FYI...

More IRS scams...
- http://www.us-cert.gov/current/#internal_revenue_service_tax_scams
March 31, 2008 - "US-CERT is aware of a series of scams circulating that are related to the United States Internal Revenue Service. The first of these attacks attempts to convince users to open bogus tax documents that may contain malicious code.
Additional attacks attempt to convince users to follow a link in an email message to an unofficial tax website that may contain malicious code or request personal information as part of a phishing scam..."

Updated...

- http://www.us-cert.gov/current/#internal_revenue_service_tax_scams
updated April 1, 2008 - "US-CERT is aware of a series of email scams circulating that are related to the United States Internal Revenue Service. Attacks have been observed that use email to convince users to perform the following actions:
* open an email attachment containing bogus tax documents that are embedded with malicious code
* follow a link to an unofficial tax website that contains malicious code
* follow a link to an unofficial tax website that requests personal information from the users as part of a phishing attack
* call an unofficial phone number that requests personal information from the user as part of a phishing attack..." (Vishing)

FYI...

- http://blog.trendmicro.com/phishers-raise-their-voices/
April 2, 2008 - "This technique — more popularly (and creatively) known as “vishing” — uses the all-too-familiar spammed email message format as initial bait... This time, however, the striking difference from past phishing emails is that instead of a malicious URL, the message contains a number that users are encouraged to call for information on possible “tax refunds.” An automated voice recording answers queries and asks callers for sensitive information: credit card and social security numbers, for instance. The timeliness of this attack is evident as deadline for filing taxes is nearing. Users may have learned to not trust unknown links; this time Trend Micro advises users to be extra careful in disclosing information even to “customer service” numbers as well."

(Screenshots of the phishing/vishing emails available at the URL above)

FYI...

- http://isc.sans.org/diary.html?storyid=4237
Last Updated: 2008-04-04 15:52:01 UTC - "With tax day getting closer in the U.S., the number of reports on related social engineering tricks are picking up as well. The e-mails are basically a re-hash of the Better Business Bureau scams that we covered a while back. As the e-mails still seem to be targeting mainly executives of a firm, the trick might still work. The current emails contain text in the style of

Dear [Name of Executive]
I am sorry but in order for [Name of Firm] to get a tax refund, all the fields must be completed.
Please complete the missing fields on the attached form and re-send it to me.

nicely adorned with bells&whistles to make it look like it really comes from the IRS. Another series uses the old "A tax complaint has been filed against you" line, which probably is less likely to get the Execs to click. But who doesn't want a refund... Thanks to all ISC readers who have sent samples of this scam over the past days."

FYI...

- http://blog.trendmicro.com/more-irs-malware-as-us-tax-deadline-looms-cyber-criminals-ramp-up/
April 8, 2008 - "...As expected, cyber criminals have renewed their illicit campaigns to bilk consumers of their money, but also infected them with malware intended to perpetrate identity theft. This sort of effort to fraudulently victimize consumers during the rush up the filing deadline (April 15th) of the U.S Tax season generally always shows up this time of year, but the social-engineering and sophistication continually evolves to ensnare as many victims as possible. This year is no exception. Earlier today, Trend Micro researchers began to receive reports of a new, targeted spam campaign which are specifically targeted to high-profile companies — some of them being Fortune 500 companies and U.S. Defense contractors — which would indicate that financial fraud is not the only intended goal of these criminals. Given their targets, they are possibly also looking to infiltrate high-profile companies for other, perhaps more insidious, reasons. The malicious spam messages all look similar to the image above, and all have a subject line that are identical in format, yet crafted for each individual company:

“Re:tax contract for [company name], Inc.”

The MS Word attachment harbors a Trojan (which Trend Micro will detect as TROJ_DELF.HAV), and if opened, tells the user that “…Microsoft Word has encountered an error and needs to close. Please double click the icon to reload…” — which will initialize the Trojan. Internet users are reminded that they should NEVER open unsolicited e-mail attachments..."

(Screenshot available at the URL above.)

The FBI does have investigators dedicated to these crimes, but many of the scammers are operating in countries where there either is no law against these scams, or where the authorities will wink at it as long as the only victims are foreigners. It's more an issue for the State Department than the FBI trying to get those countries to cooperate in pursuing internet crime.

That's not to say there aren't plenty of scammers within the US or in countries that cooperate in investigations. To some extent it appears nothing is being done because internet crime is so rampant that even the recent arrests of large numbers of scammers and of prominent scam sponsors didn't cause a perceptible drop in the spam in your inbox. (And spammers being stupid, some will continue to spam after they are raided and their computers seized or even while out on bail awaiting trial after an arrest, despite the obvious fact that their activity is being monitored.)

The other issue is that the feds work very methodically with an emphasis on catching criminals rather than preventing crime. They will allow scammers to continue to operate while keeping them under surveillance, moving in after the criminals are so overconfident and sloppy that there is overwhelming evidence of their crime and of their understanding that it was illegal when they did it. At that point, the best a high-priced spammer lawyer may be able to do for his client is to negotiate a plea bargain to reduce the prison term a bit.

But knowing that there is more crime than law enforcement manpower to investigate it all, some of what we do here with PIRT/MIRT/SIRT is do some of the legwork gathering evidence, contributing both our knowledge of what information is needed by investigators as well as our understanding of spam and what spam operations need to be the highest priority. (Insert plug here for more SIRT volunteers )

FYI...

- http://www.fbi.gov/cyberinvest/cyberhome.htm
"The FBI's cyber mission is four-fold:
first and foremost, to stop those behind the most serious computer intrusions and the spread of malicious code;
second, to identify and thwart online sexual predators who use the Internet to meet and exploit children and to produce, possess, or share child pornography;
third, to counteract operations that target U.S. intellectual property, endangering our national security and competitiveness; and
fourth, to dismantle national and transnational organized criminal enterprises engaging in Internet fraud..."

All times are GMT