17 ms·
USPS text scammers duped his wife, so he hacked their operation
- RockRobotRock 2y agoOpps wanted some initiative, blew up their entire quadrant
- localghost3000 2y agohttps://archive.ph/jm2h1 https://archive.ph/jm2h1
- dredmorbius 2y agoAbove was to the originally-submitted Wired article link. Mods have since changed the URL.
- ianhawes 2y agoCongress desperately needs to carve out an exemption in the CFAA for situations like this.
- bluGill 2y agoI don't want an exception - there is too much potential for someone innocent to be framed and attacked. I want the FBI and CIA to be given more funding to track this down. Sometimes the CIA will need to attack scammers like this because there is no diplomatic option, but not random people outside of them. (The FBI being limited to the US should take everything to court)
- asynchronous 2y agoI think this would be a great opportunity to contract private firms and companies to do exactly this. It’s not law enforcement work, so it fits perfectly.
- rightbyte 2y ago> Sometimes the CIA will need to attack scammers like this because there is no diplomatic option Oh please no. Don't give them ideas.
- advisedwang 2y ago[flagged]
- seany 2y agoWhen "auditors" no longer have a job then ACAB will go away. This will never happen.
- haliskerbas 2y agoI don’t think so. It has more to do with police brutality, unnecessary use of force, power tripping and ego, murdering of unarmed civilians sometimes children sometimes people in their own home, etc. than specific details about investigation of fraud. The bar is still very low of what we can expect of our “civil servants”.
- deleted 2y ago[deleted]
- chocolatkey 2y agoHere are the original posts themselves, probably more interesting to people here: https://blog.smithsecurity.biz/hacking-the-scammers https://blog.smithsecurity.biz/hacking-the-scammers https://blog.smithsecurity.biz/systematic-destruction-hacking-the-scammers-pt.-2 https://blog.smithsecurity.biz/systematic-destruction-hackin...
- arresin 2y agoAppreciated thanks
- ramathornn 2y agoLoved that, thanks for sharing! Very cool to see the step by step process.
- Ozzie_osman 2y agoHilarious. Exposing an LFI to view things like /etc/passwd and server logs, and a SQL injection in a PHP stack... I prob wrote code like this, when I was a 15 year-old self-described "webmaster" in 2002.
- Ozzie_osman 2y agoActually, I'm not that far off. > The creator is a current computer science student in China who is using the skills he's learning to make a pretty penny on the side.
- Scoundreller 2y ago> Michael Martel, a national public information officer at USPIS, says the information provided by Smith is being used as part of an ongoing USPIS investigation and that the agency cannot comment on specific details. Oh, they 100% can. There's a US Constitution thing allowing them to comment on things. They just chose not to comment because they don't want to.
- gamblor956 2y agoIt's not a constitutional issue. They're not commenting about an active investigation because they're still investigating and public comments can interfere with the investigation.
- delfinom 2y agoNot sure why they are bothering. The US can't touch some scammers operating out of China.
- bluGill 2y agoIf it is China the US probably can touch them - China is afraid of a trade war and so once presented evidence of who is at fault China will stop it. (so long as evidence doesn't exist China might know and perhaps even encourage it, but once evidence exists they will stop this). It is probably but not a sure thing. If they are in Russia or North Korea there is nothing the US can do (other than CIA or military operations) and so the scammers will get away with it.
- ianhawes 2y agoChina will not extradite Chinese Nationals (the US has the same policy). China will not prosecute their own citizens for crimes committed outside their borders (unlike the US).
- aragonite 2y ago> China will not prosecute their own citizens for crimes committed outside their borders Not true (not as a matter of principle). There was a high profile case in which murder suspects who fled from Japan back to China were caught & executed.[1] [1] https://zh.wikipedia.org/wiki/%E7%A6%8F%E5%86%88%E7%81%AD%E9%97%A8%E6%A1%88 https://zh.wikipedia.org/wiki/%E7%A6%8F%E5%86%88%E7%81%AD%E9...
- janalsncm 2y ago> The Smishing Triad network sends up to 100,000 scam texts per day globally This should not be possible. I guess the iMessage scams used e2ee, but the SMS scams should have been caught. It would be great if there was law enforcement that competently handled cybercrime, or at least triaged it. More broadly, and at the risk of creating another TLA, the US needs a Blue Team version of the NSA. In other words, identify critical infrastructure, figure out how it can be hacked, and require that companies fix the issues. Use national security if need be. Banks have to undergo stress tests to prove they are solvent, there is no reason that critical infrastructure should be able to leave their doors unlocked.
