Slashdot Mirror
Facebook and Google Were Victims of $100M Payment Scam
Employees of Facebook and Google were the victims of an elaborate $100 million phishing attack, according to a new report on Fortune, which further adds that the employees were tricked into sending money to overseas bank accounts. From the report: In 2013, a 40-something Lithuanian named Evaldas Rimasauskas allegedly hatched an elaborate scheme to defraud U.S. tech companies. According to the Justice Department, he forged email addresses, invoices, and corporate stamps in order to impersonate a large Asian-based manufacturer with whom the tech firms regularly did business. The point was to trick companies into paying for computer supplies. The scheme worked. Over a two-year span, the corporate imposter convinced accounting departments at the two tech companies to make transfers worth tens of millions of dollars. By the time the firms figured out what was going on, Rimasauskas had coaxed out over $100 million in payments, which he promptly stashed in bank accounts across Eastern Europe. Fortune adds that the investigation raises questions about why the companies have so far kept silence and whether -- as a former head of the Securities and Exchange Commission observes -- it triggers an obligation to tell investors about what happened.
I remember hearing about this, but never suspected Google was one of them. Good thing they realized their mistake promptly and got their money back. Bad publicity nonetheless.
Anyone who falls for stuff like this should be fired and black listed.
First rule of damage control for corporations hit by scams like this is to NEVER disclose it happened if you don't have to. If nobody finds out about it, there won't be any damage to your reputation and there won't be copycats inspired by it.
If huge corporations such as Facebook and Google can fall victim to scammers, who are we to even try resisting?
Help me pay for the scams I'm a victim of. Send donations directly to:
18LQHMjKSCSU3g4f29TfmtfxHXUfnh7juB (Bitcoin)
D9scjyKETYZesSmhjCR4vye4bc6iDqXPd6 (Doge)
#DeleteFacebook
One day, I wish that we all can be like:
"Hey remember a long, long time when Facebook was using everyone? It was so MySpace, Geocities, Yahoo!, Lycos, and About.com! Hahahaha. --yeah, 'I really felt sorry for Facebook'... said nobody ever!"
Wow, conning FB and The Goog out of a cool $100M. He should go to jail... but also be inducted into the Scammers Hall of Fame!
Hey, Windows users, there is no such thing as "forward" slash, there is only slash and backslash.
Should we now upvote users who figured out the companies months ago? https://news.slashdot.org/stor...
Moral of the story, Greedy dude got caught.
Isn't that SOP? It should be...
"I don't know, therefore Aliens" Wafflebox1
why the companies have so far kept silence
I can take a guess...
This is and old scam updated for modern times, scammers used to send small bills for office supplies to accounting departments of large corporations hoping the bill would be paid without any checking for validity. Worked often enough that the scammers kept doing it.
At some point don't you have to say to yourself "Self, we've been lucky so far. We have 15 or so mil in the bank already. This scheme really can be run from virtually anywhere. Shouldn't we pack up and move to a country that the US doesn't have an extradition treaty* with?"
I mean Russia is right there. He could have hopped over to Kaliningrad and it would be like he never really moved, nestled between Lithuania and Poland. He had enough money I'm sure he could arrange for residency.
*Yes, the US has an extradition treaty with Lithuania.
I browse on +1 so AC's need not respond, I won't see it.
the investigation raises questions about why the companies have so far kept silence and whether [...] it triggers an obligation to tell investors about what happened.
The problem is that disclosure is paradoxical.
1) Scammed corporations need to tell their stockholders because if the information is found out, it could negatively affect the value of the stock therefore it's in the interest of the stockholders to be told.
2) By covering it up, corporations prevent the stock from dropping and thus maintaining the value of the stock which is in the interest of the stockholders therefore the information should be withheld from stockholders.
Until a legislative imperative resolves this paradox, corporations will take the path that aligns with their own interests.
Anons need not reply. Questions end with a question mark.
