Fake Invoice Scams, How do They Work?

A quite common scam in the United States has come to Australia this year, already fleecing some unwitting businesses for over half a million dollars.  The scam, listed here on the government's ScamWatch site involves businesses receiving very realistic looking fake invoices from scammers, usually stating a change of bank details and directing payment to a different bank account.  This highlights the importance of taking due care when paying invoices, and having appropriate verification processes in place.

"Scammers hack into vendor and/or supplier email accounts and obtain information such as customer lists, bank details and previous invoices"

The scam has been reported extensively, particularly in non-tech news media, but it was a little light on the detail for me, so I've done some further digging.  The reports I'd seen had referred to the scammers sending very realistic invoices to their targets by 'hacking' the email accounts of suppliers and vendors, others used words like 'intercepted email', but gave no further detail.  On asking the question of a few colleagues, some told me of first hand experience with a version of the scam, dubbed a BEC (Business Email Compromise) scam.  They'd seen the simplest implementation, which involved creating free email accounts to send the fake invoices, and matching the account name as closely as possible to the actual supplier account.  But that's pretty simple, and most businesses would be quite suspicious if email that was coming from accounts@davescatering.com started coming from accounts_davescatering@yahoo.com.  Admittedly, they might not pick it up if the real business was using a free email account in the first place, but although that happens, it doesn't seem to represent enough businesses for this scam to be so successful.

Then I stumbled across this page from the IC3 (Internet Crime Complaint Center), that sheds some more light on the situation.  It details three methods of attack, the first being very much the method described above.  The other two methods are far more serious and actually do involve email accounts being hacked.  In both these cases, accounts (or the PC's of account holders) are compromised and invoices issued from them.  In the cases where the hacked account is a senior company executive, no invoice is sent, rather a request for a funds transfer is made to other staff within the company (who presumably dutifully processes it because the request comes from their boss).

So that confirms that the media reports about 'hacking' weren't the usual poor reporting (like the iCloud 'hacking' scandal).  I assume the reports of 'intercepted emails' were similarly reliable.  It's certainly plausible enough to assume that by using hacked accounts, compromised PC's or servers, hackers could have emails surreptitiously forwarded to another party, or be 'intercepted' from the server.

I was still curious about the method used to compromise these accounts though.  I had assumed they were the the result of some successful phishing expeditions - and some were - but further reading suggested at least some were genuine system compromises, particularly this from the article linked above - "Businesses and personnel using open source e-mail are most targeted".  What does that mean exactly?  Properly secured OSS email shouldn't be more vulnerable than any other system.  But that's where the trail I was following ended.  The internet doesn't seem to have any more information about this, and in particular what the role of Open Source systems would or could be.  Even the venerable Steve Gibson of GRC and Security Now didn't have any idea why OSS would matter in this case, telling me that he couldn't see why OSS would be implicated.

So that just leaves my theories, and the theories I've seen in forums and in comments around the interwebs, which is that some poorly maintained servers running Open Source mail software were compromised, or simply used as an open relay.  Not exactly conclusive, but better than what I started with, and we certainly know of other cases where hackers have taken control of systems and used them to do their bidding.

One final note is that the lack of actual published information on this is a cause for concern.  I should be able to find out how these attacks have occurred and the mechanisms used.  How can we in the IT community protect ourselves and our users against criminal activity if we don't actually know how it's perpetrated?  If anyone has any more information on this, please post it in the comments, I'd appreciate it.

Google Says Google's Stats Show What Google Want Them to Show.

Last week at a digital advertising conference, Google announced that most searches are now coming from mobile devices.  Or at least they are in 10 regional markets, two of which are the US an Japan, the other 8 Google won't identify.  That rather weak headline was picked up by all the major tech news sites, and a number of non-tech outlets.  But it seems a little weak to me.  Google didn't disclose the figures, sources, methodologies for collection or even the other 8 markets they referred to, which are apparently 'key' markets, but that's very much open to interpretation.

Interestingly, it comes on the back of Google trying to force people to make their websites mobile ready, by changing the relevant search algorithms.

So, what's going on here?  Well, my theory is that in short - Google's abusing it's search monopoly.  Trying to force people to make their sites mobile ready sounds really forward-thinking and just acknowledging the way of the world nowadays, and I don't disagree that more searching is happening on mobile.  But with Google being the only major player here, and them telling us what we have to do with our websites, then telling us they have statistics to back it up, just we can't see them.  Well, we've got no choice but to believe what they say, what are we going to do, ask Bing for a second opinion?  Design our sites for desktop and feel safe in the knowledge they'll still be listed at the top of Duck-Duck-Go searches?  We have no choice.

