Carl Jongsma
06/02/07, 12:49
Hello List(s),
Apologies for the cross-posting, but given the attention that this =20
subject has received on other lists and sites, I thought it would be =20
appropriate to allow the BT crowd to look in on what is emerging in =20
terms of real world phishing attacks.
For those interested in the original FD email about a new phishing =20
technique being employed on a professional networking site (late last =20=
week), the investigation and subsequent report have been published. =20
Readers of 'The Register' will note a write up already in place with =20
some feedback from the site involved. Although the claim of 10 or so =20=
reports per month of similar scams being made are probable, I doubt =20
that many (if any) have taken as much detailed involvement from the =20
scammer before the phish is set.
http://www.theregister.co.uk/2007/01/29/ecademy_419_scam/
You can find the report at the following address:
http://www.beskerming.com/marketing/reports/index.html
Or, for the direct link:
http://www.beskerming.com/marketing/reports/=20
Beskerming_Phishing_Report_Jan_07.pdf
A higher detailed version is available upon request, which includes =20
sufficient detail in the account screenshots for the profile text to =20
be legible.
An Executive Summary for those who don't want to read the report:
- Yes, it was a scam. The scammer started out with a stolen =20
identity, maintaining it all the way through the scam (even when =20
confronted)
- Ultimately it was a 419-style phish / scam that was traced back =20
to Nigeria
- The first recorded use of the particular stolen identity was =20
November 06, with a very similar scam (though a more traditional mass =20=
spam email).
- The scammer invested at least 2-3 days of communication and trust-=20=
building before beginning to seed the phish / scam
- The initial round of the phish bait was mild enough to almost be =20
missed.
- The Networking site was VERY prompt in addressing the situation =20
once notified (less than 5 minutes to remove the account when it =20
reappeared and they were notified again). Props to Ecademy in this =20
case.
- Sometimes you just need to be paranoid.
Any questions or queries, just ask them.
Carl
S=FBnnet Beskerming Pty. Ltd.
Adelaide, Australia
http://www.beskerming.com
Apologies for the cross-posting, but given the attention that this =20
subject has received on other lists and sites, I thought it would be =20
appropriate to allow the BT crowd to look in on what is emerging in =20
terms of real world phishing attacks.
For those interested in the original FD email about a new phishing =20
technique being employed on a professional networking site (late last =20=
week), the investigation and subsequent report have been published. =20
Readers of 'The Register' will note a write up already in place with =20
some feedback from the site involved. Although the claim of 10 or so =20=
reports per month of similar scams being made are probable, I doubt =20
that many (if any) have taken as much detailed involvement from the =20
scammer before the phish is set.
http://www.theregister.co.uk/2007/01/29/ecademy_419_scam/
You can find the report at the following address:
http://www.beskerming.com/marketing/reports/index.html
Or, for the direct link:
http://www.beskerming.com/marketing/reports/=20
Beskerming_Phishing_Report_Jan_07.pdf
A higher detailed version is available upon request, which includes =20
sufficient detail in the account screenshots for the profile text to =20
be legible.
An Executive Summary for those who don't want to read the report:
- Yes, it was a scam. The scammer started out with a stolen =20
identity, maintaining it all the way through the scam (even when =20
confronted)
- Ultimately it was a 419-style phish / scam that was traced back =20
to Nigeria
- The first recorded use of the particular stolen identity was =20
November 06, with a very similar scam (though a more traditional mass =20=
spam email).
- The scammer invested at least 2-3 days of communication and trust-=20=
building before beginning to seed the phish / scam
- The initial round of the phish bait was mild enough to almost be =20
missed.
- The Networking site was VERY prompt in addressing the situation =20
once notified (less than 5 minutes to remove the account when it =20
reappeared and they were notified again). Props to Ecademy in this =20
case.
- Sometimes you just need to be paranoid.
Any questions or queries, just ask them.
Carl
S=FBnnet Beskerming Pty. Ltd.
Adelaide, Australia
http://www.beskerming.com