- mcmcmc 2y agoCongrats, you’ve proposed the already existing Cybersecurity & Infrastructure Security Agency
- shiroiushi 2y agoDid he? He said: >It would be great if there was law enforcement that competently handled cybercrime, or at least triaged it. [emphasis mine] I'm not sure CISA fits that definition.
- 8organicbits 2y agoCISA isn't even a law enforcement agency [1]. The parent was presumably talking about the second paragraph. [1] https://www.cisa.gov/news-events/news/looking-back-chart-our-path-forward https://www.cisa.gov/news-events/news/looking-back-chart-our...
- barryrandall 2y agoIf CISA is producing a deterrent effect, only LIGO can measure it.
- fullspectrumdev 2y agoSpam filtering for SMS is still not particularly broadly implemented by network operators apparently. I remember during Covid there was a few startups in that space trying to work with MVNO’s to get a foothold in the market, but don’t think any of that went anywhere.
- Joker_vD 2y agoCan you be prosecuted for hacking cybercriminals back? Because I am pretty certain that you, if you had something stolen from you, are not actually allowed to break and enter the thief's house, take your stuff back and leave, and you're definitely not allowed to make a copy of keys for their locks while you're at it.
- langsoul-com 2y agoIt's pretty grey, there's the computer abuse act or w/e. But it's quite selectively enforced. I don't the US gov is gonna go after him for hacking a scam group AND he provided details to the authorities. Now, if he hacked them and used the stolen credit card details? Who knows.
- Joker_vD 2y ago> hacking a scam group AND he provided details to the authorities So cyber-vigilantism is technically illegal but the authorities will tacitly pretend it is not, when it suits them fine, probably.
- _heimdall 2y agoAre you proposing that every law on the books should be enforced every time anyone breaks it?
- digging 2y agoI say no, but I'd also prefer laws that are more written for more specific application. If a human can make the call that "it's not right to apply this law here; doing so would lead to more lawlessness," so can a penal code. And giving much discretion to the humans enforcing law leads, more often, to undesirable outcomes (eg. "by random chance wink wink, this law only seems to get enforced against Black people").
- kelnos 2y agoIf not, then why do those laws exist? Either we're ok with those sorts of actions, and we should repeal the laws, or we're not, and we should enforce them, equally and universally. Anything less leads to biased enforcement.
- 0xEF 2y agoI hate that it kicks off with "DISCLAIMER: This is not my work. I would never and don't condone illegal hacking of scammers" You know what? I do. We all should. These scammers are awful people and deserve to be attacked. I am tired of toothless authorities like CISA and the alphabet agencies in the US doing next to nothing about it unless some YouTube scam baiter does the work for them. Scammers destroy people, not just financially, but emotionally as well, even driving some victims to suicide. As far as I am concerned, any wannabe hacker out there should be using these scammers for target practice.
- peepee1982 2y agoDisclaimers exist for legal reasons, not for moral ones or a personal opinion. I think we all agree that hacking scammers is a net positive for society.
- prepend 2y agoI don’t think disclaimers really work. I think it’s just urban legend that they do. I find it hard to believe if some scammer is hacked and the evidence shows the hacker learned everything from solely this video then this disclaimer won’t mean anything legally. I think disclaimers are just a bit of noise that people put in out of an abundance of caution.
- lolinder 2y agoOut of curiosity, are you a lawyer or is this comment missing the IANAL disclaimer that is customary when opining about legal matters? At least some disclaimers aren't just noise—they add context that would otherwise be missing to help the reader navigate the subtext. The "this is not my work" portion of that disclaimer is highly relevant and useful information for interpreting the blog. The afformentioned IANAL disclaimer helps readers to understand whether your opinion has any stronger basis in law than their own. I also strongly suspect that some disclaimers would have legal value in the event of someone misusing information being dispensed, but IANAL.
- happymellon 2y agoWhat's quite interesting about this is the iMessage integration, as this is a good example that directly contradicts Apple supporters claims on this very site.
