Facebook and Google have been the victims of a $100 million phishing scam. According to a report on Fortune.com and the US Justice Department, the phishers forged email addresses, invoices, and corporate stamps in order to impersonate a large Asian-based manufacturer with which the tech firms regularly did business.
The point was to trick companies into paying for computer supplies. IT security experts have described this style of fraud as a “huge problem”. Lee Munson, security researcher at Comparitech, said:“Phishing or, more appropriately in this case ‘CEO Fraud’, poses a huge problem to organisations of all sizes.
While technical controls have a small part to play in reducing the likelihood of such an attack being successful, it is staff awareness training that is key here. That a non-technical business could be attacked in this way is, perhaps, forgivable but the same cannot be said for firms operating in the tech sector.”
He believes that if the companies behind the $100 million loss are indeed Facebook and Google, and the Justice Department has not confirmed this, it would be a surprise. Even if their teams are not completely alert to this sort of ruse, Munson says they should have a security department that can generate awareness around this type of financial fraud.
“Thus, while current disclosure laws may not require the victims in this case to come clean about what happened,” says Munson, “from a financial point of view – I certainly believe there is a public interest angle.
Investors in technology firms have a right to know that the business is managing its systems and people in an effective way that minimises risks. CEO fraud is relatively easy to identify and avoid, especially in this case, where the scam was allowed to continue unchecked over a two-year period.”
Explaining the background, Javvad Malik, security advocate at AlienVault said, “CEO/CFO fraud, is where a CFO is sent a phishing email purporting to be from the CEO demanding they immediately transfer some money to a third party. The mitigation strategies … would include, better third party identification and verification process, more stringent payment authorisations, and not solely relying on email as an authority to process.”
Mark James, IT Security specialist at ESET echoes this. “It’s a fact in today’s digital world that there is always someone trying to scam you. We fight it, we delete it, we even highlight it and use it to teach others what to look out for but there is one thing humans are good at and that’s adapting. Most spam or phishing attacks end up a failure, but that’s the nature of these types of attacks they don’t all have to succeed.
“For us to be safe we have to detect or block 100% of those attempts but they only need to get one right. If someone puts their mind to doing something there is a good chance they will succeed, whether that’s education, business or foul deeds. The good thing about the latter is most of the time people get caught.
This particular plan involved forging email addresses, invoices, and corporate stamps in order to trick some big companies into believing they are dealing with the ‘right’ company and handing over thousands, it just goes to prove that all companies large and small can be scammed.”
Paul Norris, senior engineer at Tripwire added, “Phishing has long been a valuable technique for cyber criminals because both trained humans and detection software have difficulty identifying a well-crafted phishing email. However, the bigger problem across the board is user awareness.
Organisations should implement training programs that help their users understand aspects of spam, phishing, and malware. A little bit of training can go a long way in this area.”
Comment on this article below or via Twitter: @ VanillaPlus OR @jcvplus
