Anti-Fraud , Business Email Compromise (BEC) , Cybercrime

Don't Fall for Fraudsters or You'll Be Poor and Brokenhearted Too(euroinfosec) • February 14, 2019    Source: Agari

This Valentine's Day, authorities are once again warning individuals to watch out for anyone perpetrating romance scams.

See Also: Live Webinar: Building Secure Delivery Pipelines with Docker, Kubernetes, and Trend Micro

Such "fauxmance" often takes the form of fraudster Romeos and Juliets, many of whom are operating from West Africa or Eastern Europe. Email security firm Agari, based in San Mateo, California, says names commonly assumed by scammers include Laura Cahill, Britney Parkwell, Lisa Frankel and U.S. Army Captain Starling Michael.

Romance scams typically start with the promise of companionship or romance, always leading to a demand for one thing. "We're talking about people you meet online, who lavish you with attention ... and then ask for money," the Federal Trade Commission says in a romance scam advisory. "Usually they want the money by wire transfer or gift card. They might claim they need it for a medical emergency or to come visit you. Then they take your money, but there's no surgery and no trip," only heartache.

"There are many romance scams out there, and the psychology of it is exploitation of feelings," says Alex Holden, CISO of Hold Security, an information security and incident response firm based in Wisconsin.

Many social engineering attacks use one of six "influencing levers," which are techniques for influencing the subconscious defined by psychologist Robert Cialdini. Raj Samani, chief scientist at security firm McAfee, says romance scams hit many of these levers: getting targets to like the social engineer, appealing to something being in short supply and exploiting victims' propensity to stick to any decision they've made.

International Affair

Romance scams and their cousin, business email compromise schemes, have been growing more sophisticated. "Many of the classic scams, such as technical support scams, advanced fee fraud and romance scams, still result in a considerable numbers of victims," the EU's law enforcement intelligence agency, Europol, says in its Internet Organized Crime Threat Assessment for 2018 (see: Cybercrime: 15 Top Threats and Trends).

As with so many online scams, criminals target victims around the world. In the U.S., women over the age of 40 are frequent targets.

"West African romance scams are straightforward, targeting older women by creating an artificial attraction and then playing on emotions from love all the way down to blackmail," Holden says. Having investigated some romance scams and worked with real victims, he says that "the effects are devastating psychologically."

Compared to fraudsters operating from West Africa, Eastern Europeans' approach appears to be more no less ruthless, but more industrialized. "While their African counterparts are not afraid to be on camera or on the phone, Eastern Europeans are mastering fraud by pretending to be attractive females - and lately gay young men," Holden says. "They have extensive manuals for endearment and abuse, templates on how to approach a victim and keep them enticed, images taken from professional models who are in on the scam, videos of the same young ladies, phone centers who will make a call to anyone, and even extensive techniques to leach money from the victims."

These are not isolated enterprises. Holden says some romance scammers also appear to be closely associated with crimes involving abuse and human trafficking.

Booming Business

Americans lost $143 million to romance scams in 2017, with each incident resulting in an average loss of $2,600, although victims over the age of 70 lost $10,000 on average, the FTC says. The Better Business Bureau estimates that since 2015, U.S. and Canadian victims' romance scam losses have reached nearly $1 billion.

Action Fraud, which is the U.K.'s national reporting center for fraud and cybercrime, says British victims filed 4,555 romance fraud reports in 2018, claiming total losses of more than £50 million ($64 million).

Social-engineering attacks appear to be popular with criminals because they're simple and effective. "Hacking people is easier than hacking technology," says Chris Morales, head of security analytics at Vectra, a San Jose, California-based threat detection and response firm. "Why break into a user's digital bank account when you can just have them send you the money? Why hack a password when you can just call a user and have them give you the password instead? Social engineering is by the far the most successful method to compromise a user or organization."

Source: CyberScout

One crime group, dubbed "Scarlet Window" by Agari, is based in Nigeria and registers dozens of different identities on dating sites large and small.

