Slashdot Mirror
Nigerian Man Charged in Hacking of Los Angeles County Emails (theguardian.com)
A 'mere' 10.8% phishing success rate has forced Los Angeles County to notify approximately 756,000 individuals that their personal information may have been compromised. The attack occurred on May 13, 2016 when 1,000 County employees received phishing emails. 108 employees were successfully phished. A Nigerian national has been charged in connection with the hack. From a report on The Guardian: Many large organizations would welcome a 10% success rate in their internal anti-phishing training sessions, with 30% and above being common. The 2016 Verizon DBIR suggests that 30% of all phishing emails are opened. The high number of individuals affected from a relatively low number of successes in LA County demonstrates how dangerous phishing attacks can be. The nature of the potentially compromised information is also concerning. "That information may have included first and last names, dates of birth, Social Security numbers, driver's license or state identification numbers, payment card information, bank account information, home addresses, phone numbers, and/or medical information, such as Medi-Cal or insurance carrier identification numbers, diagnosis, treatment history, or medical record numbers," said the County of Los Angeles Chief Executive Office in a statement.
A Nigerian man caught hacking?
He must be Russian.
"That's the way to do it" - Punch
Are these getting past spam filters? And if they aren't, are the employees really that stupid to reply to emails identified as spam?
I bet it was a Nigerian prince they caught.
So big hurrah for LA Counties judicial system. I am frustrated however that no entity be it private corporate, or municipality has simply said protection of our information shall come first. This thought that let's just contract with (insert name provider, likely Microsoft) for an off the shelf solution which clearly isn't secure is absurd. Now I am also not saying some municipality pay a contractor to custom design a system, we know which way that will go (see link).
DWP billing system errors add $245 million to uncollected debt
http://www.latimes.com/local/c...
Am I the only one who thinks all 'secure' networks should be on a isolated protocol e.g. email be only text with no public network dependent information. user systems with no access to the internet, and no user level login on public devices including your phone.
The price being paid for the convenience of looking up bread pudding recipes from your work station (or ranting on /. for that matter) is simply too high. Just a thought.
My company HR sent notice of required anti-phishing email training.
- The email came from someone I never heard of.
- It contained a link to an external website.
- And the external website required we log in with our domain credentials.
I ignored the notices for weeks until my boss came to my desk and made me do it. Just unbelievable.
So the Nigerians have progressed from advanced fee fraud to phishing? Well,they must be getting better because it is usually clear to me when an email is sent that is not legitimate. The email is rife with spelling and grammar errors and even word misuse.
Nah, they're too busy trying to start WWIII by shooting Russian diplomats in Turkey with their plant in the special police. And here I thought Obama would do something more subtle as retaliation for exposing the DNC's corruption, but I guess their Saudi & Qatari backers don't do subtle things? Now you know why Trump isn't dumb enough to give up his private security detail.
Meanwhile they wonder why the rest of us are 10 steps ahead of their dirty tricks.
I always considered the "Nigerian Prince" thing to be a complete joke; for the spammers can claim to be anybody from any country such that the Nigerian connection here sounds dodgy.
What's next, the butler actually did it?
Table-ized A.I.
My experience with similar orgs is that the executives want instant connectivity, even when at home or at "important" conferences (cough cough). The executives out-rank most IT security personnel, and thus if they want risky toys/access, they get risky toys/access.
County government is very rank-sensitive. Logic is secondary to rank. Powerful idiots are dangerous.
Table-ized A.I.
Oh, the felinity!
Our company set up our mail system to insert this line into ANY incoming external email. Has helped us a LOT with reducing the impact of phishing emails...along with filtering known phishing domains......
>>Attention: This email was sent from someone outside of [your company name here]. Always use caution when opening attachments or clicking links from unknown senders or when receiving unexpected emails.
You're messin' with my Zen Thing, man.....
Nothing new here. I'm actually surprised it wasn't a higher number.
So did President Muhammadu Buhari of Nigeria have had any reason to prefer Trump? He's Muslim, so if anything else, he should have wanted to rig the election for Clinton: break into RNC emails and expose attempts by Cruz to steal delegates disproportionate to the votes, making all Republicans wanna vote for Hilary
Obviously, Putin used the Nigerian to hide his own tracks. Duh...
In Soviet Washington the swamp drains you.
As an LAC employee, I cannot believe the hit this has taken. I got the email and dumped it, Still, I'm waiting on the $10,000 inheritance check from the former deposed Nigerian prince. I only had to submit my credit card.
The Kai's Semi-Updated Website Thingy
I got a phone call from a Nigerian prince who said he was thrown in prison for a small infraction while trying to get through customs. He said that if I only pay his bail of $5000 that he will most assuredly share with me the 35 million in cash that is waiting for him in customs.
Prince