Slashdot Mirror
Web Fraud 2.0 — Point-and-Click Cracking Tools
An anonymous reader writes "The Washington Post's Security Fix blog is running a fascinating series that peers inside some of the Web-based services cyber crooks are using to ply their trade: from masking their identity, to defeating CAPTCHAs, to creating counterfeit documents and validating stolen credit and debit cards. Everyone familiar with this space hears about these kinds of tools and services all the time in the abstract, but the Post blog includes screen shots and background details on the popularity of the services and how each one is helping to bring cyber crime that much closer to the realm of even the most newbie scam artists." Many of these tools require a working knowledge of Russian. Wouldn't surprise me to learn that Chinese-language tools exist too.
Many of these tools require a working knowledge of Russian. Wouldn't surprise me to learn that Chinese-language tools exist too.
Damn. And here I was looking for fraud tools in Klingon. No wonder I can't ever find anything.
Way to throw around those stereotypes! I bet they all run on Windows, too! Windows - the first choice for crooks and scammers!
EagerEyes.org: Visualization and Visual Communication
Finally, a use for all the Russian courses I took in high school and college.
Faster! Faster! Faster would be better!
Why not demonize some other nations while you're at it? Maybe throw in a jab at Africa?
is this text from a russian language course commercial?
It won't help with intangible goods and isn't practical with gift items, but stores that ship tangible goods can require that the shipping address be the same as the billing address and verify the billing address against information held by the credit card company.
Even verifying only the postal code will make it hard for me to order a computer using your credit card if I'm not prepared to visit your locale to take delivery.
Another technique is to allow exceptions but only if a person picks up the item at the post office or carrier's depot in person, presents ID, and smiles for the camera.
There will need to be a solution for gifts and intangible items.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
Is today global stereotype day and did I miss the memo ?
Hitting on the Russians seems to be in real fashion these days, you'd almost think there was a political motive behind it. Is France out of fashion or so ?
Really, the reason these tools exist is because there are several requirements before you can deploy these tools, which are:
- access to international banking
- a large base of hackers, preferably unemployed
(I use 'hacker' in its original form)
- organized crime
The USA, China, Germany and Russia all have these in abundance so that's where you will find your toolkits.
MP3 Search Engine
All this really means is that script kiddies can now do identity theft as easily as they can perform DDoS attacks...
If you want made-in-USA tools for this, try searching Google for "craigslist auto posting tool". Google offers seven paid ads for spamming tools and crackers. ("The worlds Best Selling Craigslist software. Works with new CAPTCHA!") Three of them (including one that advertises "Only Automated Solution for the new captcha. Nobody else is automated.") are available through Google Checkout.
This has been going on for months, despite press coverage. I'm beginning to wonder if Google is deliberately promoting tools to kill Craigslist.
Wouldn't surprise me to learn that Chinese-language tools exist too.
Uh, not such a fan of Chinese people, I take it?
What method do the 'cyber crooks' utilize in gathering the stolen credit cards in the first place ?
"I managed to acquire an account on this exclusive service, and found some 78,628 individual MasterCard and Visa credit and debit accounts for sale at various prices there"
davecb5620@gmail.com
English pointy clicky tools like this certainly do exist and certainly pre-date any Russian or Chinese tools; when was SATAN first developed? Remember SATAN? Security Analysis Tool for Analyzing Networks was I think the name.... I don't remember the year but it was long before the current wave of Russian script kiddie gangsters....
here.
Best Slashdot Co
We could sign up for the anti-captcha.com service, and constantly send them faked CAPTCHA that are impossible to solve. (make maybe 100 of them and rotate) Thus waste their resources without getting charged for it. According to their feature page, they can only take on 1,000,000 CAPTCHA a day. I am sure the the order can easily be filled.
I'd imagine that Klingons would dish out some pretty massive punishment when scammers get caught, so you're unlikely to see many Klingons using these tools.
Perhaps you'd be better to search in Ferenghi?
