Cybercrime More Lucrative Than Drugs

prostoalex writes "Yahoo is reporting that global cybercrime overtook global drug trafficking in terms of revenue this past year. In related news, only 4% of Internet users can flag 100% of phishing e-mails as fraudulent, and Americans filed 207,000 reports on cybercrime to FBI."

Comments

dotCrime Bubbles

[fembots]

Yeah sure, they'd better party like it is twenty-zero-five, sooner or later they'll run out of idiots like dotcoms ran out of VCs.

Cybercrime requires constant training, otherwise your hacking skills can be out of date in just a few months. On the contrary, a crowbar-trained criminal can still make a living in today's high-tech security world.

I foresee in 5-10 years' time, traditional crimes will go mainstream again as many cyber-criminals will be out of jobs^H^H^H^Hcrimes by then.

Re:dotCrime Bubbles

[FooAtWFU]

In 2010, you will probably still be able to send the same sorts of pretty messages pretending to from be J Random AOLer's bank or John Q Public's eBay account, which link you to a site that looks almost excactly the same, and which scrape their email and passwords. The exact same message? Probably not. But take a look at the dozens of Nigerian-419 scams which are still basically unchanged since their inception...

Petty crime has plenty of 'local' variables like where the police hang out, which places have alarms and electronics, et cetera, but most have similar principles; electronic crimes have different rootkits and different websites to fake and emails to send and addresses to harvest and spam filters to bypass, but again, most have similar principles. Unless you're manufacturing the (crowbar|rootkit/botnet) things won't change much.

Re:dotCrime Bubbles

[FudRucker]

some of that cyber crime and fraud is none other than the web portols millions of users visit everyday, including but not limited to Yahoo.com

Re:dotCrime Bubbles

[sp0rk173]

so does the whole tired ^H^H^H thing make you feel cool? More of a geek than you actually are? I'm kind of sick of seeing it used...usually by people who don't even know what it's all about.

Re:dotCrime Bubbles

[darkmeridian]

Of course cybercriminals make more money.

Drug dealers are mostly young people a bad neighborhood who have nothing better to do. There was a study (in the book Freakonomics) that said that the average lifespan of a guy who stayed in the business to be around four years. Four years! And considering all that, the money they made in profit, with the jail time, etc., they made minimum wage. Being a drug dealer, the study found, had a significant degree of status and a lottery chance of being a kingpin. And that's about all they get from it.

Cybercriminals are sophisticated folks. Many phishers for online brokerages have graduate degrees in finance. (This week's Business Week.) They have capital to invest in their enterprise, too. Of course they're going to make more money and get away with it as compared to drug dealers, even the "high" level ones.

Anyway, I've been crazily modded down recently in weird ways. Look at my history. What the hell is going on? Someone leave me a message.

Re:dotCrime Bubbles

[Atario]

Not to mention you can actually commit cybercrime with a crowbar. Laptop in car + crowbar = bye-bye customer data!

Re:dotCrime Bubbles

[ZenShadow]

So true. I mean, after all, it's so much cooler to use ^H ^Q^H^H^W -- oh, screw it...

--S

Re:dotCrime Bubbles

[plover]

sooner or later they'll run out of idiots

Please. Learn you nothing from history, hmm? Let's see what our forebears had to say:

• Programming today is a race between software engineers striving to build bigger and better idiot-proof programs, and the Universe trying to produce bigger and better idiots. So far, the Universe is winning.
  Rich Cook
• Half the world is composed of idiots, the other half of people clever enough to take indecent advantage of them.
  Walter Kerr
• Never give a sucker an even break.
  W. C. Fields
• There's a sucker born every minute.
  Barnum, P.T.
• Every crowd has a silver lining.
  Barnum, P.T.

Since they apparently haven't stopped making idiots since the 17th century, I'm guessing we won't see the end of this for a long, long time.

Re:dotCrime Bubbles

[Viperlin]

personally i think your idea of drugdealers is incorrect, sure im not saying the type you describe dont exist, becasue they fucking well do. however most dealers are just people who see the world and chemicals for what they really are, not bound by society or laws restricting their thinking, there IS a market for recreational drugs, and it is an industry in the billions, most dealers use the money as just a little extra on the side, a holiday fund or a new car fund, they are not about "being criminals" they are just out to make money, and if done correctly, it can be clean money, were certain drugs legal and the ability to purhcase them like tobacco or alcohol over the counter, under a strict screening procedure, customers would leave unreliable products from dealers and go with the safer options of drugs screened and tested by companies, comparing these people to thugs that simply steal your money from you is not a good comparison, they sell a product, and a peice of paper somewhere says this is not allowed, the voilence and thugish nature people see about dealers on TV does exist, and when it coems to the gang wars, turf, etc, that is what needs to be stopped, not supply of recreational drugs like delta-9-tetrahydrocannabinol, MDMA, psilocin and LSD, after all, it is the users choice to destroy their body with extreme use if they wish, people who do that should be helped, not percicuted, a small amount of use is not really a problem, no different that sipping brandy while listening to your favourite CD, or smoking a cigerette in the comfort of your own home away from other people so it does not effect anybody but yourself i apologise for any spelling mistakes or grammar errors, i expect there to be plenty as i write this at 5am, hopefully you wont just dismiss me because it contradicts your opinion, and possibly try and see things from my point of view, writing this will cause no harm, thinking about it will cause you no harm either

Re:dotCrime Bubbles

[sp0rk173]

Well, you know, the actual FACT of it being cool or not has nothing to do with the fact that it might make someone feel cooler by doing it. For example, skinny white guys in baggy clothes. They look like fucking morons trying to be all gangster gangster and whatnot, but they THINK and FEEL cooler because of it. I want to shoot them in the head along with slashdot users who use ^H^H^H^H to pretend they're on some arcane unix terminal browsing slashdot with a telnet client, when they're probably actually at their hip student intern job on some windows 2k/XP box debugging in-house .NET apps.

Re:dotCrime Bubbles

[Ashley Bowers]

I see it alot differnt , and that it cybercrime will go up way up! It is to bad really because one way or another the little man will end up paying for it!

Re:dotCrime Bubbles

[Anonymous Coward]

the figures are wrong. just wrong. dont even ask how i know but i know. maybe they apply to crack dealers in the bronx or something but not anywhere else ive ever been.

Re:dotCrime Bubbles

[Anonymous Coward]

> Yeah sure, they'd better party like it is twenty-zero-five, sooner or later they'll run out of idiots like dotcoms ran out of VCs.

--> The world will NEVER run out of idiots. It produces them even faster than they die out, hence the population explosion.

Re:dotCrime Bubbles

[Anonymous Coward]

I am sure that the average drug dealer makes less money than the average cybercriminal, but I somehow doubt that cybercrime make more money than drug deals. Unless they... oh nevermind. They included piracy. That's not actually money flowing out of someone's pocket and into the nefarious criminal underworld, except for rare instances. But still, it would be very hard to pin an actual number on the amount of money that people make off drugs. Cybercrime (as in the theft of money) would be fairly easy as people usually notice when their bank account is lighter (or at least I would hope that they notice.)

And the other article, the only 4% of people getting 100% of the phishing scams right? First of all, they chose only some of the best looking phishing scams. I've seen some pretty horrid ones come my way including text only with gross mispellings and grammer erros. Oh, and by the way I never did business with the bank that they are claiming they need account information on. Second, you have no ability to mouse over the links and see if they actually lead to where they claim. True, it is possible to obfuscate the real target or have a mispelling of the website that is really close. That's why if there is a possibility that an email I recieve is from a company I actually do business with, I manually log on to the account in question by entering the URL into the browser, or at the very least googling for it and clicking the link through google rather than the unsolicited email. Still possible to scam someone on this by manipulating pageranks or offering a mispelling of an odd spelled word, leading the top google result to be their website, but that would be much more difficult to pull off.

New Slogan:

[Shadow Wrought]

Geeks! Now better than junkies.

Re:New Slogan:

[Anonymous Coward]

What about junkie geeks? Nothing like a good coke binge to get some serious coding done.

Re:New Slogan:

[TubeSteak]

But not as satisfied

Re:New Slogan:

[Anonymous Coward]

Hey, geeks can use drugs to get women too. Its just that we use clorophorm instead of pot.

Re:New Slogan:

[indifferent children]

A Diet Coke binge works almost as well, and helps compensate for a sedentary lifestyle.

Curbing malware and cyberthreats

[Sheetrock]

I've been around the Internet for a long time -- since the early 90s in fact -- and am thus quite aware of the ruinous activities it has been subjected to by the typical user since then. You know, things like people popping into a random USENET group and treating it like a tech support line, or in the larger picture basically assuming the entire network is there to serve as some form of entertainment.

When I started, the USENET application would inform me that my message would be spread across tens of thousands of computers at immeasurable cost as a subtle hint to keep things interesting, and Internet Chat required some basic knowledge of Makefiles and attention to documentation before you could run a client. Frankly, things became unmanageable at the point the Internet was made accessible to anybody with a web browser; anybody who's been around this long knows what I'm talking about.

It's a short hop to realizing that the problems we're experiencing with virii and worms are the same problem. Intimate knowledge of x86 assembly used to be a requirement -- along with a malcontent-type disposition -- in order to wreak the sort of havoc that today requires fifteen minutes and an Effective VBScript In Fifteen Minutes manual. Every document is now a program, and e-mail doubles as FTP.

Many experts believe we should raise the barrier of entry by requiring programmers to undergo education, certification, and maybe even an oath to do no harm as part of the certification process if going into a security field. It used to take years to do what kids today can do in months; additionally, a would-be programmer who spends a few months picking up Visual Basic or whatever has hardly learned the fundamentals of programming any more than someone who reads a manual about his DVD player has become a laser engineer. I suggest that the field and the general user experience would be greatly enhanced by limiting access to compilers/assemblers (by means of pricing and with the cooperation of the open source community) and by separating macros or other executable content from documents.

It makes more sense than trying to go out and educate every user. Think about it; in what other field do we "educate" "users"? We don't try to educate people with electrical outlets and let any curious individual perform as a licensed electrician. We don't "educate" passengers and let anyone who cares be a bus driver give it a try. Why are things always so difficult when it comes to computers?

Re:Curbing malware and cyberthreats

[maelstrom]

I agree completely. I've noticed a similar problem on Slashdot which your solution seems to solve nicely. I recommend we limit posting access to all users who have a greater than 3 digit ID. Maybe raising the barrier of entry will prevent me from having to read half cocked ideas like limiting access to compilers.

Re:Curbing malware and cyberthreats

[Seumas]

I'm sure you're trolling, but you AFFECT a change in something. The result of what you do would be the EFFECT.

Re:Curbing malware and cyberthreats

[Anonymous Coward]

This is the dumbest post on /. I've seen in at least 10 minutes. Even rn didn't necessarily warn you prior to posting that your post was about to go out to "thousands of users" -- this behavior was often turned off. No knowlege of makefiles was required to do IRC unless you needed to build the client from source.

Licensing works for electricians (sort of) because there are customers involved who might file a complaint. This is not the case for a virus-writer -- there's no customer. This is leaving aside the impossibility of actually restricting compiler availability.

Finally, "effect" can be used as a verb (to effect a change). "Affect" can be used as a noun "the patient's affect was flat".

Sheesh.

Re:Curbing malware and cyberthreats

[Eli Gottlieb]

Things are so difficult when it comes to computers because people are so insistent on having their own computers for their own data but don't want to learn how keep those computers secure. They are voluntary fools.

However, I do agree that we have no reason to put executable code in documents.

Re:Curbing malware and cyberthreats

[the-build-chicken]

you're 100% correct...history has shown that limiting the number of thinkers that have access to a problem is a sure fire way to obtain the best solution

Re:Curbing malware and cyberthreats

[daigu]

Should I cue the crickets chirping? =)

Re:Curbing malware and cyberthreats

[Hayzeus]

Um, no. Check a dictionary:

From mw online:

Function: transitive verb
1 : to cause to come into being
2 a : to bring about often by surmounting obstacles

Re:Curbing malware and cyberthreats

[servognome]

Many experts believe we should raise the barrier of entry by requiring programmers to undergo education, certification, and maybe even an oath to do no harm as part of the certification process if going into a security field.

That doesn't work for doctors and lawyers, why would it work for programmers?
 
  I suggest that the field and the general user experience would be greatly enhanced by limiting access to compilers/assemblers (by means of pricing and with the cooperation of the open source community) and by separating macros or other executable content from documents
 
Doing so via pricing is called collusion, and I doubt any intellectual community would ever want to have the tools of its trade limited by legislation. Do we outlaw word processors which can be used to write HTML for Neo-nazi websites?

Re:Curbing malware and cyberthreats

[6OOOOO]

But you can "effect change," where effect is a verb meaning to expedite or to actualize. So, don't know what you're getting at, but it looks like you misunderstood, as the parent was quite right.

Re:Curbing malware and cyberthreats

[jeblucas]

Actually, you're wrong. I started a thread about this in a Pet Peeves poll a few months ago. Check it out. Affect and effect can be used as nouns or adjectives. Admittedly, most folks here still screw them up.

Re:Curbing malware and cyberthreats

[Kjella]

So.... your argument is that the VB novice is the cause of all the security problems around. Why I'm certainly glad we're not blaming the highly skilled and experienced developers at large multinational corporations with 40 billion or so in the bank. You seem to miss the fact that a lot of the time, the application only does what a typical application does, but in a malicious way. Malicious coders will create programs to do this, and gullible users will run it. The other half is that computers have pretty much been in hell ever since you could get machines to work for you over the internet. It didn't matter how über-infected a PC you loaded by floppies and maybe dialed a BBS was, because it couldn't do anything useful for the creator. As long as people download random apps from the Internet, it'll continue to be this way. That is in fact one reason I think Linux can prevail - each distro typically has a massive library of software which are typically safe. If users can accept that as a "self-contained sandbox" they should be quite fine. It's certainly the only place I'd teach my parents how to install programs (or the support nightmare begins).

Kjella

Re:Curbing malware and cyberthreats

[unitron]

"I recommend we limit posting access to all users who have a greater than 3 digit ID."

