USPS text scammers duped his wife, so he hacked their operation

https://blog.smithsecurity.biz/hacking-the-scammers

by wglb • 2 years ago

460 293 2 years ago

blog.smithsecurity.biz

localghost3000• 2 years ago

https://archive.ph/jm2h1

dredmorbius3• 2 years ago

Above was to the originally-submitted Wired article link. Mods have since changed the URL.

ianhawes2• 2 years ago

Congress desperately needs to carve out an exemption in the CFAA for situations like this.

bluGill8• 2 years ago

I don't want an exception - there is too much potential for someone innocent to be framed and attacked. I want the FBI and CIA to be given more funding to track this down. Sometimes the CIA will need to attack scammers like this because there is no diplomatic option, but not random people outside of them. (The FBI being limited to the US should take everything to court)

asynchronous• 2 years ago

I think this would be a great opportunity to contract private firms and companies to do exactly this. It’s not law enforcement work, so it fits perfectly.

rightbyte• 2 years ago

Sometimes the CIA will need to attack scammers like this because there is no diplomatic option

Oh please no. Don't give them ideas.

chocolatkey• 2 years ago

Here are the original posts themselves, probably more interesting to people here:

https://blog.smithsecurity.biz/hacking-the-scammers

https://blog.smithsecurity.biz/systematic-destruction-hackin...

arresin• 2 years ago

Appreciated thanks

ramathornn• 2 years ago

Loved that, thanks for sharing! Very cool to see the step by step process.

Ozzie_osman2• 2 years ago

Hilarious. Exposing an LFI to view things like /etc/passwd and server logs, and a SQL injection in a PHP stack... I prob wrote code like this, when I was a 15 year-old self-described "webmaster" in 2002.

Ozzie_osman2• 2 years ago

Actually, I'm not that far off.

The creator is a current computer science student in China who is using the skills he's learning to make a pretty penny on the side.

KwisatzHaderack• 2 years ago

You can never trust a scammer ever and even these scammers are getting scammed it seems

There’s no honor amongst thieves.

dang2• 2 years ago

Ok, we've changed the link at the top from https://www.wired.com/story/usps-scam-text-smishing-triad/ to the first one of those two original posts. Thanks!

Readers may want to read all of them of course.

dredmorbius3• 2 years ago

And for those wishing for an archive/paywall link to Wired: <https://archive.ph/jm2h1>.

spelunker• 2 years ago

Very informative! I tried doing something similar to these sites months ago after getting multiple text messages from them, but didn't really get anywhere. Very cool to see a professional walk through what they did!

Scoundreller• 2 years ago

Michael Martel, a national public information officer at USPIS, says the information provided by Smith is being used as part of an ongoing USPIS investigation and that the agency cannot comment on specific details.

Oh, they 100% can. There's a US Constitution thing allowing them to comment on things. They just chose not to comment because they don't want to.

gamblor956• 2 years ago

It's not a constitutional issue. They're not commenting about an active investigation because they're still investigating and public comments can interfere with the investigation.

delfinom2• 2 years ago

Not sure why they are bothering. The US can't touch some scammers operating out of China.

bluGill8• 2 years ago

If it is China the US probably can touch them - China is afraid of a trade war and so once presented evidence of who is at fault China will stop it. (so long as evidence doesn't exist China might know and perhaps even encourage it, but once evidence exists they will stop this). It is probably but not a sure thing.

If they are in Russia or North Korea there is nothing the US can do (other than CIA or military operations) and so the scammers will get away with it.

janalsncm• 2 years ago

The Smishing Triad network sends up to 100,000 scam texts per day globally

This should not be possible. I guess the iMessage scams used e2ee, but the SMS scams should have been caught. It would be great if there was law enforcement that competently handled cybercrime, or at least triaged it.

