Become a fan of Slashdot on Facebook

 


Forgot your password?
Close
typodupeerror
×
Security

Hackers Track Down Banking Fraud 335

Posted by jamie from the white-hatted-detectives dept.
An anonymous reader writes "Noticing some commonalities in the spam flooding their email in-boxes, a small group of hackers set out to track down who was responsible. Along the way they uncovered a trail that led them to an organized gang of criminals halfway around the world, and right back to some of the largest financial institutions in the US, and their customers, that became the gang's prey. See the SecurityFocus story for more details."
This discussion has been archived. No new comments can be posted.

Hackers Track Down Banking Fraud More

Hackers Track Down Banking Fraud

Comments Filter:

  • Yet more proof... (Score:3, Insightful)

    by Qweezle ( 681365 ) on Friday November 14, 2003 @08:32PM (#7478338) Journal
    ...that most hackers are just out to do good. The stereotype that hackers have gotten is ridiculous, and largely due to a few notable individuals who do malicious things(steal credit card numbers, etc.), and I believe that hackers are a primary security measure of the society of the internet.

    Think of them as citizen-cops, they find the bad things and patch them, report them, these are the guys who we should praise, not put down. God Bless the white hat hacker.
    • "It takes one to know one". Any sucessfull hacker knows how a hacker goes about caseing/looking at a prospective system. So, such an individual knows the ways to make a system less appealing/suseptable to such attacks. Some of the best network security experts are 14y olds with nothing better to do (yea, I mean no life). The good majority of them know more than the high payed 'security consultants' who were born 'pre-internet'.

      Atrox

    • Re:Yet more proof... (Score:5, Insightful)

      by Narphorium ( 667794 ) on Friday November 14, 2003 @08:59PM (#7478521)
      ..that most hackers are just out to do good.
      I don't think you can classify the hacker mentality as generally good or generally bad. It's about a knowledge and problem solving, which can be either good or bad.

      You're much better off using the black|grey|white hacker classes, although even that can be fuzzy at times.

    • I think the problem is that most people don't and wouldn't know the difference between a hacker (or cracker) and script-kiddies

      Script-kiddies don't investigate code, don't investigate complex systems for flaws, and have no insight in what they are doing. However they do download pre-made tools, and try them on every system & website they can find.

      These guys do the most (quantity not quality) damage and make hackers look so bad

    • Re:Yet more proof... (Score:3, Insightful)

      by Kenja ( 541830 )
      No, they find the bad things, root around, do what ever they want and then claim to have only patched them. Its like comming home to find a plumber in your living room saying he fixed the sink. If he was not invited in your home he should not be there.
    • I'm going to make a showing of good faith and splay open all of ports like a pr0n star... ...not!

    • Knock it off please (Score:3, Insightful)

      by Anonymous Coward
      Insightful? "Most hackers are out to do good." Take a deep breath and let it go...

      We lost control of the word "hackers" a long long time ago. It has been more than 10 years since the horse left the barn, stop whining about the open gate.

    • This is not what you'd normally call a "hacker" (Score:5, Interesting)

      by 0x0d0a ( 568518 ) on Saturday November 15, 2003 @04:02AM (#7480274) Journal
      This isn't exactly someone who ran out and did something positive securitywise out of the goodness of his heart. It isn't even data from someone who works in security and ran out and did something on the side.

      This entire linked-to-article is, frankly, an advertisement. It's an advertisement to try to get people to buy security consulting services from this company. Impressively, this company managed to get the story on Slashdot. It's a sample report (you can figure this out early because of the number of tables and screenshots). (Silly execs love tables and pictures -- be sure to include lots if you're ever in a vending situation, even if they provide little useful content.) Other red flags include the fact that it's aimed at financial services (folks who have lots of money), and focuses on flaws in what Citibank is doing (with the implicit suggestion that this company could help them). Especially notable is the fact that if focuses on flaws in Citibank's behavior even if said behavior is not particularly relevant to the scam, such as the format of Citibank's emails. Are customers going to notice or care whether Citibank emails contain unique identifiers -- *not* hashbusters? No, though a security consultant who focuses on spam would.

      Then they have the nice little blurb at the bottom about the company.

      Frankly, they missed one important aspect. You can't sell anything to a company unless you can provide a measure of how much the company can save. They should run out and get a ballpark estimate on how much Citibank could potentially, worst-case, lose from this. They subtract proposed consulting fees and end up with a nice fat number.

