Slashdot Mirror
How To Catch A Scammer/Spammer
Joe 90 writes "An interesting story got posted on the Irish Linux Users group. It involves the arrest of a scammer/spammer working in an internet cafe. It even includes the attempt to eat a usb pen drive, several cops and a 10 minute struggle to subdue the man. Story is available on the Linux.ie mailing list
By the way Gardai = the cops in Ireland."
No wonder there was a struggle!
Comment removed based on user account deletion
I kinda like all the stories I have read here about /.ing the spammers and signing them up for junk snail-mail and the like. (and if anyone can find me the link to the old story, I'd appreciate it)
after trying every spam blocker known to mankind
:)
I've finally switched to whitelisting. So far
it absolutely rocks and it doesn't need any
legal enforcement whatsoever.
For good measure I have a password override on it
and any email that contains the password has
it's senders address automatically added to the
whitelist.
which is why I'm not afraid to put my email right
here : j@ww.com , no spam will get through because you're still missing the password
Very simple, extremely effective.
A unmamed man aprehended a scammer and a spammer,a nd put them in the slammer using only a scanner and a spanner!
Or something like that........
Fellowship 9/11
It's a comforting thought to know that there actually is legal action being taken against those suckers. :) I think it's a proof that he knows he's in deep trouble :)
I find it very amusing to read how the spammer tries to struggle and fight back the cops
It wasn't a scam, it was just a bad April Fool joke...and we all know we had a blast with bad jokes on Slashdot. Everybody deserves a little fun.
An Indian-American Hindu committed to non-violent thought/speech/action alarmed by the global explosion of radical Islam
From the article:
Some of you who were on #linux on friday will know part or most of this story already as i witnessed some of it (while drinking a truly delicious hot chocolate).
You know, more people should mention what they're drinking when relating news like this.
There is an interesting and [somewhat] related article on The Register.
I want to drag this out as long as possible. Bring me my protractor.
...but a search engine. Posted anonymously as I don't really want to have to fix their stupid server today. Thank you all very much.
I hate spam more than I hate crackers
But yet combining spam and crackers can be quite a tasty treat.
Do it for Jesus
I guess he needed to add that last line, since this all happend around the first of April.
Maybe he should have looked into the Thermite option we saw in the latest edition of The Broken?
Of course, you don't want that going off when your trying to swallow the evidence. On second though, you don't really want it going off in your pocket either...
"Luck is what others call skill when they have none." --Phelan Kell
I work for a busy Dublin Internet cafe, doing some sysadmining and general computer maintenance. On Sunday the 28th of March, I got a rather distressing email...
...I asked around, and a man, described as being black (or is the word African-American these days?)
Hmmm...
Cheers to the Gardai and to the Sysadmin...
One more spammer cuffed and gone.
CUFF THEM ALL... EVERY DAMN ONE OF THEM.
Slainte... everyone involved in the arrest deserves a drink... stronger than that truly delicious hot chocolate.
The problem with socialism is that they always run out of other people's money. - Margaret Thatcher
Of all the fallout from the 419 spamming, I dont believe anything is funnier than Ebola Monkey Man. Good way to kill productivity this fine Monday morning. ;)
This guy sent my first scam/spam to my cell phone last week. Sorry but I had to report you guys for it. I don't particuarly enjoy getting stuff to an address I've had for a week :p
Glad you caught the bastiche though.
-maz
<happiness>beer</happiness>
Not sure if for simple spam he would have a problem under ireland's law, but as scammer probabilities go up.
No! Say it ain't so! It's bad enough we export McDonald's and Britney, but now we're exporting our political-correctness?
An "African-American" is a person of African origin living in America. Not all African-Americans are black, and not all blacks are African. Certainly it would be a strange coincidence if this black person in Dublin was visiting from America, and also happened to be originally from Africa.
This stuff hurts my head.
The House Between - Original Sci-Fi Series
Would be a good beginning of the punishment for spamming!
the admin narrating the story said the perp looked to be black (or is the word
African-American these days?), roughly 30, with an accent which seemed
half London and half African
Uh, I don't think the term 'American' should be applied to a guy with a half London and half African accent who's currently in Ireland. I just don't see the connection.
Hmm.. I kind of understand the attempt to eat cops (though you could have better diet), but how do you eat a 10 minute struggle? Is that something bad tasting that doesn't stay down or is it those police men that make it thight fit for your stomach? Well.. should subdue anyone..
Store with salt
There's a certain irony to an Irishman in Ireland referring to hauling people off in the paddywagon. Especially when the guy in question actually isn't Irish.
What a great story!
Hey, if the memory stick were actually swallowed and then passed through the scammer's digestive system, and the Gardai waited it out and retrieved it from the loo, and it still worked, think what a great marketing slogan the manufacturer could make from that.
Tough enough to pass through the guts of a scammer!
If this story turns out to be a hoax, I'll be sorely disappointed. The thought of one of these 419 scammers desperately trying to break free of the grasp of the police in order to run back and hit a kill switch on his notebook computer makes my nipples explode with delight.
You are in error. No-one is screaming. Thank you for your cooperation.
So he would be an Irish-American? Err, wait...
Typos... that's just how I role.
Someone prominent in the U.S referred to Nelson Mandela as an African-American. I can't remember who but it brings a smile to my face whenever I hear it.
:-)
I was poking fun at them
Where's all the posts saying how this guy's privacy rights were destroyed/taken/bushed by the sysadmin?
/. we are supposed to ignore the fact he's in public and using someone else's internet.
This is
[Fuck Beta]
o0t!
i'm trying to picture a revived miami vice, focused on computer crimes. imagine the possibilities. ok, there aren't many...