So in order to have posting access you'd have to abandon your #638 account and get another one?

I wonder if Cmdr Taco has already reserved # 1,000,000 for himself to avoid being trapped in the 1-999 ghetto.

Re:Curbing malware and cyberthreats

[hunterx11]

"Affect" can be a noun too, though it's rather rarely used.

Re:Curbing malware and cyberthreats

[reynaert]

I suggest that the field and the general user experience would be greatly enhanced by limiting access to compilers/assemblers

Hah! I shall SAVE THE WORLD with my carefully hidden away TURBO PASCAL 5.0 floppy!

Re:Curbing malware and cyberthreats

[Anonymous Coward]

Way to figure out a way to brag about your low user ID. Fuckwit. If you think that a low user ID on slashdot makes you cool then you must live one pathetic existence.

Re:Curbing malware and cyberthreats

[crabpeople]

dude your a dick.

i remmeber bbs's before the internet too. you were limited to a few hundred, maybe a few thousand people. you go back to that you would be killing for a slashdot brining you news every 30 minutes.

that guy above me with the 3 digit user id already served you though, so i dont have much to add. The only thing i would say, is if we ever did move to an internet without clueless lusers you would most certainly not be on it.

in conclusion, your an elitest dick who sees the dark ages through rose coloured glasses. oh and no one cares which aeffect you use. most people are smart enough to parse what you MEAN out of a sentance. proper spelling of words is ALWAYS used to attack the person, and not the opinions that they represent. period.

Re:Curbing malware and cyberthreats

[Captain Splendid]

Frankly, things became unmanageable at the point the Internet was made accessible to anybody with a web browser;

This got modded insightful? Hey buddy, you want me to go sit in the back of the internet because I haven't been on as long as you have?

Jackass.

Re:Curbing malware and cyberthreats

[khellendros1984]

Quick! Everyone brush up on their machine code skillz!

Re:Curbing malware and cyberthreats

[Anonymous Coward]

When I was your age..... we had to walk ten miles... in the snow... to find a compiler. Kids these days. They can compile from the comfort of their own homes. Lazy bastards.

Re:Curbing malware and cyberthreats

[MutantHamster]

"Grammer tip: 'Effect' is used as a noun. 'Affect' is used as a verb."

Spelling tip: "grammar" has no 'e's in it.

Re:Curbing malware and cyberthreats

[budgenator]

so hex editing a pre-compiled worm to listen to the correct IRC channel would be ok because the scriptkiddie isn't actualy using a compiler.

Re:Curbing malware and cyberthreats

[Anonymous Coward]

In other related news, fewer than 4% of slashdot users could correctly identify sarcasm.

Re:Curbing malware and cyberthreats

[TheDugong]

No!

We should outlaw word processors because they could be used by terrorists to plot the use of weapons of mass destruction as well as create pro-terrorism web sites.

They are also used by pirates who steal intellectual property which threatens the very existance of the world, so really are just terrorists.

Not to mention kiddy fiddlers! How else to you think they communicate with each other! They use word processors of course!

We are sure of it all. Proof? trust us, why would be we lie!

Ban word processor use by the general public now!

You will sleep safer at night!

Re:Curbing malware and cyberthreats

[Nethead]

Aw, come on now, be fair and make it four digits.

Re:Curbing malware and cyberthreats

[Everything Else Was]

It's a short hop to realizing that the problems we're experiencing with virii and worms are the same problem.
:
:
--

Grammer tip: 'Effect' is used as a noun. 'Affect' is used as a verb.

Grammar tip for you: 'Virii' is not a word... try 'viruses'!

Re:Curbing malware and cyberthreats

[The Ultimate Fartkno]

All this kvetching about affect vs. effect and nobody's brain is exploding over "grammer?!"

I don't know if we should call in the Spelling Nazis or the Grammar Nazis, but there are *damned* sure some Nazis called for here!

Re:Curbing malware and cyberthreats

[jrockway]

Even better... less than or equal to 229604!

Have you honestly ever read a good post with a uid greater than 229604? Didn't think so. :) :)

Re:Curbing malware and cyberthreats

[plover]

Godwin! Godwin! You brought the Nazis into this! :-)

Re:Curbing malware and cyberthreats

[typical]

I've been around the Internet for a long time -- since the early 90s in fact

We're impressed.

and am thus quite aware of the ruinous activities it has been subjected to by the typical user since then...When I started, the USENET application would inform me that my message would be spread across tens of thousands of computers at immeasurable cost as a subtle hint to keep things interesting

Yes, it's nice when people choose to restrict their activities to keep a network usable. However, that isn't feasible at a large scale. Furthermore, taking a "technical restrictions keep you from abusing the network" approach rather than a "just do no evil, m'kay?" approach is a lot more stable against attacks from that one malicious individual who *will* show up no matter what on any network. ...and Internet Chat required some basic knowledge of Makefiles and attention to documentation before you could run a client.

You realize that maybe there are people out there who view people like *you*, who use IRC, as time-wasters? Hell, you're posting on Slashdot rather than transferring research data over FTP. What's up with that?

I mean, it's a gradient.

Besides, the fact that those masses out there have tax dollars that can be used and entertainment dollars that are spent is what keeps Internet pricing low and connectivity high. I don't really give a damn about the fine points of bonsai or Hello Kitty, but the fact that a lot of people do means that a lot of people work hard to provide high-speed Internet access inexpensively most places in the world.

Frankly, things became unmanageable at the point the Internet was made accessible to anybody with a web browser; anybody who's been around this long knows what I'm talking about.

If you think so. I find the modern Internet, with Google, lots of governmental information sites, Wikipedia, instant-messaging systems, Project Gutenberg, and so forth to be a lot more interesting than the old-style Internet, a mess of gopherspace and talk/telnet systems. Sure, there were some good things that got left by the wayside (I still don't have a suitable replacement for archie, though content-addressable URLs for eDonkey are coming close), but on the whole, I'd say that things are vastly better and more interesting today.

Re:Curbing malware and cyberthreats

[hobbit]

I suggest that the field and the general user experience would be greatly enhanced by limiting access to compilers/assemblers (by means of pricing and with the cooperation of the open source community)But who will enhance the enhancers?

Re:Curbing malware and cyberthreats

[hobbit]

I particularly liked:

Frankly, things became unmanageable at the point the Internet was made accessible to anybody with a web browser.

Seemingly uttered without a trace of irony!

Re:Curbing malware and cyberthreats

[Erbo]

You mean "limit posting to all users who have 3 digits or less in their ID," don't you? :-)

Re:Curbing malware and cyberthreats

[firewrought]

I suggest that the field and the general user experience would be greatly enhanced by limiting access to compilers/assemblers.

I disagree. One, you are proposing that we limit people's ability to use the computer as a tool to help them think for themselves. Computation is an intrinsic right of all humanity, not something to be confined to a particular group who have undergone a particular indoctrination.

Two, the general thrust of computing technology has been to push down more power to end users. Generations of researchers have tried to figure out how to make computers easier to program and use by ever-wider audiences. This has greatly magnified all of the original benefits of computers and computer networks: cooperation, innovation, and productivity. So of course it's magnified the bad stuff as well. You can't remove tools from the malicious without also removing them from others who have used them to create significant cultural and economic wealth.

The goose has grown. The golden eggs are bigger and so are the turds. If you're upset about the turds, the solution is to get a bigger shovel, not starve the goose. In the end, design, architecture, tools, techniques, and education will go much further than "lock up the compilers".

Re:Curbing malware and cyberthreats

[g-san]

First it was those with four digits. Now you three digiters are gettin' all fired up.

When are you going to learn? To truly be considered human you need 5 digits.

and sorry, I can't resist the gp's comment... You know, things like people popping into a random USENET group and treating it like a tech support line...

Re:Curbing malware and cyberthreats

[Seumas]

Affect: have an effect upon
Effect: consequence - a phenomenon that follows and is caused by some previous phenomenon

I don't know if "effect" can technically be used as a causative, but even if it can it's horrible. You AFFECT change. Change has an EFFECT on you. And that's the way it should remain.

Re:Curbing malware and cyberthreats

[TheTerrorized]

Also: Effect can be used as a verb, and Affect can be used as a noun.

Re:Curbing malware and cyberthreats

[Bacon Bits]

Security through elitism? Is that a new model?

Re:Curbing malware and cyberthreats

[bogado]

You know what? Why don't you create a meta-net that has a complex and source-only (with no makefile or automake) and crypt documentation? Then, only the geekiest, the 133713s7, would be able to enter. I guess that would be quite fun, there would be no banners, spyware, virus. It could be P2P, decentralized, encrypted, secure.

On the other hand your dream net would not have, diferent point views, girls (unless you count those in the pr0n pics). The fact is, much like the realworld, you're free to hide in your basement and only meet the few people that are your friend.

But the net is much more, that are thousands of people, that are not geeks, that are worth reading. There is a diversity and a enourmous possibility of meeting people from parts of the globe that many people had never even heard of. This is the strength of the net, and this is only possible with tools that everyone can use.

Sure this enable the creation of hundreds of thousands of ego-blogs that no-one but the owner and his closest friends read. Sure this enables virus and spyware. Sure this enables blinking banners and even noisy sites. But this are facts of life. I don't like to be surrounded by ugly and incoherent ads while I walk in the streets. I don't like to be mugged.

I don't like that there is violence in the real world. But they exist, and we can whine that the world was much better in the past (not sure if this is even true), or we can try to make the world better to everyone. That is my path, I want to live in a world, and use a net where everyone can join.

Re:Curbing malware and cyberthreats

[Alioth]

Grammer tip: 'Effect' is used as a noun. 'Affect' is used as a verb.

Spelling tip: It's spelled 'grammar'.

Re:Curbing malware and cyberthreats

[indifferent children]

No, but limiting the number of non-thinkers who are allowed to influence the solution(s) might be a good idea.

Re:Curbing malware and cyberthreats

[Ohreally_factor]

Unfortunately, the idiocy goes beyond merely failing to secure one's computer. Social engineering is a major component of many gambits to get sensitive personal information. In other words, people are not only too stupid to secure their computers against malware, they willingly install it on their machines (spyware) and voluntarily give out their credit information (phishing sites).

Re:Curbing malware and cyberthreats

[LaCosaNostradamus]

Many experts believe we should raise the barrier of entry by requiring programmers to undergo education, certification, and maybe even an oath to do no harm as part of the certification process if going into a security field.

That doesn't work for doctors and lawyers, why would it work for programmers?

Sure it works, for a highly-restricted definition of "works". Programmers will find themselves still making severe mistakes, getting sued, then submitting themselves to an onerous programming malpractice insurance system. Those damaged by bad programming will still be damaged, but some will (a la the "lottery model" as is used now in medical malpractice suits) be able to collect money, even large settlements.

The medical consumer is perfectly OK with this model. Why wouldn't it "work" with programmers?

Re:Curbing malware and cyberthreats

[sakasune]

Now that you mention it...

Re:Curbing malware and cyberthreats

[Hayzeus]

Well, I'll give you this -- you're dogged. A simple review of any dictionary (OK, any english dictionary) shows that effect, in fact, can be used correctly as a verb, although that usage is less common (but not uncommon) than when the term is used as a noun. You may not like it, but what can you do?

Note that when "effect" is used as a verb it is *not* synonomous with "affect". To EFFECT a change is to initiate a change. To AFFECT a change is to influence a change. It's never correct to interchange these two words. This may be where we misunderstand one another.

"Affect" can also be used as a noun (usually meaning emotional demeanor). ("The patient's affect was flat and lifeless.") This is a rarer usage, but perfectly correct. Again, however, "affect" is not interchangable with the word "effect".

There's a concise discussion at:

http://www.wsu.edu/~brians/errors/affect.html

I was a proofreader in another life -- if I were going to hand out grammar tips as the OP does, I'd at least try to make sure they were accurate (and to spell "grammar" correctly). I mean, how annoying would it be if I ended every post with:

Grammer tip: "pickle" must never be used as a verb.

Re:Curbing malware and cyberthreats

[joto]

I suggest that the field and the general user experience would be greatly enhanced by limiting access to compilers/assemblers (by means of pricing and with the cooperation of the open source community)

Ok, you've proved you're a troll. Now, go away!

It makes more sense than trying to go out and educate every user. Think about it; in what other field do we "educate" "users"? We don't try to educate people with electrical outlets and let any curious individual perform as a licensed electrician. We don't "educate" passengers and let anyone who cares be a bus driver give it a try. Why are things always so difficult when it comes to computers?

We "educate" our users in nearly every other field. We teach people to prepare food in a way that does not result in a house fire. We teach people to lock their doors. We teach people not to smoke on the bed, and not to leave candles burning when they go away. We teach people to cross the street in a safe manner. We teach, and even license, people to drive. We teach people not to put two nails into electrical outlets and see what happens, and we teach them that they should not do repairs on electrical equipment when the power is on, and we teach them that some repairs even needs a licensed electrician. And we do teach bus passengers to sit down and not disturb the driver.

Re:Curbing malware and cyberthreats

[Krach42]

Dude, seriously... wtf?

Don't you realize that I would never have been able to develop the programming skills that I have now if I hadn't had access to free, or mostly free compilers at a young age?

FUCK DUDE... if this post is meant in earnest, then you need to just go and shoot yourself before you encourage some lobbying agency to take up your cause and make the world suck.

Oil

[Seumas]

Yet, I bet both of them combined aren't as lucrative when it comes to funding terrorism as hitting your local gas station for a fill-up.

Re:Oil

[ozmanjusri]

Yet, I bet both of them combined aren't as lucrative when it comes to funding terrorism as hitting your local gas station for a fill-up.

I dunno, Microsoft seem do be doing all right with their version of the same thing.

Re:Oil

[nycguy]

While I have no love for the regimes of oil-producing countries in the Middle East and South America, the notion that importing less oil will seriously affect the funding of global terrorism is nonsense. According to the 9/11 commission, the attacks on the US were funded with only about $500,000 (link). I would venture that the global "budget" for terrorism is only in the low tens of millions of dollars, which is a drop in the barrel compared to the many billions of dollars oil exporters are making. A better argument for importing less oil is that we should not support the prosperity of regimes that have turned a blind eye on terrorism and that deprive their populations of democratic institutions (even if free democracy might result in theocratic leadership in the short term). However, I think that just working to ensure that the income generated by oil is more evenly distributed among the populations of exporters would go much further toward eliminating terrorism than trying to indirectly strangle the funding of groups that can already do quite a bit of damage on a shoe-string budget.

