
Far too low
So the D'Souzas made around $50 million, and got fined $8.2 million?
That's low enough to be considered operating costs.
Federal authorities will collect $8 million from members of a scareware operation that duped more than a million people into installing bogus security software on their computers. Marc D'Souza and his father, Maurice D'Souza, agreed to pay $8.2 million in “ill-gotten gains” generated by the scam, which pimped software titles …
...some of the legal punishment dealt to these people might involve setting some part of them on fire.
As inappropriately magnetized as my moral compass might be, this kind of scheme makes me incredibly angry at best and sickens me at worst. (Wait until you've seen a senior citizen who thinks they've really screwed up, are very upset or confused as a result and you'll know what I mean.)
Hopefully there will be some decrease in the frequency of this crap showing up. For the last few months, these have been the most common call I get. Still, I'm not holding my breath.
Would you like them driving ahead of you on the motorway? Or just upset and confused citizens, regardless of seniority. No? How curious. Yes, apples and oranges, but there's a point to it, and there's more.
While I agree with your point, I can't be arsed to want to punish for taking advantage of the gullible at all costs. See also: Spanish law requiring a modicum of smarts on the side of the victim before a scam is punishable. This is might well be controversial, even questionable. But there's obviously a practical point to it.
What I'd rather have is not letting easily confused and upset people /all alone/ on teh intarwebz. We have hooked up enough fools and weirdos to keep all that in check, even if anyone wanted to try. If that means supervision and in-person help until experienced enough to face the 'web unfazed, then so be it. Doesn't matter to me whether it's junior or senior citizens, frankly. Especially since the latter is presumably a passing problem; the next generation of oldsters will have more experience with these newfangled things and though by then possibly just as cranky, possibly less easily dazed and frightened by bogus popups.
And its not just senior citizens either! Many people don't get computers all that well, they have other areas of expertise .. and yah some of them are just idiots. Sometimes perfectly competent people are in a hurry and get zapped, it often costs far more in wasted time than "$40 to $60". These a**wipes should have been fined at least 10 times what they were.
Maybe the punishment should include some mobster style 'incentive' to behave. Various appendages could be removed without anesthesia.
I despise people who cause this much stress,wasted time and frustration on a daily basis. Its not just a scam, its also extortion.
</rant>
This punishment is in no way a deterrent, if anything its the opposite. As AC pointed out it sure sounds like a viable business model to me and will likely encourage more of this type of thing. A more appropriate punishment would have been to fine them $1000.00 for each paid installation plus estimated costs for removing the crud from people's machines, with some jail time thrown in for good measure.
How the F*CK do you "settle" a fraud charge. After scamming hundreds of thousands of people out of money there should be jail time, total asset seizure and a good faith effort on behalf of the government to return the money to the people who were deferauded.
Not a fine and a promise to be a good boy from now on.
Jesus christ...
The $8.2 mil is just the D'Souza's share of the restitution.
If you had clicked through the FTC link and read the actual court judgement, you'd have learned:
"IV. MONETARY JUDGMENT
IT IS FURTHER ORDERED that:
A. Judgment in the amount of $163,167,539.95 is entered against Defendant, jointly
and severally with any other defendants found liable in this matter. This
monetary judgment shall become immediately due and payable by Defendant
upon entry of this Order, and interest computed at the rate prescribed under 28
U.S.c. § 1961(a), as amended, shall immediately begin to accrue on the unpaid
balance. "
personally - having seen this 4 times in my own house (2 infections completely inexplicable and not caused by internet newbies but power users) I would make these guys cut their own balls off with a rusty knife and feed them to pigs at gunpoint.
Harsh maybe but this kind of crime causes misery for millions.
Now the problem is which crime i will commit.
Since when has a promise been a punishment!
On a more serious note, who cashed all these checks for the crooks? Are they not complicit? And
Where were the tax authorities when all this money was floating about just to be picked up?
Next time I get persecuted for failing to pay a few pence in tax, can I just promise to try harder next time and settle for 20 per cent.
America's Federal Trade Commission has sued Walmart, claiming it turned a blind eye to fraudsters using its money transfer services to con folks out of "hundreds of millions of dollars."
In a lawsuit [PDF] filed Tuesday, the regulator claimed the superstore giant is "well aware" of telemarketing fraudsters and other scammers convincing victims to part with their hard-earned cash via its services, with the money being funneled to domestic and international crime rings.
Walmart is accused of allowing these fraudulent money transfers to continue, failing to warn people to be on their guard, and failing to adopt policies and train employees on how to prevent these types of hustles.
Cisco has alerted customers to another four vulnerabilities in its products, including a high-severity flaw in its email and web security appliances.
The networking giant has issued a patch for that bug, tracked as CVE-2022-20664. The flaw is present in the web management interface of Cisco's Secure Email and Web Manager and Email Security Appliance in both the virtual and hardware appliances. Some earlier versions of both products, we note, have reached end of life, and so the manufacturer won't release fixes; it instead told customers to migrate to a newer version and dump the old.
