Web Fraud 2.0 — Point-and-Click Cracking Tools 92
An anonymous reader writes "The Washington Post's Security Fix blog is running a fascinating series that peers inside some of the Web-based services cyber crooks are using to ply their trade: from masking their identity, to defeating CAPTCHAs, to creating counterfeit documents and validating stolen credit and debit cards. Everyone familiar with this space hears about these kinds of tools and services all the time in the abstract, but the Post blog includes screen shots and background details on the popularity of the services and how each one is helping to bring cyber crime that much closer to the realm of even the most newbie scam artists." Many of these tools require a working knowledge of Russian. Wouldn't surprise me to learn that Chinese-language tools exist too.
Language Support (Score:5, Funny)
Many of these tools require a working knowledge of Russian. Wouldn't surprise me to learn that Chinese-language tools exist too.
Damn. And here I was looking for fraud tools in Klingon. No wonder I can't ever find anything.
You need to look for Klingon tools (Score:3, Informative)
here. [klingon.org]
Scamming Klingons is too dangerous (Score:4, Funny)
I'd imagine that Klingons would dish out some pretty massive punishment when scammers get caught, so you're unlikely to see many Klingons using these tools.
Perhaps you'd be better to search in Ferenghi?
Re: (Score:2)
I'd imagine that Klingons would dish out some pretty massive punishment when scammers get caught, so you're unlikely to see many Klingons using these tools.
I don't know which would be worse... scamming, or being so weak as to require a _tool_ to help you do it.
the next step, lolcat? (Score:2)
Holy Stereotypes! (Score:1, Funny)
Way to throw around those stereotypes! I bet they all run on Windows, too! Windows - the first choice for crooks and scammers!
Re:Holy Stereotypes! (Score:5, Insightful)
Except it isn't a stereotype...it's a statistical certainty. Wouldn't surprise me to learn that English-language tools exist too?
See how stereotype doesn't apply? Probably not.
Re:Holy Stereotypes! (Score:4, Insightful)
The stereotype doesn't imply that the statement is wrong, but why was that statement made about Chinese and not English tools? According to the Spam origin data, English tools are a lot more likely then Chinese tools, so while in itself not wrong the decision to focus on one correct statement while omitting another correct statement speaks of bias and creates an incorrect impression to the casual reader (and if you know the data then you don't need news articles in the first place).
SANTA (Score:2)
English pointy clicky tools like this certainly do exist and certainly pre-date any Russian or Chinese tools; when was SATAN first developed? Remember SATAN? Security Analysis Tool for Analyzing Networks was I think the name.... I don't remember the year but it was long before the current wave of Russian script kiddie gangsters....
Re: (Score:2, Funny)
Offtopic, but I'm glad to learn that there's at least one other person out there who shares my view that santa == satan.
Re:SANTA -- not really offtopic :) (Score:4, Informative)
heheh... I don't recall the backstory behind this, but SATAN actually distributed for a while with a utility called "SANTA" that would change the name of the tool (and all references in the docs and so forth) from "Security Analysis Tool for Analyzing Networks" to something like "Security Analysis Network Tool for Administration" in order to get rid of the potentially disturbing acronym.
Re: (Score:1)
I recall seeing it in the mid 90's... ah, according to wikipedia it was released in 95, and on freshmeat it showed up in 2000, last update being in 2006. I also remember SAINT, which came out in 98, but I'm more familiar with Nessus which also first came out in 98.
Re: (Score:2)
English pointy clicky tools like this certainly do exist and certainly pre-date any Russian or Chinese tools; when was SATAN first developed?
Except, well, no.
The two aren't really comparable. SATAN is a tool designed to fulfil a perfectly legitimate purpose, which happens to also be able to do some things that aren't exactly legal.