Re:Oil

[Anonymous Coward]

I bet both of them combined aren't as lucrative when it comes to funding terrorism as hitting your local gas station for a fill-up.

How in the world is that +5 interesting? It doesn't even parse.

Re:Oil

[hobbit]

What, you thought the OP was talking about terrorism against America?!

Re:Oil

[cas2000]

> While I have no love for the regimes of oil-producing countries in the Middle East
> and South America, the notion that importing less oil will seriously affect the funding
> of global terrorism is nonsense.

i don't think he was talking about those terrorists. he was talking about the terrorist cabal from Texas - you know, the ones that staged a coup in the U.S. a few years back and have been terrorising the rest of the world ever since.

Re:Oil

[LaCosaNostradamus]

I would venture that the global "budget" for terrorism is only in the low tens of millions of dollars [...]

Considering that the First World's militaries -- dominated by the US -- perform most of the terrorism of the world, and have done so for the last 50 years, I'd have to say your estimate is off by a factor of x10000 AT LEAST.

That's pretty damned inaccurate, Roscoe. You should at least know that $2 billion per month is being spent to terrorize Iraq. That alone is $50B/yr ... which is still 5000 times your estimate. You're WAAAAAAAAAAAAAAAAAAAAAAAAAY off.

No new law needed

[dada21]

Cybercrime pisses off U.S. black market businesses because it outsources a huge income potential to other countries.

All kidding aside, I don't personally believe in cybercrime. Some cybercrime victims are merely stupid users, and no law can fix them. Other cybercrimes that do disturb one's property should be covered by laws already in place.

My fear is that defending the cybercrime idea will only help make more wealthy lawyers and give politicians more abusive power.

Re:No new law needed

[Anonymous Coward]

What does your "believing" in it have anything to do with whether it exists?

Re:No new law needed

[dada21]

What does your "believing" in it have anything to do with whether it exists?

Belief means placing trust or confidence in something. I don't believe (trust) that cybercrime exists beyond the basic property crimes we already have laws against.

Re:No new law needed

[Anonymous Coward]

I concur.

It is not the job of the smart people to protect the stupid people from themselves.

Re:No new law needed

[Pig Hogger]

All kidding aside, I don't personally believe in cybercrime. Some cybercrime victims are merely stupid users, and no law can fix them.

So, con artists are O.K. because their victims willingly surrender to them whatever they want???

Re:No new law needed

[dada21]

Yes. If people would learn to provide contracts to protect themselves, we wouldn't need laws to protect them. Time creates intelligence, government takes it away.

I pass on so many contracts daily because the power of contract is now only a corporate priviledge. I won't sign anything without cutting out portions, and often companies won't let me be a customer without accepting their contract. In a market where people's expectations are tied to a contract, I doubt this would happen.

Con men take advantage of people who think they have government to protect them. Guess what? Government protection of your stupidity comes from robbing me of my money. No thanks.

Re:No new law needed

[ScentCone]

I don't personally believe in cybercrime

That's like saying you don't believe in wire fraud, or don't believe in insurance scams. The point is that it's a class of criminal activity that wouldn't exist without the internet. The internet doesn't create those crimes, but those particular crimes couldn't exist without it. Just like cars don't cause auto theft, but without which, it wouldn't happen. Do you believe in the theft of automobiles? I don't need to believe in it - it's real no matter what I label it.

Some cybercrime victims are merely stupid users

Which users are those? Surely you're not suggesting that people, out of stupidity, inadvertantly transfer their life's savings into an offshore bank account owned by the Russian mob? Or do you mean users that are so dumb that they accidentally go online and have expensive electronics shipped to someone they don't know in the Bronx? Maybe it's stupid users that are so dumb that somehow they cause someone else to get a line of credit with their personal info? Obviously that's all BS... only the actions of the Bad Guys can actually leverage someone's ignorance and steal their money or fraudulently use their ID in the commission of a crime. Again: you don't have to believe in those acts... they're happening all around you, and not just because someone's grandma isn't savvy enough to see through a phishing scheme. The fact of her ignorance doesn't cause the guy in Russia using a zombie machine in Korea to send her that fake e-mail and then run off with her cash or reputation. Her igornance is a weakness, just like the glass windows on your house are a weakness that another sort of criminal easily exploits.

My fear is that defending the cybercrime idea will only help make more wealthy lawyers and give politicians more abusive power.

If you're worried about that, then why worry about other compartmentalized flavors of crime? Securities fraud involves some particular methods, practitioners, and types of victims. Enough so that we have a special name for it, even though it's still just basically deceit and theft. If specialized pursuit and prosecution of a certain type of crime is just going to make lawyers rich and politicians abusive, then would you recommend backing off of the guys that ran Enron's investors into the ground because we already have laws against theft and fraud?

We live in a highly specialized civilization, and need to deal with criminal specialists with specilialized laws and enforcement.

Re:No new law needed

[Pig Hogger]

Hey Ma! Look at what the cat dragged-in!!! A libertarian asshole!!!

Libertarians (in reality, cheap-labour conservatives) only want a government to protect them from their slaves.

Now, crawl back from that rock you came under.

Re:No new law needed

[Z34107]

Awww.... that was rude. The man was just expressing a general disdain for all of humanity, and you had to go label him a libertarian.

Consider that the United States' Federal government takes about a third of everything made in the country (GDP) as taxes, and the vast majority of it is spent as transfer payments, i.e., just giving the money to someone else for nothing in return. For the large part of the world that doesn't live in the United States, the percentage of GDP taken by European governments in taxes is much higher, given the higher taxes and the greater number (and extent of) their social programs. Of course, you have to give your hard-earned money away to complete strangers who have done nothing to earn it merely because such a policy won some politician airtime. Otherwise, you generally get thrown in jail.

Now, whether you support the programs is immaterial. Isn't it a little bit concerning when about a third of the world's wealth is just taken by men with little concern outside their desk and their telephone?

Re:No new law needed

[Anonymous Coward]

The purpose of social programs like that is to induce people to do things they wouldn't do normally, but are for the good of the society.

In other words, it's to keep people from being blindly selfish and maintaining a power imbalance.

That said, many government spending projects are exceedingly short-sighted and/or corrupt, which defeats the purpose. Also, the rich aren't taxed enough and the poor are taxed too much, making it mostly a burden for people who can't afford it.

Also, about the men who take your money - if the system worked, which it doesn't, you would have voted for those people, and you can vote them out. In practice, again, democracy is an inherently flawed system, especially simple majority democracy.

Drugs

[Nadsat]

Drugs and prostitution should not be cyber crime. Neither should crimes relating to information freedom... so all that leaves are the phishers?

Re:Drugs

[VAXman]

The drug industry has always baffled me. I'm not sure what the $105 billion is - retail level revenue or something further up, but by comparison IBM's revenues last year were $96 billion. So I find it pretty amazing that the drug industry causes so much trouble (i.e. murders, corruption, tons of people doing jail time, pay-offs, threats, etc. ...) when one company makes as much the whole thing.

Re:Drugs

[Lehk228]

the value estimates are totally off that is how.

around here a few years ago there was a big pot bust, something along the lines of 50- 100 plants worth *millions*

they derived the value by weighing the entire plant, including root ball and soil in the root ball. then multiply that by the cost of an ounce of smokable buds and voila drug estimates RIAA style

So, when I

[GmAz]

SO when I make an MP3 to put on my PDA to listen to at work, is that considered a cyber crime? And technically, what makes a drug a drug? What about perscription, cigarettes, alcohol? Those are all mind altering and bad for you. I also bet its all the druggies out there that are commiting cybercrimes so they can get more money for drugs.

Re:So, when I

[rkcallaghan]

And technically, what makes a drug a drug? What about perscription, cigarettes, alcohol? Those are all mind altering and bad for you.

This is my field of study, so I feel obliged to throw in my 2 bits here.

When someone refers to a "drug" in the sense of crime, they mean more accurately a "Schedule I Material" (and rarely, Schedule II or III, but usually just I). What does this nonsense mean? Well, in theory anyway, Schedule I is reserved for materials deemed to have no redeeming medical value, with a high possibility of chemical addiction or overdose. Now, given your statement about cigarettes and booze -- you and I both realize that that isn't entirely the case.

While at the core, the doctors who worked with the FDA and the DEA to create the original controlled substances lists were doing so in good faith to protect the population at large from "Snake Oil" and soft drinks with addictive spikes (Ahem, Coca-Cola); there are unfortunately, larger powers at work than even the medical industry today. "Big Tobacco" has been in power in this country for hundreds of years before this country was even a country. So even though nicotine in all scientific methods would be a Schedule I material -- it isn't. This is also the reason THC is Schedule I despite having qualities that should qualify it for Schedule III (your usual prescription medications). Alcohol, for similar social reasons, is not Schedule I either.

Your usual prescription medications are Schedule III; which roughly defined is materials that have useful medical value and low possibility for addiction, but have other qualities such as allergens or drug interactions that merit having a doctor or two check you out before giving you them.

Hope that I have helped :)

~Rebecca

Re:So, when I

[GNUALMAFUERTE]

If you consider that you are free to put an MP3 on your PDA, why do you consider that i shoudln't be free to put some marihuana on my system?
Who are you to say what i can i do and what i can't?, and, why do you consider that listening some song is different from smoking some pot?

When the RIAA tells you what you can do with music and what you can't, you are being opressed.
When the government says what i can do with my body, you consider it ok?

Besides, i pay for my drugs, with my jobs.
You are not paying for your MP3.

Regardless of what i think about music, and if i consider that copying is a crime (which is not), the one in a more questionable ethical position is you.
I buy what i want, and use it the way i want, without harming anyone.

You take the work of a musician and you don't pay for it.

We can discuss if you have the right to do it or not. I think that you have the right, many people will say the opossite, but, in any case, it's not a clear RIGHT to copy MP3.
OTH,it's a clear right that i have to smoke whatever i want.

So, think before you post.

Re:So, when I

[geighaus]

a high possibility of chemical addiction or overdose ok, let's take a brief look on schedule I

MDMA, MDA, TMA, DMT, LSD, Psilocybin, Mescaline, DOET, 2CB, THC, DOB and many many others - none of these substances produce a chemical dependency. Nor it is trivial to get OD'ed on those substances. Furthermore, harm of many psychedelics and empathogens (MDMA would be the most well-known example) is not proved despite extensive research. Makes you think when you compare them to alcohol and tobacco.

Now let's consider alcohol and tobacco. Overdosing on alcohol is very very common (something that you see every weekend if you go out). Another thing that alcohol is an integral part of our culture, so nobody freaks when they see an overdose. Physical dependency to alcohol is well documented and not something rare too.
Nicotine overdose is very rare indeed, at least when smoked. But if you try any other administration route, you'd find that it is quite easy to get OD'ed on it. I take it nothing needs to be said on addiction potential of nicotine.

The original motives for prohibition are sketchy. The benefits of marijuana, for example, were publicized before WW2, but still it got prohibited shortly after the war was over. According to one version, prohibition of coke, opium, marijuana and later psychedelics in 60s was used as a means of race and social oppression. I have no information backing up or discarding this version, but considering the racistic sentiments in the US in the first half of the 20th century, it is not something to completely discard.
GHB prohibition is interesting as well. Despite numerous scientific publications on medical use of GHB, it was placed in Schedule I. Quite an interesting coincidence is that GHB prohibition happened at the same time as new sleep-aid drugs hit the market in the US. Makes you think again.. Also it should be noted that no overdoses on GHB are documented in 80s despite the widespread use.

Those were just examples. If you take a closer look on the whole drug-prohibition policy, it hardly is beneficial for anyone except the state and companies which are in the drug-figthing business. Hopefully this helps.

PS: Amounts of coke in the original Coca Cola were miniscule and cocaine does not produce a physical dependency no matter how much you abuse it. Sugar and caffeine is probably more addictive than amounts of cocaine that were found in the original coke. You should know your subject better.

Re:So, when I

[Anonymous Coward]

I heard from somewhere that the reason the reason they banned hemp (and mj too?) was more to do with the the threat posed to the timber industry. There was a newspaper man that owned his own timber or something and was afraid that paper could be made from hemp (which apparently can become anything if you ask it nicely).

I have no research or other basis for repeating this...

Re:So, when I

[rkcallaghan]

You're absolutely right, and my post was never intended to provide an all encompassing list of everything questionable about the system, the insights of everyone who has been involved in the process, or any of the other things you accuse me of "not knowing my subject" about. It was a Slashdot post, not a thesis. All of the insights you've mentioned are valid in themselves, just don't apply here. Also, a majority of the items you've mentioned may not fall under the "chemical dependancy" bracket, and yes some of them also may be examples of abuses in the system -- but Schedule I covers more than just dependancy. Almost half of your list is Methamphetamines, which contain materials that can be broken down in to OTHER Schedule I materials without having redeeming medical value of their own to move them to Schedule II (a part of the scheduling process I didn't cover for brevity.) There's a very good argument for MDMA being moved to Schedule II, but because of it's high abuse potential (it's still the "rave drug"), and contents that can be broken down -- I doubt it will ever see Schedule III again. Ecstasy in the rave form, is itself more or less an "overdose" compared to the medical applications -- most street doses are 10x or more the potency of what would be used in a treatment setting. You're also very much mistaken if you think it is impossible to OD or cause permanent harm by OD'ing on MDMA.

I covered the things the post I was replying to mentioned, in a very brief method intended for an audience that does not study chemistry for pharmaceuticals. I have a one line insight in to the background of the process (that referred to Coca Cola) as a canvas to illustrate my point, which was the answer to the grandparent's post -- the reason he and many other "layman" see such inconsistancies are because there are more powers involved than just Chemistry Geeks making the rules. Again, it doesn't mean that ancient coke was a seizure inducing nightmare -- but it is true that such things were considered, and had Coke ultimately not been stopped, looking around you today in the world of vendor lock in, do you really think we'd be stopping at "miniscule amounts"?

