W32/Nuwar@MM: Its Raining Postcards!

McAfee Avert Labs has observed a spurt in the number of spam emails that entice users into visiting sites hosting exploits that would result in a drive-by download. With administrators filtering executable attachments at the mail gateway and most email clients preventing a user from opening an executable attachment, virus authors are constantly improvising to stay ahead in the game.

Social engineering – the oldest trick in the book along with the fatal combination of human stupidity + curiosity provides ample fodder for virus authors to lure new victims ; the innumerable newbie users of the internet being the low hanging fruit.

The latest spam doing the rounds contains all the elements of this tried and tested plot. A user receives an email titled “You’re received a postcard from a family member!” in his inbox and is requested to open the link contained in the message body in order to view the virtual postcard. What greets the user on visiting the link is a cocktail of browser and application exploits that attempts a drive-by install of malware on the users machine. A copy of the spammed email with the malicious link sanitized is as follows:

Most internet users are ignorant of the fact that one can get infected just by merely visiting a malicious website – without any user intervention whatsoever. And to add to these woes, thousands of legitimate sites are being compromised and abused to infect unsuspecting users.

Each infected machine becomes a spam zombie – receiving content to spam via p2p protocol and relaying thousands of emails per minute. Displayed is a screenshot of an internal honeypot capture of an infected machine spewing spam. One can view tens of mails being sent by the second.

With the average home computer having better bandwidth and processing power these days, the volume of spam that can be generated by a network of compromised zombie machines can be mind boggling. McAfee Avert Labs users are protected against this threat at the gateway level by McAfee SpamKiller, Secure Internet Gateway, Secure Messaging Gateway, and at the desktop level by McAfee VirusScan products using the latest definitions.