Voice Phishing Hits PayPal

Chai Vanilla writes "The latest social engineering phishing attack is now using phones instead of fake web sites. Identity thieves have spammed fake PayPal account compromise warnings to lure users into dialing a phone number and giving up credit card information. Unlike normal phishing e-mails, there is no URL or response address. Instead, the e-mail urges the recipient to call a phone number and verify account details."

Comments

Tracability?

[celardore]

Isn't this more traceable than just clicking on some IP in Russia? If I got an email asking me to phone any company, I'd be first looking for a landline. If it was a scam why couldn't I just call the phone company, give them the number and then they'd be able to trace it to an address or person?

Re:Tracability?

[MrShaggy]

See. Doesn't mean that these people are very smart. A not-so-great planner. Kind of like using the back of your cheque to write a bank hold up note.

Re:Tracability?

[this great guy]

Haha ! Welcome to the world of Phreaking... You might not know it but the telephone network is as easily hackable, vulnerable and exploitable as the Internet is today. Good luck tracing the bad guy who impersonated your credit card company you supposedly called on 1-800-XXX-YYYY, when he might have penetrated voicemail systems, set up temporary forwarding, hacked telephone switches, etc...

Re:Tracability?

[Traiklin]

cause they could get sued for invasion of privacy by the scammer.

So in the end it's a win win for the scammer :P

Re:Tracability?

[Keruo]

err.. 1980s called? Analogic phone networks are history in most places today. In order to hack the digital circuit switched phone networks used today, you'd need little more than a whistle and a tape recorder. Digital networks use physically separated medium for call control and signalling, and you won't get access to that medium without crowbar and selected location to crack at. And those locations are usually monitored 24/7.

Re:Tracability?

[slashdot-jake]

I must say that there should be a clean, concise list of security flaws that should never appear within a web browser, and each browser should be forced to undergo testing against that list before being released. To have such fundamental flaws appear, whether by accident or negligence, is unacceptable. Furthermore, the browser "industry" and the commercial sector NEED to come up with some guidelines as to how to promote and ensure online security for financial transactions and personal data. For example, it's almost impossible for the casual or sophisticated user to easily determine whether a frame that appears within a website actually belongs to that website, or another. For example, if you have an online account with MBNA credit card, and make an online purchase, some vendors will display an MBNA authentication page which asks you to login to your online account to verify the purchase. The problem is that this authentication page appears as a frame within the online vendor. How can you tell whether that frame is a legitimate MBNA page, or just a clever phishing attack? The browser gives no indication as to whether the frame belongs to MBNA or the vendor. PayPal suffers from the same thing. I hate clicking on the "Make a Donation" button of some sites, and then seeing the PayPal login appear within a frame of the original site. That prevents me from making a donation - with today's complicated scripting invocations and what not, I don't feel trusting enough to type my account info and password into some frame which happens to appear in the middle of some other organization's website. I can't BELIEVE that MBNA and PayPal would promote such idiotic practices, much less allow them to happen.

Re:Tracability?

[kesuki]

Sure it's tracable, right back to the voice mail they hacked because it had a default password, which rerouted it to some numbered account in some country where the officials are all too hapy to allow a few transactions slip past.

fortunately, the time of trace to the time of shutting down those accounts is limited only by the proactive reporting of such fraud by end users. so usually, it should only take a few minutes to shut down the assets of such an account. a scammer would need ungogly luck to keep an account open for more than 15 minutes with all those concerned citizens reporting these kinda spams in a community based effort.

Re:Tracability?

[Waylander1970]

Because a phone company won't be bothered and if they were, they would not do anything without a legal order due to data protection. NTL, BT, Virgin, Voda etc are all useless customer service, what makes you think they'll get this right?

Re:Tracability?

[kesuki]

correction, sorry, you need luck far greater than luck herself can provide, with various community oriented projects to harvest, examine, and report fraudulent e-mail spam to the 'correct' authorities using peer to peer software :)

It's awesome technology, and it's the reason why phishing and identity theft accounts are frozen and almost 99% of all stolen funds are recovered.

Re:Tracability?

[rangeva]

I think the problem isn't the trace. Many time websites of attackers are traceable, and also email address even the IP addresses. The law authorities don't give the spam, phishing and online crimes enough human resource and enough attention. I think that in their mind, if it's on the internet it's not a real crime.

Re:Tracability?

[kesuki]

Well the thing is :) usually Id theft phreaking in this day and age rely on simple 'human error' like misconfigured voicemails etc, to enable 'harder to trace' routing. but with the technology that's available, it takes about 10 minutes from the time a number is identified as a 'phishing' scam to the time it takes to completely secure any assets stolen.

I know there have been articles about peer based communities who harvest all these scam mails by posing as idiots on the internet, and allow authorities to quickly stop any real monitary loss from occuring.

So basically, unless you're hiring 7 year old sprinters to withdrawl the money from your accounts ever 20 seconds. You won't make a dime of phishing anywhere.

And yeah, we can back that claim up :) with pictures, just wait a little :)

Re:Tracability?

[FireFury03]

Digital networks use physically separated medium for call control and signalling, and you won't get access to that medium without crowbar and selected location to crack at. And those locations are usually monitored 24/7.

The SS7 network is certainly not built with security in mind - once you've gained access to a system connected to the SS7 net you've got a pretty free reign. Pretty much any large VoIP gateway will have an SS7 connection on one side and an internet connection on the other so crack one of them and you're sorted. Not to mention all the SIGTRAN enabled equipment that some moron has decided to plug into an unfirewalled internet connection.

That said, I suspect the worst you'd be able to do is spoof a few calls, send a few SMS messages and add a few records to the billing systems.

Besides, there are much easier ways of getting an anonymous DDI - just use one of the many PSTN-%gt;SIP gateways.

Re:Tracability?

[jdbartlett]

Internet crime gets a lot of press, but receives little attention from crime prevention teams? Interesting. Do you have anything to support that claim?

Re:Tracability?

[SeaFox]

If it was a scam why couldn't I just call the phone company, give them the number and then they'd be able to trace it to an address or person?

You think the phone company would just tell you who a line belonged to if you called them up?
  Nope. Even if the other party is calling you and harrassing you repeatedly you would have to file a police report and get the information sopenaed. The telco doesn't want to be named in any lawsuit if someone goes vigilante after getting the info.

You can use reverse directories online and such, but that assumes the number is publically listed.

and yes, I DO work for a phone carrier.

Re:Tracability?

[Anonymous Coward]

1. Steal a (or buy a stolen) credit card #.
2. Get a, say, Skype call-in number and mailbox using the stolen CC info.
3. Send out phone-phishing e-mails with the above phone number.
4. ...
5. Profit!

Re:Tracability?

[tomhudson]

Internet crime gets a lot of press, but receives little attention from crime prevention teams? Interesting. Do you have anything to support that claim?

How many 419 and other scams do you get in the mail EVERY DAY? I get more con mails every month than ALL the scam artists who have ever been jailed over phishing since the birth of the Internet.

Re:Tracability?

[jdbartlett]

You're confusing number with proportion.

Re:Tracability?

[vux984]

You think the phone company would just tell you who a line belonged to if you called them up?

You've got to admit it *seems* reasonable. After all they handed over the information on every call made in the country to the government without even blinking. Why not tell a customer about one little number? ;)

Re:Tracability?

[tomhudson]

You're confusing number with proportion. How many people EVER go to jail for phishing? Try reporting it to your local cop shop - you'll get the "we don't handle that here" bit. Then you're told to post your complaint to such-and-such a web site ... and nothing happens, because they're after the easy-to-bust ones - they guys running boiler-rooms going "You've just won a vacation, just send us the money for the taxes and duties."

They HAVE the tools to deal with that, so that's what they do. They DON'T have the tools to deal with phishers.

Re:Tracability?

[rjshields]

I hate clicking on the "Make a Donation" button of some sites, and then seeing the PayPal login appear within a frame of the original site. That prevents me from making a donation

Just shift-click or ctrl-click the link and it'll appear in a new window or tab. Failing that in FireFox you can right click -> this frame -> view frame info to see the URL. But yes, it's pretty dumb putting this stuff in a frame so you can't see the URL. Also if the framed page was encrypted with SSL, you wouldn't see the padlock icon.

Re:Tracability?

[crazygamer]

What if the person is using SkypeOut or SkypeIn, isn't that fairly anonymous? If it requires credit card payment, I'm sure these people already have plenty of stolen numbers to use.

Re:Tracability?

[Planesdragon]

Why not tell a customer about one little number? ;)

Because you can't pardon them for anything they might do illegally in helping you. The President can.

Re:Tracability?

[ivan256]

You think the phone company would just tell you who a line belonged to if you called them up?

You can use reverse directories online and such, but that assumes the number is publically listed.

I know, seriously... If you want that kind of data you have to give them some money first.

Of course, if you do give them some money, they'll give you just about anything you want.

Re:Tracability?

[karnal]

You make a funny point (to me, anyways...)

Ever since Bank One converted to chase, the online bill-payment system for them makes you enter your logon and password. But the entire page isn't marked "secure" by firefox. Want to see for yourself? Look at chase.com.

Anyways, in the upper left hand, you log into your account. I haven't figured out a way to "log in" and have firefox show me it is secure, so I am just forced to be content with the way the site is designed. Of course, the chase site shows a pretty little lock there, but that doesn't mean it is secure.... ugh.

Re:Tracability?

[rjshields]

But surely the huge gif with the padlock image makes it secure ;)

Seriously, it's because the home page isn't requested over https. If you type some false details in the username/password fields and hit return the page comes back over https. Or you can go straight to https://chaseonline.chase.com/colappmgr/colportal/ prospect?_nfpb=true&_pageLabel=page_logonform

Re:Tracability?

[Cecil]

You think the phone company would just tell you who a line belonged to if you called them up?

Actually, if you're using Sprint, they've even got an automated system to do it for you!

Re:Tracability?

[Anonymous Coward]

As others have mentioned, but in many - a - emails.. having a phone line that is as hard to trace as the Russian IP is easy:

1) goto a service that gives a 1-800 number, and will forward it to another number (http://www.dial-abroad.org/toll-free.htm came up without to much searching)
2) get a VoIP line ( I use callcentric here in canada)
3) have the computer reciveing it in Russia (and thus behind a russian IP)
4) use a creditcard from your email Phishing scheme to pay for the phone one..

On a side note, both spam paypal "account will be deleted" emails I got today where the standard "go here: <a href="http://somesightwithoutthewordpaypalinit.tld ">https://www.paypal.com/cgi-bin/run?somthing</a>"

(I have informed my spam filter, that these should not have been put into my inbox)

Re:Tracability?

[jdbartlett]

You're confusing the delegation of one authority with impotence of all authority: if I call my local cop shop on Senator McDozer-Thee-States-Over's corruption, they'll point point me elsewhere. Doesn't mean nothing's being done nohow, just that jurisdictions apply.

Re:Tracability?

[Logiksan]

And those locations are usually monitored 24/7.

Have you even been in a central office lately? All it takes is a time when the CO manager is off for the day and an AT&T badge and you can have your hands on any piece of hardware you want. The techs are clueless and there's no "security" to speak of at any CO outside of a major city. As long as your badge swipes clean at the door, there's nothing stopping you from doing whatever the hell you want once you get inside. And as long as you're not messing with 911 service or anything like that, the NOC will never be the wiser.

I worked in SBC central offices for over five years on an expired identification card. All I did was stick my ESD cert sticker over the date and no one ever bothered to check.

Re:Tracability?

[tomhudson]

Look at the conviction rates. As close to zero as you can get. Heck, look at the number of people charged. Not all that many, are there. Phishing is profitable, and almost punishment-free.

Let them start with paypal and eBay - then I'll believe they're gonna do something.

Re:Tracability?

[jdbartlett]

"Look at the conviction rates. As close to zero as you can get. Heck, look at the number of people charged. Not all that many, are there."

Which brings me back to my original question: interesting, but do you have any evidence of this?

Re:Tracability?

[tomhudson]

You said:

Internet crime gets a lot of press, but receives little attention from crime prevention teams? Interesting. Do you have anything to support that claim?

When was the last time you saw ANY type of anti-phishing crime prevention initiative from ANY level of law enforcement. Sticking a few warnings on a web site that nobody looks at until its too late is NOT crime prevention. A real anti=phishing crime prevention program would work the same as the "don't drink and drive programs:

1. Ads on tv, the radio and the newspaper advising people that if they have to use Windows, NOT to use Internet Explorer, Outlook Express, or Microsoft Office, so they don't fall victim to a "drive-by";
2. More ads telling people that only suckers use Windows - that there are cheap/free alternatives for when you need to go on the Internet
3. Using the existing public mischief laws to charge people whose machines are being used as phishing robots - including 1-year bans from access to the net. This will give ISPs a financial incentive to stop the problem before the police get involved and they lose a customer for a year or more
4. Setting an eample by making removing Micrsoft products from all levels of government a real priority. Set deadlines, and impose departmental penalties on budgets if they're not met.
5. Lean on vendors to make products that work with other OSes
6. Accept "reduced functionality" and/or more trianing as the price to be paid for a more secure system
7. We parade drunks through the media when they're caught drinkig and driving - do the same for assholes who go "gee, my machine is so slow now" but don't do anything about it. If someone drives a car with bald tires, they're liable for any accidents/harm they cause. Same thing here
8. Visit community groups, schools, old age homes, etc. and SHOW people how stupid they are when they give their account information to anyone for any reason whatsoever.