- johnisgood 2y agoWhat are their claims? But yeah, there is a lot of fanboyism going around, be it Apple or Rust.
- kubectl_h 2y agoCan you enumerate the claims you are claiming are directly contradicted?
- wizardforhire 2y agoHeres my off the cuff take on law enforcement not going after scammers to the fullest extant that I think we can all agree they should… The US has roughly 340 million people now. The US gdp is roughly 28 trillion dollars. Which means that on average the dollar value per citizen is roughly 82 thousand dollars… Divided by days in year, hours and minutes its roughly 15 cents per minute. So if we assume 100% of the population is getting at least one scam a day of some sort and that the disruption to thought to get back on track as result of the anger induced is about 30 minutes… That puts the loss to the US at little over 1.5 trillion dollars in lost productivity. The US currently spends roughly 840 billion on defense… So almost twice the yearly national defense budget is potentially lost to scams. Seems crazy, as I said off the cuff. I would love to see some way more accurate numbers. But arguing in dollar amounts I think will go a long way to putting the problem in perspective. And who knows, maybe we’ll get to some drone strikes on scammers in our lifetime.
- mylastattempt 2y agoIt's illogical to calculate the thing you are looking for, but lets run with it just for the sake of it. Let's go with your "one scam a day". The person then has to see it, choose to read it and then act on it (delete/ignore/get scammed). Not even considering the practical effects of receiving 4 before lunch, and none getting past spam filters the rest of the week. Then you come up with 30 minutes for each individual scam? If it evens goes trough the above mentioned phases, nobody is non-profitable for a full 30 minutes, for every scam attempt, every single day of the year. Using your 15 cents per minute, we could stick with just a minute of lost value. That translates into 340 000 000 * $0.15 * 365 days = 18 billion. Still a totaly useless number because it's impossible to measure, but at least much further from 'ridiculous' than 10% of the GDP you came up with.
- dgfitz 2y agoYou just didn’t like the comparison to the defense budget, let’s call a spade a spade here.
- Fokamul 2y agoNoticed the salt used for encrypting password, in the writeup? "wangduoyu666!.+-" Whoops, this looks like username -> wangduoyu666 (same for "wangduoyu8", "wdy666666". Seems like they're incrementing numbers in username too, but probably false positives, maybe popular username) Google it. Probably skid's github, linkedin, etc. (not verified) And looks like OP missed this. Also name on telegram is fake of course, Wang Duo Yu is singer in China, so skid is using singer's name as username and also as a full name in Telegram. Ps.: From their backup telegram, also "wangduoyu12" Ps2: From OP write up -> https://t.me/wangduoyu0 https://t.me/wangduoyu0 -> there is youtube channel https://www.youtube.com/@duoyuwang4820 https://www.youtube.com/@duoyuwang4820 which links in description to this telegram channel wangduoyu0 And it's full of videos of someone making tutorials to bypass china firewall? etc. Multiple 30min-1hour videos, there must be treasure trove of info. Videos is leaking these gmail accounts: https://i.imgur.com/LUiKbF6.png https://i.imgur.com/LUiKbF6.png
- yorwba 2y agoHow do you know these are all the same person, instead of different people with the same name, or independently using the name of a singer they like?
- Fokamul 2y agoYes it is possible. But github wangduoyu666 is full of wannabe hacker repos. I will edit the post.
- Fokamul 2y agoPs3: Leak from ytb videos, list of Wifi networks https://youtu.be/FnKbBmdQuIk?si=NPzl7tExHOhc3Gad&t=2929 https://youtu.be/FnKbBmdQuIk?si=NPzl7tExHOhc3Gad&t=2929 https://i.imgur.com/zJsbJZ5.png https://i.imgur.com/zJsbJZ5.png Heh, in the newest video he basically shows how to setup the BT5 panel and fake website from the writeup :) https://www.youtube.com/watch?v=2fdmVsqeQ1Q https://www.youtube.com/watch?v=2fdmVsqeQ1Q All info I've gathered from videos: Knjfatemaa@gmail.com (Cloudflare account) Username in Mac: wenziguo Telegram @DockerWang gentleman.yu2013@gmail.com yuzhiwen2017@gmail.com wangtian1888@gmail.com tangzhongwei1993@gmail.com beegoservice2012@gmail.com
- forinti 2y agoWhen I have the time, I like to script an attack on phishing sites by posting false data. The idea is to fill their databases with trash, and make it more difficult for the criminals to weed out real data entered by victims.
