Note conflict Nigerian Man Charged in Hacking of Los Angeles County Emails

Reading Time: 7 minutes

Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!

Check out the new SourceForge HTML5 internet speed test! No Flash necessary and runs on all devices.
×



Nigerian Man Charged in Hacking of Los Angeles County Emails (theguardian.com)

36






Posted
by

msmash

on Monday December 19, 2016 @01:45PM

from the mere-hacking dept.

A ‘mere’ 10.8% phishing success rate has forced Los Angeles County to notify approximately 756,000 individuals that their personal information may have been compromised. The attack occurred on May 13, 2016 when 1,000 County employees received phishing emails. 108 employees were successfully phished. A Nigerian national has been charged in connection with the hack. From a report on The Guardian: Many large organizations would welcome a 10% success rate in their internal anti-phishing training sessions, with 30% and above being common. The 2016 Verizon DBIR suggests that 30% of all phishing emails are opened. The high number of individuals affected from a relatively low number of successes in LA County demonstrates how dangerous phishing attacks can be. The nature of the potentially compromised information is also concerning. “That information may have included first and last names, dates of birth, Social Security numbers, driver’s license or state identification numbers, payment card information, bank account information, home addresses, phone numbers, and/or medical information, such as Medi-Cal or insurance carrier identification numbers, diagnosis, treatment history, or medical record numbers,” said the County of Los Angeles Chief Executive Office in a statement.

Nigerian Man Charged in Hacking of Los Angeles County Emails

5 Full
20 Abbreviated
11 Hidden
/Sea

Search 36 Comments

Log In/Create an Account

The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.

  • by Oswald McWeany ( 2428506 )

    on Monday December 19, 2016 @01:48PM (#53515393)

    A Nigerian man caught hacking?

    He must be Russian.

      • Re:

        Where do you get your news – 100percentfedup.Com?

        • Re:

          Are you attempting to dispute the facts I provided? Was that an attempt at sarcasm demanding citations, perhaps? Here:

          Popular vote break-down nation-wide [cnn.com]
          Clinton – 65,788,583, Trump – 62,955,363
          Popular vote break-down in California [nytimes.com]
          Clinton – 8,753,788, Trump – 4,483,810.

          Ergo, without California, Trump’s nation-wide deficit of 2,833,220 votes becomes a 1,436,758 surplus. Just as I said.

          Could that Nigerian asshole have had anything to do with Hillary getting so many more votes in CA than in the rest

      • Re:

        California is liberal hippy land, the bluest state in the nation, of course it went overwhelmingly for Clinton. I don’t see you questioning the fact that Trump overwhelmingly won the popular vote in, say, super-red Oklahoma.

      • So did President Muhammadu Buhari of Nigeria have had any reason to prefer Trump? He’s Muslim, so if anything else, he should have wanted to rig the election for Clinton: break into RNC emails and expose attempts by Cruz to steal delegates disproportionate to the votes, making all Republicans wanna vote for Hilary

    • I always considered the “Nigerian Prince” thing to be a complete joke; for the spammers can claim to be anybody from any country such that the Nigerian connection here sounds dodgy.

      What’s next, the butler actually did it?

    • Re:

      If you know of spam filters that are 100% reliable, or even 99%, we’d like to know about them.

      There are vast networks of people around the world who are paid to get around spam filters and try to stay one step ahead of them. The filter companies will usually take at least a couple of hours to identify new spam patterns and set up filtering criteria, and it may take yet longer to propagate the patterns to the customers’ spam catalogs.

  • I bet it was a Nigerian prince they caught.

  • So big hurrah for LA Counties judicial system. I am frustrated however that no entity be it private corporate, or municipality has simply said protection of our information shall come first. This thought that let’s just contract with (insert name provider, likely Microsoft) for an off the shelf solution which clearly isn’t secure is absurd. Now I am also not saying some municipality pay a contractor to custom design a system, we know which way that will go (see link).