/.'rs are pretty, um, passionate on privacy and gov't intrusion, even if this IS an (alleged!) spammer who by definition is not humanoid. :)
congrats to the irish police for taking the offense so seriously. but is anyway here wary of the snooping involved? yes the sysadmin had every right to monitor traffic, but in what depth and for what purpose? for example, there's talk here of trying to fish out the suspect's email password and so on -- at police request. wouldn't it would feel a bit different in the police, without warrant, were to do the same themselves -- imagine worst case of them bugging all internet cafes to examine generic traffic without individualized suspicion. it's bad enough they want to see what we do at the library....
practically speaking, i would imagine the government generally lacks the resources to parse large amounts of computer data. but just wait until it can be done by computers hunting for suspicious transactions, much as the credit card companies do now to catch fraud. the capability is there.
i'm not sure where the legal stuff comes out here, this is not US law, but wonder about future possibilities. it is debatable what expectation of privacy you have in an internet cafe -- are keyloggers ok? is decrypting information different from reading plain text? must the user be warned? as an analogy, consider that when the federal exclusionary rule was first judicially established, it did not apply to states and the "silver platter doctrine" emerged whereby state investigators would get what the feds wanted and hand it over clean of any search and seizure problem. obviously this is a charade.
someone who acts at the behest of the government -- an agent -- pretty much *is* the government, and i wonder if this interpretation colors the reaction of anyone here on privacy -- normally
It even includes the attempt to eat a usb pen drive, several cops...
Now that is one hungry spammer!
Dublin, Minnesota, of course!
...your server has that much more spam to send to the bitbucket. :)
--JT
Well, let's all start flood pinging it before we start to start thinking about our actions, its neighbor IPs, or whether the information is even really accurate :)
Imagine the same politician thinking to himself, "don't say the N-word, DON'T say the N-word" over and over, and you'll see why Nelson became an American that day...
me
Can't... Stop... Laughing...
Slashdot gets worse every day... Pipedot: News for nerds, without the corporate slant
Unfortunately it would seem that whilst you have obviously been furnished with a good understanding of the term 'African-American' you obviously have zero understanding of the term 'humour'.
Blaming GW Bush for the Iraq war is like blaming Ronald McDonald for the poor quality of food.
Yea, ditto on the hmmmm
If he had a London accent, shouldn't he be described as English-American???
I suppose that _does_ give us a united Ireland, though. I'm not certain which side would be happy about it this way. Both Irish would make one lot happy, both British would make the other lot happy - how does it work if the whole lot of us are American?
Real Daleks don't climb stairs - they level the building.
No! Say it ain't so! It's bad enough we export McDonald's and Britney, but now we're exporting our political-correctness?
An "African-American" is a person of African origin living in America. Not all African-Americans are black, and not all blacks are African. Certainly it would be a strange coincidence if this black person in Dublin was visiting from America, and also happened to be originally from Africa.
It almost killed me when I heard a US newscaster refer to Nelson Mandela as African-American.
When your world is all round pegs, what can you do when you encounter a square one?
This story made my day. One less spammer on the 'net is always a good thing.
Don't underestimate the power of The Source
Best Line: "Or a contraption which hits the user on the head for every mail they send. So if they send 1 an hour, it's a mild nuisance. But if they send 100 a minute, it'll probably kill them."
VENI, VIDI, VICI, DIXI
d'oh,
that's English-African, or Englishman of African extraction.
Ahh, it is an easy mistake to make *0*
One line I liked, in particular:
"What have I learned? Firstly, digging up evidence on criminals is an exciting activity. "
This is the sentiment I have over my jackwhispers.com website. The deconstruction of the criminal mind is very fascinating - particularly when it involves a technical computer issue.
Yell & scream & rant & rave... it's no use... you need a shaaaave ~ Bugs Bunny
Bingo,
I can't understand why e-mail never evolved to allow ONLY whitelists in the first place.
Our company doesn't use whitelists, just crappy blacklist rules, and now loads of people have spam!
Then, he spent a bit of time on http://www.emailspidereasy.com. Don't you just love the fake google-textads?
Yup, love is the word. I also love these links on the same page:
Credit cards - links to credit card resources
Cheap loans - compare and get a cheap loan
Compare mortgage quotes - cheap mortgages online
Work from home - make money with working from home
Seems this is the only site spammers need to visit; they have links to spamming resources as well! Very convenient ...
I hear there's rumors on the Slashdots
and they are investigating.
They are a co-lo facility, barebones, FYI.
THIS THING CAN TURN ON A DIME, MACROSSZERO STYLE ALSO FUCK BETA, ~NYORON
Huh? I thought transparent proxy can only be enabled for HTTP & FTP trough squid et. al. I guess I have to search more info about setting up postfix as a transparent SMTP proxy.
Eh how about you read the mail.
Our cafe was *BLACKLISTED* by spamcop. I checked the logs. I found his MAC address and when he came in with his laptop. I asked the staff. They described him. He came back and I caught him red handed.
And I would have gotten away with it, if it wasn't for you meddling kids!
Hrrm... I usually just sign my name.
i wish the author said what monitoring software he used (other then tcpdump), what software was used to transparently monitor http and smtp
Does the name Pavlov ring a bell?
African-American is about the stupidest PC label ever. First, as you rightly point out, it technically has no racial connotation and covers all the other racial groups who have lived in Africa for generations.
Secondly, a Kenyan I knew (who happened to be a black Kenyan), once told me never to call an African African. "There are no such things as Africans. There are not even Kenyans or other such nationalities, although I can tolerate being referred to as Kenyan since it is the best compromise between easily identifiable to foreigners and almost correct."
Technically my wife's boss and daughter are African-American, since both of them were born in South Africa. They're also white, and it would be side-splitting to have her report her "race" in college as African American. I'd wager there are more than a few college scholarships naively defined as being for African Americans, when they really mean blacks.
Some of you who were on #linux on friday will know part or most of this story already as i witnessed some of it (while drinking a truly delicious hot chocolate). For those of you who don't, the following is a report written up by a friend of mine on his succussful (or at least, it's looking good) attempt to stop and catch a 419 scammer. I feel it's worth the read
,
John
-------- Original Message --------
Subject: I fought the scammer... and I won.
