<?xml version="1.0" encoding="utf-8"?>
<rss version="2.0"
xmlns:dc="http://purl.org/dc/elements/1.1/"
xmlns:slash="http://purl.org/rss/1.0/modules/slash/"
xmlns:wfw="http://wellformedweb.org/CommentAPI/">
<channel>
<title>Techdirt. Stories filed under &quot;phishing&quot;</title>
<description>Easily digestible tech news...</description>
<link>http://www.techdirt.com/</link>
<language>en-us</language>
<image><title>Techdirt. Stories filed under &quot;phishing&quot;</title><url>http://www.techdirt.com/images/td-88x31.gif</url><link>http://www.techdirt.com/</link></image>
<item>
<pubDate>Mon, 12 Mar 2012 07:30:35 PDT</pubDate>
<title>If Phishing Email Can Kill NY Power Grid, Lack Of Cybersecurity Legislation Is Not The Problem</title>
<dc:creator>Mike Masnick</dc:creator>
<link>http://www.techdirt.com/articles/20120309/16470618060/if-phishing-email-can-kill-ny-power-grid-lack-cybersecurity-legislation-is-not-problem.shtml</link>
<guid>http://www.techdirt.com/articles/20120309/16470618060/if-phishing-email-can-kill-ny-power-grid-lack-cybersecurity-legislation-is-not-problem.shtml</guid>
<description><![CDATA[ We've been talking about the <a href="http://www.techdirt.com/articles/20120308/12180318040/slow-down-homeland-security-does-everyone-really-agree-that-we-need-cybersecurity-legislation-now.shtml">faux urgency</a> to pass some <a href="http://www.techdirt.com/articles/20120214/15002817761/cybersecurity-bill-backers-insist-this-isnt-sopa-is-it-needed.shtml">cybersecurity legislation</a> coming from the federal government, with plenty of <a href="http://www.techdirt.com/articles/20120221/23433317835/nsa-anonymous-might-one-day-hack-power-grids-anonymous-huh.shtml">fear mongering</a> from politicians who never seem to want to point out any <i>factual</i> basis for why we need such new laws.  Instead, it's all been about Hollywood movie script-style scenarios about <a href="http://www.techdirt.com/articles/20120216/17430217786/senators-ramp-up-fear-mongering-to-try-to-rush-through-cybersecurity-bill.shtml">planes falling from the skies</a>.  It appears that the White House is heavily involved in this bogus fear mongering as well, having recently <a href="http://dyn.politico.com/printstory.cfm?uuid=BCEC37C2-ABCD-4973-9858-569B77D9EFA5" target="_blank">set up a "simulated cyberattack on New York City's power supply"</a> to convince elected officials to move forward on the legislation.
<blockquote><i>
During a classified briefing in the Office of Senate Security, Homeland Security Secretary Janet Napolitano and White House counterterrorism adviser John Brennan showed lawmakers how a hacker could breach control systems of the city&#8217;s electric system and trigger a ripple effect throughout the population and private sector, according to a source familiar with the scenario.
<br /><br />
&#8220;The fact that we could be subject to a catastrophic attack under the right circumstances and we now know some of the things that would help us to protect against such an attack, that&#8217;s why it&#8217;s important now for the Congress to take this up,&#8221; Napolitano said in an interview with POLITICO.
</i></blockquote>
Now that's interesting.  Just <i><b>how</b></i> could a hacker breach control systems of the power grid?  Apparently with <b>an email phishing attack</b>:
<blockquote><i>
During the simulation, the hacker gains access to the electric supply&#8217;s control system through a simple &#8220;spearphishing&#8221; attack, in which a worker merely clicks on a link in an email that appears to be from someone they know.
</i></blockquote>
Um, there's your problem.  If the NYC power grid is attached to the public internet in such a way that it can be taken down, then um, <i>shouldn't we take it off the internet</i>?  This isn't about cybersecurity, this is about common sense, where things like the power grid should not be accessible via the internet -- and I'm pretty sure <i>they're not</i> (back here in reality).  But in the world where we need fear, uncertainty, doubt and the ability for the federal government to spy on private networks, we have to pretend such a scenario is likely.