In short, before you spout of what you "know", and how I should "know my field better", remember something you should have learned in ENG201 -- The medium and the audience are factors in anything you compose as well. I could be a Pharm.D and I'd still post such short "incomplete" information because it is a Slashdot post.

Feeding my paranoia

[olddotter]

Great! I'm already worried about identity theft. This will just feed my paranoia.

Re:Feeding my paranoia

[Hal_Porter]

Worried about identity theft?

Identity theft is a growing problem on the internets. Bud Scoliosis of Hound's Breath Missouri lost his life savings to a cheap huckster in Shanghai. Abe Scrotum of Alabama was amazed when his pickup truck was reposessed without warning one sunny Sunday morning. He had missed the payments, because all his bank accounts had been emptied by evil internet criminals.

But a solution is at hand. Send us your Social Security number, name, passport, bank account details and any passwords, credit cards etc and we'll keep them safe for you. You can even destroy any records you have, for added safety.

But hurry! If you reply within 24 hours you get Identity Protection PLATINUM Cover FREE for 12 MONTHS!!!! After that, it will go back to the regular price of $199 per month!

Save over THREE THOUSAND DOLLARS, and get a FREE GUN RACK or CARRIAGE CLOCK, only if you apply now. Operators are standing by. Call 01186-PEACE-OF-MIND.

Re:Feeding my paranoia

[CyricZ]

Why the obsession with scrotums, Hal?

well then...

[jusdisgi]

guess it's time to switch jobs ;-)

I'm in the top 4% !!!

[Anonymous Coward]

... I knew my mom wasn't lying when she told me I'm special!

Re:I'm in the top 4% !!!

[eurleif]

Actually, that message wasn't really from your mom, it was a phishing attempt.

10%

[GigsVT]

I once read that 10% of all trade worldwide is underground, dollar for dollar (or peso for peso or whatever). That's trillions of dollars.

I wonder if aggregate underground economy percentages have increased, or if more traditional underground trade has just moved online.

Re:10%

[drinkypoo]

I once read that for every above-board economy, there is a black market of equal size. I wonder which statement is more accurate...

Re:10%

[grumpyman]

Undergraound economy... do you mean eBay?

Re:10%

[eagle0468]

This is just opinion based on perception, but I would guess that the black market may be equal in volume of sales, but lower in capital gains due to the prices being so much less. Also, I would predict that both of those levels fluctuate with the rise and fall of economies throughout the world. I.E. the black market in China may be dwindling with the rise of capitalism there. Whereas, it seems the black market in Russia is thriving due to the lack of governmental oversight and increase in corruption. Of course these are just opinion, think what you may.

Re:10%

[zerocool^]

Supposedly, pot is the biggest grossing cash crop in america, or 2nd biggest after corn, or something.

~W

Dealers tell the media how much they make?

[RealisticCanadian]

I've yet to understand the supposed principle that the Powers That Be or the Media could possibly figure out any kind of accurate figures on illegal activites.

Dunno 'bout the rest of you guys here, but I never told the police or the press how much profit I made back when I was a small time dealer (can't touch me, young offenders act! :p)

If I didn't, you can be damn sure that big-time or organized criminals do not share these figures either.

Neither do the users. (How many crack-heads report the amount they spend on their habit?)

So what the hell is the premise on which these "statistics" have ever been based on?

I can think of a few ways to fudge up some statistics about people screwed outta their money on the net, but I can't see a way to truly gauge that either. Again, if I fell for the "send me a grand and I'll send you a million" I sure as hell wouldn't tell anyone I was that stupid.

Hence, I dub the entire original article as BS, just like the 'War on Drugs' and even the 'War on Spam' /end rant :p

Re:Dealers tell the media how much they make?

[Anonymous Coward]

Looks like the young offenders act was repealed in 2002

kung grade soon

[thelost]

hah you wait till there is kung grade ice on the black market, then you'll see the dawn of a new cyber crim the likes of which you've never seen before

does that mean...

[Anonymous Coward]

...I'll have to order my dope online now?

Legalize hacking!

[Anonymous Coward]

So far, the only accomplishment of the War on Drugs has been to increase drug crime through by creating an artifical scarcity and high demand for product on the street.

This is equally true for cybercrime. If hacking were legalized, the seedy underworld associated with illegal hacking would wither away and vanish.

Re:Legalize hacking!

[fafalone]

Huge difference there. Hacking directly infringes on anothers persons rights; the drug war attempts to legislate control over what people do with their own bodies. If drugs were legalized, doing things like slipping a girl roofies would still be illegal. Drugs hurt others only to the extent that other freedoms, such as speech, can.

min wage

[Jeffrey Baker]

According to the book Freakonomics, drug dealers make less than the minimum wage, on average. It would not be hard to beat that level of productivity in any undertaking, criminal or not.

As for the phishing problem, I really don't understand why people fall for those. Your bank, or eBay, or Paypal, will never, ever, ever, ever, ever send you an email asking you to disclose any account information. If those people want to contact you for an important reason, they will either call or send you actual mail. This seems like a simple rule to remember, doesn't it?

Re:min wage

[thelost]

of course the one thing that is simple as that rule you stated is the other rule that people who aren't habitual computer or internet users treat them as if they are the devils magic, and do not approach them in any rational way. Look for instance at the number of chain emails that are constantly sent by people; Do you yourself recieve them from your friends? I do. As long as there are people out there who are not very tech-rational or tech savvy as say for instance people who read /. then there will always be targets for phishing. I dare say that some of the /. readership itself might have even been conned.

Re:min wage

[duffbeer703]

"Your bank, or eBay, or Paypal, will never, ever, ever, ever, ever send you an email asking you to disclose any account information."

They say that, but they ask me to sign into my account to see the latest balance transfer offer or to sign up for "account guard" all of the time.

Re:min wage

[Breakfast Pants]

How about when "Amazon" sends you a $25 coupon--just click here! It takes a bit more to realize you are on www.amazon.com.bleh.meh/coupon instead of amazon.com when you enter your login information. And Amazon does send those kinds of emails.

Re:min wage

[Anonymous Coward]

Ummm, the only year I kept records, I made over $250,000.00. That is more than any of my high school senior classmates made. It was actually more than half of them made combined. I only make about half that now...... but it is all legit.

Re:min wage

[fougasse]

I think the conclusion wasn't that drug dealers make an average of $5/hour but that the typical drug dealer makes that amount. Median salary rather than mean. Obviously there are several fabulously wealthy drug dealers; it's just that there are scores of footsoldiers who make very little.

So overtaking drug earnings is still big news.

Re:min wage

[Kjella]

According to the book Freakonomics, drug dealers make less than the minimum wage, on average. It would not be hard to beat that level of productivity in any undertaking, criminal or not.

But is the average drug dealer a full time dealer or on top of other income? And by other income I also mean social security and other things you won't get along with a regular job. Is it their way of being able to afford their own habit, instead of being a hobo because they're stoned and couldn't keep a real job? Or are they just selling a little, chilling the rest? You have to put it into some context, because I find it hard to believe that dealers make less per hour than flipping burgers at McDonalds.

Re:min wage

[jellybear]

Yes. If you've read the book, he compares the drug business with McDonald's. McDonald's also has some highly paid executives.

Re:min wage

[BVis]

Obviously there are several fabulously wealthy drug dealers; it's just that there are scores of footsoldiers who make very little.

Replace "drug dealers" with "CEOs" and you'll get a very good indication of why people sell (and use) drugs. The opportunities for advancement are better, your enemies identify themselves clearly (by shooting at you) instead of manipulating office politics, and you die if you fail, so there's no messy bankruptcy/reposession process if you're young, or humiliating retirement/destitution if you're old.

Re:min wage

[Anonymous Coward]

> they will either call or send you actual mail.

That's a good one. Ever deal with EmigrantDirect.com? They claim to be the second largest "Internet Bank" in the world. They don't contact you by phone. Getting them to mail something is impossible since you can't get someone on the phone to ask them to mail something to you. The only way I've been successful in getting a reply out of them is by e-mail. They do ask for personal information by e-mail.

This is also why I can't get my damn money out of their account. I need it for a down payment on a house, but I don't have any way to get the money out of the account. They don't have their online system working yet for accounts setup after July, so I'm just screwed.

Re:min wage

[paranode]

This seems like a simple rule to remember, doesn't it?

If I give you my credit card number will you write it down for me?

Re:min wage

[raoul666]

While street-level drug dealers might make minimum wage, the higher ups do very well. Besides, a lot of the guys selling stuff on the street are doing it to support their own habit and have a real job on the side. Note: my experience with drug dealers is mostly limited to Canada and marijuana, so make of that what you will.

The only valid phishing emails...

[Anonymous Coward]

...come with the verified certificate of the Nigerian Verification Association. Accept no other phishing emails.

Aw c'mon...

[the_skywise]

Read the fine print...

"No country is immune from cybercrime, which includes corporate espionage, child pornography, stock manipulation, extortion and piracy, said Valerie McNiven, who advises the U.S. Treasury on cybercrime."

So "child porn" and "piracy" makes more money than the drug trade? I don't think so...

Re:Aw c'mon...

[McNally]

"No country is immune from cybercrime, which includes corporate espionage, child pornography, stock manipulation, extortion and piracy, said Valerie McNiven, who advises the U.S. Treasury on cybercrime."

So "child porn" and "piracy" makes more money than the drug trade? I don't think so...

Sure they do. Let's use the numbers favored by the RIAA and MPAA, the foremost industry advocacy groups dealing with this scourge of "cybercrime."

50,000,000 American teenagers * $1,000,000 in economic damage per pirated MP3 file made available through P2P filesharing = $50,000,000,000,000, or approximately $10,000,000,000,000 more than estimated 2004 world GDP. Clearly it's a serious problem!

Seriously, though, get used to the idea that sensationalist studies like this often use inflated and unverifiable claims and add them up into highly dubious totals..

Re:Aw c'mon...

[fafalone]

If you look at what the Industry thinks its losses from piracy are, its plausible. Of course, it does bring up the problem that the drug trade fuels cost estimates for piracy, since they've gotta have alot of analysts smoking crack to come up with the piracy losses they claim.

4% is bogus

[jhliptak]

I took the e-mail test and I "failed" it, identifying two "legitimate" e-mails as bogus. In both of those cases, the explanation said it would better not to follow the links in those two e-mails.

Re:4% is bogus

[Anonymous Coward]

same here. Plus, it's a bit tricky to figure out where the links go when you only have a screenshot (albeit one with one URL at the bottom of the window) to go on...

Re:4% is bogus

[Tribbles]

I did that - the two that I said were bogus were because the domain names weren't the same as the originating organisation's domain name (which was a sensible move).

Re:4% is bogus

[mysqlrocks]

I took the test and got all but one correct. I identified one legitimate e-mail as a phishing attempt. When given the choice I guess it's better to err on the side of caution. Anyways, it's not very realistic. The one I got wrong had the last four digits of an account number in it. If I'd gotten the e-mail I'd open up my wallet and see if my account number matched.

Re:4% is bogus

[remahl]

Me too, (I'm guessing we fell for the same examples).

Showing that the financial institutions are doing their part in confusing people. There were definite evidence of phishing in those messages (bank name being a sub domain of an obscure domain and a variation of the primary name). Why does Bank of America point its customers to bankofamerica1.com if they're aware of phishing issues?

Even with edge-cases like this removed, I doubt the results would be much more encouraging. But 4 % success rate is worse than chance, so there must be something phishy going on.

Re:4% is bogus

[remahl]

Ok ok, so it isn't worse than chance no matter how you calculate it, but it _was_ a good pun. ;-) My bad.

Re:4% is bogus

[remahl]

So what if the phisher had intercepted a previous mail from your bank, containing the bank account number suffix?

If they gain control of a large mail server or active router, they could easily and reliably associate thousands of account digits with the correct email addresses, and use that information to gain credibility. Email that's this important should be sent encrypted for the receiver and the signature verified against a certificate exchanged when the account or service was established.

Re:4% is bogus

[KenAndCorey]

I think most of us failed the same two: #3 and #9 I believe. One of the legit emails had a link to a different domain AND went to a non-standard port (8082). I'm sorry, but just because something is technically legitimate doesn't mean I should have trusted it. I don't open ANYTHING that tries to open a non-standard port. Also, I find it really easy to spot phishing since I don't have an account at Capital1 or EBay or Bank of America.

Re:4% is bogus

[Agelmar]

I have a real problem in that they expect me to be able to tell just by looking at a screenshot from (what I believe to be) Outlook Express. I can't hover over links to see if the URL matches the displayed text, I can't look at the message source, and I sure as hell can't see the headers. How am I supposed to be able to tell for sure without this? Sure, I can get most of them, but #3,9 for example would be very nice to see the headers of.

Re:4% is bogus

[MoriaOrc]

I made the same "mistake." I almost marked a few of the other legit emails frauds. I'm not sure whether to give credit to the phisers or blame to the companies that their special deals and confirmations look so similar. Only the fact that they used legitimate domain names (or in Bank of Americas case, didn't ask for any info) saved them.

I'm also with you about the way the test was handled. A well designed legitimate email should rely on some outside shared info (the last-4-digits in the email we marked as a fraud, for example) to prove to the recipient that you are who you claim. Just given the emails "as is" it can be hard to tell if they are legitimate or not.

For that matter... they say "only 4 percent of users can spot a phished e-mail 100 percent of the time." I wonuld bet this includes people like us, who failed for being overly cautious and marking the ones they even say they would have been suspicious of.
</disapointed I didn't get to be in the top 4% :P>

Re:4% is bogus

[Amouth]

I fully agree.. and i wonder if the "4%" ment that they also got the legit mail right too..

sorry but takeing a screen shot and showing it to me isn't going to cut it and which link was showing the url at the bottom??

the way they made 3&9 makes me think they are trying to skew the results and they they are jsut as fake as the 1000+ emails my mailserver blocks daily.

with out being able to look at the message this can't be a good test.. and what the hell was with putting part of an account number in the mail.. dear god i am glad i don't have anything to do with capital one

Re:4% is bogus

[Anonymous Coward]

I'm a sys admin and I looked at the first screenshot, what garbage. The only way to identify fraudulent emails with any accuracy is to look at the raw message. The from address in the message data as displayed in MUA's (and used by Microsoft's broken-by-design PRA) is useless.

