World of Warcraft phishing scams

Blizzard's MMORPG World of Warcraft is one of the most popular games out there, and its players are among the most targeted by online scammers.

It is common knowledge that login credentials for WoW accounts are very much sought after by phishers, so TrendLabs warns about a couple of scams currently going around.

The in-game chat/whisper system is often used to lure players to phishing sites. The phishers usually pose as Blizzard employees or unknown players and "whisper" to the victim that they have been selected for receiving a free gift or that their account has been flagged as hazardous:

In both cases, the victims are urged to follow the offered link that will take them to a phishing page where they are supposed to register with their account credentials in order to receive the gift/prevent the suspension of their account.

Recently, WoW's in-game mail system has also been employed to deliver similar malicious messages to players:

To add to the credibility of the message, the text and the offered phishing URL make many references to WoW and other Blizzard games. Just as a side note - the phishing website domain is registered and hosted in China. The website in itself resembles very closely the official Battle.net site, making it easy for some people to fall for the scam.

Blizzard is aware of these phishing attempts, and has made it their business to intensify its efforts when it comes to informing the players about them on Battle.net’s security page. They have also made it possible to report scammers from within the game (see, for example, the "Report Spam" button in the in-game mail system).

Google warns Gmail users on spying attempts from China

Recently, a number of users have been witnessing a glaring red banner popping up when they accessed their Gmail account, saying "Warning: We believe your account was recently accessed from: China (IP ADDRESS)".

ThreatPost reports that among the seemingly random victims - gamers, doctors, media consultants - was also one Alexander Hanff of Privacy International in the UK.

Even though his Gmail account is wholly unconnected with his work for the human rights organization, he says that it is possible that he was targeted because of a EU-China Human Rights Network seminar during which he discussed freedom of speech issues and differences between the EU and China on that account.

All users who have been similarly warned are advised by Google to change their passwords. Technolog asked Google to comment on the occurrence, and they said that the banner is simply part of the security feature introduced in March.

"To determine when to display this message, our automated system matches the relevant IP address, logged per the Gmail privacy policy, to a broad geographical location. While we don't have the capability to determine the specific location from which an account is accessed, a login appearing to come from one country and occurring a few hours after a login from another country may trigger an alert," they commented.

PayPal expands consumer protection

Beginning Nov. 1, 2010, shoppers around the world will have expanded buyer protection when they make purchases at the millions of retailers that accept PayPal.

The expanded protection will cover shoppers on merchant websites if they don’t receive an item they purchased, or if they receive an item that is significantly different than described by the merchant.

PayPal will extend these additional benefits to shoppers in all countries it serves except Belgium, Brazil, France, Italy, the Netherlands, Poland and Spain.

PayPal provides protections for both buyers and sellers in addition to the safeguards that are built into the PayPal system:

• Because PayPal never shares a buyer’s financial information with sellers, privacy is built into the service.
• PayPal provides zero liability for eligible unauthorized transactions on PayPal accounts.
• PayPal has one of the most sophisticated anti-fraud models in the payments industry, which gets smarter and stronger with every transaction that goes through our system – and PayPal has processed billions of transactions in the past 11 years. With this technology, PayPal often detects and stops fraudulent activity the moment it occurs and before it ever reaches our customers.

"Girl killed herself" Facebook scam returns

If the title of the "Girl killed herself, after her dad posted This to her Wall" Facebook page sounds somewhat familiar, it is because almost two months ago the very same sentence came up popped up on many a user Wall, in connection with a supposed Trojan infection.

There must be something in the title that made a lot of impact, because here it is - trotted out for another scam.

The user sees it on a friend's Wall, follows the link to the page, where a warning about possible inappropriate content pops up. After getting it out of the way, another pop-up window appears, in which the user has to prove that he is human and not a bot:

Unfortunately for him, this simple test is there to hijack his clicks and use them to post the unfortunate message on his Wall, in order to spread the scam further.

In the end, the user is asked to participate in one of several surveys offered so that he is finally allowed to access the content he wanted to see. But, tough luck, the only thing that will actually happen if he does complete a survey is that the scammers will try to make him sign up to premium rate services.

I know it is sometimes difficult to resist the lure of an interesting caption, but you must learn that things like these are rarely (if ever) benign.

Twitter Fixes Mouse-Over Flaw

The Twitter mouse-over vulnerability, which caused grief for thousands upon thousands of Twitter users has been patched and resolved. The bug which was first reported at 2:54 am PDT on Tuesday was declared gone by 6:50 am PDT.

As short lived as it was, people are constantly tweeting. A 2009 study on pingdom.com showed the average number of tweets sent reaches above 1.1 million each hour. That's nearly 4.5 million tweets during the four hour span in which the worm was active. The way it worked was that a person could tweet a maliciously crafted link which included the "onmouseover" javascript code. When the link was touched by a user's mouse (not clicked, just the mouse running overtop of the link) that user's account tweeted the same link, while opening a third party website in the user's browser. There were several high-profile Twitter accounts affected, including White House Press Secretary Robert Gibbs and Sarah Brown, the wife of former British Prime Minister Gordon Brown.

This is not the first time that Twitter has combated this type of exploit on their site. Last month, the site faced similar attacks. These were fixed on August 24th. During an update of the site this fix was somehow reversed, which allowed the attacks to continue. Twitter tweeted a message of their status when the bug was reported, and updated it when they finished re-patching the hole. They then blogged on the site describing in greater detail the onmouseover flaw, how it had resurfaced from the problem they experienced last month, and reassuring their users that account security had not been breached.

Luckily, this exploit only affected those people who were using the actual twitter site. Those who use third-party or mobile applications to tweet and read tweets were completely unaffected.

Fake "universal" iPhone jailbreaking exploit contains Trojan

When Apple released iOS 4.0.2 which, among other things, patched the vulnerabilities that allowed iPhone owners to jailbreak their device, these users were faced with the question "To upgrade or not to upgrade?"

But, buyers of iPhones with iOS 4.0.2 or 4.1 already preinstalled didn't have that choice - and they still don't. And even though a hacker announced that he was working on an exploit that will change this and will allow users to jailbreak any existing or future iPhone or iPad (regardless of the iOS version), this exploit is yet to see the light of day.

And here is where malware peddlers enter the arena.

Being aware that the jaibreaking community is eagerly waiting for the solution to come out, they thought of trying to use the hype to push some of their malicious wares.

According to Kaspersky Lab expert Costin Raiu, the awaited exploit is supposed to be called "Greenpois0n", so they named the .rar archive that contains the information-stealing Trojan greenpois0n_By pOsixninja and made it available for download on popular torrent sites.

Websites selling fake tools that can supposedly jailbreak any iPhone with any iOS have also appeared. Selling these tools for a price that goes up to $40, they are also trying to capitalize on the users' lack of patience.