Man gets 12 years in jail for running a phishing ring
July 29, 2011
A California resident has been sentenced to more than twelve years in federal prison for his center role in an international phishing and email spamming ring that stole the identities of more than 38,000 people. The investigation ran more than 1 1/2 year before the criminal was arrested. More charges will also be laid against other defendants.
Tien Truong Nguyen, 34, of Long Beach, California, received the 12 1/2 year sentence from U.S. District Judge Morrison England, who called the phisher of men “a one-man wrecking crew when it comes to identity theft.”
According to various court documents, Nguyen and two other suspects used identities stolen from users of PayPal and other financial services to fraudulently obtain merchandise worth about $200,000 from Wal-Mart stores, Target outlets and a few more.
Investigators searching his home found a computer that contained names, dates of birth, and social security numbers for over 38,480 people, prosecutors said.
Investigators also found a Remington 870 Magnum Express shotgun that stood up vertically behind Nguyen's computer stand, some near-by ammunition, and a feed from a complex surveillance system. And with previous convictions for various property crimes and narcotics offenses, Nguyen wasn't even allowed to posses any firearms.
When Nguyen pleaded guilty in 2009, he said his addiction to methamphetamine drove him to live as an identity thief.
In other Internet security news
A few hackers are saying they were successful in compromizing News Corp.'s website about two weeks ago, and they also claim to have extracted an email archive which they plan to release later today.
As a direct result of this, visitors to The Sun's website were redirected towards a fake story on the supposed death of Rupert Murdoch by infamous hacktivist collective LulzSec. The group also redirected visitors of the main News International website to the LulzSec Twitter feed.
But it gets worse-- the hack may have also allowed LulzSec to gain access to News International's email database.
Sabu, a prominent member of LulzSec, said that the group was sitting on emails of News International staffers that it planned to release today.
But in the meantime, Sabu released email login details for former News International chief executive Rebekah Brooks, a central figure in the News of the World voicemail-hacking scandal.
Brooks edited The Sun between 2003 and 2009, and had been using the password 63000 to access her email account at the paper. As IT blogger John Graham-Cumming points out, 63000 is the same number as the text tip-off line used by the Sun.
LulzSec also posted the supposed password hash – but not the password – of Bill Akass, former managing editor of the News of the World.
If this looks like a big mess, it's because it is. The hackers also posted the mobile phone numbers of three News International executives as well. This information seems to have come from an old database. The Telegraph reports that one of the phone numbers belongs to Pete Picton, a former online editor with The Sun who left to work on News Corp's iPad-only publication, The Daily, in late 2010.
Another phone number belongs to Chris Hampartsoumian, an IT worker at News Corp. Hampartsoumian recently announced that he doesn't work for any News Corp company anymore.
LulzSec certainly obtained deep enough access to News International systems during the Monday break-in to pull off a redirection hack on The Sun, but whether it obtained the depth of access it claims to have done still remains unclear at this time.
A News International spokesperson declined to comment when we asked if the organisation was taking the email hack claims seriously or whether it was taking any remedial action.
News Corp said the firm was aware of the website redirection hack on The Sun, adding that all News International websites were now up and running as normal.
But The Guardian reported earlier this morning that News International took its webmail systems and remote access systems offline as a precaution following The Sun website redirection hack.
And passwords were also reset before remote access and other systems were restored this morning, the paper added.
In other Internet security news
Overall infection rates on Vista computers dropped from around 0.11 percent 0.10 percent or even slightly less, for computers running SP2.
As Microsoft points out, Windows 7 PCs have more built-in security protection and are more immune from security attacks than machines running Vista or Windows XP. But this security performance boost is decreasing, possibly as a result in a change of tactics by virus and malware-peddling attackers.
The software giant recorded a massive fourteen-fold rise in Java-based attacks during the third quarter of last year, as miscreants sought to exploit two vulnerabilities prevalent at that time. Those two vulnerabilities (CVE-2008-5353 and CVE-2009-3867) accounted for 85 percent of all Java exploits detected in the second half of 2010.
Operating system exploits, which have declined over recent months, increased significantly in the third quarter of last year, primarily because of exploitation of two Windows security vulnerabilities, Microsoft noted.