<br /><br />
Of course, I also question why the White House chose NYC as the showcase for the simulation and suggested that there would be deaths and other massive harm from such a power grid takedown.  After all, it was just about a decade ago that the power grid in the Northeast <a href="http://en.wikipedia.org/wiki/Northeast_blackout_of_2003" target="_blank">did, in fact, fail</a>.  It was an inconvenience for many people, certainly, but it was hardly damaging in the way the White House seems to have implied with this scare tactic.
<br /><br />
So, once again, can we take a step back and ask some simple questions: what's the <i><b>real</b></i> threat and the <i><b>real</b></i> risk here?  If it's that the NYC power grid is accessible by a simple password over the public internet, then the problem isn't cybersecurity, it's whoever was stupid enough to connect the power grid to the internet.  Let's fix that.  But let's not regulate and spy on large segments of the public internet to cover for a few bad decisions.<br /><br /><a href="http://www.techdirt.com/articles/20120309/16470618060/if-phishing-email-can-kill-ny-power-grid-lack-cybersecurity-legislation-is-not-problem.shtml">Permalink</a> | <a href="http://www.techdirt.com/articles/20120309/16470618060/if-phishing-email-can-kill-ny-power-grid-lack-cybersecurity-legislation-is-not-problem.shtml#comments">Comments</a> | <a href="http://www.techdirt.com/articles/20120309/16470618060/if-phishing-email-can-kill-ny-power-grid-lack-cybersecurity-legislation-is-not-problem.shtml?op=sharethis">Email This Story</a><br />
 ]]></description>
<slash:department>oh-come-on</slash:department>
<wfw:commentRss>http://www.techdirt.com/comment_rss.php?sid=20120309/16470618060</wfw:commentRss>
</item>
<item>
<pubDate>Mon, 23 May 2011 04:43:31 PDT</pubDate>
<title>Oh Look, Sony Hacked Again, Site Used For Phishing</title>
<dc:creator>Mike Masnick</dc:creator>
<link>http://www.techdirt.com/articles/20110521/09303414368/oh-look-sony-hacked-again-site-used-phishing.shtml</link>
<guid>http://www.techdirt.com/articles/20110521/09303414368/oh-look-sony-hacked-again-site-used-phishing.shtml</guid>
<description><![CDATA[ Late on Friday, the news came out that Sony had been <a href="http://www.zdnet.co.uk/blogs/security-bullet-in-10000166/sony-site-used-for-phishing-10022513/?tag=mncol;txt" target="_blank">hacked yet again</a>, and this time the hacked site was being used for phishing.  This was totally unrelated to the PlayStation Network hacks, but involved a website for Sony Thailand.  Still, given all the trouble Sony has had lately keeping its systems secure, this seems to just add another layer to the stack of questions about Sony's technical competence.<br /><br /><a href="http://www.techdirt.com/articles/20110521/09303414368/oh-look-sony-hacked-again-site-used-phishing.shtml">Permalink</a> | <a href="http://www.techdirt.com/articles/20110521/09303414368/oh-look-sony-hacked-again-site-used-phishing.shtml#comments">Comments</a> | <a href="http://www.techdirt.com/articles/20110521/09303414368/oh-look-sony-hacked-again-site-used-phishing.shtml?op=sharethis">Email This Story</a><br />
 ]]></description>
<slash:department>count-the-hacks</slash:department>
<wfw:commentRss>http://www.techdirt.com/comment_rss.php?sid=20110521/09303414368</wfw:commentRss>
</item>
<item>
<pubDate>Fri, 4 Jun 2010 06:43:41 PDT</pubDate>
<title>Yet Again, Real Police Called Into Virtual World Over (Not Really) Theft Of Virtual Items</title>
<dc:creator>Mike Masnick</dc:creator>
<link>http://www.techdirt.com/articles/20100602/1644049664.shtml</link>
<guid>http://www.techdirt.com/articles/20100602/1644049664.shtml</guid>
<description><![CDATA[ Back in 2007 we wrote about how police had <a href="http://www.techdirt.com/articles/20071114/113704.shtml">arrested</a> a kid for "stealing" virtual furniture in the virtual world, Habbo Hotel.  At the time, we pointed out how <a href="http://techdirt.com/articles/20031114/128227.shtml">problematic</a> it is when real laws (and real police) cross over into virtual worlds.  What if "stealing" is a part of the game?  Even if it's not, it seems like these are cases where the folks who run Habbo Hotel should handle it via terms of service issues, rather than getting the real police involved.  If virtual items are "stolen," then Habbo should be able to give them back.  That's one of the nice things about a virtual world where there is no scarcity and where there's the ability to bring "stolen" things back.
