Slashdot Mirror
Child Porn Accusation As Online Extortion Tactic
Glenn writes "There's a story on silicon.com about a new twist in the tactics used by online extortionists trying to blackmail ecommerce sites with denial of service attacks. Yesterday one blackmailer threatened to send out child pornography emails in UK gambling site Blue Square's name if it didn't pay up 7000 Euros." This sounds even worse than simple DoS threats.
Using SMTP as our default e-mail system has got to go...
SMTP is wide open to the kind of attack that is being discussed here. Since there's no authentication of the sender, anybody can send out messages with the "From:" address of the desigated victim, and can smear their reputation into being anything from a spammer to a pornographer.
The only surprise to me is that it took the bad guys this long to make the connection into this being something to make extortion threats over. It's not like this was a well-hidden problem with SMTP, sender spoofing has been done by spammers and phishers for years.
We need to retire this standard and find a better way to move e-mail with the ability to authenticate that the claimed sender is the real sender. It'd solve this problem and a whole bunch of other ones at the same time.
Publicize that this is in fact a lie and the truth shall set you free.
In other words, once this scam is publicly known, it will be worthless for the scammers.
It should, however, get the attentio of the authorities much more readily though.
These guys admit to having illegal photographic material in their possession and are attempting to use it to make a buck. Catching these would be much better publicity for the enterprising copppers than some two-bit hackers.
You can't take the sky from me...
What, this extortionist thinks that people will honestly believe that a legitimate organization is now sending child porn? I think not. Let him send out all this child porn, thus not only proving that he has it, but also that he's willing to commit extortion and probably a number of other crimes. Good luck to him...
Blackmailers like this provide the test cases that clean up Internet law by building case history. A judge's decision showing the blackmailer is liable protects other victims later, diluting the force of unfounded accusations with trivially contrived evidence.
--
make install -not war
..really, I'm shocked. The company I worked for a few months back on a contract basis was getting threats like "If you don't ____________ we'll spam in your name/send people fales rates for your service/send a virus from your accounts/send magic pixies to rearrange in your sock drawer". This really seems like the natural progression of things, as sad as that sounds. You can really only hope for one of two options. Either inform the media and hope if and when it goes down, enough people are "in the know" that you can avoid any backlash or keep your fingers crossed that one of the proposed email verification ideas takes off.
since they're probably in some flea bit FSU state. and given what many (if not most) in the US call "pornography" (when it comes to children) it wouldn't be hard at all to fill that promise by sending out a few pictures of the local kids playing on the beach.
You seem to have forgotten that the internet doesn't end at the coasts?
This isn't about framing them legally - it's about smearing their reputation further. Any competent website op is going to have logs, and their tiering partners are going to have logs as well. It would be almost trivial to prove to the FBI the "bad stuff" didn't come from them, but it would likely be a fair sight harder getting the luser recipients of said material to believe it.
RTFA. These are online gambling sites. Most gambling has a large amount of organized crime involved. I think that getting fined/arrested should be the least of these scumbags' worries. And whatever the mob would do to them, they would deserve it.
-paul
Pistol caliber is like religion: everyone has their favourite, and theirs is the only right choice.
Using US Postal Service as our default mail system has got to go...
USPS is wide open to the kind of attack that is being discussed here. Since there's no authentication of the sender, anybody can send out messages with the "From:" address of the desigated victim, and can smear their reputation into being anything from a spammer to a pornographer.
The only surprise to me is that it took the bad guys this long to make the connection into this being something to make extortion threats over. It's not like this was a well-hidden problem with USPS, sender spoofing has been done by spammers and phishers for years.
We need to retire this standard and find a better way to move mail with the ability to authenticate that the claimed sender is the real sender. It'd solve this problem and a whole bunch of other ones at the same time.
Welcome to the world of international law enforcement on crimes committed over the Internet.
Perps: in Russia
Victims: UK and US
Victim contacts Scotland Yard or the FBI. If they have time, they'll investigate and figure out the perp is quite likely in Russia, but they can't be sure, because they used an anonymous proxy in South Korea. It's now about 3 months after the incident.
