Theft at Monster alarms experts
528474
Security specialists say that the alleged theft of information of millions of users of the Monster.com job-hunting website shows how cunning and dangerous e-mail scammers have become.
425595
Patrolman Brian Johnson of the Franklin, Mass., Police Department studied a surveillance video showing two men using allegedly stolen credit cards at a Home Depot.But when Johnson didn't recognize either man, he decided to involve people - a lot of them - to help crack the case.
385952
On the morning of Nov. 17, Ben Adams found himself hiding beneath the retractable cover in the back of a Chevy TrailBlazer. The truck was parked in front of a warehouse in Duncanville, Texas. His friend &quot;Sam,&quot; the TrailBlazer&#39;s owner, had just finished a test drive on a 1949 Chevy truck--the same truck Adams was certain had been stolen from him four months earlier.Adams pulled out his mobile phone and dialed 911. &quot;Please help me,&quot; he said. &quot;I&#39;m at a warehouse. There are criminals all around me.&quot;The story of how a mild-mannered software developer from San Antonio, Texas,&#160;ended up running his own undercover sting operation against eBay fraudsters begins with a truck. And if the story has a lesson, it&#39;s the one told on Adams&#39;s blog: Don&#39;t mess with Texas, especially if it involves a truck.The Colbert RapportLast July, Adams sold the 1949 Chevy in an eBay auction. The buyer, who called himself Derrick Colbert, appeared to be from Georgia. And when a transport company employee showed up at Adams&#39;s door with a cashier&#39;s check for US$9,600, Adams let him load up the truck and promised to hand over the title when the check cleared.The next day, he learned from his bank that the check was a fake.Adams immediately contacted no fewer than 15 law enforcement organizations and eBay itself, but he also began some sleuthing of his own.He found that the thief had made an important slip-up. While corresponding about the truck, Colbert had sent Adams an e-mail from a second eBay address, different from the one he used to purchase the truck.Hunting Down the ThiefBy tracking the sales and purchases of Colbert&#39;s second eBay ID and contacting a Colorado dealer who had sold him a junky 1950 Chevy truck, Adams was able to track Colbert down to the South Dallas area. But he still didn&#39;t have his truck.By now, Adams had put together a 10-page packet of information and sent it&#160;to every law enforcement agency he could think of. But police didn&#39;t seem to have much interest in working on the case, and although he had reported Colbert to eBay, that didn&#39;t get him anywhere either.&quot;At this point, I was kind of depressed,&quot; remembered Adams. &quot;Every few weeks, I&#39;d do regular eBay searches for all automobiles made between 1948 and 1952 that were within the Dallas-Fort Worth area... I even searched in Craigslist.&quot;And then on November 13, his luck changed.The Big PaybackColbert had listed the pale blue 1950 Chevy for sale on eBay. Only it wasn&#39;t junky anymore, and it didn&#39;t look like the 1950 Chevy that Colbert had bought from the Colorado dealer a few weeks earlier. It looked just like a repainted version of Adams&#39;s 1949 truck. It had the same windows in back, the same missing gas cap, and the same yellow stain across the passenger side of the front windshield.&quot;It made me sick to my stomach,&quot; Adams said. He called local police, but they were skeptical. So he decided to set up a sting.First step: fake ID. He took a tip from the thieves and bought a prepaid mobile phone in the Dallas-Fort Worth area. Then using a friend&#39;s well-established eBay account, he placed a couple of bids on the truck to show that he was an interested buyer. His name became &quot;Sam.&quot;He didn&#39;t want to seem too eager. In fact, he didn&#39;t want to do anything to tip Colbert off. And although he thought he might be putting his life at risk, Adams called Colbert and asked to set up a Saturday morning test drive. To be sure that Adams wouldn&#39;t be recognized, a friend volunteered to play the part of &quot;Sam&quot; during the face-to-face meeting.And that&#39;s how Ben Adams ended up hidden inside a Chevy TrailBlazer on a Saturday morning, calling 911. Patrol cars speeding to the scene met up with Adams and his friend about a half-mile from the warehouse and followed the amateur sleuths back to the truck.&quot;They probably had a two-minute window where they probably could have shut the warehouse door and hit the road,&quot; Adams said.But the thieves didn&#39;t leave, and now Adams has his truck back. And this time he plans to keep it.
77057
LONDON - Robbers with their own trucks stole six trailer loads of chocolates worth more than $900,000 from an industrial park in northeast England, police said Monday.    Since the chocolate heist at the Great Bear Distribution Center in Skelmersdale in the early hours of Sunday, five of the trailers have been recovered: four of them empty and the fifth still containing its load of Easter eggs...