The 4% is totally bogus, what percent of respondents realized the test was completely moronic and didn't complete it?

Re:4% is bogus

[mallardtheduck]

Firstly, most phisers (phishermen? :) wouldn't and couldn't go to those lengths.

Secondly, there is no "standard" (as in supported by ALL clients) method for encrypting emails. I know most OSS clients support PGP, but Microsoft Outlook Express doesn't and thats what many people use if they are not using web-based email.

Re:4% is bogus

[PCeye]

I incorrectly identified the following as fraud when they were legit,

1. Chase ("click here to transfer balances")
9. Capital one ("Login"; "Click here to login"; "http://capitalone.bfi0.com")

The emails had the recipient follow a link relating to their account within the message. I was somewhat suprised that the messages were legit. If the banks want to encourage savier customer behavior, why encourage the same behaviors that phishers are exploiting?

As a bank, it would be more responsible to merely suggest to log into the account from the bank site or contacting the local branch by phone...but what do I know, I am a mere mortal.

Re:4% is bogus

[TheSpoom]

Showing the last four numbers of an account or credit cart number is a common practice in the industry. You can't do anything with it without the other 12 or so numbers, and it does validate with a 0.001% degree of error that they already have your account on file (and thus are who you expect to be dealing with). Login to Paypal if you have an account and check the page with your credit cards / bank accounts in it; it does the same thing.

That said, I agree with you that Capital One should have made it a lot clearer by not using a remailer domain in their links and instead linking to the appropriate files on capitalone.com. That was the only email I got wrong in the test (I said it was a scam, it was legit).

Re:4% is bogus

[raoul666]

If they've intercepted some of your mail from the bank, I suspect they could do most of what they would like to already.

Re:4% is bogus

[hackstraw]

3,9 for example would be very nice to see the headers of.

I got it "wrong" because the url at the bottom was from links.bankofamerica1.com:8082. Notice the _1_ there, and the strange port number.

The mail seemed pretty benign, but it looked more than suspicious to me. Personally, given the information available via the picture, I would estimate that the Bank of America mail was not valid at all.

Re:4% is bogus

[Technician]

I took the test and got only 50% right. I listed ebay and others as phishing simply because I couldn't look at the headers and the clincher I don't have an ebay account.

When I get an email regarding problems with my ebay acount, I know it's a fraud simply because I don't have an account.

These are the mails I do follow the link and fill in with all kinds of information. The more time of theirs I waste the better. I also write to tell them I'm very worried about my ballance, could you send me a check of my balance of $154,329.04 US Dollars from account #3904564385 right away before a fraudster takes any more?

Re:4% is bogus

[marcosdumay]

Oh, yes. If a phisher could access my bank servers and do anything he want with them, then, I think he'll have enogh information to phish me... But just at this bank's account.

But a Problematic Comparison

[screwballicus]

It's somewhat unsurprising that a variety of con artistry should overtake a variety of contraband trafficking and sale in profits without too much trouble, when it comes down to it. After all, a good deal of cybercrime doesn't actually provide a service or a product, in order to acquire its profits, while markets in contraband goods, being markets after all, need to contend against competitive pricing and provide a product subject to some degree of genuine scarcity (varying greatly, depending on the product).

Is this real?

[Debiant]

I mean 105 billion US dollars from cybercrime?

If we take away spam and lot of phisphing attemps, what does it leave. 100 billion maybe?
Where does the rest come from?

Are these numbers calculated by the idea that any crime that has something to do with computer and network is a cybercrime? So if I happen to be a columbian drug lord using excel, I guess my heinous activies are cybercrime too?

If so small wonder cybercrime is taking over drug related crime.....

Drugs

[JanneM]

AFAIK, unless you're higher up the chain, like heading a wholesale distributor or "importer" or similar, drugs are supposedly not all that profitable. I read (but don't have the link to) an analysis that showed a street dealer or small-scale distributor didn't actually make any more money per hour worked than usual low-level white-collar jobs. And there is no risk premium for the very real chance of getting killed, or maimed, or for going to prison for a number of years (which really puts a dent in your earnings).

Inflated numbers

[thinmac]

These numbers are almost certainly very sketchy. They list piracy and stock manipulation as part of the total funds brought in by cybercrime. If they just mean people selling pirated software that's one thing, but if they mean people downloading MP3's, then that's different; nobody makes a dime when someone downloads the newest pop hit off the internet, as much as the record companies would like you to think someone just pocketed $15 of their money.

With the stock manipulation, this is also a pretty nebulous number. Did they include only verified cases of people doing this? What did they consider manipulation? The article is very thin.

Definition of 'cybercrime'

[sielwolf]

cybercrime, which includes corporate espionage, child pornography, stock manipulation, extortion and piracy

That's a pretty open-ended definition. So is old-school white collar insider trading or shenanigans now Cyber-Crime just because they do it from a workstation? It'd be interesting to see just what is a cyber-crime now and how it breaks down into that total 150 billion dollars they just throw out there. Of course such data might pop the balloon of FUD as delicious as this.

Re:Definition of 'cybercrime'

[Mad_Rain]

That's a pretty open-ended definition.

I didn't read the article (a great Slashdotter mantra), but I imagine that their definition of "drug dealing" is a pretty open-ended as well. Sure, there is cultivating, manufacturing, and distributing - Do they account for drug-related paraphanelia? (Those glass-blown tobacco-pipes/Bongs gotta cost something) Do they account for drug-related crimes and profits? (prostitution, theft, and gambling are tied into drug dealing as well)

Of course such data might pop the balloon of FUD as delicious as this.

You sure are right on that account.

Re:Definition of 'cybercrime'

[Firefly1]

Piracy? Piracy?! I think not, sir. Since when was access to a computer a requisite to piracy? Here're some reminders...

Re:Definition of 'cybercrime'

[paranode]

I think you are correct on that point. They are probably totaling all of those 'estimates' of damages that the company would like to see gained back in a civil suit but would never ever actually get nor substantiate.

fishing survey is bullshit

[Geekboy(Wizard)]

if you mark all of them as fraud, you 'fail' the test.

I consider all email from commercial entities as fraudulent.

Re:fishing survey is bullshit

[Quiet_Desperation]

I have to agree here. Accidently considering a genuine commercial email as fraud is not an "error" under any realistic sensibility. You know they did the test that way intentionally just to get an artificially low number.

Re:fishing survey is bullshit

[fishybell]

Especially since some of the companie's legitemate e-mails contained links to sites outside of their domain (eg. the Capital One e-mail).

Assuming their message doesn't get caught by my spam filters, it will never get past my own two eyeballs.

If a company that I do business with wants to e-mail me something, they'd better just say "go to our website" because I (and many others) won't ever give it a second look otherwise.

Re:fishing survey is bullshit

[RobinH]

The capital one is the one I got hung up on too, and even in the "why?" link, it suggests that you shouldn't click on any of the links in the email, and just open a web browser and go to the site directly because it's suspicious.

I protest... that should have counted as correct.

Re:fishing survey is bullshit

[hobbit]

Yes, that one and the one from links.bankofamerica1.com!

I think those guys should be sued for encouraging users to become susceptible to phishing attacks.

Uhhh...

[GeeksHaveFeelings]

You mean there's a difference between those two?! I thought kiddies do drugs! It's an onomatopoeia!

That 'IQ' test is largely pointless

[aurelian]

Because what gives a lot of phishing attempts away - certainly the better ones - is information in the mail header or URLs linked in the text. But we're not shown any of that, so unless they have loads of grammatical errors etc, it's impossible to tell if they are genuine or not.

Re:That 'IQ' test is largely pointless

[TheRaven64]

One URL is show at the bottom of the window for each one, howevever you are right that it doesn't show the headers, which are another good source of information.

Huh?

[Anonymous Coward]

I don't understand your comment. Child porn and piracy were listed as just two examples of "cybercrime" as per their definition, not the only two.

4% of phising

[Mr. Flibble]

I looked at that test, and it was annoying. I doubt I could have got 100% on it, yet, I have never been nailed by phishing spam.

What was annoying? I was supposed to judge the validity of the emails from a jpeg - not from looking at the acutal links on the email. I mean, if I get an email from my bank, and the URL that they send me is NOT the same as my banks - then I know it is phishing spam. I do this because I can tell by the domain/subdomain in the links - not by how the mail "looks".

Having said that, I have barely seen mails from my OWN bank, but many phishing spams from others.

Looking at the URL (and understanding how domains and subdomains work) certanly helps with phishing spam - not just knowing that "your passw3rd hazz expireddc" is probably not valid.

4%?

[nickgrieve]

Well, there we go. Empirical, definitive proof. People are stupid.

The test is bad

[jmv]

In related news, only 4% of Internet users can flag 100% of phishing e-mails as fraudulent

Had a look at the test and this is not surprising. Basically, they just take a screenshot of the mail reader window, ripping out any info (headers, html source) that could be of any help. Not to mention that as long as you assume anything you get from your bank/ebay/paypal/... is *potentially* a phishing e-mail, you don't have to actually be able to tell the difference. Education should not be about recognizing phishing emails because phishers will always be ahead. However, if you *never* click on a link and always use bookmarks (to bank and all) you have, then there's nothing a phisher can do. Of course, education should also be for institutions like my bank which includes its website URL in emails they send me (they're encouraging their customers to learn bad habits).

Re:The test is bad

[Anonymous Coward]

Had a look at the test and this is not surprising. Basically, they just take a screenshot of the mail reader window, ripping out any info (headers, html source) that could be of any help. [...]

Maybe this happened by chance (statistics are _bad_ with a sample of 10), but I got 90% correct and only one false positive (declared non-phishing as phising), which was from the bank company that allowed you to transfer your money somehow.

And, no I haven't got those phishing mails (or they were filtered out automatically and I didn't have a look at them).

Maybe that is the goal of the test? To see whether the phisher still can't pretend 100% that they are real, even without a tech-person on the other end who would understand mail headers? Maybe it is really hard to lie convincingly?

Yes, I'm dreaming :)

Re:The test is bad

[petertw]

I agree -- just because I thought that 3 of the legitimate emails were phishing scams doesn't mean that I can't flag 100% of phishing emails as fradulent!

However I doubt that you will learn much more by looking at the headers and html source of the email (except that might make it easier to identify links that are abusing email client vulnerablities to spoof the link destination)

The one that threw me was the legitimate capital one email -- they are actually asking clients to click on a link that goes to capitalone.bfi0.com !

People still need to learn never to trust links in any email.

Re:The test is bad

[swillden]

I agree -- just because I thought that 3 of the legitimate emails were phishing scams doesn't mean that I can't flag 100% of phishing emails as fradulent!

True. Although I got 100%.

However I doubt that you will learn much more by looking at the headers and html source of the email (except that might make it easier to identify links that are abusing email client vulnerablities to spoof the link destination)

I disagree. The path the e-mail followed is often very informative, and the source of the e-mail makes it easier to see what URL your browser will actually go to if you click the links. Links that present one URL but actually go to another are a dead giveaway.

The one that threw me was the legitimate capital one email -- they are actually asking clients to click on a link that goes to capitalone.bfi0.com !

That one almost got me, but I ran "whois" on bfi0.com and looked into who they were. Some of the other tricks I had to use to figure them all out were:

1. Looking at the whois data to see registration dates.
2. Using 'dig' to look up information about other hosts in the domain.
3. Looking at the contect on the host in the link (first via telnet, then with a web browser).

It was an interesting exercise, though. Like you, I found the phishing scams obvious and had a harder time convincing myself that the legitimate mails were legitimate. And the test just confirmed to me that determining whether or not a message is a phishing attack is beyond the skill level of most people on the net. The solution, IMO, is to teach people to disregard anything that looks like it might be from a phisher, even if it isn't. Then legitimate senders will find that they need to make their e-mail look as un-phishy as possible, or it will get ignored.

Re:The test is bad

[confusedwiseman]

Interestingly enough, while working for IT in a bank, I had the opportunity to have input on email that was being sent as an automated response to customers. We wanted to make reference to the main website without making it a url. Microsoft mail products recognize the xxxxx.com and automatically make it a hyperlink. I'll send my seldom heard microsoft hate out on that one.

Bad test

[jone_stone]

The Phishing IQ Test, on which this survey is based, is not a good gauge for the ability to detect Phishing emails. It presents you an image of questionable messages and asks you to decide whether they're trying to trick you. I don't know about you, but I use a lot more than the text and visual properties of a message to decide whether it's a fake. My first line of defense (and usually a very good one) is to look at the URLs that the message's links point to. I can weed out 99% of fraudulent email in a few seconds that way, and never even have to read what they're trying to sell me. Sometimes I'm even surprised to find that a suspicious message is actually genuine. The Phishing IQ Test denies me the URL-snooping that's available in just about every email reader and web browser, so it is by no means an accurate measurement of real-world detection skills.

I took this test a while ago and didn't get 100%, even though I'm one of the most internet-savvy people I know. Despite that, I don't know anyone who's been taken in by a phishing scam. Hmmm...

I've always been paranoid

[Auckerman]

Perhaps I'm a luddite, but I was one very early on. I've always had the policy of never putting my credit card number online. In the old days (Early 90s), it was because most "retailers" didn't even bother encrypting the numbers in their database. Hell, there was no way of even knowing that the store even existed in the first place, the earliest form of phishing. Now a days, I assume EVERY email I get that asks for any information is from a criminal.

With the advent of temporary credit card numbers, I feel comfortable purchasing online, but only from proven stores.

People want to assume the best of others. Most people want to beleive that most other people are honest. When it comes to an anonymous medium like the internet, the reverse needs to be assumed as a starting place. The worst part of its, it's getting to the point that you don't even have a choice if your information is online. Whether your info is sold, your bank allows "online banking", a physical store you shopped has online "convience", or anything else, you lose the choice. Your entire credit history can be ruined even if you never go near a computer, all because of the convience of the internet. It's reckless, dangerous and eventually modern society will pay for such activities.

