Dubious Delta Air Lines Ticket Invoices Appear: From Russia With Malice, They Steal Computer Data

CINCINNATI (TDB) -- A researcher at McAfee Inc. reports that e-mails seeming to be electronic ticket invoices from Delta Air Lines and other major carriers are fakes. This should send shivers through SW Ohio and metro Cincinnati, which is home to a major Delta hub. The bogus invoices are infected with computer malware that is capable of filching data including keystrokes. The info is reportedly transmitted to Russia. The job site Monster.com was targeted a year ago when personal information from 1.6 million entries reportedly was taken.

McAfee, which develops and sells computer protection programs, issued its warning last week, "Unsurprisingly those behind the recent attacks continued today with new spam campaigns involving airline ticket invoices." Computer World says Delta and Northwest -- the airline it is moving to merge with -- are advising customers to immediately delete any suspicious messages. Computer World's Greg Keizer reported two days ago:

"The e-mails, which purport to be from an airline, thank the recipient for using a new "Buy flight ticket Online" sercie on the airline's site, provide a long-in username and password, and say the person's credit card has been charged an amount in the $400 range. An attachment claims to be the invoice for the credit card charge.

"However, the .zip file format attachment is a Trojan hourse that steals information, including keystrokes from the infected Windows PC . . . McAfee has pegged the malware as 'Spy-Agent.bw,' but other security firms have given it different names. For example, Symantec Corp. has labeled the same Trojan horse and "Infostealer.Monstres."

Last August, the malware attacked the Monster.com job-search site. Symantec said "personal information" from hundreds of thousands of people was taken:

"Yesterday, we analyzed a sample of a new Trojan, called Infostealer.Monstres, which was attempting to access the online recruitment Web site, Monster.com. It was also uploading data to a remote server. When we accessed this remote server, we found over 1.6 million entries with personal information belonging to several hundred thousand people. We were very surprised that this low profile Trojan could have attacked so many people, so we decided to investigate how the data could have been obtained.

"Interestingly, only connections to the hiring.monster.com and recruiter.monster.com subdomains were being made. These subdomains belong to the “Monster for employers” only site, the section used by recruiters and human resources personnel to search for potential candidates, post jobs to Monster, et cetera. This site requires recruiters to log in to view information on candidates.

"Upon further investigation, the Trojan appears to be using the (probably stolen) credentials of a number of recruiters to login to the Web site and perform searches for resumes of candidates located in certain countries or working in certain fields. The Trojan sends HTTP commands to the Monster.com Web site to navigate to the Managed Folders section. It then parses the output from a pop-up window containing the profiles of the candidates that match this recruiter’s saved searches."

Ohio Gov. Ted Strickland: Worries A Delta Airlines Merger Impacts 130,000 Cincy Area Jobs

CINCINNATI (TDB) -- With merger talk now in the air between Delta Airlines -- which has an international hub at Cincinnati/Northern Kentucky Airport -- and two rivals, the timing seems right for Gov. Ted Strickland to start worrying about preserving local jobs. Strickland and Lt. Gov. Lee Fisher, who heads the Ohio Department of Development, sent a joint letter to Delta CEO Richard Anderson pledging "our assistance to ensure the future viability of your operations in our region." They said they would deliver a financial aid package to keep Delta if necessary.

Delta reportedly has been discussing a merger with Northwest Airlines, which has a major hub in Detroit, and United Airlines, which has its largest base in Chicago. Any link up is seen threatening Delta's Cincinnati-area operations, which analysts consider vulnerable because both partners are Midwestern giants (Northwest is headquartered in Minneapolis; United in Chicago). Delta is a southern company with its headquarters and main hub in Atlanta. Gov. Strickland said he and Fisher want a meeting with the Delta CEO to find out what is up, and to learn what they can offer.

"The State of Ohio is committed to the future of the Delta hub, as well as over 130,000 jobs in the region that are an outgrowth of this prominent operation. We would appreciate the opportunity to meet with you to discuss how the economic success of our region is intrinsically tied to the growth and success of Delta Airlines. As you are aware, the Cincinnati/Northern Kentucky hub is one of the ten largest hubs in the country and maintains the positions of Delta's second largest hub."

Strickland noted that more than 300 foreign-owned companies now operate in SW Ohio/Northern Kentucky, and 1,000 other businesses are involved in foreign trade. Those companies might suffer if access to flights are trimmed -- or they might look to move to other locations . Strickland and Fisher also pointed out that Cincinnati ranks as the USA's 22nd largest region as an exporter of products in the global economy. A link to the letter is available here courtesy of Cincinnati.com. Strickland's office had not yet posted a copy on the State of Ohio's online portal.