<br /><br />
However, it looks like that's not happening any time soon.  A bunch of folks have sent in the news that the Habbo Hotel folks have now asked Finnish police to <a href="http://news.bbc.co.uk/2/hi/technology/10207486.stm" target="_blank">investigate 400 cases of "theft"</a> in their world.  Seriously.  Of course it is a bit more complicated than that.  They're really upset about phishing scams that let scammers get users login information, which they then use to get into their account and transfer the virtual goods away.  But that's not really "theft" and it's a misnomer to call it that.  And, really, if Habbo Hotel users are getting phished so frequently, perhaps the Habbo developers should focus on building a better login system that is not so susceptible to simple phishing scams...<br /><br /><a href="http://www.techdirt.com/articles/20100602/1644049664.shtml">Permalink</a> | <a href="http://www.techdirt.com/articles/20100602/1644049664.shtml#comments">Comments</a> | <a href="http://www.techdirt.com/articles/20100602/1644049664.shtml?op=sharethis">Email This Story</a><br />
 ]]></description>
<slash:department>not-again</slash:department>
<wfw:commentRss>http://www.techdirt.com/comment_rss.php?sid=20100602/1644049664</wfw:commentRss>
</item>
<item>
<pubDate>Thu, 31 Dec 2009 15:44:52 PST</pubDate>
<title>FCC Boss Spams Facebook Friends With Make Money Now Scam</title>
<dc:creator>Mike Masnick</dc:creator>
<link>http://www.techdirt.com/articles/20091231/1440067570.shtml</link>
<guid>http://www.techdirt.com/articles/20091231/1440067570.shtml</guid>
<description><![CDATA[ Hey, sooner or later everyone falls for some sort of phishing/scamware type of thing, right?  It's just especially embarrassing if you're the head of the FCC.  The NY Times is reporting that FCC Chair Julius Genachowski had his Facebook account <a href="http://bits.blogs.nytimes.com/2009/12/31/whoops-fcc-chairman-spams-facebook-friends/?src=twt&#038;twt=nytimesbits" target="_blank">spam all his friends with a message saying "Adam got me started making money with this"</a> which was followed by a link to a now defunct site.  Facebook has taken down Genachowski's page, and appears to be effectively blaming him for the problem, putting out a generic notice about how users need to be careful not to click on strange links...<br /><br /><a href="http://www.techdirt.com/articles/20091231/1440067570.shtml">Permalink</a> | <a href="http://www.techdirt.com/articles/20091231/1440067570.shtml#comments">Comments</a> | <a href="http://www.techdirt.com/articles/20091231/1440067570.shtml?op=sharethis">Email This Story</a><br />
 ]]></description>
<slash:department>whoops</slash:department>
<wfw:commentRss>http://www.techdirt.com/comment_rss.php?sid=20091231/1440067570</wfw:commentRss>
</item>
<item>
<pubDate>Tue, 1 Dec 2009 09:30:00 PST</pubDate>
<title>If You Gain Unauthorized Access To A Character In A Virtual World, Is It Theft?</title>
<dc:creator>Mike Masnick</dc:creator>
<link>http://www.techdirt.com/articles/20091130/0711587130.shtml</link>
<guid>http://www.techdirt.com/articles/20091130/0711587130.shtml</guid>
<description><![CDATA[ Well, here we go again.  For years we've <a href="http://www.techdirt.com/articles/20031113/1143235_F.shtml">questioned</a> the wisdom of using real world laws to deal with issues within virtual worlds.  You begin to open up quite the Pandora's Box of problems.  If it's okay to charge someone for theft of virtual goods in a virtual world, what do you do if "theft" is a part of the game?  And then does killing another character in a virtual world become "murder"?  These issues are coming up again as <a href="http://games.slashdot.org/story/09/11/30/1323202/Man-Arrested-For-RuneScape-MMORPG-Online-Robbery?from=rss&#038;utm_source=feedburner&#038;utm_medium=feed&#038;utm_campaign=Feed%3A+Slashdot%2Fslashdot+(Slashdot)" target="_blank">Slashdot</a> points out that a guy in the UK has <a href="http://www.sophos.com/blogs/gc/g/2009/11/30/man-arrested-robbing-runescape-virtual-characters/" target="_blank">been arrested for "robbery" of a player in the online world RuneScape</a>.  In this case, the arrested guy used a phishing scheme to get access to the username and password, making it similar to a story from two years ago involving <a href="http://www.techdirt.com/articles/20071114/113704.shtml">"stolen goods"</a> in Habbo Hotel that involved a similar "hacking" of an account.
