Corrupt bank worker jailed over Trojan-powered tax scam

A former local business manager at a bank who participated in a £3.2m self assessment tax fraud was jailed for three years and three months on Friday.

Nikola Novakovic, 34, conspired with Oleg Rozputnii, 28, to register over 1,050 fictitious taxpayers on the Income Tax Self Assessment system. The pair claimed fraudulent tax refunds under assumed names before laundering the proceeds of the scam via 200 fraudulent bank accounts.

Personal details needed to pull off the racket were extracted from the computers of consumers using an unspecified computer virus. Rozputnii, an illegal immigrant from the Ukraine, used numerous false identities to help commit the fraud, which also involved Dmytro Shepel, 26, a Ukrainian, also from London.

Joe Rawbone, assistant director of HMRC Criminal Investigation, said: "These men ran an audacious scam stealing millions of pounds. They set up hundreds of false bank accounts using viruses to hack into personal computers to gain information. They used their illegal profits to fund lavish lifestyles, buying performance cars including Porches, Mercedes and Jaguars. HMRC takes tax fraud extremely seriously and we will recover any financial gain from this criminal activity."

The scam netted £3.2m between January 2008 and September 2010 when the racket was uncovered following a lengthy investigation by HM Revenue & Customs (HMRC).

Sentencing, Mr Recorder Singh QC said that Novakovic "had abused his position with the bank" as part of a "sophisticated and orchestrated fraud".

Novakovic and Rozputnii pleaded guilty to cheating the public revenue in March. Rozputnii, the main mover behind the scam, was jailed for three years and nine months on Friday. Shepel was sentenced to three-and-a-half years at an earlier hearing in August 2010.

Pictures of the subjects and their cars can be found in a HMRC statement on the case here. ®

[TheRegister]

Mobile Phones are Being Hacked and Cloned

Cloning occurs when hackers scan the airwaves to obtain SIM card information, electronic serial numbers and mobile identification numbers, and then using that data on other phones.

Cloning can happen anywhere, anytime that you’re using your phone. The bad guy simply uses an interceptor, hardware, and software to make a phone exactly like yours.

A few years ago, I was in San Diego on business. Two weeks later I received a call from my carrier alerting me to $1500.00 worth of international calls I had not made. The activity triggered an alert within their system and they shut my account down.

Fortunately for me, my carrier recognized the fraud and relieved me of the charges, rather than me discovering it and having to fight to reverse the charges. Apparently, it was a known issue that scammers in Tijuana were cloning U.S.-based phones.

Anita Davis, another mobile clone victim, wasn’t so lucky. One month, her cell phone bill showed $3,151 worth of calls in one month, to Pakistan, Israel, Jordan, Africa, and other countries.

Anita called her carrier immediately and told them she didn’t know anyone in those countries, or anyone outside the U.S. for that matter.

She says, “They told me I had to have directly dialed these numbers from my cell phone and I needed to make a payment arrangement or they would send my bill to collections.”

After begging and pleading, Anita convinced them to drop the charges.

The extent of your vulnerability varies depending on your phone and the network you’re on. Cloning mobile phones is becoming increasingly difficult, but consumers can’t do anything to prevent it from happening.

The best way to mitigate the damage is to watch your statements closely. The moment you see an uptick in charges, contact your carrier and dispute the calls.


Robert Siciliano, personal security expert contributor to Just Ask Gemalto, discusses mobile phone spyware on Good Morning America. (Disclosures)

[InfoSecIsland]

‘Granny Scam’ Uses Facebook to Target Seniors

The good hearts and generosity of grandparents are being exploited in a cruel new scam.

The “grandparent scam” occurs when an unsuspecting senior citizen receives an urgent phone call from someone claiming to be a grandchild. The impostor tells the grandparent that he is seriously hurt, or in jail, and desperately needs hundreds or thousands of dollars wired to him immediately.

Believing the caller to be their grandchild, the frightened grandparents wire money to the scammer.

“Scams in which criminals prey on senior citizens, manipulating their fears and stealing their savings, are among the most malicious in our society,” New Jersey Attorney General Paula Dow said.

Yesterday (March 23), Dow, with the N.J. State Division of Consumer Affairs and the Consumer Federation of America, launched a campaign to combat and educate against the grandparent scam.

While many traditional frauds – the Nigerian 419 scam, for example – are easy to detect and avoid, the grandparent scam comes with an air of authenticity that adds a frightening element of reality to an otherwise phony phone call.