Draconian? Maybe, but these are all examples of initiatives that can be done, and won't be done. Prevention is they key - and law enforcement is doing ZERO prevention. Heck, they think that a perl script to "dd /dev/hda | grep 'some key phrase' > suspicious.txt" is advanced. (yes, that's basically what one of their "tools" does - something that a script kiddie can throw together in seconds).

Crime prevention is more than sitting around in chat rooms pretending to be a 13-year-old girl.

Re:Tracability?

[permaculture]

If the computers that run the phone system are built and run by fallible humans, they can be cracked. Even if only by social engineering or bribing a Telecom employee. Remember Jurassic Park? They had all the latest technology, but the coder was bribed by another company.

Security is a process. There are always other ways than cracking to subvert it.

Re:Tracability?

[jdbartlett]

Well, this isn't the evidence I was hoping for (I was hoping for some actual statistics you'd used in forming your opinion - it turns out you just hadn't seen the drastic measures you were hoping to see.)

1. The Mozilla group advertises the security advantages of its Firefox browser. Unfortunately, it lacks the funding for a TV campaign, but a donation effort was successfully made for a two page ad-spread in the NYT. If you're hoping for anti-Microsoft campaigns launched by the government, I'm afraid you'll have to wait on. Microsoft would yell "Antitrust!" before the first ad reached TV. There are no standards of what an application/operating system should accomplish. Unlike a drunk driver, Microsoft is not breaking any laws.
2. Apple released such a campaign, but it only briefly mentioned OS X's security advantages over Windows. Again: home user desktop Linux distros lack the funding for a TV campaign, the government is not in the position to launch such a campaign.
3. Fine victims of malware, you mean? Maybe we should also fine victims of burglary for having houses so insecure they were broken into and thus contributed to the takings (and therefore prolonged the lifestyle) of a burglar.
4. The national wallet won't like it, won't stand for it, no sir. Unfortunately, that transition would cost a lot of money in contracts, support, downtime, retraining, installation, replacement of software tools, research, etc. It's a good goal, but it will take a long time to happen.
5. There are already good OSS alternatives to most major office products. OpenOffice.org is the most frequently cited. It operates on Linux, Windows, and Mac OS X with X11 (included on the installation disc).
6. That's your solution? "Accept it"? It won't work, accept that!
7. Personally, I disdain the thoughtless media circus that circles around drunkards, especially minors. However, their crime could easily have threatened others lives, not just the wallets of those fall for some scam or another. Again, though, you're talking about punishing victims. These aren't people whose tires are bald, these are people whose tires were slashed while they were driving. Also, again, there are no standards as to what software products should be able to accomplish. If there were such standards, they would serve to choke and not to boost OSS initiatives. GNU/Linux and other OSes would be caught in litigation's red tape, fees and possibly fines before they could launch.
8. They're called identity theft awareness campaigns. The FTC has launched such campaigns. The EU has launched such campaigns. In the USA, several banks have launched such campaigns in joint effort. I'm not aware of any current community involvement, but that doesn't prove it's not happening.

Re:Tracability?

[tomhudson]

Again, read your quote. Yo specified "crime prevention teams".

Mozilla and Apple are not "crime prevention teams". Neither is the FTC. Law enforcement (your local and state police, the fbi) are unable to handle phishing. The FBI says unless cybercirme results in damages of more than $10k, go fuck yourself - they won't do anything except to file it.

These aren't people whose tires are bald, these are people whose tires were slashed while they were driving.

Wrong. These are people who KNOW their computer is not working properly, and don't take the time to find out why. Wilfull ignorance is not a defense, quite the contrary - it indicates recklessness and irresponsability on the part of the computer owner. Same as someone who insists on driving with bald tires, or no windshield wipers, or burned-out headlights, or drunk. I'd have no problem with fining them $300 per incident, and after 3 incidents in 1 year, they're banned from using a computer for 1 year, after which they have to attend a course (same as people driving drunk) or the ban is made permanent.

People won't change their habits until they're forced to see the consequences of their actions.

Oh, and as for the whole "victims of malware" bit - maybe they should complain to the company that made their OS for making such a buggy POS in the first place. Getting rid of Windows usage among the population should be a national priority for any country worried about their IT security.

Re:Tracability?

[jdbartlett]

1. I used the term crime prevention, which includes a lot more than just law enforcement. When they advise security standards to protect against (and therefore prevent) crime, yes: both the FTC and Mozilla act as crime prevention teams.
2. I also said, do you have anything to support your claim that, for the sake of argument law enforcement authorities are disinterested in Internet crime. Thus far, you have given only your opinion and some irrelevant observations. I'm curious if you saw any statistics when forming your opinion, or whether perhaps it arrived in a dream.
3. Law enforcement teams especially should not waste resources launching smear campaigns against Microsoft. They are more concerned with enforcing law.
4. Just out of curiosity: I've heard the $10,000 story kicked around before, but never seen any supporting documents from the FBI. Where did you read about this story? Do you have a link to an FBI document explaining this?
5. You're assuming all malware victims are people who know their computer is not working properly.
6. You are therefore suggesting all malware victims are deliberately avoiding repairing their OS for reasons uncited.
7. For no good reason, I hope you are assuming they are not using antimalware/antispyware tools. Even if they are: when new exploits arise, makers of such tools need to release new protective updates. For example, Microsoft took a week to release a patch in response to the WMF exploit. Such patches cannot be written immediately. Should people be punished for not knowing about a piece of malware for which no patch exists?
8. You're assuming malware is as obvious to the average user as a bald tire. The average user (the home/work office user who wants to check his mail and go) does not have the time or skills to pamper his computer. Not using the computer is not a solution: computer use is demanded by his employer.
9. Wilful drunkenness while driving does not compare with the unintentional effects of malware-victim PCs. Being a victim is not a deliberate act. There is no reason to assume a malware victim is even aware of being such.
10. Microsoft has committed no crime in releasing a buggy OS. If such a thing were a crime, the red tape preventing the release of new OSes would stifle most OSS OS projects.
11. If, though, the cause of malware is in Microsoft's hands, why are victims being fined for Microsoft's perceived crime?
12. If getting rid of Windows is the priority, this is the priority: improving the alternatives. Few people will want to go out and buy a whole new computer, which rules out Mac. I suggest you advertise alternative PC OSes; Linux distributions such as Ubuntu especially. Please contribute to such projects if you truly want them to succeed and replace Windows as the population's OS of choise!

Re:Tracability?

[petermgreen]

and it's the reason why phishing and identity theft accounts are frozen and almost 99% of all stolen funds are recovered.
so you've just got to automate the scams enough that a 1% kept rate is viable.

Re:Tracability?

[tomhudson]

Its very simple - if you can't tell that your computer is completely ##!ed up with malware, you aren't entitled to connect it to the net, any more than you're entitled to drive a car drunk on the roads. Incompentence is no excuse, not in this day and age when the information is so readily available.

computer use is demanded by his employer.

Then let the employer supply a proper computer, not some piece of shit Windows box. Getting rid of Windows and the mentality behind it solves more than 90% of the problems with idiots on the net. And Vista is going to be just as bad, if not worse, from the latest indications.

At this point, a 2-tiered pricing system for the internet sounds like a good idea - you connect with a WonBox, you pay double.

Being a victim of malware nowadays IS a wilfull act, if you're using Windows and IE and Outlook. There is NO excuse, except laziness and inertia. The choose to continue connecting to the net with a WinBox, they pay the price.

Depending on other crap (Symantec et al) to protect a crap OS is not the answer, any more than depending on chewing gum to "fix" a leaky gas tank is. In neither case are we looking at a viable long-term solution.

Mozilla et al are NOT responsible for the design flaws in Windows that hide the real nature of file names and extensions (and this has been the case since at least Win95, and in some cases, Win3.1). Windows is broken. Always has been. It invites phishing. It enables it to an extent NO other OS does. Why? Because Microsoft knows that people will keep paying no matter what. Inertia. And their "don't want to know" attitude.

You fall for phishing after all the warnings, you deserve what you get. If you're stupid enough to send a "bank" your baning info, you're just another one of those "fools and their money are soon parted" who really are dumb. Ditto for the greedy idiots who fall for the Nigerian scams and their variants. The scammer and the victim deserve each other.

As for the rest, google previous stories on slashdot.

Re:Tracability?

[jdbartlett]

It seems we're going in circles dicussing your opinion of Laws That Should Be and What Malware Does. It's entirely possible that the malware victim uses little enough processing power and bandwidth they don't notice the single malware app sending e-mail messages. Accusing a victim of idiocy and fining him as a criminal is an interesting approach to solving crime. Maybe next time I hear someone complain about their being murdered, I'll see what they think of your theory: they're an utter idiot for falling for the old being-shot-in-the-head trick. Again though, we're roving in circles around your unsupported personal opinions.

On the bright side, it seems that you're very anti-Windows. At least we both seem to agree that Windows is a poor choice of operating system. I personally use Mac OS X Tiger (laptop) and Ubuntu GNU/Linux (desktop/fileserver) as my main operating systems. My wife uses a Windows XP (Home) desktop for games and websurfing, and I currently use my old Windows XP (Pro) laptop for testing until I install XP Pro on her desktop (I use Remote Desktop for testing). Keep preaching the good word, they'll listen someday. Word of advice though, speaking purely from a marketing perspective: calling potential switchers idiots may not be a good tactic in making a case for Windows alternatives. For some reason, most people respond badly to personal attacks.

Googling previous stories on slashdot only turned up more hearsay regurgitations of the $10k story being kicked around - no links to FBI documents or other evidence to support what so far seems to be something of an urban myth. You also seem reluctant to reveal your source in suggesting that law enforcement and criminal prevention teams are disinterested in internet crime.

Re:Tracability?

[tomhudson]

The simple fact is that when someone is in a common space (and the net is considered part of the "commons") they have to accept responsibility for what their equipment does. Same as poop-and-scooping. Same as any accident you're involved in while driving. Just because it was an accident doesn't absolve you of liability. Ditto for stop signs. Didn't see it? Tough - pay the fine, and maybe you'll pay more attention next time.

It sure works with seat belt laws.

Its not a question of "guilty or innocent", but of not crapping in the communal water supply. There is no reason to tolerate it. If someone is repeatedly too stupid to catch on that they're being phished, or that you don't just install any old crao on your machine, then they're too stupid to be allowed unrestricted access to the net.

Its the same thing with your home alarm - 3 false alarms and the police refuse to respond any more, AND you get a $300 fine per subsequent incident. One local bank got hit with $35,000 in fines because they were slack in their training of the tellers. I watched the judge lecture their lawyer about public responsibility, the unnecessary dangers to everyone when the police respond to a false alarm. The excuse of "that branch is used to train people" didn't wash.

Some people are just too stupid to be allowed on the net. And the same applies to some operating systems. Cars AND drivers past a certain age need to be inspected, or they're not allowed on the road. I'm not saying we need testing - much simpler to just fine them and cut them off. The higher cost to IPSs from customers who are cut off after a few months will get them to encourage people to use better systems - say, for example, by charging 4x the amount for Windows clients as for non-Windows clients.

People vote with their wallets. That's why Intel beat out Motorola way back in the '80s. The 68x was a MUCH better chip than the 80x, but systems with an 80x were cheaper.

Re:Tracability?

[jdbartlett]

Again, these aren't cases of equipment negligence, they're cases of equipment sabotage. If someone sabotages your brakes in a way you don't notice until they stop working, you may not be responsible for any accident incurred.

Maybe you would like internet licensing and insurance to be introduced to keep the idiots out? Of course, we'll need to throw in an internet tax to cover the expenses of licensing. That's how we keep our roads safe and clean! Besides, it's not going to help you - the internet's a global network. Ooh, wait, I know! Let's sit representatives of every political border down and get them all to agree on something! Yours could be the unifying ideal to end all wars! That idiots should be banned from the internet! It'll work! Honest!

Re:Tracability?

[tomhudson]

1. The "sabotage" is only because everyone down the line is both lazy and negligent, from Microsoft, to the sales people, to the end users. "Contributory negligence" - you're still legally on the hook in many states. Its more akin to leaving food on the counter for a week and then complaining that vermin got in it.

