The Golden Hour of Phishing Attacks

Recent research has been into the attack potency and time-to-infection of email phishing attacks. One of our findings was eye-popping, namely, that 50 per cent of phishing victims’ credentials are harvested by cyber criminals within the first 60 minutes of phishing emails being received. Given that a typical phishing campaign takes at least one hour to be identified by IT security vendors, which doesn’t include the time required to take down the phishing Web site, we have dubbed the first 60 minutes of a phishing site’s existence is the critical ‘golden hour’.

The fact that so many Internet users visit a phishing website within such a short period of time means that blocking a phishing Web site - which is sometimes a cracked legitimate site - within this golden hour has become absolutely critical. During the golden hour, our research suggests that:

• More than 50 per cent of stolen credentials are harvested
• Within five hours, more than 80 per cent are collated and become usable by cybercriminals
• The first 10 hours produce more than 90 per cent of the total credentials that will be stolen by any given phishing site

Therefore, blocking a phishing site after 5-10 hours is almost irrelevant. A more effective model would prevent users from being directed to a phishing site and/or prevent them from entering their credentials if they do end up on a criminal site As an industry, our goal should be to reduce the time it takes for institutions to detect they are being targeted by a phishing attack from hours to within minutes of the first customer attempting to access a rogue phishing page. We also need to establish really quick feeds into browsers and other security tools, so that phishing filters can be updated much more quickly than they are today. This is the only way to swiftly take down phishing websites, protect customers, and eliminate the golden hour.

Read more...

MX Prison Breakout Means 200 More Serious Criminals on Street–Increase in Violence Expected

Close to 200 drug dealers, murderers, and human traffickers broke out of a Nuevo Laredo prison—probably with the help of guards who were bribed or threatened; members of the Zetas were behind the prison break. Intelligence analysts say that the breakout means that we should expect more violence in cities within the Zetas-dominated areas An intelligence analyst says there is a greater chance right now you could become a victim of a carjacking in Mexico. A former drug enforcement agency supervisor said the prison break in Nuevo Laredo is the reason why the threat of carjackings will go up.

“The Zetas were the ones that orchestrated their breakout to increase their number,” says Gary Hale. Hale is a former drug enforcement agency intelligence supervisor in the Houston field office. He now runs his own intelligence firm. He says the prison breakout means more violence against people traveling to Mexico.

Hale and his team built a map to show the four cities in Mexico that are fifty miles from the border where Zetas have recently carjacked people. He says it could happen in every Mexican state that borders the United States. The Zetas operate in all of them. Hale analyzed the Zetas in a new report he released this past weekend. He says the Zetas are expanding in Mexico. They are now in Sonora, across the border from Arizona. He says the Mexican government is still arresting Zeta operatives. Last week, a Zeta recruiter trying to enlist teenagers was arrested in Monterrey.

Read more...

Net closes on the smiling jihadi

DENSUS 88, the Indonesian counter-terrorism police, used every day of the four months available to substantiate its charges against Abu Bakar Bashir before delivering him with its brief of evidence to the South Jakarta prosecutors on Monday. The prosecutors have 60 days to finalise an indictment against the 72-year-old cleric who, if convicted, could be sentenced to death, though that penalty is highly unlikely to be imposed. The Attorney-General's Office, however, wants Bashir in the dock as early as possible in the new year. The quicker the better, says South Jakarta chief prosecutor Mohammed Yusuf. Nor are the authorities waiting until the trial to argue their case that Bashir was not just a religious inspiration and fundraiser for the Aceh militant training camp that was dismantled by Densus 88 in February, but the actual leader of the so-called al-Qa'ida in Aceh.

"In November 2009, Abu Tholud, with Dulmatin, Abdullah Sonata, Ubaid and Warsito agreed to increase the training in Aceh to military level and [to form] al-Qa'ida Serambi Mekah," National Police spokesman Iskandar Hasan told reporters yesterday morning. "At this meeting they agreed that the amir [leader] was Abu Bakar Bashir. We have stated this all in his investigation report which we submitted to the prosecutors' office." Abu Tholut, the alleged camp training co-ordinator and a Bashir acolyte, was, until his arrest on Friday morning, the only one of the senior Aceh plotters still at large. Dulmatin was killed in a Densus 88 ambush in March. The rest are in prison, at least two of them already on trial. Immediately after yesterday's press conference, Indonesian television showed live coverage of 48-year-old Abu Tholut being brought to Jakarta under heavy security. The message from the authorities was clear: we have Abu Tholut and that proves Bashir's complicity.