This bug received a 7.7 out of 10 CVSS severity score, and Cisco noted that its security team is not aware of any in-the-wild exploitation, so far. That said, given the speed of reverse engineering, that day is likely to come.
In brief Google on Friday pledged to update its location history system so that visits to medical clinics and similarly sensitive places are automatically deleted.
In this post-Roe era of America, there is concern that cops and other law enforcement will demand the web giant hand over information about its users if they are suspected of breaking the law by seeking an abortion.
Google keeps a log of its users whereabouts, via its Location History functionality, and provides some controls to delete all or part of those records, or switch it off. Now, seemingly in response to the above concerns and a certain US Supreme Court decision, we're told Google's going to auto-delete some entries.
Microsoft is extending the Defender brand with a version aimed at families and individuals.
"Defender" has been the company's name of choice for its anti-malware platform for years. Microsoft Defender for individuals, available for Microsoft 365 Personal and Family subscribers, is a cross-platform application, encompassing macOS, iOS, and Android devices and extending "the protection already built into Windows Security beyond your PC."
The system comprises a dashboard showing the status of linked devices as well as alerts and suggestions.
Google has added API security tools and Workspace (formerly G-Suite) admin alerts about potentially risky configuration changes such as super admin passwords resets.
The API capabilities – aptly named "Advanced API Security" – are built on top of Apigee, the API management platform that the web giant bought for $625 million six years ago.
As API data makes up an increasing amount of internet traffic – Cloudflare says more than 50 percent of all of the traffic it processes is API based, and it's growing twice as fast as traditional web traffic – API security becomes more important to enterprises. Malicious actors can use API calls to bypass network security measures and connect directly to backend systems or launch DDoS attacks.
The latest threat security research into operational technology (OT) and industrial systems identified a bunch of issues — 56 to be exact — that criminals could use to launch cyberattacks against critical infrastructure.
But many of them are unfixable, due to insecure protocols and architectural designs. And this highlights a larger security problem with devices that control electric grids and keep clean water flowing through faucets, according to some industrial cybersecurity experts.
"Industrial control systems have these inherent vulnerabilities," Ron Fabela, CTO of OT cybersecurity firm SynSaber told The Register. "That's just the way they were designed. They don't have patches in the traditional sense like, oh, Windows has a vulnerability, apply this KB."
Systems Approach Since publishing our article and video on APIs, I’ve talked with a few people on the API topic, and one aspect that keeps coming up is the importance of security for APIs.
In particular, I hear the term “zero trust” increasingly being applied to APIs, which led to the idea for this post. At the same time, I’ve also noticed what might be called a zero trust backlash, as it becomes apparent that you can’t wave a zero trust wand and instantly solve all your security concerns.
Zero trust has been on my radar for almost a decade, as it was part of the environment that enabled network virtualization to take off. We’ve told that story briefly in our SDN book – the rise of microsegmentation as a widespread use-case was arguably the critical step that took network virtualization from a niche technology to the mainstream.
Updated The latest version of OpenSSL v3, a widely used open-source library for secure networking using the Transport Layer Security (TLS) protocol, contains a memory corruption vulnerability that imperils x64 systems with Intel's Advanced Vector Extensions 512 (AVX512).
OpenSSL 3.0.4 was released on June 21 to address a command-injection vulnerability (CVE-2022-2068) that was not fully addressed with a previous patch (CVE-2022-1292).
But this release itself needs further fixing. OpenSSL 3.0.4 "is susceptible to remote memory corruption which can be triggered trivially by an attacker," according to security researcher Guido Vranken. We're imagining two devices establishing a secure connection between themselves using OpenSSL and this flaw being exploited to run arbitrary malicious code on one of them.
The developer of the AstraLocker ransomware code is reportedly ceasing operations and turning attention to the far simpler art and crime of cryptojacking.
AstraLocker seems to be an offshoot of the Babuk Locker ransomware-as-a-service gang, whose source code was leaked last year. Both were identified in 2021. The developer of AstraLocker posted a ZIP folder containing decryptors for the AstraLocker ransomware via VirusTotal, which Bleeping Computer said are legit.
The decision to shut down, and release an antidote of sorts, comes after ReversingLabs last week detailed the latest version of the ransomware – AstraLocker 2.0 – that had some interesting quirks and amid reports that Emsisoft is working on a universal decryptor for the Windows malware.
If claims hold true, AMD has been targeted by the extortion group RansomHouse, which says it is sitting on a trove of data stolen from the processor designer following an alleged security breach earlier this year.
RansomHouse says it obtained the files from an intrusion into AMD's network on January 5, 2022, and that this isn't material from a previous leak of its intellectual property.
This relatively new crew also says it doesn't breach the security of systems itself, nor develop or use ransomware. Instead, it acts as a "mediator" between attackers and victims to ensure payment is made for purloined data.
Biting the hand that feeds IT © 1998–2022