December 10, 2012

Bogus hotel reservation emails have been spammed out widely, which claim to come from Booking.com but in reality carry malware designed to infect Windows computers.

Even if recipients haven't booked a hotel room they might be tempted to open the dangerous attachments, in fear that their credit card has been charged.

Here's what a typical malicious email looks like:

The emails are not entirely convincing, as they use a subject line in somewhat broken English:

Subject:
you receive the electronic reservation [random number]
From:
"Booking.com" <Reservation@my.booking.com>
Attached file:
Your electronic reservation ID[random].zip

Here's another example, which claims that you have booked a vacation at the Mandarin Oriental hotel in London's Hyde Park:

As you can see, the cybercriminals behind the campaign have attempted to make their attack harder to block by varying subject lines, attached filenames and the vacation details included in the body of the email.

For instance, a wide variety of hotel names are used in the bogus reservation emails. Here are just a handful of the names used:

• Four Seasons Hotel
• Mandarin Oriental Hyde Park
• Shangri-La Hotel
• Hotel Imperial
• Mara Safari Club
• The Sanctuary At Kiawah Island
• Il San Pietro di Positano
• Four Seasons Resort Maui at Wailea
• Grand Hotel Timeo
• Hotel Ritz-Carlton

If you do receive one of these emails, delete it from your inbox. The one thing you shouldn't do is open the ZIP file and attempt to access the file contained within, as it is designed to infect your Windows computer.

Sophos security products detect the attack as both spam and malware (identifying the attachment proactively as Mal/DrodZp-A).

Of course, this is far from the first time that malware authors have distributed their attack posing as a hotel booking, and it's unlikely to be the last. The reason they use disguises like this is that the social engineering works so well at tricking people into clicking on the dangerous attachment or a malicious link.

It's time to wise up, and tell your friends not to fool for such traps.

You should always be suspicious of email attachments that are sent to you out of the blue. Make sure that your anti-virus product is updated, that you have the latest security patches, and tell your friends to think twice before opening unknown attachments.

Stay safe folks.

http://nakedsecurity.sophos.com/2012/12/10/electronic-reservation-h...