International Journal of Network Security & Its Applications (IJNSA), Vol.5, No.4, July 2013
DOI : 10.5121/ijnsa.2013.5402 23
Marc A. Rader1 and Syed (Shawon) M. Rahman2, *
1CapellaUniversity, Minneapolis, MN, USA and Associate Faculty, Cochise CollegeAZ, USA
Mrader3@CapellaUniversity.edu
Associate Professor of Computer Science at the University of Hawaii-Hilo, Hawaii,
USA and Part-time Faculty at Capella University, Minneapolis, USA
*SRahman@hawaii.edu
ABSTRACT
Organizations invest heavily in technical controls for their Information Assurance (IA) infrastructure.
These technical controls mitigate and reduce the risk of damage caused by outsider attacks. Most
organizations rely on training to mitigate and reduce risk of non-technical attacks such as social
engineering. Organizations lump IA training into small modules that personnel typically rush through
because the training programs lack enough depth and creativity to keep a trainee engaged. The key to
retaining knowledge is making the information memorable. This paper describes common and emerging
attack vectors and how to lower and mitigate the associated risks.
KEY WORDS
Security Risks, Phishing, Social Engineering, Cross Site Scripting, Emerging Attack Vectors, DNS poising.
1. INTRODUCTION
Phishing is a social engineering technique that is used to bypass technical controls implemented
to mitigate security risks in information systems. People are the weakest link in any security
program. Phishing capitalizes on this weakness and exploits human nature in order to gain access
to a system or to defraud a person of their assets.
1. Has your son asked you to change ISPs? Most American families use trusted and responsible Internet Service Providers, such as AOL. These providers have a strict "No Hacking" policy, and take careful measures to ensure that your internet experience is enjoyable, educational and above all legal. If your child is becoming a hacker, one of his first steps will be to request a change.....
A former member of the hacker gang Kryogeniks was sentenced to four months in prison Monday for his role in a 2008 stunt that replaced Comcast’s homepage with a shout-out to other hackers.
James Robert Black Jr., 21,was known as “Defiant” when he and two other hackers hijacked Comcast’s domain name in May of 2008 — a prank that took down the cable giant’s homepage and webmail service for more than five hours, and allegedly cost the company over $128,000.
Visitors to Comcast.net had been redirected to a simple page reading “KRYOGENIKS EBK and DEFIANT RoXed COMCAST sHouTz To VIRUS Warlock elul21 coll1er seven.”
“Mr. Black and his Kryogenicks crew created risks to all of these millions of e-mail customers for the simple sake of boosting their own childish egos,” Assistant United States Attorney Kathryn Warma told the court, according to a press release. “The callous disregard of the dangers posed to others, as well as the arrogance and recklessness displayed by these, and other hackers in committing such crimes should be considered by the Court as a factor that weighs in favor of a significant prison sentence.”
10/18/12 Update: 2006 posting at forum - where Russell Handorf still contributes using his "grey hat hacker" handle "satanklawz" - suggests he has been working for FBI three years earlier than his resume claims; Adrian Lamo admits being "friends" with Handorf but still won't answer any real questions; Chet Uber offers to have Lamo "interview" me - Neal Rauhauser, who claims he has nothing to.....
No PII involved in this one, but since many may remember the case, I thought I’d post the follow-up. James Robert Black, Jr., a.k.a. “Defiant,” was sentenced yesterday in U.S. District Court in Tacoma to four months in prison, four months of electronic home monitoring, 150 hours of community service, three years of supervised release and $128,557 in restitution for conspiring to damage a protected.....
All Passwords Are Case Sensitive. Prog Name Password Acid Burn PiXY RuLEz You! Adidas toolz poiuyt Afterlife Eraser is GoD Agent Orange I Crap On Lamers America Off Line maxuck or ivan is a fairy Anti Mass Mailer bud is blah AoBliss Tosser Welcome to the wonderful world of Bliss AOExtacy BoW 2 MaTT AOExtacy Phisher Matt is king AOFuck 1."PiXY RuLEZ!" 2."WaNG DanG".....
Company Sues Spammers in Series of Lawsuits Spurred by Member-Reported Junk Email
AOL Alleges Defendants Named in Lawsuits Are Responsible for Sending AOL Members One Billion Spam Emails, Resulting in Over 8 Million Member Spam Complaints
Dulles, VA – April 15, 2003 – America Online, Inc. (NYSE: AOL), as part of its ongoing, comprehensive battle against spammers, today announced a sweeping series of lawsuits against individuals and companies that it alleges have repeatedly sent members high volumes of unwanted junk emails using a variety of evasive means to circumvent AOL’s spam filters.
AOL is filing five separate lawsuits against over a dozen companies and individuals, who the Company alleges are together responsible for sending an estimated one billion spam emails to AOL members and generating over 8 million individual spam complaints from members. The latest lawsuits filed by AOL are the first to leverage the complaints received by AOL from its members who are using the popular “Report Spam” button in AOL 8.0.
The defendants named in these lawsuits are alleged to have sent a variety of offensive and unwanted spam emails including: pornography; male organ growth/enlargement products; mortgage and home refinancing offers; college degrees; steroids; cable TV descrambler products; and software products. The kinds of spammers and the type of spamming named in these lawsuits are exactly representative of what AOL members face on a daily basis.
The methods alleged to have been used by the named defendants in these cases to send spam to AOL members include many of the egregious and fraudulent methods used today by spammers, such as: falsification of email addresses; purposefully and systematically evading spam filters set up by AOL and its members; and pursuing other means of spamming members that are prohibited by AOL’s published “Unsolicited Bulk Email Policy” (see www.aol.com).
Because AOL’s proprietary email network is located in Virginia, these lawsuits were filed in the U.S. District Court for the Eastern District of Virginia in Alexandria.
Borg Created by Gregory Magarshak TO:Greg Magarshak P.O.Box 350-592 Brooklyn, NY 11235 Please send me the newest BorG. I have enclosed three dollars. My email address is: ____________@____________ [] I would like to receive more programs from you! [] No thanks. I can always visit your website at http://members.aol.com/interMage My access code is: 1919 Thanks. I'll be waiting!
**>> FEDERATION GREETER'S GUIDE 96.09.30 TOS SECTION HOW TO DEAL WITH TOS PROBLEMS It's a sad fact that part of your job is to act as a Fed Cop and stop people from offending against TOS or the Federation Policy. Greeters are the first line of action when someone starts misbehaving, and, except in very serious cases or when you are very busy, generally Hosts won't intervene until you ask them to bump or lock someone. Please do not be afraid to pass a problem player to a Host to deal with. If you give someone a TOS warning, and they ignore it, there's usually not much point giving them another warning - they need to be bumped out of the game as a wake-up call, or locked out completely.