      The reason I find this advertisement vaguely disturbing is because folks like this are just another leech feeding off of fat, stupid corporations. Lots of consultants already do so. However, what these folks do *sounds* good but has little point. It's not financially feasible for a company to pay a small private army of techies to try to track down random Russians so that legal nastygrams can be sent to them (keep in mind that the firm didn't actually *identify* who the spammers were). There are too many potential baddies out there. A financial services corporation would be *far* better served by developing secure communication policies and technology that are *easy* to use for the consumer, and then spending money educating their customers about these. Then they become difficult to attack. To go after individual bad guys is like plugging holes in a dyke -- very profitable for the guy being paid to plug holes, but ultimately ineffective.

  • Hackers eh? (Score:4, Funny)

    by Anonymous Coward on Friday November 14, 2003 @08:34PM (#7478363)
    These hackers need to be prosecuted. This is unacceptable.

  • Hackers (Score:4, Interesting)

    by Veovis ( 612685 ) <cyrellia@gmail.com> on Friday November 14, 2003 @08:35PM (#7478370) Homepage
    Its about time the "hacker" community gets some positive news, just one more step to remove the "cyber-terrorist" label the news/media has created

    • not so fast... (Score:3, Insightful)

      by No Such Agency ( 136681 )
      Ten to one this story never reaches even the back page of the paper. Citibank refuses to even admit that anything happened (if I read the article correctly) and the average reporter would find most of this account incomprehensible. Until the Marines burst into the Russian Credit Card Theives' base and rescue the pretty blonde army woman they've been imprisoning there, this isn't "news" by a long shot, and the corporate media will continue to say hackers = criminals, because that's the story that is most e

  • Congradulations to them (Score:4, Insightful)

    by Elpacoloco ( 69306 ) <elpacoloco&dslextreme,com> on Friday November 14, 2003 @08:36PM (#7478385) Journal
    If computers ever fails you economically, welcome to law enforcement.

    Seriously, law enforcement needs much more of this. I can't name the last time I met a cop who understood computers at all.

  • Skipping English Class (Score:3, Funny)

    by cscx ( 541332 ) on Friday November 14, 2003 @08:37PM (#7478389) Homepage
    One would think that if you want to run a successful scam that looks like it came from a legitamate source, you wouldn't word e-mails like

    "and PIN that you use on ATM."

    "becaurse some of our members no longer have access to their email addresses and we must verify it" (misspelling / run on sentence)
    • There is a possibility that the high immigrant [cis.org] population here would not notice those errors. And that's not counting the illiterate population, nor those who choose to mis-speak English.
    • Yes, but these folks are from overseas. Most likely english is a 2'nd language (Not bad considering that most americans barely speak one, let alone two).
      Overall, I would guess that they were successful
      • they hid their true ID.
      • Most likely, they did get info otherwise these folks would have stopped.
    • "...One would think that if you want to run a successful scam that looks like it came from a legitamate source, you wouldn't word e-mails like..."

      So are you one of the scammers? ;)

  • Cliff Stoll (Score:5, Interesting)

    by SuperBanana ( 662181 ) on Friday November 14, 2003 @08:38PM (#7478395)
    Noticing some commonalities in the spam flooding their email in-boxes, a small group of hackers set out to track down who was responsible. Along the way they uncovered a trail that led them to an organized gang of criminals halfway around the world, and right back to some of the largest financial institutions in the US, and their customers, that became the gang's prey

    This reminds me of Cliff Stoll- an astrophysicist who moonlighted as a sysadmin at UC Berkley, and noticed a discrepancy of a cent or less in the CPU time accounting system.

    I won't spoil the story, but see if your local library has a copy of the Cuckoo's Egg(by Stoll). His more recent book, Silicon Snake Oil, discusses the falsities behind throwing technology(computers) at people- particularly in schools, for example...and was also quite good when it came out(and schools were dumping boatloads of $ into computer labs which sat mostly empty).

    He's humble, intelligent, well educated, writes fun to read stuff...one of the computer scientists(and physicists) I respect the most- far above all the three-letter personalities.

    • Re:Cliff Stoll (Score:2, Informative)

      by Anonymous Coward
      This reminds me of Cliff Stoll- an astrophysicist who moonlighted as a sysadmin at UC Berkley, and noticed a discrepancy of a cent or less in the CPU time accounting system.

      1) HE didn't notice it, it was handed to him as an assignment to0 get him poke around and get him used to the way their computers worked because he switched jobs to the computer department recently.

      2) It was 75 cents of computer time, not "a cent or less".

      3) He refered to the the hacker less than nicely for using computer time, but
    • 'particularly in schools, for example...and was also quite good when it came out(and schools were dumping boatloads of $ into computer labs which sat mostly empty)'

      Computer labs mostly sat empty because of the badly structured school system(s). As it is, learning how to use Microsoft Excel and Access is considered to be "advanced" with Keyboarding 101 being "basic". (Yes my school actually forced students to take that Keyboarding before letting them enter other computer classes. Needless to say, a class of

  • E-Mails (Score:4, Informative)

    by rf0 ( 159958 ) <rghf@fsck.me.uk> on Friday November 14, 2003 @08:42PM (#7478424) Homepage
    Recently I've been seen a marked increase in things like this for PayPal as well as the main UK banks including LLoyds and Barclays. People are definitly getting more aggressive to get your details.

