Desktop·25,136 discussions

With phishers this dumb, need we really worry?

Locked

Aside from the obvious spelling errors, the obvious fact that this was sent to multiple addresses, and the poorly hidden link re-direction, note that the alleged “problem” will not occur until [b]next[/b] week!

This reminds me of a recent incident in which a would be thief locked himself into the trunk of the car that he was ransacking.

==================================================

Received: from cmsmail13.cms.usa.net [127.0.0.1] by cmsmail13.cms.usa.net via mtad (C8.MAIN.3.17K) with ESMTP id 240JFmkyS1051M13; Mon, 13 Jun 2005 10:24:45 GMT

Return-Path:

Received: from 66.219.97.25 [66.219.97.25] by cmsmail13.cms.usa.net via smtad (C8.MAIN.3.21U); Mon, 13 Jun 2005 10:24:45 GMT

X-USANET-Source: 66.219.97.25 IN ztqfd@yahoo.com 66.219.97.25

X-USANET-MsgId: XID247JFmkyt3756X13
Received: from 82.196.200.64 by ; Mon, 13 Jun 2005 09:14:05 -0200

Message-ID:

From: “PayPal”

Reply-To: “Florine Deal”

To: a2dox@usa.net

Cc: ldb0310@usa.net, sr.janice.m.bemowski@usa.net, cponnet.stcamillus@usa.net, greymind@usa.net, hutchib@usa.net, thomasluckmann@usa.net, huberney-r@usa.net, cacla@usa.net, jparr@usa.net

Subject: [Spam] Confirmation Required

Date: Mon, 13 Jun 2005 09:22:05 -0200

X-Mailer: QUALCOMM Windows Eudora Version 5.1

MIME-Version: 1.0

Content-Type: multipart/alternative; boundary=”–45242079321187510″

X-Priority: 3

X-MSMail-Priority: Normal

X-USANET-Spam: B

X-Brightmail-Tracker: AAAAAwC29hsAxVumAM7UOA==

This message was identified as Spam by Brightmail.

————————————————–

PayPal is committed to maintaining a safe environment for its community of customers. To protect the security of your account, PayPal employs some of the most advanced security systems in the world and our anti-fraud teams regularly screen the PayPal system for unusual activity.

We are contacting you to remind you that on 20 June 2005 our Account Review Team identified some unusual activity in your account. In accordance with PayPal’s User Agreement and to ensure that your account has not been compromised, access to your account was limited. Your account access will remain limited until this issue has been resolved.

To secure your account and quickly restore full access, we may require some additional information from you for the following reason:

We have been notified that a card associated with your account has been reported as lost or stolen, or that there were additional problems with your card.

This process is mandatory, and if not completed within the nearest time your account or credit card may be subject for temporary suspension.

To securely confirm your PayPal information please click on the link bellow:

https://www.paypal.com/cgi-bin/webscr?cmd=_login-run

[b]( The real link is [v]http://www.welcomehereinnew.com/[/v] )[/b]

We encourage you to log in and perform the steps necessary to restore your account access as soon as possible. Allowing your account access to remain limited for an extended period of time may result in further limitations on the use of your account and possible account closure.

For more information about how to protect your account please visit PayPal Security Center. We apologize for any incovenience this may cause, and we apriciate your assistance in helping us to maintain the integrity of the entire PayPal system.

Thank you for using PayPal!
The PayPal Team

[v]http://www.paypal.com/cgi-bin/webscr?cmd=p/gen/privacy-outside[/v]

Topic

Unfortunately we do.

In reply to With phishers this dumb, need we really worry?

I watched a recent TV expose of the “Nigerian” letter, and it was amazing how many thousands of educated people fell for it.

The thing with these paypal ones is that there are so many people doing the same thing, its pretty obvious. I must have received a thousand attempts, with about 12 variations, within the last six months. The ones for Banks that I have never done business with are worse.

James

Agreed. Still, it struck me that, given the shear volume …

In reply to Unfortunately we do.

of PayPal scams from which to copy, the wide press coverage re. the common tell-tale signs of phishing, easy access to spell-checkers, etc., that even the rank amateur would have done a better job than this.

Clearly the originator was in such a hurry to hit as many targets as possible, in the least amount of time, that he gave little thought to measures that might have greatly increased his return with but a minimal extra effort.

