Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Perimeter

3/17/2015
04:00 PM
Sara Peters
Sara Peters
Slideshows
Connect Directly
Twitter
RSS
E-Mail

The 7 Best Social Engineering Attacks Ever

Seven reminders of why technology alone isn't enough to keep you secure.
7 of 9

Michigan Fleeced By Nigerian Prince Scam

Nigerian frogs like this one don't generally turn into princes when you kiss them, and Nigerian princes who send you emails asking for money don't generally turn out to be princes at all. But that doesn't stop people from falling for the scheme.

What we think of as 'Nigerian Prince' scams aren't anything new. They go back to at least the 16th century, with the character instead being a Spanish prisoner who's actually innocent (and wealthy). 

One of the most embarrassing examples in recent times occurred in 2007. Thomas Katona, the treasurer of Alcona County, Michigan embezzled roughly $1.25 million of the county's $4 million operating budget and paid at least some of it to a scammer. The county had little hope of recovering any of the stolen money. 

Katona was sentenced to nine to 14 years in prison for eight counts of embezzlement, one count of attempted embezzlement, and two counts of forgery. As the state Attorney General said, 'The defendant's actions are unthinkable and indefensible.'

Nigerian prince and '419' scams are definitely not a thing of the past. In 2013, according to recent research, such scams cost victims $12.7 billion worldwide; $82 million in the US alone. As the researchers explain, some of the worst victims of advance fee fraud scams experience something like an addiction, and some experience something akin to the Stockholm syndrome that kidnap victims suffer, defending their scammers, even though they only know them through e-mail communications. 

(Image: 'natal ghost frog,' by dotun55, via Flickr.)

Michigan Fleeced By Nigerian Prince Scam

Nigerian frogs like this one don't generally turn into princes when you kiss them, and Nigerian princes who send you emails asking for money don't generally turn out to be princes at all. But that doesn't stop people from falling for the scheme.

What we think of as "Nigerian Prince" scams aren't anything new. They go back to at least the 16th century, with the character instead being a Spanish prisoner who's actually innocent (and wealthy).

One of the most embarrassing examples in recent times occurred in 2007. Thomas Katona, the treasurer of Alcona County, Michigan embezzled roughly $1.25 million of the county's $4 million operating budget and paid at least some of it to a scammer. The county had little hope of recovering any of the stolen money.

Katona was sentenced to nine to 14 years in prison for eight counts of embezzlement, one count of attempted embezzlement, and two counts of forgery. As the state Attorney General said, "The defendant's actions are unthinkable and indefensible."

Nigerian prince and "419" scams are definitely not a thing of the past. In 2013, according to recent research, such scams cost victims $12.7 billion worldwide; $82 million in the US alone. As the researchers explain, some of the worst victims of advance fee fraud scams experience something like an addiction, and some experience something akin to the Stockholm syndrome that kidnap victims suffer, defending their scammers, even though they only know them through e-mail communications.

(Image: "natal ghost frog," by dotun55, via Flickr.)

7 of 9
Comment  | 
Print  | 
Comments
Newest First  |  Oldest First  |  Threaded View
Page 1 / 2   >   >>
CASVPN
50%
50%
CASVPN,
User Rank: Apprentice
3/22/2019 | 7:36:16 AM
What is Social Engineering really?
I have been reading about the social engineering thing lately, I am getting lots of phishing emails lately and I wonder where I went wrong. May be someone has got a hold of my email. I have become more aware now and I literally check every link before even opening it.
Megan is Always Wright
50%
50%
Megan is Always Wright,
User Rank: Apprentice
10/9/2017 | 11:15:58 AM
Re: What is Social Engineering really?
Social engineering is basically a technique that has long been used by humans even before the birth of the Internet. By using these techniques, the evildoers among us are able to win our trust, or more like fool us into sharing stuff that we shouldn't.

