Beta

Slashdot: News for Nerds

×

Welcome to the Slashdot Beta site -- learn more here. Use the link in the footer or click here to return to the Classic version of Slashdot.

Thank you!

Before you choose to head back to the Classic look of the site, we'd appreciate it if you share your thoughts on the Beta; your feedback is what drives our ongoing development.

Beta is different and we value you taking the time to try it out. Please take a look at the changes we've made in Beta and  learn more about it. Thanks for reading, and for making the site better!

Fake Subpoenas Sent To CEOs For Social Engineering

kdawson posted more than 6 years ago | from the whale-fishing dept.

Security 112

An anonymous reader writes "The Internet Storm Center notes that emails that look like subpoenas are being sent out to the CEOs of major US corporations. The email tries to entice the victim to click on a link for 'more information.' According to the ISC's John Bambenek: 'We've gotten a few reports that some CEOs have received what purports to be a federal subpoena via email ordering their testimony in a case. It then asks them to click a link and download the case history and associated information. One problem, it's [totally] bogus. It's a "click-the-link-for-malware" typical spammer stunt. So, first and foremost, don't click on such links. An interesting component of this scam was that it did properly identify the CEO and send it to his email directly. It's very highly targeted that way.'"

cancel ×

112 comments

Subpoena by *email* ?? (5, Insightful)

nurb432 (527695) | more than 6 years ago | (#23083374)

If you fall for that you deserve to get taken.

Re:Subpoena by *email* ?? (3, Interesting)

gnick (1211984) | more than 6 years ago | (#23083502)

One problem that I've noticed is that muckity-mucks often feel that they're "above" being targeted by such menial things as malware.

Re:Subpoena by *email* ?? (1)

FireXtol (1262832) | more than 6 years ago | (#23083554)

I'd say after you allow an executable to run... well... is like not encrypting your WRG/WAP. =)

Re:Subpoena by *email* ?? (4, Insightful)

Anonymous Coward | more than 6 years ago | (#23084784)

Actually my experience in Corperate IT, most C*O executives are dumb enough to open such items.

Cripes most virus infections at corperations come from these dimrods.

Re:Subpoena by *email* ?? (3, Insightful)

nomadic (141991) | more than 6 years ago | (#23084810)

One problem that I've noticed is that muckity-mucks often feel that they're "above" being targeted by such menial things as malware.

If you're an experienced executive you should at least realize that you need to be served with a subpoena, and e-mail isn't a valid method of service (yet). Oh well, business majors aren't known for their intellectual sharpness...

Re:Subpoena by *email* ?? (1, Informative)

Anonymous Coward | more than 6 years ago | (#23088348)

I received one of these e-mails. It was well targeted in that it got my information correct. However, other than that, it had every hallmark of spam. Links coming from the ".com" version of a ".gov" domain, e-mail from a source that wasn't what it purported to be, and the subject matter (a supeona) coming via e-mail instead of by Sheriff or Lawyer. It was also not caught by our spam filters.

One problem that I've noticed is that muckity-mucks often feel that they're "above" being targeted by such menial things as malware.
Us "Muckity-Mucks" are targeted by more malware, spam, telemarketing than any of you "little people" (tongue in cheek). Our names are on public registers and documents and those get picked up all the time. I get dozens of solicitation calls each week, piles of "official" scam letters in the mail, and hundreds of e-mail messages. This is to say nothing of the "important" faxes we receive. We are used to dealing with this junk.

Re:Subpoena by *email* ?? (4, Informative)

WaltBusterkeys (1156557) | more than 6 years ago | (#23083518)

Stranger things have happened, especially in cases where the events took place online. Normally you're right that service has to be done in person or by US mail.

BUT, if the only known way to contact a defendant or witness is by email (if, for example, their real names or addresses are unknown), then a court can authorize that as an alternative form of service. It's up to the court to decide if email would give sufficient notice and other means are impractical.

Here, of course, there's no reason to think that sending certified mail or a process server wouldn't work -- a corporate CEO isn't hard to find and service on a company can almost always be done through the state's secretary of state.

But, that doesn't mean that electronic subpoenas are never possible, as you suggest.

Re:Subpoena by *email* ?? (2, Funny)

GoodbyeBlueSky1 (176887) | more than 6 years ago | (#23084304)

This sounds like baloney. Can you back this up with a link?