510211
(InfoWorld) - The last thing you need when you're unemployed is a bank account that's suddenly emptied. But that's exactly what some unwary users of employment search site Monster.com faced after identity thieves made off with the personal information of more than a million people looking for jobs. This still-developing story has enough nooks and crannies to confuse a gumshoe, but some facts are clear: Monster's resume database was looted, and the personal information taken was used to forge convincing messages that deposited password-stealing Trojans and ransomware on users' PCs. Calculated and ambitious, the attack is striking for how it blended several elements -- stolen credentials of legitimate users, phishing e-mails, Trojan horses, money mules and more -- into a slick assault. Here's what we know so far. Was Monster.com hacked? No, as Symantec said immediately. Instead, the attackers accessed the resume database with legitimate usernames and passwords, probably stolen from professional recruiters and human resource personnel who use the "Monster for employers" section of the site to look for job candidates. But it wasn't until Thursday that Monster.com admitted as much. "By gaining unauthorized access to employer accounts, the software was obtaining job seeker contact information," a new alert said. What was snatched from the database? Names, e-mail addresses, mailing addresses, phone numbers and resume IDs, said Symantec. Yesterday, Monster.com added that only about 5,000 of the people whose data was filched live outside the U.S. That squares with what Symantec's Amado Hidalgo said in an e-mail: The information-stealing Trojan was hard-coded to dig through only the "hiring.monster.com" and "recruiter.monster.com" domains, limiting their theft to the Monster USA site's database. "They only targeted the U.S. Monster site and not any other international Monster [Worldwide] Inc. sites, such as those in the U.K., Spain, etc.," said Hidalgo. How was the information stolen? The Infostealer.Monstres Trojan runs batch searches by sending HTTP commands to the Monster Web site to navigate through folders, said Hidalgo. The malware then parses the output that appears in a pop-up window that holds the job seeker profiles that match the search criteria. Essentially, the Trojan worked as an automated search bot that located candidates, captured their contact information and sent it to a remote server controlled by the criminals. Symantec said that the server, though located in Russia, was hosted by a company out of Ukraine. By using Infostealer.Monstres to do their harvesting, the attackers also covered their tracks -- the Trojan could be planted on any computer previously compromised, with the search seemingly originating with that computer's owner -- and could easily spread the work out among a number of IP addresses, probably to slip under any Monster radar potentially watching for unusually large numbers of search requests coming from any one location. (There is no evidence at the moment that Monster deploys such radar.) How many people are affected? Initially, Symantec's researchers played it vague, saying only that "several hundred thousand" were at risk. Thursday, though, Monster said that it had found contact information on the hackers' server for about 1.3 million people who had posted resumes. The other number that's been bandied about -- 1.6 million -- represents the tally of contact entries Symantec counted on the server last week; a significant number of Monster users apparently post more than one resume. How did the hackers manage to grab so many contract records without Monster.com noticing? That's a good question. Monster itself hinted at one explanation: automated searches like the ones Infostealer.Monstres ran aren't unusual. "Many of our customers use automatic or semiautomatic means to search our database," said Monster spokesman Steve Sylven last Sunday. "Moreover, many of our larger customers rely heavily on our database, and their use may be similar to programmatic or scripted access." Translation: The searches conducted by the bigger Monster customers are as bot-like as those run by the Trojan. The thieves also probably relied on some standard tactics to avoid detection, including running the searches from innocent PCs and spreading out the work (see "How was the information stolen?" above). Spammers and malware spreaders use zombies to send junk mail and malware for the same reasons. What did the criminals do with the Monster data once they had it? No one's arguing the facts: personal information purloined from the Monster resume database was used to create, then send, targeted phishing e-mails -- the term is "spear phishing" -- that spread other malicious software or recruited "money mules," the middlemen who transfer money from a phished bank account to a foreign bank account. It's the emphasis where Monster and Symantec part. Monster has focused on the mule-recruiting angle or even depicted those e-mails as run-of-the-mill phishing. "The purpose of gathering this information appears to be sending email disguised as Monster in order to gain recipients' trust, and then attempting to convince users to engage in financial transactions," the company now says on its revised security alert. Only in passing does it also call out "or lure them into downloading malicious software." That, however, is the prime use of the stolen information, said Symantec's Hidalgo, who traced connections between Infostealer.Monstres and at least two other Trojans. The first, Banker.c, watches for, steals, then transmits back to hacker HQ online banking log-in information for accounts at Bank of America and the German arm of Citibank. The second, Gpcoder.e, is "ransomware," a Trojan that encrypts files on the infected PC's hard drive, then informs its owner that the files will be unusable until a fee is paid. In Gpcoder.e's case, the ransom was $300. What good does the other stolen information do the thieves? Two words: response rate. According to research conducted by an Indiana University team in 2005, people are much more likely to click or give up information if the message contains clues of legitimacy, as when the message appears to come from a close friend. In fact, 72 percent of the people in the study who received phishing mail from someone in their social network took the bait and divulged their log-on information, four and a half times the number in the control group. Spear phishing, then, can be incredibly effective, at least from the criminals' point of view. By using the Monster resume data to target the recipient and flesh out the e-mail with the recipient's