Phishing scam turns out to be an inside Army job

Phishing scam turns out to be an inside job

By Karen Jowers - Staff writer
Posted : Tuesday Apr 1, 2008 13:31:21 EDT

An Army “phishing” test backfired the day before April Fool’s Day after an Army command was discovered phishing amongst its own.

The Army Family and Morale, Welfare and Recreation Command issued a press release at 4:12 p.m. Monday warning about a phishing e-mail scam.

The e-mail, which sported the Army’s official MWR logo, appeared to be an attempt to obtain personal information from soldiers by offering promises of free or discounted tickets to theme parks and attractions.

The press release said the Family and MWR Command was trying to find the owners of the Web site and the host of the domain.

Less than an hour later, the command issued another statement saying the phishers had been found — the Army’s own Network Enterprise Technology Command.

That command had notified MWR officials that it had been conducting a test of how soldiers respond to phishing scams — without letting anyone in the MWR command know about it.

Army MWR officials sent out a retraction 54 minutes after their phishing warning went out, saying they were “furious” that such a test had been conducted, using the MWR logo, without their knowledge or consent, and apologizing “for any inconvenience this might have caused.”

The phishing scam e-mail listed a Web link with an online registration form asking for a name, e-mail address, phone, city, state and ZIP code. The e-mail apparently went out across the service to soldiers’ Army e-mail accounts and to MWR professionals.

“I don’t think they were doing anything malicious,” said Laurie Pugh, spokeswoman for the Army Family and MWR Command. “They were just testing the system to protect our soldiers. We wish we had known in advance. But we know our system worked. We got the word out quickly.”
go here for the rest
http://www.armytimes.com/news/2008/04/military_phishingscam_040108w/