Re:Subpoena by *email* ?? (5, Informative)

WaltBusterkeys (1156557) | more than 6 years ago | (#23084354)

Sure, here's an example of service by email [typepad.com] :

Plaintiffs Tishman and Wilkinson filed a lawsuit against defendant Pine, but had difficulty serving Pine with the summons. The plaintiffs tried the conventional methods of service under New York law, such as personal delivery. They even tried the "nailing and mailing" method by affixing a copy of the summons to the door of Pine's residence, then sending a copy in the mail.

Tishman and Wilkinson had information, however, that led them to believe Pine was out of the country. . . They petitioned the court for permission to serve Pine by e-mail, pursuant to N.Y. C.P.L.R. Â308(5), which allows service by such manner as the court directs, when the more conventional methods are "impracticable."

The court allowed service of the summons to an e-mail address Pine had used in a classified ad listing his house for sale. The court held that given the uncertainty about the success of the attempted "nailing and mailing" effort, and the fact that the Pine's attorneys wouldn't give a clear answer as to where Pine was living, alternative service by e-mail was appropriate.


Most states have similar laws that allow service by any practical means if conventional methods fail.

Re:Subpoena by *email* ?? (1)

GoodbyeBlueSky1 (176887) | more than 6 years ago | (#23084380)

Well then. Thanks for the info!

Re:Subpoena by *email* ?? (0)

Anonymous Coward | more than 6 years ago | (#23086714)

So if someone sues me after I've traveled into a black hole, the court is authorized to send someone after me?

Re:Subpoena by *email* ?? (1)

KURAAKU Deibiddo (740939) | more than 6 years ago | (#23088388)

This actually was the original premise of The Black Hole [imdb.com] , but then sanity prevailed and they realized this would only appeal to very geeky lawyers and process-servers.

Dr. Hans Reinhardt was actually supposed to be the leading process-server of his time, undaunted by the prospect of being crushed by a black hole in the pursuit of his quarry... ;)

Re:Subpoena by *email* ?? (1)

nurb432 (527695) | more than 6 years ago | (#23087768)

And with no proof of receipt i know id ignore it, and assume its spam. ( if it even got thru my filters ). No registered letter or delivery by sheriff, no show by me.

That court was ignorant if they actually allowed email to be considered.

Re:Subpoena by *email* ?? (1)

Coppit (2441) | more than 6 years ago | (#23088612)

Well, I wonder if Pine uses Pine, Alpine, or Mutt?

Re:Subpoena by *email* ?? (1)

Deadstick (535032) | more than 6 years ago | (#23083642)

Eef thee good Lor' didn' want'em sheared, he would'na made 'em sheep...

--Eli Wallach, The Magnificent Seven

rj

Re:Subpoena by *email* ?? (1)

pjt33 (739471) | more than 6 years ago | (#23087694)

Ah, but times have changed. [timesonline.co.uk] .

Re:Subpoena by *email* ?? (2, Informative)

davidphogan74 (623610) | more than 6 years ago | (#23084404)

I received one from the a California state organization about 3 years ago due to a lack of other ways to locate me and give me a written notice. The written notice had no external links whatsoever, and simply asked me to contact them regarding the matter and included a PDF of the subpoena itself, along with corroborating evidence that would relate to it.

A few phone calls and cross-checks with other resources later, it turned out to be valid.

Re:Subpoena by *email* ?? (1)

SHaFT7 (612918) | more than 6 years ago | (#23085758)

I've had a similar problem with emails coming from *@irs.gov i almost fell for one, as i was having tax issues with the previous owner of my business. now some of my clients are getting the emails, and luckily it didn't actually contain a virus, but they completely fell for it.

Re:Subpoena by *email* ?? (1)

dziman (415307) | more than 6 years ago | (#23087944)

Proper training to identify possible risks (this is a human thing) are likely key to minimizing a compromise. AV software and HIPS are great and all, you can blow your entire budget on them. There is no substitute for educated and intelligent employees (and CEOs).

Less focus on the security of the OS, network, etc, more investment in employee training to identify risks, confirm validity, etc are tools that change less over time.