real name -- often usually difficult or impossible to guess from the e-mail address itself -- the crooks can expect more people to let down their guard and actually launch the attached file. (In the case of Gpcoder.e, the file posed as Monster Job Seeker Tool, fictitious software of course, but likely enough to get people to click; when they did, they installed the Trojan, not a job search assistant.) So the goal of the attackers is...what? Bank account log-ons, clearly. Ransomware, though not uncommon, usually flops because someone -- often one or more security vendors -- cracks the encryption used to lock up the files and makes that public, eliminating the need to pay up. Another clue that bank accounts are the endgame is the effort spent on recruiting money mules. The group wouldn't need mules unless it had, or anticipated having, access to bank accounts. When did this start? We don't know, and so far, Monster has not talked about this. But one self-described Monster user claimed here to have received money-mule messages between June 3 and June 13, and had reported them to Monster. "Monster only said it was not from them and did not admit that they had let my information get away from them," said "Anonymous." Symantec first alerted Monster of its findings last Friday, Aug. 17, both the security company and Monster have said. Evidence of the Gpcoder.e seeding -- using phony Monster messages touting a nonexistent tool -- goes back at least as far as early July, according to analysis by U.K.-based security company Prevx Ltd. It may have started days or even weeks before that. Some reports, in fact, have claimed users started seeing phishing mail built atop the stolen personal information as early as February of this year. What can Monster users do to protect themselves? For the 1.3 million whose resumes have been pillaged, it's too late; the horse has left the barn. Even so, some users decided to cancel their accounts as a way to block any future malware-based searches. "I can still search for jobs and submit my resume to postings, but employers/recruiters cannot find me in their searches," said a Chicago user identified as "Greg" in a comment on a Computerworld story that ran Thursday. "I certainly would encourage others to protect themselves and delete their Monster accounts as well." Monster hasn't disabled batch or automated searches, or if it has, it's not said as much. (On Sunday, company spokesman Steve Sylven seemed to say that because large corporate customers of the service used automated searches, banning them would be out of the question.) It has, however, shut down the server that the gang was using to store its stolen data and presumably disabled the legitimate accounts used to access the database. (Symantec's Hidalgo said last week that his team had forwarded those accounts to Monster.) We say "presumably" because while we have asked Monster if those accounts have been closed, the company has not explicitly acknowledged doing so. Other than that, the only advice being given by Monster or Symantec is the usual: Be suspicious of all unsolicited, unanticipated e-mail, run up-to-date antivirus software -- to stop Trojans such as Banker.c or Gpcoder.e at the door -- and refuse to give out personal information.
515287
By James Ashton, Daily Mail, London  Jan. 31--Alarm bells, not cash tills, are ringing loudly at Torex Retail  after the Serious Fraud Office launched a criminal probe into its affairs and  searched the homes of three directors.
713091
By James Ragland, The Dallas Morning News  Sep. 18--The alarm industry certainly knows how to fight.   Not sure anyone can say they're playing dirty.
570280
InfoWorld - One week after&#160;hackers stole personal information from millions of people who had posted their resumes to the job-searching site Monster.com, the company has warned its users to be vigilant about online fraud because the breach was not an isolated incident.
750255
ERIE, Pa. - A man on probation for stealing $361,000 from a business he co-owned has stolen from his new employer, police said. Patrick J. Leighton, 59, of Erie, stole $2,621 from a veterinary clinic while he was working as a manager in November, according to state police.
664327
Scammers and thieves are out there, but you can protect yourself.
578368
By Dan Galindo, Winston-Salem Journal, N.C.  Feb. 7--Twenty computers and monitors were stolen from Sedge Garden Elementary School last week, Winston-Salem police said yesterday.   The Forsyth County Sheriff's Office also has been investigating four other recent break-ins at schools.
125475
(InfoWorld) - A gang of thieves stole computer chips reportedly worth millions of U.S. dollars in a Monday raid on an air cargo terminal in Batu Muang, Malaysia. "The incident occurred between 2.00 a.m and 3.30 a.m when the group, with weapons, forced its way into the [Penang International Airport Free Commercial Zone] facility after overpowering the personnel on duty at the Malaysia Airlines security checkpoint and the Royal Malaysian Customs office," Malaysia Airlines Cargo Sdn. Bhd. (MASkargo) said in a statement. Malaysian police are investigating the theft, MASkargo said. The gang of 20 thieves subdued 17 security guards using weapons and chloroform before stealing 585 cartons and 18 pallets of microchips and motherboards manufactured by a multinational company in Bayan Lepas, Malaysia, The Star newspaper reported Tuesday on its Web site. The stolen goods were estimated to be worth $12.7 million, making the theft the largest ever in Malaysia, it said. News reports in Malaysia have not named the multinational company that produced the chips. Several large companies, including Dell, Intel, and Advanced Micro Devices, have operations in Bayan Lepas, which is near Penang.
378646
Monster.com waited five days to tell users its system had been hacked, in a security breach that resulted in the theft of confidential information for more than a million users, a company executive told Reuters yesterday.
416328
Not Your Average Joe's, a Massachusetts restaurant chain, said yesterday that thieves have stolen credit card data belonging to its customers.
284239
Monster.com waited five days to tell users its system had been hacked, in a security breach that resulted in the theft of confidential information for more than a million users, a company executive told Reuters on Thursday.
625078
By JOHN CURRAN  BURLINGTON, Vt. - The theft of a 4-foot statue of Ronald McDonald was probably a prank, police said - but people at the home for sick children it was stolen from aren't laughing.
412634
Laptop with employee information stolen from Home Depot manager's car.