- 10 open source companies to watch
- Mythbuster busts his own tale
- $208 million petascale computer gets green light
- Sony recalls 73,000 Vaio laptops
- Chrome and Firefox and add-ons
Newsletters | Podcasts | Chats | Opinions | RSS Feeds | This Week In Print | IT Careers | Community | Reports | Downloads | Slideshows | New Data Center
Partner Sites:App Performance | On Demand Security | Networking Solution | SOA | Value of WDS
Salesforce.com is warning customers that they may be the targets of malicious software or phishing scams, after one of its employees was tricked into divulging a corporate password.
In a note to customers, Salesforce said that online criminals have been sending customers fake invoices and, starting just a few days ago, viruses and key logging software. The e-mails were sent using information that was illegally obtained from Salesforce.com.
Salesforce.com bills its Web-based CRM (customer relationship management) products as easier to use and maintain than traditional CRM software, but this latest development underlines the security risks that come with this more open model.
The problems began a few months ago, when a Salesforce.com employee fell for a phishing scam and divulged a company password that gave attackers access to a customer contact list. With this password, the criminals were able to obtain first and last names, company names, e-mail addresses and telephone numbers of Salesforce.com customers.
"As a result of this, a small number of our customers began receiving bogus e-mails that looked like Salesforce.com invoices," Salesforce.com said.
Some of those customers then fell victim to the scam and gave up their passwords to the criminals, too. When Salesforce.com started seeing malicious software being attached to these e-mails, the company decided to issue a general alert to its nearly 1 million subscribers.
According to the Washington Post, Suntrust Banks was one of the customers victimized by this scam.
Salesforce.com is working with law enforcement to resolve the problem, but in the meantime it is recommending that customers implement a number of security measures in order to cut down on the phisher's chance of succeeding.
Suggested actions include restricting Salesforce.com account access to users who are within the corporate network, phishing education or the use of stronger authentication techniques to log on to the Salesforce.com servers.
On Tuesday, Salesforce.com declined to comment further on the matter. "Everything that they have to say about it is in this note," a spokesman with the company's public-relations agency said.
Rss FeedRss Feed
Gartner summarizes its view on Application Delivery Controllers, evaluates strengths and weaknesses...
Vulnerability Management For DummiesDownload this concise book "Vulnerability Management for Dummies," to learn about the simple steps...
The ROI and TCO Benefits of Data Deduplication for Data Protection in the EnterpriseThis paper examines and quantifies the costs and benefits of backup with deduplication storage as...
Life on the edge of your WAN has changed dramatically. With the need to deliver advanced services,...
PoE Plus: Impact on the PoE MarketThe standard for Power over Ethernet (PoE), IEEE Std. 802.3af(tm)-2003, advanced networking,...
Harnessing the power of communications to increase workplace performanceDue to the convergence of IT and telecommunications technologies, the business workplace has been...
We have so many holes punched in our firewalls today that many industry insiders question the value...
The self-managed networkWe aren't there yet, but advances in network and systems management tools are making it possible to...
| NetworkWorld, Inc. | About Network World, Inc. | Advertise | Careers | Contact us | Terms of Service/Privacy | Reprints and links | Partnerships | Press room | Subscribe to NW |
| IDG, Inc. | CIO | Computerworld | CSO | Demo | GamePro | Games.net | IDGconnect.com | IDG World Expo | Infoworld | JavaWorld.com | LinuxWorld.com | MacUser | Macworld | PC World | Playlistmag.com | The Industry Standard | IDG List Services | IDG TechNetwork |
 |
Copyright © 1994-2008 Network World, Inc. All rights reserved. |
Partner Content
Brilliantly simple security and control solutions for email, web and endpoint
www.sophos.com
Stopping data leakage
Learn how to exploit your current security investment to control the information that flows into, through and out of your network.
Download the white paper.
Why detection rates aren't enough
Evaluating endpoint security products is a time-consuming and daunting task. Learn the six critical questions you need to ask prospective vendors to get the right endpoint solution.
Download the white paper.
Applications: taking back control
Employees installing unauthorized applications is a growing threat to business security and productivity. Cost-effectively reduce this threat by integrating control into your malware protection.
Learn more today.
Comments (3)
Salesforce phishing possible solutionBy CRM Expert on November 12, 2007, 1:01 pmIf you use Salesforce.com, a company called OutProtect (www.outprotect.com) has a product that secures your downloaded data. The product stops authorized users (or...
Reply | Read entire comment
Spoofing?By Yad on November 7, 2007, 10:05 am@Jeff: What do you mean by spoofing? Is it in reference to the email headers that Salesforce.com uses? The IP Addresses that they send SMTP traffic from? Have...
Reply | Read entire comment
RE: Salesforce.com falls for phishing scam, warns customersBy Jeff on November 7, 2007, 9:40 amSalesforce also uses a method called spoofing that cause email administers to create holes in their SPAM filter security for their services to work. If you combine...
Reply | Read entire comment
View all comments