Wow, this phishing season is really stepping up – three attempts today and it’s only early afternoon.

I hadn’t seen this ‘You have remaining funds in your account, [target email address]’ one before, but I got two of them today.

Coincidentally, I received them about the same time as I had two calls on my cellphone from Caller ID  ‘+00 1 00’.

I answered the first call and was subjected to a faint but clear stream of what sounded like a female Asian woman speaking in a language I didn’t recognise. She didn’t respond to anything I said, and there was ringing signal in the background like a call waiting to be merged. I hung up. I just ignored a second call which came in with the same Caller ID.

Those calls may have nothing to do with the phishing emails. I don’t know.

Naturally, I didn’t respond to this. You shouldn’t either if you receive it. Ridiculous.

The third phishing email I got (today) purports to be from the ANZ bank. (Similar to this one ‘Another day, another phish‘ earlier in the week, and sent to the same email address as that.

Fake fake fake. They really are scumbags doing this.

In this case,the ‘Start’ button would take to you
https:// redirect.businessresultsrevolution [dot] com/ <DON’T CLICK THIS. And the sender address, far from being anything to do with ANZ Bank is a human-sounding address at xtra.co.nz

It makes you wonder if any selection process is engaged to identify targets. Probably not.

ANZ Bank, to its credit, has published a warning on its website …

Click to read the warning page at ANZ bank website (the real one!)

– P

I’m still not taking these personally.

This is clearly fake…(i.e. Not really from Apple. Looking behind the sender, the address is kiwe@ovcsexn.com and the link goes to a domain using a Twitter t.co URL shortener. Very unApple-like.)

Oh gee, really? Will these phish attacks never end?

Again, you’re in for a hard time if you actually click on these things, but hey, it’s a numbers game for these deceitful guys, whatever they’re actually after.

I listened to Susan Glasser’s Global Politico podcast with John Podesta (Clinton campaign manager whose gmail was hacked after a very sophisticated phish) this week and it was interesting to hear his take on the whole thing. He doesn’t blame the assistant who clicked on the link, nor the technical expert she consulted who said it was OK to do so.

Podesta: You know, look, there’s a long, complicated story about that. I had assistants that had access to the link. One of them checked what—one of them saw this question, changed the password, asked our cybersecurity expert. He inadvertently told her to click on it, and she did. So, I don’t blame them. I mean, it was, you know, a fast-moving campaign. It’s easy to say, oh, if you’ve already done this and that and the other thing—I think we’re—I’m, you know, I’ve been around for a while. I’m fairly careful. I don’t just go click on random links, and—but, you know, if—I’m sure that if I had gotten the advice to go ahead and click on it, I probably would have done it, too, so you know, it is what it is. And people make mistakes. And if you look—if you think about it, the Bundestag has been hacked, you know, the Norwegian defense department has been hacked, the White House was hacked by the Russians, and the State Department’s been hacked. It’s like, I think you can’t come back and blame the victim for this. This was a crime; it was painful. You know, I thought I was, you know, had a relatively secure profile. It turned out I didn’t, but a lot of other people have fallen prey to fairly sophisticated hackers that are operating under Russian intelligence. In this case, most likely, from the GRU, but it’s Russian military intelligence. It’s pretty sophisticated, so they did this. So, it is what it is. I can’t really beat myself up or beat my team up over that. I just have to move on, and you know, they committed a crime. I was a victim of the crime.

“It was painful” sounds like an understatement!

I’ve been thinking about what I leave accessible online lately. I try to keep it light and tight, and to download things off the server, (or encrypt tightly and protect what’s left up there). But none of us is immune. And if you read this Motherboard article referred to by John Gruber, Russian Hackers Are Using Google’s Own Infrastructure to Hack Gmail Users  you too might start to see gmail might just be a bad place to be, despite their wonderful security (these days) and legal teams protecting your privacy etc etc.

Anyway, take care.

– P

As if we need this stuff floating around. Remember: Don’t click!

These things look pretty sophisticated. Some people will be fooled.

I’m still not taking this personally.

– P

I got this by email tonight:

FAKE. If you get one, do NOT ‘Click Here’. It’s not really from Apple.

You can’t be too careful. The ‘Click Here’ link goes off to a php page citing Ottawa, and the sender, far from being Apple, shows up as a local (i.e. xtra.co.nz) email address – probably hacked.

Drop me a line if you’re a security researcher and you want a copy of the full email with headers etc.

I don’t take this stuff personally – just like I don’t take the threats and abusive stuff that’s directed my way by obviously upset, frustrated people who appear to have a capacity to dish it out which isn’t matched by their ability to take it.

– P