I Wait For Your Urgent Reply Before Is Too Late

REF: CBN/LHG/OXD00091/16
PAYMENT FILE: CBN/FGN203/16.
PRIVATE E-MAIL: mr.godemef@yahoo.com

Attention:

Can you please confirm if you are still using this email address. It would be quite pleasing if you can assure me that you are the owner of this email address so that I can give you more details about your inheritance fund with our Bank. Due to the urgency of the meeting held today,there is presently a counter claims on your inheritance funds by your relative (Mr.Andrew Lee) who is presently trying to make us believe that you are DEAD and even explained that you entered into an agreement with him that he should claim your fund as your next of kin.

From the records of outstanding beneficiaries due for payment, your name and your email address was discovered as next on the list of the outstanding beneficiaries who have not received their payments. I wish to inform you that your part payment is being processed and will be released to you as soon as you respond to this notification letter. Also note that from my record in my file your outstanding part payment is One Million Three Hundred Thousand Dolars.

Please if you did not sign or authorize him to receive your fund on your behalf, kindly reconfirm your details to enable us process your payment if you are still alive. YOUR NAME: YOUR ADDRESS: YOUR PHONE NUMBERS:

However we shall proceed to issue all payments details to him if we do not hear from you. We are sorry for any inconvenience and delay in transferring of this funds must have caused you.I wait for your urgent reply.

Thanks.

DR.GODWIN EMEFELE
EXECUTIVE GOVERNOR
CENTRAL BANK OF NIGERIA.
DIRECT EMAIL: mr.godemef@yahoo.com

Email analysis :

NOTE : akaonyewetere@yahoo.com
NOTE : goemef28@gmail.com
NOTE : client-ip=98.139.213.150;

NOTE : Another Scam relayed by Yahoo

OMG!!! 500 Million Yahoo Email Accounts Hacked!! By “state-sponsored” hackers. Hope your is not among?

According to Yahoo, it was stated by yahoo that “state-sponsored” hackers stole information from about 500 million users in what appears to be the
largest publicly disclosed cyber-breach in history.Omg!😱.  The breach included swathes of personal information, including names and emails, as well as “unencrypted security questions and
answers”. The hack took place in 2014 but has only now been made public.

The FBI has confirmed it is investigating the claims. Stolen data includes names, email addresses, telephone numbers,
dates of birth and encrypted passwords, but not credit card data, Yahoo said. It said the information was “stolen by what we believe is a state- sponsored actor” but did not say which country it held responsible. News of a possible major attack on the technology firm emerged in August when a hacker known as “Peace” was apparently attempting to sell information on 200 million Yahoo accounts.

On Thursday, Yahoo confirmed the breach was far bigger than first thought.

Yahoo is recommending all users should change their passwords if they have not done so since 2014. In the UK, ISPs Sky and BT issued warnings for customers that they may be affected by the breach as Yahoo provides email
services for both ISPs. Sky advised all its customers to change their passwords as Yahoo is behind all Sky.com email accounts. BT said it was carrying out its own investigation but advised the “minority” of its customers who use Yahoo mail to change their passwords.

USA: More than 500 million pirated Yahoo accounts

The American group "Yahoo!" announced Thursday, September 22, 2016 hacking more than 500 million accounts of its users in 2014.

"Names, email addresses, phone numbers, birth dates, and passwords were among the hacked data," the company said in a statement, adding that the hacking was conducted by a entity related to a state without giving details about it.

The US group, which claimed to have contacted affected users, said it is working closely with the relevant US authorities to determine the circumstances of the computer attack.

He also assured that the investigation found no evidence indicating that the entity in question is currently present in the computer system of "Yahoo!" said the statement of the US company.

This piracy comes following the announcement in July, the redemption of the pioneer of the Internet by the Verizon telecommunications company for $ 4.8 billion.

Source: Iliasnotes.info and Aujourd'hui.ma

Afternoon Links 8/4/2015

I am a victim of my nostalgia. Yesterday, I revived a years-old post in which I provided bloggees with some of the latest Windows activation keys to update the data for Windows 10. I figured I might as well dredge up another bit I had let fall by the wayside; Weekly links! Exciting, I know.

   - Yahoo's ad network and Microsoft Azure's web hosting service were abused to circulate an enormous flood of malicious software. Malwarebytes is being credited with the discovery - which is a little amusing because Malwarebytes has for had their own issues with security for many years. h/t Washington Post

    - Planned Parenthood and a variety of other related organizations were brought offline by a sustained series of DDoS attacks. In what may or may not have been the work of the same group of individuals, someone has claimed they have hacked Planned Parenthood and retrieved an employee list database of some kind or another.
     AFAIK, this sort of thing is new to the abortion debate in the US - honestly the only political debates where this sort of thing typically comes to the fore are "internet" issues surrounding surveillance, cryptocurrency and the like. The "Culture Wars" are fought in city halls, lobbyist offices and in the bank transfers of PACs rather than through data center Meet Me rooms.
    Personally I am interested in finding out if the DDoS was outsourced or if there is, in fact, a pro-life botnet. Will online hooliganism become a part of the political conversation? h/t Rolling Stone

   - The Electronic Frontier Foundation and Muck Rock have partnered to file a butt-load of FOIA requests in order to provide the public with a better understanding of how biometrics is being used by law enforcement and federal government agencies to provide street level, warrantless surveillance of ordinary Americans. h/t Muck Rock

   - In a strange move, DHS Deputy Secretary Alejandro Mayorkas said that some provisions of the Cybersecurity Information Sharing Act (CISA) “could sweep away important privacy protections” and that proposed legislation “raises privacy and civil liberties concerns.” Apparently Mayorkas found nothing ironic about this statement, while the news outlets who retyped the message for public consumption found it completely normal. h/t Russia Today

Hotmail is bouncing bugtraq mailing list emails from Yahoo

What really irks me about this is that I deliberately use gigantic, stupid MTAs like gmail and live mail to deliberately avoid this sort of garbage (deliberately). Those familiar with administrating large volume email can appreciate that you can perfectly configure your mail server and end up bounding all over the place because almost everyone with a mail server is not an actual email administrator and has no clue what they are doing. Email, like high school, is ultimately all about popularity. Even the least competent of email server owners will eventually get tech support to make sure google and microsoft can deliver to and receive from their Zimbra abomination.