Social networking sites offer a wealth of family information – often including the grandparents and grandchild’s name, address and date of birth -- that a scammer can use to effectively pose as the victim’s grandchild. Armed with those details, a frantic “Grandma, I need help” call creates an extremely vulnerable victim.

Speaking at the New Jersey campaign launch, Jim and Dorothy, a couple from Wayne, N.J., told the story of how they received a call on Feb. 15 from a young person pretending to be their grandson. He said he had broken his nose in a car accident, and was now in jail in Canada and needed $2,800 for bail. The scammer used specific family details obtained from the grandson’s Facebook page.

“We thought our grandson was injured, in trouble and in need of money and we wanted to help him,” Jim told CBS New York. Thankfully, before they wired any money, Jim and Dorothy contacted their daughter — the alleged grandson’s mother — and found their real grandson was in school — not in Canada — and that they’d been scammed.

To steer clear of the grandparent scam, the Consumer Federation of America urges people to ask detailed questions of the caller, questions no impostor could know – “the name of the person’s pet, for example, or the date of their mother’s birthday.”

It’s important also to report the scam to the money-wiring service the grandchild wants the victim to use.

[SecurityNewsDaily]

Scammers Pushing Fake AV Via Skype

Rogue anti virus software companies have decided to "reach out and touch someone," according to a new report from Krebsonsecurity.com.

Groups responsible for pushing the bogus anti malware programs are using Internet-based phone calls over the Skype network to trick unsuspecting users into downloading their fraudulent wares, the site reports.

Skype users are reporting they’re getting automatic calls from vendors pushing rogue anti-virus, according to a post on Krebsonsecurity.com. The scam is not unlike an unwanted telemarketer call, with users asked to follow instructions given by the mechanized call. Those who fall for the ruse find themselves hit with a ubiquitous scareware page, warning them that their computer is infected and advising them to erase the threats from their computer. After clicking through the warning, users are sent to a “shopping cart” which convinces them to purchase their “professional online repair service.”

Previously spammers have used Skype to peddle their malware via online notifications, while larger projects, like spam campaigns and worms, have become more commonplace with the software.

[Krebs on Security] via [ThreatPost]

UK cyclists hit by fraud after online purchase at website

Updated A suspected security breach at popular UK-based biking site chainreactioncycles.com has been linked by victims to multiple instances of fraud.

Various bike enthusiast forums are alive with complaints (here and here) from customers of the site, several of whom are reporting unauthorised charges on their credit or debit cards. The victims are tied together by having shopped at the bike site over the last fortnight or so.

The majority of fraudulent transactions reported seem to involve mobile phone top-ups to either Vodafone or O2, typically two transactions valued at £15 or so for a total fraudulent amount of £30. However, a small percentage of victims have been taken for thousands of pounds.

The experiences of a Reg reader, who wishes to remain anonymous and was the first to tell us of potential problems, seems typical: "I recently purchased items from the online cycling retailer Chain Reaction. A few days after payment went through, I had a couple of fraudulent transactions on my Visa card, which I cancelled, and got money refunded."

Banking regulations in the UK mean that victims should be able to recover the lost sums, but in the meantime they face an anxious wait and the possibility of being short of cash to pay bills until the mess is sorted out.

Chain Reaction Cycles (CRC) released a holding statement, republished via a thread on popular mountain biking portal MoreDirt.com, that acknowledged reports of problems and stating that it had started an investigation. "Our own infrastructure is routinely and independently tested and we are confident that it is robust," it said. "We are working with industry experts including the card processing companies to identify possible causes both inside and outside the control of CRC."

A spokesman for CRC told El Reg that the ongoing investigation, started on Monday, had thus far not come across anything amiss.

Digital forensics blog ForHacSec adds that the common theme of the fraudulent transactions was that they occurred between seven and 10 days after victims purchased goods from chainreactioncycles.com. Purchases at CRC between March 4 to 12 seem to be those most closely associated with subsequent fraud, it adds. ®

[The Register]

Security Fake Security Software Websites – Still popular in 2011

Fake security software is a form of computer malware that misleads users into installing and potentially paying for fake security software. The sites convince users to download the malicious software by displaying fake security warnings such as “Your computer is infected” etc. End users are clearly not educated about such attacks, as the campaigns remain highly successful. Below is a short blog analyzing a recent infection on a friend’s machine to illustrate the problem.