More broadly, and at the risk of creating another TLA, the US needs a Blue Team version of the NSA. In other words, identify critical infrastructure, figure out how it can be hacked, and require that companies fix the issues. Use national security if need be. Banks have to undergo stress tests to prove they are solvent, there is no reason that critical infrastructure should be able to leave their doors unlocked.

mcmcmc• 2 years ago

Congrats, you’ve proposed the already existing Cybersecurity & Infrastructure Security Agency

shiroiushi• 2 years ago

Did he? He said:

It would be great if there was law enforcement that competently handled cybercrime, or at least triaged it. [emphasis mine]

I'm not sure CISA fits that definition.

barryrandall• 2 years ago

If CISA is producing a deterrent effect, only LIGO can measure it.

fullspectrumdev• 2 years ago

Spam filtering for SMS is still not particularly broadly implemented by network operators apparently.

I remember during Covid there was a few startups in that space trying to work with MVNO’s to get a foothold in the market, but don’t think any of that went anywhere.

newsclues3• 2 years ago

Network operators make money from scam industry there are not incentivized to deal with the problem beyond offering additional paid services

creeble• 2 years ago

I get 5-10 SMS messages a day filtered by Verizon’s anti-spam (still get notices for each though).

These days they are mostly political pleas, which are, ironically, in some semi-protected gray area. Haven’t noticed any USPS-related ones lately, but a few have gotten through in the last few months.

2OEH8eoCRo0• 2 years ago

It would be great if there was law enforcement that competently handled cybercrime, or at least triaged it.

They do. There's just a lot of it.

WillAdams• 2 years ago

Maybe something like:

https://www.npr.org/2024/05/31/1197959218/fbi-phone-company-...

Joker_vD4• 2 years ago

Can you be prosecuted for hacking cybercriminals back? Because I am pretty certain that you, if you had something stolen from you, are not actually allowed to break and enter the thief's house, take your stuff back and leave, and you're definitely not allowed to make a copy of keys for their locks while you're at it.

langsoul-com• 2 years ago

It's pretty grey, there's the computer abuse act or w/e. But it's quite selectively enforced.

I don't the US gov is gonna go after him for hacking a scam group AND he provided details to the authorities. Now, if he hacked them and used the stolen credit card details? Who knows.

Joker_vD4• 2 years ago

hacking a scam group AND he provided details to the authorities

So cyber-vigilantism is technically illegal but the authorities will tacitly pretend it is not, when it suits them fine, probably.

smegger001• 2 years ago

some times its even endorsed like when the government just let Microsoft take control of the No-IP's domains a few years back because. despite the fact Microsoft didn't have any standing and just decided they were internet sheriff. I was a customer of No-ip at the time had Microsoft just black-holed the routing of everyone myself included because some users were using their dynamic dns service for malicious purposes

qball• 2 years ago

Who are they going to call, the cops?

(This is also why criminals tend to seek illegal firearms; self-defense from other criminals is a more salient issue than it is for the average citizen for this reason.)

0xEF• 2 years ago

I hate that it kicks off with "DISCLAIMER: This is not my work. I would never and don't condone illegal hacking of scammers"

You know what? I do. We all should. These scammers are awful people and deserve to be attacked. I am tired of toothless authorities like CISA and the alphabet agencies in the US doing next to nothing about it unless some YouTube scam baiter does the work for them. Scammers destroy people, not just financially, but emotionally as well, even driving some victims to suicide. As far as I am concerned, any wannabe hacker out there should be using these scammers for target practice.

peepee1982• 2 years ago

Disclaimers exist for legal reasons, not for moral ones or a personal opinion.

I think we all agree that hacking scammers is a net positive for society.

prepend3• 2 years ago

I don’t think disclaimers really work. I think it’s just urban legend that they do.

I find it hard to believe if some scammer is hacked and the evidence shows the hacker learned everything from solely this video then this disclaimer won’t mean anything legally.

I think disclaimers are just a bit of noise that people put in out of an abundance of caution.

ipaddr• 2 years ago

Until we find out later that the scammers masked themselves using someone elses identity and they hacked an innocent person.

We have all received email from a legitimate place where a scammer uses your email to spam and then legitimate company thinks your email sent it.

randomdata5• 2 years ago

Disclaimers exist for legal reasons, not for moral ones or a personal opinion.

