StillSecure, After All These Years

Spear Phishing with Better Business Bureau complaints

I received the following email yesterday purporting to be from the BBB. It looked phishy to me, so of course I did not click the link and did a little investigating. However, I could see how someone would be fooled on this one, thinking someone filed a bogus complaint against them. Almost as good as the subpoena story I heard from a customer last week. Beware of stuff like this!

BBB CASE #841246605

Complaint filed by:	Brian Williams
Complaint filed against:	Business Name: StillSecure Contact: Alan Shimel BBB Member: YES
Complaint status:	-
Category:	Contract Issues
Case opened date:	4/20/2008
Case closed date:	-

Download a copy of this complaint so you can print it for your records (DON'T CLICK THIS)

On February 23 2008, the consumer provided the following information: (The consumer indicated he/she DID NOT received any response from the business.)

The form you used to register this complaint is designed to improve public access to the Better Business Bureau of Consumer Protection Consumer Response Center, and is voluntary. Through this form, consumers may electronically register a complaint with the BBB.Under the Paperwork Reduction Act, as amended, an agency may not conduct or sponsor, and a person is not required to respond to, a collection of information unless it displays a currently valid OMB control number. That number is 246-967.

© 2008 US.BBB.org, All Rights Reserved.

More on the Air Defense WAP phishing story

Last week I came down pretty hard on Air Defense (here and here) for phishing WAPs at the InfoSecWorld trade show. Well just to show you that sometimes people make mistakes and if you blog it, you may get it addressed, I wanted to share the following email that I received today. I have redacted out the names to protect the innocent and the guilty.

Alan,

Let me start by first apologizing for any inconvenience I might have caused you or any other vendor at InfoSec World. You can be assured that next time I will collect alarms in the privacy of my own home prior to going to a convention.  I setup a test box during the vendor setup on Monday, this is a tool we use to show some wireless attacks.  After about an hour I shut it off, I was using it to gather some historical data to show in Advance Forensic.  If I recall correctly it did run it for about 5-10 minutes the 2^nd day after the demo crashed and we lost the data I collected on Monday (plug was kicked out).  This was very brief and not intended to be harmful. 

The intent behind using the page with AirDefense was in case anyone who saw the page could at least ask us why it happened and we could apologize and explain that it was just temporary.  JOHN DOE, the gentlemen you spoke with, was not aware of my actions nor was anyone else from AirDefense. I did ask him to point you out so I could apologies and let you know it should no longer be a problem but he didn’t see you.   I unplugged the test box just in case it was still doing something behind the scenes.  Once again I do apologize for any issues I may have caused.  If you have any questions or comments please feel free to call.  Also thanks for making us aware that it may have still been phishing people off their APs.

Thanks,

So to this Air Defense engineer, I take you at your word and apology accepted.  I am glad to hear that Air Defense does not condone this as a legitimate trade show tactic. Go in peace and sin no more ;-)

A new take on the Nigerian bank scam - Kelly's Heroes

I am sure you have all received the usual email story of the bank or government officer from some African country that is looking for help in moving millions of dollars out of the country.  It is sometimes the widow or relative of a disposed leader or some other such thing.  Though I never respond, I frankly enjoy reading the stories and wonder how anyone would be stupid enough to get involved.  Do you really think there are 10 million dollars (american) waiting and these people would be kind enough to give you a 30% or better fee to help them?  If you respond to that stuff, you deserve what you get. 

Today, though I saw for the first time a new wrinkle on this one.  Showing that the bad guys know how to use current events, I call this one Kelly's Heroes, named after the Clint Eastwood movie about a bunch of American GI's taking stolen Nazi gold out of Europe at the end of WWII.  In this scam it is some British soldiers looking to ship out dollars from Iraq.  I publish it here for your amusement:

Hello,

I am Major Ralph Harland, I am a British officer attached to UN peace Keeping force in Iraq, I am the commanding officer of the First Battalion of the Royal Irish Regiment, as you may know everyday, there are several cases of insurgent’s attacks and suicide bombs going on here.

