Category: Computer Security

From: “I. R. S”
Subject: “Final Notice ! ! – Re.: Your past due I.R.S account”

Heh. Yeah. Right. I’d be more alarmed if (a) the subject line wasn’t full of grammatical errors, and (b) the from-name didn’t resolve to “Jeff” at “Yahoo.com.”

And I’d be a lot more impressed by a “Professional” Tax Specialist who didn’t try to scare me into using his services. Bastard.

Hello, SpamCop …?

Today’s favorite spam subject line awaiting me at the office:

    dave.hess,A Bigger Bust in 60 days or we’ll Pay You

I love this. The faux personalization (somewhat ruined by trying to send it to five people in one mailing, not to mention the gender-bending therein), not to mention The intereresting Capitalization.

It was vaguely educational, knowing that someone with my name works at Logan Aluminum and at Reuters. I wonder if they need bigger busts, too?

First in an intermittent series …

     Artfully Hypnotize Women Into Bed

No thanks. I prefer a club. I have to have some standards …

About once every few days I get an e-mail akin to this:

From: jerry n’ngoran
Subject: JERRY

I don’t believe I know anyone on Yahoo! Canada. I’m pretty certain I don’t know anyone named Jerry.

Fortunately, Outlook Express, for all its sins, can view the source of a message without actually opening the message, which is more than Outlook 2002 can do.

Hello,
With due respect, I have decided to contact you in
this peculiar matter believing that you will not let
down the trust and confidence that I and my colleagues
are about to repose in you.For a brief introduction,I
am Jerry N’Ngoran the Deputy Accountant of the Cote d’Ivoire
Sociiti Ivoirienne de Raffinage (S.I.R) here in Abidjan and also
a member of the contract awarding committee for the rehabilitation
and reconstruction of the country refinery that had a
fire disaster last year October 2001. I was
mandated by my colleagues to look for a reliable
and trustworthily foreigner whos account will be use
to transfer some huge amount of money, a total sum of
US$15,500,000.00 (fifteen million five hundred
thousand united sates dollars) only, out of the
country for our personal use.
This money was realised from over inflated contracts
which the contract awarding committee awarded to some
foreign contractors for the rehabilitation and
reconstruction of the refinery and the network
pipeline.
The contracts was awarded to the contractors to the
tune of US$70,Million, but we used our positions and
over invoiced the amount to the tune of US$85.5
Million.
Now that the project has been concluded and
contractors are now coming for their payments, we now
required a reliable and trustworthily person, whom
will be use as a sub-contractor and claim the over
invoiced amount of US$15.5 Million, which has also
been approved for payment and use his foreign account
transfer this fund from the paying bank here in
Abidjan, this necessitated my contacting you.
Be informed that my colleagues and I have maped out
all the necessary modalities towards the claim of this
fund, but due to our position we do not want to be
noticed.

Hey, cool! They’re ripping people off for millions of dollars, and they want my help to do it! And, of course, I can trust them …

This is actually rather clever. There are a lot of greedy, stupid people out there. Indeed, greed can make you stupid. By proposing something that only greedy people will find attractive, they run a good chance of getting a stupid person attracted to it, too.

A service of an attorney will be use to secure the
registration certificate as your sisters company here
in Abidjan, it will be back dated enable us reflect your
name as one of the contractors, for board to raise a
payment directive covering the fund in your favour.
The contact of the attorney will be forwarded to you
immediately you notify your interest in this proposal,
by sending the name and address of your company and
your bank particulars.

And all they want is my financial information, how to access my bank account, and I’ll be set! I’ll be rich! And they have attorneys doing this, so it must be legal!

Be informed also that your presence will be needed
here in Abidjan., but if you can not make it?. no
problem.
since we are still in service .

Well, maybe a vacation to the Ivory Coast would be nice. But if I can’t get the days off from that cheat of a boss of mine, I don’t have to. Cool. Boy, won’t the boss be ticked off when I’m filthy rich!

We agreed that 5% of the total fund will be given to
you to cover your travelling cost, accommodation and
some other expenses you might incur during the
process of transfer of the fund. also 10% will be given to you for
your assistance. 40% will be used
to go into joint venture investment with you, which
will be supervised by you, of which the yearly
profit will be shared equally by all parties involved,
while the remaining 45% of the total fund will be for
me and three of my colleagues.

Wow! I’m getting 15% right up front, and then I get to supervise the distribution of the rest! Hmmmm. Maybe I can rip them off for the full $15.5MM! What a bunch of suckers!