We continue to see numerous infected sites, which are redirecting users to fake security software campaigns. The pages display animated fake security warnings to users in order to scare them and convince them to download and install a binary, which is generally packaged as fake antivirus software. The victim will be infected with a downloader Trojan that will then download additional malware. Below are a few screenshots of animations typically used in the attacks:

After this initial load animation, the user will be prompted with another security warning:

Once a user clicks on the OK button, additional animated fake security warnings will be displayed.

At this point, the user is prompted to download the fake antivirus software.

This same campaign has been used over and over again and can be found hosted at thousands of domains.

All of the above animations are from the same malicious website. The content is randomly changed for each new visit to the site. Once installed the victim is forced to activate or buy a license key to remove these fake threats from the system. Here are some tips for users who still wants to stay away from those attacks.

1) No real Antivirus vendor displays such security warnings, animations and popups.

2) No website will scan a system when visited and display immediate warnings about threats on the system.

3) No real Antivirus vendor will force you to download an executable.

4) When you need AV software, go directly to the site of a reputable vendor yourself.

5) Keep an eye on address bar for the URL name and redirected URL names.

6) Keep any eye on the status bar of the browser, which is present at the bottom to spot redirection taking place.

7) If you want to download executable but are unsure that it is legitimate, it can be scaned against various antivirus vendiors by submitting it to a service such as VirusTotal If popular vendors triggers or declare the file as malicious, immedeatly delete it from the system.

Install a common antivirus solution and keep it updated with latest virus definitions.

9) Last but not least, never pay for such fake security software.

The VirusTotal results for the fake security software from the above example show that it was detected by only 21/42 popular AV vendors. Even now, we are still seeing a large number of fake security software websites promoting their fake products.

Stay safe

[zscaler] via [ComputerSecurityArticles]

Japan earthquake search results already poisoned

It didn't take long for malware pushers to take advantage of Internet users' hunger for news and videos from Japan after it was hit today by the most powerful earthquake in the last 100 years:



According to Trend Micro, a search for the “most recent earthquake in Japan” will yield many search results that take users to pages where they are offered fake AV solutions.

As always, users are advised to search reputable news sites for up-to-date news. If you feel you must use Google, at least go to http://news.google.com/ to search, since those results are taken from legitimate sources.

As a side note, Google has taken advantage of its search engine popularity to post a Tsunami Alert on the engine's home page for a number of countries that are expected to be hit by waves caused by the tectonic shift.

The company has also launched a version of its Person Finder service for people that search for loved ones and friends in the wake of the earthquake.

[Net-Security]

Fake HMRC website offers bank refunds

A friend sent me this link, which is an interesting spin on the old “HMRC tax refund” scam – a fake HMRC claiming your bank wants to issue a refund instead.




Click to Enlarge

As you can see below, they have a large selection of banks to choose from (in keeping with more common phish attacks):




Click to Enlarge

Everybody from NatWest and HSBC to Santander and Halifax are in there. Most of the bank specific pages all ask for the same kind of personal information, but if one of the banks asks for something unique to them (such as a banking PIN or other security feature) the phishers have taken care to include those too. If your bank isn’t included, no problem: they have a generic “catch-all” page for you to sign up to years of identity theft and a couple of days worth of “Who bought all this stuff on iTunes”?

Here’s a sample of the information asked for on the Barclays page:




Click to Enlarge

Deep breath: name, address, phone number, email (and email password!), national insurance number, information related to your parents, how long you’ve lived at your address, employment status / income, your full card details (of course) and everything related to your online banking account.

I think “Ouch” is the word we’re looking for.

HMRC do not issue tax refunds by email, they most certainly do not have websites where banks want to issue you with refunds, and they also know how to spell “being” (take another look at that second screenshot).

Avoid like the plague.

[ComputerSecurityArticles]

Five Myths About Fraud

We’ve all heard so much in the news about fraud over the last several years. Not a day goes by that we don’t hear about an executive caught with his hand in the cookie jar, a company that failed to follow proper accounting rules, or a compensation structure that led someone to cheat with the numbers.

In some ways, I think people are becoming immune to fraud. The cases don’t seem as significant as they would have been five years ago. They’re not as shocking as they used to be. It is sad that fraud is becoming more commonplace. And the more we hear about fraud, the more I think companies run the risk of not taking it seriously.

Most importantly, I think people are running around with some big misconceptions about employee fraud. If they mistakenly believe their company is not at risk, they are probably not actively preventing fraud. Companies must know the truth about fraud and its perpetrators in order to actively protect themselves.

