6 ms·

Scam e-mail impersonating Red Cross

73 points by News-Dog 5y ago

twoxproblematic 5y ago
nixcraft 5y ago
These scams are so common on both Facebook[1] and Twitter[2]. I have a large following on both, copying my logo and header image. Then pretend to be me and ask for bitcoin donations. I asked Twitter and FB to verify my account, but they refused, saying that I am not famous enough. So now these scams are going on. I am tired of these social media scams and the lack of control by FB/Twitter. Here is how scam looks or works as they send DMs to followers[3] [1]https://facebook.com/nixcraft https://facebook.com/nixcraft [2]https://twitter.com/nixcraft https://twitter.com/nixcraft [3]https://imgur.com/a/WJ7TPrZ https://imgur.com/a/WJ7TPrZ
- deleted 5y ago
  [deleted]
tromp 5y ago
They could have made it look more legitimate by sending multiple fake donations there. https://www.blockchain.com/btc/address/364fYEU6U4D8zt4EG2oxVZcYo2ovGYZioD https://www.blockchain.com/btc/address/364fYEU6U4D8zt4EG2oxV... shows only one ~$40 donation, which may or may not be fake. On the other hand, I guess they're only targetting the gullible, who aren't expected to check the donation history anyway...
- amelius 5y ago
  How would a benevolent party receive their first BTC donation, though, if everybody was that skeptical?
  - can16358p 5y ago
    There will always be people who are at the less-skeptic end of the spectrum. And some actually _want to be_ the first, giving them (the illusion of) exclusivity.
  - 3np 5y ago
    By sharing it over a trusted channel (like their website, a well-known social media profile, or an AFK interaction) or cryptographically signed with a trusted key. Certainly not by sending it in unsolicited emails or DMs.
  - saalweachter 5y ago
    Hell, "use a fresh address per marketing campaign" sounds like analytics 101, so you know if email blasts are worth the effort over just throwing up something on Twitter every N days/hours.
    - vmception 5y ago
      use a fresh address per recipient. the sender can still get the total balance from that set of addresses for the marketing campaign analytics
  - tenuousemphasis 5y ago
    The Ukrainian central bank shared their crypto addresses on their Twitter and received tens of millions worth of donations.
- vmception 5y ago
  They dont have to be reusing addresses There is no reason to, except some wallets make it hard for the user to switch addresses All clients give the user infinite addresses down a tree, so a script creating emails could easily move down the index for each recipient
can16358p 5y ago
Got a similar scam after Ukranian Government started accepting donations. The (fake) email allegedly came from CoinDesk (of course from a completely fake email address), telling to support Ukrania, with a picture of the original tweet with the donation addresses switched to attacker's, which is also on the email. Scam on itself is one thing. Scam abusing a sensitive topic like donating to people in need... this is just disgusting.
- willcipriano 5y ago
  We need a way to associate bitcoin addresses with domain names so users will send to ukraine.ua or similar. It's not perfect but humans have no hope with long random strings.
  - tough 5y ago
    that's what .eth domains do with ENS no?
    - can16358p 5y ago
      There are other problems with ENS though, it's not completely decentralized. But yes, that would cover some of the issues, yet scammers will still find ways to scam the less-tech-savvy ones.
      - tough 5y ago
        Yeah I'm tech savvy and it's a fuck fest of scam DM's I get both on twitter (For having an .eth domain on my username) and discord (whenever i join a NFT/DAO/web3 project... I mean I can deal with it, but is easier when you buy almost nothing. I know this stuff and yet sometimes I almost get scammed.
  - woodruffw 5y ago
    Isn’t a naming authority exactly the kind of thing that cryptocurrency people deride as centralization?
sharperguy 5y ago
Bitcoin really needs some kind of SSL or way of getting a verified address from a particular organisation or person. Raw addresses encourage address reuse, which is already problematic for the bitcoin ecosystem. Add on top of that the fact that there is no authentication, there really needs to be a solution. An alternative that exists today would be LNURL, which is simply an HTTPS protocol that will generate an lightning invoice, however lightning itself doesn't have wide spread use yet.
- MereInterest 5y ago
