4 ms·

Whoever takes down criminals like this wire transfer scammer is a hero. Fuck crackers, scammers, and other douche bags.

deleted 10y ago
[deleted]
ta_the_gray 10y ago
(Using a throwaway for obvious reasons here.) I couldn't agree more. Lately I've been taking down scammers left and right. For instance, my wife got a text recently trying to phish Bank of America accounts. She gave me the URL, and I emptied their database and took the site offline. These people are straight-up evil.
- marmot777 10y ago
  It may seem like I was doing something pretty obvious: preaching to the choir. But it takes intention, effort, skill and at least some passion or anger drive motivation to follow-through on something like this. It's worth saying out loud that it's an act of heroism.
  - sillysaurus3 10y ago
    Praising this isn't necessarily a good idea. I'm the last to say something like that, but the CFAA is legitimately terrifying. To see how little tolerance people have for hackers, look at the Steubenville incident: https://www.reddit.com/r/TwoXChromosomes/comments/51ot8u/activist_who_helped_expose_steubenville_rape_of_a/d7ebmwe https://www.reddit.com/r/TwoXChromosomes/comments/51ot8u/act... When you do something like this, a mistake -- even a minor one -- can turn you from a heroic vigilante into the hunted. The point of an indictment is to indict you, but people generally talk about accusations as if they're fact. That would give me pause before executing a plan like this, no matter how moral. For example, ta_the_gray didn't use Tor, or else their comment would be marked dead. That means they're putting a lot of faith into HN to conceal their IP address. Hopefully they used Tor -> VPN -> HN, but even then, how did they pay for the VPN? Stuff like this takes a lot of training and preparation to pull off flawlessly. Of course, if you live outside of America, your situation may be different.
    - ikeboy 10y ago
      Tor->free VPN is pretty easy to set up.
    - marmot777 10y ago
      I'm in the U.S. and I've never been a hero of any sort, just to clear the air on that. :-) This is my last post of the night so I don't have to time right now to read all that you mentioned and maybe it's not necessary. You're saying that making a mistake going after a cracker or scammer or other douche bag of this sort can easily backfire on you if you make a mistake? The conclusion you make then is don't do it? I'm not even disagreeing if this what you're saying. If it's truly not so much heroism as I claimed but in fact reckless stupidity then I'll concede the match on this point.
- reitanqild 10y ago
  Averted an email whaling scam a couple of weeks ago. (Although in this case they were trying to harpoon a small tumbler;) Got his email adress. Any ideas?
- iamcreasy 10y ago
  Could you tell us more about it? What happened? What was the url? and how did you do it?
prawn 10y ago
Honest question: Are there many efforts made by domestic organisations which can seriously discourage this? e.g., if a megacorp gets screwed out of $10m, it's likely to attract police, FBI, etc interest. But if you're a small business, I imagine you have minimal protection and zero recourse, right? What could be done in pursuing or discouraging this sort of thing?
- crypt1d 10y ago
  IMHO, biggest issue is that attacks usually appear to be coming from 'not-so-cooperative' countries (eg, Russia, China). Even if the attack is not based there they can appear like it (eg, via proxy/VPN). That makes it difficult for US police to track down the criminals without involving Interpol or use some other means of cross-country police cooperation. And that usually means it has to be a really big fish to catch. So best solution is still prevention and education.
  - prawn 10y ago
    So, is it effectively an unsolvable problem given the current situations with email and banking and so on? As the other respondent indicated, you can lock down your domain but if the whaler registers yourbuslnessdomain.com, they'll catch someone. "Sorry, I've had some trouble with my email recently and IT haven't been able to get the authorised designation appearing, you know how they are! Anyway, I've been working on a contract with Penske for months as you probably heard and unfortunately their lawyers have accelerated the process to the first stage. I need you to organise the initial cash transfer..."
    - crypt1d 10y ago
      Best solution to the example u gave would be to use PGP to verify email signature and ensure the sender is really who he say he is. Of course, PGP has its own problems but thats another story.
      - prawn 10y ago
        Susceptible to the same social engineering. "My PGP thingy isn't working right now. We could wait until IT have fixed that but I'm worried that we're going to run out of time." I'm aware that Nigerian scammers supposedly fill emails with typos to eliminate clever marks, but if scammers could more accurately emulate emails/styles and write more convincingly in English, I think we'd see a lot more people scammed.

