Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

Facebook Dinner Date Turns Supermarket Robbery

Robbers in Belgium used a fake Facebook profile to kidnap a supermarket manager, steal his keys, and empty the store's safe.

Top 15 Facebook Apps For Business
(click image for larger view)
Slideshow: Top 15 Facebook Apps For Business
Be careful who you trust online. On Thursday, the federal police in Belgium disclosed that earlier this year, thieves used Facebook to set up a robbery that enabled them to steal the contents of a supermarket safe.

According to the related police report, in February, thieves "friended" the Carrefour supermarket's manager on Facebook, using the identity "Katrien Van Loo." One week later, Katrien invited the manager over for dinner.

When the manager showed up at the specified address that evening at 10:30, however, it turned out to be an empty building. Furthermore, two unidentified men overpowered the manager, gagged and blindfolded him, and stole his keys. While one of the robbers remained, the other searched the manager's apartment, where he found keys to the Carrefour supermarket. That robber's face was caught on the apartment building elevator's surveillance camera.

Later that night, said police, a third robber used the keys to access the store and steal the contents of its safe. Police didn't specify how much money had been stolen. That robber also was caught by surveillance cameras, but his or her face wasn't revealed.

Police have asked anyone with information about the case to come forward. They've also released surveillance footage of the two robbers and noted that, unusually, both appear to be left-handed.

One moral of the story is to ensure that virtual trust remains virtual--until proven otherwise. "Never admit unknown people to your circle of trust; you jeopardize your own safety and privacy as well as that of the friends who may be posting on your wall," said Rik Ferguson, director of security research and communications for Trend Micro, in a blog post that publicized the police report. "If you ever decide to meet a stranger, don't repeat this guy's mistakes. Do it first in a public place and do not go alone."

Ferguson also recommends conducting a quick background check on anyone who sends you a friend request, but who you don't recognize. "Do you have any friends in common? If you do not, this should raise a suspicion flag. If you can see any info on the person, do you have anything else such as schools or workplaces in common? Does the profile have a photo and if so is it one that you recognize? If you cannot see any info, mutual friends or photo, it's a definite no-no."

Of course, this isn't the first time that Facebook has been used as a robbery aid. Scores of news stories have reported on thieves trawling Facebook and Twitter for people's schedules and vacations, to better plan their robberies.

Last year, for example, WMUR Channel 9 News reported that police had arrested three suspects, and recovered up to $200,000 in stolen goods, as part of an investigation into 50 home burglaries in Nashua, N.H. Investigators said that the robbers used Facebook and other social networking tools to help ascertain when homeowners weren't going to be home.

Black Hat USA 2011 presents a unique opportunity for members of the security industry to gather and discuss the latest in cutting-edge research. It happens July 30-Aug. 4 in Las Vegas. Find out more and register.

 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Deb Donston-Miller
50%
50%
Deb Donston-Miller,
User Rank: Apprentice
7/29/2011 | 5:13:10 PM
re: Facebook Dinner Date Turns Supermarket Robbery
Another moral of the story: Don't accept a dinner invitation from someone you "met" a week ago on Facebook. But the point is well-taken, especially with regard to letting the people in your network know that you will be away from home or in some other vulnerable position. You may trust everyone in your network, but you never know when your posts will be shared or otherwise exposed in ways you hadn't anticipated.

Deb Donston-Miller
Contributing Editor, The BrainYard
COVID-19: Latest Security News & Commentary
Dark Reading Staff 7/6/2020
Ripple20 Threatens Increasingly Connected Medical Devices
Kelly Sheridan, Staff Editor, Dark Reading,  6/30/2020
DDoS Attacks Jump 542% from Q4 2019 to Q1 2020
Dark Reading Staff 6/30/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
How Cybersecurity Incident Response Programs Work (and Why Some Don't)
This Tech Digest takes a look at the vital role cybersecurity incident response (IR) plays in managing cyber-risk within organizations. Download the Tech Digest today to find out how well-planned IR programs can detect intrusions, contain breaches, and help an organization restore normal operations.
Flash Poll
The Threat from the Internetand What Your Organization Can Do About It
The Threat from the Internetand What Your Organization Can Do About It
This report describes some of the latest attacks and threats emanating from the Internet, as well as advice and tips on how your organization can mitigate those threats before they affect your business. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-5595
PUBLISHED: 2020-07-07
TCP/IP function included in the firmware of Mitsubishi Electric GOT2000 series (CoreOS with version -Y and earlier installed in GT27 Model, GT25 Model, and GT23 Model) contains a buffer overflow vulnerability, which may allow a remote attacker to stop the network functions of the products or execute...
CVE-2020-5596
PUBLISHED: 2020-07-07
TCP/IP function included in the firmware of Mitsubishi Electric GOT2000 series (CoreOS with version -Y and earlier installed in GT27 Model, GT25 Model, and GT23 Model) does not properly manage sessions, which may allow a remote attacker to stop the network functions of the products or execute a mali...
CVE-2020-5597
PUBLISHED: 2020-07-07
TCP/IP function included in the firmware of Mitsubishi Electric GOT2000 series (CoreOS with version -Y and earlier installed in GT27 Model, GT25 Model, and GT23 Model) contains a null pointer dereference vulnerability, which may allow a remote attacker to stop the network functions of the products o...
CVE-2020-5598
PUBLISHED: 2020-07-07
TCP/IP function included in the firmware of Mitsubishi Electric GOT2000 series (CoreOS with version -Y and earlier installed in GT27 Model, GT25 Model, and GT23 Model) contains an improper access control vulnerability, which may which may allow a remote attacker tobypass access restriction and stop ...
CVE-2020-5599
PUBLISHED: 2020-07-07
TCP/IP function included in the firmware of Mitsubishi Electric GOT2000 series (CoreOS with version -Y and earlier installed in GT27 Model, GT25 Model, and GT23 Model) contains an improper neutralization of argument delimiters in a command ('Argument Injection') vulnerability, which may allow a remo...