We managed to Move funds belonging to some demised persons who were attacked and killed through insurgent attacks. The total amount is US$9.5 Million dollars in cash. We want to move this money to you, so that you may keep our share for us until when we shall come over to meet you.

We will take 60%, my partner and I. You take 40%. No strings attached, just help us move it out of Iraq, Iraq is a war zone.

We plan on using Diplomatic courier and shipping the money out in two large metallic boxes, using diplomatic immunity. If you are interested I will send you the full details; my aim is to find a good partner that we can trust and assist us can you be trusted?

When you receive this letter, kindly send me an e-mail here  ralpharland@yahoo.co.uk , or majorralpharland@aol.co.uk signifying your interest including your most confidential telephone/fax numbers for quick communication and also your contact details.

This business is 100% risk free.

Respectfully,

Major Ralph Harland

Be careful of notices of filings with the Better Business Bureau

In another example of how devious the bad guys are comes this email we received today:

From: operations@bbb.org [mailto:operations@bbb.org]
Sent: Thursday, February 22, 2007 5:43 AM
To: RB
Subject: BBB Case #263064499 - Complaint for RB

Dear Mr./Mrs. RB

You have received a complaint in regards to your business services. The complaint was filled by Mr. Alexander Vanderbilt on 02/05/2007/
Use the link below to view the complaint details:

DOCUMENTS FOR CASE #263064499

link was: a title="a //ronaldwestinvest.com/redirect/default.htm5c694550626c6fbd4a025e481b172875=5d570bdc5a703bde131cbbdaf2943278&04d964a1f1d1cf5f0842a51d40544328=2d24a338e243c427e8aaae4f19f7be30">ronaldwestinvest.com/redirect/default.htm5c694550626c6fbd4a025e481b172875=5d570bdc5a703bde131cbbdaf2943278&04d964a1f1d1cf5f0842a51d40544328=2d24a338e243c427e8aaae4f19f7be30" href="//ronaldwestinvest.com/redirect/default.htm?5c694550626c6fbd4a025e481b172875=5d570bdc5a703bde131cbbdaf2943278&04d964a1f1d1cf5f0842a51d40544328=2d24a338e243c427e8aaae4f19f7be30">http://ronaldwestinvest.com/redirect/default.htm?5c694550626c6fbd4a025e481b172875=5d570bdc5a703bde131cbbdaf2943278&04d964a1f1d1cf5f0842a51d40544328=2d24a338e243c427e8aaae4f19f7be30"

Complaint Case Number: 263064499
Complaint Made by Consumer Mr. Alexander Vanderbilt
Complaint Registered Against: Latis Networks
Date: 02/05/2007/

Instructions on how to resolve this complaint as well as a copy of the original complaint can be obtained using the link below:

DOCUMENTS FOR CASE #263064499 link removed

Disputes involving consumer products and/or services may be arbitrated. Unless they directly relate to the contract that is the basis of this dispute, the following claims will be considered for arbitration only if all parties agree in writing that the arbitrator may consider them:

·  Claims based on product liability;

·  Claims for personal injuries;

·  Claims that have been resolved by a previous court action, arbitration, or written agreement between the parties.

The decision as to whether your dispute or any part of it can be arbitrated rests solely with the BBB.

The BBB offers its members a binding arbitration service for disputes involving marketplace transactions. Arbitration is a convenient, civilized way to settle disputes quickly and fairly, without the costs associated with other legal options.

When I went to cut and paste it into my blog editor, this hidden text showed up:

'When they find the guy they ought to hang him up by the thumbs,' Bill Norton said. 'Badminton, Ben?'

It was hidden by a font color tag. 

Now of course we recognized it for the phishing it was. However, many a small business I guarantee you, will not and will click on the link, not wanting to have a BBB mark against them.  Of course don't click the links.  These guys are just so devious.