At least that's what I figured until I started getting bounces like the one below. It seems Microsoft has decided that Security Focus mailing lists are too dangerous. To step up the oddity of this policy, bounces only occur when the originating MTA is with Yahoo. I can receive email directly from securityfocus.com. I can receive email from securityfocus.com when the originating mail server is a one-off IP address from Finland that is part of a DSL netblock. But Yahoo is a bridge too far. Stupid stupid stupid.

Return-Path: <>
Received: (qmail 22048 invoked from network); 15 Jul 2015 15:26:46 -0000
Received: from sf01mail1.securityfocus.com (HELO mail.securityfocus.com) (192.168.120.35)
by lists.securityfocus.com with SMTP; 15 Jul 2015 15:26:46 -0000
Received: (qmail 27445 invoked by alias); 15 Jul 2015 15:26:31 -0000
Received: (qmail 21710 invoked from network); 15 Jul 2015 15:26:06 -0000
Received: from sf01smtp2.securityfocus.com (192.168.120.34)
by mail.securityfocus.com with SMTP; 15 Jul 2015 15:26:06 -0000
Received: by sf01smtp2.securityfocus.com (Postfix)
id E771981455; Wed, 15 Jul 2015 10:31:59 -0700 (PDT)
Date: Wed, 15 Jul 2015 10:31:59 -0700 (PDT)
From: MAILER-DAEMON@securityfocus.com (Mail Delivery System)
Subject: Undelivered Mail Returned to Sender
To: bugtraq-return-55766-(redacted)=live.com@securityfocus.com
Auto-Submitted: auto-replied
MIME-Version: 1.0
Content-Type: multipart/report; report-type=delivery-status;
boundary="5D865812F6.1436981490/sf01smtp2.securityfocus.com"
Content-Transfer-Encoding: 8bit
Message-Id: <20150715173159 data-blogger-escaped-.e771981455="" data-blogger-escaped-sf01smtp2.securityfocus.com="">

This is a MIME-encapsulated message.

--5D865812F6.1436981490/sf01smtp2.securityfocus.com
Content-Description: Notification
Content-Type: text/plain; charset=us-ascii

This is the mail system at host sf01smtp2.securityfocus.com.

I'm sorry to have to inform you that your message could not
be delivered to one or more recipients. It's attached below.

For further assistance, please send mail to postmaster

If you do so, please include this problem report. You can
delete your own text from the attached returned message.

The mail system

<(redacted)="" live.com="">: host mx4.hotmail.com[65.55.92.152] said: 550 5.7.0
(SNT004-MC2F10) Unfortunately, messages from (143.127.139.113) on behalf of
(yahoo.com) could not be delivered due to domain owner policy restrictions.
(in reply to end of DATA command)

--5D865812F6.1436981490/sf01smtp2.securityfocus.com
Content-Description: Delivery report
Content-Type: message/delivery-status

Reporting-MTA: dns; sf01smtp2.securityfocus.com
X-Postfix-Queue-ID: 5D865812F6
X-Postfix-Sender: rfc822; (redacted)@securityfocus.com
Arrival-Date: Wed, 15 Jul 2015 10:18:42 -0700 (PDT)

Final-Recipient: rfc822; (redacted)@live.com
Action: failed
Status: 5.7.0
Remote-MTA: dns; mx4.hotmail.com
Diagnostic-Code: smtp; 550 5.7.0 (SNT004-MC2F10) Unfortunately, messages from
(143.127.139.113) on behalf of (yahoo.com) could not be delivered due to
domain owner policy restrictions.

--5D865812F6.1436981490/sf01smtp2.securityfocus.com
Content-Description: Undelivered Message
Content-Type: message/rfc822
Content-Transfer-Encoding: 8bit

Received: from lists.securityfocus.com (lists.securityfocus.com [192.168.120.36])
by sf01smtp2.securityfocus.com (Postfix) with QMQP
id 5D865812F6; Wed, 15 Jul 2015 10:18:42 -0700 (PDT)
Precedence: bulk
(redacted)
Delivered-To: mailing list (redacted)@securityfocus.com
Delivered-To: moderator for (redacted)@securityfocus.com
Received: (qmail 9417 invoked from network); 15 Jul 2015 10:14:32 -0000
Date: Wed, 15 Jul 2015 10:14:31 GMT
Message-Id: <201507151014 data-blogger-escaped-.t6faevnw013232="" data-blogger-escaped-sf01web2.securityfocus.com="">
Content-Type: text/plain
Content-Disposition: inline
Content-Transfer-Encoding: binary
MIME-Version: 1.0
X-Mailer: MIME-tools 5.420 (Entity 5.420)
From: (redacted)@yahoo.com
To: (redacted)@securityfocus.com
Subject: XSS vulnerability in OFBiz forms