-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

===========================================================================
A  U  S  C  E  R  T                                           A  L  E  R  T

                       AL-2006.0125 -- AUSCERT ALERT
                             [Win][UNIX/Linux]
         Fake Reserve Bank of Australia email and websites entice
               users to disclose online banking credentials
                             18 December 2006

===========================================================================

        AusCERT Alert Summary
        ---------------------

Operating System:     Windows
                      UNIX variants (UNIX, Linux, OSX)
Impact:               Access Confidential Data
Access:               Remote/Unauthenticated

OVERVIEW:

        AusCERT has received reports of a new fraudulent email, falsely 
        claiming to be from the Reserve Bank of Australia. The email entices 
        users to visit fake online banking websites and contains links to 
        fraudulent ANZ, Commonwealth Bank and Westpac online banking sites.


IMPACT:

        The information gathered by these websites can be used to 
        compromise online banking accounts for the purposes of financial 
        fraud.


MITIGATION:

        Users should avoid clicking on any links in emails, unless the 
        email was already expected.

        System administrators may consider configuring web proxy servers or 
        firewalls to block the following destinations:

           hxxp: // www (dot) svmcjrotc (dot) org/forums/images/anz/ANZ/Bankmain.htm

           hxxp: // www (dot) webophil (dot) net/mots-cles/.web/www3.netbank.commbank.com.au/NetBank/LogOn.htm

           hxxp: // www (dot) webophil (dot) net/philoweb/.web/online.westpac.com.au/Login/SrvPage/     

           hxxp: // www (dot) favoremail (dot) net/pages/.web/www.anz.com.au/Online%20Serivces/.account%20update/Bankmain.htm

           hxxp: // www (dot) chambily (dot) com/journal/.web/www3.netbank.commbank.com.au/account%20update/online%20service/NetBank/LogOn.htm

           hxxp: // www (dot) chambily (dot) com/captures/.web/.www.westpac.com.au/internet/publish.nsf/content/ 

        Additional addresses may also be used. Checking proxy logs for 
        these addresses can help to determine if any users may have already 
        been affected.


DETAILS:

        The fraudulent email appears to be from "Reserve Bank of Australia 
        <bankaccount@rba.gov.au>" and has a Subject line of "Your bank new 
        security" or similar.

        The email attempts to convince recipients to click on the link to 
        visit a fake website and "confirm your account security".

        The fraudulent website then requests online banking usernames and 
        passwords.


AusCERT has made every effort to ensure that the information contained
in this document is accurate.  However, the decision to use the information
described is the responsibility of each user or organisation. The decision to
follow or act on information or advice contained in this security bulletin is
the responsibility of each user or organisation, and should be considered in
accordance with your organisation's site policies and procedures. AusCERT
takes no responsibility for consequences which may arise from following or
acting on information or advice contained in this security bulletin.

If you believe that your computer system has been compromised or attacked in 
any way, we encourage you to let us know by completing the secure National IT 
Incident Reporting Form at:

        http://www.auscert.org.au/render.html?it=3192

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================

-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQCVAwUBRYYnBSh9+71yA2DNAQJcFQP+Os+olKEB37DNelH/ohhnG5IKVv0+MLVM
5ijqfwVD+xnTSsedG2pE/fUVzEhS8GLo2LtlZapJ0jjre2lS4nEgNh/1MkIYu+pR
8Z6iUDWSnKBkWYsRU2pV/C2yV834FV6R6iN+j1R6FJAJz6Z0bMPbLEe0WYsrZ+za
HlKtrQuZ1bg=
=qe5P
-----END PGP SIGNATURE-----