You already have real problems. (5, Insightful)

Cajun Hell (725246) | more than 6 years ago | (#23083408)

So, first and foremost, don't click on such links.

If clicking a link poses even the slightest risk, you need to replace your software ASAP.

Websites don't "run" malware; users download and install malware with execution privileges. Or their defective user agents do it for them. CEOs don't need defective user agents. I'm not sure who does.

Re:You already have real problems. (4, Informative)

Anonymous Coward | more than 6 years ago | (#23083462)

CEOs should know better anyway. Start of process is with your registered agent, not your email address.

Re:You already have real problems. (1)

nomadic (141991) | more than 6 years ago | (#23085968)

CEOs should know better anyway. Start of process is with your registered agent, not your email address.

If it's a subpoena sent to them in their personal capacity it goes straight to them (or their attorney if he/she has accepted service on their behalf).

Re:You already have real problems. (1)

kylehase (982334) | more than 6 years ago | (#23085992)

Some C_Os don't know a lot about technology but have privileged access to secured resources so they're a valid concern for breaches. http://www.wired.com/techbiz/media/news/2003/08/60052 [wired.com]

Re:You already have real problems. (5, Funny)

cynicsreport (1125235) | more than 6 years ago | (#23083628)

So, first and foremost, don't click on such links.
This is always good advice. For more information on how to avoid anonymous links, check out this website [autoinfect-virus.cr] .

Re:You already have real problems. (5, Funny)

Lobster Quadrille (965591) | more than 6 years ago | (#23083738)

I clicked it. It just says 'server not found'.

If you're going to make a joke on slashdot, you gotta at least register the domain and build a website, or nobody will take you seriously.

Re:You already have real problems. (0)

Anonymous Coward | more than 6 years ago | (#23084068)

Because the virus has already hijacked your browser and caused it to display a fake 'server not found' page. This one's sneaky, stealthy, and very hard to eradicate. If you clicked that link, I suggest you reformat your hard drive. It's the only way to be sure you've gotten rid of it.

Re:You already have real problems. (1)

Lobster Quadrille (965591) | more than 6 years ago | (#23084322)

Well, shit.

Re:You already have real problems. (3, Funny)

Lobster Quadrille (965591) | more than 6 years ago | (#23084350)

Good thing I used my CEO's computer to view it.

Re:You already have real problems. (2, Funny)

GreyWolf3000 (468618) | more than 6 years ago | (#23084542)

He did. It's just that the link got slashdotted.

Re:You already have real problems. (0)

Anonymous Coward | more than 6 years ago | (#23084996)

Yeah, I agree. You can find out more about proper trolling techniques here [xrl.us] .

Re:You already have real problems. (1)

Lobster Quadrille (965591) | more than 6 years ago | (#23085364)

Dammit. Twice in one week.

Re:You already have real problems. (0, Redundant)

CBravo (35450) | more than 6 years ago | (#23086740)

Hey man, I clicked the link and now my machine is infected. Thanks a lot bro!!!

Re:You already have real problems. (2, Funny)

matt me (850665) | more than 6 years ago | (#23089022)

If you're going to make a joke on slashdot, you gotta at least register the domain and build a website, or nobody will take you seriously.
I have not registered the domain and built a page there. The page appears identical to the firefox error page.

Re:You already have real problems. (1)

Nushio (951488) | more than 6 years ago | (#23083762)

Uhm, your link is broken :-(

Re:You already have real problems. (1)

borgasm (547139) | more than 6 years ago | (#23083912)

This would have been a perfect opportunity for a goatse link. Please plan accordingly next time.

Re:You already have real problems. (0)

Anonymous Coward | more than 6 years ago | (#23084072)

or a rick roll.

Re:You already have real problems. (0)

Anonymous Coward | more than 6 years ago | (#23084004)

See how many tards clicked on a link they don't know where it had came from?
And they are not CEOs, but Might-Uber-H4x0r-Linuz geniuses...

Re:You already have real problems. (2, Funny)

Urza9814 (883915) | more than 6 years ago | (#23084316)

c'mon man! If you're gonna make a link, make it to a real website! As a Linux user, I enjoy visiting malware sites :)

Re:You already have real problems. (-1, Flamebait)

Anonymous Coward | more than 6 years ago | (#23083750)

Great advice. Right up there with, don't crash into other vehicles unless you want to be in a wreck.

