5 ms·

yes, very wrong conclusion. the author blames cheap domains and easy to get https. You could as well blame cheap computers, cheap internet access, cheap electri

by acvny 7y ago

yes, very wrong conclusion. the author blames cheap domains and easy to get https. You could as well blame cheap computers, cheap internet access, cheap electricity. Since that looked like an SMS, I would report it to your mobile provider, let them track who sent the message.

edent 7y ago
I'm the author. I'm not blaming cheap domains. I'm saying that spam like this is a consequence of cheap domains. The blame lies at the feet of the spammers. And, I've worked for a couple of mobile providers. This spam was likely sent from a disposable pre-paid SIM. There's no realistic way to check who sent it.
- bostik 7y ago
  So the phone/device IMEI is not recorded for the session? Not that it would tell who sent it, but would allow to track if the same devices were used as part of ongoing campaign.
  - edent 7y ago
    The sending network may have a record of the IMEI, but I don't think the receiving one gets it. But SMS sending devices are cheap and disposable. Sure, it's illegal to alter your IMEI in the UK - but if they're already committing one crime, I don't think that'll stop them.
- badrabbit 7y ago
  And who sent it shouldn't be recorded. Your problem is not the spammers but the reason users fall for the phish. Why are prepaid pins special and free email is not?
- ryanlol 7y ago
  Sending bulk sms costs waaaay more than any domain. This theory doesn’t really make any sense.
  - edent 7y ago
    Bulk SMS costs around 1p/message - if you're sending from the UK. If you're sending from overseas it can be significantly cheaper. So, sending a couple of hundred messages is about the same price as a domain. Of course, if you've stolen a SIM or hacked peoples' phone in order to send the messages, it's even cheaper.
    - ryanlol 7y ago
      IME good providers tend to charge at least 2p/message. You also need to get decent leads from somewhere or your conversion rates will suck. Then there’s also a significant time investment in setting up accounts with those SMS services that’ll constantly be banning you. Couple of hundred messages isn’t going to get you very many hits unless you’re collecting low value information.
- thefounder 7y ago
  Chances are the scammers didn't even pay the domain name or the SMS. Maybe the real issue is the state of payment services. You provide some random numbers in an unknown form....and this is since forever. How stupid is that? Things like Apple Pay seem to go a bit in the right direction but at the root you still use that random card number as identity/authentication.
- danShumway 7y ago
  > I'm saying that spam like this is a consequence of cheap domains. Technically correct, but the thing is, spam like this is a consequence of a lot of things. Why draw attention to that specific cause out of everything else? You could just as accurately say that spam like this is a consequence of human-readable domains. If humans weren't visually validating URLs, it would be impossible for a scammer to use unicode tricks to make a URL look legitimate. A lack of gatekeepers means we'll have more scammers, yes. But, gatekeepers almost universally don't scale well in any system as large as the Internet, and they come with so many additional problems that they're not worth paying special attention to or prioritizing as a solution to any problem on this scale.
- prox 7y ago
  If you watch kitboga (youtube / twitch) and in the odd chance kitboga gets to talk about why they do it the spammers fall into a couple of categories: 1) The angry/evil spammer. Doesn’t give a shit and wants make his dollars. Usually someone higher up. 2) The worker. Just his bills paid. Usually rather uncaring what they are doing, although they acknowledge its wrong 3) Playing oblivious, just ignoring and avoiding any sense of blame or justice It’s lucrative and as long as we keep falling for it, it will stay. Making domains more expensive will make the barrier of entry higher, but the top players will likely just consolidate more resources vs little scammers. If a domain is like an address then maybe we could or should enforce some more legitimacy, but such a thing would be hard to implement in the countries where spam usually originates from.
acomjean 7y ago
The fact that we were trained to look for https as a sign of legitimacy.. it kinda bugs me that letsencrypt which is a fantastic public service is being abused by scammers in this way. Anonymity all the way down the stack...
- toohotatopic 7y ago
  It's legitimacy for the connection, not for the domain. Who trains people to trust every domain?
  - Deukhoofd 7y ago
    Banks did for a while, many banks told you to look for the green padlock to ensure it was the right site.
  - wongarsu 7y ago
    An EV certificate is still a decent proxy for legitimacy: it's somewhat expensive to get and allows you to track down a legal entity. Both points deter scammers and other evil-doers, even if they don't completely prevent them. Sadly there's no way to judge from just the URL if a site has an EV cert or just a cheap/free https cert, and by the time you opened it in the browser it might be too late.
    - PeterisP 7y ago
      A lack of EV certificate is not a decent proxy for legitimacy, because most of legitimate important sites don't have an EV certificate - so people can't be trained to think that they should think twice if an EV certificate is absent.
      - SmellyGeekBoy 7y ago
        EV certificates are a scam anyway.
      - wongarsu 7y ago
        I sure would do a double take if I noticed a bank website using a non-EV cert or an EV cert issued to somebody other than the bank. But that's probably one of the few industries where you can expect it.
LinuxBender 7y ago
The messages are spoofed. The attacker has access to a SS7 signalling link and you can set the source number to anything you want. Telco's share some blame in facilitating this. I tried to stop of of this in the 90's and was told to help the scammers send messages faster. I wanted to terminate their SS7 links but I would have been fired for doing so. To clarrify, the individual scammer may not even know what a SS7 link is. It's usually a tiered system, where one shady person has access to a link, then sells access via bitcoin to other shady people via some tor web interface. As for the domain name, that problem isn't going away. If anything, it will only get worse, as people are lazy and push UX designers to show less and less information. And the UX devs are right, the users won't know what to do with the extra info most of the time anyway. And then there are payment processors, who also teach people BAD habits, by sending HTML messages, clickable links, etc. And that isn't going to change because it would increase customer support cases which costs them money. Banks won't implement secure authentication beyond phone MFA for the most part. I can think of a dozen ways to make this more secure, but all the ideas would be rejected as adding too much friction. All that is left is educating the masses and that fails as well. Most people learn by making mistakes. About 40% of people will click on the scammers links. About 10% of people will enter their credentials.
- belorn 7y ago
  > All that is left is educating the masses and that fails as well. That is not always true. You can have regulations which force banks to change. Banks don't like it but politicians don't like an unstable banking sector, especially if it causes sharp changes in the stock market. As an example, the recent money laundering scandals in Sweden has caused some changes in credit card security. Politicians want to reassure the public and increase trust in Swedish banks, so the last years has seen several notable banking regulations. I would guess that they actually want noticeable friction in order to reassure the public that they have things under control.
  - LinuxBender 7y ago
    That is excellent. I would love to see this pattern spread around the world.

