{"id":1254,"date":"2018-05-18T11:42:39","date_gmt":"2018-05-18T09:42:39","guid":{"rendered":"https:\/\/www.mcgill.org.za\/stuff\/?p=1254"},"modified":"2018-05-18T12:56:07","modified_gmt":"2018-05-18T10:56:07","slug":"man-in-the-mailbox-fraud-mitmb-howto","status":"publish","type":"post","link":"https:\/\/www.mcgill.org.za\/stuff\/archives\/1254","title":{"rendered":"Man in the mailbox fraud (MITMB) HOWTO"},"content":{"rendered":"

This has come up twice, so it’s time to tell the world how it’s done.\u00a0 Basically, if someone has control of your mailbox (e-mail address and password), then you’re going to lose your money<\/strong>: someone (not you, and not your friend) is going to say to use a different account to receive payment.\u00a0 This control can be by means of a simultaneous login, or by a forwarding rule that sends critical mail away.<\/p>\n

Here’s how to do it:<\/p>\n

    \n
  1. Choose a victim: someone that pays money, or receives money<\/li>\n
  2. Get control of the victim’s e-mail box: send a phishing mail, and wait for the magic click<\/li>\n
  3. Wait for the victim to negotiate a payment<\/li>\n
  4. Send a correction to the payer (“sorry, please use this account instead”)<\/li>\n
  5. Add mailbox filtering rules to ensure that the payer is not in communication with the victim: forward the mail to your own address, or add a filter rule to move it to some other mailbox, like Archive\/2007\/YearEndReporting<\/li>\n
  6. Withdraw money<\/li>\n
  7. Go to jail, go to hell, etc. Bread of deceit is sweet to a man; but afterwards his mouth shall be filled with gravel.<\/li>\n<\/ol>\n
    \"\"<\/a>

    What you think is happening<\/p><\/div>\n

    So vic@VICTIMcorp is buying a crate of frumbles from his supplier SUPPLYCORP, and shipping them to his client CHUMPSHOP.\u00a0 Here’s how it should go:<\/p>\n