Unhappy 39th birthday, spam, and many unhappy returns

From Sophos Naked Security:

Unhappy 39th birthday, spam, and many unhappy returns

"In October 2011, email turned 40. Last week it was the turn of its troublesome twin, spam, to make it to within a year of the same hoary milestone.

Inevitably in an industry ageing fast, personal computing’s calendar is filling up with significant anniversaries. So, does spam’s – or email’s – really matter that much?"

Monsanto accused of hiring army of trolls to silence online dissent – court papers

From RT:

Monsanto accused of hiring army of trolls to silence online dissent – court papers

"Biotech giant Monsanto is being accused of hiring, through third parties, an army of Internet trolls to counter negative comments, while citing positive “ghost-written” pseudo-scientific reports which downplay the potential risks of their products.

The documents emerged during pre-trials on 50 lawsuits against Monsanto which were pending in the US District Court in San Francisco. The plaintiffs allege that exposure to the biotech giant’s flagship product, the herbicide Roundup, caused them or their relatives to develop non-Hodgkin lymphoma, while Monsanto concealed the potential risks."

How to protect your boss from phishing attacks

From Sophos Naked Security:

How to protect your boss from phishing attacks

"We already know that more than 75% of us lie on social media.

Too bad it’s impracticable to lie more about our workplaces on professional networking sites like LinkedIn: it might spare our employers a lot of grief."

FBI: Business- and Email Account Compromise Attack Losses Hit $5 Billion

From Dark Reading:

FBI: Business- and Email Account Compromise Attack Losses Hit $5 Billion

"The FBI's IC3 division reports a 2,370% spike in exposed losses resulting from BEC and EAC between January 2015 and December 2016.

The FBI's Internet Crime Complaint Center (IC3) reports business email compromise (BEC) and email account compromise (EAC) attacks caused $5.3 billion in exposed loss for global and domestic companies between October 2013 and December 2016. Victims, which come from 50 states and 131 countries, reported a total of 40,203 incidents in the same time period."

Europe Pumps Out 50% More Cybercrime Attacks Than US

From Dark Reading:

Europe Pumps Out 50% More Cybercrime Attacks Than US

"Cyberattacks originating from Europe were substantially higher than nefarious activity launched from the US during the first quarter.

Cybercrime attacks launched from Europe reached more than 50 million in the first quarter, double the volume coming out of the US, according to the ThreatMetrix Q1 Cybercrime Report released today."

FTC Alert: Who's really calling?

From the Federal Trade Commission:

Who's really calling?

"The millions of people who reported scams last year told us that imposters were the top fraud of the year. Imposters have called many of us – maybe even most of us, pretending to be anyone from the IRS to a family member in trouble, from fake tech “help” for your computer to a business selling things that turned out to be bogus. Their goal? To get your money as quickly as possible."

Google Docs Phishing Attack Abuses Legitimate Third-Party Sharing

From Dark Reading:

Google Docs Phishing Attack Abuses Legitimate Third-Party Sharing

"Phishing messages appear nearly identical to legitimate requests to share Google documents, because in many ways, they are.

Google users today were hit with an extremely convincing phishing spree launched by attackers who manipulated Google Docs' legitimate third-party sharing mechanism."

Update: Google Doc phishing story takes some bizarre turns

From Sophos Naked Security:

Update: Google Doc phishing story takes some bizarre turns

"Since news began circulating last night of a phishing campaign parading around as Google Doc access links, the tale has taken strange twists and turns.

A self-described graduate student claims he was behind the blast of emails, and that they were part of a test for a school project, not a phishing attack. But according to the university he claims to be enrolled at, he’s not a student there."

FYI - to help reduce the attack surface block:

hhhhhhhhhhhhhhhh @ mailinator . com

on your email system(s).

OAUTH phishing against Google Docs ? beware!

From SANS ISC:

OAUTH phishing against Google Docs ? beware!

We got several reports (thanks to Seren Thompson, Tahir Khan and Harry Vann) about OAUTH phishing attacks against Google users. The phishing attack arrives, of course, as an e-mail where it appears that a user (potentially even one on your contact list, so it looks very legitimate) has shared a document.

An image of such an e-mail is shown below:

How Cybercrooks Put the Beatdown on My Beats

From Krebs On Security:

How Cybercrooks Put the Beatdown on My Beats

"Last month Yours Truly got snookered by a too-good-to-be-true online scam in which some dirtball hijacked an Amazon merchant’s account and used it to pimp steeply discounted electronics that he never intended to sell. Amazon refunded my money, and the legitimate seller never did figure out how his account was hacked. But such attacks are becoming more prevalent of late as crooks increasingly turn to online crimeware services that make it a cakewalk to cash out stolen passwords."

Blind Trust in Email Could Cost You Your Home

From Krebs On Security:

Blind Trust in Email Could Cost You Your Home

"The process of buying or selling a home can be extremely stressful and complex, but imagine the stress that would boil up if — at settlement — your money was wired to scammers in another country instead of to the settlement firm or escrow company. Here’s the story about a phishing email that cost a couple their home and left them scrambling for months to recover hundreds of thousands in cash that went missing."