Unlike Dulmatin, the preacher cannot deny knowing him. They met when both were in Cipinang prison in 2004, Abu Tholut taught at Bashir's religious boarding school near Solo, al-Mukmin, and later joined the cleric's above-ground and purportedly anti-violence organisation, Jamaah Ansharut Tauhid. As previously in the case of the executed Bali bomber Mukhlas, Bashir's former student, the softly-spoken cleric denies knowing anything about Abu Tholut's alleged terrorist activities. The younger man left JAT over "ideological differences", he said on Monday, adding approvingly: "Tholut is a holy warrior." On the day of Dulmatin's funeral, he said: "Dulmatin was a mujahed, even if I don't agree with his struggle and use of violence in the country in times of peace."

Of the Aceh training camp, his lawyer Luthfie Hakim said a fortnight ago the preacher denied any association with or knowledge of terrorist activities. But once again: "According to ustad [teacher] Abu Bakar Bashir, what happened in Aceh is in line with what Islam teaches and is not a crime, not a terrorist act." Bashir has already been tried for involvement in three of Indonesia's worst terrorist outrages of the past decade. He was found not guilty twice and convicted once, but acquitted on appeal. In previous trials he has been able to remain mostly silent while his lawyers have exploited serious flaws and weaknesses in the prosecution's cases. He is a sinuous quarry. The authorities' painstaking diligence before and since his August 9 arrest -- and now the prosecutorial urgency and public theatre -- underscores that for the Indonesian justice system's credibility, this will be the most important terrorism trial since at least December 2006.

Read more...

Sweden suicide bomber: Taimur Abdulwahab al-Abdaly was living in Britain

Taimur Abdulwahab al-Abdaly tried to set off a car bomb packed with gas canisters in a busy shopping street in Stockholm. The car caught fire and the bomber fled the scene before blowing himself up 300yd away 15 minutes later, injuring two bystanders. It emerged last night that Abdulwahab, who was due to turn 29 yesterday, is a former physical therapy student at Bedfordshire University in Luton, and that his wife and three young children still live in the town. MI5 is now investigating possible links with extremists in Luton, whether the bomber was radicalised at the university and claims that he was helped by an extremist group in Yemen, the base for al-Qaeda in the Arabian Peninsula.

The suicide bombing follows an attempt by Umar Farouq Abdulmutallab, a former student at University College London, to blow himself up last Christmas on a flight to Detroit. Abdulmutallab had trained in Yemen, but had become increasingly radical during his time in Britain. The security services and police are concerned that British university campuses have become breeding grounds for extremism. Neighbours told The Daily Telegraph last night that they had last seen Abdulwahab at the 1930s semi-detached house in Luton, Beds, two and a half weeks ago. The couple have two young girls and a baby son. His wife, Mona, a Swedish citizen, is said to run a home beauty company.

Reports from Sweden said Abdulwahab was shouting in Arabic and carrying six pipebombs, one of which exploded, along with a rucksack full of nails and explosives. A paramedic said the bomber had no injuries to the face or body in general but looked as if he had been carrying something that exploded in his stomach. One witness said the bomber had worked as a sandwich board advertiser in the Drottninggatan shopping area. Carl Bildt, the Swedish foreign minister, said it was “a most worrying attempt at a terrorist attack”, adding that it “failed – but could have been truly catastrophic”. Theresa May, the Home Secretary, said: “The Swedish government have indicated they believe this was a terrorist attack. We will be talking to them about the details of that attack.”

Read more...

Drug barons arrested and narcotics rings smashed in NSW raids

Drug raids have smashed major narcotics networks and led to the arrests of some of the nation's biggest drug barons, NSW police say. “Today we haven't taken a tentacle off the beast, we've removed a very, very big beast,” NSW Police Commissioner Andrew Scipione told reporters. “We further allege that among those that are in custody right now are a number of major players in the Australian drugs trade, names that you will instantly recognise.” Detectives launched what was claimed to be one of the state's biggest drugs busts at first light today, with 500 cops raiding 37 premises across Sydney, on the NSW Central Coast and in Mudgee. They arrested 28 men and one woman in NSW and two people in Western Australia.

Police said they had seized 16.7kg of drugs, believed to be cocaine, 5848 tabs of LSD, 30 cannabis plants, 29kg of precursor chemicals, four firearms and 600 rounds of ammunition. The drugs have an estimated street value of $9 million. Assets worth $14 million, including aircraft, luxury cars and mansions are being examined and may also be seized. But it is the taking down of alleged drugs barons that police say is the most significant outcome. “We'll be alleging ... this is the top of the tree,” Assistant Commissioner Dave Hudson told reporters. There were measures in place to try and ensure those arrested were not simply replaced by other drug dealers, he said.

Mr Scipione said alleged criminals he started hunting 30 years ago were among those arrested. “A number of the people who were arrested today were people I started working on 30 years ago when I started working in the police force,” he said. “These people have been around a long time. These people are before the courts today, they will be well known to many of you.” The operation which led to the arrests, Strike Force Domino, began a year ago. It was so extensive it required NSW Police Minister Michael Daley to authorise a one-off , $1.7 million grant to fund it.

Read more...