Date: Fri, 02 Apr 2004 21:54:30 +0100
From: Steffen Higel
To: John Allman
paulinemccaffrey at eircom.net, stevecash at ireland.com, tony.odonnel at cs.tcd.ie, declan.dagger at cs.tcd.ie, edwin.higel at brookside.ie, marynstanley at eircom.net, richard.bannister at cs.tcd.ie, oconnoat at tcd.ie, jean.higgins3 at mail.dcu.ie
[This is long, and is quite heavy on the technical discussion. Skip the bits you don't understand. It gets interesting.]
I work for a busy Dublin Internet cafe, doing some sysadmining and general computer maintenance. On Sunday the 28th of March, I got a rather distressing email from a sysadmin in a large U.S. University. Spamcop had blacklisted our server's external IP address. Abuse mail for the server in question gets sent to my college account (bad practice, I know, but it's a part time job). My college uses Spamcop as a blacklist source. You can probably tell what happened...
Anyway, said email included the full headers of an email which was natted by our server pretending to be from the widow of Mr. Jonas Savimbi, offering the recipient a share of an unspecified large sum of money. The usual panicked thoughts kick in... "Have I fiddled with something which has left us as an open relay?", "Has our server been cracked?", "Have I been sleep-spamming again?". A more reasoned examination of the headers showed that the mail had originated from one of the IP addresses that we assign dynamically to people who bring laptops into the cafe. This is something of a nightmare for cafe operators, we can hardly block outbound smtp but then again it isn't possible for us to manually check every single mail either. Maybe rate limiting is a valid technical solution. Or a contraption which hits the user on the head for every mail they send. So if they send 1 an hour, it's a mild nuisance. But if they send 100 a minute, it'll probably kill them.
A peek through the logs revealed:
Mar 26 15:04:16 server dhcpd-2.2.x: DHCPDISCOVER from 00:40:f4:5d:aa:f7
via eth1
Mar 26 15:04:17 server dhcpd-2.2.x: DHCPOFFER on 192.168.1.70 to
00:40:f4:5d:aa:f7 via eth1
Mar 26 15:04:17 server dhcpd-2.2.x: DHCPREQUEST for 192.168.1.70 from
00:40:f4:5d:aa:f7 via eth1
Mar 26 15:04:17 server dhcpd-2.2.x: DHCPACK on 192.168.1.70 to
00:40:f4:5d:aa:f7 via eth1
Mar 26 15:04:20 server dhcpd-2.2.x: DHCPREQUEST for 192.168.1.70 from
00:40:f4:5d:aa:f7 via eth1
Mar 26 15:04:20 server dhcpd-2.2.x: DHCPACK on 192.168.1.70 to
00:40:f4:5d:aa:f7 via eth1
Bingo. I had something to work with. The network card is one based on a Cameo 32bit chipset. Matches up quite nicely with these:
Return-Path:
Received: from 192.168.1.70 (server.XXXXXX [XXXXXXX.29])
byXXXXXXXXXXXXXXXXXX) with SMTP id i2QFrgi0002755
for ; Fri, 26 Mar 2004 10:53:44 -0500 (EST)
Reply-To: "michelle savimbi"
From: "michelle savimbi"
To:
Subject: urgent response
Date: Fri, 26 Mar 2004 15:53:26 +0000
Organization:
Mime-Version: 1.0
Content-Type: multipart/alternative;
boundary="----=_NextPart_0 00_0034_01C221EC.6C64F7B 0"
X-Priority: 3 (Normal)
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2600.0000ams
X-MimeOLE: Produced by Microsoft MimeOLE V6.00.2800.1165
I asked around, and a man, described as being black (or is the word African-American these days?), roughly 30, with an accent which seemed half London and half African had been in the cafe with a laptop and had a number of visitors call into
It even includes the attempt to eat a usb pen drive, several cops and...
Diet tip of the day: never try to eat cops. That whole pig motif's just a cunning lie.
This is the kind of thing that makes your day, knowing that you personally have removed at least one source of the crap that fills inboxes. Let's hope the Irish bobbies can do something amazing with your tcpdump trace and if not I'm sure there will be vigilantes out there waiting to DoS the servers you mentioned!
We need more admins who are willing to take action.
Is there scope for running something like spamassassin on outgoing mail? Do people do this? Would give you a chance to stop outgoing spam before you get blacklisted.
Ummm...I'm pretty sure Canada is already the 51st state.
This is a story that starts with a sysadmin seeing a 419 scam, hearing that there was a black guy with a "suspicious" accent in his cafe, deciding that this must be our criminal, and deciding to read his e-mail to find out...
Right?
Not totally. He first said that a company (Spamcop?) blacklisted him and he didn't know why. He went back to investigate and looked through the logs, he saw a lot of traffic by someone using a laptop at the cafe and figured that the person was spamming. He had the hours it happened, and asked, and the person told him about the "suspicious" people during those hours.
...are much tastier with a bit of ketchup, and easier to swallow too!
Visit http://ringbreak.dnd.utwente.nl/~mrjb/growingbettersoftware to download your free copy of the book
I was sick that day in school; why do you not refer to him as African American?
No, a sysadmin has his IP balcklisted because of spam, discovers it was sent from a laptop and when. Then he finds out that there was someone in with a laptop at the right time and they had visitors while they were there (which is not rare or suspicious of itself in a net cafe, but it attracts attention and can look suspicious depending on what they are doing). The guys description was male, black, 30 and a half london, half african accent. The sysadmin had the MAC address of the laptop and asked the staff to watch out for the same man. When the same guy appeared the sysadmin raced in and after the guy had waited to get a particularly private booth the sysadmin saw the mac address appear and hence had his confirmation. But the police wanted someone caught in the act of doing something illegal so he had to keep watching until the spam went again. Not quite as you described it eh?