The following are five of the fraud myths that I regularly run into in my fraud investigation practice. Whether owners and executives actually utter these out loud or not, merely buying into these myths mentally can be a recipe for disaster.

1. Our company does not have an internal fraud problem.


While companies would like to believe they have good employees and adequate controls to prevent fraud, the fact of the matter is that 45 percent of companies will be significantly affected by fraud, according to one international study. A separate study estimates that the average internal fraud will cost $159,000, and that almost one-fourth of fraud cases will cost companies over $1 million each.

Companies cannot afford to ignore the risk of fraud and the likelihood that fraud is occurring internally. It is too expensive, particularly when one considers the fact that there are many indirect costs of fraud, including investigation and legal costs, employee attrition, and decreased employee morale.

Actively fighting fraud means implementing policies and procedures that prevent and detect fraud. Anti-fraud professionals who are experienced with the common methods of fraud can be invaluable to this process. Whether a company gets there with employees or outside consultants, it is important to secure company information and assets to prevent internal fraud.

2. Most people are honest and won’t commit fraud.


This is a dangerous approach to take to the business of fraud. It is true that most people are generally honest. But to rely on this instead of putting controls in place to prevent fraud is a big mistake.

While it’s wise to hire those with a track record of honesty, past behavior doesn’t necessarily predict future behavior. Almost 88 percent of employees and executives who commit fraud against their employer have never before been charged or convicted of a fraud-related offense. This means it’s nearly impossible for companies to predict who is going to commit fraud and when they are going to do it.

It is a fact that honest people can and do commit fraud. Outside pressures can cause people to behave in ways they normally would not. Things that could push someone toward fraud include addictions, divorce, overwhelming debt, and gambling problems. When pressures like this are present, it’s difficult to predict who will commit fraud.

In the end, those who commit fraud come from all walks and ways of life. From clerks to executives, no one is immune. Thieves come from all social classes and all economic backgrounds. If given a strong motivation and ample opportunity, anyone can commit fraud against her or his employer.

3. If our company follows government regulations, we will be protected against fraud.


Unfortunately, the current accounting rules and regulations do not really provide protection against fraud. Sarbanes-Oxley is probably the most widely-recognized regulation dealing with fraud. It has had some positive effects because it has forced companies to review and document their policies and procedures.

Companies have spent enormous amounts of money on implementing Sarbanes-Oxley, and it’s probably discouraging to admit that even such an extensive project isn’t really preventing fraud. The regulation forces management and the board of directors to accept responsibility for issuing accurate financial statements, however, it doesn’t really ensure that companies have fraud prevention procedures in place.

In order to effectively prevent fraud, companies must create and implement policies and procedures specifically designed to deter and detect fraud. Again, this should be accomplished with the help of an anti-fraud professional who is experienced in the methods used by corporate fraudsters. A good fraud prevention program will actively prevent and detect fraud while still complying with the applicable regulations.

4. Small frauds aren’t important enough for management to worry about.


Virtually every big fraud started out as a small fraud at one point. Whether it is a minor theft of cash or a financial statement manipulation intended to cover up a substandard quarter, what starts out as a small fraud can quickly grow into a major fraud scheme. A theft of $500 may not seem significant enough for management to devote time and effort to the problem. But what if an employee was stealing $500 a week for three years? Suddenly, there is a theft of over $75,000, which could be very material to the company.

It’s important for companies to take small frauds and ethical lapses seriously. Not only does management want to cut off frauds while they are in their early stages, they also should be sending a message to employees that dishonesty is not tolerated. A zero tolerance policy is a necessary part of any good fraud prevention program.

It may be expensive to monitor and investigate smaller thefts from the company. However, in the long run, the cost will be worthwhile because the company will have stopped frauds from growing into the hundreds of thousands and millions of dollars. Therefore, an effective fraud prevention program will contain components that help the company discover fraud early.

5. Fraud will be detected by our auditors.


History has shown us that a company’s independent auditors cannot be relied upon to find fraud. This is true primarily because audits are not designed to detect fraud. They are designed to give “reasonable assurance” that the numbers shown on the financial statements are materially accurate.

Because fraud involves the active concealment of the truth, it makes it difficult for auditors to discover. Further, auditors have a tendency to become complacent with their clients. They see the same things year after year in the audit, and they may stop paying close attention. Employees who are concealing a fraud may also be comfortable with the auditors and know what procedures are coming. If that’s the case, count on the employees to be very careful with the fraud as it relates to those expected procedures.

