Forum Moderators: open
Hackers have discovered a new way of duping users onto fraudulent websites: fake parking tickets. Cars in the US had traffic violation tickets placed on the windscreen, which then directed users to a website.The website claimed to have photos of the alleged parking violation, but then tricks users into downloading a virus.
Vehicles in Grand Forks, North Dakota were the targets for this new type of fraud.
1.) Target needs to think the ticket is real,
2.) And must believe going online is better than checking with the police.
3.) The target needs to have a computer,
4.) With Internet access,
5.) And be fairly comfortable on the Internet,
6.) Yet not be so tech-savvy as to realize the ploy.
7.) Then must be interested enough to check for photos of their vehicle,
8.) And chooses to install a toolbar to see.
9.) Must not have reliable security software,
10.) And is presumably running an unpatched OS.
Those are just what I can think of off the top of my head, yet any link missing from that chain will cause the whole thing to fail.
This seems like a very inefficient way to deliver a payload.
Related, look up the sites venting frustration over lousy or selfish parking.
Maybe this is a variation on these old vents. Everyone hates scammers/spammers, make it out to be one of them. Seems just too localized to be anything else . . . .
They made it at least as far as UK.
I'm with MatthewHSE on his list of requirements, however I think he's underestimated the number of morons on the internet. Most people are internet savvy when it comes to punching a web address, blogging, or saddening your life on Facecrap, but those same users are also idiots. They'll click on 'yes' to anything that pops up.
Add to that the fact they are pissed off they have a ticket, don't believe they should have it and want to see the proof.
These schemes absolutely do work. Just like SPAM email actually works and makes the scammers millions.
If these guys put that absolute genius to good work, I'm sure they could be extremely successful in the advertising world. Hey, if they could get me as many customers as they do through spam then I'd pay em'!
Hats off to them I say, the problem is with simpletons who blindly accept popups, not them.
Hackers have discovered a new way of duping users onto fraudulent websites: fake parking tickets.Cars in the US had traffic violation tickets placed on the windscreen, which then directed users to a website.
The website claimed to have photos of the alleged parking violation, but then tricks users into downloading a virus.
This is sneaky and I'm sure there will be many variations on this theme if it proves to be successful. I'm guessing few computer professionals would fall for this sort of scam, but it may be worth warning family and friends.
Kaled.
I wonder just how many newspapers etc fully check urls before their ads run. And that is just one example.
This parking ticket example is quite worrying.
"Cars in the U.S." and "vehicles in Grand Forks" -- how many cars? 1 car? 5 cars? 500 cars? 5000?
Where were these cars parked? In one particular lot in the city? Or at a bunch of random places around town? Were they indeed parked illegally?
I've not seen a single reference to any actual car owner who found one of these fake tickets on his car. Are there any such people?
Did any of these car owners actually fall for the scam and install the fake toolbar and install the fake anti-virus program?
Did any car owners contact the city or county about their fake parking ticket? Did the city or county have any comments on the scam being perpetrated on its residents?
How did this scam come to the attention of the SANS Institute? Did one of the car owners contact them?
Have these fake parking tickets cropped up anywhere other than Grand Forks?
I have no trouble believing that the malware itself is real. There are specifics a-plenty on that. But I have to wonder if this report might not be a ploy designed to induce panic over a new "attack vector" and get more people to buy someone's anti-virus software, or perhaps an underhanded link-building campaign.
Does anyone have any more specifics on this story? I can find nothing beyond what's in the original report, which is too light on details to be truly believable.
[isc.sans.org...]
The story becomes more believable when real details of actual incidents are available.
So someone gets this totally bogus-looking "flier" accusing them of violating "standard parking regulations" and it directs them to visit a web site with a totally bogus-sounding domain name, and they do that, and they download and install a toolbar, and they're surprised that they got a virus?
None of the components of this scam looked even remotely real or official. This particular scam is only dangerous to people who click anything without thinking.
And there's lots of them about.
In addition, people are naturally curious.
I don't see the point however as it would be exposed far too quickly.
The question is would enough people would fall for a scam of this sort to make the additional expense worth while. My instinct is no, but I could be wrong.
Kaled.