You sound like the typical arrogant douche with mac or linux that thinks exploits don't exist except on windows.

No matter how false your sense of security is, not click a link in an email is the best course of action.

Acting like your shit don't stink will get you pwnt.

Re:You already have real problems. (1)

Fast Thick Pants (1081517) | more than 6 years ago | (#23085536)

If clicking a link poses even the slightest risk, you need to replace your software ASAP.

What would you suggest replacing it with? Arbitrary-execution bugs have cropped up in every major browser (yes, even lynx [secunia.com] ) from time to time, and often the bad guys know about them first. Ditto with common browser plugins. Hopefully your browser is not running with root privileges, but probably it has full access to your personal files -- and besides, privilege escalation bugs are also constantly being discovered.

Short of using a temporary installation image (or live CD) on a separate network, I can't think of what sort of setup I could, with clear conscience, recommend to someone who wanted the freedom to click on targeted malware links.

Welcome to the grim paranoid realities of net security -- every link, every email, every IM, every packet heading into your network does indeed pose the slightest risk, because it will eventually be processed by one or more pieces of buggy software. There's a lot you can do to manage these risks, but pretending that they only exist in "bad" software is just putting your head in the sand.

Re:You already have real problems. (1)

jimicus (737525) | more than 6 years ago | (#23090086)

If clicking a link poses even the slightest risk, you need to replace your software ASAP.

Websites don't "run" malware; users download and install malware with execution privileges. Or their defective user agents do it for them. CEOs don't need defective user agents. I'm not sure who does.

Let me play devil's advocate for a moment.

Knowing (as discussed elsewhere) that email, while unusual, is in some circumstances a perfectly acceptable way to serve a subpoena, no responsible CEO is going to ignore the email unless pretty damn convinced that it's fake.

A user agent saying "Where do you want to save this?" won't help. All that will happen is they'll save it somewhere then run it from there.

The only solution is for the OS to actively prevent the end-user from executing code from random locations - in Unix, you'd mount their home directory and maybe /tmp with the noexec option.

Even then, the IT department is still going to have some work to do. You'll need to convince the CEO that the subpoena is fake without actually opening it.

Someone had to say it... (2)

Lunix Nutcase (1092239) | more than 6 years ago | (#23083422)

I for one welcome our new CEO scamming overlords.

Re:Someone had to say it... (0)

Anonymous Coward | more than 6 years ago | (#23091082)

I am a CEO, you insensitive clod! ... and think of the children!

Risk/Benifit - and insider trading (1)

Gat0r30y (957941) | more than 6 years ago | (#23083432)

I sure hope no CEO was dumb enough to fall for this. But it certainly is a new and interesting direction for Social Engineering - very targeted, but if even one falls for it the whole companies financials/business strategies, basically a tremendous amount of high value information all in one fell swoop.

Re:Risk/Benifit - and insider trading (1)

liquidpele (663430) | more than 6 years ago | (#23084494)

I know most of our upper management would not, but then again, we are a security company :)

I'm guessing the CEO's that would click it are for businesses that don't deal with technology, and the management relies on IT to keep them safe.

Hmmm.... (2, Insightful)

Otter (3800) | more than 6 years ago | (#23083446)

If you're the CEO of a major corporation (or the admin who reads and prioritizes his email for him), you're crazy to be clicking on something like that even if it were guaranteed to be real. That's what you have a legion of lawyers for.

Clever scheme, though.

Re:Hmmm.... (1, Funny)

Anonymous Coward | more than 6 years ago | (#23083546)

I've been using bill@microsoft.com as my email address for websites for years.
I hope he appreciates the extra business i'm sending his way.

Re:Hmmm.... (3, Informative)

iNaya (1049686) | more than 6 years ago | (#23084832)

Pity his email is actually billg@microsoft.com

Re:Hmmm.... (1)

Architect_sasyr (938685) | more than 6 years ago | (#23084100)

(or the admin who reads and prioritizes his email for him)
As a fellow B.O.F.H. I have to say that is the best damned justification I've ever seen for reading my CEO's email!

Boss got this yesterday (5, Interesting)

ResQuad (243184) | more than 6 years ago | (#23083464)

My boss received one of these yesterday. Luckily he is one of the smarter people in this world and FW'd me the email (being the suspicious person he is). Personally I thought it was rather clever.