- thedanbob 2y agoI almost did this the other day when I got a fake Docusign phishing email. Unfortunately, I found that the webpage it led to was sending collected credentials to an apparently innocent but hacked third-party wordpress site, which I assume forwarded the info elsewhere. I didn't want to waste the third party's bandwidth so I used their contact form to explain the situation. Didn't expect a response, but I just checked and they fixed it!
- prmoustache 2y agowe need a new phone/text messaging infrastructure that prevent number spoofing AND force operators to filter out scams attempts.
- bell-cot 2y agoTrue. But neither "our" government, nor the corporations maximizing their profits in the current dystopia, give more than a lip-service sh*t about doing that.
- coldpie 2y agoAt least for people in the US, the solution is simple: make internationally-sourced communications opt-in. By default any calls or texts originating from a non-US carrier will be dropped. Then, any spam coming in must be from a US entity, and can be investigated & prosecuted. People who do need to receive internationally-sourced communications can turn it on with their carrier. While they'll still be at risk of receiving spam, the value of sending that spam in the first place will go way down because the vast majority of it will just get dropped. It's an easy solution, and it solves call/text spam for everybody.
- bluGill 2y agoI'm reasonably sure that countries like France will sign a treaty to not allow spoofed numbers in this way. They don't want to be a source of scams anyway and so will do their part to prevent them. The details of this matter of course, but France should be an easy automatically opt-in. (I picked France because I can spell it, there are several dozen others that I'm confident can be in the automatic opt-in list as nothing from them is a scam)
- hobs 2y agoI have never once got a spam call from an international number, just local numbers. So your plan doesn't work when some local proxy is happy to take the traffic.
- vel0city 2y ago
- batch12 2y agoOne wife is enough I guess
- speed_spread 2y agoThat's the title of the next James Bond movie
- merek 2y agoI recently came across NanoBaiter on YouTube. He baits scammers and hacks their systems, often disrupting their entire operation. He identifies the culprits in detail, scares the hell out of them, reports them to police, and tries to inform / refund the victims. In at least one video, he accesses the scammer's Stripe account and refunds the victims (often elderly) for their payments on bogus IT security products. I recall another video where gains access to the CCTV in the scammer's office building, and captures a police raid on the scammers. https://www.youtube.com/@NanoBaiter https://www.youtube.com/@NanoBaiter
- ChrisMarshallNY 2y agoI've learned to leave hackers and scammers alone; no matter how much they piss me off. Most of them are quite capable of delivering a nasty counterattack. Some, IRL. Had a friend hack a spammer that hijacked his server, and they blasted his server into LEO.
- spydum 2y agodefinitely this..you are messing with a group of folks, and potentially stopping their flow of money. unless you have great opsec, you may just cause problems for yourself you dont want. personally never heard of it escalating beyond online attacks, but it's not worth the drama imho
- Fokamul 2y agoYes, since the guy who made the writeup, has exactly 0% opsec. -> ridiculous. But I would be more scared of 3letters.
- ChrisMarshallNY 2y ago> never heard of it escalating beyond online attacks Krebs gets SWATted.
- insane_dreamer 2y agoAnd the bigger the operation, the more $ is at stake for them and the more resources they have to allocate to stopping you and/or revenge.
- VikingCoder 2y agoRemember *69? You'd get the phone number of the person who just called you? (Theoretically - it didn't always work.) How in the hell do we not have a trivial "report a scam" option on phone calls and text messages? Which reports it to the FTC or FBI or something?
- shkkmo 2y agoThe easier reporting becomes, the more the average quality of reports decreases. So making reporting easier is good only if you already have atleast sufficient resources to process and follow up on the current report volume. My understanding is that we don't currently have enough resources dedicated to handling the reports we do get of people who got scammed. If that is the case, then making it easier to report potential scams doesn't help until we increase the resources for tracking down and stopping scammers.
- VikingCoder 2y agoYou really think the quality of bug reports go down the easier it is to report bugs? I find when I can send feedback in a way that captures enough context that the resulting bugs are very high quality. If I could report a call from a scammer in such a way that the investigator heard the entire conversation...? I think that would be incredibly damning.
