More virus attacks (UPDATED)…

I have now been notified by four individuals about recent hacking attempts.  I have posted the emails these individuals received below.  There are four different messages.  I am happy to post these types of attacks, but if you receive one, please consult with an IT professional about obtaining the “email header”. This is what is most valuable to IT security professionals.  Please send me the “email header” to post (see below for an example).

Below are the four malicious emails of which I am aware:

Email 4: Targeted at one known individual

From: Suzan Park
Date: Fri, May 27, 2011 at 7:02 AM
Subject: interview questions
To:

Hi, this is Park of NCN News.
We are producing a documentary on “International Status of Northeast Asian Countries in Perspective of Soft Power”.
I was informed you are professional in this field.
It would be grateful if you could answer the interview questions about this documentary.

Documentary & Questions Link is here : Focusing on Current Situations of North Korea

Best regards!
Park

The phrase “Focusing on Current Situations of North Korea”  links to “ncnbroadcasting.reportinside.net/producer/2011FocusingOnDPRK.hta”.

The header for this email can be found below

Email 3: Targeted at one known individual

From: Pam Benson <[email protected]>

Date: Tue, May 17, 2011 at 8:08 AM

Subject: FW: Kim Il Sung:the Great Hero of Mankind(ask your comments)

To: [DELETED]

I am forwarding the feature column : “Kim Il Sung: the Great Hero of Mankind”.

This writing concerns his great achievements.

The column is very realistic and beautiful.

I guess everyone who reads this column is impressed with his history.

I wonder what you think about this writing.

Thanks.

Sincerely Yours.

Attached to this email is a MS Word document titled, “Great Leader Kim Il Sung.doc”.  Do not open this attachment.

Email 2: Targeted at two known individuals

From: David L <[email protected]>

To:

Date: Thu, 12 May 2011 00:58:07 -0700 (PDT)

Subject: final draft

It’s been a long time since I last corresponded with you.

How have you been? I hope everything is well with you, your family.

Finally, The final draft was complete yesterday.

It will be announced next Month after collecting more opinions from experts in the field.

The Current Situation and Future Prospects in Northeast Asia : JAPAN, NORTH KOREA, SOUTH KOREA, CHINA

I look forward to sharing my insights with you once I receive your assessment.

I hope to hear from you soon .

Sincerely Yours,

David in Japan

The title underlined above was actually a link to the following: http://reportinside.net/draft/fainaldraft_201105.htaXX ( I added the XX at the end to prevent anyone from accidentally linking to the server).

Email 1: Targeted at one known individual

From:

Date: 2011/4/13

Subject: contact list

To:

Prof.

attach contact list

교수님

학회 명단 첨부합니다.

The email contained an attached MS Word document which contained the virus.

Keep your eyes open folks.  This has happened before.

Here is the header information from Email #4:

Delivered-To: XXXXX
Received: by 10.229.245.145 with SMTP id lu17cs38890qcb;
Thu, 26 May 2011 23:02:14 -0700 (PDT)
Received: by 10.42.167.200 with SMTP id t8mr2928768icy.270.1306476134254;
Thu, 26 May 2011 23:02:14 -0700 (PDT)
Return-Path: <[email protected]>
Received: from nm2-vm3.bullet.mail.ne1.yahoo.com (nm2-vm3.bullet.mail.ne1.yahoo.com [98.138.91.132])
by mx.google.com with SMTP id c8si774389icw.1.2011.05.26.23.02.12;
Thu, 26 May 2011 23:02:13 -0700 (PDT)
Received-SPF: pass (google.com: best guess record for domain of [email protected] designates 98.138.91.132 as permitted sender) client-ip=98.138.91.132;
Authentication-Results: mx.google.com; spf=pass (google.com: best guess record for domain of [email protected] designates 98.138.91.132 as permitted sender) [email protected]; dkim=pass (test mode) [email protected]
Received: from [98.138.90.53] by nm2.bullet.mail.ne1.yahoo.com with NNFMP; 27 May 2011 06:02:12 -0000
Received: from [98.138.89.244] by tm6.bullet.mail.ne1.yahoo.com with NNFMP; 27 May 2011 06:02:12 -0000
Received: from [127.0.0.1] by omp1058.mail.ne1.yahoo.com with NNFMP; 27 May 2011 06:02:12 -0000
X-Yahoo-Newman-Property: ymail-3
X-Yahoo-Newman-Id: [email protected]
Received: (qmail 59400 invoked by uid 60001); 27 May 2011 06:02:12 -0000
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s1024; t=1306476132; bh=pWoXMwYQ8EQcw2SLEczW6rjq1nhYdsj2Kx5S4gyJuZI=; h=Message-ID:X-YMail-OSG:Received:X-Mailer:Date:From:Reply-To:Subject:To:MIME-Version:Content-Type; b=0wiJUxWnvCC4IzzFHsyk0chyhsI4tWNBXoJZqBhLjWBL396QPFHxId3IRmX0a79NWidPt4WpZ+CmcDW+vSMAJLRccylXv1rjEP+DHesFRkOp9B5ooez1XbEe3bYxe2WcMJDznkMBTFzrJTZo2YimAzeFP+rTB33W9maiEHM51CE=
DomainKey-Signature:a=rsa-sha1; q=dns; c=nofws;
s=s1024; d=yahoo.com;
h=Message-ID:X-YMail-OSG:Received:X-Mailer:Date:From:Reply-To:Subject:To:MIME-Version:Content-Type;
b=YCHpgXo+4TyIJbp17UXBhvIE+DNI0DmU/hQZXy83JsEAN5leR5GSEmCsdI4SZzQZd2uOgGCP/C95CjsOQXNAo2PL/RGa0ybIj5JUO5AY7TEGIevZc9sfgS5C/aO+lHbkUi+dMj7sODIrmLlwMZk+HLZ3hyeQkNF9y+oHcLZJm/Q=;
Message-ID: <[email protected]>
X-YMail-OSG: lnJOtxwVM1lRvwYV6FMNXyRQpqXH7El4eV82aOjgSG5w3sb
ESapHq6xLclsgpoEhJUOLX8HmdpHemC3l52xKBvh9hSOJoMXzs4caBgMJDJQ
IL03HLjG7xI4ViVYuvivjNFohW8Ecc_bvnVFI1IpAHdstYZuh8671c324VGl
8sJGLjfIEwlxjrC7muzGTBv26vRIZTLoejFYKARccUQw7_qbZM5ga1Gq7pyh
Aj2H3BZQGhQh08HuCcXSB1E9GyQ_N_Nwy4qSF1mSPxQUtamiEXDWypdceD14
iOArQPgs2NsH2.EmvKzszMl96XzlH8Pul4K8H9D.B3OrgxtOT2GraQUykvxx
fve4Xk94YY68VUpRePvkCpXMr.P5P0f63K3yWG86FyFm6j4BFamNwQ71bAso
VvxjvKakqW16lU1bZOSWax..ZKzqLV5avhydQy5BBd5ATb1LQVtURJGudrtc
b
Received: from [210.110.151.146] by web125220.mail.ne1.yahoo.com via HTTP; Thu, 26 May 2011 23:02:12 PDT
X-Mailer: YahooMailWebService/0.8.111.303096
Date: Thu, 26 May 2011 23:02:12 -0700 (PDT)
From: Suzan Park <[email protected]>
Reply-To: Suzan Park <[email protected]>
Subject: interview questions
To: XXX
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary=”0-1266752663-1306476132=:55224″

–0-1266752663-1306476132=:55224
Content-Type: text/plain; charset=us-ascii

Hi, this is Park of NCN News.
We are producing a documentary on “International Status of Northeast Asian Countries in Perspective of Soft Power”.
I was informed you are professional in this field.
It would be grateful if you could answer the interview questions about this documentary.

Documentary & Questions Link is here :Focusing on Current Situations of North Korea

Best regards!
Park
–0-1266752663-1306476132=:55224
Content-Type: text/html; charset=us-ascii

<html><body><div style=”color:#000; background-color:#fff; font-family:times new roman, new york, times, serif;font-size:12pt”><div>Hi, this is Park of NCN News.<BR>We are producing a documentary on “International Status of Northeast Asian Countries in Perspective of Soft Power”. <BR>I was informed you are professional in this field. <BR>It would be grateful if you could answer the interview questions about this documentary. <BR><BR>Documentary &amp; Questions Link is here :<A href=htXtp://ncnbroadcasting.reportinside.net/producer/2011FocusingOnDPRK.hta> Focusing on Current Situations of North Korea</A> <BR><BR>Best regards! <BR>Park <IMG src=”hXttp://ncnbroadcasting.reportinside.net/producer/pga/page.php?no=010″ width=1 height=1> </div></div></body></html>
–0-1266752663-1306476132=:55224–

And here is some header information from Email #3:

Delivered-To: [DELETED]

Received: by 10.229.245.145 with SMTP id lu17cs2064qcb;

Tue, 17 May 2011 00:08:45 -0700 (PDT)

Received: by 10.42.221.3 with SMTP id ia3mr277704icb.181.1305616124633;

Tue, 17 May 2011 00:08:44 -0700 (PDT)

Return-Path:

Received: from nm7-vm1.bullet.mail.ne1.yahoo.com (nm7-vm1.bullet.mail.ne1.yahoo.com [98.138.90.250])

by mx.google.com with SMTP id z27si453516ibz.114.2011.05.17.00.08.44;

Tue, 17 May 2011 00:08:44 -0700 (PDT)

Received-SPF: pass (google.com: best guess record for domain of [email protected] designates 98.138.90.250 as permitted sender) client-ip=98.138.90.250;

Authentication-Results: mx.google.com; spf=pass (google.com: best guess record for domain of [email protected] designates 98.138.90.250 as permitted sender) [email protected]; dkim=pass (test mode) [email protected]

Received: from [98.138.90.49] by nm7.bullet.mail.ne1.yahoo.com with NNFMP; 17 May 2011 07:08:43 -0000