You're probably still wondering how this is abusing a monopoly?  As far as I'm aware it's illegal in a number of countries to use a monopoly position to influence other markets, and it just so happens that Google have virtually no presence in desktop and laptop PC's.  Chromebooks are a thing, but accounted for 1% of worldwide PC sales last year in Q2 (.95 million).  Meanwhile in the same period Android accounted for 250 million units shipped.
So, it's CLEARLY in Google's interest to ensure they push us toward the thinking that most web activity is on mobile platforms, then we design our websites for mobile, then we put more advertising on mobile, then Google make more money.  Because after all, Google sell advertising, that's what they do, and they need you on the platforms they control to make more money from it.  So in this case, Google are using search as a way to drive us further toward mobile and mobile advertising - two non-search markets.

Can we all say "anti-trust investigation"?  I hope not, that was so very painful last time around.

Time for a Change

Well, this blog has gotten stale hasn't it? In the words of this 90's commercial for an alternative Cola nobody wanted, it's time for a change.  This blog was about technology in the education sector, but I'm broadening it to cover science and technology in the everything sector.  Why not?  It's time for a change and the change is me writing about what I'm interested in, so here goes!

UPDATE: - Come to think of it, how about a site redesign?  It's time for a new look as well.  Just a facelift (maybe some botox and collagen, nothing huge). Stay tuned!

Dell, a year later.

Well, after being given bad marks for their Windows 8 model lineup last year, Dell have been back to the drawing board and come up with some options that are more School-friendly.  It's nice to see the fight to take Dell private isn't interfering with the day-to-day business.  Well, at least not right at the moment.

After being given detention last year for the bizarre juxtaposition of the XPS 10 and the Latitude 10, Dell have done their homework and handed in a couple of decent assignments.  Or at least they turned up to class and made it look like they were working, the product looks promising but we haven't been able to assess it properly yet.



Dell have been getting around doing roadshows for their clients again and at the one I attended recently, the sales guys came armed with a couple of new models that piqued my interest.  The first was a new 11 inch touch enabled Netbook available in Intel or AMD (pending confirmation), starting at AUD$500.  The jury was still out at Dell as to whether the machine would actually ship with an AMD (Kabini core) CPU, but the Intel version was confirmed.  It will bear the recently revived Celeron brand, which is just the Bay Trail Atom platform in (poor) disguise.  Having adopted the Clover Trail Atom this year, we can assume this will represent good computing power for the dollars.  That and a touch-screen for that money makes for a decent little device that should run Windows 8 quite competently.  Much better than the previous generations of Netbook, that were too crippled to even run Windows XP Starter Edition, which was one or two generations older than the current Windows OS at the time.  The device itself looks and feels nice too, but that's all I can say at this point.  The example I saw was a piece of wood and plastic, not actually a working example, and some specs such as the SSD/eMMC used were a little hazy, but it's clear that Dell are aiming this at schools, who previously bought up tons of these sorts of machines.  It'll remain to be seen whether those schools can wash the bad taste of old-school Netbooks out of their mouths and put down their fisher-price tablets or cheap-and-cheerful Chromebooks to consider this sort of device.

Dell is also packing a Surface competitor in it's new lineup.  By that I mean, they'll be selling an Intel Core i series tablet with a magnetic keyboard-cover.  Sounds familiar.  The Dell Surface knock-off isn't as pretty as the Microsoft device (I have no pictures to back that up, it wasn't allowed), but it is designed to be more serviceable, including things like a removable battery and some clue how you might open it up.  It does come with an active stylus - also like Surface - which should make those schools that drank the pen based computing Kool-Aid happy.  Pricing was indicated to be competitive with Surface Pro as well, so it looks like there might be a viable enterprise-grade alternative out there soon.

Not bad Dell.  I'd give you an A, but I'll wait until I'm able to mark your work first.  Last year, I went to two of these Dell Roadshow events, and this one had more interesting new gear than the last two put together.  Last year, all they had was the XPS-12, which was fine, but not student-friendly.  Nice to see some improvement.  I await further details and the NDA's to lift.

Surface Pro 2, Better for Schools (maybe)

After the announcement of Microsoft Surface last year, many schools got excited about the prospect of this highly capable device raising the bar for tablets in an education setting.  Then it shipped and the reality was that it was incredibly hard to get hold of, the service arrangements were poor, and the battery didn't have a full school day in it.