Never underestimate the dark side of the Source
Hmmm, well let's think for a moment:
a) The internet cafe is more or less a public place, as well as a private establishment. If they don't have a sign indicating monitoring, at least they wouldn't have anything indicating that you do have 100% privacy
b) No "privacy" was violated until the issue with SPAM was discovered. At this time, massive SMTP requests were tracked to a particular machine/NIC using the MAC address.
c) MAC generally being a fairly unique identifier (not many people MAC-spoof), there was a fair bit of surety that the monitoring action was being taken against the same scummy spamming individual, used to acquisition evidence against his activity which while if perhaps not illegal, would almost indefinately violate the usage agreement for the cafe.
d) You don't really really even have that many privacy "rights" with your ISP. They log activity for these very reasons (spammers, kiddy-fiddlers, other illegal activitiy). If you were tagged as a spammer (with a non-spam friendly ISP) or a kiddy-pr0nography, you would no doubt come under scutiny with them as well.
He did say: postfix and squid (presumably using iptables or similar to do the rerouting to a local machine).
Though, I'd recommend calling the "militant anti-spam vigilantes" BEFORE calling the cops.
Take those baseball bats and solve the issue!!!
Have you noticed them spammers using any politeness when spamming you? - No. Alright then.
"The pen is mightier than the sword"
In this dumbasses case, it's mightier than the sword when it comes to stabbing himself in the foot.
He should've used one of those biometric ones that you can encrypt your data (AES-128 or better I believe).
Q. Surely Ireland, Britain etc. should be the 0th, 1st etc. states? ;o)
A. No. And don't call me Shirley.
I also work in a Cybercafe and Callshop in Dublin ... ... we copied and collected the faxes for a while and rang the Gardai and told them what was going on ...
... who refused to beleive that it was a scam.. and insisted that it could'nt be and that they where going to get their money ... they had to ... they'ed risked there whole buisseness on it and had sent over $100,000 to the scammers... :(
Last year I noticed that someone was using our fax machine to send and reseive 419s
we had film of him comming in to send faxes and recieving faxes from people which went along the lines of
Dear Sir, we have resieved your money but need more to bribe people in Bank of Ireland / AIB / cant remmember which bank they where making up.
and getting replys with letters of Attorney for the transpher of money and such...
the Gardai came took the faxes and some photos from our security system... but said there was nothing they could do... I still see the guy around... not so many faxes though...
At the time my boss rang the poor person in america that was getting scammed
we had so much dirt on that nigerian guy it's crazy that he's still wandering round free...
The jury is still out on that question.
Food not Bombs is a nice platitude but it breaks down when you notice that the Bombees are usually well fed
Actually, from his name the admin in question sounds German or Austrian -- Steffen? Could be Irish all the same I suppose.
... was found in the booth as well, I suppose?
f-f-f-f-f-f-f!!!
If construction was anything like programming, an incorrectly fitted lock would bring down the entire building...
The cafe operator ought to know better:
If you operate a public Internet access point (school, library, cafe, city park, etc.) please block egress port 25 traffic! Your patrons do not need to pretend to be an e-mail server. To allow such traffic to come from your network is to invite spammers, scammers, and so on to operate freely with your resources. Anyone needing legitimate e-mail access can use webmail or pester their ISP or business to use SMTP+AUTH+SSL/TLS for initial mail submission (on a port other than 25, of course).
Configuring a SMTP server to handle this in not difficult for a reasonably skilled sys admin, so no excuses!
http://appft1.uspto.gov/netacgi/nph-Parser?Sect1=P TO1&Sect2=HITOFF&d=PG01&p=1&u=/netahtml/PTO/srchnu m.html&r=1&f=G&l=50&s1='20030009698'.PGNR.&OS=DN/2 0030009698&RS=DN/20030009698
Better stop innovating, it could get costly.
I think Allan Cox has been using a very similar method for a long, long time.
My mail is so bad now, I'm probably going to set up such a method. I just can't deal with it anymore. My email is utterly useless now.
Was it really a joke? Or has someone in Ireland been brainwashed enough by our media to think he's supposed to call blacks in his country "African-Americans" - ? It's sad that I believe the latter first, though I'd love to be proved wrong.
The House Between - Original Sci-Fi Series
Why not?
You're a cyber cafe, not a shop that's set up with local accounts. Mail should be of one of two types:
Either way, your proxy server should have a default DENY outbound port 25 EXCEPT from your mailserver, which itse'f is handling the authentication for the few accounts that really are allows to send mail.
This space for rent. Call 1-800-STEAK4U
Good work Steff.
...
In fairness the guy who was 419ing from my Cafe was Nigrian and I just use the word as an expleative now.
He also had a simmilar acsent... no laptop though.
heay Steff long time no see
wie gehts?
Chris
Or he could be American-Irish.
Ok, how about we just call him a man. Is that alright with everyone?
I don't think that the only problem for internet-cafes are the customers who run "illegal" software, but also the security-policies of the cafes themselves. If policies are not enforced lots can happen before someone takes action.
I'm currently a part-time employee at a Swedish Internet-cafe where I work as a system admin. I've previously only been taking care of the Linux systems which we run for sponsored websites and gameservers but have recently been forced to take over the work of our late Windows-loving administrator.
He had the responsibility to maintain our firewall (WatchGuard), our active-directory Windows2000 server (user-database and login) and the exchange system, aswell as other system as the check-in/out machine. These tasks has now forcedly fallen onto me as this previous admin has been removed from further duties. Perhaps he had too much on his hands or he simply didn't care, but lots of security-policies were not enforced which could have saved me lots of trouble.
Anyhow, recently I began getting calls from an employee at a university here in sweden who told me that spam were originating from our mail.domain.se machine, after doing some further checks I noticed the e-mails were infact being sent from a software disguised as "nortonav.exe" on one of our game-machines. Acting as a spam-daemon. The first thing I did when I had recieved the password for the firewall was to block all smtp-traffic except for the trusted exchange and shutdown this terminal. I've set-up a series of security policies as well as tried to teach the cafe-staff some security-values as in maintaining the antivirus/adware-awarity. Would there be other good countermeasures to take?