<br /><br />
But, again, it seems questionable to call this a robbery.  Why not just charge the guy with violation of whatever laws there are against phishing or fraud, rather than robbery.  These sorts of "robberies" can and probably should be dealt with directly in the virtual worlds themselves, where game administrators should be able to just "make things whole."  Instead of calling it a robbery, why not focus on the actual crime of phishing, rather than the questionable "crime" of "robbery" of another's character.<br /><br /><a href="http://www.techdirt.com/articles/20091130/0711587130.shtml">Permalink</a> | <a href="http://www.techdirt.com/articles/20091130/0711587130.shtml#comments">Comments</a> | <a href="http://www.techdirt.com/articles/20091130/0711587130.shtml?op=sharethis">Email This Story</a><br />
 ]]></description>
<slash:department>confusion-abounds</slash:department>
<wfw:commentRss>http://www.techdirt.com/comment_rss.php?sid=20091130/0711587130</wfw:commentRss>
</item>
<item>
<pubDate>Thu, 22 Jan 2009 18:46:53 PST</pubDate>
<title>Facebook's Lack Of Hacking Resolution System For Nigerian Scammers</title>
<dc:creator>Mike Masnick</dc:creator>
<link>http://www.techdirt.com/articles/20090121/2124463488.shtml</link>
<guid>http://www.techdirt.com/articles/20090121/2124463488.shtml</guid>
<description><![CDATA[ In the past week, you may have seen various news stories about <a href="http://news.cnet.com/8301-1009_3-10092504-83.html?part=rss&#038;subj=news&#038;tag=2547-1_3-0-20" target="_new">Nigerian scammers hacking into Facebook</a>, and then sending their "friends" messages, saying they're <a href="http://www.news.com.au/technology/story/0,28348,24943531-5014239,00.html">stranded in London</a> without money.  It is, of course, just the latest improvement on the venerable old Nigerian 419 scam, this time upgraded to use hacked/phished Facebook accounts to trick trusting friends into coughing up their money.  However, one of the biggest issues is raised by <a href="http://jergames.blogspot.com">Yehuda Berlinger</a>, who points out that for those who are hacked, <a href="http://catless.ncl.ac.uk/Risks/25.51.html#subj10" target="_new">Facebook doesn't seem to have any reasonable way to contact them</a> and fix the problem.  Considering how much of your "identity" might be tied up in your social networking profile, you would think that a company like Facebook would have a ready made system in place to handle such "emergency" situations.<br /><br /><a href="http://www.techdirt.com/articles/20090121/2124463488.shtml">Permalink</a> | <a href="http://www.techdirt.com/articles/20090121/2124463488.shtml#comments">Comments</a> | <a href="http://www.techdirt.com/articles/20090121/2124463488.shtml?op=sharethis">Email This Story</a><br />
 ]]></description>
<slash:department>seems-like-a-problem</slash:department>
<wfw:commentRss>http://www.techdirt.com/comment_rss.php?sid=20090121/2124463488</wfw:commentRss>
</item>
<item>
<pubDate>Thu, 13 Nov 2008 23:07:56 PST</pubDate>
<title>Online Criminals Move On To Corporate Espionage</title>
<dc:creator>Mike Masnick</dc:creator>
<link>http://www.techdirt.com/articles/20081112/0321052809.shtml</link>
<guid>http://www.techdirt.com/articles/20081112/0321052809.shtml</guid>
<description><![CDATA[ One of these days, someone will do a fascinating study or book on the evolving nature of online crime.  It's a constantly changing phenomenon that would be quite interesting to study.  A few years ago, we noted that the ease with which script kiddies could jump into the phishing and online extortion market meant that <a href="http://www.techdirt.com/articles/20060427/1258251.shtml">margins were getting squeezed</a> for older online organized crime groups who had focused on such practices in the past.  Apparently, the big money now has moved away from standard phishing and <a href="http://www.usatoday.com/money/industries/technology/2008-11-11-thieves-cyber-corporate-data_N.htm?csp=34" target="_new">into corporate espionage</a>.  Organized crime groups are figuring out ways to hack into company networks, suck up as much data as possible, and then sell it off to the highest bidder -- whether it's competing firms or foreign governments.<br /><br /><a href="http://www.techdirt.com/articles/20081112/0321052809.shtml">Permalink</a> | <a href="http://www.techdirt.com/articles/20081112/0321052809.shtml#comments">Comments</a> | <a href="http://www.techdirt.com/articles/20081112/0321052809.shtml?op=sharethis">Email This Story</a><br />
