Feeds

419ers rifle through Ecademy.com

Anti-social networking

Intelligent flash storage arrays

The growing popularity of Web 2.0 as a venue for viruses, pedophiles and other online nasties made it only a matter of time before sleaze oozed to professional networking sites, and sure enough, an Australian security firm is offering a detailed postmortem on an attempted Nigerian banking scam on Ecademy.com.

Carl Jongsma, a lead researcher at Sunnet Beskerming, says he encountered the attempted fraud while perusing the pages of Ecademy, which aims to be to business people what MySpace is to Gen Y. Ecademy is based in the UK and claims more than 100,000 members worldwide. According to a report released today, the 419 perpetrators used a ginned-up user profile and Ecademy's messaging system to tailor appeals to site users.

"For the non-technical reader, this report provides a walkthrough of a scam attempt that they are likely to encounter in the future when logged into Professional/business networking sites, and it will help them identify potentially risky situations," Jongsma writes.

Jongsma, who uses Ecademy as a means of cultivating contacts, logged onto the site recently to find a message purporting to come from an executive at Emirates Bank Group, with headquarters in the United Arab Emirates city of Dubai.

"Your last name 'Jongsma' attracted me to read your profile which also impressed me and I decided to communicate with you and see how best we can assist each other," the message read in part.

In addition to the message tailored specifically to Jongsma, the communication also appeared authentic after the recipient was able to establish the existence of an Emirates Bank executive with the same name of his Ecademy correspondent. In the name of research, Sunnet Beskerming officials took the bait.

It's probably clear where all this is heading. The would-be banking executive soon made reference to a deceased banking customer, a "Peter Jongsman," who tragically perished in the 2006 Earthquake in Indonesia. The real Jongsma, who eventually changed the discussion venue with the executive to email, soon discovered that the messages were not originating from the UAE but - you guessed it - Nigeria.

Even after being confronted with the cancellation of his Ecademy account and other suspicious circumstances, the person posing as the bank executive insisted he was the real deal. So eager we he to clear the whole thing up that he made his case using IM features on Skype - another red flag since UAE authorities, according to Jongsma, ban the VoIP service in that country.

"As it stands, this new style of phishing and scamming is more like an old style scam, from when there was no Internet, and con artists had to invest time and resources into making a successful scam," Jongsma writes.

Julian Bond, Ecademy's CTO, agrees. "Social networks are another form of communication that is being attacked. Just like email," he wrote in an IM to The Register. He readily admits there's nothing stopping someone from gracing an account with the name and likeness of this reporter or anyone else. And he says Nigerian scams like the one Jongsma received are reported as many as 10 times per month.

Ecademy's security team quickly sniffs out untrustworthy people, often with the help of its user base, he adds. But the episode is a reminder that beyond all the buzz of Web 2.0 and social networks, there's no replacement for old-world skepticism. ®

Beginner's guide to SSL certificates

More from The Register

next story
MI6 oversight report on Lee Rigby murder: US web giants offer 'safe haven for TERRORISM'
PM urged to 'prioritise issue' after Facebook hindsight find
I'll be back (and forward): Hollywood's time travel tribulations
Quick, call the Time Cops to sort out this paradox!
Assange™ slumps back on Ecuador's sofa after detention appeal binned
Swedish court rules there's 'great risk' WikiLeaker will dodge prosecution
NSA mass spying reform KILLED by US Senators
Democrats needed just TWO more votes to keep alive bill reining in some surveillance
prev story

Whitepapers

Designing and building an open ITOA architecture
Learn about a new IT data taxonomy defined by the four data sources of IT visibility: wire, machine, agent, and synthetic data sets.
5 critical considerations for enterprise cloud backup
Key considerations when evaluating cloud backup solutions to ensure adequate protection security and availability of enterprise data.
Getting started with customer-focused identity management
Learn why identity is a fundamental requirement to digital growth, and how without it there is no way to identify and engage customers in a meaningful way.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Protecting against web application threats using SSL
SSL encryption can protect server‐to‐server communications, client devices, cloud resources, and other endpoints in order to help prevent the risk of data loss and losing customer trust.