Some of the firewall-blocking:
03/31/04 19:05 firewalld[159]: deny out eth1:0 48 tcp 20 128 192.168.0.102 64.236.62.131 4697 25 syn (SMTP)
03/31/04 19:05 firewalld[159]: deny out eth1:0 48 tcp 20 128 192.168.0.102 64.4.50.99 4696 25 syn (SMTP)
03/31/04 19:05 firewalld[159]: deny out eth1:0 48 tcp 20 128 192.168.0.162 200.208.9.162 3525 25 syn (SMTP)
03/31/04 19:05 firewalld[159]: deny out eth1:0 48 tcp 20 128 192.168.0.162 213.212.42.30 3524 25 syn (SMTP)
It may be just me who has had bad experience with all administrators at companies I've worked at, who only see Windows as the only option but is it more common for these kind of people to ignore security?
Wer hat das gesaght?
Der arme Spammer?
Mien Deutch sind ganz slecht.
oh wait are you talking about the nigerian?
Other illegal activities including using P2P, discussing Islam, contributing to Open Source, criticizing President Bush or Chinese Communist Party, etc.?
I don't want my activities monitored in the Internet cafe. Well, perhaps monitoring for network-related reasons is ok (traffic, spamming, port scanning, troyan sending, etc.), but not recording (that's what transparent proxying means).
Recording someone's activity should be reserved for those cases when the system administrator already has reason to suspect someone, not as a prevention or a way to entertain himself.
Future Wiki -- If you don't think about the future, you cannot have one.
As a black man, I absolutely HATE being called African-American.
People *think* they're being *safe* by referring to me as one, but I'd rather punch anyone that uses that term in the friggin' nose.
to be found here on the bbc
every day http://en.wikipedia.org/wiki/Special:Random
Why is it every time school bureaucrats are shown to be fools they have to lash out and suspend students?
Does anyone else find having entire Cybercafes blacklisted by anti-spam filters a bit worrying?
I do a lot of travelling, and about a year ago, I noticed that in a lot of Cybercafes, when I tried to e-mail a particlar person, I got an automated response from their mail-server to say it had rejected the e-mail because it was spam. I usually use my Freeserve account (via a web-mail interface). I wondered how my e-mail address could have become blacklisted, and tried my Hotmail account which I hardly use (I only got one could use MSN messanger). The Hotmail e-mail got through (I got no automated rejection, and even a reply). This at first led me to the conclusion that my Freeserve e-mail address had been blacklisted. Later, I found that sometimes, e-mails from my Freeserve account would get through, and at other-times, they would be rejected.
Eventually, I figured out that it was the IP address of the place I was sending it from that triggered the spam-filter. This has lead me to two conclusions.
Do all spam-rejecting filters give out an automated rejection-reply? If not, then I won't know that my e-mail has been rejected by an anti-spam filter, and I won't try to mail it again from my Hotmail account or another place with Internet access.
Try this out for some fun with bad PC labels.
do not read this line twice.
>USB pen drives aren't very filling.
Don't know. That's a lot of bytes.
"Living in a former oppressive totalitarian state, now a relatively free country. My best regards to Americans, who do the opposite." This is on your entries page at /. - please explain
Except this was a private business whose product (internet access) was being degraded because they were being blacklisted because of a Spammer.
That has real consequences to the business, as customers may not return when they find that they can't send email to their company/friends from that particular cafe.
Linux - Because Mommy taught me to Share.
So they can stop the uprising, put the kids back in line. What's more amazing is they get away with it. And did you notice they also suspended students for passing out a petition critizing them for having racist awards like this? The exact sort of free speech that is VEHEMENTLY defended by the supreme court, and courts all over the USA, time and time again. It's one of the freedoms they got right, and they know what it's good for.
But then, this is the USA's public school system, which is apparently pretty bad. Makes sense that the teachers are lame too, doesn't it?
>
> Eventually, 2 more gardai arrive and he's cuffed and brought out, crying like a little girl
Ten. Whole. Minutes. Skulls thumping, billy clubs and fists flying, and 419er whimpering.
Video? Even grainy stuff from the internet cafe's security cam? Please? Pretty please? Pretty please with a lead pipe and a clump of spammer flesh on top?
> What have I learned? Firstly, [ ... ]
FIFTHLY: BRING A VIDEO CAMERA NEXT TIME! You got to see all the good stuff, and you didn't SHARE!
He didn't say they were scammers, did he? Re read the quote you posted. Doesn't say a thing about them being involved, does it?
You're not being politically correct, you're being an asshole.
Carpe Deez
Amen. I kind of balked at the same paragraph (since the spammer was black the sysAdmin is now justifying denying access to other black people with african accents?).
You mean Niggardly?
In a business you cant predict who your next customer may be.
If you filter him out, he will be someone else's customer..
---- Booth was a patriot ----
Of course IP addresses in cafes should be on blacklists. You answer that question yourself when you mention just about half have been abused.
Why are you sending direct to MX from an internet cafe?
You have a return email address on your email. The server that handles that address should be setup to allow an authenticaed relay for you. Then your email always goes to the MX of the recipient with the same IP as the address of your MX. If your MX is properly secured you'll never be blacklisted.
And no, not all filters reject. Most client side filters (many of which use blacklists in whole or in part) just dump the spam without sending a reply. SMTP does not gaurantee delivery or notification of delivery. It's up to you, not your technology, to make sure your messages get delivered. So setting up a configuration that works most of the time is in your interest. Sending direct to MX from a cafe is, as you've discovered, not very fail safe.
I say let him eat the pen drive, then have our Guardai friends load him up with a couple of pounds or kilos of that good Irish farm cheese. Then we'll see how much he likes being a spammer.
Revenge fantasies really are a waste of time, aren't they?
Why do I have this? I don't smoke.
The correct term, as everyone should know, is African-African.
Er, wait...
~Idarubicin
Were I you, I would set up a Paypal tip jar.