2. There's no need for an "extra tax". Fines would pay for the system. Your machine is a spambot - pay $200, do not pass GO. Any surplus would be distributed as a rebate to other users, so the spambots end up subsidizing the rest. Watch how fast people switch OSes when their ISP sends them the fine (and no, under this system, switching ISPs won't help any more than switching insurance companies does after you've had too many claims. Don't pay the fine, you don't get connected)

Or simply charge people 4x the price if they connect using Windows, and use THAT revenue to subsidize other net connections. It could work out that Windows users pay enough so that everyone else gets a free ride - at least until enough realize that they're paying for a piece of crap.

Re:Tracability?

[inet50]

Most of these attacks are using VOIP making tracking down the fraudsters difficult.

Re:Tracability?

[jdbartlett]

1. Contributory negligence only applies in a situation where there is contributory negligence, hence the name. We have already established that a user can be running antimalware tools/a fully up to date system and still be attacked. Therefore, they are doing everything they can to ensure their system is up-to-date: Microsoft hasn't issued any factory recalls on their Windows version, their system told them it was okay. Therefore, they are not negligent. Again, negligence is not the issue. Bad software is a contributing factor in the issue. Evil software (also known as malware) is the real issue. Again: negligence is not the issue.
2. That word again: negligence. Look it up in the dictionary: n. Not the issue.
3. Charge people for using Windows! And here I was worried you'd come up with a solution that fell into the dictionary definition of antitrust!
4. No taxes, eh? Pays for itself, eh? Oh, I get it! It's just like how speeding fines pay for the police department! That's right, we won't need people to man this system, it'll be fully automated! How silly of me! We'll have automatic programmers to write it, automatic telephone staff to respond to complaint/payment calls, automatic researchers and developers not working to update and not improve it (Why would it need improvement? It's perfect!), automatic policemen to enforce it! If anything, it should make the governments of the world profitable as well as peacable! (We've already established this is the thing that will bind all nations together in peace and harmony.) I think you may have really hit on something here. Call your senator right away! Cancel that! Call The President! He'll know what to do. We'll see your ideas come to fruition just months (No! Weeks! No! Days!) from now. I'm sure of it.
5. I'm not being sarcastic.
6. Honest.
7. Welcome to the internet: ISPs who stop people from accessing it only, please. If you ignore this, we'll get our robots onto you. As soon as you pay the fine to cover the cost of powering them. Thanks.
8. Do not collect $200. Do not pass GO.
9. Go on! Call him! It'll be fun! His number's (202) 456-1414.
10. If you don't call him, clearly you don't have as much faith in your little scheme as you claim to.
11. Or are you afraid?
12. Chicken.

Re:Tracability?

[tomhudson]

Running Windows when there are free alternatives that are readily available IS contributory negligence, and wilful ignorance. Neither one is a defense. Everyone knows that Microsoft only makes crap software. Name ONE good piece of Microsoft software. Just one.

The real issue as to malware is that Microsoft's software is defective intentionally. Look at the latest hole they're introducing into Vista on purpose. F*cktards.

And yes, traffic tickets, including speeding, generate more revenue than they cost in terms of manpower, so the system of fines is a profit center. Look at the reports of the impact on costs every time police stop issuing fines when they're on a work-to-rule campaign.

As for calling (202) 456-1414, you've got the wrong country. I'm not an American. And I do spend time promoting linux usage among everyone I come into contact with. Got my ubuntu cd pack from shipit.com, and I'm handing them out.

Re:Tracability?

[jdbartlett]

1. We (assuming 'we' govern) cannot fine people for using Microsoft Windows without either triggering an antitrust case or creating standards Operating Systems must attain to (standards which Microsoft Windows does not attain to and is therefore unfit for use). In the first case, we have an antitrust case with good cause. In the second case, we create litigation that stifles OSS OSes. Remember: if such litigation were introduced, Microsoft is one of the few OS-developing companies that has the money to survive it. In the end, we'd have a better Microsoft OS - but we may only have a Microsoft OS! Other OSes may struggle to cut through that kind of red tape.
2. Unless you support it with evidence, I will not accept your claim that Microsoft intentionally (as in, "with intent") leaves Windows open for malware.
3. Unless you support it with evidence, I will not accept your claim that police fines alone could cover the running cost of the system by which those fines are issued and collected in entirety.
4. Not American? No excuse! Call the Governor General! Call the Prime Minister! Call your Lieutenant-Governor! Call your Premier!
5. Good going on the Ubuntu CDs. They'll come in handy when Canada bans Windows. You'll be a national hero.

Re:Tracability?

[tomhudson]

But you CAN fine people for using a bot-infested box.

If that's the sole criterion, then there is no "cost for system compliance". the responsibility is on the end user. Either

keep your Windows box clean

move to something more robust

pay the fine over and over until you finally give up and do #2 Evidence - Activex. Read about it.

More evidence - Windows File Explorer doesn't properly report the true extension of many files. This is intentional, and a huge flaw.

More evidence - the task list doesn't report all tasks. Another intentional flaw. In both the Explorer and Task list, there is code to check each name and decide "do I show this as it really is, or do I obfuscate it/hide it"

As for the "police fines" bit, just ask your local municipality. We had a work-to-rule campaign by the police force a couple of years ago, and the financial loss was enough to force the government back to the bargaining table. Tickets and fines subsidize your local police. If you don't know this, you're obviously not too well-informed with regards to politics, because police financing is a political, not economic, issue.

Re:Tracability?

[jdbartlett]

1. If you dictate, you can fine people for whatever you wish. That doesn't make it good, or right.
2. We've already established that the end user can be doing everything in their power to keep their system free from Malware and still suffer a Malware attack that results in some phishing e-mails being sent from their machine. Unless Microsoft Windows is banned, that their system runs on Microsoft Windows is irrelevant. What is relevant is that you are suggesting they be fined for something not in their control.
3. The existence of ActiveX does not prove that Microsoft intentionally (as in, "with intent") left Microsoft open for malware.
4. Interesting, I've never had a problem with File Explorer displaying the true extension of any files. But it doesn't prove that Microsoft intentionally (as in, "with intent") left Microsoft open for malware.
5. That the task list does not report all "tasks" does not prove that Microsoft intentionally (as in, "with intent") left Microsoft open for malware.
6. That your local police force experienced loss does not prove that money received from speeding fines alone could cover the running cost of the system by which those fines are issued and collected in entirety.
7. That tickets and fines in part subsidize my local police is not evidence that money received from speeding fines alone could cover the running cost of the system by which those fines are issued and collected in entirety.

Re:Tracability?

[tomhudson]

1. If someone is stupid enough to reply to the nigerian scams, or "we need to reconfirm your account information, plese enter your user name and password", they've already proven they shouldn't be near a computer, same as you wouldn't let a kid play with the stove. You don't need a license to use either one, but you do need some brains.

2. No, we have NOT established that the end user can do everything in their power. Quite the contrary, we've established that most users don't want to take ONE LOUSY HOUR to junk their old system and learn a new one. They're lazy, and they deserve to hae their pockets picked continuously until they buy a clue.

3. They refuse to close the activex hole, despite almost 2 decades of warnings (this was WAY before the internet became popular - when it went under another name). Part of the reason is that activex works only under windows. But as I said, just look at the latest hole they've intentionally introduced into Vista.

4. You HAVE had problems with Explorer displaying the REAL extension. You just haven't noticed it. Do some reading. Ditto with the task list. Better yet, go to the library and take out a few books. Not all the info is on the net, kid.

5. WGA. 'nuff said.

6, 7. I said fines subsidize the running of the police force, not that it pays for whole police force. It MORE than pays for the cost of the system of fines. Ditto with any system fining people who let their machines be used as spambots - the fines would MORE than cover the cost of running the fine system, and the balance could be used for ther purposes. In the case of the local police, both they AND the government hae admitted it in the press. What more proof do you need.

Oh, right ... Wiondow fanbois don't want proof OR common sense - thats why they continue to throw good money after bad on Windows. They think that as long as Microsoft patches something within a year or so, its okay, because, after all, its Microsoft.

Re:Tracability?

[jdbartlett]

1. Says you, and you have not been able to reasonably defend or justify that opinion.
2. I'm not sure where we established that. Maybe in your mind, right after we proved that the US military is holding designs for flying saucers and NASA faked the moon landing. ("But the evidence people! Look at the evidence!") Also, your belief that "these people" deserve to have their pockets picked makes me slightly less confident in your status as the savior of the internet.
3. That ActiveX has not been replaced does not prove that Microsoft intentionally (as in, "with intent") left Microsoft Windows open for malware.
4. As I said, I have never had a problem with File Explorer displaying the true extension of any files. That doesn't mean it hasn't happened, just that if it has happened, it hasn't caused me any problems. In fact, I hadn't even noticed. And it doesn't prove that Microsoft intentionally (as in, "with intent") left Microsoft Windows open for malware.
5. Unless you wear a tinfoil hat, Windows Genuine Advantage (which, as explanation for others reading this conversation, recently fell to spyware accusations due to its undisclosed "phoning home" to Microsoft) does not prove Microsoft intentionally (as in, "with intent") left Microsoft Windows open for malware.
6. Unless you can prove a percentage of the police force is dedicated only to issuing speeding fines, the whole police force is part of the running cost of the system by which those fines are issued and collected. There are also printing costs, collection costs, cost of arrest and jailtime of nonpayers... Also, you have not shown that speeding tickets more than pay for that force or the system by which speeding fines are issued and collected.
7. That you claim a police force did only their minimum work, causing a government to rethink its policy on some undisclosed matter, does not prove that speeding tickets pay for that force or the system by which speeding fines are issued and collected, indefinitely or even temporarily.
8. As stated before, I currently only use Windows for testing and prefer not to use it as my main operating system of choice. November last year, I began using Ubuntu Breezy as my main OS. In January, I was fortunate enough to acquire a Mac/OS X equipped machine. That I do not wear a tinfoil hat and accuse Microsoft of demonic acts and inviting malware and call every Windows user an idiot does not make me a "Wiondow fanboi". That's just another one of your wild, wacky assumptions, I'm afraid.

I am not convinced you have faith in your proposed "solution" to internet crime (punishing its victims). If you are serious, you will contact one of the following people before posting your next reply:

• Jean Charest is the Premier ministre du Québec. If you speak Fax, you can call him at (418) 643-3924. His English/Frog-speaking phone is available by dialing the numbers (418) 643-5321. Parentheses are not numbers. Hyphens are not numbers either.
• Stephen Harper is the current Premier ministre du Canada. Call him: (613) 992-4211. Ask for Ol' Blue Eyes.
• I already gave you the number for the White House (I pulled it from the intro to H2G2, by the way. Resourceful, non?) You said you'd be calling the wrong country. You forgot: the internet is accessible globally; for your approach to have any real effect, it would need to be enforced globally. Yes, it'll be a lot of work, but just think: you'll be an international hero!

In your next comment, please explain which of these people you called, why, and describe their response. If you do not do so, I will have to assume that you have no real faith in your proposed "solution".

Re:Tracability?

[tomhudson]

Jesus H Christ, you really ARE one clueless whatever ... Jean Charest? He's the new "Joe Who?"

Jean Charest is SUCH a lame duck. He is in absolutely no position to do anything. He is so ineffective that he's just a joke. He never makes the news, because he never DOES anything, and he can't DO anything because he's already seen in everyone's eyes as a political failure. Even his supporters admit that he's not exactly high-profile. You can go months without seeing him in the news. Literally a care-taker until such time as the party replaces him. Having him support your project is the kiss of death. Better to have the Parti Québecois behind it - at least they'll TRY to do something.

Stephen Harper is too busy trying to get his nose further up Bush's arse while trying not to give that impression. There's no way he would try to do anything against a Republican Party contributor.

The Grey House (It used to be white, but the current occupant has so tarnished its image - maybe Canada should burn it down again ... before we have to accept the next wave of draft dodgers) ... see the Republican Party contributor bit.

I wish the malware authors more and jore success - they'll "fix" the ecosystem much quicker than any of your proposals. By driving people away from Microsoft, they're doing the world a big favour. It's like the bullshit with Mafia Boy - the claims for billions of dollars of losses weren't true - quite the contrary. Companies like Yahoo! and CNN actually made a profit, because of the increased page views as people followed the news. The kids lawyer was stupid - he should have subpoenad the server log summaries for the previous 12 months. They would have shown an overall INCREASE in traffic even after the attacks are removed from the analysis.

Activex could be removed today. Sure, it would break things, but tough shit - its a broken technology. There is no excuse for keeping it, never mind allowing it on the next generation of systems. That's intentional - because its one of the few things that keeps people locked into apps that require it, and thus locked into Windows.

People who, after being wared and warned and warned, persist in being stupid, deserve any Darwin Awards the net hands out. The sooner every Windows box is turned into a spambot, the sooner everyone will switch. The internet is supposed to route around damage by design, and that will eventually include Windows clients, since people will switch rather than "upgrade" to Vista. Vista is Microsofts' biggest blunder to date. Even Moore's Law won't save it.

