About Me

Chris Barton
Having been with "big red" since the Dr Solomons acquisition Chris has seen many come and go but is never content to be ...

Blogs

Consumer (478)
Corporate (155)
Enterprise (466)
McAfee Labs (1126)

Tags

#SecChat $1 million guarantee 12 Scams of Christmas access to live fraud resolution agents Acquisition Alex Thurber Android antivirus Apple botnet Channel Partners cloud security Compliance Consumer counter identity theft credit card fraud and protection credit fraud alerts credit monitoring credit monitoring and resolution critical infrastructure Cyber Security Mom cyberbullying Cybercrime cybermom data breach data center data center security Data Protection Dave DeWalt DLP Email & Web Security embedded encryption Endpoint Protection enterprise facebook fake anti-virus software Family Safety Friday Security Highlights global threat intelligence google government Hacktivism how to talk to kids how to talk to teens identity fraud identity fraud scams identity protection identity protection $1 million guarantee identity protection fraud identity protection surveillance identity surveillance identity theft identity theft expert identity theft fraud identity theft protection identity theft protection product Identity thieves and cybercriminals intel iphone kids online behavior lost wallet protection malware McAfee McAfee Channel McAfee Family Protection McAfee Identity Protection McAfee Initiative to Fight Cybercrime McAfee Labs McAfee security products Mid-Market Mobile mobile malware mobile security monitor credit and personal information Network Security online personal data protection online safety Operation Aurora PCI personal identity theft fraud personal information loss personal information protection phishing privacy proactive identity protection proactive identity surveillance Public Sector restore credit and personal identity Risk and Compliance scam scams scareware security smartphones social media social networking social networks spam Stuxnet twitter vulnerability Web 2.0 work with victim restore identity

McAfee Labs :

Microsoft's SkyDrive beta abused by spammers.

Tuesday, January 8, 2008 at 8:27am by Chris Barton

“If its free and worth abusing, discovery time is the variable these days.”
(Or rather… spammers are the bane of free services…)

Our labs trapped many thousands of spam overnight that are abusing the Windows Live SkyDrive Beta service launched in August last year (or rather it’s the new name for Windows Live Folders…). The service allows you to upload up to 1Gb of files and share them with anyone via weblinks. The trapped pill spam promises the usual assurances:

We sell only fda prescription medicine through our fully licensed
pharmacy. orders are overseen by licensed accredited physicians.

http://hostname.bay.livefilestore.com/..Long-url…/adv-filename.html

{english textual bayes poison}

The payload is an html file with just one line of HTML at the moment, that redirects your browser to the current incarnation of spammers pill-serv:

<html><body><script language=JavaScript>window.location.replace( "http://top10epharms.com")</script></body></html>

We’d expect this to change to obscured script or meta redirection in the not to distant future.

It’s not just spam either, the technique has also been spotted in the labs on blogspot splogs too.

So what makes services like these worth abusing and attractive to spammers?

Unique urls
Domains relatively safe from blacklisting
Link longevity
abuse handling issues
Features – host *almost anything*
Great Price
Someone else pays the hosting costs

It’s a great value proposition for abuse isn’t it? Well not really, it the same proposition as just about ever other file sharing service out there, this one just got hit, big, suddenly. Another interesting point is the number of times we trapped each url was interestingly low for such a big campaign, I’d therefore estimate they had tens of thousands of files uploaded. We’ve seen a few small scale spam using SkyDrive service dating back to November last year but were on an much smaller scale to last nights campaign. I’m sure it won’t be too long before it’s used to host other unwelcome content types I’d like to see more of these online file storage offerings malware scanning downloads too.

They have a pretty good terms of service document that this spammer is clearly in breach of. I will be honest and say that I am not going to fill out an online abuse form for every individual url though! SkyDrive folks – feel free to get in touch if you’ve not had enough reports

If you try SkyDrive be sure to leave feedback and suggestions here and here, it looks very neat so far.

About Me

Feeds & Podcasts

Blogs

Meet the Bloggers

Archive

Tags

Microsoft's SkyDrive beta abused by spammers.

Submit your own comments / message for this post

Comments (0)