This guy has all the makings of a marketer.

sept email

In reply to Agreed. Still, it struck me that, given the shear volume …

I have sept email for paypal only, which spammers don’t have, makes it easy to spot the fakes.

To help them I immed fwd email to them either abuse@paypal.com or spoof@paypal.com, is on their website, and mention to not send me anti-phishing info as I didn’t reply.

Look at phishers’ marks

In reply to Agreed. Still, it struck me that, given the shear volume …

Rememeber out in our day-to-day world a great percentage are only marginally literate, most are horrible spellers, and very few have even the most rudimentary knowledge of how computers and the internet work. Mix these ingredients together with poorly protected computers, online banking and buying, and some at least marginally plausible phishing attempts and voila…..We’ve got real problems.

Most of the poor schmucks out there surfing the net have little idea of which addresses are “real” or forged to resemble the real McCoy. They probably don’t know that they’re being redirected at all when they click on a link. It’s not their fault, it’s just outside of their sphere of knowledge. Unfortunately, we sell people computers, encourage them to surf the web, buy things online, and to bank online, but they are never given even the most basic training in how to operate their computer in a safe manner and to lock it down from online predators.

Until we get better training for the masses, this kind of misfortune will perpetuate.

Comic Relief

In reply to Unfortunately we do.

I see these types of scams as technical comic relief. Sadly… waaaaay to many people fall for it. You can even fall for it by sheer accident.. I was sitting with an employee of mine who was showing me that their computer was locked… clicking around the screen… when the process that locked his system freed up…. it clicked right into a scam… We both bursted out in some freakish laugh… he still gets hammered with spam from that one.

Random mouse clicks, etc. reminds me of favorite definition of insanity.

In reply to Comic Relief

[i]”Insanity is repeatedly trying the same action with the expectation of a different outcome.”[/i]

Insanity

In reply to Random mouse clicks, etc. reminds me of favorite definition of insanity.

And the scary thing is that with my XP box I DO get different outcomes…

😉

I quess that means you’re NOT insane!

In reply to Insanity

…

I don’t know about that…

In reply to I quess that means you’re NOT insane!

…firstpeter is using XP.

Yes, but he’s getting varied results!

In reply to I don’t know about that…

…

Touche

In reply to I don’t know about that…

Enough said.

I get these all the time….

In reply to With phishers this dumb, need we really worry?

and I don’t even HAVE an ebay account…guess that would be a clue huh? BUT APPARENTLY IT ISN’T ENOUGH OF A CLUE! I have had many, many users call me to tell me that they are filling out the “form” and can’t remember their password can I help them find it. When I ask them “what form” the tell me about their Ebay problem. Well….then I say do you have an EBay account and they say “I must have, they sent me this message that I needed to update it!” oh crap………………………

Sooo True

In reply to I get these all the time….

You figure people would catch on… remember the old telephone scams when they call you about your calling card or credit card. Then they ask for the numbers for verification? Soooooo many poeople used to fall for that stuff it wasn’t even funny… People haven’t changed… just the delivery…

Either I’m damned lucky; or, I’m close to invisible.

In reply to I get these all the time….

Phishing e-mails are virtual strangers to my in-boxes; this despite multiple accounts (9) with multiple providers (6).

While 2 of my addresses are clearly on the spammers hit lists, even those rarely see a phisher.

Curiously, this one arrived at my most well guarded address, but not at another with the same provider!

gmail cures all ;-)

In reply to Either I’m damned lucky; or, I’m close to invisible.

I’ve found that gmail sure does cut down on the phishers and spammers. I also don’t have as many problems with strange messages cropping up.

I am being spammed to death with my comcast account and I’ve dropped my yahoo account….

deep you are lucky! It seems those guys are out to find you…even if you have an obfusacted email address.

gmail

In reply to gmail cures all ;-)

I must say that my gmail account is pretty clean.
My yahoo account isn’t too bad either.
My corporate site has its good and bad months.

Cable sucks in this regards because, …

In reply to gmail cures all ;-)

cable is a shared system, with the local loops functioning as LANs, & the cable companys do little or nothing to shut down the zombies that thrive there.

As for Gmail, I wish they’d get their POP3 service working right.

POP3 kinda works ;-)

In reply to Cable sucks in this regards because, …

But, ya it has issues. I can’t synch my PDA with their POP3 service and I have issues trying to get it working with my mail “server”

Maybe it’s POP2.5

In reply to POP3 kinda works ;-)

I’ve had no luck using it with any web based mail service. I’ve yet to try it with OE.