Auditing rules have attempted to address how auditors approach the potential for fraud within companies. While the current rules are somewhat better than those of several years ago, a traditional independent audit still cannot be relied upon to detect fraud. Executives who believe differently are setting their companies up for disaster.

The Solution


Preventing fraud in companies all comes back to active prevention techniques and educating employees about fraud. First, owners and executives must be aware that they are very much at risk of experiencing internal fraud, and that the statistics show that the losses can be expensive. Then they need to take decisive action in formulating a fraud prevention program.

Education of everyone is still a very important part of fraud prevention. No company is immune to the problem, and no employee is completely free from the possibility of committing a fraud one day. After owners and executives appreciate the true magnitude of the problem, it will be through action that fraud will be prevented at their companies.

Tracy L. Coenen, CPA, CFF is a forensic accountant and fraud investigator with Sequence Inc. in Milwaukee and Chicago. She has conducted hundreds of high-stakes investigations involving financial statement fraud, securities fraud, investment fraud, bankruptcy and receivership, and criminal defense. Tracy is the author of Expert Fraud Investigation: A Step-by-Step Guide and Essentials of Corporate Fraud, and has been qualified as an expert witness in both state and federal courts. She can be reached at tracy@sequenceinc.com or 312.498.3661. 


[InfoSecIsland]

Simple protection steps from credit card fraud

Every year, cybercriminals steal billions of dollars from unsuspecting computer users and companies by committing credit card fraud.



Although this activity was once relegated to pick-pocketers and mailbox thieves, today roughly half of all credit card fraud starts with online attacks ranging from phishing and email scams to spyware programs such as adware, keyloggers, Trojans, system monitors, browser hijackers, and dialers.

Fortunately, if you know what to watch for – and have good online protection – you can avoid becoming a victim of these fraudsters and keep your personal information safe.

The first step to ensuring that you're able to catch any form of credit card fraud (online or otherwise) early is to closely monitor your credit card activity. You can do this the old-fashioned way via your credit card company's official website, or you can find a security program that monitors your credit cards for you and alerts you to suspicious activity.

Here are a few additional tips from Webroot to help you safeguard your personal information online:

• Use varied and complex passwords for all your accounts, including online shopping accounts, bank accounts, social networking sites, etc. (You may want to try using a security software program with a password manager to help you keep them straight.)
• Only provide personal information on secure sites. (Look for "https" in the web address or the lock icon at the bottom of the browser.)
• Do not respond to unsolicited requests for personal information – they are often a sign of phishing.
• Avoid questionable Web sites, such as adult sites and file sharing sites.
• Only download software from sites you trust.
• Practice safe email protocol by not opening messages from unknown senders. Immediately delete messages you suspect to be spam.

Some signs and symptoms that your PC may be infected and require cleanup (as well as updated spyware and virus protection) include:

• Sluggish performance
• Increased number of pop-ups
• New toolbars you can't delete
• Unexplained changes to homepage settings
• Puzzling search results
• Frequent computer crashes.

[Net-Security]

Five online criminals sentenced in UK

        You might remember our blog post from last August, discussing an online criminal who posted his bail sheet to an online forum.

He has been convicted today in London and received four years in prison. In the same sentencing, two other males and two females were convicted to jail sentences ranging from 18 months to four years and to community service.

Scotland Yard’s release follows:

A group of young internet fraudsters who set up an online ‘criminal
forum’ which traded unlawfully obtained credit card details and tools
to commit computer offences have today been jailed for a
total of 15.5 years.

[A] Gary Paul Kelly (14.04.89 – 21 yrs) unemployed of Clively Avenue,
Clifton, Swinton, Manchester;

[B] Nicholas Webber (10.10.91 – 19 yrs) a student of Cavendish Road,
Southsea;

[C] Ryan Thomas (8.7.92 – 18 yrs) a web designer of Howard Road, Seer
Green, Beaconsfield, Herts;

[D] Shakira Ricardo (14.11.89 – 21 yrs) unemployed of Flat 13, J Shed,
Kings Road, Swansea SA1;

were sentenced today (Wednesday 2 March) for computer misuse and fraud
offences following a two-day Newton Hearing at Southwark Crown Court.
All pleaded guilty at earlier hearings.

