Re: Phishing/scam attempt (was Fwd: UPDATE YOUR E-MAIL SEC...)

On Fri, July 15, 2011 11:33 pm, Geert Mak wrote:
> spamassassin decided this is spam?

A quick look through the email says SA is very likely right (technically,
it's a phishing attempt, not spam, but...)

> Begin forwarded message:
>
>> From: "Squirrel Mail Development Team"<[email protected]>

Wrong sender email address, wrong spelling (it's squirrelmail, not
"squirrel mail")

>> To: undisclosed-recipients:;

Missing recipient email address (should have the SM announce list there)

>> Subject: UPDATE YOUR E-MAIL SECURITY IMMEDIATELY (IUEU)

All-caps subject, missing the list header (the equivalent of [SM-DEVEL] 
for the announce list)

>> Dear E-Mail User
>>
>> Due to the package compromise of 1.4.11,1.4.12 and 1.4.13, we are forced
>> to release 1.4.15

Quick quiz: what's the latest 1.4.x release? (hint: it was announced less
than 3 weeks ago)

 to ensure no confusions. While initial review didn't
>> uncover a need for concern, several proof of concepts show that the
>> package alterations introduce a high risk security issue, allowing
>> remote inclusion of files. These changes would allow a remote user the
>> ability to execute exploit code on a victim machine, without any user
>> interaction on the victim's server. This could grant the attacker the
>> ability to deploy further code on the victim's server.

Wording/grammar scream "ESL speaker" to me (this isn't bad per se, and
wouldn't prove anything by itself, but it's another indication that
something's off).

>> So upgrade to  Squirrel Mail Development Team by  click Squirrel Mail
>> Login SquirrelMail 1.4.15 Released

I'm guessing there was a link to an attack/compromised/phishing webpage
there.


------------------------------------------------------------------------------
AppSumo Presents a FREE Video for the SourceForge Community by Eric 
Ries, the creator of the Lean Startup Methodology on "Lean Startup 
Secrets Revealed." This video shows you how to validate your ideas, 
optimize your ideas and identify your business strategy.
http://p.sf.net/sfu/appsumosfdev2dev
-----
squirrelmail-devel mailing list
Posting guidelines: http://squirrelmail.org/postingguidelines
List address: [email protected]
List archives: http://news.gmane.org/gmane.mail.squirrelmail.devel
List info (subscribe/unsubscribe/change options): https://lists.sourceforge.net/lists/listinfo/squirrelmail-devel