Fake Subpoenas Sent To CEOs For Social Engineering

An anonymous reader writes "The Internet Storm Center notes that emails that look like subpoenas are being sent out to the CEOs of major US corporations. The email tries to entice the victim to click on a link for 'more information.' According to the ISC's John Bambenek: 'We've gotten a few reports that some CEOs have received what purports to be a federal subpoena via email ordering their testimony in a case. It then asks them to click a link and download the case history and associated information. One problem, it's [totally] bogus. It's a "click-the-link-for-malware" typical spammer stunt. So, first and foremost, don't click on such links. An interesting component of this scam was that it did properly identify the CEO and send it to his email directly. It's very highly targeted that way.'"

Comments

Subpoena by *email* ??

[nurb432]

If you fall for that you deserve to get taken.

Re:Subpoena by *email* ??

[WaltBusterkeys]

Stranger things have happened, especially in cases where the events took place online. Normally you're right that service has to be done in person or by US mail.

BUT, if the only known way to contact a defendant or witness is by email (if, for example, their real names or addresses are unknown), then a court can authorize that as an alternative form of service. It's up to the court to decide if email would give sufficient notice and other means are impractical.

Here, of course, there's no reason to think that sending certified mail or a process server wouldn't work -- a corporate CEO isn't hard to find and service on a company can almost always be done through the state's secretary of state.

But, that doesn't mean that electronic subpoenas are never possible, as you suggest.

Re:Subpoena by *email* ??

[WaltBusterkeys]

Sure, here's an example of service by email:

Plaintiffs Tishman and Wilkinson filed a lawsuit against defendant Pine, but had difficulty serving Pine with the summons. The plaintiffs tried the conventional methods of service under New York law, such as personal delivery. They even tried the "nailing and mailing" method by affixing a copy of the summons to the door of Pine's residence, then sending a copy in the mail.

Tishman and Wilkinson had information, however, that led them to believe Pine was out of the country. . . They petitioned the court for permission to serve Pine by e-mail, pursuant to N.Y. C.P.L.R. Â308(5), which allows service by such manner as the court directs, when the more conventional methods are "impracticable."

The court allowed service of the summons to an e-mail address Pine had used in a classified ad listing his house for sale. The court held that given the uncertainty about the success of the attempted "nailing and mailing" effort, and the fact that the Pine's attorneys wouldn't give a clear answer as to where Pine was living, alternative service by e-mail was appropriate.

Most states have similar laws that allow service by any practical means if conventional methods fail.

Re:Subpoena by *email* ??

[Anonymous Coward]

Actually my experience in Corperate IT, most C*O executives are dumb enough to open such items.

Cripes most virus infections at corperations come from these dimrods.

You already have real problems.

[Cajun Hell]

So, first and foremost, don't click on such links.

If clicking a link poses even the slightest risk, you need to replace your software ASAP.

Websites don't "run" malware; users download and install malware with execution privileges. Or their defective user agents do it for them. CEOs don't need defective user agents. I'm not sure who does.

Re:You already have real problems.

[Anonymous Coward]

CEOs should know better anyway. Start of process is with your registered agent, not your email address.

Re:You already have real problems.

[cynicsreport]

So, first and foremost, don't click on such links.

This is always good advice. For more information on how to avoid anonymous links, check out this website.

Re:You already have real problems.

[Lobster Quadrille]

I clicked it. It just says 'server not found'.

If you're going to make a joke on slashdot, you gotta at least register the domain and build a website, or nobody will take you seriously.

Boss got this yesterday

[ResQuad]

My boss received one of these yesterday. Luckily he is one of the smarter people in this world and FW'd me the email (being the suspicious person he is). Personally I thought it was rather clever.

Also - I wonder... Is there some "hacker code" out there that says if you are sending out a phishing email - you must misspell at least a few words? Cause these subpoenas looked fairly good - but there were misspellings. Can't they just run the emails through Word or Open Office before they send them out?

Re:Boss got this yesterday

[Anonymous Coward]

Is there some "hacker code" out there that says if you are sending out a phishing email - you must misspell at least a few words?

We're really not supposed to talk about the hacker code in public, where n00bs might see.

Re:Boss got this yesterday

[tattood]

The first rule of hacker code is - you don't talk about hacker code.

Etch a Sketch

[EEPROMS]

We just gave our CEO a new laptop, that reminds me I better tell him he needs to shake it to reset.

Re:I have been saying this...

[Digi-John]

The real danger lies elsewhere. Stories like this and the cyber-war story about the US and China are the ones that you need to follow and think about.

It looks a lot like the butterfly effect http://en.wikipedia.org/wiki/Butterfly_effect in the fact that one small chance encounter or small piece of information can greatly affect the outcome of a particular chain of events. Your company makes cheeseburger boxes for a company whose CEO, in turn, is a friend of or associate of some political figure. This information is gleened from your system via email, and phishing email is used to get that political figure to open an email which is a dupe of a previous email sent, but contains an active-x payload... this in turn leads to more serious and useful information down the road... and viola! you have enough for a hack on the RNC mail server...

That is how spying works, a little bit at a time, patiently looking for a chink in the armor.

Reminds me of the information security training I had to take before starting my job here at a national lab. First, we watched a video in which an ex-KGB boss who now provides security consulting worldwide says, "Do not think that because you are low-ranking or do not work with classified information, that you are not a potential target for espionage" and goes on to tell us how almost certainly at least a few of the people we work with have been or will be targeted for espionage or potential defection. Then we were told how several pieces of non-classified information can be put together to create classified information, even unintentionally.

Even if you don't work for the government, you have to be really careful if you want your data to be secure.

I was hit by it...

[npal]

I saw it on my Treo and it looked very real - at first. There were four issues: It was a Federal subpoena but it mentioned a "city prosecutor" down towards the end. This started some suspicion.
Then I noticed that it was a grand jury for a civil trial. So I'm wondering, do they use grand jury's for civil trials? It was in California, so I thought maybe they somehow did. Then, I could see that they wanted a credit card to get the information. Big red flag, but it used pricing by the page - so I thought only the government could dream up something like this and maybe it was legit. Finally, the domain name for the link to the credit card page looked okay, but it was phony.

All and all, I'll bet a number of people fell for it because the targeting was so good.

That's nothing

[PCM2]

You think that's targeted? The other day I received an e-mail from a pharmaceutical company offering to discuss options for enlarging my very small penis. They asked me if I was tired of being unable to satisfy women, and whether I had tried the other pills without results. I mean, seriously ... how can spammers find out stuff like this?? I'm switching to Firefox.