Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Endpoint

Scammers Fall in Love with Valentine's Day

Online dating profiles and social media accounts add to the rich data sources that allow criminals to tailor attacks.

US-CERT and Cupid don't often keep company, but this Valentine's Day is being marked by new threats to those seeking romance and new warnings from the federal cybersecurity group.

A notice from US-CERT points to an FTC blog post about how consumers can protect themselves from online scams involving dating sites, personal messaging systems, and the promise of romance and companionship from online strangers.

The general warning comes as specific scams are being exposed by online researchers. For example, researchers at Agari Data have followed a Nigeria-based group dubbed "Scarlet Widow" since 2017 as they exploited vulnerable populations, moving from romantic "attacks" against isolated farmers and individuals with disabilities to business email compromises that raised the financial stakes.

Security experts aren't optimistic about finding a quick solution.

"These types of scams will not be disappearing anytime soon," says Anupam Sahai, vice president of product management at Cavirin. "Certain times of the year, Valentine's Day included, bring out both the best and the worst in us. Here, hackers prey on those most vulnerable, especially those who are possibly recovering from a family tragedy without a support network. Given the emotions, it is no surprise that romance scam losses, averaging $2,600 each, are seven times greater than most other frauds."

The primary issue is that these attacks aren't assaults on technology vulnerabilities — they prey on human limitations.

"These kinds of romance scams are very targeted social engineering attacks, effectively 'hacking' the victim's emotions rather than trying to perform a technical assault," says Nathan Wenzler, senior director of cybersecurity at Moss Adams. "Unfortunately, these kinds of attacks are becoming more and more commonplace, not only because of the large financial incentive, but because it has become easier than ever to tailor these scams for each individual victim."

Online dating profiles and social media accounts add to the rich data sources that allow criminals to tailor attacks as they look to exploit individuals in the same way that spear-phishing attacks exploit corporate employees to extract credentials and critical business data.

The FTC provides tips for avoiding victimization that include never sending money to an online romantic contact, taking the relationship slowly, doing an online image search to see whether the photo for the person's account appears with a different name, and discussing the relationship with friends and family members from real life. US-Cert has its own set of tips for staying safe on social media.

"No matter how desirable a person may sound online, everyone must tread with caution," says Chris Morales, head of security analytics at Vectra. "Only trust those you know in person, and even then be cautious. In our connected society, everyone needs to remember a basic rule we were taught as a child, especially with people you can’t even look in the eye: Don't talk to strangers."

Related Content:

 

 

 

Join Dark Reading LIVE for two cybersecurity summits at Interop 2019. Learn from the industry's most knowledgeable IT security experts. Check out the Interop agenda here.

Curtis Franklin Jr. is Senior Editor at Dark Reading. In this role he focuses on product and technology coverage for the publication. In addition he works on audio and video programming for Dark Reading and contributes to activities at Interop ITX, Black Hat, INsecurity, and ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Oldest First  |  Newest First  |  Threaded View
10 Ways to Keep a Rogue RasPi From Wrecking Your Network
Curtis Franklin Jr., Senior Editor at Dark Reading,  7/10/2019
The Security of Cloud Applications
Hillel Solow, CTO and Co-founder, Protego,  7/11/2019
Where Businesses Waste Endpoint Security Budgets
Kelly Sheridan, Staff Editor, Dark Reading,  7/15/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: "Jim, stop pretending you're drowning in tickets."
Current Issue
Building and Managing an IT Security Operations Program
As cyber threats grow, many organizations are building security operations centers (SOCs) to improve their defenses. In this Tech Digest you will learn tips on how to get the most out of a SOC in your organization - and what to do if you can't afford to build one.
Flash Poll
The State of IT Operations and Cybersecurity Operations
The State of IT Operations and Cybersecurity Operations
Your enterprise's cyber risk may depend upon the relationship between the IT team and the security team. Heres some insight on what's working and what isn't in the data center.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-13623
PUBLISHED: 2019-07-17
In NSA Ghidra through 9.0.4, path traversal can occur in RestoreTask.java (from the package ghidra.app.plugin.core.archive) via an archive with an executable file that has an initial ../ in its filename. This allows attackers to overwrite arbitrary files in scenarios where an intermediate analysis r...
CVE-2019-13624
PUBLISHED: 2019-07-17
In ONOS 1.15.0, apps/yang/web/src/main/java/org/onosproject/yang/web/YangWebResource.java mishandles backquote characters within strings that can be used in a shell command.
CVE-2019-13625
PUBLISHED: 2019-07-17
NSA Ghidra before 9.0.1 allows XXE when a project is opened or restored, or a tool is imported, as demonstrated by a project.prp file.
CVE-2019-3571
PUBLISHED: 2019-07-16
An input validation issue affected WhatsApp Desktop versions prior to 0.3.3793 which allows malicious clients to send files to users that would be displayed with a wrong extension.
CVE-2019-6160
PUBLISHED: 2019-07-16
A vulnerability in various versions of Iomega and LenovoEMC NAS products could allow an unauthenticated user to access files on NAS shares via the API.