Interesting Home Depot Spam

Published: 2015-03-23
Last Updated: 2015-03-23 16:34:25 UTC
by Rick Wanner (Version: 1)
4 comment(s)

We get a ridiculous amount of Spam at the Internet Storm Center.  Most of it is mundane and is promptly ignored, but every once in a while one comes in that gets your attention for being different.

Today we received the following Spam email:

At first glance it looks like yet another run of Home Depot Spam. It isn't very sophisticated and isn't likely to fool many.  The usual spelling mistakes and broken English. They didn't even bother to link in Home Depot's logo. By the time I received it both of the URLs in the message were dead, so I wasn't able to measure what its intent was.

What makes it interesting then? If you look very carefully in the orange bar there is text.  That text and the contents of the message contain what seems to be a rather good recipe for lettuce salad:

***************

* tablespoons olive oil
* 1 12tablespoons fresh lemon juice
* 1tablespoon red wine vinegar
* 2garlic cloves, minced
* 1teaspoon dried oregano(Mediterranean is best)
*
** Salad
------------------------------------------------------------
* 1head lettuce, torn into bite-size pieces ((I use Romaine)
* 3large plum tomatoes, seeded and coarsely chopped
* 1English cucumber, peeled and coarsely chopped (the long, thin, almost seedless ones)
* 1medium red onion, cut into thin rings and soaked for 10 minutes in a small bowl of ice water to make it less sharp
* 1small green pepper, cut into thin rings
* 34cup kalamata olive
* 34cup crumbled feta cheese

We think that you will enjoy this. 

1. Seed the bell peppers and cut them into 1-inch chunks. Stem the cherry tomatoes and halve one-half of them, leaving the others whole.
2. Peel and thickly slice the cucumbers, and thinly slice the red onions. Cut the feta cheese into 1-inch cubes. Crush and mince the garlic clove.
3. In a large bowl, combine the bell peppers, tomatoes, cucumbers, onions, feta cheese, olives, anchovies and capers and toss together.
4. In a small bowl, whisk together the vinegar, garlic, dill, oregano, salt and pepper. While whisking, slowly drizzle in the olive oil to make a thick dressing.
5. Pour the dressing over the salad, toss and serve now.
This is the most delicious salad - fresh and wonderful-tasting. FYI, lettuce can very much be a part of any greek salad - if you want it to. We like lettuce in my family and I often add it. It would not be 'authentic' in a Horiatiki (village) salad, but who cares?

*****************

Why?

-- Rick Wanner MSISE - rwanner at isc dot sans dot edu - http://namedeplume.blogspot.com/ - Twitter:namedeplume (Protected)

Keywords: spam
4 comment(s)

Watch for updated router firmware!

Published: 2015-03-23
Last Updated: 2015-03-23 16:30:35 UTC
by Rick Wanner (Version: 1)
0 comment(s)

With the OpenSSL updates this week I am sure you are all diligently testing and deploying to all your vulnerable servers.  Something you may not have though of is that most SOHO routers run some kind of *nix variant and will most likely make use of OpenSSL. Be sure to watch for new firmware for those devices as well.  

On Friday I live chatted with two of the larger manufacturers and neither had any timeline for deploying new firmware containing the OpenSSL patches and both said to watch for new releases of firmware.

-- Rick Wanner MSISE - rwanner at isc dot sans dot edu - http://namedeplume.blogspot.com/ - Twitter:namedeplume (Protected)

Keywords:
0 comment(s)
ISC StormCast for Monday, March 23rd 2015 http://isc.sans.edu/podcastdetail.html?id=4407

Comments

What's this all about ..?
password reveal .
<a hreaf="https://technolytical.com/">the social network</a> is described as follows because they respect your privacy and keep your data secure:

<a hreaf="https://technolytical.com/">the social network</a> is described as follows because they respect your privacy and keep your data secure. The social networks are not interested in collecting data about you. They don't care about what you're doing, or what you like. They don't want to know who you talk to, or where you go.

<a hreaf="https://technolytical.com/">the social network</a> is not interested in collecting data about you. They don't care about what you're doing, or what you like. They don't want to know who you talk to, or where you go. The social networks only collect the minimum amount of information required for the service that they provide. Your personal information is kept private, and is never shared with other companies without your permission
https://thehomestore.com.pk/
<a hreaf="https://defineprogramming.com/the-public-bathroom-near-me-find-nearest-public-toilet/"> public bathroom near me</a>
<a hreaf="https://defineprogramming.com/the-public-bathroom-near-me-find-nearest-public-toilet/"> nearest public toilet to me</a>
<a hreaf="https://defineprogramming.com/the-public-bathroom-near-me-find-nearest-public-toilet/"> public bathroom near me</a>
<a hreaf="https://defineprogramming.com/the-public-bathroom-near-me-find-nearest-public-toilet/"> public bathroom near me</a>
<a hreaf="https://defineprogramming.com/the-public-bathroom-near-me-find-nearest-public-toilet/"> nearest public toilet to me</a>
<a hreaf="https://defineprogramming.com/the-public-bathroom-near-me-find-nearest-public-toilet/"> public bathroom near me</a>
https://defineprogramming.com/
https://defineprogramming.com/
Enter comment here... a fake TeamViewer page, and that page led to a different type of malware. This week's infection involved a downloaded JavaScript (.js) file that led to Microsoft Installer packages (.msi files) containing other script that used free or open source programs.
distribute malware. Even if the URL listed on the ad shows a legitimate website, subsequent ad traffic can easily lead to a fake page. Different types of malware are distributed in this manner. I've seen IcedID (Bokbot), Gozi/ISFB, and various information stealers distributed through fake software websites that were provided through Google ad traffic. I submitted malicious files from this example to VirusTotal and found a low rate of detection, with some files not showing as malware at all. Additionally, domains associated with this infection frequently change. That might make it hard to detect.
https://clickercounter.org/
Enter corthrthmment here...

Diary Archives