As for the rest, you're obviously incapable of reading. A good example is the whole police force thing. Whe EVEN THE GOVERNMENT ADMITS TICKETS ARE A NET PROFIT CENTER, that they rake in more than it costs for enforcement, you just show that you're either too stupid, too stubbourn, or just trolling. A real troll would do a better job, so I have to pick "too stupid". And unless you've been living in a cave, you'd know that many police forcs have staff assigned ONLY to traffic. They have whole DIVISIONS only for traffic enforcement.

Re:Tracability?

[tomhudson]

I wrote:

"Look at the conviction rates. As close to zero as you can get. Heck, look at the number of people charged. Not all that many, are there."

Clueless mac fanboi replied:

Which brings me back to my original question: interesting, but do you have any evidence of this?

Yo can easily disprove me - show us evidence, any evidence, that there are lots of people being charged. Oh, right, the few that ARE charged make headlines because its so F*CKING RARE! Res ipso loquitor.

Easier to track?

[nurb432]

Wouldnt having a phone to trace be more effective in catching them then a 'blind' and easily hidden behind webpage??

Re:Easier to track?

[beebware]

Not necessarily. For example, in the UK I could get a free non-graphical number (such as 0871 or 0845) which would be the sort used by financial institutions, I could then get that number "pointed" at a VoIP number (such as Gizmoproject) which I could then pay using a stolen CC to forward onto a Skype VoIP number which, also paid with a stolen CC, would then forward onto a landline in Russia. That's 4 different companies (in 3 different countries) which would need to be contacted in turn to trace down the ultimate destination of the call.

Latest phishing method???

[Anonymous Coward]

wasn't phone phishing one of the first methods used?

Re:Latest phishing method???

[JourneyExpertApe]

Yes, telephone scams have been around forever. The new thing here is that the people are initially contacted by email and encouraged to call the scammer on the phone, who poses as an agent of paypal.

The obvious joke...

[davidbrit2]

Quick! What's the number for the internet???

Re:The obvious joke...

[mcpkaaos]

(202) 224-3004

Ask for Ted.

Re:The obvious joke...

[Anonymous Coward]

Just google it.

Re:The obvious joke...

[beadfulthings]

No, no, no! That's not how the Internet works!

You don't CALL the Internet. You wait for somebody to SEND you an Internet. That usually takes about three days, and then you can send them back an answer to their Internet.

I KNOW this is true! I read right here on Slashdot, somewheres or other, about how this happened to a United States Senator who knows all there is to know about Net Neutrality and things. He waited three whole days for an Internet from one of his staff members. He must be smart--or else how did he get to be a Senator, right?

Not in the VoIP era

[Andy Dodd]

There are now plenty of companies (such as StanaPhone) that provide a free DID, all you need to do is register with them. Their business model is that they make money on outgoing calls, but most of them don't require payment until you actually decide to make such a call.

Got that yesterday...

[canavan]

I've gotten that phishing mail yesterday, and called the number (1-805-214-4801) immediately. The system's recordings were chopped and barely intellegible, and I was prompted to enter "my 16 digit credit card number" (which was indeed verified to at least follow the basic rules of correctess or be rejected), and its expiry date, but nothing like a name or even the paypal account data.

Where can one complain about such fraudulent 1-8xx numbers to get them shut down? Additionally, how much does calling a 1-805 cost in the US, and is any part of the cost passed to the operator?

Re:Got that yesterday...

[strstrep]

805 is a standard US area code, in parts of California. If it's a personal landline, then the incoming call is likely free. If it's a cell phone, then you're probably using their minutes. However, unless you live near wherever that number is, you're probably being charged, too.

Re:Got that yesterday...

[MrShaggy]

Maybe your local fraud squad, or the FCC. Maybe your FBI. I'm not sure.. I am not in the US. Maybe your government or your bank might have a page that directly talks about that. Paypal might as well.

Re:Got that yesterday...

[Anonymous Coward]

805 is Bakersfield, California, USA. You're charged whatever your long distance carrier feels like. If you go to the FBI website, you'll find that there's a link to file an Internet crime complaint. The link is here: http://www.ic3.gov/

Re:Got that yesterday...

[Anonymous Coward]

1-8xy are toll free numbers only if x==y, otherwise they're usually some area code.

http://www.cs.ucsd.edu/users/bsy/area.html

Re:Got that yesterday...

[Anonymous Coward]

So did you fall for it?

Re:Got that yesterday...

[Anonymous Coward]

There is nothing special about this 1-805-214 number; it's a CLEC in Newbury Park, CA so it could be a VoIP DID, a cell, or ported who knows where. But it's not a service number so neither toll-free nor is the operator making money off of it. Based on the choppiness, I'd bet it's a VoIP DID on a bad or saturated Internet connection (everyone who got the email is calling?!).

Re:Got that yesterday...

[Anonymous Coward]

Beeing in Germany, I get get to pay the international fees, which surprisingly are lower than those for national long distance calls.

I actually did send a mail to the FCC, since I was hoping that they would be able to get this 'service' shut down. I had completely forgotten about the ic3, but that's mostly because I'm under the impression that they will only take any action if someone has already been defrauded, probably with some additional minimum damage requirement around US$ 2000 (I seem to recall that that's the minimum before the FBI does anything).

Is there any institution similar to the US postal inspection service, but for telephone? Or something like the german "bundesnetzagentur" (federal network agency) that can shut down at least the equivalent of 1-900 numbers, and impose fines on operators of the same if they aid or abett fraudulent operation of those services?

Re:Got that yesterday...

[hlh_nospam]

I don't believe that 805 is a toll-free number. IIRC, inbound WATTS lines are 800, 888, 877, and 866.

From 411.com reverse lookup:

(805) 214-4801 is a land line based in Newbury Park, CA
The registered service provider is Pacific Bell**.
Detailed listing information is not available.

**Due to number portability, some numbers have been transferred to a new service provider

Re:Got that yesterday...

[Anonymous Coward]

I happen to know some "test" credit card numbers that validate properly in may cases and are easy to remember. In some places you can actually use them to pay for actual services, like WLAN access, document downloads etc, because the operators don't perform a full check. The most expensive thing I've ever bought with it was a full week of WLAN access on an exhibition I didn't attend for about EUR 420. If those things work, I usually alert the operator of the site.

Re:Got that yesterday...

[Anonymous Coward]

805 is a hell of a lot more than Bakersfield. It's most of the Central Coast.

Re:Got that yesterday...

[assassinator42]

"The number you have dialed has been disconnected, or is no longer in service." It's gone. Skype seems to be saying Pooh Bear after the call ends though.

Re:Got that yesterday...

[stonecypher]

Why the hell would you reply to say you don't know?

Re:Got that yesterday...

[Sven The Space Monke]

I got one this morning. 1-530-204-6800 - google tells me it's based in Sacramento, CA. Didn't call them, but I'm tempted to just to see what's on the other end. I'm wondering if these aren't just like those free voicemail services. I have a free voicemail number set up on an area code that points to, IIRC, Tacoma, WA. Takes faxes and voice calls, incomming only. I set up the outgoing message, and when someone calls, the message they leave is forwarded to an email address - for me, Gmail. Now, I've never been anywhere near Tacoma, WA, but with a voicemail and fax line there (2 separate numbers), I can (and often do) convince people that I have an office there (I like to bait scammers). Didn't cost me anything, and they didn't ask any personal information. Signup was real easy, took 5 minutes.

There's lots of similar services out there that will let you pick damn near any area code you want, but ask for some billing information should you go beyond the trial period. They don't actually try to bill you for anything unil you owe them money, which leaves you with a month to have as many people punch in their credit card numbers after the beep before the bogus credit card number you enter blows causes your account to be killed.

Re:Got that yesterday...

[pnewhook]

I got that one too this morning. It traces to 01 Communications in Davis California. when I contacted them they told me the 6000 block is owned by CommPartners California. - the number is a VolP number. Sent an email to them and the Davis police.

The only way to get rid of these scams is for everyone to report them to the phone company or service provider they are associated to.

Re:Got that yesterday...

[jrockway]

I don't think "test" credit card numbers exist. Do you have a reference?

Re:Got that yesterday...

[Sven The Space Monke]

I'm rather ignorant in such matters - how did you trace that number to 01 Comunnications? If these types of scams take off, it would probably come in handy to know how to do that. Was it just a 'call the phone company and ask' sort of thing?

Re:Got that yesterday...

[dotgain]

Did you Google? Obviously not.

Re:Got that yesterday...

[pnewhook]

I'm rather ignorant in such matters - how did you trace that number to 01 Comunnications? If these types of scams take off, it would probably come in handy to know how to do that. Was it just a 'call the phone company and ask' sort of thing?

I just used a free reverse phone lookup. Just type that phrase into Google and it'll come up with several services. I always check several sources to make sure they come up with the same info.

Once I got the main provider and their location, an email to their abuse department got a quick email back to say who owned the block.

Re:Got that yesterday...

[ozbird]

The link is here: http://www.ic3.gov/

Obviously the FBI don't watch "The Bill". IC3 is the abbreviation used by London police for a black person (e.g. "IC3 male").

Do they call the Terrorism Complaint Center www.ic6.gov?

Re:Got that yesterday...

[Anonymous Coward]

Actually, 805 covers all of the california central valley and central coast - Bakersfield, ventura, thousand oaks, simi valley, etc. (I live in Camarillo, CA, also an 805 area code).

Re:Got that yesterday...

[Anonymous Coward]

Thank you :)

I live in the central coast and am quite ashamed to share the same area code of the people who trash our beaches and treat the locals (myself included) like shit.

Re:Got that yesterday...

[Tatarize]

Sweet, so anybody try calling that and giving it random numbers?

Re:Got that yesterday...

[CaptainCarrot]

I got it yesterday myself. The area code was 503, which is Northern California (Chico, Redding, Truckee, etc.) I assume all these numbers are forwarded to a central location though. It's unlikely that many people had this idea simultaneously.

Re:Got that yesterday...

[CaptainCarrot]

Grr. Missed the Preview button. That's 530, not 503.

I can see it now

[Anonymous Coward]

I'm just waiting for phone calls telling me my p3ni$ is too small and I need to buy some v14gra...

Re:I can see it now

[Anonymous Coward]

On further reflection, I don't need a phone call to tell me that ;)

Re:I can see it now

[Anonymous Coward]

obviously your husband/wife doesn't have a phone.

Oh, just to clarify

[Andy Dodd]

The numbers these companies provide will cause calls to be sent via VoIP to a computer or analog telephone adapter anywhere in the world. In this case, the number could be in California but you might in the end be connecting to a machine running Asterisk in Russia.

not surprising

[v1]

There's a small degree of higher risk, but if you get a new disposable cell phone every three days and move around all day you'd be a hard mark to hit.

Too many people are now aware of the "don't click the link" aspect of phishing, but I'm sure there are still pleanty of suckers that assume if they have your phone number you must be legit. I would not be surprised if they find a way to do this through US Mail in a way that hides their identity.

It would be interesting if one day, to get such an online account set up, they make you pass a short test, where they give you ten examples of people asking for your account information in various ways, and you have to answer "give them the information" or "report the incident to phishing.ebay.com". Anyone that answers "give them the information" on any of the questions doesn't get an account.

I wager that alone would eliminate 80% of successful phishes.

Re:not surprising

[Anonymous Coward]

there are still pleanty of suckers that assume if they have your phone number you must be legit.

It doesn't really help that Paypal doesn't publish a phone number anywhere, so that nobody can tell if the number in the mail is legit. The only place to find numbers to call to actually reach humans at paypal are places like paypalsucks.com.

Re:not surprising

[alshithead]

It's not to hard to avoid this. Don't give them any information, hang up, got to the dern intarnet or your phone book and look up their customer service number and call that number back. If they say, "we don't know what you are talking about" then it is a scam. I recently spent 20 minutes on a phone call from a recruiter who was looking to fill a contract position for a major bank. That means they want background and credit checks. He wanted a SS number. I recognized his firm's name and I told him send me an email and I'd call him back. He sent me an email and I checked the headers and then I looked up the number for their local office. I called that number and asked for him by name. Once I got him I knew that everything was legit or a VERY complex scam.

Re:not surprising

[MrNonchalant]

"I wager that alone would eliminate 80% of successful phishes."

And, not so incidentally, 80% of PayPal's customers.

Re:not surprising

[theLOUDroom]

It would be interesting if one day, to get such an online account set up, they make you pass a short test, where they give you ten examples of people asking for your account information in various ways, and you have to answer "give them the information" or "report the incident to phishing.ebay.com". Anyone that answers "give them the information" on any of the questions doesn't get an account.

Why should ebay care? They don't bear the cost of phising, you do.

Re:not surprising

[stonecypher]

Er, yes, they do.

Paypalsucks.com is a front for a group which claims to be a paypal competitor. Guess what? They're a scam quite like the one being discussed in the article. The difference? They're selling something real but useless: a merchant account that literally nobody accepts. So, when you try to go get your seven hundred dollars back, the bank tells you "well, they haven't actually done anything illegal, so, no."