+ [E] Samantha Worley (30.09.88 – 22 yrs) unemployed of Flat 13, J
Shed, Kings Road, Swansea SA1 was sentenced on 14 December 2010 to 200
community service for acquiring criminal property.

The gang are believed to have been responsible for the largest
English-language online cyber crime forum and were all arrested on
various dates in 2009 and 2010, following a complex investigation by
officers the Metropolitan Police Service’s Police Central e-Crime Unit
(PCeU).

During an eleven month investigation detectives uncovered evidence that
the defendants were directly involved in the global forum (used by over
8,000 members) which promoted and facilitated the electronic theft of
personal information; credit and debit card fraud; buying and selling
of personal information (including passwords and PIN numbers); the
creation and exchange of malicious computer programs (malware); the
establishment and maintenance of networks of infected personal
computers (BotNets);and tutorials offering advice on how to commit such
offences, including how to evade and frustrate law enforcement activity
and the exchange of details of vulnerable commercial sites and servers.

Founder of the forum was Webber. Having established a web site named
‘www.GhostMarket.net’, he acted as “administrator” and had overall
control of the site (meaning he was able to allow/ban members, remove
or edit their posts, and alter their status on the forum.)

An examination of the rebuilt forum and its database revealed many
thousands of data entries relating to individuals’ personal details
including names, dates of birth, bank details, passwords, paypal
accounts and social security numbers. Site members are believed to have
traded in compromised databases containing thousands of personal
details including bank account numbers, PIN numbers, passwords and
malware including the Zeus Trojan and other types of criminal software,
including credit card verification programs.

The forum included such topics as: ‘Phishing kits (post free phishing
kits and sell them)’; ‘Show off (show us your skills here)’; ‘Tutorials
(post some useful info here)’; and ‘Cardable (post sites you’ve carded
here)’. There was also advice and tutorials on various methods of
evading law enforcement, how to encode blank plastic with credit card
data, and how to hack into sites, and even recipes for controlled drugs
(crystal meth) and a tutorial on bomb making.

Members of the site communicated anonymously by the use of screen
nicknames. They were able to post messages in various forum topics on
the website and send/receive private secure messages to/from other site
members.

During the investigation detectives recovered from the defendants’
computers more than 130,000 compromised credit card numbers, which at
an estimated industry loss of £120 per card, is a potential £15.8
million financial loss in relation to card numbers alone.

On 3 November 2009 detectives arrested Kelly after executing a search
warrant at his home address. A full search of the property was
conducted, with a number of computers and mobile phones removed from
the address for examination.

It was established that Kelly had independently constructed and
distributed across the web a sophisticated Zeus malicious computer
programme which enabled him to infect and compromise over 15,000
computers in over 150 countries, harvesting from them over 4 million
lines of data ­ including huge quantities of credit card numbers and
other confidential, personal information.

Having been provided with relevant passwords by Kelly, detectives were
able to rebuild the GhostMarket forum and its database using files from
his PC.

Prior to this, on 12 October Webber and Thomas were arrested at a five
star central London hotel for using stolen credit card details to pay
for accommodation in the penthouse suite. They claimed to have
responded to an online advert, saying they had paid money to an
anonymous individual.

Bailed to return whilst officers conducted further inquiries, items
including their laptops were seized. In addition they were found to be
in possession of business cards brandishing the ‘GhostMarket’ logo,
advertising it as “A new era in virtual marketing” with the byline
“I’m a carder, ask about me…”

The duo’s involvement in the ‘GhostMarket’ criminal forum was soon
established and inquiries were made to trace them after they fail to
return on bail in relation to the stolen credit card offence.

It was later discovered that on 31 October the pair had flown out to
Palma, Majorca, where they had been living in a rented flat in Port
D’andrax.

On 29 January 2010 they were arrested at Gatwick Airport as they flew
in from Palma.

The following day a search of Webber’s home address revealed a computer
containing a series of files outlining a step-by-step guide to
committing various criminal offences.

Owing to the volume of evidence to be examined and the complexities of
the case, the pair were released on police bail to return at a later
date.

Officers subsequently travelled to Spain and, accompanied by Spanish
Police, attended the flat Thomas and Webber had rented out. The
property was empty, but local enquiries established that the contents
had been posted back to their UK addresses.

Those items, as well as additional computer equipment, were
subsequently recovered.