"While they hit the popular dating sites like Match, eHarmony, and OKCupid, the group also targeted relationship seekers on more specialized sites, such as Dating4Disabled.com, Farmers Dating Site and DivorcedPeopleMeet.com," according to a report from Agari. "Farmers in rural areas and people with disabilities are at higher risk of isolation and loneliness, making them especially vulnerable targets."

Example of a "Laura Cahill" email template used with a romance scam target (Source: Agari)

The group's more successful scams appear to have made a connection with victims via religion. "It is clearly an area the group actively tries to exploit," Agari says. "This is likely one way to test willingness to fall for the scam, and a way to build connection and trust with religious-minded victims."

Busting Bad Romeos and Juliets

Authorities continue to battle scammers via cross-border operations (see: Churchgoing Nigerians Drive Business Email Attacks).

Ronayerin K. Ogolor, 49, a naturalized U.S. citizen from Nigeria, was charged with one count of conspiracy to commit wire fraud in a criminal complaint filed in Missouri federal court in October 2018. Ogolor has been accused of running romance scams since 2014, often targeting elderly people in search of either romance or companionship via sites such as Facebook, ChristianMingle.com and Hangout.com.

"One victim - a widow in Indiana who received a friend request on Facebook - believed a co-conspirator was a widower working on an oil rig off the coast of Louisiana; she sent a total of $450,000 to Ogolor," the Department of Justice said. "Another victim in Texas, who believed a co-conspirator was a widower and U.S. Army general deployed in Afghanistan, lost at least $300,000."

In June 2018, an international investigation - dubbed Operation Wire Wire, targeting business email compromise and romance scammers who received funds via wire transfers - resulted in 74 arrests - many in the U.S., a few across Canada, Mauritius and Poland, as well as 29 in Nigeria.

Separately, in 2017, a U.S. judge sentenced three Nigerian nationals to lengthy prison terms. During a three-week jury trial after being extradited to the U.S. from South Africa in 2015, the men were convicted of numerous crimes, including identity theft, payment card fraud and romance scams.

Rasaq Raheem, Oladimeji Seun Ayelotan and Femi Alexander Mewase (Photos: Department of Justice)

Prosecutors told the court that the three men - Rasaq Aderoju Raheem, Oladimeji Seun Ayelotan and Femi Alexander Mewase - would allegedly often pretend to be European women to establish a romantic relationship with victims, often to trick them into serving as money mules for the gang or on behalf of others (see: Don't Be a Money Mule for the Holidays).

Money Mule Recruitment

The FBI says crime gangs often recruit money mules or use "work at home scams" to move money and make it more difficult for investigators to unravel their operations.

In August 2016, Interpol and the Nigerian Economic and Financial Crime Commission announced the arrest of "Mike," a 40-year-old Nigerian man accused of being tied to $60 million in fraud. Together with a 38-year-old alleged accomplice, Mike was arrested in the southern Nigerian city of Port Harcourt, thanks to a tip to Interpol from security firm Trend Micro.

A digital forensic review of devices seized when Mike was arrested revealed that he was involved in numerous business email compromise and romance scams, authorities said. "Heading a network of at least 40 individuals across Nigeria, Malaysia and South Africa, which both provided malware and carried out the frauds, the alleged mastermind also had money laundering contacts in China, Europe and the U.S. who provided bank account details for the illicit cash flow," Interpol and EFCC said in a joint statement.

Hacking the User

Despite such arrests, as long as romance scams keep generating profits, criminals will keep playing Romeo or Juliet. "Social engineering attacks like this will continue to be used because of their high success rates and potential for larger financial payoffs. Granted, they're harder to setup and execute than, say, a standard phishing campaign or trying to run a ransomware scam, but the payoff makes it worthwhile," says Nathan Wenzler, senior director of cybersecurity at Moss Adams, a Seattle-based public accounting firm.

"Plus, as industries focus more and more on securing their networks, servers, databases and application, they're making it harder for the more traditional methods of cyberattack to work," Wenzler says. "Since attackers are operating, by and large, for financial gain, they're going to take the path of least resistance to attack. And more and more, that's now the users themselves, rather than the technology they use."

