Thursday, January 24, 2002

Risks of bouncing e-mail The Strasbourg newspaper "Dernières Nouvelles d'Alsace" reports (in French) an interesting case of e-mail forgery. The exact circumstances are not yet clear, but it appears that: - An e-mail was sent from the account of the mayor, telling members of a city commission to vote in favour of a plan to extend a local hypermarket. The official, public policy of the city council and the mayor is to oppose this extension. - The mail to one member of the commission bounced, because the recipient's name was incorrectly spelled. - An assistant to mayor Fabienne Keller, who has access to her mailbox, noticed the "undeliverable" reply and determined that the mail had been sent at a time when the mayor could not have sent it. - The general manager of the hypermarket is under police investigation for illegal entry into a computer system, forgery, use of forged documents, and attempted fraud. Original texts in French for those interested: http://www.dna.fr/cgi/dna/motk/idxlist_light?a=art&aaaammjj=200201&num=18041610&m1=keller&m2=mairie&m3= http://www.dna.fr/cgi/dna/motk/idxlist_light?a=art&aaaammjj=200201&num=19049 910&m1=keller&m2=mairie&m3= I suppose the RISK is that if you're going to pretend to be someone else, make sure you can spell ! Nick Brown, Strasbourg, France [BROWN Nick via risks-digest Volume 21, Issue 89] 0:00 # G!

Brisbane ISP in court The following is the entirety of a story printed in *Australian Financial Review* 21 Jan 2002, attributed to Australian Associated Press: "Dataline in court" "The ACCC has begun legal action against Brisbane-based Internet provider Dataline.net.au, its managing director, Mr John Russell, and associated companies Australis Internet and World Publishing Systems. Dataline allegedly intercepted e-mails and debited consumers' credit cards without authority." ACCC stands for Australian Competition and Consumer Commission, or in tabloid-ese "The consumer watchdog". Other contributors to RISKS have mentioned packet sniffing and electronic "dumpster diving" to extract credit-card numbers. This looks to be much simpler. If the ACCC is correct, this seems a good reason to become an ISP. Is this a new risk? Probably not. The full and more worrying set of allegations is at ACCC's Web site: http://www.accc.gov.au/media/mediar.htm then click on 18 January 2002 ACCC Takes Action Against Internet Service Provider Peter Deighan [Peter Deighan via risks-digest Volume 21, Issue 89] 0:00 # G!