Through the forensic examination of seized computers and other digital
storage devices, as well as evidence secured through the rebuilt
Ghostmarket site, officers identified Ricardo, a trusted member of the
forum, and she was traced to Swansea, South Wales. Initially joining
the site as a complete novice, over time Ricardo had progressed to
become directly engaged in card fraud and computer malware activity.
Financial enquiries identified a payment made from Ricardo into her
partner Worley’s bank account, incriminating her in the fraud.

Detective Inspector Colin Wetherill, Police Central eCrime Unit said:
“These defendants were accomplished cyber criminals, engaged in the
systematic mass infection of computers in homes and businesses in the
UK and overseas.

“They unlawfully harvested personal and financial information from
their victims to be exploited for financial gain.

“The GhostMarket crime forum was used by thousands of computer
criminals and fraudsters operating worldwide.

“Through it the defendants built an extensive criminal network to
facilitate the wholesale trade of compromised credit card details,
confidential financial and personal information, malicious computer
programmes, and other sophisticated tools and criminal services.

“The arrest, prosecution and conviction of these individuals represents
a significant step forward in our efforts to tackle cyber crime and
reduce the harm it causes.”

+ A full financial investigation into all four defendants is underway.

[ComputerSecurityArticles]

Scam emails can now be forwarded to the Police

Action Fraud - the UK’s national fraud reporting centre run by the governmental National Fraud Authority - has recently set up a dedicated e-mail address to which users are encouraged to forward every scam e-mail they receive.

The e-mails sent to this address - email@actionfraud.org.uk - are forwarded to the National Fraud Intelligence Bureau run by the City of London Police, which then engages in analysis in order to extract possible evidence from the messages, to think up ways for fraud prevention, for disruption of links between fraudsters and victims and for targeting the fraudsters' networks in the future.

"The NFIB analyses this information, searching for patterns and similarities between reports, which come from across the country. Intelligence packages are formed from the data and sent to relevant law enforcement agencies such as the police and Serious Organised Crime Agency," says Action Fraud, and adds a few tips on how to spot fake e-mails:

Fake e-mails often (but not always) display some of the following characteristics:

• the sender’s e-mail address doesn’t tally with the trusted organisation’s website address
• the e-mail is sent from a completely different address or a free web mail address
• the e-mail does not use your proper name, but uses a non-specific greeting like “dear customer”
• a sense of urgency; for example the threat that unless you act immediately your account may be closed
• a prominent website link. These can be forged or seem very similar to the proper address, but even a single character’s difference means a different website
• a request for personal information such as user name, password or bank details
• the e-mail contains spelling and grammatical errors
• you weren't expecting to get an e-mail from the company that appears to have sent it
• the entire text of the e-mail is contained within an image rather than the usual text format
• the image contains an embedded hyperlink to a bogus site.

According to the National Fraud Intelligence Bureau, only four days after the setting up of the dedicated e-mail address it has already received 19,000 scam e-mails.

“We thank the general public for this overwhelming response and urge them to keep on forwarding us their scam emails," said Detective Superintendent Tony Crampton, Director of the NFIB. "These will all be analyzed at the NFIB and the resulting intelligence will be used to disrupt the architects of these crimes.”

[net-security]

Bogus support call scams - this time with market research

Bogus support calls continue to plague Australians, with the Queensland Police Service (QPS) recently warning its constituents of a specific "outbreak" of call scams, this time from a call centre claiming to be the Windows Service Centre.

Brian Hay, a Detective Superindent with the QPS (and, not at all incidentally, winner of the 2010 AusCERT Director's Award for Individual Excellence in Information Security), points out that this latest scam seems to be more targeted than previous call-centre scams.
The scammers appear to have done some market research beforehand:

It has become apparent that some of the targeted victims of this scam had previously engaged in a phone survey some weeks earlier. This innocuous survey sought no personal information; however, it did query information regarding the householder’s computer equipment. When armed with this information at a later date, the fraudster is able to gain credibility of consumers to better scam them of their money.

The lessons to learn from this are:

* Don't assume that participating in unsolicited surveys is harmless because you're only giving away modest amounts of information such as the software you use. The scammers don't need to know exactly who you are, or where you live, in order to sound more believable when they contact you in the future. If in doubt, leave it out!

* Don't accept unsolicited calls which try to work on your computer security fears. You have nothing to gain, and everything to lose.

* Don't take a stranger's explanation of errors in Event Viewer or other system logs. If you are genuinely worried, contact a friend. Not a Facebook friend - a real friend. Someone you know, and like, and trust.