    Also the emails are getting "smarter" in that they look more like the place and making use of the old http://www.domain1.com@www.domain2.com which for a newbie can be very easily misread

    Rus
    • It's very strange that the UK and US authorities don't seem to have been pursuing this. This isn't some legal grey area: this is clearly an attempt at fraud on a significant scale.

      If the spammers did follow through on the scam and extract money from someone's account then it should be relatively trivial to trace the money and find the bad guys. Certainly much easier than trying to find through technological means.

      Why isn't this being done?

      • Re:E-Mails (Score:3, Funny)

        by Anonymous Coward
        The US authorities are busy pursuing real bad guys:

        - the terrorist 5 year olds trying to smuggle their baby scissors onto airplanes, so they can cut up paper at their destination

        - the terrorist 12 year olds participating in filesharing, and thereby potentially violating copyright

        - the terrorist people of arabic descent trying to fly on airplanes, thereby frightening the crew and passengers by their resemblence to mideasterners

      • If the spammers did follow through on the scam and extract money from someone's account then it should be relatively trivial to trace the money and find the bad guys. Certainly much easier than trying to find through technological means.

        First, I RTFA and I am well aware that the scammers perpetrating the bank scam are Americans, and therefore the law covers them.

        However, many of these scam spams come from overseas, where we have no jurisdiction. We'd have to invade them, force them to setup a government

    • "Also the emails are getting "smarter" in that they look more like the place and making use of the old http://www.domain1.com@www.domain2.com which for a newbie can be very easily misread"

      That'd be a case of the client being dumber, and supporting this without putting up HUGE WARNING DIALOGS or (much better) just not supporting those forms of URIs at all.

      When was the last time you saw a raw hex encoded IP that was not in a misleading spam? How about the domain@domain form you mention?

      If something is use

  • Tracking down things these days... (Score:5, Funny)

    by magarity ( 164372 ) on Friday November 14, 2003 @08:42PM (#7478430)
    Along the way they uncovered a trail that led ... right back to some of the largest financial institutions in the US

    So have they been arrested and charged under the DMCA for divulging weaknesses in the financial system?

  • A fool and his money (Score:4, Insightful)

    by The Donald ( 525605 ) <Don@d[ ]ldred.net ['one' in gap]> on Friday November 14, 2003 @08:44PM (#7478438)
    If I walk up to you, and say "Hi, I'm with Citibank, we have a problem with your account, we need to verify your account number and PIN, please write it down on this piece of paper and give it to me." I'll get a punch in the mouth. Yet when the average user sees gets a call or E-mail asking for this info, it's handed over.
    • That's simply not true. The average person getting a call or e-mail asking for this info does not hand it over. One in a hundred, or one in a thousand, or one in some large number do.

      If you walk up to a few hundred thousand people and ask for their account numbers and PINs, yes, you're going to get many punches in the mouth. But you might also get an account number and a PIN, because one of the people that you walk up to is a complete idiot.

      It's not that the medium makes people stupider. It's that it'

      • Re:A fool and his money (Score:3, Interesting)

        by hazem ( 472289 )
        That reminds me of a story about a guy who would walk down the street, and any good-looking woman he saw, he would as her if she wants to have sex. He said, "sure, you get slapped several times in a day, but eventually someone says yes".
    • Well, given the fact that the page appeared to link to Citibank and indeed opened the Citibank main page behind the verification window, it'd be more like someone inside the bank wearing a Citibank jacket asking you for your account number and PIN.
      • And the front door with it's bright red "citybanc" really helps sell the scam.

        Some clues are just too obvious.


        • RTFA and look at the pictures too. Here's some help, scroll down to Figure 4:

          • Figure 4: The third revision of the Citibank trojan login, from 25-Oct-2003. A server in Moscow, Russia provides the popup but the main window actually is the Citibank home page.

    • Re:A fool and his money (Score:4, Insightful)

      by blair1q ( 305137 ) on Friday November 14, 2003 @09:20PM (#7478652) Journal
      Average?

      Hardly.

      They send out spam to 180 million people, and get maybe a few hundred suckers.