Cybercrime , Cyberwarfare / Nation-state attacks , Data Loss

Monica Witt Allegedly Aided Spear-Phishing Attacks Against US Military(jeremy_kirk) • February 14, 2019    Source: FBI

A former U.S. Air Force counterintelligence agent has been indicted together with four Iranians for coordinating spear-phishing campaigns that sought to compromise the computers of other U.S. intelligence agents. The charges were revealed by the U.S. Department of Justice on Wednesday.

See Also: Live Webinar | Underestimated Risk & Overestimated Security: When All You Do Is React, it May Be Too Late

The former agent, Monica Elfriede Witt, defected to Iran in 2013, the DOJ says. She also stands accused of revealing the identity of a highly classified U.S intelligence program and an intelligence officer. Witt has been charged in federal court in Washington with three counts of espionage.

Witt's indictment marks another serious security breach by an insider. The U.S. government over the past several years has struggled to contain leaks of classified information.

Iran has a well-developed offensive cyber capability. Private security companies have developed profiles for groups suspected to be connected with Iran and linked them to campaigns that have sought to compromise Western companies and organizations.

In January, the Department of Homeland Security warned of attacks that sought to modify Domain Name System settings and issued an emergency directive warning agencies to check for tampering. The computer security firm FireEye has seen similar attacks, which it said appeared to have an Iranian nexus (see: DHS Issues More Urgent Warning on DNS Hijacking).

Also last month, U.S. Director of National Intelligence Dan Coats warned that Iran, Russia, China and North Korea remained a looming threat to the U.S. government and private companies (see: Intelligence Chiefs Expect More Cyberattacks Against US).

Target Packages

The Justice Department says it took years of investigation to build its case against the 39-year-old Witt. She served in the U.S. Air Force from August 1997 though March 2008 and had clearance for secret and top secret material, including the identity of clandestine agents.

Her path to Iran started after she attended an anti-American conference there in 2012. It was run by the New Horizon Organization, which prosecutors say is connected to the Iranian Revolutionary Guard Corps. That unit is responsible for unconventional warfare, including assassinations and cyberattacks, according to the indictment.

Witt is accused of developing target packages, or background data that would help attackers track people. That could include their location, position and possible vulnerabilities that could be taken advantage of, according to the indictment.

Witt speaks Persian Farsi as the result of her military training, and she also deployed to the Middle East. In early 2012, she appeared in videos broadcast on Iranian media where she criticized the U.S. She also converted to Islam in a ceremony that appeared on Iranian TV.

She apparently returned to the U.S. in mid-2012, where FBI agents warned her that she was a target for recruitment by Iranian agents. Witt allegedly told agents that she wouldn't speak of her Air Force work if she returned to Iran.

Another Edward Snowden?

But Witt allegedly indicated her disenfranchisement with the U.S. during communications with an Iranian-American identified in the indictment as "Individual A."

Prosecutors say that in June 2013, she wrote to that individual, saying "if all else fails, I just may go public with a program and do like Snowden :)" and indicated she possibly might contact WikiLeaks. Edward Snowden was a former National Security Agency contractor who leaked thousands of sensitive documents in 2013 documenting U.S. and British cyber capabilities.

In August 2013, Witt defected to Iran. The Iranian government provided her with housing and computer equipment, prosecutors allege. Witt began conducting searches for U.S. agents on Facebook via fictitious accounts to create the target packages.

DOJ alleges the targeting information was then used by the four Iranian nationals who were also indicted: Mojtaba Masoumpour, Behzad Mesri, Hossein Parvar and Mohamad Paryar. The men have been charged with three counts of computer crime, including hacking.

The four indicted Iranian men (Source: FBI)

Mersi is accused of targeting U.S. agents via a company he ran, as well as contracting with the three other men for technical support for malware.

The attacks often first involved sending friend requests to U.S. agents on Facebook, then sending messages or email with malicious attachments, according to DOJ. Some agents accepted because the accounts appropriated the identities of other agents. Other accounts were fake, including one going by the name "Bella Wood."

An excerpt from an email sent by "Bella Wood" to a U.S. government agent

It's unclear if any of the attempts were successful, but at least one of the messages sent by the group would have immediately raised suspicion. It asked the recipient to disable anti-virus software before opening what was purportedly a photo album.