Caveat emptor.

Re:not surprising

[stonecypher]

Why should ebay care? They don't bear the cost of phising, you do.

Nonsense. I've had someone attempt to take advantage of me through PayPal, and PayPal ate the cost. Know why? Because I actually read their instructions and followed the steps I'm required to follow in order to protect myself. The only people who bear the cost of phishing are the people who refuse to follow PayPal's protection rules. That you can't tell why they're the only ones you hear from is honestly pretty naïve.

Re:not surprising

[Anonymous Coward]

Paypalsucks.com is a front for a group which claims to be a paypal competitor. Guess what? They're a scam....

Cite?

I mean, sure,there are some links and banner ads, etc for other payment sites, but so what? If one payment meathod (paypal) sucks, then it's only natural to offer alternatives.

As for your contention that "no one accepts" the other meathod, I'd have to disagree.

Re:not surprising

[theLOUDroom]

Nonsense. I've had someone attempt to take advantage of me through PayPal, and PayPal ate the cost.

Could you be a little more vague?

Know why? Because I actually read their instructions and followed the steps I'm required to follow in order to protect myself.

Which makes it sound like your incident was NOT phishing.

The only people who bear the cost of phishing are the people who refuse to follow PayPal's protection rules.

Characterizing victims of phising as people who deliberately refused to follow Paypal's rules is quite dishonest.

why no phishing stings?

[v1]

I haven't heard of any sting operations for hitting the phishers... Considering the anonymous and random nature of the phishing scams and ease with which you can attract a phishing email, you could send an email from a newly created email account back to the phisher without them realizing this wasn't one of the addresses they phished, and could arrange for a carefully monitored and traceable transaction to take place, to track down the phisher. ("follow the money" principle) Why don't we see more of this going on?

Re:why no phishing stings?

[CrazyJim1]

The first time someone tried to phish me on paypal via email, I notified the FBI and explained how easy it would be to sting them.

Re:why no phishing stings?

[Elminst]

And it's very likely they smiled through the phone, nodded, agreed with you, and then filed your report in the circular bin.

Re:why no phishing stings?

[NineNine]

The US government and all law enforcement is busy tracking down pissed off retards who sit in one of their mothers' basements and talk about blowing things up in order to prove that they're stopping "terrorism". Now, call these people "terrorists" and get some news media to cover it, and I can guarantee that Gonzalex will be all over it, calling it a victory against terrorism, and Bush will say, "See? We need to spend billions of dollars a day bombing a foreign country in order to keep you SAFE!"

Re:why no phishing stings?

[stonecypher]

I haven't heard of any sting operations for hitting the phishers...

Then you're apparently not listening. Why is it that stupid people think that just because they haven't heard about something means it isn't going on? You haven't heard about the new fashions in Milan. Does that mean fashion doesn't exist either? Or, Milan?

Re:why no phishing stings?

[stonecypher]

Based, of course, on your deep familiarity with FBI procedures, which is why you correctly pointed out that the FBI isn't even the right bureau for this. Announcing your own guesses as probable outcomes just makes you look dense. Learn from this.

Re:why no phishing stings?

[CptNerd]

One of the things I do sometimes when I get these "enter your credit card for verification" phishers, I deliberately go to their "paypal" site, then enter as much bogus info as I can: "First Name: Yougotta." Last Name: Beshittinme", and so on and so on. CC #s are all 0, of course. I figure if they went to the trouble to try to piss me off, I should go to as much trouble to amuse myself with their failures.

Paypal -- reachable by phone? Ha.

[Buran]

What I find funny about this is that it's spoofs supposedly sent by a company notoriously hard to contact by phone. Anyone who has ever tried to contact Paypal about anything would know this. (Of course, the average user doesn't, which is probably what they count on).

Re:Paypal -- reachable by phone? Ha.

[Rob_Warwick]

Maybe they're counting on you thinking it's legit after you can't check it against the phone number on the website.

Re:Paypal -- reachable by phone? Ha.

[Sancho]

I got one of these and did some Google searching on some of the phrases used in the e-mail. After I got no hits, I searched for the phone number. No hits. So I searched Google for "Paypal Phone Number". The first hit is to a faq explaining to go to the Help Center. Clicking there, you find a link which takes you to their phone number, which happened to be in a different area code than the number I was sent via the phishing e-mail.

So it actually isn't all that hard to get a phone number for Paypal. For the record, from their home page, click "Help" then "Contact Us" to get to the same page I mentioned above.

Re:Paypal -- reachable by phone? Ha.

[stonecypher]

What I find funny about this is that it's spoofs supposedly sent by a company notoriously hard to contact by phone. Anyone who has ever tried to contact Paypal about anything would know this. (Of course, the average user doesn't, which is probably what they count on).

It is trivially easy to contact PayPal by phone. I had a harder time reaching Sony than I did PayPal.

The first google hit for phone number site:paypal.com leads to a help page with a link. That link points to a second help page with the phone number and hours of operation printed clear as day. Typing phone number in PayPal's help system leads to the exact same page. When you contact them, the wait is usually less than three minutes. The phone operators open with a first name and a company ID code, and the system immediately forwards you to an automated quality survey after about one in three calls you make.

Every paypal page has a block of links at the bottom. In the dead center of that block, there is a link that says "contact us." If you click that, you are taken to this page, which has three headers: help by email, help by phone and merchant support. If you then hit "help by phone," you are taken to this page, where one of their half-dozen free support lines is printed clear as day.

If you're actually so dumb that you can't find this information on your own, here's a helping hand: 1 (402) 935-2050 . That line is open 18 hours a day (14 on the weekends.)

The only people who have trouble contacting PayPal are the dunces who hear it's hard and never try. Generally, they're the same dolts who announce to SlashDot how difficult something is that they've never tried, immediately after making some smarmy comment about how other people didn't try. If you really struggle too hard to use a simple help system, you need to get the hell off of your high horse talking about how lazy and ill informed other people are, and maybe just go to the mirror store.

Maybe in ten years you'll realize you were talking about yourself the whole time.

Re:Paypal -- reachable by phone? Ha.

[Buran]

If you are going to call me dumb for trusting the hundreds of complaints I've seen online that Paypal makes its contact information is hard to find, then you are a fucking asshole. It's so easy to slam other people, isn't it, when you're hiding behind that anonymous user name? You wouldn't call me stupid if you actually knew me, unless trusting other people is stupid now.

Things change, and apparently this is one of them, but the fact that people on the Internet can be assholes when completely uncalled for hasn't.

Fuck you, and have an awful day. It goes both ways, but to use an old saying, you started it.

Re:Paypal -- reachable by phone? Ha.

[stonecypher]

If you are going to call me dumb for trusting the hundreds of complaints I've seen online that Paypal makes its contact information is hard to find, then you are a fucking asshole.

No, I'm calling you dumb for announcing something you don't know as fact. There's a pretty big difference.

It's so easy to slam other people, isn't it

Yes. Like, one could call someone a fucking asshole for pointing out their stupidity. The difference between you doing it and my doing it is that I am pointing out you spreading disinformation, and you're throwing a tantrum for being caught telling falsehoods.

when you're hiding behind that anonymous user name?

What anonymous username? My name is John Haugeland. I live in San Diego. If you follow the link in my signature, you can easily get my address and home phone number from the resume on my website.

Then again, finding information doesn't seem to be your strong suit, and claiming it's not there when it is seems to be a pattern for you, so I suppose I shouldn't be surprised.

You wouldn't call me stupid if you actually knew me

Yes, I would.

unless trusting other people is stupid now.

Trusting people isn't stupid. Reporting things you don't know as fact, however, is. There's a difference.

Things change, and apparently this is one of them

No, it isn't. PayPal has been easy to contact since day one. It was their original selling point.

but the fact that people on the Internet can be assholes when completely uncalled for hasn't

Haven't read your own post yet, have you?

Fuck you, and have an awful day. It goes both ways, but to use an old saying, you started it.

Right, it's my fault you're posting lies to slashdot, and flipping out like a ten year old when you're caught being full of it.

Re:Paypal -- reachable by phone? Ha.

[hackstraw]

What I find funny about this is that it's spoofs supposedly sent by a company notoriously hard to contact by phone. Anyone who has ever tried to contact Paypal about anything would know this. (Of course, the average user doesn't, which is probably what they count on).

But my first thought was how easy this would be to implement because of it being common for credit card companies to ask for CC numbers, and in fact just today I called my gas company because I didn't get/can't find this month's bill, and they asked for my account number or my SSN.

Like typosquatters, I've thought of registering a dialasquatter number that is similar to a service and ask for all kinds of stuff :)

However, I'm too chicken and honest and just don't have the desire to scam people that much, but I still have those th... (author gets pulled from keyboard immediately for thought crime) ...

Re:Paypal -- reachable by phone? Ha.

[Anonymous Coward]

I think he's commenting that they don't have a big shiny toll free number right on their home page where even the lazy can't miss it.

Though, honestly, at one point (maybe 5 years ago or so), I was looking for said number, and it really wasn't listed on their site. I had to search for it at other locations and found several bulletin board posts complaining how difficult it was. I think at paypalsucks.com, they found it and put it up.

So, there, you're both right. Don't you feel better.

Re:Paypal -- reachable by phone? Ha.

[Reaperducer]

Face it, you got p0wned. That's what you get for repeating something you heard on the internet as a fact. Resorting to profanity only proves he was right about you.

Use someone else

[Colin Smith]

Paypal is just one of many. Do you really need the hassle if they're being targeted?

Perhaps losing customers might encourage companies to start signing official emails.

Re:Use someone else

[FireFury03]

Perhaps losing customers might encourage companies to start signing official emails.

AFAIK PayPal say they will never send you an email, so I'm not sure how signing the non-existant emails is going to help. Do you really think the average victim of a phishing scam is going to check the signature?

Re:Use someone else

[SanityInAnarchy]

Would it make a difference, really? I don't think Paypal sends any official emails anymore, and I don't think the average user knows how to check signatures. I agree, companies should sign official emails, but unless you've got a suggestion of someone who does, I don't see the harm in sticking with PayPal.

Re:Use someone else

[whmac33]

I think MS signs their security notification emails.

And PayPal sends me a notification for any funds received and such. So they do send emails still.

Re:Use someone else

[SanityInAnarchy]

Their legitimate emails are harmless. I'm sure you know this, but the easy way to tell a scam is, they'll never send you a scam message that says "receipt", and they'll never send you a real message that says "click here to verify..."

1-800 Number ?

[Joebert]

I got a weird email about two weeks ago.
I never did find out if Paypal has a 1-800 number & just ended up "reporting phishing" to be done with it.

"Latest" attack?

[Beryllium Sphere(tm)]

This goes back to decades before the Internet.

[ring, ring]Hello? Hello, is this $TRUSTINGSENIORCITIZEN? I have wonderful news! Congratulations, you have just won a diamond ring in our marketing lottery! There are some shipping and insurance fees, so if you'll just give me your credit card number...".

Law enforcement and consumer groups said over and over not to give out sensitive information unless you placed the call yourself, which is really the same advice as "don't click on the link" if you think about it.

Re:"Latest" attack?

[mbklein]

Law enforcement and consumer groups said over and over not to give out sensitive information unless you placed the call yourself

But you did place the call yourself. Just like the unsolicited email told you to.

Re:"Latest" attack?

[FireFury03]

Law enforcement and consumer groups said over and over not to give out sensitive information unless you placed the call yourself

Unfortunately many companies assume that people will ignore this advice anyway - I have been phoned before now by my cellphone provider who ask me to authenticate myself by giving them my passphrase and date of birth when I pick up the call. Of course I refuse since there's no way for me to authenticate them first - and that leaves them a bit stumped.

Re:"Latest" attack?

[beebware]

I've had my (now ex)-bank's anti-fraud system automatically call me. "This is an automated telephone call from Lloyds TSB for Mr xxxxxx. To confirm you are the card holder, please enter in your 16 digit card number." Needless to say, I hung up and called the number printed on the back of my card. I asked the person what it was about and then asked if they would have entered their number onto an automated system that randomly called them - nope(!)

Re:"Latest" attack?

[stonecypher]

Obviously, what he meant was in the context of a phone-start scam. What you should have heard was "... if you didn't initiate contact yourself."

Re:"Latest" attack?

[stonecypher]

Of course I refuse since there's no way for me to authenticate them first - and that leaves them a bit stumped.

Generally the easiest way to handle this is as follows:

"Yeah, I'd love to, but I don't give out personal data to incoming calls. If you'll give me your extension, I will happily call the 1-800 number on my card and ask to be transferred back to you, at which point I will know you really are an officer of the bank and give the information requested. Thanks for understanding."

Bank officers understand, and will happily do as you ask.

Re:"Latest" attack?