* Don't call back or visit websites based on what you're told over the phone or in an email. Find a reliable, physical reminder of where to call or go online - for example, the emergency number on the back of your credit card for banking problems, or the support number on the last bill from your ISP for online concerns.

[NakedSecurity]

UK Government Agency wants your email scams - but is it doing it the right way?

The British public is being urged to forward any email scams it receives to the National Fraud Authority. The reason? To collect intelligence which might help track down internet fraudsters and bring them to justice.

According to a BBC News report, mass marketing scams account for 90% of losses (an average victim who reports a fraud loses £27,000), but only make up a quarter of all reported fraud.


I personally applaud the motives of the agency. However, I question the effectiveness of this initiative.
It's all very well that the National Fraud Authority's Action Fraud website wants to be sent your scam emails - but has it provided members of the public with sensible instructions on how to send them in?
Taking a look at the Action Fraud press release, I see the instructions they give to users who want to assist the initiative:

People receiving scam emails are urged to forward them on to email@actionfraud.org.uk.

However, plain forwarding of an email is lossy - in other words, you lose important information that can be helpful in determining who may be behind the scam, or how it is being run. Specifically, full email headers are not normally included when you forward an email message.

This is an issue we know only too well about here at Sophos. Because relevant information can often be lost through the act of simple forwarding an email, the team at SophosLabs asks customers to send us email samples as RFC-2822 attachments. This retains the header information and means that the underlying characteristics of the message are not mangled in forwarding.

By the way, it's good to see that the agency recommends that users remove personally identifiable information before forwarding the emails - just in case.

In short, even if you believe you are assisting the fight against scammers by forwarding a message to Action Fraud, valuable information may have been lost.

As a separate point, it's worth noting that the National Fraud Authority's press release does describe a series of steps that may allow you to spot scams. Unfortunately, in most cases they require a keener eye than and a more fundamental knowledge of email than the general public may typically possess.

Fake emails often (but not always) display some of the following characteristics: 

* the sender’s email address doesn’t tally with the trusted organisation’s website address 

* the email is sent from a completely different address or a free web mail address 

* the email does not use your proper name, but uses a non-specific greeting like "dear customer" 

* a sense of urgency; for example the threat that unless you act immediately your account may be closed 

* a prominent website link. These can be forged or seem very similar to the proper address, but even a single character’s difference means a different website 

* a request for personal information such as user name, password or bank details 

* the email contains spelling and grammatical errors 

* you weren't expecting to get an email from the company that appears to have sent it 

* the entire text of the email is contained within an image rather than the usual text format 

* the image contains an embedded hyperlink to a bogus site

I have to ask myself, would most of these tips work with aged parents/grandparents/neighbours?

It's great that advice is being shared in an attempt to better protect the general public, but we also need to find ways to effectively communicate sometimes complex issues in language that the non-computer literate will understand.

[nakedsecurity]

8 years for ID fraudster

An identity thief who fraudulently claimed more than £1.3m in tax credits under false names has been imprisoned for eight-and-a-half years.
Olaide (John) Taiwo, 35, a security guard from Camberwell, South East London, who was earlier found guilty of conspiracy to commit tax credit fraud and acquiring criminal property, was jailed at a sentencing hearing at Inner London Crown Court on Tuesday. He was convicted along with a female accomplice, Olajumoke Ademuyiwa, who faces a sentencing hearing in April, of conspiring to steal the identities of at least 350 people before submitting more than 300 fraudulent tax credit claims.

Ademuyiwa, 42, of Canning Town, London, abused her position as a a Jobcentre Plus employee to obtaining the details of low-income people who might be eligible for tax credit repayments. These payments were directed towards accounts controlled by Taiwo and Ademuyiwa.

The scam ran from June 2004 until July 2008, when the fraud was detected and an investigation launched that ultimately resulted in the August 2010 arrest of Taiwo. HMRC investigators seized "details of numerous bank accounts held in the defendants’ names and aliases, plus documentation which held hundreds of innocent people’s identities". Investigators also seized £70,000 as suspected proceeds of crime pending the conclusion of confiscation proceedings, which remain ongoing.
Richard Young, senior investigating officer for HM Revenue & Customs (HMRC), said: "This pair ... deliberately attacked and abused a system designed to provide financial help to the most vulnerable people in our society. The sentences given will be a warning to anyone considering committing this type of fraud – it will not be tolerated. HMRC will pursue, prosecute and reclaim the financial gain from those found to commit these types of crime." ®

[The Register]