Be rest assured of this transaction and keep it
confidential, because of our positions in Government
and also our committee is fully in charge of all
contracts verifications, allocation and approval.

Just in case you were worried, we’re the watchdogs here, so there’s no risk. Trust us.

Expecting your immediate response.
call me on this number 22507955967.
Best Regards.
N’Ngoran.J.

This is all, of course, at best a hoax, and, at worse, a scam. The bottom line is, while visions of millions dance in their heads, folks who fall for this will actually be sending their bank account information. to someone they don’t know (or, worse, someone who, to the extent they know them, is known to be a cheat).

And, of course, if the bank information isn’t enough, there will soon come requests for front money, to enable all the transfers …

It all reminds me of the scene at the begining of The Sting …

For some remarkably similar texts, and some further warnings, see here and here. The latter link has a number of parallel constructions, some of which tug on the heart-strings rather than baser instincts. This page talks in more gory detail about these scams and how they work.

The worst, most enticingly dastardly part of this letter, of course, comes at the end:

______________________________________________________________________
Find, Connect, Date! http://personals.yahoo.ca

Now, talk about scans …

I get spam. Lots of spam. All sorts — virility enhancers, naughty picture sites, stock suggestions, alternative drugs … you name it, somebody wants to sell it to me.

I use Spamcop.net to report it all, so I feel like I’m at least doing something about the problem. And usually that’s the end of it.

But I’ve run across a little bit that was so clever, I had to pass it on. It probably even has applicability on my blog.

Many spam filters look for key words or phrases — parts of the anatomy (or slang terms thereof), activities one does with those parts (or slang terms there of), etc.

But what’s sought after is what’s coded in the e-mail, not what’s displayed. And if you are using HTML mail, then you can code something like:

Fre<!– howdy –>e Por<!– pardner –>n!

On the screen it will read as an offer for Free Porn!, but a spam filter won’t sense it (any more than, hopefully, a web site filter will catch that phrase in my blog) because the <!– –> stuff is treated as a comment — it doesn’t display, but it breaks up the Naughty Words in the code, so it isn’t seen.

I just thought that was rather clever. In a fiendlishly sleazy sort of way. And it potentially lets me put terms up on the screen here that would raise flags going through language filters.

I don’t know how it would affect Google, as another example, but that’s a good question, too.

When computer viruses strike, and pundits begin reciting the economic impact, where do they pull those numbers from? Possibly from thin air.

Michael Erbschloe, vice president of research at Computer Economics, said that the company tabulates virus cleanup and damage costs from information provided by its clients, antiviral applications vendors and systems administrators.
Erbschloe refused to name the specific sources for the data, saying that much of this information is provided off the record.
[…] “Erbschloe says that the company uses valid microeconomic data, but he won’t make it available so that people can analyze and critique it,” said Rob Rosenberger of virus information site vMyths. “Nor will he adequately explain his collection methodology or adequately explain his extrapolation model.”
“When I speak to the press, they openly admit a simple truth — they must turn to Erbschloe for virus damage guesstimates. No one else will prostitute the dollar figures reporters and antivirus vendors so desperately crave.”

Alas, like so many other things in the computer realm (e.g., RoI on the latest hot PC), these sorts of dollar figures seem to be a lot hazier than they sound.

(Via Boing Boing)

How do computer viruses get their names? An interesting article on the subject.

Sometimes the process is more random. Who would have guessed that the Code Red virus got its name from an eEye Digital Security researcher’s beverage of choice — the cola variety of Mountain Dew soft drink — the night they picked through the corruptive code.

(Via John Doe)

God Bless USA! Get .USA Domains!

Gee, why would the registrar for “.USA” TLDs (Top Level Domains), www.dotusa.com be using a .com address, rather than a .usa address?

Could it be that it’s because these won’t actually be deployed until 2002?

Could it be that “they will initially be viewed on the Internet by making a slight alteration to your web browser.”

And if that’s so, why did the very next spam I get, from the same source, say, “The latest domain name extension has arrived .USA!!! It’s the fresh, new, exciting web address that is taking the world by storm”? How can it be taking the world by storm when nobody can actually go to any such domain yet?

Could it be that this is another set of “rogue TLDs” that won’t work for most people unless they point their DNS pointers to the TLD Network servers (hosters, registrars and vendors of, not uncoincidentally, .usa)?

Could it all be a huge rip-off, playing on American patriotism at home and a desire to be associated with America abroad?

Naaaaaaah. I saw it on the Internet! It must be true!