Vulnerabilities / Threats
7/29/2011
12:03 PM
50%
50%

Facebook Dinner Date Turns Supermarket Robbery

Robbers in Belgium used a fake Facebook profile to kidnap a supermarket manager, steal his keys, and empty the store's safe.

Top 15 Facebook Apps For Business
(click image for larger view)
Slideshow: Top 15 Facebook Apps For Business
Be careful who you trust online. On Thursday, the federal police in Belgium disclosed that earlier this year, thieves used Facebook to set up a robbery that enabled them to steal the contents of a supermarket safe.

According to the related police report, in February, thieves "friended" the Carrefour supermarket's manager on Facebook, using the identity "Katrien Van Loo." One week later, Katrien invited the manager over for dinner.

When the manager showed up at the specified address that evening at 10:30, however, it turned out to be an empty building. Furthermore, two unidentified men overpowered the manager, gagged and blindfolded him, and stole his keys. While one of the robbers remained, the other searched the manager's apartment, where he found keys to the Carrefour supermarket. That robber's face was caught on the apartment building elevator's surveillance camera.

Later that night, said police, a third robber used the keys to access the store and steal the contents of its safe. Police didn't specify how much money had been stolen. That robber also was caught by surveillance cameras, but his or her face wasn't revealed.

Police have asked anyone with information about the case to come forward. They've also released surveillance footage of the two robbers and noted that, unusually, both appear to be left-handed.

One moral of the story is to ensure that virtual trust remains virtual--until proven otherwise. "Never admit unknown people to your circle of trust; you jeopardize your own safety and privacy as well as that of the friends who may be posting on your wall," said Rik Ferguson, director of security research and communications for Trend Micro, in a blog post that publicized the police report. "If you ever decide to meet a stranger, don't repeat this guy's mistakes. Do it first in a public place and do not go alone."

Ferguson also recommends conducting a quick background check on anyone who sends you a friend request, but who you don't recognize. "Do you have any friends in common? If you do not, this should raise a suspicion flag. If you can see any info on the person, do you have anything else such as schools or workplaces in common? Does the profile have a photo and if so is it one that you recognize? If you cannot see any info, mutual friends or photo, it's a definite no-no."

Of course, this isn't the first time that Facebook has been used as a robbery aid. Scores of news stories have reported on thieves trawling Facebook and Twitter for people's schedules and vacations, to better plan their robberies.

Last year, for example, WMUR Channel 9 News reported that police had arrested three suspects, and recovered up to $200,000 in stolen goods, as part of an investigation into 50 home burglaries in Nashua, N.H. Investigators said that the robbers used Facebook and other social networking tools to help ascertain when homeowners weren't going to be home.

Black Hat USA 2011 presents a unique opportunity for members of the security industry to gather and discuss the latest in cutting-edge research. It happens July 30-Aug. 4 in Las Vegas. Find out more and register.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Deb Donston-Miller
50%
50%
Deb Donston-Miller,
User Rank: Apprentice
7/29/2011 | 5:13:10 PM
re: Facebook Dinner Date Turns Supermarket Robbery
Another moral of the story: Don't accept a dinner invitation from someone you "met" a week ago on Facebook. But the point is well-taken, especially with regard to letting the people in your network know that you will be away from home or in some other vulnerable position. You may trust everyone in your network, but you never know when your posts will be shared or otherwise exposed in ways you hadn't anticipated.

Deb Donston-Miller
Contributing Editor, The BrainYard
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading Tech Digest, Dec. 19, 2014
Software-defined networking can be a net plus for security. The key: Work with the network team to implement gradually, test as you go, and take the opportunity to overhaul your security strategy.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-8370
Published: 2015-01-29
VMware Workstation 10.x before 10.0.5, VMware Player 6.x before 6.0.5, VMware Fusion 6.x before 6.0.5, and VMware ESXi 5.0 through 5.5 allow host OS users to gain host OS privileges or cause a denial of service (arbitrary write to a file) by modifying a configuration file.

CVE-2015-0236
Published: 2015-01-29
libvirt before 1.2.12 allow remote authenticated users to obtain the VNC password by using the VIR_DOMAIN_XML_SECURE flag with a crafted (1) snapshot to the virDomainSnapshotGetXMLDesc interface or (2) image to the virDomainSaveImageGetXMLDesc interface.

CVE-2015-1043
Published: 2015-01-29
The Host Guest File System (HGFS) in VMware Workstation 10.x before 10.0.5, VMware Player 6.x before 6.0.5, and VMware Fusion 6.x before 6.0.5 and 7.x before 7.0.1 allows guest OS users to cause a guest OS denial of service via unspecified vectors.

CVE-2015-1044
Published: 2015-01-29
vmware-authd (aka the Authorization process) in VMware Workstation 10.x before 10.0.5, VMware Player 6.x before 6.0.5, and VMware ESXi 5.0 through 5.5 allows attackers to cause a host OS denial of service via unspecified vectors.

CVE-2015-1422
Published: 2015-01-29
Multiple cross-site scripting (XSS) vulnerabilities in Gecko CMS 2.2 and 2.3 allow remote attackers to inject arbitrary web script or HTML via the (1) horder[], (2) jak_catid, (3) jak_content, (4) jak_css, (5) jak_delete_log[], (6) jak_email, (7) jak_extfile, (8) jak_file, (9) jak_hookshow[], (10) j...

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
If you’re a security professional, you’ve probably been asked many questions about the December attack on Sony. On Jan. 21 at 1pm eastern, you can join a special, one-hour Dark Reading Radio discussion devoted to the Sony hack and the issues that may arise from it.