« September 2005 | Main | November 2005 »

October 26, 2005

The English-is-not-our-first-language phishers have been propagating a spelling mistake in (among the ones I've seen) PayPal and Chase scam messages throughout October, 2005. The messages specify a deadline date, by which time you must confirm your personal information or lose your account. Half a dozen messages that reached me all spell "October" as "Octomber."

My guess is that they started with "September," and, if they looked at "November" and "December" they figured all these "ber" months must be "mber" months. Thus, when they updated the scam message for the new month, they replaced "Septe" with "Octo" to get "Octomber." This further leads me to believe the native language of the initial generator is not one whose month names use the Latin roots. Something from the Far East perhaps?

A few of the PayPal messages also include this gem of English ineptitude:

One of our Customer Service employees has already tryed to telephonically reach you. As our employee did not manage to reach you, this email has been sent to your notice.

No PayPal employee would dare split an infinitive like that!

While I'm on a phishing rant, a recent article reported that the typical phishing site remained operational for an average of 5.5 days in August (down from 5.9 days the previous month). In other words, it takes the owner of a hijacked Web site or Web hosting service longer than a typical work week to react to a report of phishing activity.

According to the article, the trend indicates success in squashing phishing. Five-and-a-half days! I can't imagine that a phisher has high hopes that a site would be up that long. The main damage to consumer information has to occur within the first 24 hours, and certainly within 48 hours. When I see a second or third mailing pointing to the same hijacked server arrive a few days after the first one, I consider the lack of action on the owner's or ISP's part a massive failure.

If the phishing site takedown rate improves at the same pace going forward, it will be Octomber 2006 before we're anywhere near a desirable figure.

October 16, 2005

I usually don't reference news articles in this blog because there are plenty of spam- and scam-related Web sites and blogs acting as metanews outlets. But I wanted to make some brief comments on two articles that appeared recently.

First is an item from CNet discussing renewed enforcement actions in Nigeria to cut into the advance-fee (a.k.a. 419) schemes that have plagued the world since before email. I'm obviously all for whatever the Nigerian government can do to shut down the gangs. If it means getting the help of Microsoft's expertise, that's great, too. What disturbs me, however, is the attitude conveyed by this quote from a Nigerian government official:

The measures are starting to show. The scammers are moving out of the country. Things are changing a lot and changing our lives.

What does that mean? If the scammers aren't in Nigeria anymore, then the problem has gone away? I don't think this fellow has any idea about the public relations nightmare that these ripoff artists have given Nigeria. No matter where they physically originate, 419 scams will forever be associated with Nigeria. Heck, the scam's nickname comes from a Nigerial criminal code number.

Second is a The Detroit News article about an FBI raid and seizure of the computers of Alan Ralsky, a high-volume email marketer who has been in Spamhaus' sights for years. What I found most interesting about the article is that the raids occurred back in September. It also states that he sent mortgage spam. Is it just a coincidence that my mortgage spam dropped significantly in September? Let's hope not.

October 02, 2005

Imagine that you're a new or occasional PayPal user. You may have entrusted the firm with not only your credit card information, but perhaps access to a bank checking account to facilitate direct funds transfer. You switch on your computer one sunny Sunday morning, only to find not one, not two, but four email messages claiming to be from PayPal:

It turns out that none of these messages comes from PayPal. They're all phonies, attempting to lure unsuspecting users to give up their PayPal user IDs and passwords. The sites where the active links lead to are located all over. Two are in Germany (different ISPs), one is in Hong Kong, and the fourth is in Iran.

I would hope that a newbie receiving a barrage like this would be suspicious enough to wonder about the messages' authenticities. At the same time, alas, it wouldn't surprise me if plenty of folks would respond to not one, not two, but all four requests for information out of fear of having PayPal suspend their account—confusing the message quantity and variety with urgency.

One of these four sites, by the way, is particularly dastardly. The crook managed to either set up or hijack a Web server that provides a secure socket layer. Not only does the URL to the site contain the https protocol, but the site really does have a digital certificate. A modern Web browser might, however, alert the visitor to the fact that the certificate was not issued by a verified authority. The certificate says it's "PayPal, Inc." but the certificate is self-signed, and looks very different from the one at the real PayPal site. I'd be surprised if more than 5% of PayPal's members could tell the difference, no matter what kinds of red flags the browser raises.

Let's hope someone is at home at the ISP in whose IP address space this bogus "secure" site is located, and will shut it down ASAP.

A Reuters news story from December 8, 2004 quoted Howard Schmidt (special adviser on cyber-security in the the first term of our current president), who believed that the combination of new technology and law enforcement would essentially stamp out phishing scams:

"I firmly believe that at this time next year we will be able to say that phishing used to be a problem."

Tick tock.