by acvny 7y ago

edent 7y ago

I'm the author. I'm not blaming cheap domains. I'm saying that spam like this is a consequence of cheap domains. The blame lies at the feet of the spammers. And, I've worked for a couple of mobile providers. This spam was likely sent from a disposable pre-paid SIM. There's no realistic way to check who sent it.

bostik 7y ago
So the phone/device IMEI is not recorded for the session? Not that it would tell who sent it, but would allow to track if the same devices were used as part of ongoing campaign.
- edent 7y ago
  The sending network may have a record of the IMEI, but I don't think the receiving one gets it. But SMS sending devices are cheap and disposable. Sure, it's illegal to alter your IMEI in the UK - but if they're already committing one crime, I don't think that'll stop them.
badrabbit 7y ago
And who sent it shouldn't be recorded. Your problem is not the spammers but the reason users fall for the phish. Why are prepaid pins special and free email is not?
ryanlol 7y ago
Sending bulk sms costs waaaay more than any domain. This theory doesn’t really make any sense.
- edent 7y ago
  Bulk SMS costs around 1p/message - if you're sending from the UK. If you're sending from overseas it can be significantly cheaper. So, sending a couple of hundred messages is about the same price as a domain. Of course, if you've stolen a SIM or hacked peoples' phone in order to send the messages, it's even cheaper.
  - ryanlol 7y ago
    IME good providers tend to charge at least 2p/message. You also need to get decent leads from somewhere or your conversion rates will suck. Then there’s also a significant time investment in setting up accounts with those SMS services that’ll constantly be banning you. Couple of hundred messages isn’t going to get you very many hits unless you’re collecting low value information.
thefounder 7y ago
Chances are the scammers didn't even pay the domain name or the SMS. Maybe the real issue is the state of payment services. You provide some random numbers in an unknown form....and this is since forever. How stupid is that? Things like Apple Pay seem to go a bit in the right direction but at the root you still use that random card number as identity/authentication.
danShumway 7y ago
> I'm saying that spam like this is a consequence of cheap domains. Technically correct, but the thing is, spam like this is a consequence of a lot of things. Why draw attention to that specific cause out of everything else? You could just as accurately say that spam like this is a consequence of human-readable domains. If humans weren't visually validating URLs, it would be impossible for a scammer to use unicode tricks to make a URL look legitimate. A lack of gatekeepers means we'll have more scammers, yes. But, gatekeepers almost universally don't scale well in any system as large as the Internet, and they come with so many additional problems that they're not worth paying special attention to or prioritizing as a solution to any problem on this scale.
prox 7y ago
If you watch kitboga (youtube / twitch) and in the odd chance kitboga gets to talk about why they do it the spammers fall into a couple of categories: 1) The angry/evil spammer. Doesn’t give a shit and wants make his dollars. Usually someone higher up. 2) The worker. Just his bills paid. Usually rather uncaring what they are doing, although they acknowledge its wrong 3) Playing oblivious, just ignoring and avoiding any sense of blame or justice It’s lucrative and as long as we keep falling for it, it will stay. Making domains more expensive will make the barrier of entry higher, but the top players will likely just consolidate more resources vs little scammers. If a domain is like an address then maybe we could or should enforce some more legitimacy, but such a thing would be hard to implement in the countries where spam usually originates from.