deleted 10y ago

[deleted]

(Using a throwaway for obvious reasons here.) I couldn't agree more. Lately I've been taking down scammers left and right. For instance, my wife got a text recently trying to phish Bank of America accounts. She gave me the URL, and I emptied their database and took the site offline. These people are straight-up evil.

marmot777 10y ago
It may seem like I was doing something pretty obvious: preaching to the choir. But it takes intention, effort, skill and at least some passion or anger drive motivation to follow-through on something like this. It's worth saying out loud that it's an act of heroism.
- sillysaurus3 10y ago
  Praising this isn't necessarily a good idea. I'm the last to say something like that, but the CFAA is legitimately terrifying. To see how little tolerance people have for hackers, look at the Steubenville incident: https://www.reddit.com/r/TwoXChromosomes/comments/51ot8u/activist_who_helped_expose_steubenville_rape_of_a/d7ebmwe https://www.reddit.com/r/TwoXChromosomes/comments/51ot8u/act... When you do something like this, a mistake -- even a minor one -- can turn you from a heroic vigilante into the hunted. The point of an indictment is to indict you, but people generally talk about accusations as if they're fact. That would give me pause before executing a plan like this, no matter how moral. For example, ta_the_gray didn't use Tor, or else their comment would be marked dead. That means they're putting a lot of faith into HN to conceal their IP address. Hopefully they used Tor -> VPN -> HN, but even then, how did they pay for the VPN? Stuff like this takes a lot of training and preparation to pull off flawlessly. Of course, if you live outside of America, your situation may be different.
  - ikeboy 10y ago
    Tor->free VPN is pretty easy to set up.
  - marmot777 10y ago
    I'm in the U.S. and I've never been a hero of any sort, just to clear the air on that. :-) This is my last post of the night so I don't have to time right now to read all that you mentioned and maybe it's not necessary. You're saying that making a mistake going after a cracker or scammer or other douche bag of this sort can easily backfire on you if you make a mistake? The conclusion you make then is don't do it? I'm not even disagreeing if this what you're saying. If it's truly not so much heroism as I claimed but in fact reckless stupidity then I'll concede the match on this point.
reitanqild 10y ago
Averted an email whaling scam a couple of weeks ago. (Although in this case they were trying to harpoon a small tumbler;) Got his email adress. Any ideas?
iamcreasy 10y ago
Could you tell us more about it? What happened? What was the url? and how did you do it?

prawn 10y ago

Honest question: Are there many efforts made by domestic organisations which can seriously discourage this? e.g., if a megacorp gets screwed out of $10m, it's likely to attract police, FBI, etc interest. But if you're a small business, I imagine you have minimal protection and zero recourse, right? What could be done in pursuing or discouraging this sort of thing?

crypt1d 10y ago
IMHO, biggest issue is that attacks usually appear to be coming from 'not-so-cooperative' countries (eg, Russia, China). Even if the attack is not based there they can appear like it (eg, via proxy/VPN). That makes it difficult for US police to track down the criminals without involving Interpol or use some other means of cross-country police cooperation. And that usually means it has to be a really big fish to catch. So best solution is still prevention and education.
- prawn 10y ago
  So, is it effectively an unsolvable problem given the current situations with email and banking and so on? As the other respondent indicated, you can lock down your domain but if the whaler registers yourbuslnessdomain.com, they'll catch someone. "Sorry, I've had some trouble with my email recently and IT haven't been able to get the authorised designation appearing, you know how they are! Anyway, I've been working on a contract with Penske for months as you probably heard and unfortunately their lawyers have accelerated the process to the first stage. I need you to organise the initial cash transfer..."
  - crypt1d 10y ago
    Best solution to the example u gave would be to use PGP to verify email signature and ensure the sender is really who he say he is. Of course, PGP has its own problems but thats another story.
    - prawn 10y ago
      Susceptible to the same social engineering. "My PGP thingy isn't working right now. We could wait until IT have fixed that but I'm worried that we're going to run out of time." I'm aware that Nigerian scammers supposedly fill emails with typos to eliminate clever marks, but if scammers could more accurately emulate emails/styles and write more convincingly in English, I think we'd see a lot more people scammed.