FBI Tracks Down Big Phish
from the about-time dept
You would think that it wouldn’t be that hard to track down phishing scammers. While they do try to hide themselves, in the end, there should be some sort of money trail leading back to them. However, for all the talk of trying to track these guys down, it seemed like no one ever got anywhere. There was a ton of hype around Microsoft catching a phishing “kingpin” until you realized that it was just some kid who set up a website and never made any money. The real problem, everyone always said, was that the real phishing kingpins operated as part of organized crime in Eastern Europe — and that made them tough to track down. Partly due to the nature of any organized crime setup, it probably wasn’t that hard to nab the small fry who were the front men — but that was useless if you wanted to catch the big phish who actually masterminded the operation. However, that doesn’t mean the authorities weren’t working on it. The FBI has announced that they’ve brought down one phishing group, arresting at least 16 people. Up to five of those arrested are American with the rest being Polish. The FBI is still trying to track down others involved, including some in Romania. While it’s definitely great to see them finally bring down a big phishing group, it should suggest how big a problem this really is that it’s taken this long to nab one single group. Just imagine how many more are still out there, phishing away.
Comments on “FBI Tracks Down Big Phish”
OMG! ...MAJOR FINANCIAL INSTITUTION
In the News.com article it makes mention of a major financial institution in the fall of 2004 – hopefully, they have learned how to secure their servers after that.
You would think that a major financial institution would be a little more savy than most.
And as far as trading in online forums – did the FBI monitor as the credit cards were being traded – then, they subpenoed the Host for the IP addresses of the traders and the IP addresses and emails they used when registering?
If that is the case – it explains why they were able to catch THIS ring and not the others.
Anyone dumb enough to publically trade on an online forum …… well,…
Re: OMG! ...MAJOR FINANCIAL INSTITUTION
You need to realize that these scams have NOTHING to do with how secure the “major financial institution” websites are. These severs are never breeched or hacked. If I were savvy enough, I could setup a page that looked just like Bank of America’s account login on my Abyss server at home and try to get someone to go there and login. THAT’s what’s happening here….
Phishing...
I cannot believe people can do such things as trying to steal bank accounts…most of this guys dont even know what they are doing, they just get paid to send massive emails…I just hope the banks can find a quicks solution for this.
http://www.androhair.com
haha
Yet again another funny News report like the Microsoft’s one… same things happen..
One thing is for sure, none of these institutions will waste their money for weeks or even months or even years of traces to catch a big group or a “big fish” why? because the costs are bigger then the catch… that’s why usually they catch 1 or 2 and give the whole blame to them to make them an example for others… but heh that’s kinda like an cartoon movie for kids… the REAL phishers never gets caught and most of the times those ‘first lead” phishers are underage kids whom gov’s cannot do anything other then give them some low charges… and the next week they are doing the same thing they’ve done before… because like in any other crime real or cyber the kids are used as first lead and even they get caugh in most of the states on this globe they don’t even go to jail for any of this… mostly they pay the charges and that’s all.
Oh and let me tell you something, first scam’s ever existed begin from employers whom were selling banks info’s like website sources, big lists of members info’s and many others like that… only after some years people started to copycat the original websites… Also if you check e-bay more then 30% of the accounts are fake.. who’s fault is that? paypal employers sold 343242 times members data’s.. for large amount of money… these are only some expamples…
How is possible that search engines lead to websites full of stolen personal data like credit cards/ bank accounts etc and none of them reported those?, how come you can find on google “how to make a real bomb”? How come search engines can lead to gov’s websites whom have top secret or classified files and none of them are protected?
Who’s fault is that? because like you can see the nowadays answer for any crime real or cyber is “Because We Can?” Why don’t you waste those big amounts of money for something more helpfull, like creating more secure systems for e-commerce and money transfers… create TV shows on subjects like “how to stay safe while surfing the internet”, “how to make an safe transaction over the internet”, banners on walls “don’t forget to change your password once a week” lol… remember if the system is secure none of these would happen in the first place… if people would know all aspects of the internet before they do anything over the internet… none of these would happen… If the institution employers would be paid a lil more i doubt they will sell those info’s to live a better life doing crimes… AND if this world would be a better place i doubt any crime will ever be made.. see i’m almost dreaming… no matter what, there will always exist good and bad since they both exist in us… more or less…
Stay safe… read the news 🙂
Report2System
My bad...
I became excited when I read the title. I thought maybe Trey Anastasio was arrested!
Re: My bad...
I expected it to have something to do with suspected child pornographer Mike Gordon…
re: ha ha
Although it was a tough read, you’re making some good points and they really can’t do anything about criminals who are underage.
I can’t help but wonder why they don’t catch more of the top people in these phishing scams and the only answer I can come up with is that they don’t want to. With all the “power” that the NSA, the CIA & the FBI seemingly have, why is it that John Q Public has to point it out, complain and try to sue before they do anything about it? It’s always some guy making the headlines about how he was “taken” before anyone even knows it’s around. Where is our security? It’s sometimes difficult not to take a page out of a conspiracy theorist’s handbook.
i dont get it
why dont they simply put restrictions on new email acounts limiting them to only 20 reciptients per email and make it painfully hard for them to cycle sending adresses. this would stop cut down on alot fo spam and phishing i think, most people are too lazy if they cant paste their 5000 generated or stolen adresses into one email. if they cant catch them they could at least piss them off.