Recently though, word has leaked on a new and improved Surface Pro 2 is on the way, which thanks to Intel's new Haswell CPU architecture may promise more than a school day on battery as well as a RAM bump, a better kickstand and even some interesting accessories. There are even rumours of a new type cover that will contain a second battery (because although v2 may sport up to 7 hours battery, that's still not as good as competing Haswell devices).

the device was only available through retail channels, with the usual return-to-base-and-wait-until-the-next-ice-age warranty

Sounds great doesn't it?  It might even be released and available in time for the end of the summer school break... in the U.S!
Of course there's the catch, those of us in countries outside of the U.S. had to wait so long for Surface Pro last time that the tablet was practically obsolete by the time we saw it.  Moreover, the device was only available through retail channels, with the usual return-to-base-and-wait-until-the-next-ice-age warranty, making it even less appealing to education.

So, I guess I'm being pessimistic, but based on previous form, I have to say that while Surface Pro 2 could be the best tablet for schools, possibly the only thing likely to stop it is the company that makes it.  So there's a challenge Microsoft, prove me wrong!

Digital Tourists

Maybe it's slightly off-topic for this blog, but I recently read this great article titled Kids Can't Use Computers... And This Is Why It Should Worry You and I thought I'd add my 2c worth to the debate.  After all, I've spent the last 15 years watching students and teachers use of and attitudes to Computers change.

Some time ago, a very intelligent man called Marc Prensky temporarily abandoned his intellect and coined the term "Digital Natives".  That term has probably been unfairly extrapolated on and taken out of context, but is largely taken to refer to those who were born in a world with computers and the internet and therefore can better use their "native" technological gadgets.  That theory is wrong.  Kids certainly don't have the fear of technology older generations might, but that's about where it ends.  A teacher/techie I know once used the term "Digital Contiki Tourists" which meant, to paraphrase a little -  they were on the tour bus, supposedly getting an appreciation for the actual natives, but all they want to do is hang out the side of the bus and go "wheeeheeyyy", hit the nightclub and go on the rollercoaster.



Firstly though, I have to say although I did enjoy the article linked above, the author crosses the line more than once, slipping into the chest-pounding "I am UberNerd, Hear me Roar" persona.  Which, as he's a Linux fan reminds me again that this slight disconnectedness from reality is a little too common from that corner of the computing world.  In particular, the author opines:

"He asks what he needs to do, and I suggest he reinstalls Windows. He looks at me blankly. He can’t use a computer."

I don't believe the ability to install an operating system is a core skill the average user should need.  Sure, it's handy to know how, but I actually think the need to do this is a result of poor system design in the first place.

"While I was busy deleting my on-line accounts and locking down my machines, my friends called me paranoid and made jokes about tinfoil hats."

This is as a direct reaction to Snowden and PRISM?  Your friends were right, you are paranoid.  You're worried about privacy while happily blogging every second opinion that occurs to you?  Those two things are incompatible.  Also, traditional privacy doesn't exist on the internet, forget about it.

"When they hit eleven, give them a plaintext file with ten-thousand WPA2 keys and tell them that the real one is in there somewhere. See how quickly they discover Python or Bash then."

This is the author suggesting that you tease your own kids using wifi access as bait.  Now that's just being an arse.  How about the kids hide your car keys somewhere in the house and make you search a list of locations to find them.  Not so clever now you're late for work eh?

"Google and Facebook give kids money if they manage to find and exploit security vulnerabilities in their systems. In schools we exclude kids for attempting to hack our systems. Is that right?"

Yes, it is right.  I and every teacher I work with would agree to draw the line at any 'learning' that has the ability to negatively impact everyone else.  <sarcasm>Why don't we teach kids about combustion by giving them a box of matches and a can of petrol and letting them go nuts!</sarcasm>

... But I Digress.

Sorry for staring the article by going off on a somewhat negative tangent.  Despite that, I do agree with the premise of the article.  Modern computing is easy to use, which is a great thing when you need to get work done.  It just has a downside of no longer forcing people to learn as much about using their computing device, which means when things go wrong they feel more confused and affronted than ever before.  So, I've picked out the bits I don't agree with, now let's look at some positives:

Oh… I guess these days you must find that the kids know more about computers than the teachers….

This isn't just a teacher being offended at the suggestion that some hormonally imbalanced adolescents might be able to teach them a thing or two.  They probably could, but most of the time it'd be how to complete a level of Angry Birds.  The fact of the matter is, our little "Digital Natives" save documents and have no idea where they went or what they were called, and that's just the start of it.