[Anonymous Coward]

[ring, ring]Hello? Hello, is this $TRUSTINGSENIORCITIZEN? I have wonderful news! Congratulations, you have just won a diamond ring in our marketing lottery! There are some shipping and insurance fees, so if you'll just give me your credit card number...".

Hmmm, that reminds me, I need to buy a diamond to put on the engagagement ring for my girlfriend. I'm off to WalMart.

I'm just waiting for the other shoe to drop ...

[tomhudson]

Hw long before eBay (who own paypal) strt a rumur that Google Checkout is behind this?

Re:I'm just waiting for the other shoe to drop ...

[Anonymous Coward]

Fuck dude, you should fix your keyboard: You're missing ALOT of keys there!

Re:I'm just waiting for the other shoe to drop ...

[tomhudson]

That's what I get for typing while eating and trying to convince the dogs that MY food is for moi!

Re:I'm just waiting for the other shoe to drop ...

[Anonymous Coward]

eBay doesn't have to start anything...you just did it for them.

The obvious answer...

[bsartist]

It's 42, of course.

I do not understand

[jawtheshark]

Why exactly would *any* financial institution want to verify credit card information. They have the fucking information: it's their bread and butter. No financial institution would lose any customer data because it's the most valuable item they have.

Anybody who falls for "please verify your information" has no clue how financial institutions work (Yeah, I know PayPal isn't a bank, but nevertheless... Your credit card number is the most valuable they have)

A compromise of the database would just mean that they lock your account. Next time you log in, you get an explanation and you have to re-enter your data.

That's pretty much fool-proof.

Re:WTF

[Anonymous Coward]

Homeland security is not about protecting citizens, it's about surveilling citizens.

The Beauty Behind It

[BumpyCarrot]

Whilst of course they face greater risk of legal action, there's no fake URL in the e-mail to rumble.

This has been around forever-

[TemplesA]

It just used to be called Sex Hotlines. [See Punch Drunk Love]

Re:WTF

[Anonymous Coward]

Actually it is about protecting citizens.

If some American citizens associate with those who wish to harm other American citizens, or wish to harm other American citizens themselves, or supply funds to those who wish to harm American citizens, or speak on behalf of or in defense of those who wish to harm American citizens, then it is entirely possible (and perfectly legal and correct) that they'd come under surveillance.

As much as you may hate to admit it there are such people living among us today.

In school, not when signing up...

[SanityInAnarchy]

I live in Iowa. In the state of Iowa, to get a driver's license, you must pass driver's education.

I would dearly love to have a high-school level course in computer usage, which would be required for anyone to connect to the Internet. Not going to happen, I know...

Maybe just make it a part of the general education requirements?

Most people think I'm a snobbish bastard, like every other Linux user. Which is true, to some extent. But I do believe we have a right to call people stupid when they do things like fall for a PayPal scam, buy from spam, send important (highly confidential!) information over email, refuse to apply patches (or not know how), and so on, and so on.

I mean, we have Sex education, we have Driver's education, I don't think it's unreasonable that we know the computer equivalent of wearing a condom, stopping at red lights, buckling your seatbelt... I don't like driving much, I avoid it, but when I have to drive, I consider it my responsibility to know enough to not be a danger to myself and others, and to not get tickets (which cost money and are a hassle, rough equivalent of getting scammed even if you're not held liable)...

This is the argument I use to explain to my mother why we are so snobbish. She gives the example of my uncle, a chemistry prof at MIT -- even his own wife doesn't need to know what he's doing. And I say, at least she knows what atoms are. At least she has a rough idea of what chemistry is, and what a chemical reaction is. Or take a car, at least you know to put gas in the thing, and you know it runs on an internal combustion engine. Take math, at least you know enough basic math to know whether you're getting ripped off; most people still remember a little algebra, even. These basic concepts do have equivalents in computer science.

I may not ever have the opportunity to use a wrench, or take a wrench to my car. But I know what a wrench is and what it does, and so do most people. Most people don't know what a compiler is, and are offended that they should have to know if they'll never use it.

Do you see the parallel?

This is not just about phishing, this is about life skills. It is as profoundly stupid to fall for a phishing attack as to fire a Roman Candle or a bottle rocket at your face. I'm no chemistry or pyrotechnics expert, but even I know it's a bad idea.

Oh, and the Chinese education system has us beat in so many ways it isn't funny -- they're learninng their second foreign language in 7th grade. All we have left is creativity. If they ever find a way to teach creativity, we're through. If we want to preserve our ideals and our way of life, it's imperitive that we improve our education system.

Re:In school, not when signing up...

[heinousjay]

No, the parallel isn't there. Basic internet literacy has as much to do with computer science as sugar has to do with the sweet science.

Re:In school, not when signing up...

[stonecypher]

But I do believe we have a right to call people stupid when they do things like fall for a PayPal scam, buy from spam, send important (highly confidential!) information over email, refuse to apply patches (or not know how), and so on, and so on.

Did you know that 85% of dead televisions just have a blown fuse? Did you know the $120 transmission fluid replacement at Jiffy Lube is a twelve dollar bottle of green grease, and the opening and closing of one valve? Did you know that almost everything a plumber ever actually does is run a drain snake and a plunger?

I mean, we have Sex education, we have Driver's education, I don't think it's unreasonable that we know the computer equivalent of wearing a condom, stopping at red lights, buckling your seatbelt...

Here's the difference: one costs people their lives, the other costs them an hour at the local computer shop. I don't think it's unreasonable that we know how to maintain appliances; nonetheless, nobody requires it, because that's batshit retarded.

Most people think I'm a snobbish bastard, like every other Linux user.

It's got nothing to do with your being a Linux user. It's because you're condescending and because you can't fathom that some people don't have the time or the desire to learn to maintain their computers. Believe it or not, some people have better things to do with their lives.

Next time you pull into a jiffy lube, call a repair person, go to a barber shop, buy art tools, purchase clothes or engage in any service activity whatsoever, please remember that that's something you could learn to do and then spend your life doing, just like a seventy year old woman could spend a year reading tech sites and manuals and getting up to speed on jargon.

Guess what? You don't want to either. You're just too dense to tell the difference.

Re:In school, not when signing up...

[pipingguy]

And the jargon changes every few years, so older/non-tech folk become even *more* confused.

I am one of the last of a dying breed; a draftsman that can take a clean sheet of paper and make it worth something using not much more than a pencil, straightedge and a piece of string.

Today, CAD operators need tens of thousands of dollars in hardware and software just to get started. Leonardo must be rolling in his grave.

Re:In school, not when signing up...

[whmac33]

Tranny fluid isn't green.

It's not worth $120 either, but it's not green.

At least not the tranny fluid I've ever used.

Note: IANA Jiffy Lube Attendant

Re:In school, not when signing up...

[Anonymous Coward]

stonecypher you are my hero! This is so well put. (I'm totally serious.)

Re:In school, not when signing up...

[Phaedrus420]

(Automatic) Tranny fluid is definitely red, and is not grease, and there's no valve. Automotive fluids are color coded; green is antifreeze (or tire Slime, FWIW). I just got back from perfoming a fluid and filter change, and can still smell the shit on my hands. The owner is _very_ happy with the results; Before = van goes for three moments, then doesn't. After = van goes and shifts better than when they bought it (used... er, pre-owned).

I have also replaced that fuse, and run that snake. "Just" a fuse is rare, except for in the case of a power surge (read 'lightning strike'); fuses blow for a reason, you've got to look for the cause (read 'short'), or you just go through fuses.

That hour at the computer/car/whatever shop is going to cost you as many as 12 hours at work (assuming an expensive shop and a low paying job), so it does make sense to spend some time getting caught up, because I'm sure you can think of a better way to spend/invest your money. That being said, I wouldn't call someone stupid because they got roped in by one of these scams (like Jiffy Lube), I'd just show them how so they can do/avoid it themselves, or in the case of the "I can'ts," let them know that I'll do it for half the price.

I can't believe I just read this: "I may not ever have the opportunity to use a wrench, or take a wrench to my car." Is this for real, or a 'for example'? Dude, I sort of agree with you on the basic computer skills class, except it should be required for graduation, not for internet access, but to me this puts you in the same group as the people that you express offense toward. (Please don't be offended, great-grandparent, I'm drinking.) If you have a car, buy a Haynes Repair Manual for it (16 to 25 dollars), and some tools as needed. Create the opportunity, and you might never go to a mechanic again. (I know that people who rent their homes often aren't allowed to work in their own driveways/parking lots, and that's the only reason I've ever been to the oil change place, but if I had to do it again, I'd have done it myself and told the super where he could stick it.)

That's all I've got for now, I hope it wasn't too bad, because like I said, I'm drinking.

Re:In school, not when signing up...

[Maestro4k]

It's because you're condescending and because you can't fathom that some people don't have the time or the desire to learn to maintain their computers.

If people don't take the time to learn to maintain their car the engine will eventually lock up on them. I can't change my own oil (well I probably could if I felt like reading up on it, I don't want to though) but I know how often it's supposed to be changed and take my car to someone to have it changed for me at the appropriate times. I didn't have to take the time to learn how to change my oil to know that it must be changed regularly to maintain my car. People don't have to learn programming or deep systems administration skills to know when an E-mail sounds funny (phishing), when it's obviously not an up-and-up merchant offering (spam), or that some prince in Nigeria died and now someone wants to give you a big chunk of their money illegally (401 scams). These are things that should be common sense. I think that's more what the grandparent was after, people should have to learn some basic, common sense skills in school both to protect them and others from them online.

Besides, people don't want to pay to get their computers worked on. They'll wait till it's so hosed it's not repairable without a clean wipe then expect you to only charge them $20 to recover their data and reinstall their OS. People simply don't want to do the bare minimum maintenance to keep their PC running properly, yet they wouldn't think of skipping out on having their oil changed for a year.

And really, most of the phishing E-mails are pretty blatantly not real. I get them all the time for banks I've never even heard of. When I, on rare occasion, see one show up for my actual bank it's still obvious it's not from them. Spam's even worse, to evade spam filters the content barely resembles English any longer. Would you buy from a store that mispelled every one of their signs? I know I wouldn't, I'd figure something fishy was going on. Likewise if some guy comes up to me on the street and tells me my mortgage that I never applied for has been approved I sure as hell wouldn't give him my financial information, yet people do it every day online.

I don't think it's snobbish of me, or anyone else, to feel that people who fall for blatantly obvious fraud don't deserve any sympathy and should learn some common sense. I also don't think it's condescending to expect people to have some common sense with what they do online. Just because you're not on a street corner doesn't mean you can check all your common sense at the door, yet this is exactly what most people seem to do.

Re:In school, not when signing up...

[SanityInAnarchy]

Here's the difference: one costs people their lives, the other costs them an hour at the local computer shop.

Or it also costs quite a lot of other people's resources dealing with the spam being sent by spyware on your computer. Crashing a car doesn't always cost lives, but it does cause damage. The difference is, when the accident is the fault of your vehicle, it's also your fault, because it's assumed that you know how to drive. When your computer is spewing spam all over the place, or being used to spread viruses/spyware or break into someone's server, it's not your fault, because it's ok to own a computer but not know how to "drive" it. We could at least require people to put forth a good effort, but most people don't even bother to slap on the off-the-shelf virus/spyware protection.

Let me ask you this: If your computer gets too slow because of spyware, you buy a new one. If your car gets totalled because you crashed into mine, should you be allowed to just walk away and buy a new one, without being liable for the damage you caused to my car? And a crash at 5 mph isn't going to kill anybody, but it will cause significant amounts of damage.

It's got nothing to do with your being a Linux user. It's because you're condescending

I think I have a right to be. But I'm trying to explain why people like me are condescending, and why we feel we have a right to be.

and because you can't fathom that some people don't have the time or the desire to learn to maintain their computers.

Ok, let's explore this one:

Next time you pull into a jiffy lube, call a repair person, go to a barber shop, buy art tools, purchase clothes or engage in any service activity whatsoever,

Here's the difference: I admit changing the oil is pretty easy, but something I don't feel like learning. But, I know to take a car to the jiffy lube every now and then. If I owned a car, I'd make sure I know how often.

I may not want to cut my own hair, but that doesn't mean I always wait till it's so long I can't see through it.

I may not build all my own stuff, but if I'm going to buy art tools, presumably I know how to do some sort of art. If I buy clothes, I don't put them on backwards. If I do put them on backwards and inside out, then I do deserve to be ridiculed for it.

Most people not only don't understand computers, but don't understand that they don't understand. They assume they know what they're doing, and attempt to do the equivalent of, say, replacing the muffler or adding a turbocharger to a car. These are the most annoying to deal with.

And most people don't understand that a typical computer does need some sort of maintenance. If you don't know how to use Windows Update, then yes, go to Jiffy Lube -- hire someone to do it for you.

If you don't know how to use a lawnmower, if you don't know how to run a dishwasher, if you don't know how to drive a car, you read the manual and learn how before you just go off mowing over the inflatable pool, or driving into a tree, or breaking all the dishes. If you don't know how to use a computer, you should not be using a computer.