They contact the South Korean network with the open proxy. They answer after a month or two saying they didn't keep logs. Pass go, do not go to prison.
They then contact the Russian authorities. The Russians answer you have no proof this falls under Russian jurisdiction, and even if you did, you have failed to show how which Russian law was broken, and even if you did prove Russian law was broken, the punishment under Russian law is 5 months probation, and no, we will not extradite the criminal to the US or UK.
We're now at 5 - 6 months after the incident.
That's assuming it's not the Russian mafia, who really doesn't give a shit whether or not the Russian cops bust them for $7K extortion scam.
In Soviet Russia, I ruled you
Comment removed based on user account deletion
What a load of crap. Spammers are in the game for profit.
but if a company, and granted i don't gamble so i don't know what their typical mailings are like, that i do business with sends me an e-mail with pornography in it my first thought is not going to be, "sick bastards! i'll never gamble there again!" it's going to be "one more victim, how sad." i think this type of thing get's blown out of preportion, which if i might add is what the spammers are really looking for (next to money). no i'm not proposing that if we ignore it the problem will go away, find the useless scum and string them up, but i think people in general are smart enough to figure out that the companies they do business with aren't involved in the child pornography industry. i see this as a hollow threat because even if it is followed through with it's an annoyance at best (spoken as someone who has an effective spam filter). the worst part about this is the precedent it sets because i can garauntee this is not the last we've heard about this.
The only way to get rid of a temptation is to yield to it.
-Oscar Wilde
Like Lyndon Johnson said, it's doesn't have to be true; it's enough to make the poor bastard deny it.
TRUE free speech requires anonymity, to prevent reprisals from the government or other parties that disagree with the speech. It's the same reason that we have anonymous voting. If you had to put your name and address on your ballot, then someone outside the voting area could use your past record against you to 'influence' you (usually with a heavy object or projectile weapon). They also have a list of people to deal with before they get the chance to vote in the next election.
Yes, we may get a high noise-to-signal ratio by allowing ANYONE to say things and be anonymous, but otherwise we would end up with only those people speaking the party propaganda actually safe from harm. (Think PRAVDA, or other Soviet-era news outlets).
And 'filtering' free speech, by definition, makes it non-free.
On reading the headline I thought the extortionists were threatening to upload child pornography to their servers then call the authorities.
This would likely get their servers seized at least long enough to figure out that they'd been hacked. To an on-line business, that may just be long enough to put them out of business.
With just emailing in their name, all the extortionists are doing is causing a breif blip of bad publicity before they get the word out that they're being framed.
... when you establish thought crimes.
If times were different the threat might be to send Communist propaganda.
One thing you're not understanding: it was Catholic policy to move the priests to different locations which led to more children in danger instead of getting them help. That is just one notch below endorsement. Its sick.
That's right. All your base.
That's not what he said, jackass. He wasn't saying we should just take free speech away from people we don't like. Laws tend to take away rights in exchange for safety/order/efficiency/whatever. And hopefully the trade-off is worth it. Your parent post was implying dismay that a similar trade-off is almost looking appealing as people find more destructive ways to utilize the anonymity that the internet can provide.
One time I threw a brick at a duck.
But we have technology that works almost perfectly with existing SMTP servers that combats this very threat.
No, we most certainly don't.
SPF, Sender ID et al are designed to confirm that the sender or sending domain is reflected accurately.
And how, exactly, does this "combat" anything?
Assume a scammer wants to extort money from "UpstandingCo.com". What's to stop them from registering "UpstandingCo.cx", "Upstanding-Co.com", "UpstandingCompany.com", or any one of a zillion other domains, setting up the appropriate SPF/SenderID record, and using that to send out their hoax emails?
Anyone who would believe that "UpstandingCo.com" would send kiddie porn in the first place isn't going to be smart enough to realize that "Upstanding-Co.com" isn't the same outfit.
*THAT* is the problem here. It's not a technical problem, it's a social one - and you can't solve a social problem with a technical solution.
