I got an interesting email today. The contents of which are below (links weren’t suspicious, but were removed):<\/p>\n
Please open the attached document. It was scanned and sent to you using a Xerox WorkCentre Pro.<\/span><\/p>\n
Sent by:\u00c2\u00a0the-espositos.net<\/span><\/span><\/span>
\nNumber of Images: 1<\/span>
\nAttachment File Type: ZIP [PDF]<\/span><\/p>\nWorkCentre Pro Location: Machine location not set<\/span>
\nDevice Name: B5SQ1CXA7J<\/span><\/p>\nAttached file is scanned image in PDF format.<\/span>
\nAdobe(R)Reader(R) can be downloaded from the following URL:\u00c2\u00a0http:\/\/www.adobe.com\/<\/span><\/span><\/span><\/p><\/blockquote>\nIt had a ZIP file attached. \u00c2\u00a0Looks pretty legit, right? Except, I don’t own a Xerox anything. Now the company I work for may, but anyone sending me documents from work wouldn’t appear to be coming from my personal domain. But being who I am, I had to open it to see what was inside.<\/p>\n
Taking precautions, I saved the attachment and scanned it. No viruses. Disappointing. Maybe it’s sophisticated enough that there isn’t a signature for it yet? So, I used a “non-standard” method of unzipping it, which would not execute any binary code within. I was really expecting a sophisticated attack vector. \u00c2\u00a0I thought I’d actually get a PDF file that I’d be tricked into opening with the latest version of Adobe that I was just instructed to download. So, I’d open the PDF, with new software I trusted, downloaded from a verified source and still be subject to an exploited flaw that would compromise my system. What a Zero day attack that would have been!<\/p>\n
I was planning how to identify the flaw and counter it’s effects (I will admit I was pretty clueless here, getting ready to allow my VM to succumb to the attack while another VM snooped and recorded all the outbound ethernet traffic), when I looked and saw a lone .exe file sitting all alone and vulnerable in the directory. Scanning it produced nothing also. So it was just a lame windows Trojan exe.<\/p>\n
I was hoping with the creative nature of the introduction to this threat, that we’d have something exciting and potentially dangerous. But sadly it was just a new dress on an old pig.<\/p>\n
Remember, don’t open attachments in email if you don’t know what they are. If it was something important, someone you know would say, “Did you get the images I sent you the other day?” To which you can reply, “No, send them again. Um, were they safe for work?”<\/p>\n
Virtual Machines deleted. A lot of work for nothing.<\/p>\n","protected":false},"excerpt":{"rendered":"
I got an interesting email today. The contents of which are below (links weren’t suspicious, but were removed): Please open the attached document. It was scanned and sent to you using a Xerox WorkCentre Pro. Sent by:\u00c2\u00a0the-espositos.net Number of Images: 1 Attachment File Type: ZIP [PDF] WorkCentre Pro Location: Machine location not set Device Name: … [Read more…]<\/a><\/span><\/p>\n","protected":false},"author":3,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[20],"tags":[],"class_list":{"0":"entry","1":"post","2":"publish","3":"author-siteuser","4":"post-232","6":"format-standard","7":"category-technical"},"_links":{"self":[{"href":"https:\/\/andrew.the-espositos.net\/blog\/wp-json\/wp\/v2\/posts\/232","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/andrew.the-espositos.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/andrew.the-espositos.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/andrew.the-espositos.net\/blog\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/andrew.the-espositos.net\/blog\/wp-json\/wp\/v2\/comments?post=232"}],"version-history":[{"count":0,"href":"https:\/\/andrew.the-espositos.net\/blog\/wp-json\/wp\/v2\/posts\/232\/revisions"}],"wp:attachment":[{"href":"https:\/\/andrew.the-espositos.net\/blog\/wp-json\/wp\/v2\/media?parent=232"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/andrew.the-espositos.net\/blog\/wp-json\/wp\/v2\/categories?post=232"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/andrew.the-espositos.net\/blog\/wp-json\/wp\/v2\/tags?post=232"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}