I'm not saying learn absolutely everything about it, but learn something.

And that's just the practical stuff -- there's academic significance, too. Why do we learn things in science class like "how to make glue", and plenty of useless algebra in math, but no programming at all? But I'll concede that if you concede that people should at least take the practical, how-not-to-commit-digital-suicide class.

After all, if you don't want to learn about computers, why not pay someone else to use it for you? I know there are people who pay others to drive their cars for them...

You're just too dense to tell the difference.

Same to you.

Re:In school, not when signing up...

[SanityInAnarchy]

You're right, but here's why I think technical things should be taught:

People seem to realize that hackers exist -- they've seen them in the movies. They also seem to think that such hooligans are about as rare and as dangerous as getting mugged in the park. They seem to think it's OK to send confidential stuff via email, because they really never get convincing forgeries via snail mail, and because they figure it's probably about as uncommon to have email read as it is to have snail mail intercepted/read by the postman.

What they fail to understand about email is how easy it is to intercept plaintext email, how easy it is to set up PGP with a couple of trusted friends. Even then, you should understand how easy it is to set up insecure PGP (it's NOT ok to just email your public key), and how easy it can be to avoid being insecure (just read a fingerprint over the phone, or exchange USB thumb drives).

This is pretty much the same as arithmetic -- it's easy to forget to carry a one, but it's not as if doing it properly is hard.

That's why I think at least some things should be taught which are a bit technical, and a bit beyond people's interest, but still within the realm of good stuff you should know anyway.

Re:In school, not when signing up...

[ObitMan]

"That hour at the computer/car/whatever shop is going to cost you as many as 12 hours at work"

I remember those days. But I didn't think about it that way then.
I worked on my car and other's then to save money. I just knew calling someone else was "too expensive unless desperate" and I had time to fix it because I had no choice.

Now that hour in whatever shop for whatever service = only 1 to 2 hours of work and i've become lazy.
I call the plumber, handyman, or mechanic when I need something done because i don't have the time to do it.

Re:WTF

[Anonymous Coward]

I don't deny the fact that there are American citizens, who wish to harm other American (and non-American) citizens. I'm just saying that the system has turned into a giant surveillance machine, not unlike KGB was in Soviet Union.

Re:Passwords

[tomhudson]

One guy up here was convicted for "hacking" into the local police squad's voicemail system.

Everyone's password was (and I'm not making this up, and its NOT a Spaceballs reference) "1" "2" "3" "4" "5"

For months he listened into all sorts of messages for the detectives, including from informants, wives and girlfriends (nice to be able to blackmail a cop by threatening to tell his wife about his action on the side), etc.

You KNOW most systems have an easy password (or still have the default password).

Convicted, sentenced ... and caught doing it again - they hadn't changed the passwords a year later!!! Of course, once the story made the news, they HAD to change them (hint: if you remember the story and the police station, try "54321")

Woah, timely!

[Kid Zero]

Just got mine in the email this morning.

(530) 204-6800 is a land line based in Davis, CA
The registered service provider is 01 Communications**.
Detailed listing information is not available.

So what duped you?

[SmallFurryCreature]

Lets be honest here, you were scammed but why? What was it in the e-mail that immidialtly send you to the telephone ready to hand over your credit card number. Why did you not check the paypal site for any confirmation or even just to check the number in question.

Did you check the email headers, were they faked?

You now know that you been had and that it was stupid, you are, judging from your ID, a fairly recent slashdot user but the mere fact that you are here probably means you have heard about phishing scams before especially in concern to paypal and that in general handing over your credit card number is a bad idea.

So why? Was it a very good scam or are even warned people just plain stupid when on the line and in the general buzzle of a normal day you just didn't think it was going to happen to you?

I think the last case is the most frightening because it suggests there is nothing that can be done about this except to develop a 24/7 sense of paranoia. I remember growing up just having your wallet in your back pocket. Now it is standard routine to switch it to the front if I see an immigrant. Oh yes very racist but when you travelled for 2 years through a station (amsterdam lelylaan) wich was constantly pickpocketted by muslims to the extent that now the station has all but one entrance/exit sealed off (and damn any chance of an emergency or that people now have to cross a busy street to reach the trams/parking lot) you either learn to keep an eye on people with a dark skin or are one of the other losers who are confused why they have one less piece of luggage.

Oh well, going offtopic again.

Re:So what duped you?

[ScrewMaster]

He didn't say he was scammed, just that he called the number to see what was going on because he was curious. At least, that's how I read it.

Besides, paranoia is not required, 24/7 or otherwise. It's very simple ... if someone or something contacts you asking for private information ... DON'T GIVE IT. PERIOD! Legitimate organizations just simply don't DO things like this, so any contact you receive that claims to be from such an organization is almost certainly fraudulent. I've had banks and credit cards phone me once or twice about fraudulent transactions on my account, but never in an email and I've never had one of them ask for my account number and password. Ever. And, if they did, I'd cancel that account in a heartbeat. Face it, phishers depend upon people panicking and doing something stupid in the heat of the moment, where if they thought about what they were doing for ten seconds they'd realize, gee, I don't know where this is coming from ... best contact my bank directly and see if they know anything about it.

Re:So what duped you?

[drspliff]

That is not true, banks over here (UK) do phone you up and ask for personal information for security reasons because they cannot discuss your account due to data protection laws.

This is how a usual phone call goes:
Bank: Good afternoon, I'm calling from Abc123 Bank, please can you confirm your date of birth and address.
Me: Err, are you kidding. Which department are you in and what's your name and I'll call you back.
Bank: I'm sorry, I can't go any further unless you confirm your date of birth and address.
Me: Can I have a number to call you back on? .... bzzp ....

When I do actually give my dob & address out they go on as normal with whatever issue they have with my account.

The real problem happens when I phone them up about my account, want to increase/decrease my overdraft? want to change my address? want to order a credit card?

Me: Hey, I'd like to increase the overdraft on my account.
Bank: Ok, can we have your sort code, account number and for security your date of birth?

See the problem there? These are things that are widely accepted as security questions, and (in my experience atleast) it's fairly rare to have to go through a second line of security such as confirming previous addresses or account balance.

It's a catch 22 situation, banks wont talk about their account until you confirm your identity, they aren't allowed to answer security questions about my account to confirm their identity because of data protection.. and ANYBODY could phone me up at any time and pretend to be my bank given just a small amount of semi-public information, but it's me that's expected to give in and just tell them whatever they want.

And please don't say this doesn't happen in real life, I've seen it happen, I've nearly been a victim myself and another person I know had this happen to them.

Re:So what duped you?

[canavan]

Lets be honest here, you were scammed but why? What was it in the e-mail that immidialtly send you to the telephone ready to hand over your credit card number.

No, I wasn't scammed. Which part of my posting misled you into believing that I could possibly have entered my real credit card number?

You now know that you been had and that it was stupid, you are, judging from your ID, a fairly recent slashdot user but the mere fact that you are here probably means you have heard about phishing scams before especially in concern to paypal and that in general handing over your credit card number is a bad idea.

No, now I know that some people with slashdot IDs 40 times higher than mine may not yet have understood the decimal system, or confuse UIDs and CIDs. The scammers don't have my credit card number, but instead one of these. Have fun shopping online with any of these.

Re:So what duped you?

[stonecypher]

That is not true, banks over here (UK) do phone you up and ask for personal information for security reasons because they cannot discuss your account due to data protection laws.

That's an absurd system, and UK banking regulators should be ashamed. To require a bank to behave in the same fashion as identity thieves is a gigantic and wholly unnessecary risk.

Back here in civilization, we have these things called "passcodes." We also have a setup where the bank gives *you* a password which they'll replace on request. Bank calls you? Ask them the current account verification code, and if they respond correctly, first tell them to replace it, then start dealing with them.

Someone should let Britain know that it really isn't that hard to provide bidirectional identification.

Re:So what duped you?

[ScrewMaster]

Well, I live in the U.S. and I agree, anything can happen. What you're talking about is social engineering and it does happen on a regular basis. But the discussion was about remotely duping individuals into voluntarily relinquishing their personal info. What you say is true, people do scam banks directly, and there is very little you, as a bank customer, can do to protect yourself in that regard. On the other hand, there is a difference between some unknown entity initiating contact via phone or email and requesting personal information, versus you contacting a known entity (i.e., your bank or credit-card issuer) and providing such information in order to verify your identity. A major qualitative difference, actually. And that was my original point: if someone you don't know asks for such information, just don't give it to them. This isn't rocket science! Small children are taught not to trust total strangers! I shake my head in wonder that people don't intuitively see the similarity between a phishing expedition, and some person walking up to them on the street and asking could he have your social security number, oh, and by the way what's your bank account number and PIN. Amazing, really.

Re:So what duped you?

[Sven The Space Monke]

Happens in Canada, too. Just this past week I had my bank call me to discuss "important banking information" with me, and asked for my mailing address, postal code and date of birth. They've called me before, and asked for different information. I used to work for this bank, and I know why they do it - because the person they reach may know some information about someone, but not all. So they're supposed to mix it up a little. Make it hard to predict what info the bank will ask for.

When I told the guy I don't give my info to someone who just calls me and asks me for it, he said something like "but I'm with the bank, I can see that information in front of me already". I told him I had no idea if that was true, because he could be damn near anybody pretending to be with the bank. Then he told me that they'd just send out a letter with the information he wanted to give me, which is what I prefer anyway.

Turns out I had missed a credit card payment (I was in the hospital at the time and rather drugged up), and the problem had been sorted out by itself anyway, but I didn't know that the guy on the other end of the phone was who he pretended to be.

There's lots of companies that are trying to incorporate technology that they don't really understand and wind up getting things really, really wrong. Just after the bank, I worked for a group insurance provider. They had a strict "no personal information inquiries from customers over email" policy, which I liked. There's no way to verify who sent the email, or who will read it. Well, one day, corporate decides that any customer who wants their medical, dental and payment history can make the request over email provided the email address has the customer's name. Ooh, goody.

I showed my boss exactly how easy I can get an email address with her name, and then request her information using that same email address. She told me that if I showed that to anyone else, I'd be fired. That company has since been bought out and the policy changed, but it was still scary as hell.

I got one yesterday...

[fprintf]

I got one yesterday I must say it sounded really compelling. I checked the headers and my initial newbie glance was that none of the URLs were immediately noticeable as faked. Upon second glance I could see some warning messages about mismatching IP addresses.

Regardless of the technicalities, because it didn't have the usual telltale signs it really made me wonder. I then checked into my account the usual way, noticed nothing was wrong and then forwarded the email to spoof@paypal.com, receiving a reply this morning that it was indeed a phishing attempt.

The thing is, on this site we always talk about how clueless people are, and I have participated myself on occasion. But after talking with my wife and in-laws yesterday I realize how *easy* it is to dupe 95% of the computer using population using these tactics. These are people that are educated, smart and generally not clueless in life... but when it comes to computers they are. I had to explain to my sister-in-law why my brother-in-law was receiving Cialis/Viagra emails shortly after posting their clean (well, it was) email address on petfinder.com. My point is, it may seem like there is a low percentage of willing responders to a phone phishing attempt, but I can say from my observation that this new technique should be more successful than ever!

I just wonder isn't it really easy to trace phone numbers?

Re:I got one yesterday...

[petermgreen]

I just wonder isn't it really easy to trace phone numbers?
not if they use a voip account obtained either free (from a provider that gives free incoming) or using stolen credit card information and put thier base of operations outside the western world.

voip has made phone numbers as hard to trace as anything on the internet.

Why?!?

[kahrytan]

I just got couple questions.

Why is Phishing so successful?
What is so hard about actually contacting the company yourself?

Suggestion:
  Record IP addresses or domains of phishing sites and add them to HOSTS. Along with addresses used in trojans and worms. Also add them to Routers.

    Quick. Someone write a program that automatically updates HOSTS file and charge $19.95/year or $4.95/month for the peace of mind that you won't be caught up in phishing attempts or viruses.

Re:Why?!?

[Anonymous Cowled]

OK - so it doesn't update automatically, but this will do the job.... http://www.mvps.org/winhelp2002/hosts.htm

"Long Distance" Number?

[daitengu]

Wait, it asks you to call a long distance number? Any self-respecting company now days has an 800 number for you to call. Paypal HAS an 800 number printed on their webpage somewhere, I don't understand how people can actually fall for this. Anyone with half a brain would go "A long distance number? what kind of BS is this?"

Even in today's day-and-age of Free Long Distance service via VOIP and Wireless carriers, 800 numbers are still quite popular, even small businesses that do business over the internet have them.

Re:"Long Distance" Number?

[8ball629]

What about the people in that area code? It would seem more real to them as they think to themselves "Wow, they gave me a localized number for PayPal."

But I do see your point about the long distance number for other users. Personally, I would never contact anyone that asks me for account information - isn't that common sense these days?

