RE: Hotfix/phishing spam

2014-08-16 Thread Karsten Bräckelmann
On Thu, 2014-08-14 at 19:37 -0500, John Traweek CCNA, Sec+ wrote: > Usually an end user has to request the hotfix and fill out a form on > the MS site and then MS will send out an email with the URI. Pardon my ignorance, but... WHY!? Why would anyone require filling out a web form, to send an aut

Re: Hotfix/phishing spam

2014-08-15 Thread Alex
Hi, >> That's a really good question. >> >> Perhaps it was a malware attempt and the attacker forgot to replace the valid MSFT URL with their own URL... > > This isn't the first time I've seen ratware malfunction. Other possibility > some scammer test-driving a shiny new toy but wants to first tes

Re: Hotfix/phishing spam

2014-08-14 Thread David B Funk
On Thu, 14 Aug 2014, John Hardin wrote: On Thu, 14 Aug 2014, Alex wrote: Microsoft outsourcing their tech-support that badly? I don't think so. Right, that was my point. The sender is not one of my trusted users, yet the link in the body seems legit. So what's the point of this spam? Just a

Re: Hotfix/phishing spam

2014-08-14 Thread Alex
Hi, Microsoft outsourcing their tech-support that badly? I don't think so. >>> >> >> Right, that was my point. The sender is not one of my trusted users, yet >> the link in the body seems legit. >> >> So what's the point of this spam? Just a misconfigured machine somehow? >> > > That's a really g

Re: Hotfix/phishing spam

2014-08-14 Thread John Hardin
On Thu, 14 Aug 2014, Alex wrote: Hi, But when they do I doubt that they do it via Yahoo from somebody in Bangladesh. Looking at the headers in that pastbin example, the originating IP is 114.31.4.36 which looks like it's from a cyber-cafe in Bangladesh. Microsoft outsourcing their tech-supp

Re: Hotfix/phishing spam

2014-08-14 Thread Alex
Hi, > But when they do I doubt that they do it via Yahoo from somebody in Bangladesh. > Looking at the headers in that pastbin example, the originating IP is > 114.31.4.36 which looks like it's from a cyber-cafe in Bangladesh. > > Microsoft outsourcing their tech-support that badly? I don't think

RE: Hotfix/phishing spam

2014-08-14 Thread David B Funk
But when they do I doubt that they do it via Yahoo from somebody in Bangladesh. Looking at the headers in that pastbin example, the originating IP is 114.31.4.36 which looks like it's from a cyber-cafe in Bangladesh. Microsoft outsourcing their tech-support that badly? I don't think so. On Thu,

RE: Hotfix/phishing spam

2014-08-14 Thread John Traweek CCNA, Sec+
Usually an end user has to request the hotfix and fill out a form on the MS site and then MS will send out an email with the URI. So to answer your question, yes, MS does send out emails with hotfixes, but only when an end user requests it, at least in my experience… If the end user did not