Unsung software developers behind rise in online fraud
465970
Tool kits spark explosion in malicious code base, says Symantec One weekend in June, a little-known Trojan downloader made a major debut on the international malware stage after it managed to burrow its way into more than 10,000 websites in just 72 hours. Infected sites - including one connected to rock musician Bon Jovi and another that raises money for charity work of the late Mother Teresa - suddenly became the agents of Russian crime gang, as they pushed malware on unsuspecting visitors.â¦
319877
From disguising applets to look like part of Windows to co-opting security tools, Web crooks use a variety of methods to bypass your system's safeguards.
53902
A Columbia man's computer fraud scheme allegedly involved more than 600 victims worldwide.
230240
Hi-tech fraudsters have developed a new way of tricking customers who go online to do their banking, analysts warned yesterday. A &quot;Trojan horse&quot; programme insinuates itself into a user&#39;s computer via an email
731737
Apparently it&#39;s not just unwary individuals that fall victim to online scammers. Even large corporations, it seems, can get suckered into parting with their money by devious&#160;phishers.Case in point: Eden Prairie, MN.-based grocery chain Supervalu, which earlier this year got conned into depositing more than $10 million into two fraudulent bank accounts before recognizing the ruse. Details of the case are contained in court documents filed in connection with two forfeiture cases stemming from the incident.According to federal court filings in the U.S. District Court for the District of Idaho, the fraudulent activity took place in late February and early March this year. In the court filings, Stephen Kilgroff, Supervalu&#39;s vice president of legal affairs, said that on February 26 and 28 the company received two separate e-mails, one purporting to be from an employee at American Greetings Corp. and the second from an employee at Frito-Lay, both company-approved vendors.Both e-mails told Supervalu to send future payments for each vendor to new bank account numbers. In the case of the e-mail that purported to be from American Greetings Corp., Supervalu was advised to send payments to an HSBC account in Miami. The other e-mail advised Supervalu to send Frito-Lay payments to an account at First Security Bank in Rogers, Arkansas.Between Feb 28 and March 3, Supervalu deposited just over $6.5 million via multiple wire-transfers to the HSBC account, thinking that it was sending the money to American Greetings Corp. Similarly, on March 2 it made eight separate wire-transfers to the bank in Arkansas, depositing a total of $3.6 million to an account it thought belonged to Frito-Lay.In addition to the $6.5 million deposited by Supervalu into the HSBC account, an additional amount of $500,000 had been deposited into the same account by a second company, identified as &quot;ROHM&quot; on court documents. No information has been available concerning the second company, and it is not a party to subsequent litigation.Around March 6, according to the filings made by Kilgroff, Supervalu discovered that it had been &quot;induced&quot; into making the transfers to the bogus accounts. Following the discovery of the fraud, Supervalu quickly notified the appropriate law enforcement authorities, who managed to recover nearly all of the money before it could be withdrawn from the accounts.The recovered money is now being claimed by Frito-Lay, American Greetings and Supervalu. In making the claim to the recovered money, Frito-Lay said that it believes the money belongs to Supervalu and said supported that company&#39;s claim to ownership of the misdirected funds.&quot;However to the extent there is any determination that the ownership of these funds changed from Albertsons/Supervalu [the Albertsons grocery chain was recently acquired by Supervalu] to Frito-Lay (as a result of the attempted transfer, the misdirection, or any other development) Frito-Lay makes this claim to these funds in the alternative and subject to any claim of ownership by Albertsons/Supervalu&quot; the company said in an affidavit.A federal judge is expected to rule sometime in November on which firm should receive the recovered funds.A spokeswoman from Supervalu responded via e-mail to a request for comment. &quot;As indicated by the forfeiture complaint filed by the U.S. Attorney&#39;s Office in Boise, Supervalu was the target of attempted financial fraud,&quot; spokeswoman Haley Meyer said. &quot;Due to our internal controls and processes, we were able to quickly discover and report this to the FBI. As a result of the quick work of the Boise FBI Office and the U.S. Attorney, any funds lost are minimal.&quot;Computerworld is an InfoWorld affiliate.&#160;
524684
Attack of the tainted banner ads Thousands of PC users have been duped into surrendering sensitive information and installing malicious software after falling victim to a complex scam that continues to plague well-known websites, a researcher warns.â¦
438878
The rise in online scams has companies spending hefty sums to educate customers about fraud prevention and to address 'phishing' damage.
94259
Pay-per-click advertising fraud is becoming more pervasive as spurious clicks can be generated through automated programs.