    DWP billing system errors add $245 million to uncollected debt
    http://www.latimes.com/local/c… [latimes.com]

    Am I the only one who thinks all ‘secure’ networks should be on a isolated protocol e.g. email be only text with no public network dependent information. user systems with no access to the internet, and no user level login on public devices including your phone.

    The price being paid for the convenience of looking up bread pudding recipes from your work station (or ranting on /. for that matter) is simply too high. Just a thought.

    • Re:

      You’re right – the county should ensure that its employees can make only the most minimal use of the web, and only for the specific purpose of performing their work related duties. Laptops should not be issued and their use prohibited, and the use of personal mobile equipment (including smart phones) should be absolutely banned. Also, all county employees should be required to obtain a Bachelor’s degree in Information Processing within two years of being hired, regardless of their capacity within county g

    • My experience with similar orgs is that the executives want instant connectivity, even when at home or at “important” conferences (cough cough). The executives out-rank most IT security personnel, and thus if they want risky toys/access, they get risky toys/access.

      County government is very rank-sensitive. Logic is secondary to rank. Powerful idiots are dangerous.

  • by Anonymous Coward

    on Monday December 19, 2016 @02:12PM (#53515583)

    My company HR sent notice of required anti-phishing email training.

    – The email came from someone I never heard of.

    – It contained a link to an external website.

    – And the external website required we log in with our domain credentials.

    I ignored the notices for weeks until my boss came to my desk and made me do it. Just unbelievable.

    • Re:

      At a previous employer, HR did some actual benefits mailing from a third party I’d never heard of… a domain with a wacky name like “12monkeys.com”. (That wasn’t the name, I don’t think, but it was something like that.) I think the domain’s whois was even privacy protected. I sounded the “We are being phished!” alarm with IT. HR was kind of put out, but my boss approved of my actions.

      • Re:

        I had similar (and I think 12 monkeys *might* be right…)
        I added the domain to our blacklist within a minute of getting the e-mail. Chaos and hilarity ensued.

        I regret nothing.
        -nB

    • Re:

      I had the opposite happen to me once.

      As the webmaster, I got a vague notice something like, “To whom it may concern, please remove item X from your commerce site. The site in question is not authorized to sell X. Contact us at [phone and email] immediately to resolve this!”

      I dismissed it as spam/phishing because it had no specifics. It was like a form-letter (generic template). It didn’t mention or our site URL nor identify the page and date spotted.

      A few weeks later some angry lawyers called our org and co

    • Re:

      Just wait until someone with a security clearance is contacted by an alleged outside contractor [slashdot.org] doing an “investigation”. The f[censored]ing FBI can’t even keep people from running around with fake badges, claiming to be agents.

    • Re:

      Been there, done that. As you say, just unbelievable.

  • So the Nigerians have progressed from advanced fee fraud to phishing? Well,they must be getting better because it is usually clear to me when an email is sent that is not legitimate. The email is rife with spelling and grammar errors and even word misuse.

  • by bev_tech_rob ( 313485 )

    on Monday December 19, 2016 @03:25PM (#53516085)

    Our company set up our mail system to insert this line into ANY incoming external email. Has helped us a LOT with reducing the impact of phishing emails…along with filtering known phishing domains……

    >>Attention: This email was sent from someone outside of [your company name here]. Always use caution when opening attachments or clicking links from unknown senders or when receiving unexpected emails.

    • Re:

      Not a bad suggestion, thanks.

      We do phishing audits here 2-3 times a year. We always get a click through of between 7 – 25% no matter how much training we do.

      Of course, when we devise our tests, we try to be as sneaky as the bad guys are likely to be while still providing enough tells to make it identifiable as a phishing e-mail.

      Our most recent effort is in mitigation since we are probably never going to get to 0% click through.

      We have been using OpenDNS for a while to help with that. We utilize L7 rules to

.

Leave a Reply

Your email address will not be published. Required fields are marked *