Vulnerabilities / Threats
7/29/2011
12:03 PM
50%
50%

Facebook Dinner Date Turns Supermarket Robbery

Robbers in Belgium used a fake Facebook profile to kidnap a supermarket manager, steal his keys, and empty the store's safe.

Top 15 Facebook Apps For Business
(click image for larger view)
Slideshow: Top 15 Facebook Apps For Business
Be careful who you trust online. On Thursday, the federal police in Belgium disclosed that earlier this year, thieves used Facebook to set up a robbery that enabled them to steal the contents of a supermarket safe.

According to the related police report, in February, thieves "friended" the Carrefour supermarket's manager on Facebook, using the identity "Katrien Van Loo." One week later, Katrien invited the manager over for dinner.

When the manager showed up at the specified address that evening at 10:30, however, it turned out to be an empty building. Furthermore, two unidentified men overpowered the manager, gagged and blindfolded him, and stole his keys. While one of the robbers remained, the other searched the manager's apartment, where he found keys to the Carrefour supermarket. That robber's face was caught on the apartment building elevator's surveillance camera.

Later that night, said police, a third robber used the keys to access the store and steal the contents of its safe. Police didn't specify how much money had been stolen. That robber also was caught by surveillance cameras, but his or her face wasn't revealed.

Police have asked anyone with information about the case to come forward. They've also released surveillance footage of the two robbers and noted that, unusually, both appear to be left-handed.

One moral of the story is to ensure that virtual trust remains virtual--until proven otherwise. "Never admit unknown people to your circle of trust; you jeopardize your own safety and privacy as well as that of the friends who may be posting on your wall," said Rik Ferguson, director of security research and communications for Trend Micro, in a blog post that publicized the police report. "If you ever decide to meet a stranger, don't repeat this guy's mistakes. Do it first in a public place and do not go alone."

Ferguson also recommends conducting a quick background check on anyone who sends you a friend request, but who you don't recognize. "Do you have any friends in common? If you do not, this should raise a suspicion flag. If you can see any info on the person, do you have anything else such as schools or workplaces in common? Does the profile have a photo and if so is it one that you recognize? If you cannot see any info, mutual friends or photo, it's a definite no-no."

Of course, this isn't the first time that Facebook has been used as a robbery aid. Scores of news stories have reported on thieves trawling Facebook and Twitter for people's schedules and vacations, to better plan their robberies.

Last year, for example, WMUR Channel 9 News reported that police had arrested three suspects, and recovered up to $200,000 in stolen goods, as part of an investigation into 50 home burglaries in Nashua, N.H. Investigators said that the robbers used Facebook and other social networking tools to help ascertain when homeowners weren't going to be home.

Black Hat USA 2011 presents a unique opportunity for members of the security industry to gather and discuss the latest in cutting-edge research. It happens July 30-Aug. 4 in Las Vegas. Find out more and register.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Deb Donston-Miller
50%
50%
Deb Donston-Miller,
User Rank: Apprentice
7/29/2011 | 5:13:10 PM
re: Facebook Dinner Date Turns Supermarket Robbery
Another moral of the story: Don't accept a dinner invitation from someone you "met" a week ago on Facebook. But the point is well-taken, especially with regard to letting the people in your network know that you will be away from home or in some other vulnerable position. You may trust everyone in your network, but you never know when your posts will be shared or otherwise exposed in ways you hadn't anticipated.

Deb Donston-Miller
Contributing Editor, The BrainYard
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-2130
Published: 2015-03-05
Cisco Secure Access Control Server (ACS) provides an unintentional administration web interface based on Apache Tomcat, which allows remote authenticated users to modify application files and configuration files, and consequently execute arbitrary code, by leveraging administrative privileges, aka B...

CVE-2014-9688
Published: 2015-03-05
Unspecified vulnerability in the Ninja Forms plugin before 2.8.10 for WordPress has unknown impact and remote attack vectors related to admin users.

CVE-2015-0598
Published: 2015-03-05
The RADIUS implementation in Cisco IOS and IOS XE allows remote attackers to cause a denial of service (device reload) via crafted IPv6 Attributes in Access-Accept packets, aka Bug IDs CSCur84322 and CSCur27693.

CVE-2015-0607
Published: 2015-03-05
The Authentication Proxy feature in Cisco IOS does not properly handle invalid AAA return codes from RADIUS and TACACS+ servers, which allows remote attackers to bypass authentication in opportunistic circumstances via a connection attempt that triggers an invalid code, as demonstrated by a connecti...

CVE-2015-0657
Published: 2015-03-05
Cisco IOS XR allows remote attackers to cause a denial of service (RSVP process reload) via a malformed RSVP packet, aka Bug ID CSCur69192.

Dark Reading Radio
Archived Dark Reading Radio
How can security professionals better engage with their peers, both in person and online? In this Dark Reading Radio show, we will talk to leaders at some of the security industry’s professional organizations about how security pros can get more involved – with their colleagues in the same industry, with their peers in other industries, and with the IT security community as a whole.