Also - I wonder... Is there some "hacker code" out there that says if you are sending out a phishing email - you must misspell at least a few words? Cause these subpoenas looked fairly good - but there were misspellings. Can't they just run the emails through Word or Open Office before they send them out?

Re:Boss got this yesterday (4, Funny)

Anonymous Coward | more than 6 years ago | (#23083532)

Is there some "hacker code" out there that says if you are sending out a phishing email - you must misspell at least a few words?
We're really not supposed to talk about the hacker code in public, where n00bs might see.

Re:Boss got this yesterday (4, Funny)

tattood (855883) | more than 6 years ago | (#23083594)

The first rule of hacker code is - you don't talk about hacker code.

Re: The Hacker Code -- REVEALED (1)

chooks (71012) | more than 6 years ago | (#23085008)

1. Don't talk about the hacker code.
2. Don't talk about the hacker code.
3. ????????
4. PROFIT.

Re:Boss got this yesterday (1)

madfancier (1111009) | more than 6 years ago | (#23085922)

You just broke it.

P.S. I could never get my head around this recursion.

Re:Boss got this yesterday (1)

Lobster Quadrille (965591) | more than 6 years ago | (#23083758)

No, but I'm going to write one now.

Re:Boss got this yesterday (1)

LordP (96602) | more than 6 years ago | (#23083788)

I got a spam email the other day that actually had no spelling errors in it. I didn't check the grammar, because it was TL;DR, but it looked ok.

Click [addict.net.nz] if you want to have a read.

Re:Boss got this yesterday (2, Informative)

XHIIHIIHX (918333) | more than 6 years ago | (#23084214)

I wonder... Is there some "hacker code" out there that says if you are sending out a phishing email - you must misspell
Yes there is. By mispelling [sic pun] a few words, you can confuse anti-spam filters that are looking for duplicate mass mailed documents or for specific words. Typical spamming programs will allow you to insert random chars (replace 1, l or ! for I) or will substitute some automatically.

Re:Boss got this yesterday (2, Interesting)

pclminion (145572) | more than 6 years ago | (#23084376)

Yes there is. By mispelling [sic pun] a few words, you can confuse anti-spam filters that are looking for duplicate mass mailed documents or for specific words. Typical spamming programs will allow you to insert random chars (replace 1, l or ! for I) or will substitute some automatically.

That might help it get past the spam filter, but it certainly doesn't help it get past the "Me" filter. *I* will recognize the email as a phish based on a SINGLE misspelling. The problem isn't getting past the filters, the problem is convincing the user that the email is legitimate, and misspellings only hurt that cause.

Re:Boss got this yesterday (2, Informative)

XHIIHIIHX (918333) | more than 6 years ago | (#23085698)

Which doesn't matter if it doesn't get to the user in the first place.

Re:Boss got this yesterday (1)

Eevee1 (1147279) | more than 6 years ago | (#23085816)

It also works for MySpace posts. And some!ime$ $/. p0Ztz.

Agreed (1, Interesting)

Anonymous Coward | more than 6 years ago | (#23084252)

Our CEO got one of these yesterday too. Luckily, his executive administrator has more brains than he, and forwarded it to our legal dept., questioning it. Our legal dept contacted the IT dept, and I told them that it was totally bogus.
 
The admin actually was quoted as saying "Since when are they sending subpoenas by email?".

Re:Boss got this yesterday (1)

jberryman (1175517) | more than 6 years ago | (#23084670)

Unfortunately for the truly 1337, ed has no spellchecker.

To be on the safe side ... (2, Funny)

cpricejones (950353) | more than 6 years ago | (#23083488)

maybe they should post the email list so that all the CEOs out there know if that particular subpoena they received was real or not. So many subpoena emails to go through ...

I have been saying this... (2, Interesting)

zappepcs (820751) | more than 6 years ago | (#23083558)

Every time that I comment on a story about viruses and malware and security, I mention the fact that what is normally mentioned by antivirus vendors is junk used to scare up business.

The real danger lies elsewhere. Stories like this and the cyber-war story about the US and China are the ones that you need to follow and think about.