All they had to do is look at Microsoft....

[PenguinBoyDave]

They have been involved in Cybercrime for years. Each time they force-feed a copy Windows down people's throats. Made them rich.

Re:All they had to do is look at Microsoft....

[Anonymous Coward]

...and there's the other $100 billion.

False Positives

[PMuse]

only 4% of Internet users can flag 100% of phishing e-mails as fraudulent
No. Half the examples in that test require users to identify suspect emails as Legitimate. Sure enough, few people (especially the ones who practice 'safe browsing' by default -- i.e. tell no one nothing ever) will score 100% by trusting all those suspect examples.

Users can be taught to default to "NO". They are learning.

That said, user credulousness would be a problem even if 99% of users had identified all the fraud examples as fraud. That 1% would still be a lot of victims.

Nobody can spot 100% of phishing attempts

[Otter]

The only way to deal with phishing is to *never* give whatever secure information in response to email you didn't initiate. Unless you're Jon Postel (and I believe he's now dead) you simply can't distinguish between legit emails and top quality phishing, no matter how loudly the idiot snobs here insist otherwise.

Singapore

[Anonymous Coward]

I don't know about America, but in Singapore the only real difference between CyberCrime and Drugs is that hackers and criminals are rewarded with $10,000 prizes while drug mules are hung.

The test is misleading.

[Anonymous Coward]

The emails shown in the test could be real or fake depending on the links, which you cant check from a screenshot.

Language?

[Anonymous Coward]

Only 4% yeah, but does it take into account the main language of the people receiving these emails?
For example I am a native french speaker (from Canada). Every email I receive which is in english ( 99% of my junk mail ) seems suspect to me. It's fairly easy to recognize spam, when you don't recognize the language it is in. Since I receive a lot of english-written spam, and considering that a fairly large part of the internet users are not native-english speakers, I suppose that the 4% figure applied to Americans would be drastically different in another part of the world.

That's my point...

[the_skywise]

It's ONE thing to say that piracy causes the RIAA/MPAA to have "lost revenues". That's at least an arguable point.

It's ANOTHER to say that piracy has more INCOME than the drug trade.

Now, pirated items "sold" over the internet like actual goods, yeah, that's revenue. But I highly doubt that number has overtaken the drug revenue number. But you KNOW they're including all the free traders on the p2p services in those numbers just so they can scare people into tighter legislation.

4% and phishing test.

[RingDev]

That test is a waste. The 'emails' are image files, so you can't see where the actual links point to, you can't see the email header or the true from address. Anyone who nails 100% is more lucky then savey.

-Rick

Re:4% and phishing test.

[Anonymous Coward]

What are these images you speak of?

I use Thunderbird, and while it can render HTML email with images, I dont even open my email I just use CTRL+U to view the source, so all i see is plain text with full headers.

I've never fallen for a phishing email /Go 4%!

Re:4% and phishing test.

[hackstraw]

That test is a waste. The 'emails' are image files, so you can't see where the actual links point to, you can't see the email header or the true from address. Anyone who nails 100% is more lucky then savey.

I got 7 out of 10 correct, and the ones I missed were "legitimate" and I flagged them as phishing. I would NEVER respond to any of these kinds of mail. I tried to pretend that some of the mails were legitimate, but I'm pretty immune to these kinds of things. Mostly due to spamassassin.

Oh, and I didn't realize that people still viewed HTML emails. Besides women that wanted backgrounds in their emails, I don't know why anybody ever did.

Plain and simple, HTML email is evil and should never be used (IMNSHO).

Also, the mails had status information at the bottom. Is that normal? I thought that it was more common to hide relevant information from users.

Also, "normal" people don't know what headers are nor do they know how to read them.

Quantizing drug profits is almost impossible. Good marijuana has little profit value because of people selling it to help people out. "Drug lord" marijuana has profit values at the higher level, but not at the lower level. Most of the 1st tear (I have no clue how to spell that) drug sellers oftentimes only sell drugs to get free drugs for themselves. Its akin to slave labor to their habit.

Re:4% and phishing test.

[RingDev]

"Also, "normal" people don't know what headers are nor do they know how to read them"

My wife, who I would consider computer literate (26 years old, non-IT related work) has no problem checking links. Those are the dead give away, the "Visit Citibank Mutual Now" links that are href to Citibank.SomeDomainName.com. She doesn't look through header info, but she can still pick out the phishers. And like many net savey people, she knows better then to click on a link from an email and just goes directly to the company's page.

-Rick

You don't get it

[Kohath]

This includes piracy. The movie, record, and software industries routinely claim extremely, ridiculously high losses from piracy to cover up the fact that they make crap that no one wants.

In other words, this article is almost certainly BS, which you could have just assumed when you saw Reuters.

Easy solution

[ch-chuck]

The Phish Piss Test.

Just have all new employees and randomly picked existing employees pee in a cup and test it for phishing metaboloids.

Re:Easy solution

[bumptehjambox]

If they listen to Phish, they are certainly going to fail a pee test.

Don't be such an ass.

[jabbo]

> I suggest that the field and the general user experience would be greatly enhanced by
> limiting access to compilers/assemblers (by means of pricing and with the cooperation of
> the open source community) and by separating macros or other executable content from
> documents.

[eg. the premise: artificially raise the cost of compilers and nastybad people will stop writing viruses, etc. just like gangsters in New York improvised zip guns when guns cost too much... oh, wait, that's a bad analogy... bad people just make do.]

You should also consider separating "clueless" from "malicious" in your thought process. HTH.

> Think about it; in what other field do we "educate" "users"?

Other than prenatal care, disaster response, home safety, poison control, vehicular operation, wildfire control, diabetes management, power tools, gun storage, and how to program your VCR? Can't think of any offhand...

> We don't try to educate people
> with electrical outlets and let any curious individual perform as a licensed electrician.

But we'll sell wire cutters and conduit to any moron at Home Depot, along with a Hole Hawg and a 3 foot masonry bit. Surprisingly, a license is not required to burn down your house as a DIY repairman, nor is it required to pack a thousand pounds of fertilizer, some gasoline, and some nails into the back of a van, detonate it, and cause much worse harm.

Cars are deadly weapons, as are guns; both require a license to operate, but in neither case does that eliminate fatalities caused thereby. (In fact, on the evening news last night, I noticed that a Class C licensed bus driver rolled over an embankment, killing 2 people and one fetus, injuring the other 39 people on the bus. More than likely, a smaller percentage of licensed commercial drivers do this than, say, unregulated Pakistani mountain bus jockeys, but I have no useful measure of the protective effect conferred by this certifying process.)

Bad people will still be bad people, and "the cooperation of the opensource community" is not something I think you can depend on for this venture. (cf. PGP and SSL export restrictions)

Stack protection, virtualization, perhaps legal penalties for willfully distributing software known to pose a risk to the users without their awareness or education (cf. the Theramed); maybe an overhaul of the communications system, and use of (NON-unicode) certificates required for financial communications. I don't know for certain, but I do believe that your rant about compilers holds little relevance to phishing at this point in time.

Full disclosure: I learned to program on an HP-80 and a Timex-Sinclair ZX-81. I was using Usenet before AOL 'broke' it. And I still think you're chasing the wrong idea.

Re:Don't be such an ass.

[Lehk228]

guns do not require a license, HANDGUNS do in some (all?) states.

Re:Don't be such an ass.

[PsiPsiStar]

I think the slashdot user experience would be greatly enhanced if, instead of having to type a word to prove you weren't a 'bot' you had to answer a trivia question. The question should involve some level of analysis so you can't just google the answer. I wonder what that type of control would do to the quality of a forum. Of course, I suppose karma bonuses serve roughly the same purpose on Slashdot.

Re:Don't be such an ass.

[Anonymous Coward]

Oh c'mon, he hit the nail spot-on. But why limit these kinds of restrictive measures to cyberspace? Why not apply them to bars/pubs, clubs, parties, or any kind of public setting where social activities may take place?

I'm so sick and tired of these uncultivated public school kids coming to my social outings thinking they can just waltz right in and start fraternizing with everyone else without a proper upbringings and having gone to a $40k/year boarding school for 4 years to learn how to behave like a proper member of high society. Do they really think that paying their way through 2 years of ITT Tech by bus boying at some scummy restaurant puts them on par with those of us who graduated from magnet schools and have been slaving to meet the spirit-crushing societal expectations and to assimilate ourselves with high society.

We need to quarantine the unwashed masses.

Re:Don't be such an ass.

[jamstar7]

> Think about it; in what other field do we "educate" "users"?

Other than prenatal care, disaster response, home safety, poison control, vehicular operation, wildfire control, diabetes management, power tools, gun storage, and how to program your VCR? Can't think of any offhand...

Reputedly, in the US, you're supposed to be trained to drive a motor vehicle. Living in Cleveland for 25 years makes me rather doubt it though...

Re:Don't be such an ass.

[Anonymous Coward]

IMHO Google broke Usenet. Every ISP used to offer a news server that one could logon to and use any newsreader to access Usenet. Since Google Groups every darned ISP where I live has dropped this service and tells everyone to use Google Groups Web browser interface. Google's Usenet browser interface flat ass sucks huge weiners!

Re:Don't be such an ass.

[indifferent children]

Nope. In Florida, we have no licenses for handguns, and no registration either. The only kind of license you might want is a Concealed Weapons Permit, which is very easy to get.

Re:Don't be such an ass.

[indifferent children]

Reputedly, in the US, you're supposed to be trained to drive a motor vehicle.

Not really. In most US states, the high schools offer "Drivers' Ed" as a non-mandatory course, but the state office that grants Drivers' Licenses doesn't know or care if a person has had any training.

I can't speak for many countries, but in Germany, the Driving School (Fahrschule?) is mandatory to get a license and IIRC, costs about $2000.

Re:Don't be such an ass.

[Anonymous Coward]

I was using Usenet before AOL 'broke' it.

ME TOO!!!

Note to mods-
You won't get this unless you were there

Re:Don't be such an ass.

[LaCosaNostradamus]

[I]n Germany, the Driving School (Fahrschule?) is mandatory to get a license and IIRC, costs about $2000.

That's because Germany is CIVILIZED, and has an actual SOCIETY. America in contrast is a wilderness of civility and almost wholly devoid of a society, and people there are still generally encouraged by American culture to prey upon their fellow man in a huge range of ways. Hence, it is still largely the case that a person can survive the pissant tests of their DMV, climb into a 3000LB killing machine, and then hurtle down the road drunk as a skunk and yellin' "yaaaaaahooo!". CRUNCH!

Just try to advocate a mandate to have all drivers in your state undergo a mandatory training program. Go ahead! Just try it. Rush Limbaugh will soon be on the radio screaming "Liberals! Liberals! Liberals!" about your proposal, and will then go on about the "nanny state", excessive costs of government, etc. America loves individualism as a secondary religion, since it supports the primary religion of MAKING MONEY.

Re:Don't be such an ass.

[Anonymous Coward]

The world's accumulated mass of morrons via AOL hopped onto Usenet and started posting off topic and idiot "Hello world" messages in the mid 1900's.
This forced every Usenet newsreading application to add an ignore all posts from this morron button.

Sorry, that don't qualify! Google broke Usenet!!! Not one single broadband provider in my area, whether that be Wireless, Cable or Telco DSL, provides a Usenet server to their customers.
Usenet is not only broken it's fuckin gone forever. Call any of them up and ask why they don't provide a NNTP server and every one of them will ask "What's that?"!!!!!!

Re:Don't be such an ass.

[poofyhairguy82]

Hence, it is still largely the case that a person can survive the pissant tests of their DMV, climb into a 3000LB killing machine, and then hurtle down the road drunk as a skunk and yellin' "yaaaaaahooo!". CRUNCH!

Just like you Europeans- we discover a way to control overpopulation in our own nation (a huge worldwide problem) and you just have to diss on it. You think you are SOOO fancy because you have better beer, a better internet connection, and better cars with better drivers, and better

.....wait. That sounds cool. Why do I stay in the U.S.? I yeah, now I remember. I can maintain a higher material standard of living because Wal-Mart and its pals make everything here dirt cheap. Mmmmmmmmmmmm cheap computer parts. Like the 230 Euro (thank God for the google currency converter) AMD 3800 x2 with matching motherboard I got at Frys the other day. Well worth the risk of death at the hands of a mom hauling ass to her kids' soccer practive in a new Ford SUV on the freeway next to me on the way to the computer store.

Dump your html email

[deacon]

only 4% of Internet users can flag 100% of phishing e-mails as fraudulent

So only 4% are using text only mail readers like pine? And the rest are looking at the Paypal graphic in the HTML email and deciding the email is genuine?

Poor bastards.

More meat and less bun in a mailreader makes fakes trivial to spot.

more lucrative?

[bumptehjambox]

When its 3AM and I want a watch, a television, and some new shoes...
No matter what I do on the internet, it doesnt really help me get there for atleast a day or two.
All I am saying is, don't be foolish and close down your Meth labs cuz of this.

One Level of Commonality

[Calibax]

It occurs to me that only the illegal drug and software industries call their customers "users".

Shit!

[Anonymous Coward]

Does this mean my drugs are going to get more expensive?

A reason NOT to upgrade

[Hao Wu]

I considered updating my (retired) father's computer to a nice fast machine with a cable modem... then I considered how much more trouble he would get into with a good connection.

It's hard enough to explain phishing and spyware to him - it's like he almost thinks that I'm making it up just to ruin his fun or something.

Flawed test :(

[HeliumHigh]

Hmm, that test is flawed. It doesn't let you check the header info of the email. I check the headers of every email that deals with any account, and check all the link, and I type the address of the site in myself. If there is something so important, then I can check it in my account page.

According to Napoleon...

[Chris Bradshaw]

"Computer Hacking Skills and/or Skill with a Bo-Staff", Either one will get you chicks... Face it, Drugs are out, Geeks are in...

Re:4% is not measuring what you think it is

[greg1104]

Yeah yeah, we all were suspicious of #3 and #9. But read the quote again: "only 4% of Internet users can flag 100% of phishing e-mails as fraudulent". The only way you fail to be part of the elite 4% is if you misidentify a phishing attempt as a legitimate one, which you did not do. You, like myself and everybody else commenting here, correctly identified all the phishing attemps as such, which is the statistic they're quoting. The fact that we're so paranoid we sometimes distrust legitimate mails as well doesn't figure into that number.