First off, it seems to me that the weak link in this extortion scheme would be the money transfer. The extortionist (not to be confused with "contortionist" or "exorcist", or some combination thereof) would have to be very clever not to be caught by the transfer. If it's something as simple as a wire or drop-off, catching the person or persons responsible would be a snap.
Second, there is no reason to believe that the person(s) making the threat actually has child pornography (not that I'm defending him/her/them). The posession of the material is not required to make the threat. The extortionist could be like a bank robber without a firearm, either claiming to have one but not, or having a toy pistol (having "barely 18" pornography that looks like child pornography).
In short, in order to actually pull something like this off without getting caught, one has to either be very smart or have a very stupid target.
~UP
Eat the Path.
Reprisals don't necessarily come from the government. Just because the government doesn't crack down on dissenting opinions, doesn't mean other groups or individuals don't. The call for anonymity protects the speaker from ALL sources of reprisals. The witness protection program, from organized crime reprisals. The whistleblower program (government protection for those uncovering corruption and/or misdeeds in the government processes) protect the person coming forward. News reporters protecting their sources is an old and honored practice, to prevent these sources from being endangered by 'forcing' them public. All of these are non-governmental persecution on free speech.
Free speech is more than complaining about the government, it's the ability to say dissenting opinions about any subject. Individuals and groups unfortunately, respond with violence against these people that are publicly identified with their speech and/or policies. (Think presidental assassinations, the assassination of Martin Luthor King, Bobby Kennedy, many Equal Rights speakers during the 60's, church burnings, random killing of openly gay individuals, bombings of Planned Parenthood clinics, the list goes on.) Unpopular opinions can get one killed. Without anonymity, most of these people afraid for their safety would simply shut up.
Aside from the utter fucking nastiness of getting this stuff, it is just as bad to get busted receiving this shit as it is to be busted for sending it, in a frame-up such as this.
I may be completely off here, but I seem to recall a case where a guy was persecuted/prosecuted based on some email he'd gotten via some group but hadn't requested. At least, that's what he claimed.
Even if it were true that he requested it, the problem is with the ambiguity in the law but the complete lack of ambiguity in public opinion. Even if he were eventually found completely innocent and publically touted as a model citizen, there are still going to be all kinds of people who now know way more about his masturbation habits than he'd like, and probably quite a few who refuse to believe that he didn't do it - where there's smoke there's fire.
I can't be certain, but I bet there are some people who have emailed child porn to people and then called the police to turn in the recipient, banking on exactly this kind of thing.
What we need is one of 2 things:
1: A system where we have some reasonable definition of what a person's intent is. Just because Joe Schmo signs up to recieve Hot Anal Action pictures from a Yahoo! group does not mean he is culpable when some asshole spams that group with child porn.
2: A way to absolutely verify where an email came from and then ruthlessly bitchslap the person or people responsible for this kind of shit.
In a reasonable world, I'd hope for 1, but who can say what'll happen.
Since I can't tell them apart, I treat all ACs as the same person.
Now, threatening with sending child porn with their email is not very serious. A lot of spam was sent with my email address (some spammers send spam with real email addresses instead of totally fake ones to try to have more luck, and being hit with that a few times), but checking mail headers normally clean a bit what really happened (why i would travel to mexico just to send spam? :).
Of course, if the mail server of this people is an open relay or is hacked, and is used to send child pornography, spam, 419 scams, Al-Qaeda advertisement or any kind of law-breaking stuff, well, there mail headers will not help a lot, and they will have a bit of responsibility on that.
which city? which team? which tv station? names please
Of course a smart company will realize that giving in to blackmail will do nothing except encourage more blackmailing, to the detriment of the whole industry. But in order for all companies to take this stance, it should be made an offense to pay off blackmailers, subject to heavy fines. That makes it much easier for a company to reply to scammers "i'm sorry, we'd love to pay you for your lack of services, but uncle sam won't let us." Such a law would be much more effective than a similar one for kidnappings and ransom, as it becomes more of a pure business decision rather than a moral and emotional dillema.