Re:"Long Distance" Number?

[stonecypher]

Any self-respecting company now days has an 800 number for you to call. Paypal HAS an 800 number printed on their webpage somewhere

No, they don't. PayPal's customer service number is in area code 402. Please don't make statements without verifying them first.

Anyone with half a brain would go "A long distance number? what kind of BS is this?"

I guess that means you have half a brain, then.

Re:"Long Distance" Number?

[Anonymous Coward]

actually the copy i got asked me to call an 800 number. but my cell phone knows the numbers for paypal us and paypal uk so if i wanted to call, i'd just have my cell phone call paypal.

MOD PARENT UP

[ZakMcCracken]

I thought Slashdotters would know about VoIP!

Catch 22?

[wbean]

The other day I got an atuomated call from a credit card company asking me to call an 800 number to review account details. When I called I was in the voice-mail system that sounded like the company but without any explanation of what I was to do. When I finally managed to get to an operator she wouldn't discuss the matter with me without the last four digits of my social security number, and I wouldn't give her those. So there we were, she didn't know who I was and I didn't know who she was. I got through two levels of supervisor and still never found out what the call was about.

Re:Catch 22?

[solitas]

And? So? Make up four numbers and see how much further you can get toward figuring out what they want.

Re:Catch 22?

[IKnwThePiecesFt]

You're surprised? Would you rather the CC company give your information to anyone who calls without verifying who they are in some way? I personally have worked in a customer service call center, and it's pretty basic that they should ask for the last for digits of your social.

Re:Catch 22?

[wbean]

Absolutley. The if I call a number that I know belongs to the credit card company I expect to give them some data to identify myself. In this case I was calling a number that I didn't recognize to respond to a phone call that didn't explain itself. How do I know who I've actually reached. My complaint was that the message wasn't specific enough. They should explain why I got the phone call without my having to identify myself - either in the call or when I reach the number. Otherwise it's a standoff.

The R00t Of The Problem.....

[IHC Navistar]

Ok..... It is definitely wrong and illegal to do what these phishing sites are doing, but the victims of these schemes have only themselves to blame. ANYONE who calls a number, or discloses it AT ALL, and enters their bank/credit/debit/social security information is just plain stupid, and clearly guilty of LWCS.

LWCS, or Living Without Common Sense, is very similar to Driving Under the Influence (D.U.I.), lighting yourself on fire, or parking your car in some parts of the Bronx..... you just don't do it (thank you Lord Of War for that wonderful phrase!).

The reason these scams work is because of 1) Scammers like Phishers, and 2) People who are too stupid to NOT DISCLOSE a 9-digit Social Security Number and blame everybody else when their identity is stolen.

Instead of getting pissed because someone stole your identity, maybe you should be thankful that you got to learn what some of us were lucky enough to be born with.....COMMON SENSE. Common sense is simple, effective, and a virtually foolproof way to defeat social engineering.

-----

Anyone who uses the phrase "Think of the children!" ought to have the snot beaten out of them.

Spam is spam?

[Sippan]

Why? Do the spammers expect more people to fall for it now?

"YOU ARE A VIAGvRA STOCK WINNER FOR YOUR MIRACLE WEIGHT L0SS GIRL TO BE HAPPY"
"Ha, as if I would fall for that."
"Please call Vicky at this number to claim your prize. spendtrift oleaginous potvaliant"
"Oh, it's a PHONE NUMBER!! This changes everything, weight loss here I come!"
?

Re:Spam is spam?

[chris.evans]

This type of advertising doesnt work on me. If the advertiser cannot spell the product and produce meaningful sentences with out mumble jumbo at end then I dont give it any attention and delete it. Imagine if TV ads were like this, company would be out of business in a week, flat. So I ask, why is this email spamming thing still going on if it isnt looking professional?

just cutting costs...

[mike518]

they are just cutting costs-- i mean do you know how much it costs to set up and maintain a illegal webpage these days!? its highway robbery! Not to mention how it keeps getting shut down, its really a big hassle.

Sample

[Faux_Pseudo]

I got one of these. Here is a copy of it:
                                                                              PayPal
Account Verification
Dear $email_addres
You have received this email because we have strong reason to belive that your
PayPal account had been recently compromised. In order to prevent any fraudulent
activity from occurring we are required to open an investigation into this matter.

If your Credit/Debit Card on file is not updated within the next 48 hours, then will
assume this account is fraudulent and will be suspended. We apologise for this
inconvenience, but the purpose of this verification is to ensure that your PayPal
account has not fraudulently used and to combat fraud attempts.

To speed up the process, you are required to call us ($phone_number) to verify your
PayPal account.

We apologise in advance for any inconvenience this may cause you and we would like
to thank you for cooperation as we review this matter.

Regards,
PayPal Account Verification.
Copyright (c) 1999-2006 PayPal. All rights reserved.
--
Please do not reply to this e-mail. Mail sent to this address cannot be answered.

Re:Sample

[pipingguy]

Where's the Chuck Norris-style ass-kicking when we really need it?

My Simple Solution

[DarkNemesis618]

If it's paypal, ebay, or hell any company that you "supposedly" get an e-mail from with a phone number to call. Don't call it. Go to the company's OFFICIAL site (actually type in the URL, no links), get that phone number and call it if you're not sure. That way you know its valid. Most customer service reps will completely understand about phishing so you shouldn't get made fun of, criticized, or anything. The few times I checked, the service reps were very understanding simply said something along the lines of "thanks for alerting us, but there's nothing you need to do, your account is fine. Please go to our webpage and submit a phishing report." They were always very nice and polite. So don't hesitate to call and check, just don't use any links or phone numbers in the email.

And also, if you don't have an account with a bank, and that bank emails you requesting verification...yeahhhhhh...just delete it or report it and then delete it.

yet again...

[u235meltdown]

I have already been getting emails like this, with a phone number instead of link. These were for "colleges" that were trying to recruit me. Hahaha, funny.
As for the pay pal ones, so far I have received two, both marked as spam by Gmail. I have reported them as phishing. They were identical except for the phone numbers.

The full email received is posted here.

The "pay pal" phone numbers 1-805-214-4801 and 1-530-204-6800

It seems to me like the spoofer is a ChoiceOne subscriber, or a poor drone sending out emails because of a trojan.

If signing becomes common place

[Colin Smith]

Then we may get email clients which automatically check the signatures and say yup, this is a real valid email. It's entirely possible, perfectly automatable and I think quite a reasonable expectation of email software.

This is driving my crazy

[markass530]

The first time I encountered phishing is before it even had a name, and It was retarded obvious, and Not even a good attempt. After that, I was very hesitant with anything of that sort, then phishing became more widespread, got a name etc, so I made a simple rule for myself. Never ever respond to or click on anything, or call any number given to, that asks me for anything I wouldn't Tell any stranger I met on the street. Ever. I Have all the numbers and websites for all my financial information, and other companies I do business with. I will go to them directly If I ever have any question. This Seem to 100% eliminate any kind of phishing ever, so Why is this thing still an issue? Why is this not the general rule for every person??? and why is phishing still a problem??

Press 1 if you're a moron.

[StikyPad]

Obviously it's time to fight fire with fire. Companies such as eBayPal, Citigroup, et al need to start "phake phishing." When the recipient clicks on the link or calls the number, he or she will be presented with:

YOUR BANK ACCOUNT IS EMPTY.

At least, that could have been the result from clicking on this link. NEVER trust e-mails which claim to require account information, logins, or passwords. Delete them, and/or forward them to abuse@ourwebsite.com. If in doubt, call the number on your most recent bill, or find our number in the phonebook to discuss the issue with one of our representatives.

Voice pishing?

[andrewman327]

When did they stop calling this Social Engineering?

Re:Traceability?

[tomhudson]

BTW - you still haven't named ONE good piece of Microsoft software.

And anyone who thinks coldfusion is hot shit really needs to buy a clue.

Re:Traceability?

[tomhudson]

From your profile:

ActionScript, Ajax, ColdFusion, CSS, Flash, HTML, JavaScript, Linux, MySQL, OpenOffice.org, OS X, Perl, PHP, RoR, Ruby, Ubuntu, XHTML, XML

• What are you trying for "Buzzword 2.0" compliance?

  And I notice not a SINGLE PIECE of Microsoft software. Gee, guess you're being hypocritical saying that people shouldn't be to blame if they don't switch from Windows, while you have.

  So, hypocrite, name me ONE good piece of Microsoft Software. Just ONE. One that the competition doesn't do better, or one that you can't get a "good-enough" free replacement for.

  Just ... one ...

In conclusion

[jdbartlett]

If true, that speeding tickets can produce profit for a system already funded by taxes does not prove that speeding tickets can even meet the expenses of a system without tax funding.

"Unless you've been living in a cave, you'd know..." Ah yes, the old "everyone knows" argument. "Everyone knows" the world is flat. "Everyone knows" the earth is in the center of the universe. Or, to quote a famous literary figure: "It is a truth universally acknowledged..."

I did not intend to suggest that there are not staff members assigned only to handling traffic issues, but rather that the law enforcement involved in regulating traffic issues extends beyond any specific percentage of police resources. Heck, if you count manufacturers of the computer systems and software makers, printers, etc. - it extends beyond police resources altogether! Thus, you cannot prove only a percentage of the force to be singularly responsible for speeding fines because the responsibilities involved overlap. My apologies for the misunderstanding - clearly this lame duck thinks too quickly for you!

That ActiveX has not been removed does not prove that Microsoft intentionally (as in, "with intent", as in "with the intent that malware take advantage of ActiveX") left Microsoft Windows open for malware.

In one of the trolling attacks you most recently posted to our happy litle thread, you seemed to suggest that my knowing how to write ColdFusion scripts (CF is listed in my profile) could somehow imply I believe CF to be "hot": don't confuse capability with endorsement. Most of us are physically capable of murder, yet few people endorse murder. Not that I'm comparing CF to murder.

In another fluff statment, you challenged me to name a good Microsoft product. Excepting security issues, the general quality of Microsoft's software is not relevant to our debate. It is true that I have not named one good piece of Microsoft software throughout the course of our debate. However, it is also true that I have not named the Brazillian soccer team members in the 2006 world cup. Neither of these would enhance our debate as both are irrelevant (that people can switch from Microsoft tools to TP tools does not excuse unfairly persecuting them for not doing so). Perhaps I will name a good Microsoft product if you can provide me with a good reason to name a good Microsoft product. At this stage in the debate, I probably will not.

In another attack, you suggested that I am a hypocrite for not using Microsoft products. As you admitted in the attack text, my reasoning has been that people should not be unfairly persecuted for using Microsoft products. Please, do not confuse arguing against unfair practices (such as fining victims and introducing legislation that would stifle OSS projects) as arguing that people should not use non-Microsoft products, or that people should be persecuted for using non-Microsoft products!

I am now unwilling to extend this debate any further. These are my reasons for halting this debate:

1. You have no faith in your "solution". Your unwillingness even to attempt contacting authority figures who could apply your "solution" reveals that not even you have faith in your wacky schemes. Your revealed lack of faith in said authority figures suggests you didn't expect these schemes to work or even be introduced in the first place.
2. Personal attacks. Your arguments are becoming more and more personal in tone. You have attacked my profile, claiming it is ridden with "buzzwords", launched an unfounded accusation of hypocrisy, accused me of cave-dwelling, begun to use masked and unmasked profanity, and implied lack of intelligence on my part for failing to swallow your unfounded claims.
3. Uncontrolled feelings. Your use of masked and unmasked profanity combined with a more and more frustrated tone suggests this discussion is causing you unnecessary tension. It will be better for both of us if t

Re:In conclusion

[tomhudson]

You have defended the use of Microsoft software as a proper practice for people who have security concerns, all the time using Mac OSX yourself.

Hypocritical?. Yes.

Trolling? Probably.

Uninformed and simplistic? Considering that you can't even understand a plain english explanation of how traffic fines subsidize other police operations in MANY jurisdictions, and that without those fines they'd have to lay off cops in non-traffic areas, its either wilful ignorance or more trolling.

As for all the hand-waving about politicians, I'm quite happy to let the malware do its darwinian weeding out of those who are dumb enough to use Windows. I've said as much. The idea of fining people would be to their benefit, to encourage them to switch quicker, rather than endure more frustration. It would also highlight the problem that much quicker, and give the slackers at Microsoft more motivation to dump the Windows core for something better. That you think I should contact politicians shows your naiveté in believing that politicians really have an informed opinion in the first place when it comes to IT. They don't.

In fact, the darwinian approach is what's happening ... malware and viruses are driving more and more people into the non-Windows world. For many people, XP will be their last Windows version, and they'll buy their next box as a plain vanilly beige no-OS box. Within a year or two you'll be able to assemble a complete laptop from off-the-shelf components as cheaply as you can order one pre-assembled. At that point, Windows will begin to lose significant "guaranteed" market share from the lack of tie-in between desktops and laptops.