Vulnerabilities / Threats
7/29/2011
12:03 PM
50%
50%

Facebook Dinner Date Turns Supermarket Robbery

Robbers in Belgium used a fake Facebook profile to kidnap a supermarket manager, steal his keys, and empty the store's safe.

Top 15 Facebook Apps For Business
(click image for larger view)
Slideshow: Top 15 Facebook Apps For Business
Be careful who you trust online. On Thursday, the federal police in Belgium disclosed that earlier this year, thieves used Facebook to set up a robbery that enabled them to steal the contents of a supermarket safe.

According to the related police report, in February, thieves "friended" the Carrefour supermarket's manager on Facebook, using the identity "Katrien Van Loo." One week later, Katrien invited the manager over for dinner.

When the manager showed up at the specified address that evening at 10:30, however, it turned out to be an empty building. Furthermore, two unidentified men overpowered the manager, gagged and blindfolded him, and stole his keys. While one of the robbers remained, the other searched the manager's apartment, where he found keys to the Carrefour supermarket. That robber's face was caught on the apartment building elevator's surveillance camera.

Later that night, said police, a third robber used the keys to access the store and steal the contents of its safe. Police didn't specify how much money had been stolen. That robber also was caught by surveillance cameras, but his or her face wasn't revealed.

Police have asked anyone with information about the case to come forward. They've also released surveillance footage of the two robbers and noted that, unusually, both appear to be left-handed.

One moral of the story is to ensure that virtual trust remains virtual--until proven otherwise. "Never admit unknown people to your circle of trust; you jeopardize your own safety and privacy as well as that of the friends who may be posting on your wall," said Rik Ferguson, director of security research and communications for Trend Micro, in a blog post that publicized the police report. "If you ever decide to meet a stranger, don't repeat this guy's mistakes. Do it first in a public place and do not go alone."

Ferguson also recommends conducting a quick background check on anyone who sends you a friend request, but who you don't recognize. "Do you have any friends in common? If you do not, this should raise a suspicion flag. If you can see any info on the person, do you have anything else such as schools or workplaces in common? Does the profile have a photo and if so is it one that you recognize? If you cannot see any info, mutual friends or photo, it's a definite no-no."

Of course, this isn't the first time that Facebook has been used as a robbery aid. Scores of news stories have reported on thieves trawling Facebook and Twitter for people's schedules and vacations, to better plan their robberies.

Last year, for example, WMUR Channel 9 News reported that police had arrested three suspects, and recovered up to $200,000 in stolen goods, as part of an investigation into 50 home burglaries in Nashua, N.H. Investigators said that the robbers used Facebook and other social networking tools to help ascertain when homeowners weren't going to be home.

Black Hat USA 2011 presents a unique opportunity for members of the security industry to gather and discuss the latest in cutting-edge research. It happens July 30-Aug. 4 in Las Vegas. Find out more and register.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Deb Donston-Miller
50%
50%
Deb Donston-Miller,
User Rank: Apprentice
7/29/2011 | 5:13:10 PM
re: Facebook Dinner Date Turns Supermarket Robbery
Another moral of the story: Don't accept a dinner invitation from someone you "met" a week ago on Facebook. But the point is well-taken, especially with regard to letting the people in your network know that you will be away from home or in some other vulnerable position. You may trust everyone in your network, but you never know when your posts will be shared or otherwise exposed in ways you hadn't anticipated.

Deb Donston-Miller
Contributing Editor, The BrainYard
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
DNS Threats: What Every Enterprise Should Know
Domain Name System exploits could put your data at risk. Here's some advice on how to avoid them.
Flash Poll
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-7445
Published: 2015-10-15
The Direct Rendering Manager (DRM) subsystem in the Linux kernel through 4.x mishandles requests for Graphics Execution Manager (GEM) objects, which allows context-dependent attackers to cause a denial of service (memory consumption) via an application that processes graphics data, as demonstrated b...

CVE-2015-4948
Published: 2015-10-15
netstat in IBM AIX 5.3, 6.1, and 7.1 and VIOS 2.2.x, when a fibre channel adapter is used, allows local users to gain privileges via unspecified vectors.

CVE-2015-5660
Published: 2015-10-15
Cross-site request forgery (CSRF) vulnerability in eXtplorer before 2.1.8 allows remote attackers to hijack the authentication of arbitrary users for requests that execute PHP code.

CVE-2015-6003
Published: 2015-10-15
Directory traversal vulnerability in QNAP QTS before 4.1.4 build 0910 and 4.2.x before 4.2.0 RC2 build 0910, when AFP is enabled, allows remote attackers to read or write to arbitrary files by leveraging access to an OS X (1) user or (2) guest account.

CVE-2015-6333
Published: 2015-10-15
Cisco Application Policy Infrastructure Controller (APIC) 1.1j allows local users to gain privileges via vectors involving addition of an SSH key, aka Bug ID CSCuw46076.

Dark Reading Radio
Archived Dark Reading Radio

The cybersecurity profession struggles to retain women (figures range from 10 to 20 percent). It's particularly worrisome for an industry with a rapidly growing number of vacant positions.

So why does the shortage of women continue to be worse in security than in other IT sectors? How can men in infosec be better allies for women; and how can women be better allies for one another? What is the industry doing to fix the problem -- what's working, and what isn't?

Is this really a problem at all? Are the low numbers simply an indication that women do not want to be in cybersecurity, and is it possible that more women will never want to be in cybersecurity? How many women would we need to see in the industry to declare success?

Join Dark Reading senior editor Sara Peters and guests Angela Knox of Cloudmark, Barrett Sellers of Arbor Networks, Regina Wallace-Jones of Facebook, Steve Christey Coley of MITRE, and Chris Roosenraad of M3AAWG on Wednesday, July 13 at 1 p.m. Eastern Time to discuss all this and more.