Industry News April ~ June 2007
back to Recent News

 
Spam baiters fight back at fraudsters
Canada.com, April 01, 2007, by Gillian Shaw

VANCOUVER - Most people hit the delete button when they receive an apparently fraudulent e-mail promising vast riches if the recipient co-operates - co-operation that can rob gullible victims of tens of thousands of dollars.

Not Mike Berry.

The Britain-based computer engineer launches into an elaborate "scam baiting" response, in which he convinces the scam artist to do his bidding and even send him money.

In the case of one e-mail from "Prince Joe" of the Nigerian National Petroleum Corporation, it led to a hilarious correspondence in which Berry convinced Joe to join the Holy Church of the Order of the Red Breast, complete with appropriate photo evidence. Before he was finished, Berry managed to get Joe to send him $80. Joe never saw a nickel of the $18,000 he was hoping his victim could be conned into sending.

The tale can be found at www.419eater.com, one of a growing number of sites that document how ordinary citizens fight cyber crime. Scam baiting, the subject of 419eater (another name for the Nigerian letter scam and based on the article of the Nigerian criminal code concerning fraud) is just one of the many ways Internet vigilantes are fighting back.

Fighting back can take as many forms as there are Internet cons. There is "phishing" fighting, hitting back at e-mails or instant messages that pretend to be from legitimate businesses and organizations and hit victims in a variety of ways - whether it's getting them to reveal passwords, financial details and other confidential information or simply getting them to unknowingly install malicious software on their computers.

There are the white-hat hackers, the so-called ethical hackers who use their skills to uncover security flaws in an effort to protect rather than exploit flaws for their own gain, which is the practice of their black-hat counterparts. The white hats can be found anywhere from security companies, where their skills are in high demand, to home basements where they send out alerts when they discover a problem and sometimes even land perpetrators in jail.

The self-appointed guardians of the Internet face risks that may dissuade amateurs from trying scam baiting at home.

"I get death threats on a fairly regular basis, at least once a month," said Berry, whose site gets 15,000 hits a day and has almost 22,000 registered members.

Berry, whose online persona is Shiver Metimbers, has written a book on the subject, Greetings in Jesus Name! The Scambaiter Letters.

Some of the stories are the stuff of adventure novels. A scam baiter only known by his online name YeaWhatever has managed to convince scammers who targeted him as a potential victim to travel vast distances - even from country to country - in the hope of making the big payday.

In one long saga, YeaWhatever (whose website is www.yeawhatever.catholiccall.org) reeled in a scammer and trolled him through an almost 6,000-kilometre trek along the African coast, supposedly hot on the trail of money hidden inside a GPS-enabled box.

In others, he sent a couple of Nigerian letter writers to Darfur, the pair believing they were stealing money from an elderly priest. When their boss started to worry, YeaWhatever convinced him to head to Khartoum (via Frankfurt) in the expectation of bailing them out. In another case, a hopeful scammer built a two-storey pyramid out of sandbags and videotaped the evidence for YeaWhatever - all in the expectation his victim would cough up vast sums of money.

While scam baiters say the Nigerian letter writers are usually working alone or not with access to large and sophisticated organizations, tackling them at their own game is not for mere novices.

"The whole ethos of the site is to raise awareness," said Berry. "People see the funny pictures, they read the funny correspondence and at the same time they are being educated about the scams.

“We have had lots of e-mail from real victims. We hear horror stories of how they have lost hundreds of thousands. The biggest amount somebody contacted me about was 120,000 pounds and that was lost by a lady in Wales; she was a retired school teacher and she lost the money over a period of nine months."

Eve Edelson, a computer systems engineer from California, created one of the earliest scam-baiting sites, Scamorama.com and she is the author of the recently published book, Scamorama: Turning the Tables on Email Scammers.

"There are two sorts of fighting back," she said. "On the funny side, it definitely wastes the scammers' time. The scam baiters are called jokemen among the scammers and the scammers hate them.

"The serious part is there are people who do more than just correspond with the scammer. They are technically very talented hackers who break into the e-mail accounts of the scammers and they are happy to share information with the police."

Ryan Purita, a white-hat hacker and security specialist and forensic examiner for Totally Connected Security said fighting back can range from the individual who gets a spam and decides to try and trace it, to the highly sophisticated corporate security specialists.

"They can do denial of services, they can compromise systems, they can track individuals to their home countries, but these are all legitimate people like me," he said.

Purita warns that for those who are not technologically savvy, trying to fight back against organized phishing schemes and the like can backfire.

"It is a very dangerous game to play," he said."If you piss off a credit card dealer or scammer or a major spammer, they can make it so you don't have e-mail, they can ruin your credit.

"Why do you want to throw up a red flag and say you don't want to take it? They don't care, but if you piss them off, they can make your life very difficult and they will, these are people out of Pakistan, Romania and Russia, for them there is nothing to lose."

While it's tempting to write back to those annoying Viagra ads and phishing expeditions, the experts warn not to.

"By writing back you are confirming your existence and it makes your e-mail address much more valuable," said Ron O'Brien, senior security analyst with Sophos. "And it confirms you check your e-mail."

That will make your e-mail address one that commands a premium rate among those who trade in them and your inbox will be flooded.

O'Brien said in the case of phishing e-mails, the best course is to report the e-mail to the company being targeted. Many banks and other organizations have directions on their websites for reporting such fraudulent e-mails.

Don't think a few online lessons will prepare you to take on the cyber criminals. Anyone with an Internet connection can find information on launching such counter attacks as taking down a website but in terms of online expertise, that's considered child's play among the experts.

"You've got to be careful," said Purita. "Don't go out there being a vigilante unless you know how to protect yourself and know what you are going to do if one of them turns on you, because eventually it is going to happen."

 
back to Recent News  
 
   
 
 
   
     
     
  Untitled Document A brand is much more than a trademark. It's a trustmark! TM

home | company | careers | press releases | info center | contact | privacy

Brandmail Solutions is a proud member of:
                                


To view this site, you must have the latest version of Flash Player installed.
Copyright © 2008 BrandMail Solutions, Inc. All rights reserved.