I know I'd kick some cash your way!
www.eFax.com are spammers
What the #$%^ is Gardai?
You're both wrong!
Every school child knows that CANADA is the 51st state. Britain and Ireland are clearly states which joined later. Duh!
The "funny" thing is, these politically correct terms are often more offensive than the terms they replace.
Ham is a particular part of the pig, and spam is no part in particular...
The Gardai as they are referred to are actually called, in Gaelic "Garda Siochana na hEireann", which translates to "Guardians of Peace in Ireland" . They are the cops in the Republic of Ireland. They even go on peacekeeping missions abroad.
I hate sigs.
Technically my wife's boss and daughter are African-American
If your daughter is african-american, you should realy check what your boss is doing when he asks you to stay in work after working hours...
Googlefight declares your 'humour' to be the loser.
Please begin using the proper spelling as soon as possible.
LOL!!
Tylena Martin, a junior, said the poster had been on the door to her homeroom class where she is the only black student. She said she felt hurt by the posters and the backlash that ensued.
Someone should tell little Tylena to grow the fuck up. Being a whiny little P.C. bitch isn't going to get her anywhere in life. The few celebrities that are both are the exception, not the rule.
-Ryan, with the unoriginal sig
The USB key was probably one of those encryption keys from http://enovatech.net/ they are used in some IBM laptops. It's a hardware real-time encryption device. Where the USB key is the "key".
Remove the key and the harddrive will be inaccessible.
but couldn't internet cafes and the like install SpamAssassin on the outbound as well as the inbound servers? That way, if an outbound email is flagged as spam (tolerance altered to suit) it could be prevented from ever leaving the network?
If it's been done I'd like to see where/how, 'cos that could be quite useful.
I certainly hope nobody sends any nasty email to the schools email westside@westside66.org I certainly would not do so.
Snowden and Manning are heroes.
Since independence, of course, Irish law has evolved along a different path -- a written constitution, for example -- Bunreacht na h-Eireann (basic law of Ireland).
All laws are published somewhere in here -- a very interesting site from our Department of Justice, Equality and Law Reform: http://www.justice.ie
Then why mention them in the first place?
I think the asshole shoe is on your foot.
This is a story that starts with a sysadmin seeing a 419 scam, hearing that there was a black guy with a "suspicious" accent in his cafe, deciding that this must be our criminal, and deciding to read his e-mail to find out... Right?
Right. Every time a black man is arrested for breaking the law, it's not his fault. Some racist white bastard is to blame.
-Ryan, with the unoriginal sig
I have bought a domain (let's say johndoe.org) from a very cheap url forwarding company (at a rate of something like $15/year). It comes with unlimited e-mail forwarding aliases, and a "catch-everything" alias (let's say notexisting@johndoe.org), that forwards any e-mail send to non-existing alias to the default e-mail address that I have defined.
:P
:)
The default e-mail address (let's say secret@johndoe.org) is an alias that forwards everything to my real mailbox (let's say johndoe@aol.com). Of course, my real mailbox address, my catch-all address and the "default" address are not given to ANYBODY.
For my communication needs, or whenever asked, I just makeup a e-mail address (jonamazon@johndoe.org for amazon so that I will remember easily what address I use on the site). Since the alias is not setup in the mailserver, when amazon tries to contact me, the e-mail will follow the following alias path:
1) jonamazon
2) notexisting
3) secret (default)
4) real mailbox
When I see an spam message (once in two weeks!!!), I just divert the alias to point to an abuse address of a random spamhaus. The good thing, is that since I use random but descriptive addresses, I can see what websites actually harvest e-mails and sell them to spammers!!!
It is interesting to note that at some point I received e-mail that were addressed at some ridiculus random aliases (e.g. jesus@, happykitty@ etc) of my domain (clearly not used by me). Just an indication of the use of wordlists (of course every such alias got blocked).
I have not yet reached the levels of paranoia of giving seperate e-mail addresses to any of my friends of course
Anyway, it is not as complicated as it looks, and of course way less complicated than using bayesian filters and the like. And believe me, it works
Hi all,
This OT but my money is worth more than my karma...
I had a buyer purchase my Sony Playstation on Ebay. Surprise surprise, its from a brand new ebayer acting on behalf of a relative in Nigeria. The offered US$22 (funny, the bid was GB20) via Western Union. I received an email from "Western Union" but actually from an accountant.com address (like the one in the article). I smell a rat and obviously won't send anything, but is this accountant.com a known haven for scammers?
Thanks, John
-- "...I'm a bad guy because I, well, I sing some rock-and-roll songs." M. Manson
I'm still not clear how you knew it was him from the initial log - did your staff notice him coming in and leaving at the time the logs said, or was he just the most suspicious person there during that time? Surely the cafe wasn't otherwise empty.
That said, although you don't explicitly say so in the story, I'm assuming you were tracing only that particular MAC address, and so if it weren't him, your tcpdump wouldn't have shown anything at all. For some reason the story implied that you raced to the cafe and set up a trace on his particular Ethernet port, which is of course not how it's usually done unless you have a managed switch...
"It even includes the attempt to eat a usb pen drive, several cops and a 10 minute struggle to subdue the man."
You mean he wasn't "shot while trying to escape?"
He is joking, grow a sense of humor.
His daugter is African American because she was born in Africa and was born to a native-born African. Of course they're both white.
My wife and I don't have kids.
I'm surprised that the author used the term "paddywagon", which I understood to be an american term particularly offensive to an irishman.