I don't understand how slashdot can constantly get away with these types of racist quips about the Chinese. Why do you as Americans feel so threatened by them? Why do slashdot staff let through these constant stories that are designed to do nothing more then instill distrust and hatred for the Chinese? Clearly that last comment was put in place simply to taint the Chinese with the same brush, it serves no other purpose. It's time you people realised you're being manipulated.
heheh... I don't recall the backstory behind this, but SATAN actually distributed for a while with a utility called "SANTA" that would change the name of the tool (and all references in the docs and so forth) from "Security Analysis Tool for Analyzing Networks" to something like "Security Analysis Network Tool for Administration" in order to get rid of the potentially disturbing acronym.
Some numbers:
$1 for 1000 CAPTCHAs = $0.001/CAPTCHA
Assuming the people running this scam keep 50% of the profits (they probably keep more) that means $0.0005/CAPTCHA for their lackeys.
If you managed 5 seconds to solve each CAPTCHA (they say in the article they are usually returned in a minimum of 20 seconds), and they were always streaming to you:
(3600/5) * $0.0005 = $0.36 / hour
Average wages in the poorest parts of China: $0.41/hour.
This might be an attractive alternative, but the profit margin (for an essentially illegal operation) would need to be decidedly low to attract people from any other jobs even in the poorest areas. Consider also that the sorts of areas that have workers who will work for food (tm) are the sorts of places that *DON'T* have internet access at all.
If only there was a way to make CAPTCHAs take a minimum amount of time to solve, like say 10 seconds... This system would be beat.
just like hammers can be used for doing construction projects or they can be used to bash peoples heads in, the same can be said with these controversial tools.
As long as packets can traverse from one point to another, it will be impossible to prevent automation tools from being used to automate various interfaces to access public online systems. If web sites think they can get rid of people by putting various challenges in their way, i.e. captcha, they are wrong. Given enough resources, people will get around this.
Not everyone is a terrorist or criminal gang, some people are just trying to access systems that otherwise would be impossible to accomplish by hand. I've been writing and using automation tools for dozens of application for decades now, so I always think its funny when some online site tries to prevent me from accessing their network -- they will 100% of the time be on the losing end of this battle.
Sites like Craigslist (especially), MySpace, Facebook, GMail that go to great lengths to hire large groups of staff who sit there and write software tools that prevent people from using their site, all they do at the end of the of the day is push people away who are legitimately trying to use their site, and eventually they lose market share because people will find something less cumbersome to use. One of Backpage.com, Kijiji.com and other sites selling points is that they don't have 100 different filters in place to prevent you from posting your ad.
It's a real waste of time when you have to use a site like craigslist and spend your whole daying to post 10 ads and only one of them shows up on the site -- for 20 minutes until it gets auto-flagged off their anti-spam aka "anti-use" tools...
It's kind of pathetic really -- the majority of the work that Craig Newmark has done over the last five years has been to prevent people from using his site... I've seen large groups of people who used to post ads regularly promoting their business on that site who have been driven away because the ads just don't stay up anymore because of Craig's overuse of anti-use tools.
Mm, Chinese are bad, m'kay
Get rid of the "monetary" system. As long as we have money people will always conjure up creative ways to steal it. Our global society needs to move forward to the "star trek" world where money doesn't exist. I know, I'm asking for the impossible.
"I bow to no man" - Riddick
I've long wanted an easy-to-use penetration testing tool, something that allows you to scan for vulnerabilities in your network without having to fully understand all the ins and outs of everything that may be possible on your network. I'm talking about something more than, say, GRC.com's "Shields Up" - I want to check on WiFi weak spots, overlooked port forwarding mistakes, unpatched Apache setups, misconfigured FTP or other services, no-password Samba shares, buffer overrun vulnerabilities, whatever.
Right now I feel like I'm virtually stuck behind my NAT - I know I'm safe from pretty much everything (except stuff like browser vulnerabilities), but I'm limited to wired networking and no access from the outside world. I'd like to set up stuff like VNC tunneled via SSH, or WiFi for my wife's iPhone that bypasses the internal lan but gives outside access, but I know just enough about how these things work to worry about misconfiguring something and opening up my server to drive-by hackers...
It doesn't have to be 100% perfect or comprehensive, just something that can scan for low-hanging fruit and do it easily, as close to pushbutton as possible. It could even be a service rather than an application - I'd pay a monthly fee for periodic checks.
Don't forget about lolcat support. Sure, script kiddies and others will be able to break the law, but what about our feline friends?
Comment removed based on user account deletion
Comment removed based on user account deletion