Slashdot Mirror
Angry Boss Phishing Emails Prompt Fraudulent Wire Transfers
chicksdaddy writes: Lots of studies have shown that assertiveness works in the professional sphere as well as the personal one. It turns out to work pretty well in the cyber criminal sphere, also. Websense Labs has posted a blog warning of a new round of spear phishing attacks that rely on e-mail messages posing as urgent communications from senior officers to lower level employees. The messages demand that the employees wire funds to a destination account provided in the message.
According to Websense, these attacks are low tech. The fraudsters register "typo squatting" domains that look like the target company's domain, but are subtly different. They then set up e-mails at the typo squatted domain designed to mirror legitimate executive email accounts. Like many phishing scams, these attacks rely on the similarities of the domains and often extensive knowledge of key players within the company, creating e-mails that are highly convincing to recipients.
The key element of their attack is – simply – "obeisance," Websense notes. "When the CEO or CFO tells you to do something, you do it." The messages were brief and urgent, included (phony) threads involving other company executives and demanded updates on the progress of the transfer, making the request seem more authentic. Rather than ask the executive for clarification (or scrutinize the FROM line), the employees found it easier to just wire the money to the specified account, Websense reports.
Websense notes the similarities between the technique used in the latest phishing attack and the grain trading firm Scoular in June, 2014. That company was tricked into wiring some $17 million to a bank in China, with employees believing they were acting on the wishes of executives who had communicated through e-mail.
According to Websense, these attacks are low tech. The fraudsters register "typo squatting" domains that look like the target company's domain, but are subtly different. They then set up e-mails at the typo squatted domain designed to mirror legitimate executive email accounts. Like many phishing scams, these attacks rely on the similarities of the domains and often extensive knowledge of key players within the company, creating e-mails that are highly convincing to recipients.
The key element of their attack is – simply – "obeisance," Websense notes. "When the CEO or CFO tells you to do something, you do it." The messages were brief and urgent, included (phony) threads involving other company executives and demanded updates on the progress of the transfer, making the request seem more authentic. Rather than ask the executive for clarification (or scrutinize the FROM line), the employees found it easier to just wire the money to the specified account, Websense reports.
Websense notes the similarities between the technique used in the latest phishing attack and the grain trading firm Scoular in June, 2014. That company was tricked into wiring some $17 million to a bank in China, with employees believing they were acting on the wishes of executives who had communicated through e-mail.
Nuf said.
You can't raise an army of slaves and then expect them to act as free men.
You have to put autonomous thinkers and obeying sheep on their correct places; and there are plenty of both. If you put a sheep on the wrong post, don't go now crying about a problem that you created yourself*.
*: Or your boss, if you're one of the sheep.
just like the prisoner who sent an email to get out, by using proper open source email clients and GPG digital signatures.
will be CEO of a company forcing or tricking employees to make a fraudulent wire transfer which mimics a phishing scam.
I have never in my 27 years in IT, run across any Executive who would fault me for verifying and asking questions to avoid costly mistakes. I have had managers who are that utterly stupid, but they never rise above middle level manager and if they do, they usually piss so many people off with their nonsensical use of bullying that they are promoted out of a job (it happens.)
If I were ever faulted for not verifying that a request to wire money was legitimate, I would quit because if a boss faults you for doing the right thing, he/she/it are an idiot and I don't work for idiots, simple really.
Hi,
I'm a Nigerian Prince^h^h^h^h^h^h^h^h^h^h^h^h your boss ....
If you have procedures, you need to stick to it. But perhaps I an the exception who is not afraid to say no to my boss.
And yes, I have been in situations where I did not do as my CxO requested.He mailed me a request and I told him I would not do it, because that was not accoring to procedure. He treatend me and I still did not do it.
Obviously I placed all that I needed to cover my ass in the reply and added the reason as to why I would not do as requested.
In the end it probably save them several million in legal fees and fines. It was fun to see how things escalated after my denial.
Don't fight for your country, if your country does not fight for you.
Just how fucking stupid are people anyway?
Sorry, but what?
If my manager or my CEO send me an email demanding money they're going to get told to piss off.
Maybe this will work in the accounting department, but on behalf of the rest of us ... fuck you assholes, you have more money than we do.
What's that, my manager needs bail money? Wow, that's a bummer.
Lost at C:>. Found at C.
The emails look pretty good -- they're even from an executive@company.com address that the spam filters see as a legit server! No, wait.. that's a "company.co" (no m) address -- which is surprisingly easy to pass up, especially when the signature line includes a link to "executive@company.com" with the 'm' not being part of the link, of course -- the visual difference between blue and black is very minor.
Fortunately, the wording is a little weird (especially if you're from a region with distinctive patterns), and our CEO is a pretty nice guy so this threw our CFO for a loop. He just happened to pass'em in the hall shortly after the email and asked what it was all about -- surprise.
and Phraudulent
Come on, where are the copies of these phishing emails? That's the fun part. I'd love to see what kind of process gets people to wire funds without so much as a phone call for confirmation.
- Unsigned emails,
- From an external domain that kinda looks legit (this won't even work with Exchange and Outlook; they will always know it's from a foreign system and notify the recipient),
- Probably with unspecified urgency, without reference to procedure, and no means of tracking the request
Yeah, if a simple phish beat your process, you should find a new career.
Gamingmuseum.com: Give your 3D accelerator a rest.
I've investigated a half dozen or so of these. It has been going on for a while; the first one I saw was about a year ago.
Some of the common characteristics:
They know the names, email addresses, and nicknames of the CEO, and the Treasurer and/or Controller.
They address the Controller by name, a little bit of social pleasantries, and often say what account the "expenditure" should be coded to. The first contact is pleasant, but says it's urgent, and needs to be done right away. Subsequent emails get progresively more demanding.
Early ones asked for the wire transfer to go to a bank in Shanghai, Singapore, or something. More recent ones are transfers to an indivdual's account in a U.S. bank. (Doubtless belonging to some poor gullible person who answered one of those "Well Paid Part Time Job Working From Home as a Financial Agent" spams.)
Registering a .co domain to spoof a .com is popular, as are various other typosquatting tricks. Some cheapskate crooks just use a hotmail-type Reply-To, though.
If the victim sends the money, another request will follow. Then another, and another, as long as they'll keep doing it.
From last September: http://blog.barracuda.com/2014...
The fraudsters register "typo squatting" domains that look like the target company's domain,
Since when do you need to effin' typo-squat a domain name to send something that looks like bossman@targetcompany.com to underling_grunt@targetcompany.com?
The FROM: header can be anything. Hell, you can telnet to port 25 and type it in manually. It's been that way since forever-ago, as far as I can tell.
I mean, come on, I've personally sent mail from satan@hell.org.
--
BMO