The chances that your company is already compromised by the NSA or some other country's spy agency/military is reasonably high, no matter what you do.

Okay, so you make cheeseburger boxes for several chain restaurants, who would want data from your system?

It looks a lot like the butterfly effect http://en.wikipedia.org/wiki/Butterfly_effect [wikipedia.org] in the fact that one small chance encounter or small piece of information can greatly affect the outcome of a particular chain of events. Your company makes cheeseburger boxes for a company whose CEO, in turn, is a friend of or associate of some political figure. This information is gleened from your system via email, and phishing email is used to get that political figure to open an email which is a dupe of a previous email sent, but contains an active-x payload... this in turn leads to more serious and useful information down the road... and viola! you have enough for a hack on the RNC mail server...

Something like that, just work out your own end goal and play 6 steps to Kevin Bacon to find out how to get there. Much is public information and can be used to nail the last link you need for planting the right spyware in the right place, unnoticed, undetected, unfettered. No need for millions of bots, just one well placed piece of code.

Best part is that it is enabled/started by the high-ranking user, one that is never spied on, so the malware is safely sitting there doing it's thing without interruption.

That is how spying works, a little bit at a time, patiently looking for a chink in the armor.

Re:I have been saying this... (1)

realthing02 (1084767) | more than 6 years ago | (#23083652)

I'm not sure I agree with this. Wouldn't it just be easier to send out mass emails to the target company, and just wait for the one stupid individual to click the link? Then you've got your malware or whathaveyou, and you're on your way. I can see your point if we're talking about some ridiculously secure intranet that you want access to, but not something targeting seemingly random CEO's. But I do not have a lot of experience in this area, so maybe you know more than I'm getting from the post.

Re:I have been saying this... (1)

bagboy (630125) | more than 6 years ago | (#23083736)

I've got the cheeseburger box folks' bot telling the bun folks' bot to tell the burger folks' bot to inform the ketchup folks' bot to relay to the mayo folks' bot to hold the mayo. Now my lunch is hot-off-the-grill and ready for me.

Re:I have been saying this... (4, Informative)

Digi-John (692918) | more than 6 years ago | (#23083770)

The real danger lies elsewhere. Stories like this and the cyber-war story about the US and China are the ones that you need to follow and think about.

It looks a lot like the butterfly effect http://en.wikipedia.org/wiki/Butterfly_effect [wikipedia.org] in the fact that one small chance encounter or small piece of information can greatly affect the outcome of a particular chain of events. Your company makes cheeseburger boxes for a company whose CEO, in turn, is a friend of or associate of some political figure. This information is gleened from your system via email, and phishing email is used to get that political figure to open an email which is a dupe of a previous email sent, but contains an active-x payload... this in turn leads to more serious and useful information down the road... and viola! you have enough for a hack on the RNC mail server...

That is how spying works, a little bit at a time, patiently looking for a chink in the armor.

Reminds me of the information security training I had to take before starting my job here at a national lab. First, we watched a video in which an ex-KGB boss who now provides security consulting worldwide says, "Do not think that because you are low-ranking or do not work with classified information, that you are not a potential target for espionage" and goes on to tell us how almost certainly at least a few of the people we work with have been or will be targeted for espionage or potential defection. Then we were told how several pieces of non-classified information can be put together to create classified information, even unintentionally.

Even if you don't work for the government, you have to be really careful if you want your data to be secure.

Re:I have been saying this... (1)

Lobster Quadrille (965591) | more than 6 years ago | (#23083790)

You're on the right track.

When I'm doing a pentest, I often look into websites that known users of my victim site frequent, to get more info about possible passwords, social engineering fodder, or other info. It rarely gives huge returns, but you can usually get something this way, and that's often all you need.

And even if your company's servers dont' have the information I'm looking for, I could always use it as a proxy while attacking the real target, to send the blame your way while I'm working for your competitor.

Re:I have been saying this... (1)

Technician (215283) | more than 6 years ago | (#23085818)

Every time that I comment on a story about viruses and malware and security, I mention the fact that what is normally mentioned by antivirus vendors is junk used to scare up business.


You missed the obvious.. The Acrobat.exe.. It's another Microsoft Windows Virus.

CEOs read email? (1, Informative)

Anonymous Coward | more than 6 years ago | (#23083668)

Most I know, the secretaries read it, print it and then file the copies.