In other words, a scam towards the reader?

chii• 2 years ago

vigilantism can spiral out of control. While it makes sense in this scenario, it's because the scammer is obviously breaking some law and is criminal. What happens if it wasn't so obvious?

newsclues3• 2 years ago

I’m fine with a war on scammers getting out of control to the point where bombs are being dropped on scammers call centres.

They are the modern Hostis humani generis

themaninthedark2• 2 years ago

If society doesn't want vigilantes than it must take an active role in pursuing and punishing criminals.

vouaobrasil• 2 years ago

Then society would quickly condemn the vigilantes. Vigilantism works precisely in those cases where the criminals being persecuted is obvious. It seems to me that there is an optimal amount of vigilantism and it's greater than zero in those rare cases where there is a person skilled enough to carry out the retribution.

nonrandomstring2• 2 years ago

If we're going to invoke "vigilantism" (as opposed to notions of reasonable and proportionate self-defence) let's acknowledge how U.S. American culture at least in the 80s and 90s is drenched in a deep love of vigilante justice... The A-Team, Knight Rider, The Equaliser, even Batman! Who doesn't dream of a secret base inside a mountain, filled with surveillance gear, an anti-crime computer and a personal Apache attack helicopter waiting on the pad to rain fire down on miscreants?

Let's say that's more than just individual morality but a concrete cultural relation to wealth, power, justice and social contract of the state.

edm0nd• 2 years ago

I mean scammers are the perfect targets to hack because they cant go to the police lol

I have no issues with hackers hacking scammers and fucking their shit up.

loopdoend• 2 years ago

Ah yes the classic SWIM defence.

gadders3• 2 years ago

For people that ransomware hospitals, I want Navy Seals (or equivalent) falling out of the sky and renditioning back to the appropriate country to stand trial.

Waterluvian3• 2 years ago

There’s a demonstrated inhumanity in attacking hospitals and children that really should earn special attention.

sheepscreek• 2 years ago

Why is the author afraid of getting sued by scammers? I think there should be some legal protections for people like them. Better yet - a licensing program to allow them to do this without legal repercussions as long as it’s done within the guardrails of the framework.

BiteCode_dev• 2 years ago

Because, believe it or not, the system is better at inflicting pain at someone honest than someone crooked.

coldpie2• 2 years ago

Why is the author afraid of getting sued by scammers?

Being civilly sued by scammers isn't the fear, it's being prosecuted by the state for committing CFAA (or similar) crimes.

delfinom2• 2 years ago

As far as I can tell, these scammers were in China.

Nothing illegal until they sign an extradition treaty with the US.

Which they won't, lmao.

lesuorac2• 2 years ago

Isn't it?

Like if I fly from China to US and offer you a bridge in exchange for $20 and take the $20 and don't give you a bridge, it's a scam.

What's the difference between that and doing it online? The offer is still posed on US soil; if anything it should expose you to the legality of both countries.

seanhunter• 2 years ago

An extradition treaty doesn't define what is and isn't legal, it defines under what circumstances a country who is party to the treaty will surrender someone who is currently sheltering in their territory to face prosecution in another country.[1]

So for example some GRU agents came to the UK and attempted to murder a couple of Russian expats using a nerve agent called Novichok[2]. As well as the original targets, three further people were poisoned and had to be hospitalised, one of whom died.

Unsurprisingly perhaps Russia won't extradite their millitary intelligence officers back to the UK to face justice. This doesn't change the fact that murder and attempted murder are definitely illegal in the UK.

[1] https://www.cfr.org/backgrounder/what-extradition

[2] https://en.wikipedia.org/wiki/Poisoning_of_Sergei_and_Yulia_...

bluGill8• 2 years ago

I don't because some scammers will find ways to frame their enemies. If you attack the person/organizations doing the scam fine - but don't attack an innocent organization. Most of vigilantes are not careful to tell the difference.

codetrotter2• 2 years ago

Exactly! People are not trained in gathering and interpreting evidence. And when they are “investigating” something that is personally affecting them there is probably even greater chance of them jumping to conclusions and acting rashly. Emotions will cloud judgement. And judgement was lacking in the first place because they are not trained in how to investigate matters and they are not familiar with tactics that criminals use to make it appear like they are someone else.