These tools are (mostly, at least) things that have no legitimate purpose. What's the legitimate purpose behind a service to provide forged ID? A marketplace for stolen credit
Re: (Score:2)
What if he said "many burglaries are committed by blacks, I bet many are also committed by latinos" while not mentioning
Re:Holy Stereotypes! (Score:5, Insightful)
It is not a stereotype to say that many burglaries are committed by blacks, as this can easily be backed by data. It is stereotypical, however, to say, "All blacks commit burglaries", "Most blacks commit burglaries", or "He is black so he's probably committed burglary."
Re: (Score:2)
Re: (Score:1)
Many years ago, English was once thought to be the universal hacking language. Of course, not just focused around malicious hacking...
Re: (Score:3, Informative)
http://www.spamhaus.org/statistics/countries.lasso
1 United States 1571
2 China 428
3 Russian Federation 305
4 South Korea 197
5 Germany 180
6 United Kingdom 180
7 France 177
8 India 153
9 Japan 147
10 Brazil 147
In other words, the US beats the next 7 countries combined, Germany, France and the UK together beat China and every two of them beat Russia.
We'd be a lot better at fighting the bad guys if we wouldn't assume that "we" are the good guys.
Re:Holy Stereotypes! (Score:4, Informative)
http://www.spamhaus.org/statistics/spammers.lasso
1 HerbalKing India
2 Vincent Chan / yoric.net Hong Kong
3 Alex Blood / Alexander Mosh / AlekseyB / Alex Polyakov Ukraine
4 Nikhil Kumar Pragji / Dark-Mailer Australia
Queensland
5 Ruslan Ibragimov / send-safe.com Russian Federation
6 Leo Kuvayev / BadCow Russian Federation
7 Pavka / Artofit Russian Federation
8 Russian Business Network Russian Federation
9 Yambo Financials Ukraine
10 Alexey Panov - ckync.com Russia
Re: (Score:2, Interesting)
Register of *known* Spammers. I'd expect the much better/less bribe-able police services in the US would encourage Spammers there to stay much deeper underground...
Re: (Score:3, Interesting)
Who's making assumptions now?
Re: (Score:3, Informative)
Utterly meaningless statistic. Foreign spammers know that their spam must originate from the U.S. or it has an almost 0% chance of reaching American mailboxes. Consequently, they search constantly for server and user machines in the U.S. they can easily compromise.
Re: (Score:3, Insightful)
The botnets that send those spam messages from the Unites States are controlled by Russia(ns). Remember the news a few weeks ago when Russia invaded Georgia and 80% of the world's spam stopped while the botnets switched to attacking the Georgian government's web page?
Re: (Score:1)
Horror Show! (Score:4, Funny)
Re: (Score:2)
Ne znayu kak vy, no lichno ea privetstvuyu nashih novyh, russko-govoreashih poveliteley!
If you want to exercise your Russian skills, try coming up with a better interpretation of the WALL-E acronym (story here: http://railean.net/index.php/2008/08/15/translation_challange_wall_e_russian [railean.net])
Re: (Score:2, Informative)
Re: (Score:1)
Using postal information to validate cards (Score:2, Insightful)
It won't help with intangible goods and isn't practical with gift items, but stores that ship tangible goods can require that the shipping address be the same as the billing address and verify the billing address against information held by the credit card company.
Even verifying only the postal code will make it hard for me to order a computer using your credit card if I'm not prepared to visit your locale to take delivery.
Another technique is to allow exceptions but only if a person picks up the item at th
Re: (Score:3, Informative)
Re: (Score:2, Informative)
Re: (Score:1)
Re: (Score:2, Informative)
Re: (Score:2)
stores that ship tangible goods can require that the shipping address be the same as the billing address and verify the billing address against information held by the credit card company.
There is a problem with this approach, which is that it alienates certain customers. For instance, I'm a director of a company and hold a credit card in the name of that company. The billing address on the account is our accountant's office. I don't want everything I order to go via our accountant, so any company that r
stereotype day (Score:5, Insightful)
Is today global stereotype day and did I miss the memo ?
Hitting on the Russians seems to be in real fashion these days, you'd almost think there was a political motive behind it. Is France out of fashion or so ?