The parents seem to have some vague concept that spending hours each evening on Facebook and YouTube will impart, by some sort of cybernetic osmosis, a knowledge of PHP, HTML [etc].

The parents?  How about the teachers, administrators and many involved in designing curriculum for the past decade?  Thankfully we may be out of that period now, but schooling for a while now has operated under the assumption that IT skills didn't need to be formally taught, that it could be 'integrated'.  Which meant teachers who "can't use computers" asked students who "can't use computers" to use computers in a vicious cycle of the blind leading the blind.  It even worked sometimes (because of better teachers, probably), just to muddy the waters.  But generally, it didn't and formal IT of some sort might even make a comeback soon.  Hurray!

Not really knowing how to use a computer is deemed acceptable if you’re twenty-five or over. It’s something that some people are even perversely proud of

I had to highlight this.  It's something I've noticed for a long time now.  It's usually the same person who sounds offended at the mere suggestion that they understand the thing they're using to access Facebook or Instragram.  Those that proudly espouse their ignorance like we should give them a medal for it.  These people that still think a person who can use a computer competently is some sort of 1980's stereotype, something straight out of "Revenge of the Nerds".  People I've known like this tend to extend this attitude to the knowledge of anything else they deem uncool.  These are the people Martin Luther King Jr. was talking about when he said "nothing in the world is more dangerous than sincere ignorance and conscientious stupidity".

Mobile has killed technical competence

Has it?  Mobile technology is still in its infancy and I really don't think it's that mature you can blame it completely.  Certainly a whole community of Android hackers was given life by mobile technology.  I will certainly concede though that the 'point, shoot, upload' mentality has dulled the average user.  This is a disappointing consequence of convenience, more than anything.  The real enemy here might be distraction.  It started with web-based games.  It's just too easy to waste time in class gaming, rather than waste time in class tinkering! ;)

Stop fixing things for your kids

Not a problem for most parents if this article is accurate.  Apparently they couldn't fix much anyway.  They probably know someone who can though, so it's a valid point and I'll certainly by trying this out with my own children when they're old enough.  "I had to fix my own computer sonny, and walk 30 miles through the driving snow in bare feet to get a copy of Asteroids, then another 30 for the joystick, then it took a week to load!".

A hundred years ago, if you were lucky enough to own a car then you probably knew how to fix it

These days, everyone should know how to install and remove software, and everyone should know how to change a tyre.  I get it.  But I 'tyre' (sorry) or the analogy, it's wheely bad (okay, I'll stop now).  Cars are probably the most recent, pervasive new technology that people can think of so they keep trying to liken computers to cars.  The fact of the matter is that computers are almost everywhere, and will be everywhere else eventually.  The need to understand them is greater.  There's a computer in my car, there's not a car in my computer!

So, I think it's evident that there's a problem.  The real question is, are we able to fix the problem, or has it got away from us?  The last decade of rapid technological change and increasing ease of use, against a backdrop of ignorant educational philosophy has probably driven the wedge too far.  I feel like we can stem the tide, but never turn it back.  Not a wholly cheerful way to end, but probably the most realistic way.

Will Acer be the post-PC era's first casualty?

UPDATE: - Acer have refuted the claim below in this official response.  ARN also dismisses the original article, and we've been contacted directly by an Acer BDM with a similar objection  We've received some assurance that Acer will still support education customers (see comments section, below), although to what level and whether it includes all customers in all regions remains unclear (if unsure, you should contact your local Acer person).

According to Channel News, Acer Australia has taken a serious hit from the recent decline in PC sales, and are reacting by scaling back their Australian operations, sacking staff, stopping manufacturing and ending field-service operations after seeing an almost 40% loss in sales.

This puts things in an interesting context for us as a school.  Have we just dodged a bullet?  The Acer w510 was one of a shortlist of devices in contention for our 1:1 computing program.  It only missed out by a narrow margin, but now that I hear quotes like these, some of which were sourced from Acer employees, I think I should be happy the Acer just missed out:

"Acer Australia will cease production of PC's for schools"

"The intent is to wind down all field service operations and move to a return to base warranty model across the board"

This reminds me of another recent disaster that befell a number of Australian schools when Optima went out of business.  While not that same level of disaster, this still doesn't look good for those relying on onsite service contracts.

Of course, Acer will still be able to service their equipment, albeit in a return-to-base manner, but it would seem they now intend to operate more like a Samsung, ASUS or Apple in future.  Leaving the Enterprise hardware supply to the big boys (Lenovo, Dell and HP).  Enterprise wont miss them, but I'm sure some schools and small businesses will.