Several years ago when I still had a Facebook account there was a guy that DMed me yelling at me and accusing me of trying to “hack him”. His evidence? The reverse DNS record for a server was pointing to a domain I owned. I replied and told him the reverse record was out of date. I had previously rented a VPS with that IP address and I had had the reverse record point to my domain. I had since cancelled the rental of that VPS and now the hosting company had assigned the IP to someone else. Apparently the hosting company had not bothered to remove the reverse DNS record from their systems so it was still pointing to my domain. The guy that was yelling at me was of course too stupid to understand this when I explained it to him so I gave up on trying to educate him and blocked him from being able to send me any more DMs.

Now imagine if this guy had started a full-on retaliation campaign based on his misguided “evidence”. Luckily for me I never heard or seen from him again.

But yeah, that kind of thing is exactly why “vigilante justice” is such an incredibly dangerous and stupid idea.

gosub1005• 2 years ago

back around 2007, the scam: "send you a check for a mistakenly huge amount and ask you to refund the difference" was in full swing. In their email they said they'd overnight a check, and I thought "good, overnight shipping is very expensive, at least if I scam them I'm costing them $20 in fees", but no. Brought the envelope to a friend at UPS, he gave it to their fraud department, and behold the letter was sent using a stolen corporate shipping account. Maybe I helped by getting that account shut down, but I also ended up costing them money.

jsbisviewtiful2• 2 years ago

These scammers are awful people and deserve to be attacked.

Some of them are being held prisoner and are being forced to run these scams under threat of torture. There was a Search Engine episode about this in the last year.

ChrisMarshallNY5• 2 years ago

John Oliver did a great segment on it.

I won't link to it, because he seems to piss some of the folks, hereabouts, off.

fsckboy2• 2 years ago

"19th century cotton growers were awful people"

"but the people growing the cotton were enslaved"

"the enslavers, generally known as cotton growers, were awful people"

Wistar• 2 years ago

Related: on NPR yesterday, “How criminal syndicates traffic, torture and enslave people to send scam text messages”

“https://www.npr.org/2024/08/08/nx-s1-5058798/how-criminal-sy...

Audio and transcript.

bob_theslob646• 2 years ago

What are you trying to state? It sounds like you want empathy, but what about the victims? This is a dangerous argument.

EricE• 2 years ago

They have to or they may get in trouble due to our stupid laws. From the article: "Initially, Smith says, he was wary about going public with his research, as this kind of “hacking back” falls into a “gray area”: It may be breaking the Computer Fraud and Abuse Act, a sweeping US computer-crimes law, but he’s doing it against foreign-based criminals."

blacklion2• 2 years ago

Same could be said for self-defense, though it is effectively banned in most "civilized" countries.

lupire4• 2 years ago

I don't no which countries you're referring to, but the US is not one of them.

vkou• 2 years ago

Self-defense isn't banned anywhere, the kind of 'self-defense' murder that some people in the US occasionally get away with is, though.

(For example, if your idea of self-defense starts with 'I'll be following someone around in my truck...', most other countries would let you hang.)

5040• 2 years ago

An outlaw, in its original and legal meaning, is a person declared as outside the protection of the law. In pre-modern societies, all legal protection was withdrawn from the criminal, so anyone was legally empowered to persecute or kill them.

dang2• 2 years ago

We detached this subthread from https://news.ycombinator.com/item?id=41198724.

hot_gril2• 2 years ago

It "doesn't condone it" but shows the exact recipe for doing it, and even distributes a dump of their PHP files. Just a CYA statement.

kelnos7• 2 years ago

The solution here is to fix the law enforcement apparatus, not condone vigilantism. Yes, I know that's a hard thing to fix.

But think about "IRL crime". Would we condone someone pulling out their gun and going after someone who they believed had stolen from them? I hope not.

The problems are the usual ones with vigilantism: ensuring a proportionate response to the alleged crime is impossible (vigilantism usually has a large emotional component, so good luck restraining someone there), and ensuring the vigilante is actually going after the right person, and hasn't screwed up their investigation, causing them to target someone innocent.