448789
9 out of 10 crooks use ready-made code Phishing kits are helping to dumb down the process of creating fraudulent websites. Back in the day, setting up a bogus facsimile of a banking site required a modicum of programming skills. No more.â¦
724562
Until just a few months ago, Gary Warner did not have the kind of day job you&#39;d expect from an antiphishing crusader. He didn&#39;t work for a security vendor or a bank, or any kind of company you&#39;d expect to care about phishing.Warner&#39;s career as a cyber-sleuth began on Halloween 2000. That&#39;s when his company&#39;s Web site was defaced by a hacker named Pimpshiz as part of a pro-Napster Internet graffiti campaign.&quot;My boss came to me and said, &#39;Find out who did this and put them in jail,&#39;&quot; said Warner, who was at the time an IT staffer with Energen, a Birmingham, Alabama oil and gas company.It was an eye-opening experience. &quot;I called the police and they were like, &#39;What do you want us to do?&#39;&quot; he said.Months later, when Pimpshiz struck servers at NASA, Warner reached out, calling staff there and saying &quot;Hey, we know who this guy is. Here&#39;s his name and address.&quot;Since then, Warner has quietly become one of the most-respected authorities on phishing in the U.S. -- the kind of guy that federal agents and banking IT staff call when they want to know how to catch the bad guys and shut down their credit-card-stealing Web sites.With Warner&#39;s help, authorities eventually arrested Pimpshiz, whose real name is Robert Lyttle,&#160;in connection with the hacks.Fishing for PhishersWarner said that the Pimpshiz case was formative, underlining how hard it is for law enforcement to catch the bad guys on the Internet.&quot;The experience showed me that it&#39;s not that they don&#39;t care,&quot; Warner said.&#160;&quot;Their hands are tied by the legal process.&quot;Soon, Warner found himself spending dozens of hours each week compiling data on spammers and phishing attacks. &quot;I would sit for a couple of hours every morning and find all the new phishing sites that I could,&quot; he said.He&#39;d take screenshots of the sites, e-mail the Webmasters who were hosting them and ask them for Web logs, and eventually he started making connections -- he&#39;d connect one phishing group with several different attacks -- and learn who he needed to call to get Web sites removed, no matter where in the world they were hosted.He&#39;d get calls from IT staff at small credit unions asking for help taking down fraudulent sites, every day, all day long. It was cutting in on his work. Late last year, he decided to make a change. &quot;I went to my boss and told him that I&#39;m going to look for a way to do this full time.&quot;Helping the Feds Crack Down on Online FraudIn July, with recommendations from FBI and Secret Service agents,&#160;Warner took a job as Director of Research in Computer Forensics with the University of Alabama at Birmingham (UAB).He also began working with law enforcement, not only educating FBI and Secret Service agents on how crimes were committed, but also helping to track down the criminals and helping with take-downs.&quot;He&#39;s an outstanding resource for the FBI,&quot; said Dale Miskell,&#160;supervisory special agent with the FBI&#39;s Birmingham Cyber Crime unit, who has worked with Warner since 2005.Miskell said Warner has helped the FBI with investigations and taught staff about his antiphishing techniques.&quot;He could be a multimillionare by his skillsets... he&#39;s a very gifted speaker, he can talk to the techies, and then he can turn around and talk to the non-techies and everyone will understand.&quot;Warner is now focusing on fighting cyber-crime full-time and on training a new generation of network forensics investigators. &quot;You wouldn&#39;t believe the looks on their eyes the first time they got an e-mail back from a Webmaster saying, &#39;Thanks for letting me know. I just shut that down.&#39;&quot;When he spoke with IDG News, it was five days after final exams at the University of Alabama at Birmingham and though it would have no effect on their marks, four students were still coming into the labs to help shut down phishers.&quot;That idea that as a private citizen, you can help, that&#39;s the kind of thing we&#39;re trying to inspire,&quot; he said.The Future of Phish-bustingAt the University, Warner is building up a 256-node supercomputer which could eventually become the largest collection of spam email on the planet, processing as many as 100 million email messages per day and providing researchers and law enforcement with valuable analysis data.For Warner, the work isn&#39;t so much a job, as it is his moral responsibility as a computer scientist. &quot;One of the things that really bothered me from the very beginning was people who were using my field to attack other people,&quot; he said. &quot;The way I see it, this is our Internet. I&#39;m going to stand at the end of my driveway and protect what&#39;s mine.&quot;He says that his anti-phishing work hardly feels like work at all. &quot;This is what I like to do,&quot; he said. &quot;It&#39;s cheaper than golf, and you can do it when the weather&#39;s bad.&quot;What You Can Do to Protect Yourself&quot;The best people that help law enforcement have no motive other than to catch the bad guy,&quot; said one law enforcement official who declined to be identified because he hadn&#39;t been authorized to speak with the press.But even if you&#39;re not a cyber sleuth, if you get hit by a computer criminal there are some things you can do to help police catch the criminal. What you should do depends a little bit on the crime. If you&#39;re the victim of identity theft, it&#39;s worth filing a report with state and local police so that you have a record of the crime.That comes in handy later, in case you need to prove that it was the thief, and not you, that incurred any subsequent charges. Another good place to stop is the Federal Trade Commission (FTC) site, which has a variety of tools to help identity theft victims get organized and set their credit back on track. And if things get really bad, the Social Security Administration can help you, too. This site has instructions on how to report social security fraud and get a new social security number.You can file a report with the FTC, but if you want your data to be used to catch the bad guys, the Internet Crime Complaint Center (IC3) is a better bet. Run in part by the FBI, the IC3 data is used regularly by law enforcement to link together large schemes. The more factual data you can report about your crime, the more useful it will be to police. Sometimes a single fax number or eBay ID can help crack open an entire case.The FBI is most interested in crimes that involve malicious software, phishing, and child pornography. Spam and auction fraud get a lower priority and, worse, if you&#39;re the victim of an auction fraud, the odds of you ever getting your money back are very low.Still, if you&#39;re rigorous about documenting the crime, and you fill out that IC3 complaint, you just may be helping to bring down your criminal -- some day.
172825
Huge crowds in social networking sites draw money-minded malware authors.
143995
A sophisticated hacking scheme seen early last year appears to be affecting an increasing number of Web servers.
160498
Spammers have become enthusiastic adopters of technology designed to spot and stop them.
410306
Online crooks are quickly enlarging an already vast sales and distribution network to propagate spam and send malicious software in hopes of infecting millions of computers worldwide, according to a new report.
317554
Computer criminals are making phishing more potent by automating attacks. Anti-Phishing Working Group (APWG) analysts reckon fraudsters are using automated tools and botnets to ramp up attacks.
570280
InfoWorld - One week after&#160;hackers stole personal information from millions of people who had posted their resumes to the job-searching site Monster.com, the company has warned its users to be vigilant about online fraud because the breach was not an isolated incident.
506530
In open-source software and new media, there's big money in unpaid labor