What, if anything, has worked for you?

And, is your PFD using POP or IMAPI?

Fighting Spam

In reply to Either I’m damned lucky; or, I’m close to invisible.

I’ve created a honey pot email… I have it accept everything. It gets about 3,000 email or more per day of spam or malicious emails.

I have another process that reads those emails and takes them out of my regular email and the email of other in my company. I has dramatically reduced spam but it certainly has not eliminated it.

BrightMail

In reply to Fighting Spam

2 of my web based accounts are with USA.net, one of the 1st to use BrightMail for spam filtering; it works quite well, and accepts & uses feedback from users.

Symantec was so taken with BrightMail that they recently bought the compnay.

wish they’d offer indiv accounts

In reply to BrightMail

for a short time when they started they offered indiv accounts, no more, must be company or ISP. wish more ISP’s would use them. They do quite a bit of effective filtering.

Watch for product(s) to be forthcoming from Symantec.

In reply to wish they’d offer indiv accounts

Symantec bought the company, so as to avoid having to roll their own anti-spam engine, and thus get to market with a like product of their own more quickly.

Whether it will be offered as a standalone product remains to be seen.

Others

In reply to Watch for product(s) to be forthcoming from Symantec.

I think messagelabs and possibly others do the same thing.

Brightmail was in UK if I recall correctly.

Interesting

In reply to BrightMail

I’ll have to check that out.

If you DoS (DDoS) these IPs do you get in trouble? ;-)

In reply to I get these all the time….

So, if I go out and start bringing the phishers boxes to their knees, will I go to jail or get a medal?

careful who you ddos

In reply to If you DoS (DDoS) these IPs do you get in trouble? ;-)

it seems pretty straight forward to ddos a site that actually contains a form. (but) suppose we started alot of retailiatory ddosing, then to get back at a commercial site, someone could send out phishing emails listing the site’s IP to shut it down, even if they hadn’t really loaded a phishing form on it.

You’d have to click on form to be sure there was a phishing form at that site before acting.

as mentioned in the vigilante thread, might be better to hack in and delete the phishing web page instead to protect others, so when they click nothing happens, as it is either a phishing server or an already hacked server. this could be harder to do of course.

I think I have a better idea now

In reply to careful who you ddos

How about actual LAWS that will put these people in jail? We can extradite them and flog them with wet noodles until they talk…

Can we throw Jello Too?

In reply to I think I have a better idea now

…

No! You must throw Crackers.

In reply to Can we throw Jello Too?

…

LOL

In reply to No! You must throw Crackers.

😀

Thought it was toast

In reply to No! You must throw Crackers.

Like when you go see a midnight Rocky Horror Picture Show.

Crackers are less odiferous than Phish.

In reply to No! You must throw Crackers.

Perhaps if you toast the fish?

Only if it is lime

In reply to Can we throw Jello Too?

NT

Throw some this way; lime’s my favorite.

In reply to Only if it is lime

…

Gag! Lime is NASTY!

In reply to Only if it is lime

NT

You have problem with nasty?

In reply to Only if it is lime

You don’t have much fun, do you.

Laws only work if …

In reply to I think I have a better idea now

the offenses occur within the jurisdiction of that law, there is an actively engaged & competent law enforcement effort extant, and all Sovereigns involved co-operate to the full required extent.

The sad fact is that we do [b]not[/b] need new laws to address these problems.

What we lack are the latter 2 said requirements.

Even then..

In reply to Laws only work if …

There is no grantee of a happy outcome. There are few laws on the books to combat this kind of fraud, as stated, many of these people/organizations are outside US jurisdiction. We do not need new laws though. The elderly who make up our highest courts are so out of touch with technology, it seems just about every law passed to affect phishing and spam do little to allow for prosecution of the offender, and instead hamper the rights of small business, and hamper new technologies growth. The only way this stuff ends, is when users stop leaving their common sense behind when they hit the web. If someone came up to the people who buy into this, and a guy with Nigerian ascent (what ever that sounds like) in a nice suit says, hay, give me your banking info, and I will transfer all this money, you will affectively get rich while doing nothing…..almost no one, I don’t care if the guy has a Rolex and a limo, few will give their account info. How is it when it is a poorly typed totally random email, people start grabbing for their wallets?

You got me

In reply to Even then..