The same period also witnessed an enormous increase of 1,200 percent in phishing attacks using social networking as the bait, as social networks become lucrative areas for increased criminal activity as of late.
Overall, phishing attacks using social networking as bait increased from a low of 8.3 percent of all attacks in January 2010 to a high of 84.5 per cent in December of the same year.
Additionally, the Security Intelligence Report also charts a big increase in adware-based attacks as well. Two new strains of adware, JS/Pornpop and Win32/ClickPotato were also major contributors to this increase.
Both strains of virus and malware generate pop-ups on infected computers. In the case of Pornpop, those pop-ups advertise pornographic sites.
Microsoft's 89-page PDF report can be downloaded on its website.
In other Internet security news
Internet security experts say they've discovered numerous security flaws in most of the popular file hosting sites that allow people to gain unauthorized access to data that's supposed to be available only to those selected by the user.
The Internet security experts include Nick Nikiforakis, Steven Van Acker, Wouter Joosen, of the Katholieke Université de Leuven in Belgium, then Marco Balduzzi and Davide Balzarotti of the Institute Eurecom in France.
Those file hosting services, which include sites such as RapidShare, FileFactory and EasyShare, allow users to upload large files and make them available to anyone who knows the unique URI (Uniform Resource Identifier) that's bound to each one.
Internet users can post the link on websites, in emails or on forums available to the public. For example, RapidShare says it can be used to share your data with your friends, colleagues or family.
But according to research academics in Belgium and France, a significant percentage of the 100 FHSs (File Hosting Services) they've studied made it very easy for outsiders to access the files simply by guessing the URLs that are bound to each uploaded file.
Making an already bad situation even worse, they presented more evidence that such Internet attacks, far from being theoretical, are already happening in the wild, and with increased frequency.
The academic researchers said they developed some software and then 'trained' web crawlers on the file services and uncovered hundreds of thousands of private files in just two weeks. They also used the file hosting sites to store private files that contained Internet beacons, so they'd know if anyone opened them. Over a month's span, no less than 80 unique IP addresses accessed the so-called "honey files" 275 times, indicating that the weakness is already being exploited in the wild to harvest data many users believe isn't available for general viewing or utilization.
“These so-called file hosting services adopt a security-through-obscurity mechanism where a user can access the uploaded files only by knowing the correct download URIs,” the researchers wrote in a paper presented at the most recent USENIX Workshop on Large-Scale Exploits and Emergent Threats.
“While these services claim that these URIs are secret and cannot be guessed, our study shows that this is far from being true,” said the researchers.
The security flaws that were the easiest to exploit were found on hosting sites that use sequential identifiers in the download URIs. By writing scripts that enumerate the IDs character by character, their bot crawler was able to locate almost 311,000 unique files over a period of just 30 days. The researchers then ran searches on Microsoft's Bing.com search engine to arrive at an estimate of 168,320 or 54 percent of them, were private files because they hadn't been shared online, at least not yet.
“Unfortunately, the security issues are extremely serious since the list of insecure FHSs using sequential IDs also include some of the most popular names, often highly ranked by Alexa in the list of the top Internet websites,” the researchers wrote.
But in an effort to prevent their findings from being abused, their report didn't say which specific sites are the most vulnerable to various types of attacks.
Another common security flaw involved the use of pseudorandom URIs for each uploaded file. By using brute-force attacks that cycled through every possible known combination, the researchers were able to successfully guess a file's unique ID 1.1 times for every thousand attempts. Part of the weakness is the result of websites that used IDs that consisted of only numeric strings with a maximum length of six numbers. But even when services used IDs with alphanumeric characters or numbers with a length of 8, the researchers achieved similar success at penetration rates.
In other instances, some file hosting services used ID systems with enough complexity that rendered brute-force techniques ineffective or used CAPTCHAs (user-graphic input identifier boxes) or other mitigations.
However, and in many cases, the researchers were often able to guess the names anyway by simply exploiting a directory traversal vulnerability in a commonly-used web hosting program used by most file sharing services.
You can link to the Internet Security web site as much as you like.