Cybercrime more lucrative than drugs?!?!?!

[roesti]

I don't believe this for a second. The amount of drug money that is laundered through the US every year is way more than $100,000,000,000. I've heard figures as high as $600,000,000,000, and those figures are a couple of years old.

Re:Cybercrime more lucrative than drugs?!?!?!

[Reziac]

Must be all them drugs being sold via the internet ;)

Try this quiz instead...

[CowsAnonymous]

Ok, try this quiz. I give you how they described the e-mail in their "find out why it was a fraud/legit e-mail" section, and you guess if they were talking about a fraud or legit e-mail.

"The content of this e-mail introduces privacy policies, so it's good, right? But the e-mail is not personalized and some of the links go to bankofamerica1.com, which might be bad" Legit or Fraud?

"But, the e-mail provides links to login to your account-which could be abused by fishers." Legit or Fraud?

"These links seem legitimate as the URL displayed in the status bar at the bottom of the email appears to go to the legitimate Network Solution domain, but always remember that this display can be faked." Legit or Fraud?

What I'm getting at here, is the idea that telling people that they should weed out the good and bads is silly, because even the goods show characterstics of the bads. Just plain don't click on the links. Don't think of emails to be your little gateway to the www, but rather as just a way to get and send messages. Read the message about your bank account, then open up your browser and get to the account yourself or call up the bank.

Kuang grade...

[Burning Plastic]

Never heard of this Kung stuff ;->

I seem to remember that it's an ICEbreaker not ICE...

Re:Kuang grade...

[TubeSteak]

"What is this thing?" he asked the Hosaka. "Parcel for me."

"Data transfer from Bockris Systems GmbH, Frankfurt, advises, under coded transmission, that content of shipment is Kuang Grade Mark Eleven penetration program. Bockris further advises that interface with Ono-Sendai Cyberspace 7 is entirely compatdble and yields optimal penetration capabilities, particularly with regard to existing military systems..."

"How about an AI?"

"Existing military systems and artificial intelligences."

"Jesus Christ. What did you call it?"

"Kuang Grade Mark Eleven."

"It's Chinese?"

"Yes."
...

"Dixie," he said, jacking in, "what do you know about Chinese virus programs?"

"Not a whole hell of a lot."

"Ever hear of a grading system like Kuang, Mark Eleven?"

"No."

Case sighed. "Well, I got a user-friendly Chinese icebreaker here, a one shot cassette. Some people in Frankfurt say it'll cut an Al."

"Possible. Sure. If it's military."
...

"I checked ol' Kuang Eleven out again for you, boy. It's real friendly, long as you're on the trigger end, jus' polite an' helpful as can be. Speaks good English, too. You ever hear of slow virus before?"

"No."

"I did, once. Just an idea, back then. But that's what ol' Kuang's all about. This ain't bore and inject, it's more like we interface with the ice so slow, the ice doesn't feel it. The face of the Kuang logics kinda sleazes up to the target and mutates, so it gets to be exactly like the ice fabric. Then we lock on and the main programs cut in, start talking circles 'round the logics in the ice. We go Siamese twin on 'em before they even get restless."

William Gibson, Neuromancer

The entire text of the book

"Speaks good English, too"
Great line.

Re:Kuang grade...

[thelost]

don't forget the first rule for a good anti-virus company, make sure there are viruses (ICEbreakers) for your anti-virus software(ICE) to fix! The norton of tomorrow will be bring the premier ICE to your shop window, and the best ICEbreakers to the blackmarket in chiba!

The Old Days

[MightyMartian]

Back in the old days, we had to shovel coal into our computers. That was way back when Usenet traffic was passed via UUCP and by the sacrificing of virgins (never hard to find in CS departments way back when). Why, I remember alerts going "Keep signatures to 28 characters or someone will come and remove your testicles with a 7/16ths nut driver and some mouldy toast".

Re:The Old Days

[justin12345]

Oh man, I knew there was an easier way, I should have just sacrificed some virgins. I used to have to walk six miles, uphill, in the snow, to the local 1400 baud modem. Once there I had to wait 2 hours to download the day's newsgroup activity (alt.sex.binaries must have accounted for at least 70% of that time) onto a set of floppies.

Then I had to walk back, six miles in the snow, uphill (again), and boot up my brand new monochrome NeXT cube. It was the first computer I ever had that was coal free -which is a very important feature if you are trying to run it in your Mom's basement.

Re:The Old Days

[zerocool^]

...by the sacrificing of virgins (never hard to find in CS departments way back when).

I'd venture to say "still not hard to find in CS departments today". As long as you're not picky about gender, that is.

~W

Re:The Old Days

[hobbit]

You had floppies? Luxury! We used to have to carry each nybble of data in a separate trip...

(etc.)

Re:The Old Days

[lisaparratt]

Let's face it, in todays CS departments, appearances are deceptive where gender's concerned!

Bummer

[etzel]

The only purpose of this post was to get your slashdot ID.

You'll be hearing from us pretty soon

government planted story

[Anonymous Coward]

One, the premise is just not true,it's pure unadulterated horsecrap, illegal drugs are much larger than so called "cybercrime" * globally, two, the US senate is set to vote on the cybercrime law real soon. Let's just throw occams razor at this one once you parse the source for this DC ghetto goon political infotainment. This is government propoganda being pushed as news with the wires carrying it like they always do.

Does anyone really think the major banks and CC companies are eating over 100 BILLION dollars a year to scammers?

The wonder of statistics

[Mr. Freeman]

The test is flawed to begin with, then of course companies might be inclined to "loose" the results from people that actually get the answers "correct".

Also, given the fact that both cybercrime and drug trafficking are illegal, how do they know how much of each occurs? Seems to me that if they had the resources to get an accurate count, there wouldn't be any more cybercrime or drug trafficking.

I wonder what kind of new laws are going to be passed based on this questionable study. Perhaps because we aren't smart enough to verify the email ourselves, the government has to do it for us?

Shame

[etzel]

Too bad you can't smoke cybercrime

Re:4% is not measuring what you think it is

[TheRaven64]

The test was also not entirely fair since it only showed images of the emails. For this kind of thing, I always hit view source, and read the headers and the markup before making a decision - and then usually go to the site by typing in the address and logging in manually, rather than clicking on a link.

Bad News

[chord.wav]

This is bad news for mind-expansion and brain-hacking drugs as more criminals will turn their investments to the more profitable and less risky cibercrime industry.

the future

[iceberg0151]

i believe in the next twenty years, computers will be the size of houses, and only the very wealthy will be able to afford them.

An Important Public Service Announcement:

[Anonymous Coward]

This is your brain .

This is your brain on the Internet.

Just say NO to the Internet!

Two totally different crimes

[Mr. Cancelled]

One's a crime of greed, while the other is a crime of demand (although plently of people get into the drug business solely for the income potential).

If there wasn't a demand for drugs, there would be no drug trade. Conversely, the only reason to steal from others is always greed. Some might steal for fun *cough* winona ryder *cough*, but theft (in person, 3rd person, or via cybercrime) is almost always due to greed. Big difference there... One's there as a result of people wants, and demands. The other is largely parasitic, and exists solely to leech off people.

Personally, I'd rather see my government invest more of our tax dollars into protecting our identities, and investments, as opposed to busting generally harmless dope smokers, and their suppliers (In case you didn't know, marijuana smokers are the most commonly targeted drug demographic these days, and the majority of our tax dollars, go towards fighting marijuana, while proven "bad drugs", such as meth, ruin lives, and run rampant throughout the country).

The reason for all this is greed. The big companies almost write their own laws these days, and meanwhile more and more of our freedoms our lost, as our lawmakers focus on giving their funders (not constituents!) what they want. And surprisingly, things like Cybercrime continue to grow, and be largely ignored (Note, I'm talking real crimes, such as identity theft, phishing, and so on. Not downloading music and videos, which IMHO should be near the bottom of our list of priorities) .

Personally, I'd like to see a major change in how we handle crimes in this country: Elevate identity theft, and other life-altering crimes to the level they deserve, focus our energies and money on bettering our country, and removing our dependence on other countries for our very existance, and stop focusing on the average downloader as being the worst thing to hit the US since Pearl Harbor. Meanwhile, start fighting the real drug problems that are facing our country: Meth, Cocaine, Heroin, and so on, rather than going after the "low hanging fruit", marijaua users, which are largely chosen simply for the ease of busts, and the profit available to cops for doing so.

It's all about priorities, and right now our lawmakers top priorities are largely themselves, as evidenced by recent events.

Re:Two totally different crimes

[MacDork]

In case you didn't know, marijuana smokers are the most commonly targeted drug demographic these days, and the majority of our tax dollars, go towards fighting marijuana, while proven "bad drugs", such as meth, ruin lives, and run rampant throughout the country

Are you suggesting we arrest our men and women in uniform? Terrorist! ... BTW, many states now require an ID to buy over-the-counter cold medicine like Alka-Seltzer.

Note, I'm talking real crimes, such as identity theft, phishing, and so on. Not downloading music and videos, which IMHO should be near the bottom of our list of priorities

Which raises and interesting point. How much of this so called 'cybercrime' money is derived from the RIAA's over-inflated numbers? I think the Columbians are still raking in a lot more than the Nigerians.

IT is not funny

[etzel]

GoodDear Sir/madam,

Greetings to you who are highly favoured may the lord God Almight be with you Amen. My name is george Ochonogor,im from Delta State Nigeria,am 24years old
boy,I have no family i lost my whole family during the crisis which they fought seriously in Delta state in the year 1999,i have no father,mother,sister or brother,they where burned alive by the ijaws youth during the crisis. Good grief! I hope my ijaws don't set on fire - sounds damn painful.

I was the only one who God survived in my family since then i have nothing in this world all of our property where burned complete including my whole family right now i am alone in this world suffering and begging.i lost my education career because there is no one to pay my school fees,i dont have home to live and no good clothes to wear,i begged to eat right now there is no one i can call for help.

i am now a worthless beggar. Who can afford Internet access. please i really want you to help me with anything you have for me.in fact if there is anyway you can used to help me it will be great.you can help me your old clothes which you are not wearing anylonger,please look at my situation and the pains which im going through in world and help me.

I have no family to help me that is why im here begging you to help me. it is written in the book of {matthew chapter 7verse 7 it says "ask and it will be given unto you,seek and you will find,knock and the door will be opened to you"}so you can help me with anything at all and the Lord will surely blessed you as you help Amen.

I wish my parents are alived i would have finished my education by now. Help in the name of God, please i really rely on your help and i wait for your reply.thanks for you assitance

N.B YOU CAN HELP ME WITH CLOTHES THAT YOU NO LONGER WEAR,YOU CAN SPONSOR ME TO ANY OPHANGE HOME,OR YOU CAN ALSO ASSIT ME WITH ANY AMOUNT OF MONEY TO COMPLETE MY EDUCATION OR YOU CAN TAKE ME AS YOUR SON OR HOUSE HELP. GOD BLESS FOR EVERTHING YOU DO.AMEM

Typical bogus

[farrellj]

Probably piracy makes up 90% of their numbers, and we know that the RIAA, MPAA, and their proxies world-wide probably over-estimate their figures by claiming that everyone who downloads something will not buy it. The article doesn't show the numbers breakdown...

ttyl
            Farrell

IT Cartels

[NoMorePoints.com]

So if there are these IT Cartels, who do we have defending us against them? Keanu Reeves? Yikes.... NoMorePoints.com

50% correct can be a GOOD thing!

[Tsu Dho Nimh]

I took the test and got 50% ... but not because I was fooled by half the pfishers. They were frauds because I do not have accounts with any of the supposed senders.

Maybe the test should say: "IF you had an account with the following entities, would you consider this a genuine or a fake email from them?"

How to spot phish in 1 easy step...

[Anonymous Coward]

Find the link they want you to click. Hover your mouse over it. If it doesn't go to where it says it goes, it's fraud. Now if we can only teach the other 200 million uninformed, we'll be all set.

4%?

[NoodleSlayer]

That 4% number seems rather suspect to me.

If you take a look at the survey it not only checks to see if you can spot a fraud, but if you can spot a legitimate email too, and marking a legitimate email as a fraud, which in real world terms is harmless, is given the same penalty has marking a fraudulent email as legitimate... Even in the explanation they say that the message had red flag yet was legitimate, so what's supposed to be the lesson learned here? That users also have a hard time spotting legitimate emails?

spelling tip: Grammer is spelled "Grammar"

[bobalu]

Yes, it's terrible new people have moved into the neighborhood. I'd like to introduce you to my coworker - she started out hard-wiring programs into an IBM in the 60's.

Now any fool who can type can come along and they don't even have to hand-assemble their programs! Sheesh!

Phishing Test

[MiKM]

It's little more than a scam to get you to buy their anti-phishing products. I scored a 70% which surprised me given that
a. I have never recieved mail from any of those institutions, so I have no idea what a "legit" email looks like / how it's worded.
b. I cannot see where the links go
c. I cannot see the header
d. Cannot check if the links have a legit/valid SSL certificate

Given that information, I know I could pass the test with flying colors.

Ohhh

[paranode]

So I guess all that extra money we started paying for gas after the 'war for oil' started is going to recruit new terrorists since so many were killed or captured?

Or maybe what you meant to say was 'fund rich capitalists'.

The name is Valerie McNevin

[tigertiger]

Ah, journalists... So let's do some homework for them.

So for all of us who are busy googling for this person, the name is not Valerie McNiven, but Valerie McNevin. She is a lawyer, worked for the state of Colorado in about 2002 and then for the World Bank and is now with a private company, Cybrinth, LLC which does consulting on cyber crime. The Reuters correspondent did not bother to reveal this.

The article itself is rather confusing - he is actually claiming that cybercrime is perpetrated by "idle youths looking for quick gain"? In the Third World?? And just for fun, once the Reuters dispatch gets rewritten, she turns into a cybercrime guru...