Certainly holding law enforcement accountable is difficult and sometimes impossible. But at least there's a process to fix that, and people are constantly working on this problem. There's no process to fix cases where randos botch an amateur investigation and mess up the life of someone innocent.

happymellon• 2 years ago

What's quite interesting about this is the iMessage integration, as this is a good example that directly contradicts Apple supporters claims on this very site.

johnisgood2• 2 years ago

What are their claims? But yeah, there is a lot of fanboyism going around, be it Apple or Rust.

kubectl_h• 2 years ago

Can you enumerate the claims you are claiming are directly contradicted?

wizardforhire• 2 years ago

Heres my off the cuff take on law enforcement not going after scammers to the fullest extant that I think we can all agree they should…

The US has roughly 340 million people now.

The US gdp is roughly 28 trillion dollars.

Which means that on average the dollar value per citizen is roughly 82 thousand dollars…

Divided by days in year, hours and minutes its roughly 15 cents per minute.

So if we assume 100% of the population is getting at least one scam a day of some sort and that the disruption to thought to get back on track as result of the anger induced is about 30 minutes…

That puts the loss to the US at little over 1.5 trillion dollars in lost productivity.

The US currently spends roughly 840 billion on defense…

So almost twice the yearly national defense budget is potentially lost to scams.

Seems crazy, as I said off the cuff. I would love to see some way more accurate numbers.

But arguing in dollar amounts I think will go a long way to putting the problem in perspective. And who knows, maybe we’ll get to some drone strikes on scammers in our lifetime.

mylastattempt• 2 years ago

It's illogical to calculate the thing you are looking for, but lets run with it just for the sake of it.

Let's go with your "one scam a day". The person then has to see it, choose to read it and then act on it (delete/ignore/get scammed). Not even considering the practical effects of receiving 4 before lunch, and none getting past spam filters the rest of the week.

Then you come up with 30 minutes for each individual scam? If it evens goes trough the above mentioned phases, nobody is non-profitable for a full 30 minutes, for every scam attempt, every single day of the year.

Using your 15 cents per minute, we could stick with just a minute of lost value. That translates into 340 000 000 * $0.15 * 365 days = 18 billion.

Still a totaly useless number because it's impossible to measure, but at least much further from 'ridiculous' than 10% of the GDP you came up with.

dgfitz2• 2 years ago

You just didn’t like the comparison to the defense budget, let’s call a spade a spade here.

Fokamul6• 2 years ago

Noticed the salt used for encrypting password, in the writeup?

"wangduoyu666!.+-"

Whoops, this looks like username -> wangduoyu666 (same for "wangduoyu8", "wdy666666". Seems like they're incrementing numbers in username too, but probably false positives, maybe popular username)

Google it. Probably skid's github, linkedin, etc. (not verified)

And looks like OP missed this. Also name on telegram is fake of course, Wang Duo Yu is singer in China, so skid is using singer's name as username and also as a full name in Telegram.

Ps.: From their backup telegram, also "wangduoyu12"

Ps2: From OP write up -> https://t.me/wangduoyu0 -> there is youtube channel https://www.youtube.com/@duoyuwang4820 which links in description to this telegram channel wangduoyu0

And it's full of videos of someone making tutorials to bypass china firewall? etc. Multiple 30min-1hour videos, there must be treasure trove of info. Videos is leaking these gmail accounts: https://i.imgur.com/LUiKbF6.png

yorwba• 2 years ago

How do you know these are all the same person, instead of different people with the same name, or independently using the name of a singer they like?

Fokamul6• 2 years ago

Yes it is possible. But github wangduoyu666 is full of wannabe hacker repos. I will edit the post.

Fokamul6• 2 years ago

Ps3: Leak from ytb videos, list of Wifi networks https://youtu.be/FnKbBmdQuIk?si=NPzl7tExHOhc3Gad&t=2929

https://i.imgur.com/zJsbJZ5.png

Heh, in the newest video he basically shows how to setup the BT5 panel and fake website from the writeup :)

https://www.youtube.com/watch?v=2fdmVsqeQ1Q

All info I've gathered from videos:

Knjfatemaa@gmail.com (Cloudflare account)

Username in Mac: wenziguo

Telegram @DockerWang

gentleman.yu2013@gmail.com

yuzhiwen2017@gmail.com

wangtian1888@gmail.com

tangzhongwei1993@gmail.com

beegoservice2012@gmail.com

css• 2 years ago

"666" is a slang term: https://en.wikipedia.org/wiki/Chinese_Internet_slang

Fokamul6• 2 years ago

Cool, is there any good OSINT info/tools for Chinese "world"?