acomjean 7y ago

The fact that we were trained to look for https as a sign of legitimacy.. it kinda bugs me that letsencrypt which is a fantastic public service is being abused by scammers in this way. Anonymity all the way down the stack...

toohotatopic 7y ago
It's legitimacy for the connection, not for the domain. Who trains people to trust every domain?
- Deukhoofd 7y ago
  Banks did for a while, many banks told you to look for the green padlock to ensure it was the right site.
- wongarsu 7y ago
  An EV certificate is still a decent proxy for legitimacy: it's somewhat expensive to get and allows you to track down a legal entity. Both points deter scammers and other evil-doers, even if they don't completely prevent them. Sadly there's no way to judge from just the URL if a site has an EV cert or just a cheap/free https cert, and by the time you opened it in the browser it might be too late.
  - PeterisP 7y ago
    A lack of EV certificate is not a decent proxy for legitimacy, because most of legitimate important sites don't have an EV certificate - so people can't be trained to think that they should think twice if an EV certificate is absent.
    - SmellyGeekBoy 7y ago
      EV certificates are a scam anyway.
    - wongarsu 7y ago
      I sure would do a double take if I noticed a bank website using a non-EV cert or an EV cert issued to somebody other than the bank. But that's probably one of the few industries where you can expect it.

LinuxBender 7y ago

The messages are spoofed. The attacker has access to a SS7 signalling link and you can set the source number to anything you want. Telco's share some blame in facilitating this. I tried to stop of of this in the 90's and was told to help the scammers send messages faster. I wanted to terminate their SS7 links but I would have been fired for doing so. To clarrify, the individual scammer may not even know what a SS7 link is. It's usually a tiered system, where one shady person has access to a link, then sells access via bitcoin to other shady people via some tor web interface. As for the domain name, that problem isn't going away. If anything, it will only get worse, as people are lazy and push UX designers to show less and less information. And the UX devs are right, the users won't know what to do with the extra info most of the time anyway. And then there are payment processors, who also teach people BAD habits, by sending HTML messages, clickable links, etc. And that isn't going to change because it would increase customer support cases which costs them money. Banks won't implement secure authentication beyond phone MFA for the most part. I can think of a dozen ways to make this more secure, but all the ideas would be rejected as adding too much friction. All that is left is educating the masses and that fails as well. Most people learn by making mistakes. About 40% of people will click on the scammers links. About 10% of people will enter their credentials.

belorn 7y ago
> All that is left is educating the masses and that fails as well. That is not always true. You can have regulations which force banks to change. Banks don't like it but politicians don't like an unstable banking sector, especially if it causes sharp changes in the stock market. As an example, the recent money laundering scandals in Sweden has caused some changes in credit card security. Politicians want to reassure the public and increase trust in Swedish banks, so the last years has seen several notable banking regulations. I would guess that they actually want noticeable friction in order to reassure the public that they have things under control.
- LinuxBender 7y ago
  That is excellent. I would love to see this pattern spread around the world.