Facebook and Google were the victims of a $100M phishing scam. According to the Justice Department, the crook forged email addresses, invoices, and corporate stamps in order to impersonate a large Asian-based manufacturer with whom the tech firms regularly did business. The point was to trick companies into paying for computer supplies. IT security experts from AlienVault, ESET, Tripwire, Comparitech.com and FireMon commented below.
Javvad Malik, Security Advocate at AlienVault:
“CEO / CFO fraud, is where a CFO being sent a phishing email purporting to be from the CEO demanding they immediately transfer some money to a third party.
The concept of this heist is identical, albeit at a much higher level, with a lot more foundational work being put in place beforehand.
Therefore, it is not unexpected that many of the mitigation strategies would be similar in nature, these would include, better third party identification and verification process, more stringent payment authorisations, and not solely relying on email as an authority to process.”
Mark James, IT Security Specialist at ESET:
“It’s a fact in today’s digital world that there is always someone trying to scam you. We fight it, we delete it, we even highlight it and use it to teach others what to look out for but there is one thing humans are good at and that’s adapting. Most spam or phishing attacks end up a failure, but that’s the nature of these types of attacks they don’t all have to succeed. For us to be safe we have to detect or block 100% of those attempts but they only need to get one right. If someone puts their mind to doing something there is a good chance they will succeed, whether that’s education, business or foul deeds. The good thing about the latter is most of the time people get caught. This particular plan involved forging email addresses, invoices, and corporate stamps in order to trick some big companies into believing they are dealing with the “right” company and handing over thousands, it just goes to prove that all companies large and small can be scammed.”
Paul Norris, Senior Engineer at Tripwire:
“Phishing has long been a valuable technique for cyber criminals because both trained humans and detection software have difficulty identifying a well-crafted phishing email. However, the bigger problem across the board is user awareness. Organizations should implement training programs that help their users understand aspects of spam, phishing, and malware. A little bit of training can go aSecurity Experts long way in this area.”
Lee Munson, Security Researcher at Comparitech:
“Phishing or, more appropriately in this case ‘CEO Fraud’, poses a huge problem to organisations of all sizes.
While technical controls have a small part to play in reducing the likelihood of such an attack being successful, it is staff awareness training that is key here.
That a non-technical business could be attacked in this way is, perhaps, forgivable but the same cannot be said for firms operating in the tech sector.
If the companies behind the $100 million loss are indeed Facebook and Google, it would be a surprise as, even if their teams are not completely alert to this sort of ruse, they should have a security department that can generate awareness around this type of financial fraud.
Thus, while current disclosure laws may not require the victims in this case to come clean about what happened – from a financial point of view – I certainly believe there is a public interest angle.
Investors in technology firms have a right to know that the business is managing its systems and people in an effective way that minimises risks that can have a significant impact – and CEO Fraud is relatively easy to identify and avoid – especially in this case, where the scam was allowed to continue unchecked over a two-year period.”
Paul Calatayud, Chief Technology Officer at FireMon:
“The type of attack both these companies fell pray to did not impact customer data or cooperate intellectual property. Also, this scam prays on finance departments rather then the cyber or engineering “talent”, so any company – no matter how innovative – can become a victim.
The issue at hand is whether or not these types of events warrant disclosure. Given that both these companies have significant amounts of money in the bank and some was recovered, as the law stands, I don’t feel reporting it was necessary. I do feel that we are lacking federal level breach disclosure laws that center around eliminating public vs. private or material vs. immaterial conditions. We need to drive awareness; and these notifications can serve to benefit other companies. Until we do that, we will remain debating in Board rooms whether or not cyber investments are necessary or how likely attacks may be. Like other debates on social forums, many crimes go unreported and this only benefits the criminals by being able to operate in the shadows.”