      Being in the .001 percentile is hardly "average".
    • Interesting. This happened in my town. A guy was posing as a security guard at an ATM and told people that it was out of order and that if they left their deposits with him he'd take care of it for them. Apparently he got a lot of people and was never caught.
      • Did it happen, or did you read that in "American Gods"?
      • I think I've mentioned this before, but I used to work at a bank. First floor of downtown HQ was the main branch which didn't open until some time after 8. So as we're all walking across from the parking garage, someone comes up, discovers the drive-through is closed and the ATM is down, and asks J. Random Passerby if she works there, and on getting a mumbled affirmative, shoves an envelope full of cash at her with a frantic request to deposit it when the branch opens thanks bye I'm late for work.

        The poo
    • A better analogy is if you dressed like a bank employee (minus the logo or a few other minor details), walked up to someone, handed them a bank form of some sort, and asked them to fill it out. The only difference is on the internet you dont get arrested the first time someone doesnt fall for it.

  • The scariest part... (Score:5, Insightful)

    by The Gline ( 173269 ) on Friday November 14, 2003 @08:49PM (#7478458) Homepage
    ...is that Citibank apparently didn't even care. When someone sent out spams attempting to scam people with accounts with Sony Financial Services, I contacted them about it and they promised they'd have someone call me first thing next day. They never did.

    I don't like to say this, but if they are indifferent about this sort of crime now, they are going to have no chance of fighting it.

    • Even Scarier (Score:5, Insightful)

      by retrosteve ( 77918 ) on Friday November 14, 2003 @10:20PM (#7479013) Homepage Journal

      ...Much worse than "Citibank didn't care". Look down lower on the SecurityFocus report [securityfocus.com] and you'll see that Citibank's own fraud reporting webpage appears to be compromised, they know about it, and they hadn't (as of publication date) tried to correct it. The email reply from the fraud page is itself fraudulent, and directs users to a nonexistent toll-free number or a private AOL email address, although it appears to come from Citibank's own servers!

      Also, there's a CNET article about the August 16 version of the scam, reported on August 18, 2003. The article is supposed to be here at http://news.com.com/2011-10173-5065394.html?tag=ma instry (Link) [com.com]

      But when you check that link, it first comes up, then a second or two later gets redirected to a search page claiming that the article is "expired".

      Strangely, the CNET search page (which searches on terms similar to the title) comes up with 2 flattering articles about Citibank's quality process, one dated 2002, the other dated 2000. Neither of those articles has "expired". Draw your own conclusions here.

      For those who aren't too quick on the mouse, part of the text of the "expired" article is here:

      Citibank, a division of Citigroup, said "numerous" people received the e-mail, which purported to advise them of conditions affecting their accounts.

      It said the e-mail linked to a Web site that looks like Citibank's, and asked customers for their Social Security numbers, a form of identification. Scammers can use such data to obtain credit cards or access to bank and other accounts.

      The bank urged recipients to delete the e-mail and call the customer service number on their automatic teller machine cards. It said that the company is working with law enforcement and that its systems have not been compromised.

      SecurityFocus notes that Citibank should know the exact number of people who came to their website from the fraudulent redirection, although officials there claim not to know. It also seems unlikely that Citibank's systems were not compromised, considering the email replies that came from their "report fraud" webpage.
      • As a CitiBank customer (bcksp.. erm former customer as of 5 mins ago) I was concerned with this article.

        I looked at the Citibank page for reporting fraudulent email (a stroke of genius to call it "/domain/spoof/report_abuse.htm".. boy does that make me think "official" and NOT "spoofed") and (a) it doesn't work in Mozilla (b) I'm not sure the form to report this stuff actually goes to anywhere that doesn't end in aol.com
    • I want nothing to do with a banking group that tolerates the operations of one of its susidiaries, Primerica, which is nothing more than a multi-level marketing scheme. After one of their many, many "regional vice presidents" tried to recruit me into their scheme, I cancelled my credit card with them.
    • Most large banks probably look at these things with a wink and a nod. The amount of money laundering that goes on by drug dealers, arms dealers, terrorists and other criminals must be staggering compared to spammers.

      If the banks profit they will find a way to look away. Also there is a "legal" need for corporations to shuttle vast amounts of money to and from overseas accounts to hide profits from the tax collectors all over the world. I imagine it's probably realively easy to ride that wave without being

    • Scary and sad (Score:2, Interesting)

      by Pan T. Hose ( 707794 )

      When someone sent out spams attempting to scam people with accounts with Sony Financial Services, I contacted them about it and they promised they'd have someone call me first thing next day. They never did.

      Sadly, the only thing that corporations care about today is bottom line. (This is the reason Microsoft antitrust was such a farce, by the way.) This story reminds me the story [securityfocus.com] about Kevin Mitnick testifying against Sprint in Vice Hack Case:

      [...] "to my knowledge there's no way that a computer

    • The scariest part ... is that Citibank apparently didn't even care.

      That is pretty scary.

      Something similar happened up here in Canada recently (ie, this week). I got very convincing looking mail from a spammer trying to impersonate a bank asking me for my account info (apparently they updated the system and needed to reactive my account... yeah right).