Now, how she gets the number of more that $100 bn being made by cybercrime, I have no idea. I guess it includes the $40 bn revenue Microsoft makes each year...

The obvious solution...

[paranode]

...is to legalize cybercrime.

Re:The obvious solution...

[Jon_E]

nah .. just promote them to high ranking government positions and have people randomly congratulate them on what a good job they've done.

/. fix

[paranode]

Hey man I'm a tech junkie, got any stuff? Stuff that matters?

Re:/. fix

[indifferent children]

Sorry, nothing but dupes and shills. Try again in 15 minutes.

Does that include spam?

[Anonymous Coward]

I would think if that included spamming it would be a little bit misleading. Sure spam is dirty and lame, but I wouldn't go so far as calling it a crime. Wonder if it also includes "warez", where the companies tally up every download as a lost sale.

I know, I know. I should RTFA. But I'm not gonna.

It's slashdot

[Anonymous Coward]

The right combination of anti-US or anti-MS commentary will get you instant karma.

Re:It's slashdot

[Frizzle Fry]

And in Soviet Russia, instant karma gets YOU!

No wait, that's not Soviet Russia; it's a John Lennon song.

Re:It's slashdot

[Paradise Pete]

No wait, that's not Soviet Russia; it's a John Lennon song.

Cute. One of the (very) few good Soviet Russia jokes I've seen.

Frightening opinion you have there.

[pyrosim]

Well, first of all, "ARRHGHGHGHGHGHHHHH the tinfoil hat, it BURRRNNSSS", and

Secondly, if we raised the barrier of entry to the internet to require programing certifications, we would not need to worry about the worms and virii, because anybody worth their certification would have far less of a likelyhood of having a problem with such things, and the virii would have much less shelter to propigate from.

Third, how are you going to make it that only licensed people are allowed to program? Seize the computer of anybody who tries to write a program? Make compilers and assemblers highly contraband and only allow liscensed individuals have them? Shut down internet based tutorials for programing languages because they are not officaly approved by the certification body, and we cant allow people to learn basic programming on their own? Fourth, what the hell good would educating bus passengers do? Educated computer users ARE better at avoiding worms and virii, are educated bus passengers gonna be better at preventing crashes? I would like to know how that works. Using an electrical outlet to plug in a electronic device is nowhere near what an electrician is supposed to train for, and knowing not to click on the "PUNCH TEH MONKEY AND WIN $999999999 $$$$$ DOLLLARS!!!!" flash ads, is nothing near coding.

Your post frightens me severly, and I sincerely hope that this is not a majority opinion.

Cyberdrugs

[skingers6894]

Hmmm, How are we going to classify the drug trade when it goes online?

Link doesn't support assertion.

[Phanatic1a]

only 4% of Internet users can flag 100% of phishing e-mails

I took the test the linked-to article cited as the source of data for that 4% claim. I only scored 80%. Does that mean I flagged only 80% of phish attempts? No, it doesn't. I flagged 100% of the phishing attempts as exactly what they were.

I had two false-positives, which lowered my score. But false-positives are quite a bit safer than false-negatives. In each case, the 'legitimate' email linked to different domains than the origin; the one from Bank of America linked to bankofamerica1.com, and the one from CapitalOne linked to a really odd domain, bfi0.com. That second one is a *huge* red flag, regardless of the content of the email, you'd have to be very trusting or do some extra research in order to *not* flag it as a phishing attempt.

Only 4% of users might score a 100% on that quiz, but that's not at all the same thing as saying that only 4% of users can't flag all phishing scams as such.

Re:Link doesn't support assertion.

[hidden]

Thank you... So I'm not the only one that thought the CapitalOne email was weird...

Re:Link doesn't support assertion.

[Oswald]

You are exactly right. I got the Bank of America one right because I cheated and tried the URL for myself and found it was legit. The lame CapitalOne question got me because I was too bored to try the same test a second time. Their explanation of why it was legit was in fact an explanation of why it was verly likely an phishing attempt. I call bullshit.

Re:4% is not measuring what you think it is

[hackstraw]

The test was also not entirely fair since it only showed images of the emails. For this kind of thing, I always hit view source, and read the headers and the markup before making a decision - and then usually go to the site by typing in the address and logging in manually, rather than clicking on a link.

Phishing scams are not targeted at people like you. Most people have no clue how to read email headers. It is not easy. I admin a mail server, and sometimes I have to decipher what in the world is going on with a bounced mail sometimes, especially when bounced mails are another form of phishing. HTML source. That is well beyond most people as well. It looks scary, and like a foreign language. Typing in an address manually. The keyboard is not considered user friendly. It has too many buttons.

Oh. And I type my urls into google. I don't trust my typing any more than I trust a commercial mail from somebody.

Sales data?

[HermanAB]

How accurate can sales figures of illegal drugs and online fraudsters be? Do all drug dealers and fraudsters submit honest tax returns for their illegal sales?

You forgot caffeine and fast food

[catmistake]

Both those should be scheduled substances, too... espescially the latter.

Phishing Scam test is screwed up

[Jason1729]

An email starting "Dear Network Solutions Customer" is a legitimate email?? No wonder only 4% of people pass that test.

Phishing and Internet Explorer 7

[Z34107]

This is mildly off topic, but the phishing problem may be close to near-extinction. I, a proud user of the Internet Explorer 7 Beta </glee> am happy to inform you that it has a "phishing filter." When you go to a site, it checks it against a database and will warn you if it's a known scam. If you think an unreported site is a scam, there's a little "report" button you click. So, with any luck, only the stupid who disregard an explicit popup warning telling them they're about to hand over their soul to a Nigerian will fall victim to phishing.

By the way, any idea if Firefox will implement something like this?

Re:Phishing and Internet Explorer 7

[Eraser_]

I doubt this will be very effective. There are likely hundreds of live phishing sites at any given moment. At the webhosting place I work we get probably 5 or 6 new phishing sites daily, possibly more. It is a mix of fraudulent signups with stolen credit card or paypal information and simple exploited websites. We tend to get them removed in ~24 hours, but it only takes one person to put their info into one of these forms.

Re:Phishing and Internet Explorer 7

[Anonymous Coward]

If you think an unreported site is a scam, there's a little "report" button you click.

Gee, I bet that button will never get abuse.

Re:Phishing and Internet Explorer 7

[Jasin Natael]

There's a way to prevent that. For the first 24 hours a website is available, make the contents visible to the Class C that the owner last logged in from, and put up a 'coming soon' page for everyone else. Then, once the details have been verified and maybe someone has looked at the site, remove the restriction.

Jasin Natael

Re:Phishing and Internet Explorer 7

[Eraser_]

That is a seriously unworkable solution. Between domain registration and misc dns propagation delays, plus websites which are managed by multiple people from different class c's, we would piss off a substantial portion of our customer base if we told them "hold on...". The other thing is a lot of these people sit on their accounts for a couple of days, it is likely their automated tools just make a sweep through the various systems and then go back to see what worked.

We have automated systems in place to try and detect fraudulent accounts and signups, but that can only be so effective. It catches more and more as the days go by but some will always slip through the cracks. Plus, many of our phishing accounts are exploited scripts with a /paypal/ directory or similar added. We deal with it how we can. Don't try to send email From: paypal.com, one of a pile of banks, or other accounts you have no business sending from and common misspellings and other obfuscations. Your email won't go anywhere and you won't get notification.

Not to mention, do *you* want every website you go to crossreferenced in some big Microsoft database?

Re:Phishing and Internet Explorer 7

[Z34107]

Not to mention, do *you* want every website you go to crossreferenced in some big Microsoft database?

You can turn the feature off, but ONLY if you use Microsoft Hotfix KB1234567: Tinfoil Hat Construction. :D (You can turn it off, tho - Tools -> Phishing Filter -> Turn Off Automatic Checking)

You're right, though, that putting sites on "probation" is completely unworkable, and the filter won't be able to catch everything because even if it did for a while by some miracle, dozens of more scam sights will spring out of the ground like corruption out of the U.N. The current system seems to work fine, tho - if Internet Explorer 7 finds that you're at ImGonnaStealYourIdentity.com, and ImGonnaStealYourIdentity.com is on their blacklist, you get a little warning. (You can still give them your identity if you want, tho.)

Or, <troll>we could make it illegal for Nigerians to send email.</troll>

From the article text...

[mikael]

... I thought this implied that online drug dealing was making greater profits that the bricks'n'mortar drug dealer.

if drugs were as plentiful as spam

[TheLittleJetson]

the world would be a better place

In Other News ...

[RedneckTek]

HP, Epson, Canon and other inkjet printer manfacturers reported record profits on 5.5 picoliter inkjet replacement cartridges. Several spokesmen said their companies have plans to make even smaller cartridges, that will sell for the same price. One company VP was overheard stating, "it's already worth more than cocaine, now if we can make it worth more than gold ..."

Bah

[YaroKutai]

its probably a skewed statistic that includes the "losses" due to "piracy", which as everyone here knows is a load of bullshit

Drug War costs MUCH more than Drugs

[billstewart]

The cybercrime investigator's figure of $105 billion for illegal drugs sounds like it's part of the 43% of statistics that are made up, but suppose it's true. The War on Politically Incorrect Drugs costs far more than that - direct expenditures by US and EU governments probably exceed that, but the real costs of the drug war include all the violence and corruption in Latin America that's fueled by the black market, which includes right-wing and left-wing paramilitary forces in places like Colombia, all the terrorism that's funded by opium grown in Southwest Asia (especially now that the anti-drug Taliban are no longer in power in Afghanistan), and all the people's lives that are wasted in prisons or in dead-end jobs because of prison records or in drug-dealing jobs that could have been doing more productive things.

Yes, legalizing drugs would lead to some medical problems, because some people have trouble handling them, but the free-market price of opiate addiction is cheaper than a cigarette habit, so addicts wouldn't have to resort to crime to fund it, and they'd be able to get pure enough drugs that fewer people would be overdosing because of random quality or getting HIV and other drugs because of sharing needles. (And marijuana's cost is entirely because of the black market - the stuff's a weed that grows anywhere you can grow tomatoes, so it ought to cost about $1/pound when it's in season.)

Re:Drug War costs MUCH more than Drugs

[somersault]

yes because we all want junkies running around with needles. Marijuana may not be much of a problem, but when you get to stuff like cocaine, please tell me who can 'handle' that? Why do people even need it? The people that feel they need that kind of buzz probably are the people that are going to have to commit crimes to fund it. Hard drugs can ruin people's health and lives pretty quickly, and I really just hate needles anyway and dont want to see them being sold in newsagents :p

Kellogs Coca-pops, snap, crackle, and pop your way out of bed in the morning..

Re:Drug War costs MUCH more than Drugs

[lisaparratt]

You appear to have missed the main thrust of the grandparents argument: drug addicts only commit crime because they can't afford their drugs. They can't afford their drugs because they're from black market suppliers. They're only available from black market suppliers because they're illegal. Therefore, if they're legalised, they become so cheap that practically anyone could afford a habit.

As for you not wanting to see needles in a newsagents - since when were you put in charge of what people should be allowed to do to their own lives and bodies?

What a Ridiculous Test

[Anonymous Coward]

I just took the referenced phishing test. Here's one of the answers, along with an explanation. Read it, and then tell me you think this test is legitimate: http://www.mailfrontier.com/quiztest2/answers/why_ q9.html

Don't display html = get interesting poetry

[bitingduck]

I sure as hell can't see the headers.

Ever since phishing got popular I started always showing full headers, not displaying html, and not autodisplaying images in email. Now, instead of getting phishing attacks, I get the interesting poetry that they use to get past the spam filters. Some of it is quite good and answers the age old question of whether a machine can create art.

Very little email that I want includes html that I want to see rendered, or pictures that I want displayed without warning. Combined with showing full headers it's pretty phish proof.

Phishing-identification test is flawed

[daveewart]

This "only 4 percent of users can spot a phished e-mail 100 percent of the time" thing is bogus anyway: that test is flawed:

1. You can't see the message headers or underlying message source. This can be very important when trying to figure out whether something is legitimate or not;

and also, more importantly

2. There is no context for the message. If you have no relationship with $BANK, then *any* message from $BANK is a phishing scam (or advertising, which is just as bad, I guess). You don't *need* to be able to identify it as 'phish' or not from looking at the message.

low tens of millions? hardly

[cookie_cutter]

I would venture that the global "budget" for terrorism is only in the low tens of millions of dollars

Osama Bin Laden alone is/was worth several hundred million dollars.

Re:low tens of millions? hardly

[nycguy]

First off, the wealth was that of his family, not his wealth personally--he was one of many children of a wealthy father. Second, if he already has that wealth, buying less oil will not take away what he already has. Most importantly, I'm talking about the "budget"--how much needs to be spent each year to keep terrorist organizations running--not the "cash reserves" of those organizations. In any case, my fundamental claim that al Qaida was funded by low tens of millions is backed up (link). Admittedly, al Qaida does not represent the whole of global terrorism, but the fact is that terrorism is relatively cheap to fund.

Cringely's solution

[walterbyrd]

According to cringely, the solution to the problem would be for everybody to give the phishers bogus information. Bogus credit-card numbers etc. If thousands of people did that, the phishers would be frustrated out of existance, or maybe even caught.

I've tried this once or twice, but I'm too lazy to keep it up.

Stupid test...

[Anonymous Coward]

The only way to consistently determine if an email is real or a well fashioned phishing attempt is to look at the link addresses. This test doesn't give you any of the info that a real email would have so the test only collects data about nothing. Give us a real test and then the percentages would be interesting.

Identifying Phishing E-mail

[kentborg]

The pointed to Phishing IQ Test is, at least to my ideas, bogus.

I identify phishing e-mail by looking at headers, link URLs, etc.

The test e-mails were screen shots where URLs were dead and headers were missing.

-kb

Tim Berners Lee: Father of the Internet

[Ohreally_factor]

Yes, we all know that the internet was invented on August 6, 1991. That's when we celebrate Intarweb Day across the word (wide web).

Gee, what's that sound? WHOOOSH!

Mod Parent Up

[Anonymous Coward]

I kid you not -- my last mod point expired just as I loaded and read this post.
So frustrating!