Taken individually, these attacks are usually pretty easy to spot. But when you're hit with so many of them over the years, even if you catch 99% of them, a few will slip through.
Fuck yeah !!!
To know the office to whom to send such bills, to know the sort of tech that was purchased there, and to know how to spoof each companies' purchase orders, an insider was required. Caught 'em yet?
$100M? Seems like someone got greedy. Wouldn't it make more sense to keep the amounts smaller, maybe fly under the radar? To quote Hans Gurber "Well, when you steal $600, you can just disappear. When you steal 600 million, they will find you..."
How much would it take to live comfortably for the rest of your life in Lithuania? Given that the median annual income is $5,000, $100M seems a bit overkill.
According to the Justice Department, he forged email addresses, invoices, and corporate stamps in order to impersonate a large Asian-based manufacturer with whom the tech firms regularly did business.
Of all the companies in the world, I expected Google to have established some method of identification of their suppliers more secure than email addresses, invoice formats, and corporate stamps. PGP is now 26 years old, and the algorithms it implemented are older yet. It's really really time for businesses to start using those algorithms, if not PGP itself.
I'm envisioning a system where, during the meeting when a contract is signed, the principals exchange public keys, maybe going so far as printing them out as QR codes that are included beneath the signatures on the signature page. It takes a fairly dense QR code to represent 4096 bits with any redundancy, but there is a standard that can accommodate it.. These keys are specific to the contract; no reason to create a One True Corporate key, that if compromised, all is lost. Generating keys is cheap and easy, so make new ones at some convenient level of granularity. Per contract is best, per relationship is tolerable, per division is less good but might work, per organization should be avoided, but maybe if you're a small business it's ok. Store the private keys on one of those tamper-resistant secure storage thingies with a USB interface. (Google already uses those things internally. Why weren't they using them for invoices?)
When invoicing, sign the invoice with the correct private key. The system should preferably also encrypt with that private key, and encrypt with the recipient's public key already on file. This prevents interception of invoices in transit, and also makes it extremely clear to the recipient's Accounts Payable department whether or not an invoice is legitimate. If it won't decrypt, Accounts Payable won't try to be helpful and pay the invoice anyway, since all they'll see is guck. Maybe allow signing only, but it should be buried deep in the options, and default to off.
What needs to be done, which as far as I know is missing, is software integration to make this process as frictionless and foolproof as possible. PGP (and gpg) have email client integration, but last I looked, it worked only indifferently well, and wasn't available in all clients. What's missing, and what really needs to exist, is integration with accounting software. The relevant public keys should be on file inside the accounting software, and plugins should be written to know what to do with them, be it GnuCash, Peachtree Accounting, Quicken, or (heaven help you) SAP. The private keys (locked with a pass phrase) should be carried on the secure storage physical device by the authorized signer, and plugged in and unlocked only when that person is actually submitting invoices.
This is where I see a business opportunity. In order to be accepted, the system must be ubiquitous, reliable, and as unintrusive as possible. That means writing, testing, and seriously grinding the rough edges off of plugins, helpers, and apps to support every version of every OS, every version of every accounting package, and every device. This requires dozens of individual pieces of software, and integration work with existing code that is only barely friendly at best, and outright hostile at worst. A customer should be able to buy into the system and get whatever they need to work with the systems and software they already use, be it a small business running a seven year old version of Peachtree on Macs to a billion dollar behemoth with a tailored SAP Solution(TM)(R)(May God Have Mercy On Your Soul). When two small business owners meet in a bar to sign a ten thousand dollar contract, their smart phones should have apps that can offer up appropriate QR codes, and take pictures of them, to be funneled into the accounting software when they get home. (Etiquette suggests that the invoicer should present her QR code first, followed by
Is it possible that Facebook and Google found some people to give money to that their employees wouldn't suspect to avoid taxes? I know companies like that wouldn't need to, but maybe just to see if it could work if they ever did?
You can't upvote comments from a story over a month ago. On Reddit you can upvote comments for a few months, but that's Reddit.