      The spammer only made two mistakes, though: He spoofed a bank that I do not, nor have ever actually banked with. So it was an obvious fraud. Plus, the tric

  • Hacking? (Score:4, Insightful)

    by Superfreaker ( 581067 ) on Friday November 14, 2003 @08:49PM (#7478460) Homepage Journal
    I wouldn't call what they were doing exactly "hacking". They simply ran some lookups and other simple discovery tools a person would use as preperation for an attempted hack. They never performed any exploits though, like actually trying to access the web server in russia to see what information they actually had...

    • Re:Hacking? (Score:3, Interesting)

      by Xerithane ( 13482 )
      Sshhh, you read the article and realized that the Slashdot summary was much more sensational. The only proof that it was a single gang is that the mis-spelling were the same. The best "proof" provided was from Cleatis.

    • hey never performed any exploits though, like actually trying to access the web server in russia to see what information they actually had...

      Maybe I don't completely understand web servers, but one question I had left from the article was "How did they get the server log files they said reported the data about hits?"

  • to be a complete pedant... (Score:5, Informative)

    by BobTheLawyer ( 692026 ) on Friday November 14, 2003 @08:57PM (#7478517)
    the 419 fraud isn't a Ponzi scam.

    A Ponzi scam is where you take money from new "investors" and use some of it to pay an apparently high return to your existing investors, grabbing the rest for yourself. Everybody's happy until (inevitably) you run out of new investors and the whole thing falls apart.

    The 419 fraud involves a promise to transfer $millions into the victim's bank account, for some trumped up and obviously rather dubious reason. At the last minute you ask the victim to pay a "transfer fee" of perhaps a few $1000. You then vanish with the "transfer fee", never to be heard of again.

    • Re:to be a complete pedant... (Score:4, Informative)

      by Dunark ( 621237 ) on Friday November 14, 2003 @09:33PM (#7478720)
      The 419 fraud involves a promise to transfer $millions into the victim's bank account, for some trumped up and obviously rather dubious reason. At the last minute you ask the victim to pay a "transfer fee" of perhaps a few $1000. You then vanish with the "transfer fee", never to be heard of again.

      The more skillful 419 scammers don't stop when they get the $1000. Once they have a sucker on the hook, they milk them for all they can get by inventing a series of ever-increasing "fees", "bribes", etc that must be paid to complete the deal. A woman who worked in a law office got scammed into shelling out about $2 million of her employer's money. The Secret Service estimates the total take (so far) for these scams at about a half billion dollars.
      • Damn, I hit "Submit" instead of "Preview", but I wasn't done yet.

        The persistent success of this scam tells me there's something very important missing from the curriculum being taught in our schools.

        • Re:to be a complete pedant... (Score:2, Insightful)

          by Anonymous Coward
          I don't know if you can teach Common Sense.
        • The persistent success of this scam tells me there's something very important missing from the curriculum being taught in our schools.

          How does one teach stupid people to shoot themselves in the head? They'd probably be too stupid to understand the hints you're giving them...
      • "A woman who worked in a law office got scammed into shelling out about $2 million of her employer's money. "

        The filter I want to put that through, is something like "Nobody is that stupid, perhaps there is more to the story."

        My guess is that the scam was more insidious than stupid. She knew the 419 was a scam. So she tried to connect her employer to the scammer, collecting some money in the middle. The plan was to make it look like her employer had fallen for the scam, presumably in hopes that the emp
  • ...so here it is for the unlucky. There were a few pictures, and text examples I removed so it wouldn't get too big, but it's mostly intact.

    ----
    1 Overview
    Not all people that send undesirable email (spam) are the same. Their motives differ as greatly as their tools and technical abilities. This document uncovers a spam gang who seeks to acquire your banking information, and the response from one of the targeted victims: Citibank.

    This document describes the unique bulk-mailing tool used for recent rash of f

  • Yikes!!! I'm glad I RTFA (Score:5, Insightful)

    by bobdotorg ( 598873 ) on Friday November 14, 2003 @09:04PM (#7478559)
    If you haven't RTFA, I suggest you do. Here's why:

    After nine years on the net, this is the first scam that I believe I might (though probably not, as I always show the address bar and look for the secure connection icon) have fell for.

    Having your web browser load Citibank's home page, and then swiping the info via a rogue pop-up is the sneakiest tactic I've seen.

    Even the link in the email appears to be from Citibank upon first glance.

    A exceptionally clever and well-crafted scam.