Really, the reason these tools exist is because there are several requirements before you can deploy these tools, which are:
- access to international banking
- a large base of hackers, preferably unemployed
(I use 'hacker' in its original form)
- organized crime
The USA, China, Germany and Russia all have these in abundance so that's where you will find your toolkits.
Re: (Score:3, Insightful)
You should move to Canada, where it's always in fashion to hit on Americans.
Re: (Score:2, Insightful)
No, it's always in fashion to hit on America, not Americans. As it is everywhere, seemingly. Like Lance Armstrong used to say, I love the French, its France I hate. Never met a Canadian that wasnt gracious and courteous (well, except waiters in Quebec) and the same follows for Russians/Iraqis/Mexicans/Japanese/etc. People generally villify Big Faceless Stereotypes and not other people.
Re: (Score:1, Funny)
As a Canadian I resent that. Americans are too fat and lazy to hit on.
Re: (Score:1)
Re:stereotype day (Score:4, Insightful)
Been there, done that, and again, that's just another stereotype. Canadians do not routinely bash Americans more than the Americans probably deserve on account of abusing tariffs and nafta.
Re: (Score:1)
Re: (Score:2)
"Hitting on the Russians seems to be in real fashion these days, you'd almost think there was a political motive behind it."
Nah. We just miss the good ol days of the cold war.
Re: (Score:2)
Thank you for improving my English, I'll never be as good as a native speaker though.
Russian bashing was closer to what I had in mind.
Re:stereotype day (Score:5, Interesting)
- a weak, corrupt legal system.
Russians (and quite a few people in the other states of the ex-USSR) have a weird sense of entitlement that causes them to believe that it's perfectly acceptable to steal from the rich. They suffered under communism for so long that it's quite all right to get some payback by stealing from the West now.
Since Russian law really doesn't care about crimes that are committed outside of Russia against non-Russians and anyway you can just bribe a judge to get whatever ruling you want, there really is no stopping these people. Well, I can think of ways to stop them, but let's just say that I don't think the USA or the EU has the stomach for what it would take. The weak legal system argument probably applies to China too.
Re: (Score:2)
Hitting on the Russians seems to be in real fashion these days
I didn't think anybody actually hit on Russians, I thought they just met them online through a broker and married them.
Re: (Score:2)
To expand on your post, lots of cheap under/unemployed people also make automated tools redundant or not required. Also makes countermeasures, (necessarily automated)less efficient & effective. Don't bother trying to crack the latest Craiglist captcha, just get a load of poor (in both senses of the word) people to do it. It's a service that's even 'advertised'...
This shouldn't be terribly surprising (Score:5, Interesting)
Made in USA versions sold by Google (Score:5, Interesting)
If you want made-in-USA tools for this, try searching Google for "craigslist auto posting tool" [google.com]. Google offers seven paid ads for spamming tools and crackers. ("The worlds Best Selling Craigslist software. Works with new CAPTCHA!") Three of them (including one that advertises "Only Automated Solution for the new captcha. Nobody else is automated.") are available through Google Checkout.
This has been going on for months, despite press coverage. I'm beginning to wonder if Google is deliberately promoting tools to kill Craigslist.
Re: (Score:3, Interesting)
I'm beginning to wonder if Google is deliberately promoting tools to kill Craigslist.
They're deliberately promoting advertisements that make them money. If you notice, if you search for something like AdSense and you'll find links to such treasures as Google Massacre [googlescalper.com]. Whatever pays the bills I guess.
Re:Made in USA versions sold by Google (Score:4, Interesting)
This has been going on for months, despite press coverage. I'm beginning to wonder if Google is deliberately promoting tools to kill Craigslist.
If I were Craigslist, I would rather see those tools easily available instead of pushed underground. Because it makes it easier to identify them and thus to create countermeasures.
For example, instead of just shutting down the exploits and their distrubtion, I would study the tools and see if they have a recognizable 'fingerprint' when used. Then I would make the craigslist software look for such 'fingerprints' and treat the postings differently - for example instead of just blocking the post, I would set the threshold for other user's tagging it as spam to be very low, or even set a timer to delete the post after an hour or two.
