Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Malware scam appears to use GPS data to catch speeding Pennsylvania drivers

theverge.com

Post reply on HN
Print view View original

21–28 of 28 posts

Re: Malware scam appears to use GPS data to catch speeding Pennsylvania drivers

#21

Post by mattjwarren »

jcrawfordor wrote: post #12

I'm fairly skeptical of these stories, for the simple reason that this seems like far too much effort to go to just to deliver malware. If the scammer were trying to get people to pay the fines, that would make a lot more sense - it'd be over $100 a mark. But commodity malware infections are worth maybe a few dollars per host. Not much to use your clever multi-platform location-collecting scam on. If these stories ar…

They say these events are very localised atvthe moment. Maybe they are targeting/fishing for someone in particular?

Re: Malware scam appears to use GPS data to catch speeding Pennsylvania drivers

#22

Post by tobyhinloopen »

flashman wrote: post #5

This seems like a huge amount of effort to get malware onto a computer. While it seems technically plausible, the steps involved (getting a compromised app onto devices, harvesting contact and location data, waiting for a subset of the infected population to speed, then delivering more malware to them via email) makes me rather dubious.

This is exactly why you wouldn't suspect it to be malware. :)

Re: Malware scam appears to use GPS data to catch speeding Pennsylvania drivers

#23

Post by anotheryou »

jcrawfordor wrote: post #12

I'm fairly skeptical of these stories, for the simple reason that this seems like far too much effort to go to just to deliver malware. If the scammer were trying to get people to pay the fines, that would make a lot more sense - it'd be over $100 a mark. But commodity malware infections are worth maybe a few dollars per host. Not much to use your clever multi-platform location-collecting scam on. If these stories ar…

You'd get an infected phone and a linked infected Computer. This can bypass 2-factor authentication (e.g. for Banking with TAN by sms)

Re: Malware scam appears to use GPS data to catch speeding Pennsylvania drivers

#24

Post by saasyguy »

nkurz wrote: post #3

Here's a slightly earlier article about this: http://www.phillymag.com/news/2016/03/25/speeding-ticket-sca... Nothing in either story explains why the victims would be geographically clustered in Pennsylvania. But if the scam was prevalent elsewhere, I'd think we'd be hearing more people saying "I got one too!". I wonder if there's some other angle than a shared smartphone app explains the locality better: a disgrunt…

A local business or gov't entity got breached, possibly an insider, and due to living there now or in the past has local knowledge of popular roads that 80% of their targets would be familiar with. Or if they didn't live there it'd be pretty easy to use public records to see where traffic tickets are given out most, where traffic cams are installed, etc.

Re: Malware scam appears to use GPS data to catch speeding Pennsylvania drivers

#26

Post by wojt_eu »

mschuster91 wrote: post #20

Shit if I'd done this, I'd just have attached a faked ticket with a working bank account. Or a dead drop for people to send cheques to. No need for malware, that doesn't pay as much as a 10$ speeding ticket.

I expect you'd be easily traced by this account number and then face charges of producing counterfeit official documents.

Re: Malware scam appears to use GPS data to catch speeding Pennsylvania drivers

#27

Post by everly »

Aelinsaar wrote: post #25

Maybe the GPS is just used to extract location info about routes taken? Then you just look up the speed limit, and make up a plausible number, no need to actually track their speed. Think like a con man, not a programmer.

Good point, and to further your idea, even the GPS isn't necessarily required for this scam. If you've obtained a table with everyone in the city's home address along with every street name and speed limit in the city, then you could phish using streets that a person is guaranteed to use when going to and from their home. Using reasonably moderate speeding estimates it seems like a lot of people would assume it's accurate data.

The article didn't make it clear how specific the alleged GPS data is (just says "accurate local township road removed), so I'm skeptical of how likely it is that GPS malware is actually being used here.

Re: Malware scam appears to use GPS data to catch speeding Pennsylvania drivers

#28

Post by supremeanger »

wojt_eu wrote: post #26
mschuster91 wrote: post #20

Shit if I'd done this, I'd just have attached a faked ticket with a working bank account. Or a dead drop for people to send cheques to. No need for malware, that doesn't pay as much as a 10$ speeding ticket.

I expect you'd be easily traced by this account number and then face charges of producing counterfeit official documents.

You would think that but plenty of these scams run for ages without getting the accounts shut down.
Post reply on HN