    • Re:Yikes!!! I'm glad I RTFA (Score:4, Informative)

      by Anonymous Coward on Friday November 14, 2003 @09:30PM (#7478704)
      This reminds me of the scam using unicode (if I remember right) in URLs, so what you think is www.PayPal.com is actually www.PayPal.com (can't tell the difference? That is the point, one of the a's isn't an "a" at all, it is another character in another language that just happens to look identical, but the ascii / unicode is very different, and of course takes you to a completely different site (though it ~looks~ like you're at www.PayPal.com the entire time)).

      Scary!
      • It was as simple as changing the trailing l to a capital i. The domain name was PayPai (capital i to make it look like an L)-- PayPaI.com. It looked similar to PayPal.com in IE's font for the address bar. I believe it looked nearly identical in many e-mail clients though (so the fraudulent link in the e-mail lpassed the glance expection), since there are many common fonts that show those two letters nearly identical to each other. BTW, notice how a capital I is the only character in the AddressBar font
      • Here's the paper by Gabrilovich and Gontmakher on the Homograph Attack [technion.ac.il] (unicode scam).

    • Protecting oneself... (Score:4, Insightful)

      by silentbozo ( 542534 ) on Friday November 14, 2003 @10:52PM (#7479178) Journal
      Surf with Javascript off. Stops spammers of all stripes from trying to exploit your browser to cover their tracks. Check e-mail with a mail client that isn't stupid (ie, outlook), and allows you to toggle HTML rendering on/off so you can examine the underlying code (even better, get a client that only displays plain text.) Get a Mac to really screw up malware.

      Unfortunately, the essential element, common sense, is what is tripping people up. Would your bank really contact you via e-mail to get your personal info? Would your bank call you up and ask for your personal info? They're your bank for chrissakes, they can get a complete profile on you just by asking the credit bureau!

      Last note - the best way to prevent any failure in mental processes is to keep the mail from reaching the user in the first place. Spamassassin has done incredibly well by me ever since I trained the bayesian feature on a backlog of scam mails. I rarely get financial scam mails, instead now I have to fight soft-pedal scams that trip none of SAs hard-coded rules, but still score a bayes_99 score. Oh well...

      • Adjust the score of bayes_99. Every few months or so, I increase the scores of the bayesian tests by 10% or so, as the training from an expanded corpus makes the bayesian scores more reliable.

        I've been thinking about implementing my own spamassassin derivative that, rather than assign scores to distinct regexps and then run through a bayesian scanner, uses the regexps matched as extra tokens for the bayesian scanner to chew on. Because the regexps would be crafted to look at certain non-tokenized data (

      • " Surf with Javascript off. "

        Generally a good idea except that there are way too many fuckups in this world who think that links should be javascript.

        • Re:Protecting oneself... (Score:3, Interesting)

          by j3110 ( 193209 )
          Hey, most of the web people browse /., we should be arguing:
          Stop using JavaScript completely!

          Of course that will break Mozilla's plans for XUL. The best thing you could do is re-invent how JavaScript works. What if pages with JavaScript required a signature? Then we could set up trust levels per site/coder. A significant enough people use Mozilla such that people would fix their sites if they wanted to use JavaScript. If you ran into a site that didn't have signatures, and ran JavaScript you could hav

  • Should design for security (Score:5, Interesting)

    by fermion ( 181285 ) on Friday November 14, 2003 @09:18PM (#7478634) Homepage Journal
    This is a really good example of why certain web and advertising techniques are just too dangerous to be in general use, and why certain web features are justified as not just ad busting techniques, but reasonable security measures.

    In this scam a pop up with no navigation and no URL box was presented to the user on top of a genuine web page. This confused the user into thinking the pop up came from citibank. Advertisers like such pop ups because it locks the user into a path specified by the advertiser and obscures the source of the ad. Some web designers like the format because they think it's looks less cluttered.

    Most modern web browser can be set will block pop up, force navigation, or always display the URL. Many advertisers whine that this is unfair. So what. What is even more amazing is that generally responsible companies, such as eBay, will create pop up screens with no URL and no navigation, thereby setting a precedence to allow such fraud.

    The same is true from images from a third party server. It is useful for advertisers to set web bugs and large scale rotating campaigns. It is even useful for websites to distribute load. It also introduces security issues.

    Which is just to say that may on /. would say that the luser should be more careful, and stupid people deserve to be swindled. But i have seen financial organizations use pop ups and third party ads to push product to their customers on the customers financial information page. This is a page that should only contains sensitive information, not irrelevant content The banks are willing to compromise security to push products. And then the banks complain that customers are to blame.

    • In this scam a pop up with no navigation and no URL box was presented to the user on top of a genuine web page. This confused the user into thinking the pop up came from citibank. Advertisers like such pop ups because it locks the user into a path specified by the advertiser and obscures the source of the ad. Some web designers like the format because they think it's looks less cluttered.