Re: i dont get it
it’s a numbers game. it’s all about really huge numbers.
the phishing emails are sent from botnets. a bot is a computer that is being remote controlled by someone else. bots are regular people’s machines being used to send spam without the owner’s knowlege or consent. a botnet may have thousands or even tens of thousand of bots.
so you use some of your bots to send emails. maybe 500 or less, maybe to 500 recipients or less. for a real time black list like spamhaus, a host that sends 500 spams won’t even show up on their radar.
once the mail is sent, the bots aren’t used again for weeks. most bots are people’s home computers connected to broadband and in a week or so the machine will get a new IP address and the process can start over again. 500 messages to 500 recipients sounds really small time, until you mulitply that by 10,000… the number of machines in a decently sized botnet. 10,000 computers X 500 emails X 500 recipients is 2.5 billion messages.
now, lets say that one half of one percent of people actually receive, believe, and respond to a scam. that doesn’t sound like very many, until you factor in those huge numbers. one half of one percent of 2.5 billion is a little over 1.2 million.
now, lets say that one half of one percent of those account details are usable for fraud. again, that doesn’t sound like very many, but one half of one percent of 1.2 million is still a little over 62 thousand.
now, once you run the scam, you may only succeed with one half of one percent of your attempts, but that’s still 312 people that you and your organization have managed to fleece. the whole con takes less than a week from start to finish, so one gang could conceivably pull off well over 50 scams in a year. it sounds like a lot of work for not a lot in return, but for these guys it’s way safer than armed robbery or dealing drugs.
the problem with the money trail is that the stolen money ends up offshore in countries with no real extradition policy with the US. compund that with the fact that the websites and funds used in the theft are bought and verified with stolen identities and financial info and you have a very difficult trail to track.
also, take into consideration that phishing for details financial details is one form of attack. some of those spams can contain keyloggers or browserjackers or other forms of spy/malware instead of a social engineering attempt, and you have the current threat environment for the average internet user.
Re: Re: i dont get it
Sounds like we’ve hit on something you know a lot about. The way you explain it, it’s scary. Thanks for the head’s up.
Re: Re: i dont get it
Rofl dude that theory its like an “casual” for you but its not even close…. those are just some numbers you have typed… you don’t know for sure if its true or not… its more like this… they hack an system, they send e-mails untill they don’t have access to that server anymore… not 500 mails… 3240324032 billions of e-mails, also who told you that they can do only 50 scams per year? haha that must be a cute joke… listen to this… let’s say from 10 people, 1 falls into their trap… “guessing” he has a debit account with 1 mil of US dolars… well the phishers can get all that 1 million if they want to… how ?
1. ATM (max $2000 at every 12 or 24 hours)
2. wire transfer
3. using the credit card over the net at 324324 websites buying from electronics to jewels and so on
4. going on e-bay and “supposedly” buying an yaht or a car with just an e-check
5. transfers from real currency to e-currency and then back to real currency just to wash the money
6. western union/money bookers and many others whom are doing world wide money transfer…
7. playing on “setup” online casinos
and many other ways…
well all those transfers can be made in 1 hour and that single person lost 1 milion, so basicly they don’t need 50 scams… while they can do 1 and good. You will never know anything other then theory untill you see it with your own eyes.
PS: For the guy who said that it doesn’t matter if the “systems” are secure or not.. i’ll tell you something.. if any of the actual banks that have online banking would be more secure i bet none of these would happen, because that’s the first point from where the phishers start, they check the solen data if they have an online banking account, they check if it has any money on it or not. From online banking you can do wire transfers and/or you can confirm many other processes that helps them to withdraw and steal the people’s money.
re: i don't get it
Joe, phisher and spammers don’t use regular email accounts like you and I do.
most of it is sent from websites with automated scripts… so in effect they’re actually just sending 1 email… a few million times… while they sleep.
That’s just one way… there’s several. There are programs that do this, then there’s also exploitable websites.
Does your website have a contact form? Does it let me type in characters for my name, or email address, or subject? If so, I can spam using your website.
so your restriction would only stop the spammers or phishers who have no idea what they’re doing.
re: myself
heh, techdirt (correctly) blocked the example characters i typed in there…. but you get the point.
SSN
Another thing that not many of you knows, nowadays at even more then half of the actual banks in the world, the phishers need only an SSN( social security number) to get your accounts, they don’t need your full personal informations and nor even your credit card since only with an SSN they can get your e-banking account by a very a lame and insecure process… and that’s “Forgot your password” and “Forgot your user ID”, another lame process is that on some e-banks you can even login with your credit card number and a simple password, also if you got the credit card number and the SSN you easily get the password…. bah see IF only the systems would be more secure NONE OF THESE would happen. But heh we are in 2006… so wakeup.
Hidding under your nose.
But the assistant director of the F.B.I.’s Cyber Division, James Finch, suggested that this was slowly changing.
“We are sharing evidence and using sophisticated techniques like never before,” Mr. Finch said in a statement. “Cybercriminals will no longer be able to hide behind borders to conduct their illicit business. There will be no safe haven for cybercrime.”
Something very funny, 30-40% of the AOL(America Online) accounts are fake, created with stolen credit cards and used by “phishers”, “carders”, “crackers”, “hackers” because it provides a WALL and behind that, they can easily hide and none of you would look there, first because it provides dynamic ip addresses whom don’t have any real location, they are registered as virtual and when you lookup the ip addresses the results are in US even the “enduser” is located in china or australia.
That’s where FBI should start the leads from, because AOL is the “NEST”, they are hiding under your nose and you don’t even know that.
Why should Phishing be easier to track than drug d
The structure of a phishing gang and a ring of drug dealers is basically the same. They both need some channels to handle the money. Having is a pyramid scheme is the solution for both. The front people are at the bottom of the pyramid, they might get caught. All the real money makers are safe on the upper levels of the pyramid.
Xenia
Re: Why should Phishing be easier to track than dr
are they really safe in the upper levels of the hiearchy? what makes you so sure?
Mr T