- LinuxBender 2y agoThe numbers are spoofed via private SS7 links connected to messaging platforms, VoIP systems, etc... SS7 was designed to be an entirely closed trusted telco controlled network so there is no security. The only solution I can think of would be to get rid of all the SS7 to mapi gateways and force all cell phones to use internet based secure routing over RCS or preferably something better and also ensure that phones are not allowed to do spell check over the wireless carrier VPN. That would be a world wide project and requires cooperation from every nation. Either that or make specific countries walled gardens blocking all SS7 messaging and just accepting some things will break. I fully support breaking things that are already fundamentally broken. I would personally prefer direct phone to phone true E2EE taking the carriers, Apple and Google out of the picture even if there is some friction. It should be a physical phone-to-phone sync of sorts so you smack each others cell phones together, high five, do the hokey pokey and now you are E2EE with no layer 7 servers in the middle instead talking to a L4 VPN router that only knows how to connect one VPN to another over UDP. Everything else performed entirely by the phones using a different encryption cipher, hash, key, etc... Maybe using QUIC. For people that can't tap phones together maybe a fallback option for QR codes over video chat so you know you are syncing with someone you know, AI fakes excluded.
- paul7986 2y agoAmazing over 400K people entered their credit card information.. mind boggling to me yet like all to most of us here we just about ignore every phone call and text message not from someone already in our contacts. I always thought there should be a driver license and test to use the Internet to cut down on people being ignorant. As well or a class you must pass in high school that teaches ignore all phone calls, text, emails and etc from people you have not met offline. If you do meet them online make them snap or facetime you fairly quickly to verify veracity.
- UncleEntity 2y agoMy Great-Aunt got scammed out of something like $30k back in the late 80s and all she had was a landline...
- jeffwask 2y agoI wonder if these are the ones I constantly get saying I have a package at USPS and they need info but the texts all originate from an international number, so they are obviously fake to me.
- idunnoman1222 2y agoHow come vigilanteeism is accepted for computer related crimes but not other ones?
- deleted 2y ago[deleted]
- cvoss 2y ago> The creator is a current computer science student in China who is using the skills he's learning to make a pretty penny on the side. There's a strong argument right here for teaching technology ethics as part of a typical CS curriculum. I'm not saying that would have stopped this student from making his own unethical choices, but it does highlight the fact that we equip people with these really powerful technical skills, but we don't even try to equip them with the ethics to be responsible about it. We just sort of hope they were raised right, I guess. Anyone here have experience with a curriculum that includes the ethics aspect?
- signalToNose 2y agoNot ethics per se but all students at university in Norway take basic philosophy https://en.wikipedia.org/wiki/Examen_philosophicum https://en.wikipedia.org/wiki/Examen_philosophicum
- bix6 2y agoThe Markkula Center at SCU is fantastic. https://www.scu.edu/ethics/about-the-center/center-news/integrating-ethics-into-undergraduate-computer-science-education/ https://www.scu.edu/ethics/about-the-center/center-news/inte...
- mlavrent 2y agoThe Brown CS curriculum has in the past few years started including “socially responsible computing” material across intro and non-intro level courses. See https://responsible.cs.brown.edu/ https://responsible.cs.brown.edu/
- dgfitz 2y agoWhy does it have to be social? Why not just “responsible computing” instead?
- TimedToasts 2y agoYou know why
- hot_gril 2y agoI used to get frequent iMessages that look just like this, except with links to a different domain name. Last one was July 21, linking to https://us-usps-mg.top/us https://us-usps-mg.top/us Seems it's no longer active. If I send "Y", the message is not delivered. The domain points to 404 on a "King Ice" website selling jewelry shaped like guns or penises, I'm not joking.
- smm11 2y agoI broke into VT-100 terminals (the real ones, not the modern terminal app derivative) at my university library over 40 years ago. Can't tell you how, it's been a minute.
- OfficeChad 2y ago[dead]
- wdb 2y agoWhy are they not accepting a whole bunch of credit card (types)?
- rererereferred 2y agoI got one of these texts just last week. In Spanish and pretending to be my country's national postal office. Also using a .top domain. What's freaky is I just got a package through the post office a few days before. These guys are maybe accessing package tracking tools looking for phone numbers. I would expect that's not heavily secured data. Edit: I reported the domain to the registrar and they took it down.