      I am (currently) safe from the malware, because I think slashdot would immediately know about a Linux-based scam like t

  • What if we used tax money for this - (Score:3, Interesting)

    by Progman3K ( 515744 ) on Friday November 14, 2003 @09:19PM (#7478636)
    Paying hackers to track down scammers and spammers.

    They seem to be a lot better at it than law enforcement.

    No, this is not a troll...

    *sigh* whatever...
  • ..PC Plod is still trying to work out how to use his mouse. Heck, these scammers are becoming really blatent in their activities, and law enforcement seems comletely unable to act..

  • Protect Against 303 (Score:2, Interesting)

    by Anonymous Coward
    The thing that makes this possible is the HTTP 303 error. Is there any way to detect the 303 when someone comes to your site to determine if it's legitimate or not?

    Otherwise it seems there is NO way to protect against this (except smarter consumers... Like that's going to happen!).

  • Why don't banks and credit card companies... (Score:4, Insightful)

    by Trolling 4 dollas ( 723481 ) on Friday November 14, 2003 @09:26PM (#7478677)
    Tell their customers that they will NEVER correspond with them via email and will NEVER ask for their ATM pin number over the internet in any shape or form. My bank did this when I signed up for online banking. This is of course obvious to 99.999999% of the /. crowd but to everyday common people (read stupid) this might not make sense or be obvious.

  • Hope this makes the news... (Score:4, Insightful)

    by jeeryg_flashaccess ( 456261 ) on Friday November 14, 2003 @09:27PM (#7478681) Homepage Journal
    ...because more stories like this would only help the word "Hacker" gain a better stand in the public at large.

    Stories like this would be serious eye openers to my family and friends who seem to know nothing about computer fraud.

    I submited the story to a few local news agencies. Hopefully one of them picks up on it.

    My work here is done :)

  • What to do about this (Score:5, Insightful)

    by robogun ( 466062 ) on Friday November 14, 2003 @09:41PM (#7478769)
    I'm sure, by now, everybody who has a Citi or Ebay account has gotten one of those spams. (I have several ebay accounts and therefore have received each of the ones mentioned in the article. They also target Paypal MUCH more than mentioned. I get a paypal scam every week at least. The Ebay ones only want your login info so they can pose as a "legit" seller for a few days to run Romanian-type auction scams. [ebay.com]

    The Paypal scammers, with only your password, can literally take you for every cent you got AND every cent of credit availability.

    And where is the mention of the origin of it all, the AOL phishers? I guess you only see it on AOL but it is a huge problem over there. The main purpose seems to use compromised accounts to spam AOL members from inside, it happened to my dad, who is still "not budging" from AOL.

    The ideal solution would be a distributed deliberate response, using the form provided by the spammer, by the targetted companies, who could load predetermined user/pass combinations and disinformation (I have a script) into their database. When access is attempted using the provided login/password combinations, the criminal is detected in real time (he is not safe by proxying - he is still dead meat when seen in action. Logs will exist on the proxy servers to point right to him, the more the merrier.)

  • ... TV movie?

  • From info.jvarley@barclays.co.uk Sun Oct 19 16:27:18 2003
    Return-Path: <info.jvarley@barclays.co.uk>
    Delivered-To: stock@stokkie.net
    Received: (qmail 6293 invoked from network); 19 Oct 2003 16:26:58 -0000
    Received: from host-64-110-77-2.interpacket.net (HELO localhst949.com) (64.110.77.2)
    by 217-19-24-246.dsl.cambrium.nl with SMTP; 19 Oct 2003 16:26:58 -0000
    From: "BARCLAYS BANK UK" <info.jvarley@barclays.co.uk>
    Reply-To: john09varley@yahoo.co.uk
    To: stock@stokkie.net
    Date: Sun, 19 Oct 2003 17:27:26

  • Something similar... (Score:5, Interesting)

    by Anonymous Coward on Friday November 14, 2003 @10:44PM (#7479134)
    I was recently (about 2 months ago) defrauded in the amount of $6000 in an Advance Fee Fraud. I realize most people will laugh at me for this, but some of these scammers can be particularly convincing. The scam in this case involved the purchase of my car (which was being sold online), and a cashier's check of an amount in excess of the agreed purchase price. This 'excess' was to be wired to the 'shipper', as the car was going overseas.

    Anyhow, I decided to do something about it. I hacked into the email account used to defraud me, and followed a chain of emails and accounts that eventually led me to a handful of personal accounts. Each time I gained access to a new email account, I'd peek at all the emails inside and warn off any people who were being targeted from that particular account. After a month and a half of monitoring personal email, I gathered real names, relations, addresses and even resumes on those people involved. The particular 'ring' of scammers that got me is a family and friends affair, with the eldest brother of the family attending university in London, UK. His brothers and cousins (who live in Nigeria) work the fake email accounts and collect 'clients'. Once they have a deal made and personal information collected, they forward this to the ring leader in London, who contacts his sources to produce fake checks. He also takes over the email account, giving out a UK mobile phone number (changes often) to 'clients' who ask for one.