-MattT *** Not speaking for my employer, or any other sentient beings ***
should be reserved for those cases when the system administrator already has reason to suspect someone
/home/* | awk '{ if ( $1 > 100 ) print $2 ":" $1 }'
Which of course, they did. So in this case there's really nothing to complain about. As a sysadmin myself, I generally stay out of the proxy logs and/or people's home drives. However, there have been occasions where I've had to poke around:
a) Internet logs: Innapropriate behavior or suspect behavior gets one of two things. I general GREP of the logs for inappropriate keywords, or in most circumstances, a GREP of logs for the person in question.
b) Home drives: Recently we've been getting a bit high on the drive size in home directories. I don't like quotas, because some people have legit reasons to use more space. However, I do find this a bit useful:
du -ms
(basically, print out size/username of directories > 100MB)
Most users here (a school) are sub-100MB, with space for documents, some graphics, etc. More recently, we've been having issues with students storing game installers, demos, etc on the network space. Having several GB extra when I do a network-based backup can be annoying, so I periodically check out the homes of large drives. Minimal intrusion is done if possible, I just scan for the deepest large directory, then see the filenames. If they seem suspicious, I may investigate further, but in most cases the "WARCRAFT_3_DEMO.EXE" is a dead givaway.
The trick in being an admin is to be as unrestrictive/unintrusive as possible, while still finding ways to grab the info you need to deal with cases of abuse. Not always an easy thing to do... and sometimes I wonder where the students find the time/place to download over 50MB of pr0n (and hope I've never used the keyboard on that terminal).
I mean, are there any news articles that can collerberate what this guy is posting or is this a tall tale?
... the ability to customise your display preferences, and also an easy way to keep track of on-going discussions that you have participated in.
At least that's why I registered.
Only 50 megs of porn? Amature.
he never mentioned denying access to anyone.
Many million Irish emigrated to the US between 1845 and 1950. One of the more popular areas for them to work was law enforcement. Therefore paddywagon actually refers to the fact that it carried so many Irish cops not that it carried so many Irish prisoners.
Start: 4/5/04 3:46:06 PM
Whois user: 66.180.174.12
OrgName: Netsonic
OrgID: NESO
Address: PO Box 28283
City: Green Bay
StateProv: WI
PostalCode: 54304
Country: US
NetRange: 66.180.160.0 - 66.180.175.255
CIDR: 66.180.160.0/20
NetName: NETSONIC-BLK2
NetHandle: NET-66-180-160-0-1
Parent: NET-66-0-0-0-0
NetType: Direct Assignment
NameServer: NS1.NETSONIC.NET
NameServer: NS2.NETSONIC.NET
Comment:
RegDate: 2001-10-15
Updated: 2003-05-28
TechHandle: IA111-ARIN
TechName: IP ADMIN
TechPhone: +1-920-490-1128
TechEmail: ip-admin@netsonic.net
OrgTechHandle: IA111-ARIN
OrgTechName: IP ADMIN
OrgTechPhone: +1-920-490-1128
OrgTechEmail: ip-admin@netsonic.net
# ARIN WHOIS database, last updated 2004-04-04 19:15
# Enter ? for additional hints on searching ARIN's WHOIS database.
No, I think it's:
...
51) Canada
52) Britain
53) Germany
54) Japan
397) France
The only title of honor that a tyrant can grant is "Enemy of the State."
I'm surprised that the author used the term "paddywagon", which I understood to be an american term particularly offensive to an irishman.
I think he was just taking the Mick. Or maybe he was just drunk, bejaysis.
Gwan da Steff!
The conclusion of your syllogism, I said lightly, is fallacious, being based on licensed premises
You can tell you don't have to pay for the traffic, and how is an algorithm going to stop traffic OUTSIDE the telcos router. You see if it goes into you network either good or bad traffic you pay for it. The Telco company just sees a figure based on that, and that is what you are billed for
And besides, spamming is pretty sophisticated these days, if the mail delivery fails, the target e-mail is often removed from the list of e-mail addresses they are trying to send scam e-mails to ( as far as I know )You have got to be kidding! I see bad traffic from addresses EVERY day from addresses that have been dead for 4 years. If it bounces it bonuces back to some-poor-sap.comcast.com. We have blackholed all the big boys so today about 90% of the spam that gets through our servers and our filters is basically untraceable due to the fact that it traces back to some machine on DSL or on a cable network. One day the SAME message comes from a comcast machine here in the US. Tomorrow from a DSL modem in Denmark. You can't stop that, and they can't know what mail is bouncing nor do they care.
Fact 72% of the traffic logged on our servers IS BAD TRAFFIC!!. Either machines looking for an open relay, trying to send to generic addresses that don't exist, or bouncing because they have been blackholed. now with a number like that do you really believe that when they get a bad address they just go away?
Think about it like this only 28% of the use of the server and the connection to the network is paid for. The rest is stolen. Not a good turn around of profit=resources.
I do believe whitelisting is the way to go!This just doesn't work on a business level. Say Joe Blow goes to your web site and wants to use your company. He sends you an email and he's not on the white list and his mail bounces. Most likely he will go somewhere else to do his business and you lost a sale.
The only cure is stiff harsh and cruel punishment of these assholes. They are theives no matter how you look at it, and they steal out of MY pocket daily.
By the way cops = Gardai in America.
Once again, an American makes the mistake of thinking that he speaks standard English and assumes that the Internet should be translated into American English.
Does anyone else think it a bit strange that an Irishman would consider calling someone in his own country "African-AMERICAN?"
Duh. That would be African-Irish. ;^)
... while in an internet cafe? I mean, in theory it's not much different from a hotel providing a phone service to a customer, whilst sneakingly listening in.
Don't get me wrong here, spammers are bad and should be caught, but it doesn't do any good when the spammer is let go in a day because of lack of undisputed evidence. My eavesdropping on a communications channel doesn't really do much good there.
I understand that when the communication actually goes to your own server there is nothing wrong (practically, in many countries it is ok to record a conversation as long as you are the one having it), but I feel that intercepting his yahoo or mail.com passwords is a little on the gray side of the law...
Please correct me, I want to be wrong here.
Slashdot: stuff for news, nerds that matter, matter for news, stuff that nerd
I find that having to accept mass quantities of spam from cybercafes more than a bit worrying.