 ]]></description>
<slash:department>plain-old-phishing-doesn't-pay</slash:department>
<wfw:commentRss>http://www.techdirt.com/comment_rss.php?sid=20081112/0321052809</wfw:commentRss>
</item>
<item>
<pubDate>Mon, 18 Aug 2008 04:54:44 PDT</pubDate>
<title>Phishing Scammer Gets Seven Years</title>
<dc:creator>Mike Masnick</dc:creator>
<link>http://www.techdirt.com/articles/20080815/1422541995.shtml</link>
<guid>http://www.techdirt.com/articles/20080815/1422541995.shtml</guid>
<description><![CDATA[ People seem to get pretty excited whenever we have stories of spammers and scammers getting long jail sentences, so I'm sure plenty of folks will be happy to hear that a phishing scammer <a href="http://www.theglobeandmail.com/servlet/story/RTGAM.20080815.wgtphish0815/BNStory/Technology/?page=rss&#038;id=RTGAM.20080815.wgtphish0815" target="_new">just got sentenced to seven years in prison</a>.  Considering that he was scamming people's passwords to use elsewhere, this seems a lot more reasonable than the folks who get long jail sentences <a href="http://www.techdirt.com/articles/20050411/1721233.shtml">just for spamming</a>.  But, with all of these stories about spammers and phishers getting convicted, it always seems like the punishment is rather arbitrary.  There's no clear pattern at all.<br /><br /><a href="http://www.techdirt.com/articles/20080815/1422541995.shtml">Permalink</a> | <a href="http://www.techdirt.com/articles/20080815/1422541995.shtml#comments">Comments</a> | <a href="http://www.techdirt.com/articles/20080815/1422541995.shtml?op=sharethis">Email This Story</a><br />
 ]]></description>
<slash:department>this-ought-to-make-some-folks-happy</slash:department>
<wfw:commentRss>http://www.techdirt.com/comment_rss.php?sid=20080815/1422541995</wfw:commentRss>
</item>
<item>
<pubDate>Mon, 21 Apr 2008 21:01:08 PDT</pubDate>
<title>Non-Existent Domain Hijacking Not Just Annoying, But A Security Threat</title>
<dc:creator>Mike Masnick</dc:creator>
<link>http://www.techdirt.com/articles/20080421/015522900.shtml</link>
<guid>http://www.techdirt.com/articles/20080421/015522900.shtml</guid>
<description><![CDATA[ Back in 2003, there was a <a href="http://www.techdirt.com/articles/20030918/2257251.shtml">huge mess</a> over VeriSign's plan to create "SiteFinder," which effectively hijacked "page not found" messages online and inserted advertising instead.  This also broke a bunch of online services that relied on accurate page not found messages.  Eventually, VeriSign backed down, but over the last couple of years, ISPs have been starting to do the same thing on their own at a slightly different level in the process.  However, some security researchers have demonstrated just how dangerous this can be, by using Earthlink's set up <a href="http://blog.wired.com/27bstroke6/2008/04/isps-error-page.html" target="_new">to show how it can be used by phishers to make pages look like they're really on someone else's domain</a>.  This particular hole has been patched, but it does demonstrate some of the unintended problems of hijacking a widely accepted standard behavior on the internet for the ISP's own purposes.  The ISPs (including Earthlink in this case) always claim that they put up these ad pages as a "customer service" or to "improve their experience," but that's simply untrue.  Such pages don't help matters.  If a page can't be found, the user should be told that the page can't be found.  They can do a search on a search engine themselves to find the proper page.<br /><br /><a href="http://www.techdirt.com/articles/20080421/015522900.shtml">Permalink</a> | <a href="http://www.techdirt.com/articles/20080421/015522900.shtml#comments">Comments</a> | <a href="http://www.techdirt.com/articles/20080421/015522900.shtml?op=sharethis">Email This Story</a><br />
 ]]></description>
<slash:department>please-stop</slash:department>
<wfw:commentRss>http://www.techdirt.com/comment_rss.php?sid=20080421/015522900</wfw:commentRss>
</item>
<item>
<pubDate>Thu, 3 Apr 2008 23:47:00 PDT</pubDate>
<title>Army Sets Up Phishing Scam To See How Gullible Service Members Are</title>
