Feeds

419ers rifle through Ecademy.com

Anti-social networking

Remote control for virtualized desktops

The growing popularity of Web 2.0 as a venue for viruses, pedophiles and other online nasties made it only a matter of time before sleaze oozed to professional networking sites, and sure enough, an Australian security firm is offering a detailed postmortem on an attempted Nigerian banking scam on Ecademy.com.

Carl Jongsma, a lead researcher at Sunnet Beskerming, says he encountered the attempted fraud while perusing the pages of Ecademy, which aims to be to business people what MySpace is to Gen Y. Ecademy is based in the UK and claims more than 100,000 members worldwide. According to a report released today, the 419 perpetrators used a ginned-up user profile and Ecademy's messaging system to tailor appeals to site users.

"For the non-technical reader, this report provides a walkthrough of a scam attempt that they are likely to encounter in the future when logged into Professional/business networking sites, and it will help them identify potentially risky situations," Jongsma writes.

Jongsma, who uses Ecademy as a means of cultivating contacts, logged onto the site recently to find a message purporting to come from an executive at Emirates Bank Group, with headquarters in the United Arab Emirates city of Dubai.

"Your last name 'Jongsma' attracted me to read your profile which also impressed me and I decided to communicate with you and see how best we can assist each other," the message read in part.

In addition to the message tailored specifically to Jongsma, the communication also appeared authentic after the recipient was able to establish the existence of an Emirates Bank executive with the same name of his Ecademy correspondent. In the name of research, Sunnet Beskerming officials took the bait.

It's probably clear where all this is heading. The would-be banking executive soon made reference to a deceased banking customer, a "Peter Jongsman," who tragically perished in the 2006 Earthquake in Indonesia. The real Jongsma, who eventually changed the discussion venue with the executive to email, soon discovered that the messages were not originating from the UAE but - you guessed it - Nigeria.

Even after being confronted with the cancellation of his Ecademy account and other suspicious circumstances, the person posing as the bank executive insisted he was the real deal. So eager we he to clear the whole thing up that he made his case using IM features on Skype - another red flag since UAE authorities, according to Jongsma, ban the VoIP service in that country.

"As it stands, this new style of phishing and scamming is more like an old style scam, from when there was no Internet, and con artists had to invest time and resources into making a successful scam," Jongsma writes.

Julian Bond, Ecademy's CTO, agrees. "Social networks are another form of communication that is being attacked. Just like email," he wrote in an IM to The Register. He readily admits there's nothing stopping someone from gracing an account with the name and likeness of this reporter or anyone else. And he says Nigerian scams like the one Jongsma received are reported as many as 10 times per month.

Ecademy's security team quickly sniffs out untrustworthy people, often with the help of its user base, he adds. But the episode is a reminder that beyond all the buzz of Web 2.0 and social networks, there's no replacement for old-world skepticism. ®

Beginner's guide to SSL certificates

Whitepapers

Why and how to choose the right cloud vendor
The benefits of cloud-based storage in your processes. Eliminate onsite, disk-based backup and archiving in favor of cloud-based data protection.
A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Protecting against web application threats using SSL
SSL encryption can protect server‐to‐server communications, client devices, cloud resources, and other endpoints in order to help prevent the risk of data loss and losing customer trust.
Intelligent flash storage arrays
Tegile Intelligent Storage Arrays with IntelliFlash helps IT boost storage utilization and effciency while delivering unmatched storage savings and performance.