Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

Facebook Dinner Date Turns Supermarket Robbery

Robbers in Belgium used a fake Facebook profile to kidnap a supermarket manager, steal his keys, and empty the store's safe.

Top 15 Facebook Apps For Business
(click image for larger view)
Slideshow: Top 15 Facebook Apps For Business
Be careful who you trust online. On Thursday, the federal police in Belgium disclosed that earlier this year, thieves used Facebook to set up a robbery that enabled them to steal the contents of a supermarket safe.

According to the related police report, in February, thieves "friended" the Carrefour supermarket's manager on Facebook, using the identity "Katrien Van Loo." One week later, Katrien invited the manager over for dinner.

When the manager showed up at the specified address that evening at 10:30, however, it turned out to be an empty building. Furthermore, two unidentified men overpowered the manager, gagged and blindfolded him, and stole his keys. While one of the robbers remained, the other searched the manager's apartment, where he found keys to the Carrefour supermarket. That robber's face was caught on the apartment building elevator's surveillance camera.

Later that night, said police, a third robber used the keys to access the store and steal the contents of its safe. Police didn't specify how much money had been stolen. That robber also was caught by surveillance cameras, but his or her face wasn't revealed.

Police have asked anyone with information about the case to come forward. They've also released surveillance footage of the two robbers and noted that, unusually, both appear to be left-handed.

One moral of the story is to ensure that virtual trust remains virtual--until proven otherwise. "Never admit unknown people to your circle of trust; you jeopardize your own safety and privacy as well as that of the friends who may be posting on your wall," said Rik Ferguson, director of security research and communications for Trend Micro, in a blog post that publicized the police report. "If you ever decide to meet a stranger, don't repeat this guy's mistakes. Do it first in a public place and do not go alone."

Ferguson also recommends conducting a quick background check on anyone who sends you a friend request, but who you don't recognize. "Do you have any friends in common? If you do not, this should raise a suspicion flag. If you can see any info on the person, do you have anything else such as schools or workplaces in common? Does the profile have a photo and if so is it one that you recognize? If you cannot see any info, mutual friends or photo, it's a definite no-no."

Of course, this isn't the first time that Facebook has been used as a robbery aid. Scores of news stories have reported on thieves trawling Facebook and Twitter for people's schedules and vacations, to better plan their robberies.

Last year, for example, WMUR Channel 9 News reported that police had arrested three suspects, and recovered up to $200,000 in stolen goods, as part of an investigation into 50 home burglaries in Nashua, N.H. Investigators said that the robbers used Facebook and other social networking tools to help ascertain when homeowners weren't going to be home.

Black Hat USA 2011 presents a unique opportunity for members of the security industry to gather and discuss the latest in cutting-edge research. It happens July 30-Aug. 4 in Las Vegas. Find out more and register.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Deb Donston-Miller
50%
50%
Deb Donston-Miller,
User Rank: Apprentice
7/29/2011 | 5:13:10 PM
re: Facebook Dinner Date Turns Supermarket Robbery
Another moral of the story: Don't accept a dinner invitation from someone you "met" a week ago on Facebook. But the point is well-taken, especially with regard to letting the people in your network know that you will be away from home or in some other vulnerable position. You may trust everyone in your network, but you never know when your posts will be shared or otherwise exposed in ways you hadn't anticipated.

Deb Donston-Miller
Contributing Editor, The BrainYard
Navigating Security in the Cloud
Diya Jolly, Chief Product Officer, Okta,  12/4/2019
US Sets $5 Million Bounty For Russian Hacker Behind Zeus Banking Thefts
Jai Vijayan, Contributing Writer,  12/5/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: Our Endpoint Protection system is a little outdated... 
Current Issue
Navigating the Deluge of Security Data
In this Tech Digest, Dark Reading shares the experiences of some top security practitioners as they navigate volumes of security data. We examine some examples of how enterprises can cull this data to find the clues they need.
Flash Poll
Rethinking Enterprise Data Defense
Rethinking Enterprise Data Defense
Frustrated with recurring intrusions and breaches, cybersecurity professionals are questioning some of the industrys conventional wisdom. Heres a look at what theyre thinking about.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-19719
PUBLISHED: 2019-12-11
Tableau Server 10.3 through 2019.4 on Windows and Linux allows XSS via the embeddedAuthRedirect page.
CVE-2019-19720
PUBLISHED: 2019-12-11
Yabasic 2.86.1 has a heap-based buffer overflow in the yylex() function in flex.c via a crafted BASIC source file.
CVE-2019-19707
PUBLISHED: 2019-12-11
On Moxa EDS-G508E, EDS-G512E, and EDS-G516E devices (with firmware through 6.0), denial of service can occur via PROFINET DCE-RPC endpoint discovery packets.
CVE-2019-19708
PUBLISHED: 2019-12-11
The VisualEditor extension through 1.34 for MediaWiki allows XSS via pasted content containing an element with a data-ve-clipboard-key attribute.
CVE-2019-19709
PUBLISHED: 2019-12-11
MediaWiki through 1.33.1 allows attackers to bypass the Title_blacklist protection mechanism by starting with an arbitrary title, establishing a non-resolvable redirect for the associated page, and using redirect=1 in the action API when editing that page.