<dc:creator>Mike Masnick</dc:creator>
<link>http://www.techdirt.com/articles/20080402/194347734.shtml</link>
<guid>http://www.techdirt.com/articles/20080402/194347734.shtml</guid>
<description><![CDATA[ Well, since Japan <a href="http://www.techdirt.com/articles/20050623/0251255.shtml">leaked</a> nuclear secrets via a P2P site, perhaps it's nice to know that our military runs its own phishing tests to see how gullible service members are.  <a href="http://yro.slashdot.org/article.pl?sid=08/04/02/2053208&#038;from=rss">Slashdot</a> points us to the news that the Army <a href="http://www.military.com/news/article/net-scam-actually-an-army-security-test.html" target="_new">ran its own phishing scam</a>, emailing members with an offer for free tickets to theme parks if they just went to a website and filled in certain information.  The test itself was set up by the U.S Army Intelligence and Security Command (INSCOM) and U.S. Army Network Enterprise Technology Command (NETCOM) -- and it involved a "fake" website supposedly from Army Family and Morale, Welfare and Recreation Command (Family and MWR).  Amusingly, it appears that INSCOM and NETCOM didn't bother to tell the folks at Family and MWR that they were conducting this test, so the group had rushed out an announcement warning people away from the fake site, only to later be clued in by the security folks.  Oh well, it still seems better than <a href="http://www.ynetnews.com/articles/0,7340,L-3052074,00.html">using Dungeons &#038; Dragons</a> as a test of whether army members are security risks.<br /><br /><a href="http://www.techdirt.com/articles/20080402/194347734.shtml">Permalink</a> | <a href="http://www.techdirt.com/articles/20080402/194347734.shtml#comments">Comments</a> | <a href="http://www.techdirt.com/articles/20080402/194347734.shtml?op=sharethis">Email This Story</a><br />
 ]]></description>
<slash:department>and-here's-the-list-of-folks-not-to-give-sensitive-info-to</slash:department>
<wfw:commentRss>http://www.techdirt.com/comment_rss.php?sid=20080402/194347734</wfw:commentRss>
</item>
<item>
<pubDate>Wed, 27 Feb 2008 07:21:00 PST</pubDate>
<title>Senate Looks To Outlaw Phishing, Even Though It's Already Illegal</title>
<dc:creator>Mike Masnick</dc:creator>
<link>http://www.techdirt.com/articles/20080226/195527365.shtml</link>
<guid>http://www.techdirt.com/articles/20080226/195527365.shtml</guid>
<description><![CDATA[ As the saying goes, when your only tool is a hammer, everything starts to look like a nail.  The folks in Congress sure do an awful lot of whacking at various nails these days.  The latest is a new bill in the Senate that <a href="http://www.news.com/8301-13578_3-9879859-38.html?part=rss&#038;subj=news&#038;tag=2547-1_3-0-20" target="_new">seeks to outlaw phishing</a>.  One tiny point is important here: phishing is already illegal.  So, really all this bill does is allow these politicians to claim that they took a stand to stop phishing.  Except, it's actually worse than that.  Not only will this bill not do anything to stop phishing, it will actually make life worse for plenty of non-criminals.  That's because a part of the bill would outlaw hiding domain name registration information.  Now, there are plenty of legitimate reasons for not wanting to reveal your info in the whois database -- but according to this bill, it won't be allowed any more.  If you want to own a domain, you'll need to cough up your name, address and phone number to whoever wants it -- and they better be legit.  If you provide false info, you'll also be breaking the law.  So, it won't do anything new to stop phishing, but will make it much more difficult to own a domain anonymously.  That's quite a nail.<br /><br /><a href="http://www.techdirt.com/articles/20080226/195527365.shtml">Permalink</a> | <a href="http://www.techdirt.com/articles/20080226/195527365.shtml#comments">Comments</a> | <a href="http://www.techdirt.com/articles/20080226/195527365.shtml?op=sharethis">Email This Story</a><br />
 ]]></description>
<slash:department>gotta-do-something</slash:department>
<wfw:commentRss>http://www.techdirt.com/comment_rss.php?sid=20080226/195527365</wfw:commentRss>
</item>
<item>
<pubDate>Tue, 30 Oct 2007 21:49:19 PDT</pubDate>
<title>Phishing Scammers Convince Grocery Store To Give Them $10 Million</title>
<dc:creator>Mike Masnick</dc:creator>
