Facebook's Lack Of Hacking Resolution System For Nigerian Scammers

Thu, Nov 13th 2008 11:07pm

Filed Under:
corporate espionage, cybercrime, espionage, organized crime, phishing

7 Comments | Leave a Comment..

Online Criminals Move On To Corporate Espionage

from the plain-old-phishing-doesn't-pay dept

One of these days, someone will do a fascinating study or book on the evolving nature of online crime. It's a constantly changing phenomenon that would be quite interesting to study. A few years ago, we noted that the ease with which script kiddies could jump into the phishing and online extortion market meant that margins were getting squeezed for older online organized crime groups who had focused on such practices in the past. Apparently, the big money now has moved away from standard phishing and into corporate espionage. Organized crime groups are figuring out ways to hack into company networks, suck up as much data as possible, and then sell it off to the highest bidder -- whether it's competing firms or foreign governments.

Mon, Aug 18th 2008 4:54am

Filed Under:
jailtime, phishing, scams

16 Comments | Leave a Comment..

Phishing Scammer Gets Seven Years

from the this-ought-to-make-some-folks-happy dept

People seem to get pretty excited whenever we have stories of spammers and scammers getting long jail sentences, so I'm sure plenty of folks will be happy to hear that a phishing scammer just got sentenced to seven years in prison. Considering that he was scamming people's passwords to use elsewhere, this seems a lot more reasonable than the folks who get long jail sentences just for spamming. But, with all of these stories about spammers and phishers getting convicted, it always seems like the punishment is rather arbitrary. There's no clear pattern at all.

Mon, Apr 21st 2008 9:01pm

Filed Under:
hijacking, page not found, phishing, vulnerability

Companies:
earthlink, verisign

11 Comments | Leave a Comment..

Non-Existent Domain Hijacking Not Just Annoying, But A Security Threat

from the please-stop dept

Back in 2003, there was a huge mess over VeriSign's plan to create "SiteFinder," which effectively hijacked "page not found" messages online and inserted advertising instead. This also broke a bunch of online services that relied on accurate page not found messages. Eventually, VeriSign backed down, but over the last couple of years, ISPs have been starting to do the same thing on their own at a slightly different level in the process. However, some security researchers have demonstrated just how dangerous this can be, by using Earthlink's set up to show how it can be used by phishers to make pages look like they're really on someone else's domain. This particular hole has been patched, but it does demonstrate some of the unintended problems of hijacking a widely accepted standard behavior on the internet for the ISP's own purposes. The ISPs (including Earthlink in this case) always claim that they put up these ad pages as a "customer service" or to "improve their experience," but that's simply untrue. Such pages don't help matters. If a page can't be found, the user should be told that the page can't be found. They can do a search on a search engine themselves to find the proper page.

Thu, Apr 3rd 2008 11:47pm

Filed Under:
army, gullibility, phishing

17 Comments | Leave a Comment..

Army Sets Up Phishing Scam To See How Gullible Service Members Are

from the and-here's-the-list-of-folks-not-to-give-sensitive-info-to dept

Well, since Japan leaked nuclear secrets via a P2P site, perhaps it's nice to know that our military runs its own phishing tests to see how gullible service members are. Slashdot points us to the news that the Army ran its own phishing scam, emailing members with an offer for free tickets to theme parks if they just went to a website and filled in certain information. The test itself was set up by the U.S Army Intelligence and Security Command (INSCOM) and U.S. Army Network Enterprise Technology Command (NETCOM) -- and it involved a "fake" website supposedly from Army Family and Morale, Welfare and Recreation Command (Family and MWR). Amusingly, it appears that INSCOM and NETCOM didn't bother to tell the folks at Family and MWR that they were conducting this test, so the group had rushed out an announcement warning people away from the fake site, only to later be clued in by the security folks. Oh well, it still seems better than using Dungeons & Dragons as a test of whether army members are security risks.

Politics

Wed, Feb 27th 2008 7:21am

Filed Under:
anonymity, grandstanding, phishing, senators

27 Comments | Leave a Comment..

Senate Looks To Outlaw Phishing, Even Though It's Already Illegal

from the gotta-do-something dept

As the saying goes, when your only tool is a hammer, everything starts to look like a nail. The folks in Congress sure do an awful lot of whacking at various nails these days. The latest is a new bill in the Senate that seeks to outlaw phishing. One tiny point is important here: phishing is already illegal. So, really all this bill does is allow these politicians to claim that they took a stand to stop phishing. Except, it's actually worse than that. Not only will this bill not do anything to stop phishing, it will actually make life worse for plenty of non-criminals. That's because a part of the bill would outlaw hiding domain name registration information. Now, there are plenty of legitimate reasons for not wanting to reveal your info in the whois database -- but according to this bill, it won't be allowed any more. If you want to own a domain, you'll need to cough up your name, address and phone number to whoever wants it -- and they better be legit. If you provide false info, you'll also be breaking the law. So, it won't do anything new to stop phishing, but will make it much more difficult to own a domain anonymously. That's quite a nail.

Tue, Oct 30th 2007 9:49pm

Filed Under:
phishing

Companies:
supervalu

20 Comments | Leave a Comment..

Phishing Scammers Convince Grocery Store To Give Them $10 Million

from the the-big-phish dept

By now, most people are familiar with how phishing scams work, usually preying on individuals and tricking them into handing over data that allows the scammers access to bank accounts or other useful info. However, scammers have been aiming a bit higher lately. One tactic is commonly referred to as "spear phishing," where scammers focus on business targets, and attempt to convince them that they're actually coming from partners or suppliers. Apparently one such spear phishing attempt nearly worked to the tune of $10 million. The scammers sent two emails to someone at the headquarters of the supermarket chain Supervalu, purporting to be from Supervalu suppliers American Greetings and Frito-Lay. Both emails claimed that their bank account info had changed and Supervalu now needed to deposit payments into different accounts. Someone at Supervalu followed the instructions, leading approximately $10 million to be deposited into the two accounts over a period of about 4 days. At this point, someone from Supervalu figured out there was a problem and alerted the authorities, who were then able to recover most of the money before the scammers withdrew it. However, it appears that no one has yet figured out who opened the accounts, though Supervalu has filed a lawsuit in order to try to get that information.

Studies

Mon, Jul 23rd 2007 8:34am

Filed Under:
phishing, research, scams

Companies:
indiana university