Password Hackers Do Big Business With Ex-Lovers

Hugh Pickens writes "The Washington Post reports that disgruntled lovers and spouses considering divorce are flocking to services like YourHackerz.com that boast they have little trouble hacking into Web-based e-mail systems like AOL, Yahoo, Gmail, Facebook and Hotmail. The services advertise openly, and there doesn't appear to be much anyone can do about it because while federal law prohibits hacking into e-mail, without further illegal activity, it's only a misdemeanor, says Orin Kerr, a law professor at George Washington University. 'The feds usually don't have the resources to investigate and prosecute misdemeanors,' says Kerr. 'And part of the reason is that normally it's hard to know when an account has been compromised, because e-mail snooping doesn't leave a trace.' It's not clear where YourHackerz.com is located, but experts suspect that most password hacking businesses are based overseas."

Comments

Moo, moo.

[girlintraining]

Yeah, well I'd say it's a big reason why I get phone calls. I hung my shingle out a long time ago about being a computer geek. People usually come to me for one of three reasons: First, their computer's suddenly running slow. "But I've tried everything." Malware is the main reason. Second is "It won't turn on anymore." Coffee spill on laptop, or HDD failure without error message. And the third most common reason: "I want to ruin someone's life! You're a hacker, right?"

Of course, these are my friends, not strangers. I usually oblige them by asking if they knew what common passwords their ex used, any websites they frequented, the full spelling of their name, date of birth, and social security number. And the strange part is: They usually know all of these things. You know what I do then? Nothing. Not a damn thing. I sit down and have a long talk with them about personal security and how just like we don't go out alone at night (I'm a girl. Most of my friends are girls -- I know most of you are dudes and don't think about it much), we also need to take precautions online! This is usually said while saying what a bastard the guy was. And I give them a pat on the head, some candy I keep around for this purpose, and send them on their way.

I'm a white hat (eh, most of the time). But a lot of people just like me know this about others because they've hung their shingle out too and announced they're a geek. And not all of them are going to have an ethical hangup about sucking up all your personal data, hacking your accounts, and leaving "I have a small penis" written to all your friends. Because really... The average person if you do go through all the effort to get them access just sits there feeling all powerful for a minute and then does something incredibly juvenile that'll make you wish you'd done your laundry instead of wasted two hours at the keyboard.

My advice to you people: Love your partner. But do not give them the root password!

P.S. Only once ever have I done a spot of sleuthing that I felt was worth it -- when I discovered a friend-of-a-friend was dating a terrorist. No, I don't mean the fluffy-bunny kind that the media portrays either (everything is terrorism these days). No, I mean the guy came overseas, setup shop over here, and was doing serious criminal enterprise and had cases open with a half-dozen agencies. A few days later, a police officer informed her that if she valued her life, she should cease contact with him immediately. Fun times. Everything else though? Boring as shit.

Re:Moo, moo.

[girlintraining]

But maybe these different patterns relate to the fact that I am male?

More likely it's that girls have a lot more aqaintances and casual contacts than men do... And that we gossip so that people who know of us extends beyond a few close friends and coworkers but into the friend-of-a-cousin-of-a-friend's boyfriend scope. That, and most guys just want to be done with the drama and suffer in silence when it ends. Girls don't usually skip the part of the process that entails great amounts of fire and brimstone. Of course, in the end it's all a tempest in a teapot, but that doesn't stop them from beating a path to my door and getting Lecture #46.

Double Standards...

[fiendishfish]

Quite a ingenius scam really. The following link - http://www.complaintsboard.com/complaints/yourhackerzcom-c141692.html [complaintsboard.com] - suggests that they take your 'hard earned money' and then blackmail you. Saying that they will tell the person you are trying to 'hack' if you don't send them $1000. It made me lol.

How do they work?

[Anonymous Coward]

If you're curious how these things work, here's a write-up of a typical example of one of these services.

Re:RTFS

[xaxa]

Several UK banks use the EMV card (branded as "Chip+PIN" here (wiki it), a debit/credit card with a chip) for authentication with online banking. The readers don't connect to a computer, and getting the PIN wrong three times in the portable reader only means you need to reset the card by using it in an ATM.

The trouble is, it's been done cheaply, and has some *big* problems. Ignoring problems with encryption, the biggest one is a social problem: I have a small card reader. I can put one of my debit/credit cards in, press "Identify", type in my PIN, and get the message "PIN OK" and a code. Fine, I can put the code in the online banking website to authenticate.

The problem is, if I get the PIN wrong, the message says "PIN incorrect", and no code is produced. Argh! Introducing the chips has drastically cut face-to-face (shop, ATM) fraud in the UK, and means criminals now want a PIN to go with a card. They sometimes install a tiny camera in an ATM and steal the card when you walk away, but ATMs are in "safe" places, and have CCTV around them etc -- or at least, people don't use them if they don't feel safe.

So instead, they steal your card somewhere more private:
*thump* *thump* "Tell me the PIN!"
"5-2-9-1! Let me go!"
*"Identify"* *tap-tap-tap-tap* *schking* "Tell me the real PIN, or else!"