I also didnt understand what it was until i read this article (https://www.purevpn.com/blog/social-engineering-attacks/) which explained what it was and how to protect against it
nickhudson
50%
50%
nickhudson,
User Rank: Apprentice
10/5/2017 | 8:03:33 AM
What is Social Engineering really?
I have been reading about the social engineering thing lately, I am getting lots of phishing emails lately and I wonder where I went wrong. May be someone has got a hold of my email. I have become more aware now and I literally check every link before even opening it.
baller188
100%
0%
baller188,
User Rank: Apprentice
3/14/2017 | 6:00:19 AM
Forex security and vulnerabilities
Great post as always. Technology advances every day, new vulnerabilities arise all the time. Security is everyones main priority and rightly so. For any site owner nowadays you need a dedicated security team to make sure you and your customers are safe. Its a scary world out there.
Sincee
50%
50%
Sincee,
User Rank: Strategist
10/2/2015 | 4:56:47 AM
thank's for post
system security in any country is the future !
MichaelH91401
50%
50%
MichaelH91401,
User Rank: Apprentice
10/1/2015 | 3:18:11 PM
Re: name required
The post refers to "Ferrara" repeatedly, but never describes who he is or what he does. 
AnonymousC493
50%
50%
AnonymousC493,
User Rank: Apprentice
5/9/2015 | 9:41:21 AM
Social Engineering examples
Here's another example:

https://engineering.social/2015/05/02/sinkholing-script-kiddies/

It's not one of 'the best social engineering attacks' ever, but shows that anyone can be a target.

 

 
mithoon
0%
100%
mithoon,
User Rank: Apprentice
3/28/2015 | 2:37:41 AM
Re: name required
great post
delllphi
50%
50%
delllphi,
User Rank: Apprentice
3/24/2015 | 7:21:23 AM
Confidence Man
The name of the "confidence man" was "William Thompson" and not "Samuel Williams". The article "Arrest of the Confidence Man" (New-York Herald, July 8, 1849) can be found online.
xmarksthespot
50%
50%
xmarksthespot,
User Rank: Strategist
3/19/2015 | 4:24:22 AM
Good examples
Great article!  Periodic User awareness training to reduce social engineering is of paramount importance.  Some phishing emails are so good that high trained security people can fall for them.  The examples in the article effectively demonstrate the issue.


The rule I use for my own emails is not click links in emails, including unsubscribe, unless the email is expected, such as one as confirmation during new account setup. Of course, never click on attachments either unless they are expected.  I have within Spyshelter (anti-keylogger) where I can save an attachment, right click the file and on the pop-up menu click 'Spyshelter-> Check it on VirusTotal'; it uploads to virustotal.com .   It's then scanned by over 50 antivirus software products. 

I think this rule is probably the most important security measure I use for computers at my home.
Page 1 / 2   >   >>
News
Inside the Ransomware Campaigns Targeting Exchange Servers
Kelly Sheridan, Staff Editor, Dark Reading,  4/2/2021
Commentary
Beyond MITRE ATT&CK: The Case for a New Cyber Kill Chain
Rik Turner, Principal Analyst, Infrastructure Solutions, Omdia,  3/30/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-29370
PUBLISHED: 2021-04-13
A UXSS was discovered in the Thanos-Soft Cheetah Browser in Android 1.2.0 due to the inadequate filter of the intent scheme. This resulted in Cross-site scripting on the cheetah browser in any website.
CVE-2021-3460
PUBLISHED: 2021-04-13
The Motorola MH702x devices, prior to version 2.0.0.301, do not properly verify the server certificate during communication with the support server which could lead to the communication channel being accessible by an attacker.
CVE-2021-3462
PUBLISHED: 2021-04-13
A privilege escalation vulnerability in Lenovo Power Management Driver for Windows 10, prior to version 1.67.17.54, that could allow unauthorized access to the driver's device object.
CVE-2021-3463
PUBLISHED: 2021-04-13
A null pointer dereference vulnerability in Lenovo Power Management Driver for Windows 10, prior to version 1.67.17.54, that could cause systems to experience a blue screen error.
CVE-2021-3471
PUBLISHED: 2021-04-13
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Notes: none.