“How is it when it is a poorly typed totally random email, people start grabbing for their wallets?”
You got me but I believe it is because people but a level of authority and legitimacy on technology because they don’t understand it. But that hypothisis is a shot in the dark.

Fraud laws need NOT address specific means to be applicable.

In reply to Even then..

To be fraudulent, an act need have but 3 basic elements:

1) The act made a material mis-representation for the express purpose of causing loss;
2) A loss actually occurred; and,
3) Had the mis-representation not been made, the victim would not have suffered said loss.

How the mis-representation was delivered, what the loss was, and how such loss was effected are all irrelevant.

The only impact of laws addressing specific frauds is with regards to prescribing specific criminal penalties.

What needs to be done is to effectively enforce existing laws.

Agreed, but

In reply to Laws only work if …

we still don’t have solid laws that make sense (or have teeth) in regards to spamming, phishing, pharming, etc…

I think the law makers need to call in the IT experts to write this law…

Fraud is fraud; new laws not necessary.

In reply to Agreed, but

See my above post, at
[v]http://techrepublic.com.com/5208-6230-0.html?forumID=9&threadID=176027&messageID=1792016[/v]

If nations are unwilling to help

In reply to Laws only work if …

Start excluding servers that, through inaction or involvement, perpetuate act of cyber-terrorism and organized computer fraud and theft. Soon enough they’ll just be crappin’ in their own little sandbox.

Who decides who should be blocked?

In reply to If nations are unwilling to help

And, who has the balls to block, for example, ComCast?

A tangled web with no single answer.

In reply to careful who you ddos

See
[v]http://techrepublic.com.com/5208-6230-0.html?forumID=9&threadID=176027&messageID=1791259[/v]

Yes.

In reply to If you DoS (DDoS) these IPs do you get in trouble? ;-)

For starters, if your actions violate your ISP’s Terms of Use, you could loose your service.

Secondly, if your ISP is held liable for your acts, your ISP could hold you liable for any damages suffered by them

As for legal action, such would depend on the jurisdictions off all involved party, so that that question has no one answer.

But, a medal? Definitely!

That was a clue to me

In reply to I get these all the time….

I’m always getting those too, I can’t help but laugh when I don’t do PayPal.

this just in

In reply to With phishers this dumb, need we really worry?

This just in:

http://nwc.securitypipeline.com/showArticle.jhtml?articleID=164901038

appears a commercial vendor, cyota, inc will ddos phishing sites on request if you subscribe to one of their security response services. i.e. a bank could prevent any customers from responding to the phishing attack.

God bless em

In reply to this just in

NT

Celebration premature.

In reply to God bless em

Cyoda is [n]not[/b] offering DDOS services.

See their product description at
[v]http://www.cyota.com/product_1_1.asp[/v]

Cyota is NOT offering DDOS services.

In reply to this just in

See their product description for details.

[v]http://www.cyota.com/product_1_1.asp[/v]

Sorry, thanks

In reply to Cyota is NOT offering DDOS services.

It sounded like they were DDos’ing article. I should have been suspicious as this would be illegal I’d think.

Sounds good

In reply to Sorry, thanks

I’m sure some company will pop up off shore in some country and start doing this for a fee.

Hmmmm…I wonder…I bet a server in China would work just fine 😉

Cyota may be able to achieve results similar to a DDOS.

In reply to Sounds good

If a client can quickly enough identify a phishing attack directed at their client base, and provide the offending e-mail(s) to Cyota, and if the URL at the link in the e-mail is still active, Cyota will generate bogus replies to such e-mails in quantity.

While technically not a DDOS, in sufficient volume, such responses could effect a practical denial-of-service for the URL in question.

found a similar service

In reply to Cyota may be able to achieve results similar to a DDOS.

This company analyzes phishing forms and if the website pulls up, they set it up to fill in the website, the end result could disable phisher site similar to a ddos attack but is legal as you’re just filling in their form with a client they give you. ( Blue Security’s Blue Frog client)

http://www.informationweek.com/story/showArticle.jhtml;jsessionid=ENCFP50ITNNA2QSNDBCSKH0CJUMEKJVN?articleID=166400318

An interesting approach

In reply to found a similar service

I’ve seen several articles & other mentions of Blue Frog over the past several weeks.

This just might be a viable approach, one that I’ll be watching with much interest & hope.

[Author]

Replies