So you figured out that the blocking is based on the IP address. Of course it is. If you make direct SMTP connections, it's going to be blocked from zillions (well, realistically, a few myriads ... that's tens of thousands) of networks around the world. If you submit your mail via web pages on some free mail sites, such as Hotmail, you can still end up getting blocked by some of those networks because they scan the headers and look for the HTTP client IP address that the sites add on. Most don't go this far, but many definitely do that (I don't for free mail sites that are working to fight spam being submitted through their service).
That's not entirely true, but since Hotmail does make a big effort to stop submitted spam abuse, very few networks are checking its headers for blacklisted IPs. Hotmail is therefore more usable. Perhaps Freeserve isn't doing as well as Hotmail. I don't scan either of them for blacklisted client IPs at this point.
Some do, some don't, and some have limitations. Because of the fact that spammers are using forged sender/from address in their mail so much, it has become necessary to avoid bounce back messages. Many networks (including mine) do block networks that bounce spam to forged addresses (they are just as much a part of the problem as open relays, open proxies, and infected always-on home machines). Some networks solve the problem by ensuring that all spam checking is doing during the SMTP session so it can be rejected by a 5XX response code, instead of sending back (to the forged address) a bounce message (this is the strategy I use). Some others who can't make that happen in all cases (because of their unfortunate choice of mail server software) might change things so the bounces are simply not sent (these are the cases where you won't know to retry an other way). This is one of the advantages of block-by-IP (which I do) as opposed to block-by-content (which I do not do) ... it happens at SMTP session time, and you get a rejection (which if you connected directly should result in your mail program leaving you a failure notice of some kind).
Be aware of this crucial point. My objective (and that for many network operators) is more about reducing the spam attempt workload for my network and servers, rather than reducing the exposure of the messages to human eyes and the excessive wear and tear on the "D" or "Delete" keys. Blocking the sources of spam does not eliminate the costs ... it only reduces it to about 1/4 of what it otherwise would be. But I still see an average of 2 to 3 SMTP connection attempts that turn out to be blocked as probable spam ... per second. Sometimes the peaks go over 100 (and the mail server bogs down briefly when that happens). What that means is I can't really cut the costs any further without also breaking the ability to override that blocking for specifically whitelisted email addresses (e.g. if I block at the packet level, I won't establish the SMTP connection at all, and won't know what the sender/from email address is to use that to check the whitelist database). So that means spam fighting has to go to the next level to further get it reduced, and that means doing stuff like blocking whole cafes, and large chunks or entire ISPs, to "encourage" them to do something to stop
now we need to go OSS in diesel cars
He should have taken some advice from ramzi
spook
nig-nog
chocolate soldier
coloured cousin
spade
oh, I could go on forever...
I look forward to the day when we have to start saying "Black African-American", and then just shortening it to "black"... Ah, the lifecycle of a politically correct term.
Assume I was drunk when I posted this.
I'll be back in Dublin soon, time to drop in to buy Steffen a beer. Or seven. ;-)
the AC
Hemos is like...sci-fi fans;he thinks technology is cool, but he hasn't bothered to understand the science it's based on
Hang on, Australia's AT LEAST the 53rd state. Possibly the 52nd.
-- INTX Grouch. http://www.midnightblue.net
Ok, how about we just call him a man. Is that alright with everyone?
Except that he's a spammer/scammer. That doesn't qualify as a man. I vote for "scum".But why is the rum gone?
No kidding.
I use CF13 (see sig), a program I wrote to handle my spam problems once and for all.
The only 'false-positives' I got were from reputable senders that got subsequently whitelisted--problem solved.
In a perfect world, Spammers would be aprehended and put in a prison cell with men who have had a penis enlargement, taken viagra, and are looking for a fresh new relationship...
I went to a private high school, where they had one of those silly racist scholarships. Amusingly, it was given to a white kid who had grown up in S. Africa.
"I hope more libraries, internet cafes, and wifi hotspots will monitor their traffic occasionally"
I do not wish the same. Monitoring should be only performed when. like in this case, there are reasons to suspect criminal activity, and this shuld be backed up by a publicly available policy warning you that you do not have any expectation of privacy.
Casual monitoring of private sessions "just in case" or for the fun of it should be discouraged unless we want to become East Germany pre Berlin Wall fall.
IANAL but write like a drunk one.
A news story being carried by Yahoo! reports that a Nigerian 419 scammer (arrested in Ireland it seems) has been tried and found guilty by a court in the UK (Wales) and sentenced to 20 months.
Well, if you have to sign some forms for a membership, stating that you won't be using the service to do anything illegal, and that you accept the fact that your activities might be logged and monitored....
Vintage computer games and RPG books available. Email me if you're interested.
Internet servers are like highways; you're not going to automatically get your car searched just for travelling, but if you're speeding, or driving erratically, well, you're getting pulled over.
Vintage computer games and RPG books available. Email me if you're interested.
Heck, I can sign an agreement that I am willing to be put on stand in the middle of a square and get tomatoes thrown at my head. That doesn't make it "legal" by law. Last I heard, the law overrules a contract when it clearly 'goes the other way' (not talking about the casual leapholes..). Sorry, I need a different answer :)
Slashdot: stuff for news, nerds that matter, matter for news, stuff that nerd
You're right; you can't sign away legal rights.
You don't currently have a legal right to use somebody else's network to perform illegal acts. Therefore, as long as I let you know you might be monitored, I'm fine.
Hence the 'this call may be monitored for quality assurance' messages on phone queues, and 'Wal-Mart uses CCT and video recorders to help cut down on shoplifters, have a nice day' in, well, Wal-Mart, and 'Internet activity may be monitiored to help ensure quality of service blah blah blah' in Internet cafes.
Vintage computer games and RPG books available. Email me if you're interested.
Or, as American experience proves, if you are black.
Future Wiki -- If you don't think about the future, you cannot have one.
In parts of the UK it's common to call Black people "Afro-Caribbean", whether they're from Africa or the Caribbean (but definitely only when they're Black).
I just call 'em "folks".