Cyberwarfare / Nation-state attacks , Fraud Management & Cybercrime , Governance

Sizing Up the Impact of Initiatives to Curb Fake News(gsuparna) • February 14, 2019    

It's far from clear whether Facebook's latest move to curb fake news in India ahead of the upcoming elections by expanding its engagement with third-party fact checkers will have much impact.

See Also: Live Webinar: Building Secure Delivery Pipelines with Docker, Kubernetes, and Trend Micro

Five new partners, including the India Today Group, a leading local media house, have been added to Facebook's fact-checker network in India, taking the total number to seven, Facebook says. The program has been broadened to cover services in more Indian languages.

Last year, the social media giant introduced a third-party fact-checking program in India with BOOM Live to combat the spread of "false news" on its platform with a pilot in Karnataka ahead of elections in that state.

But so far, Facebook has failed to offer any hard numbers on the impact the pilot project has had on reducing the spread of fake news. And Facebook did not respond to my request for comment.

Several security practitioners and cyber law experts tell me they see no evidence that Facebook's efforts to fight fake news in India or other countries have been successful (see: Are Facebook's Election-Related Moves in India Meaningful?).

"They have never openly spoken about the technology deployed by these fact checkers to curb fake news," says cybersecurity expert Sanjay Sahay, a senior police officer in Karnataka. "It is a question of intent. If Facebook being a technology company cannot come out with a proper solution for this menace, then it has no business to stay in this space."

'Take More Responsibility'

The fresh effort by Facebook to fight fake news comes after a pledge by its CEO, Mark Zuckerberg, to "take more responsibility" over content shared on the internet platform.

This followed revelations last March that user data had been leaked to Cambridge Analytica, a research company that did work for U.S. President Donald Trump's campaign in 2016.

According to the Nikkei Asian Review, Facebook's efforts to fight the spread of fake news have stirred controversy in the Philippines, where the government of President Rodrigo Duterte has accused the social media company of partnering with parties critical of his administration.

Facebook is extremely popular in the Asia-Pacific region, as the chart below illustrates.

Number of Facebook users in Asia (Source: Statista)

Brooke Binkowski, former managing editor of Snopes, which Facebook used in 2016 for fact checking in the U.S., says in a blog that fact checking for a social media service that is used by a huge chunk of the world's population is no easy task.

"We were given access to a tool that hooked into our personal Facebook accounts and was accessed that way and it spat out a long list of stories that had been flagged for checks," she writes. "We were free to ignore the list, or mark stories as 'true,' 'false' or 'mixture.' But no matter how many times we marked them 'false,' stories would keep resurfacing with nothing more than a word or two changed. This happened often enough to make it clear that our efforts weren't really helping."

Govindraj Ethiraj, BOOM Live founder, did not reply to my request for a description of how how it zeroes in on fake news items.

Last week, Snopes and the Associated Press said they had ended their fact-checking partnerships with Facebook in the U.S. after concluding the effort was not effective. They say that there was little clarity on how Facebook carried out the entire exercise and zero transparency.

What Can Be Done?

The government of India has proposed to put more responsibility on Facebook, WhatsApp and other social networks to cut down on fake news by asking them to remove objectionable content within 24 hours. But some question whether such a move would curb free speech.

"If fake news or sensitive news leads to deaths in the country, what internet freedom are we talking about?" Sahay asks. "How long can Facebook wash its hands of responsibilities? It [must] not take responsibility of content on its website."

Binkowski stresses that the major social media companies need to invest adequate resources to do a thorough job of fact checking that can have a real impact on curtailing the spread of fake news, especially news about the upcoming election.

Jiten Jain, CEO at the India InfoSec Consortium, a group of leading security experts, contends that Facebook's latest move to work with more fact checkers in India is largely a public relations effort.

"Facebook is not doing a favor by taking these steps. This is part of their responsibility," Jain says. "If they can leverage technology to monitor us every minute, I refuse to believe that they don't have the technology to curb the menace of fake news."

And it's important that Facebook provide tangible evidence that its efforts to crack down on fake news in India is having a real impact.