ebil phishers

[Lachlan]

I got an interesting spam (phishing) e-mail today that had a clever way to bypass my spam filters. It showed up in my mail client with a lot of the letters jumbled up but it was still readable (kind of like that old e-mail that went around about how the letters in the middle of the word could be jumbled up but your mind could assemble it if the first and last letters were correct). Such as:

Aoccdrnig to a rscheearch at Cmabrigde Uinervtisy, it deosn't mttaer in waht oredr the ltteers in a wrod are, the olny iprmoetnt tihng is taht the frist and lsat ltteer be at the rghit pclae. The rset can be a toatl mses and you can sitll raed it wouthit porbelm. Tihs is bcuseae the huamn mnid deos not raed ervey lteter by istlef, but the wrod as a wlohe.

Anyway, so the e-mail looked thusly in my e-mail client:

Drae Blcraays Mrebme,

Tsih eamil was snet by the Balcrays serevr to vreify yoru eiaml arddess. You muts celpmote tsih prcoess by clicnikg on the likn bleow and engniret in the slaml windwo yoru Blcraays Membsrehip nbmuer, pcssaode and mlbaromee word. Tsih is deno for yuor petorction - beuacse smoe of our membesr no legnor haev acecss to tehir eliam ardesses and we mtsu vfiry it. To vfirey yruo emlia aerddss and acssec yruo bakn acnuoct, clkci on the lkni bwole:

Then I went to copy/paste the text to a buddy over IM so he could see how it was jumbled, but when I pasted it, the text was correct!

Dear Barclays Member,

This email was sent by the Barclays server to verify your email address. Your must complete this process by clicking on the link below and entering in the small window your Barclays Membership number, passcode, and memorable word. This is done for your protection - because some of our members no longer have access to their e-mail addresses and we must verify it. To verify your e-mail address and access your bank account, click on the link below:

That was odd, so I decided to paste it into notepad. What notepad revealed is an extra ascii character surrounding the letters which were jumbled (notice the letters aren't merely jumbled, but reversed). Apparantly Windows interpreted the ascii characters when pasted and put them in the correct order!

So, they bypassed the spam filter because the letters were jumbled, but Windows is kind enough to display the whole text in the correct order. Luckily, I use Thunderbird which just suppressed the extra ascii characters and left them jumbled.

If some of these people would put all of this energy to something good, who knows how far techonoly would advance!

[Lev]

I got an interesting spam (phishing) e-mail today that had a clever way to bypass my spam filters. It showed up in my mail client with a lot of the letters jumbled up but it was still readable (kind of like that old e-mail that went around about how the letters in the middle of the word could be jumbled up but your mind could assemble it if the first and last letters were correct). Such as:

Aoccdrnig to a rscheearch at Cmabrigde Uinervtisy, it deosn't mttaer in waht oredr the ltteers in a wrod are, the olny iprmoetnt tihng is taht the frist and lsat ltteer be at the rghit pclae. The rset can be a toatl mses and you can sitll raed it wouthit porbelm. Tihs is bcuseae the huamn mnid deos not raed ervey lteter by istlef, but the wrod as a wlohe.

Anyway, so the e-mail looked thusly in my e-mail client:

Drae Blcraays Mrebme,

Tsih eamil was snet by the Balcrays serevr to vreify yoru eiaml arddess. You muts celpmote tsih prcoess by clicnikg on the likn bleow and engniret in the slaml windwo yoru Blcraays Membsrehip nbmuer, pcssaode and mlbaromee word. Tsih is deno for yuor petorction - beuacse smoe of our membesr no legnor haev acecss to tehir eliam ardesses and we mtsu vfiry it. To vfirey yruo emlia aerddss and acssec yruo bakn acnuoct, clkci on the lkni bwole:

Then I went to copy/paste the text to a buddy over IM so he could see how it was jumbled, but when I pasted it, the text was correct!

Dear Barclays Member,

This email was sent by the Barclays server to verify your email address. Your must complete this process by clicking on the link below and entering in the small window your Barclays Membership number, passcode, and memorable word. This is done for your protection - because some of our members no longer have access to their e-mail addresses and we must verify it. To verify your e-mail address and access your bank account, click on the link below:

That was odd, so I decided to paste it into notepad. What notepad revealed is an extra ascii character surrounding the letters which were jumbled (notice the letters aren't merely jumbled, but reversed). Apparantly Windows interpreted the ascii characters when pasted and put them in the correct order!

So, they bypassed the spam filter because the letters were jumbled, but Windows is kind enough to display the whole text in the correct order. Luckily, I use Thunderbird which just suppressed the extra ascii characters and left them jumbled.

If some of these people would put all of this energy to something good, who knows how far techonoly would advance!

That's pretty cool, can your forward me the spam? I'd like to pass it around my office as a "cool" sort of thing, i'll pm you my work email (i do security consulting now)

[Lachlan]

You got it.

[Chosen One]

me too plz