Re:CEOs read email? (1)

RiotingPacifist (1228016) | more than 6 years ago | (#23084372)

Most I know, the secretaries read it, print it and then file the copies.
Its when they start trying to click the links, that you worry who's running your company!

Re:CEOs read email? (1)

Culture20 (968837) | more than 6 years ago | (#23084596)

But that means the Secretaries are the ones that click the link. Considering that the Secretaries often have gobs of useful calendar information (and access to the CEO email), this is a _bad_ thing.

An email subpeona? (1)

Cracked Pottery (947450) | more than 6 years ago | (#23083684)

That is new to me. Must be a dyslexic server process. Anybody in a position of responsibility who falls for any kind of phishing ought to look into getting a chauffeurs license, or if they are artistically inclined they can go to barber school.

I like to look (1)

contrapunctus (907549) | more than 6 years ago | (#23083686)

Even if I know this was bogus, I would still click on it because I would be curious about the scam and for the entertainment value.
Would I fail the test then?

Re:I like to look (1)

flyingfsck (986395) | more than 6 years ago | (#23083754)

I always click everything with wild abandon. That is what web browsers are for. If you can't click on everything and anything, then something is broken and needs fixing.

Re:I like to look (1)

justinlee37 (993373) | more than 6 years ago | (#23083896)

Yeah, my free copy of Avast! antivirus (home edition for non-commercial use) notifies me when I click on something malicious, and gives me a chance to opt out of downloading it. Additionally, Spybot Search & Destroy's "TeaTimer" prompts me before any application attempts to edit the registry (which shady websites love to do). On top of all that, Firefox is my default browser, and most ActiveX controls are disabled or prompt-to-download by default (as they should be).

No, I am not a shill.

Re:I like to look (1)

Heembo (916647) | more than 6 years ago | (#23085478)

This is an executable, and AVG does not include coverage right now. FF will not save you, either.

Translation: PWND

http://www.virustotal.com/analisis/13bfb6913f9c328c7b657fce4ba4c731 [virustotal.com]

Re:I like to look (1)

justinlee37 (993373) | more than 6 years ago | (#23085850)

Assuming someone could trick me into running a malicious executable. It's usually pretty obvious -- like those "porn videos" on yahoo vid. search that link you to a site that's all like, "error! you must download this blah thing to see nekkid ladies!"

Being able to distinguish an executable from a family vacation photo or tax spreadsheet is what separates the users from the lusers.

Re:I like to look (0)

Anonymous Coward | more than 6 years ago | (#23086724)

clicky [goatse.cx]

Re:I like to look (1)

Lobster Quadrille (965591) | more than 6 years ago | (#23083822)

I do it too, but in a vm, not running the likely target OS (though for a targeted attack, this won't make a difference, I suppose), and with noscript.

Re:I like to look (1)

Your Pal Dave (33229) | more than 6 years ago | (#23086044)

Even then, you need to be careful. I got one of the "April Fools" storm worm spams, and I decided to see what it would do in a vm on my linux box. I started up a bunch of sysinternals tools, ran the downloaded exe, watched it for a while, and then nuked the vm.

Unfortunately, I forgot to shut off networking to the vm, and the next day I got an email nastygram from my ISP saying that my port 25 had been blocked due to spamming...

Etch a Sketch (5, Funny)

EEPROMS (889169) | more than 6 years ago | (#23083732)

We just gave our CEO a new laptop, that reminds me I better tell him he needs to shake it to reset.

Re:Etch a Sketch (1)

DJNephilim (832695) | more than 6 years ago | (#23084592)

You work at the White House?

/sarcasm

Highly targeted? (1)

Itninja (937614) | more than 6 years ago | (#23083766)

More like widely broadcast. Everybody has been getting these (who's spam filter isn't catching them). It's been on Snopes since this morning (not linking to Snopes in protest of their scriptastic ad pushing).

"emails that look like subpoenas " (1)

rickb928 (945187) | more than 6 years ago | (#23083906)

I'm not that dumb. sheesh.

Looks like I gotta change my job site profile. 'CEO' isn't that hard a job to fake, apprently. At least I won't be as easily phished as the current spawn.