  This would require some level of trust, which Bitcoin and the cryptocurrency ecosystem are pathologically avoidant of. Every one of cryptocurrency's problems, from the massive electrical cost to the irreversible transactions to the permanent auditable record of all transactions, could be avoided by the existence of a trusted intermediate. Societies grow strong on the basis of trustworthy and trusted institutions. Cryptocurrency has neither, and pays the cost of inefficiency with every hash.
  - PretzelPirate 5y ago
    > This would require some level of trust, which Bitcoin and the cryptocurrency ecosystem are pathologically avoidant of. This is a misunderstanding of the blockchain community. They understand that trust is important and even required in many situations. The idea in blockchain is that you should decide who you trust and to what degree you trust them. For the scenario of figuring out if an address is really owned by the Red Cross, people are interested in the idea of Decentralized Identity where cryptographic attestations are stored on-chain about an address. Someone can choose to trust those attestations (by following a larger web of trust through attestations), or They can choose to trust some other source. Blockchains are about choice and not being forced to trust any specific entity who hasn’t gained your trust simply because you’re told to.
    - MereInterest 5y ago
      If that were the case, then blockchains would be implemented akin to GPG's web of trust. You could choose who to trust, and based on a level of trust, whether you would trust their trusted contacts. Public-key cryptography is about being able to choose who to trust. Blockchain is about never trusting anybody.
ourmandave 5y ago
“Unfortunately, any time there is an emergency or a disaster, we saw this with COVID, people start thinking of ways they can take advantage of the situation,” said Rasor. “It's horrible to think of, but it happens every time there's a disaster.” To help ensure you’re not giving money to a criminal, don’t click on links from people you don’t know. You may get a legitimate-sounding solicitation over the phone or via text. Keep in mind, that person may not be who they say they are. Independently go to that nonprofit’s website to confirm who you’re giving your money to. Don’t let someone talk you into donating through gift cards or wire transfers. If you can, use a credit card. It carries some additional protections. “What I would recommend is that you give with your heart, but you also give with your head,” Scally said. https://www.nbcdfw.com/news/nbc-5-responds/how-to-donate-to-ukraine-relief-efforts-ensure-your-money-is-safe/2906916/ https://www.nbcdfw.com/news/nbc-5-responds/how-to-donate-to-...
jacquesm 5y ago
Tons of them, also lots of attempts to impersonate Ukrainian prominent individuals. Be careful about all accounts created during or after Feb. 2022 and anybody soliciting donations.
ls15 5y ago
I get a unknown certificate issuer warning on Tor browser for https://redcross.org.ua/en/donate/ https://redcross.org.ua/en/donate/ which seems to be the official domain.
hamiltonians 5y ago
None of these donation scammers are making any money. empty wallets or peanuts. The big $ is in those fake crypto giveaway livestreams on youtube. In a single month scammers combined earned as much as all ukraine crypto donations, about $30 million, and do it month after month unstopped . greed is more profitable than generosity.
- input_sh 5y ago
  My experience as well. Any scamming operation in people's inbox and either the operators are earning nothing or are smart enough to use separate blockchain addresses (unlikely if you ask me). On the other hand, one YouTube livestream playing some Musk talk and boom, dozens of thousands of dollars minimum. YouTube's algorithm really likes to push livestreams with thousands of views.
- vmception 5y ago
  There are a bunch of more consensual opportunistic things happening, people launch “Charity tokens” all day with trading taxes built in where the tax is actually sent to Ukraine government addresses Even the least cynical traders notice that only a fraction of a single digit percent of the money being thrown around is being sent to Ukraine, but its actually happening and people do love to flip newly launched tokens I avoid them because they could rug (remove liquidity, or be backdoored), but otherwise they are providing an effective form of entertainment where proceeds go to charity, better than the charities are
pizza 5y ago
Well, well, well.. the Red Cross was hacked by an APT (linked to Iran by the FBI) just about 2 months ago and 500K email addresses were stolen. Any link here? https://www.icrc.org/en/document/cyber-attack-icrc-what-we-know https://www.icrc.org/en/document/cyber-attack-icrc-what-we-k... https://krebsonsecurity.com/2022/02/red-cross-hack-linked-to-iranian-influence-operation/ https://krebsonsecurity.com/2022/02/red-cross-hack-linked-to...

