ANTenna Blog -- Security

Odds are you or someone in your business have received some dangerously convincing e-mails in the last few days. Mail that claims to come from Microsoft, warning of Conficker infections and, more dangerously, mail that appears to be from your administrator at your own domain, announcing a server upgrade. They're phishing attacks, of course, and particularly nasty ones.

The surge in botnet-launched phishing attacks, and particularly the convincing (to unwary or only partly wary users) nature of the messages they carry should be met with quick, in-depth, and serious warnings to all of your employees.

No matter how much they know or think they know about protecting themselves from phishmail and the malware links they hold.

The extraordinary leap in the number of fake anti-virus messages this year is now taking new and both more personal more official-looking twists, either of which can catch users off-guard.

The phony Microsoft Conficker warning messages, including offers of cleanup tools, plays a doubles game, both a fake message from a real company and an offer of cleanup tools that don't exist.

Let your people know that a) "Microsoft Windows Agent" messages about infections and cleanups should be deleted immediately (and, preferably, blocked before they reach their targets) and ) no cleanup tools or anti-virusware should ever be installed with approval of your systems administrator.

Speaking of systems administrators, another of the variants making the rounds appears to be a message from your admin, using the recipient's own domain, letting them know that their e-mail account is being upgraded for security and other reasons, and that their participation is required in the form of clicking an included link.

The link, needless to say, launches an infection, in this case the ZeuS Trojan/Zbot banking information thief.

Time to remind everyone of the evolving nature of phishing campaigns, and to put together a memo that clearly identifies what sorts of messages your legitimate systems administrators will use when contacting employees -- and, crucially, what sorts of messages you won't use.

Unfortunately, considering the speed of threat evolution and the variety of new approaches and techniques the phishers are using, the second half of that memo will almost undoubtedly have to be updated constantly.