Infographic: 7 Ways Hackers Look To Exploit Your State & Local Governments

PDF format infographic from CoreSecurity:

7 Ways Hackers Look To Exploit Your State & Local Governments

POLICE PHONE SCAM ALERT

Yesterday I received a call from someone pretending to be Det. Garry McFadden from the Charlotte-Mecklenberg PD.  The caller left a message stating there was a criminal charge filed against me & I would be arrested if I didn't call back within 24-48 hours.

I returned the call several times.  Each time the phone rang three (3) times before giving me a message stating "The person you are calling has a voicemail box that has not been set up."  This morning I spoke with a person with the CMPD.  They confirmed that Det. Garry McFadden was a detective in their department but has retired because he has a show on Investigation Discovery.  The person indicated this is a scam and forwarded me to their Fraud Dept.

Earlier today I spoke with the person claiming to be Det. McFadden.  He went into a high pressure spiel about charges being filed if I did not take care of this matter immediately.  I confirmed his name & asked if he was still with the CMPD.  The male stated he was.  I then asked if he was the same Det. McFadden who now has a show on ID.  He said that was him & he is now a private investigator.  At this point I asked if he was a private investigator & no longer associated with the CMPD why was he misrepresenting himself as an officer of the law?  The male did not answer this question, instead he stated that he had "talked to some people up in my area."  I asked what PD & with whom he had spoken to.  The male hung up the phone immediately.

I have made repeated calls to the number for this scammer after he hung up.  All have gone directly to the voicemail & message noted above.  I've also provided the number to several of my colleagues who have been calling it with the same results.

In the event you have been contacted by this person please report it to the CMPD at 704-336-7600.  The number this "person" was calling from is 704-292-4414.

704-292-4414 / 704-292-4414 / 704-292-4414 / 704-292-4414 / 704-292-4414 / 704-292-4414 / 704-292-4414 / 704-292-4414 / 704-292-4414 / 704-292-4414 / 704-292-4414 / 704-292-4414 / 704-292-4414 / 704-292-4414

Leaked document reveals Facebook conducted research to target emotionally vulnerable and insecure youth

From news.com.au:

Leaked document reveals Facebook conducted research to target emotionally vulnerable and insecure youth

"FACEBOOK has come under fire over revelations it is targeting potentially vulnerable youths who “need a confidence boost” to facilitate predatory advertising practices.

The allegation was revealed this morning by The Australian which obtained internal documents from the social media giant which reportedly show how Facebook can exploit the moods and insecurities of teenagers using the platform for the potential benefit of advertisers."

FTC Offers ID Theft Victims Online Crime Reporting Tool

From Dark Reading:

FTC Offers ID Theft Victims Online Crime Reporting Tool

"ID theft victims can report their cybercrime attack to the Federal Trade Commission, without having to file a police report in most cases.

ID theft victims now have an alternative to filing a police report, a self-service online reporting tool from the Federal Trade Commission (FTC)."

Google, Facebook Swindled in $100M Payment Scam

From Dark Reading:

Google, Facebook Swindled in $100M Payment Scam

"Lithuanian man impersonated an Asian-based manufacturer to trick Facebook and Google into paying him $100 million.

A new investigation has uncovered details of a payment scam targeting Facebook and Google, Fortune reports. Lithuanian Evaldas Rimasauskas impersonated an Asian-based manufacturer, which often did business with both companies, to trick them into paying for products."

Discovery of 8,800 servers sends warning to Asian cybercriminals

From Sophos Naked Security:

Discovery of 8,800 servers sends warning to Asian cybercriminals

"In one of the more curious cybercrime announcements of recent times, Interpol’s Asian centre says it has “identified” 8,800 servers used as command & control (C2) for all sorts of bad things including DDoS attacks and distributing ransomware and spam.

You read that correctly. Interpol hasn’t disrupted these servers, merely passed information on their whereabouts and malevolent purpose to police forces in eight countries, including Malaysia, Myanmar, Philippines, Singapore, Thailand and Vietnam."

Facebook admits it is being used as propaganda tool by ‘malicious actors’

From Sophos Naked Security:

Facebook admits it is being used as propaganda tool by ‘malicious actors’

"What is Facebook?

To most people, it’s something called a “social network”, a thriving digital hub that conveniently also packages news, secure messaging, live video streaming and even a jobs marketplace.

For naysayers, it’s more like an unregulated surveillance system people might not be so keen on if they were to think about the extent to which it is constantly mining their online lives for commercial gain."

Beyond 'Fake News:' Facebook Fights 'Information Operations'

From Newsmax:

Beyond 'Fake News:' Facebook Fights 'Information Operations'

"Facebook is acknowledging that governments or other malicious non-state actors are using its social network to sway political sentiment, including elections."

IRS and Immigration Officials Impersonated in Call Center Scam

From Dark Reading:

IRS and Immigration Officials Impersonated in Call Center Scam

"A call center in India was used to scare US residents with threats of imprisonment and deportation in a ruse that impersonated US officials.

With stolen data and a call center based in India, a group of thieves impersonated Internal Revenue Service and US Citizenship and Immigration Services officials to scare money out of US residents."