Received: from [98.138.89.196] by tm2.bullet.mail.ne1.yahoo.com with NNFMP; 17 May 2011 07:08:43 -0000

Received: from [127.0.0.1] by omp1054.mail.ne1.yahoo.com with NNFMP; 17 May 2011 07:08:43 -0000

X-Yahoo-Newman-Property: ymail-3

X-Yahoo-Newman-Id: [email protected]

Received: (qmail 86611 invoked by uid 60001); 17 May 2011 07:08:43 -0000

DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s1024; t=1305616123; bh=YRmhoQ/kNM5QGsVIpIZM4yJ/dZh4Yc9QDNzHtAgWy1A=; h=Message-ID:X-YMail-OSG:Received:X-Mailer:Date:From:Reply-To:Subject:To:MIME-Version:Content-Type; b=SxqwX+mV7jiCVbtSqJHfkGdEf/T6XY4cA8aelRhM0hA8NPqZeuigfxak+HTmfYyMzemvSyG1t6TtzRDkVXRcRti0m3aR7T/CAX3VoRnDj5hWevgHXNrjZkCFa5hXzQanOao+WcQrc8im2FTgh0yybsLNWdPpRqwjsggAOdh8wB8=

DomainKey-Signature:a=rsa-sha1; q=dns; c=nofws;

s=s1024; d=yahoo.com;

h=Message-ID:X-YMail-OSG:Received:X-Mailer:Date:From:Reply-To:Subject:To:MIME-Version:Content-Type;

b=A/jZPcax9+pda8SDIs51AlbFD/Cu+jD0XOE5RijEz+OI8eU738GK+BeT2TsmAUF+XQ+fwzZ1Hx5SzyH2RQa1Ov4ls4xmrr/rnxrEovOjYp+kqJqxn4ZITci4sClednvB+dwPfWemFGILcrNdJH+ZpTnPB5gnL6OeCX+dxp5e8BA=;

Message-ID: <[email protected]>

X-YMail-OSG: dCgK8H8VM1kieK4XmBo5P9j5RAVlONmIR97dyZnRe5Rlirl

VOdJvUlKK1P2pqBLJiwYU6FYzyYu2GXBsTuxiZEcjt0tHWAH719rmpja_65u

VezOv9BNUzWlU2d.gD_Gqlv6V5KFaLoS7PqDG6cvMJvuOlBoHJ0fS2lUHVpi

whFEhmNgpGI7WghDdQbtTs8l_SFkXVGQ0DaG9FQFM3fWrVFHYNA5SnH.CqvE

OjKKUf9_CYlk1YeNDsIWImpGT.OMeN.MZYfhPwzgU5y16hl9BkKXk2K3iimA

gYEU41eKj4o53MPb79gUf_o3FIG7pZd8nBu0vVZJCvWPTO3t95majJfqKOhH

vt0t__sX7qcplRDW7HAKuhcJJyQpZK6Pr5NS0B7H2uiUz1WCz1jgtFrD.bhD

D4eq4tNfPibw6JchlQ1ewmoAWHy3xB3nSkVvqIQ–

Received: from [85.237.165.150] by web121110.mail.ne1.yahoo.com via HTTP; Tue, 17 May 2011 00:08:43 PDT

X-Mailer: YahooMailWebService/0.8.111.303096

Date: Tue, 17 May 2011 00:08:43 -0700 (PDT)

From: Pam Benson

Reply-To: Pam Benson

Subject: FW:Kim Il Sung:the Great Hero of Mankind(ask your comments)

To: “[DELETED]

MIME-Version: 1.0

Content-Type: multipart/mixed; boundary=”0-1151318799-1305616123=:82736″

–0-1151318799-1305616123=:82736

Content-Type: multipart/alternative; boundary=”0-1420268040-1305616123=:82736”

–0-1420268040-1305616123=:82736

Content-Type: text/plain; charset=us-ascii

I am forwarding the feature column : “Kim Il Sung: the Great Hero of Mankind”.

This writing concerns his great achievements.

The column is very realistic and beautiful.

I guess everyone who reads this column is impressed with his history.

I wonder what you think about this writing.

Thanks.

Sincerely Yours.

–0-1420268040-1305616123=:82736

Content-Type: text/html; charset=us-ascii

Share

4 Responses to “More virus attacks (UPDATED)…”

  1. Benoit says:

    You should hide your friend email address from his message, otherwise he could get increased spam…

  2. […] Aidan Foster-Carter Honorary Senior Research Fellow in Sociology & Modern Korea, Leeds University in the UK, received the email copied below. Has anyone else received this, or similar? If so, beware. It is almost certainly a virus. […]

  3. Tad @ NKNews says:

     That IP is in California…

  4. crosspatch says:

    “Received: from [85.237.165.150] by web121110.mail.ne1.yahoo.com via HTTP; Tue, 17 May 2011 00:08:43 PDT ”

    That IP is in Poland.  It appears to be a cable TV subscriber.  Probably a “bot-netted” computer (a computer with a “back door” that allows it to send traffic by remote control by a third party).

    Quite likely the person who is assigned that address did not intentionally send that email.