73 points by News-Dog 5y ago

These scams are so common on both Facebook[1] and Twitter[2]. I have a large following on both, copying my logo and header image. Then pretend to be me and ask for bitcoin donations. I asked Twitter and FB to verify my account, but they refused, saying that I am not famous enough. So now these scams are going on. I am tired of these social media scams and the lack of control by FB/Twitter. Here is how scam looks or works as they send DMs to followers[3] [1]https://facebook.com/nixcraft https://facebook.com/nixcraft [2]https://twitter.com/nixcraft https://twitter.com/nixcraft [3]https://imgur.com/a/WJ7TPrZ https://imgur.com/a/WJ7TPrZ

deleted 5y ago
[deleted]

tromp 5y ago

They could have made it look more legitimate by sending multiple fake donations there. https://www.blockchain.com/btc/address/364fYEU6U4D8zt4EG2oxVZcYo2ovGYZioD https://www.blockchain.com/btc/address/364fYEU6U4D8zt4EG2oxV... shows only one ~$40 donation, which may or may not be fake. On the other hand, I guess they're only targetting the gullible, who aren't expected to check the donation history anyway...

amelius 5y ago
How would a benevolent party receive their first BTC donation, though, if everybody was that skeptical?
- can16358p 5y ago
  There will always be people who are at the less-skeptic end of the spectrum. And some actually _want to be_ the first, giving them (the illusion of) exclusivity.
- 3np 5y ago
  By sharing it over a trusted channel (like their website, a well-known social media profile, or an AFK interaction) or cryptographically signed with a trusted key. Certainly not by sending it in unsolicited emails or DMs.
- saalweachter 5y ago
  Hell, "use a fresh address per marketing campaign" sounds like analytics 101, so you know if email blasts are worth the effort over just throwing up something on Twitter every N days/hours.
  - vmception 5y ago
    use a fresh address per recipient. the sender can still get the total balance from that set of addresses for the marketing campaign analytics
- tenuousemphasis 5y ago
  The Ukrainian central bank shared their crypto addresses on their Twitter and received tens of millions worth of donations.
vmception 5y ago
They dont have to be reusing addresses There is no reason to, except some wallets make it hard for the user to switch addresses All clients give the user infinite addresses down a tree, so a script creating emails could easily move down the index for each recipient

can16358p 5y ago

Got a similar scam after Ukranian Government started accepting donations. The (fake) email allegedly came from CoinDesk (of course from a completely fake email address), telling to support Ukrania, with a picture of the original tweet with the donation addresses switched to attacker's, which is also on the email. Scam on itself is one thing. Scam abusing a sensitive topic like donating to people in need... this is just disgusting.

willcipriano 5y ago
We need a way to associate bitcoin addresses with domain names so users will send to ukraine.ua or similar. It's not perfect but humans have no hope with long random strings.
- tough 5y ago
  that's what .eth domains do with ENS no?
  - can16358p 5y ago
    There are other problems with ENS though, it's not completely decentralized. But yes, that would cover some of the issues, yet scammers will still find ways to scam the less-tech-savvy ones.
    - tough 5y ago
      Yeah I'm tech savvy and it's a fuck fest of scam DM's I get both on twitter (For having an .eth domain on my username) and discord (whenever i join a NFT/DAO/web3 project... I mean I can deal with it, but is easier when you buy almost nothing. I know this stuff and yet sometimes I almost get scammed.
- woodruffw 5y ago
  Isn’t a naming authority exactly the kind of thing that cryptocurrency people deride as centralization?

sharperguy 5y ago

Bitcoin really needs some kind of SSL or way of getting a verified address from a particular organisation or person. Raw addresses encourage address reuse, which is already problematic for the bitcoin ecosystem. Add on top of that the fact that there is no authentication, there really needs to be a solution. An alternative that exists today would be LNURL, which is simply an HTTPS protocol that will generate an lightning invoice, however lightning itself doesn't have wide spread use yet.