How will he click it? (2, Funny)

prockcore (543967) | more than 6 years ago | (#23084164)

How will the CEO click the link on the printout his secretary made for him?

I was hit by it... (5, Informative)

npal (133524) | more than 6 years ago | (#23084310)

I saw it on my Treo and it looked very real - at first. There were four issues: It was a Federal subpoena but it mentioned a "city prosecutor" down towards the end. This started some suspicion.
Then I noticed that it was a grand jury for a civil trial. So I'm wondering, do they use grand jury's for civil trials? It was in California, so I thought maybe they somehow did. Then, I could see that they wanted a credit card to get the information. Big red flag, but it used pricing by the page - so I thought only the government could dream up something like this and maybe it was legit. Finally, the domain name for the link to the credit card page looked okay, but it was phony.

All and all, I'll bet a number of people fell for it because the targeting was so good.

Amazing (1)

elloGov (1217998) | more than 6 years ago | (#23084482)

Oh the talent in this world!

Subpeona = SPAM (1)

zienth (890583) | more than 6 years ago | (#23084588)

I have my spam filter set up to send all subpoenas directly to my junkmail folder. I find it saves me a lot of time and hassle.

Zienth

easily done (2, Insightful)

locokamil (850008) | more than 6 years ago | (#23085470)

I don't know about other industries, but in the financial industry (as far as I know) employees are required to have an address of format [name1.name2]@[company domain].

Makes for easy spamming...

Re:easily done (0)

Anonymous Coward | more than 6 years ago | (#23089748)

I am not sure what you mean by financial industry, but the bank I use doesn't use that format.

I would be more concerned that... (1)

Guppy06 (410832) | more than 6 years ago | (#23085650)

CEO's of major corporations are so easily duped. Are the stockholders really getting their money's worth, what with all the golden parachutes on top of this?

CEOs read their own mail?! (1)

GumphMaster (772693) | more than 6 years ago | (#23085740)

CEOs read their own mail?!

Never would have believed if I hadn't read it here :)

That's nothing (4, Funny)

PCM2 (4486) | more than 6 years ago | (#23085938)

You think that's targeted? The other day I received an e-mail from a pharmaceutical company offering to discuss options for enlarging my very small penis. They asked me if I was tired of being unable to satisfy women, and whether I had tried the other pills without results. I mean, seriously ... how can spammers find out stuff like this?? I'm switching to Firefox.

Re:That's nothing (1)

Hoi Polloi (522990) | more than 6 years ago | (#23090720)

Sure your partner, or an ex, isn't a spammer?

You might want to ask what all those checks written out for Russian banks are about.

The CEO is always the dumbest guy in the building (0)

Anonymous Coward | more than 6 years ago | (#23086966)

This is a very good choice of target. The higher up they are in the organization, the less they know about anything. Eat the rich!

Typical (1)

Fnord666 (889225) | more than 6 years ago | (#23088418)

I fail to see the news in this. Spammers and malware distributors have always targeted the technologically ignorant.

CEO's don't read e-mail (1)

TheRealCodeRed (46572) | more than 6 years ago | (#23089834)

I don't see the problem. 1) CEO's don't read e-mail. 2) Even if they did read it they would forward it to there lawyer. 3) CEO's are way to smart to fall for that. :)

I got a good phish last week (1)

peter303 (12292) | more than 6 years ago | (#23090508)

This phish had spoofed a major credit card's email address and had a 1-800 number to respond. I was looking for javascript or cgi returns to another source, but didnt see it. I called the real 800 from that company just to doubled-check my account because the spoof was so good. I only checked up on one phish before, the first one I got about ten years, because it was a new thing then.

These guys are spending big dollars to set up a 1-800 number. I guess they get it all back in one or two victims.
Load More Comments
Slashdot Account

Need an Account?

Forgot your password?

Don't worry, we never post anything without your permission.

Submission Text Formatting Tips

We support a small subset of HTML, namely these tags:

  • b
  • i
  • p
  • br
  • a
  • ol
  • ul
  • li
  • dl
  • dt
  • dd
  • em
  • strong
  • tt
  • blockquote
  • div
  • quote
  • ecode

"ecode" can be used for code snippets, for example:

<ecode>    while(1) { do_something(); } </ecode>
Create a Slashdot Account

Loading...