    The money is sent in the name of one-time accomplices. These are people that the ring leader recruits to pick up money at Western Union counters. Once the money is picked up, he gives them a portion then splits the rest between himself, the cheque source and the relative who originally manned the email account.

    Long story short: I have all this information, and don't know exactly what to do with it. I've tried to contact the London Metropolitan police anonymously (via email), several times, and have not heard back. I'm not sure if I should go to my own federal authority because what I've done to gather the information is illegal.

    This particular scam has people involved in the US, Canada, the UK and Nigeria. I'm located in Canada. Any advice?

    • Re:Something similar... (Score:2, Insightful)

      by Anonymous Coward
      How about contacting a reporter? He or she should be able to shield you as a source, and if you pick one with a background in cyber-crime reporting would be likely to have useful contacts in law enforcement.

      Mitnick groupies might have a hissy fit for this suggestion, but John Markoff of the New York Times comes to mind as one possibility.

    • Re:Something similar... (Score:4, Insightful)

      by Blimbo ( 528076 ) on Saturday November 15, 2003 @02:12AM (#7479980) Homepage
      If this was me, i might forward this info(anonymously)to a major metro rag, ie the Toronto Sun..first maybe determine which writer might be interested in following up.
  • Don't people realize that you are allowed to have multiple bank accounts, and multiple credit cards?

    I don't really consider myself all that paranoid, but I'm not about to link the bank account that has all my savings up with Paypal. The account I linked up could be accurately described as my "spending money" account, which means that if I'm compromised, they aint getting much and I aint losing much. Since I can just walk across the street and deposit a check from my real account, I have no need to link a
  • From the Citibank reply:

    You can forward the fraud Email to hatsu1@aol.com.
    ...
    Thank you for using MyCiti.com, Cleatis Hawkins

    &3925000440863888ZSU@L6G"@L6GECT&

    WHAT? This email looks almost as untrustworthy as the original spam! Please forward the fraudulent email to an aol account? Are they serious?

    This kind of infers that Citibank has ONE person dealing with this sort of thing, and that one person uses AOL. It would be funny if it wasn't so pathetic.

    If I was a Citibank customer I'd be on

    • Actually, its a team of about 20 who use a standalone computer seperate from the rest of the network. After all, would you foward possible trojans to your corporate network? I can gurantee that the admins there dont know about it, at least not yet ;) ...
    • After using email blind-drops and malware, the group quickly progressed to impersonating web sites. The impersonation was done through web redirections. The hypertext transport protocol (HTTP) permits web servers to redirect requests to alternate sites (HTTP 303 return codes). In this case, the gang's web server returned an HTTP 303 return code redirecting browsers to the targeted financial institution. But, the HTTP response may also contain valid HTML code. The valid code usually tells the user that the

  • Complain To Citibank (Score:3, Informative)

    by RedSynapse ( 90206 ) on Saturday November 15, 2003 @11:12AM (#7481073)
    To me the scariest part of this article is that citibank's own "e-mail fraud reporting" services replies to people that they should forward any further occurances of email fraud to an @aol.com email address.

    Something is very wrong.

    It seems like the citibank website is designed not to give out any email addresses but here's some addresses I've found.

    I'd recommend sending a polite e-mailthe following details:

    • A link to the sercurityfocus article http://www.securityfocus.com/infocus/1745
    • State that there was an fraud attack on citibank that may have affected over 100,000 clients.
    • State that it seems likely that citibank should be able to identify which clients were affected by checking their web logs.
    • Most importantly state that there seems to be something very wrong with their e-mail fraud reporting page, which may itself be compromised, and as such could the person you are contacting forward your e-mail to the appropriate Information Security department.
    Please note that these people are not in departments related to IT or web development, so just ask them to forward your email to the appropriate person. Trust me, if enough people complain about this it will get resolved.

    citibank@shareholders-online.com, shareholderrelations@citigroup.com, investorrelations@citi.com, fixedincomeir@citigroup.com, louis.f.fortunato@citigroup.com, evelyn.kenvin@citicorp.com, mary.cosgrove@citicorp.com, joseph.g.eicheldinger@citicorp.com, valerie.kuhl@citicorp.com, mamie.chinn-hechter@citicorp.com, geoffrey.h.siedor@travelers.com, johnsonl@citigroup.com, prettoc@citigroup.com, kevin.j.heine@citigroup.com

Slashdot Top Deals

You knew the job was dangerous when you took it, Fred. -- Superchicken

Close