The end result being that the most common and easily available tools would be compromised in non-obvious ways, reducing the rate of escalation in the "arms race" of cracker/anti-cracker tools and simultaneously making abuse less effective for most (ab)users.
Re: (Score:3, Interesting)
Forget the tools, it's much easier to identify the fake ads because they use the same phrases over and over. To wit:
to name just two I can remember. All CL has to do is to scan their postings every hour, identify ads which use these phrases and delete them. Sure, the postings still get put up but they get taken down just as easily.
Re: (Score:1)
I take it you haven't administered a network of any reasonable size recently, at least not one which hosts mail servers...
cyber crooks validating stolen credit cards .. (Score:2)
"I managed to acquire an account on this exclusive service, and found some 78,628 [slashdot.org] individual MasterCard and Visa credit and debit accounts for sale at various prices there"
Re: (Score:3, Funny)
Best Western.
Re: (Score:1)
Fighting spam with spam. (Score:2)
Re:Typical Slashdotzz comment! (Score:4, Interesting)
Your comment just proves how clueless you are about the spam situation in China.
China is, and has been for several years, a bastion of "bulletproof" hosting. Since you're so clueless about spam, I probably have to explain bulletproof hosting. Bulletproof hosting is a contract with a hosting provider and/or ISP with IP space to burn that doesn't care what you do with that hosting/IP space so long as you pay your bills.
China is also a haven of phishing sites, largely for the same reason and courtesy of a few rogue registrars operating in China.
There's nothing racist about criticizing China for its conduct. What next? You'll be telling us it's racist to criticize Nigeria for being the source of most of the world's 419 spam?
Silly me. I hadn't heard that scammers, spammers, and those who give them shelter constituted a race.
Re: (Score:1)
Actually, Chinese is one of the leading languages for spam. They've got quite a homegrown spam industry there. I work for one of the leading anti-spam vendors, and the Chinese spam problem is so large that we opened a local office in China to deal with it. The big three languages for spam are English, Spanish, and Chinese. I suppose you're now going to suggest it's racist for saying Spanish is a big spamming language too?
Re: (Score:1)
I'll further back this up with a number: 95% of the spam received in China is in Chinese. Still doubt that spamming tools might be available in Chinese?
Re: (Score:1)
"Chinese Race"? I know there are many, many Chinese people but I don't beleive that alone qualifies them as a "race" or are you also thinking there's a "European" race too? Perhaps you really meant "blatantly ignorant statement" or "fear-mongering statement"?
Re: (Score:2)
If they are a race, is it then OK to wipe this "race" out?
Re: (Score:2)
This might be an attractive alternative, but the profit margin (for an essentially illegal operation) would need to be decidedly low to attract people from any other jobs even in the poorest areas.
Why would you say the operation is illegal? What (Russian/Chinese) laws are being broken?
dual uses (Score:2)
just like hammers can be used for doing construction projects or they can be used to bash peoples heads in, the same can be said with these controversial tools.
As long as packets can traverse from one point to another, it will be impossible to prevent automation tools from being used to automate various interfaces to access public online systems. If web sites think they can get rid of people by putting various challenges in their way, i.e. captcha, they are wrong. Given enough resources, people will get a
Money (Score:2)
Get rid of the "monetary" system. As long as we have money people will always conjure up creative ways to steal it. Our global society needs to move forward to the "star trek" world where money doesn't exist. I know, I'm asking for the impossible.
Re: (Score:2)
Get rid of the "monetary" system. As long as we have money people will always conjure up creative ways to steal it. Our global society needs to move forward to the "star trek" world where money doesn't exist. I know, I'm asking for the impossible.
Not impossible. Just not likely to happen in the near future. I consider a moneyless society plausible in the future, if you have the following situation:
* nearly-free energy (e.g. large-scale fusion reactors)
* no shortage of resources for any substance that is i