<link>http://www.techdirt.com/articles/20071029/222817.shtml</link>
<guid>http://www.techdirt.com/articles/20071029/222817.shtml</guid>
<description><![CDATA[ By now, most people are familiar with how phishing scams work, usually preying on individuals and tricking them into handing over data that allows the scammers access to bank accounts or other useful info.  However, scammers have been aiming a bit higher lately.  One tactic is commonly referred to as "spear phishing," where scammers focus on business targets, and attempt to convince them that they're actually coming from partners or suppliers.  Apparently one such spear phishing attempt nearly worked to the tune of $10 million.  The scammers sent two emails to someone at the headquarters of the supermarket chain Supervalu, purporting to be from Supervalu suppliers American Greetings and Frito-Lay.  Both emails claimed that their bank account info had changed and Supervalu now needed to deposit payments into different accounts.  Someone at Supervalu followed the instructions, leading <a href="http://www.computerworld.com/action/article.do?command=viewArticleBasic&#038;taxonomyName=spam__malware_and_vulnerabilities&#038;articleId=306300&#038;taxonomyId=85">approximately $10 million to be deposited into the two accounts</a> over a period of about 4 days.  At this point, someone from Supervalu figured out there was a problem and alerted the authorities, who were then able to recover most of the money before the scammers withdrew it.  However, it appears that no one has yet figured out who opened the accounts, though Supervalu has filed a lawsuit in order to try to get that information.<br /><br /><a href="http://www.techdirt.com/articles/20071029/222817.shtml">Permalink</a> | <a href="http://www.techdirt.com/articles/20071029/222817.shtml#comments">Comments</a> | <a href="http://www.techdirt.com/articles/20071029/222817.shtml?op=sharethis">Email This Story</a><br />
 ]]></description>
<slash:department>the-big-phish</slash:department>
<wfw:commentRss>http://www.techdirt.com/comment_rss.php?sid=20071029/222817</wfw:commentRss>
</item>
<item>
<pubDate>Mon, 23 Jul 2007 08:34:37 PDT</pubDate>
<title>Latest Phishing Scam... Actually University Research</title>
<dc:creator>Mike Masnick</dc:creator>
<link>http://www.techdirt.com/articles/20070722/221435.shtml</link>
<guid>http://www.techdirt.com/articles/20070722/221435.shtml</guid>
<description><![CDATA[ Lots of people are trying to research phishing scams in order to better understand them and come up with better ways to protect against them, but some folks are apparently a bit upset at research coming out of Indiana University that involved <a href="http://hosted.ap.org/dynamic/stories/P/PHONY_PHISHING?SITE=CADIU&#038;SECTION=HOME&#038;TEMPLATE=DEFAULT">actually phishing a variety of people</a> to con important information out of them in order to understand what kind of phishing scams work.  The researchers and the university are defending the practice, saying they learned a lot from it, and it's legal to be deceptive for the purpose of research so long as the deception is no different than what a person might come across normally and the risk to the person is minimal.  Still, if any of the information is eventually misused or gets leaked, it certainly could create some problems for the university (and universities are no stranger to <a href="http://www.techdirt.com/articles/20070711/135658.shtml">leaking data</a>).  The university still claims that this kind of research is key to preventing phishing... but oddly, the article seems to highlight what works <i>for</i> phishing scams, rather than what works to stop phishing scams.  So, right now, the research seems to be telling scammers how to be more effective scammers, rather than coming up with ways to stop phishing.<br /><br /><a href="http://www.techdirt.com/articles/20070722/221435.shtml">Permalink</a> | <a href="http://www.techdirt.com/articles/20070722/221435.shtml#comments">Comments</a> | <a href="http://www.techdirt.com/articles/20070722/221435.shtml?op=sharethis">Email This Story</a><br />
 ]]></description>
<slash:department>gotta-trick-you-to-understand</slash:department>
<wfw:commentRss>http://www.techdirt.com/comment_rss.php?sid=20070722/221435</wfw:commentRss>
</item>
</channel>
</rss>