MereInterest 5y ago
This would require some level of trust, which Bitcoin and the cryptocurrency ecosystem are pathologically avoidant of. Every one of cryptocurrency's problems, from the massive electrical cost to the irreversible transactions to the permanent auditable record of all transactions, could be avoided by the existence of a trusted intermediate. Societies grow strong on the basis of trustworthy and trusted institutions. Cryptocurrency has neither, and pays the cost of inefficiency with every hash.
- PretzelPirate 5y ago
  > This would require some level of trust, which Bitcoin and the cryptocurrency ecosystem are pathologically avoidant of. This is a misunderstanding of the blockchain community. They understand that trust is important and even required in many situations. The idea in blockchain is that you should decide who you trust and to what degree you trust them. For the scenario of figuring out if an address is really owned by the Red Cross, people are interested in the idea of Decentralized Identity where cryptographic attestations are stored on-chain about an address. Someone can choose to trust those attestations (by following a larger web of trust through attestations), or They can choose to trust some other source. Blockchains are about choice and not being forced to trust any specific entity who hasn’t gained your trust simply because you’re told to.
  - MereInterest 5y ago
    If that were the case, then blockchains would be implemented akin to GPG's web of trust. You could choose who to trust, and based on a level of trust, whether you would trust their trusted contacts. Public-key cryptography is about being able to choose who to trust. Blockchain is about never trusting anybody.

ourmandave 5y ago

“Unfortunately, any time there is an emergency or a disaster, we saw this with COVID, people start thinking of ways they can take advantage of the situation,” said Rasor. “It's horrible to think of, but it happens every time there's a disaster.” To help ensure you’re not giving money to a criminal, don’t click on links from people you don’t know. You may get a legitimate-sounding solicitation over the phone or via text. Keep in mind, that person may not be who they say they are. Independently go to that nonprofit’s website to confirm who you’re giving your money to. Don’t let someone talk you into donating through gift cards or wire transfers. If you can, use a credit card. It carries some additional protections. “What I would recommend is that you give with your heart, but you also give with your head,” Scally said. https://www.nbcdfw.com/news/nbc-5-responds/how-to-donate-to-ukraine-relief-efforts-ensure-your-money-is-safe/2906916/ https://www.nbcdfw.com/news/nbc-5-responds/how-to-donate-to-...

jacquesm 5y ago

Tons of them, also lots of attempts to impersonate Ukrainian prominent individuals. Be careful about all accounts created during or after Feb. 2022 and anybody soliciting donations.

ls15 5y ago

I get a unknown certificate issuer warning on Tor browser for https://redcross.org.ua/en/donate/ https://redcross.org.ua/en/donate/ which seems to be the official domain.

hamiltonians 5y ago

None of these donation scammers are making any money. empty wallets or peanuts. The big $ is in those fake crypto giveaway livestreams on youtube. In a single month scammers combined earned as much as all ukraine crypto donations, about $30 million, and do it month after month unstopped . greed is more profitable than generosity.

input_sh 5y ago
My experience as well. Any scamming operation in people's inbox and either the operators are earning nothing or are smart enough to use separate blockchain addresses (unlikely if you ask me). On the other hand, one YouTube livestream playing some Musk talk and boom, dozens of thousands of dollars minimum. YouTube's algorithm really likes to push livestreams with thousands of views.
vmception 5y ago
There are a bunch of more consensual opportunistic things happening, people launch “Charity tokens” all day with trading taxes built in where the tax is actually sent to Ukraine government addresses Even the least cynical traders notice that only a fraction of a single digit percent of the money being thrown around is being sent to Ukraine, but its actually happening and people do love to flip newly launched tokens I avoid them because they could rug (remove liquidity, or be backdoored), but otherwise they are providing an effective form of entertainment where proceeds go to charity, better than the charities are

pizza 5y ago

Well, well, well.. the Red Cross was hacked by an APT (linked to Iran by the FBI) just about 2 months ago and 500K email addresses were stolen. Any link here? https://www.icrc.org/en/document/cyber-attack-icrc-what-we-know https://www.icrc.org/en/document/cyber-attack-icrc-what-we-k... https://krebsonsecurity.com/2022/02/red-cross-hack-linked-to-iranian-influence-operation/ https://krebsonsecurity.com/2022/02/red-cross-hack-linked-to...