Am4TIfIsER0ppos• 2 years ago

666 is also a common number over here. Perhaps he's into heavy metal.

0xml• 2 years ago

Wang Duoyu (王多鱼) is a character in the Chinese comedy film Hello Mr. Billionaire.

https://www.imdb.com/title/tt8529186/

forinti• 2 years ago

When I have the time, I like to script an attack on phishing sites by posting false data. The idea is to fill their databases with trash, and make it more difficult for the criminals to weed out real data entered by victims.

thedanbob• 2 years ago

I almost did this the other day when I got a fake Docusign phishing email. Unfortunately, I found that the webpage it led to was sending collected credentials to an apparently innocent but hacked third-party wordpress site, which I assume forwarded the info elsewhere. I didn't want to waste the third party's bandwidth so I used their contact form to explain the situation. Didn't expect a response, but I just checked and they fixed it!

prmoustache3• 2 years ago

we need a new phone/text messaging infrastructure that prevent number spoofing AND force operators to filter out scams attempts.

bell-cot• 2 years ago

True. But neither "our" government, nor the corporations maximizing their profits in the current dystopia, give more than a lip-service sh*t about doing that.

coldpie2• 2 years ago

At least for people in the US, the solution is simple: make internationally-sourced communications opt-in. By default any calls or texts originating from a non-US carrier will be dropped. Then, any spam coming in must be from a US entity, and can be investigated & prosecuted. People who do need to receive internationally-sourced communications can turn it on with their carrier. While they'll still be at risk of receiving spam, the value of sending that spam in the first place will go way down because the vast majority of it will just get dropped. It's an easy solution, and it solves call/text spam for everybody.

bluGill8• 2 years ago

I'm reasonably sure that countries like France will sign a treaty to not allow spoofed numbers in this way. They don't want to be a source of scams anyway and so will do their part to prevent them. The details of this matter of course, but France should be an easy automatically opt-in. (I picked France because I can spell it, there are several dozen others that I'm confident can be in the automatic opt-in list as nothing from them is a scam)

hobs• 2 years ago

I have never once got a spam call from an international number, just local numbers. So your plan doesn't work when some local proxy is happy to take the traffic.

athenot• 2 years ago

We have a lot of progress under the form of STIR/SHAKEN. Now it doesn't prevent all types of spoofing but it makes the calls traceable back to the originating carrier.

What happens is scammers get numbers with small carriers who interconnect with major ones. Eventually the reputable carriers notice spam from these smaller carriers and start dropping their calls (or banning them altogether). So the smaller carriers decide whether they want to see their legitimate traffic dropped or just ban the offending users (which is eventually what ends up happening). Scammers end up hopping to a different carrier so it's a cat-and-mouse game, but it's a lot more expensive to play now than it was with simple number spoofing.

In parallel, numbers are starting to get reputations attached to them, similar to IP addresses. Some filtering takes advantage of that.

Of course, spearfishing can continue unimpeded with someone buying a prepaid cell phone and using that to call a specific target. :(

https://transnexus.com/whitepapers/understanding-stir-shaken...

kelnos7• 2 years ago

STIR/SHAKEN is only for calls, though, not SMS/MMS. Messaging is a giant hole, there...

hypeatei• 2 years ago

Yeah, I'm not sure why but a lot of comments here tend to go down the "governments must stop this with law enforcement" route when there is probably much better ways to do this technically without forming international task forces.

UncleEntity2• 2 years ago

Sure, but the Telcos seem perfectly fine with taking the monies from the scammers until they are forced to do something.

I mean, it's validly been 25 years since I received my first scam text and I still sporadically get them once in a while.

gosub1005• 2 years ago

and a third option: telco carriers are liable for allowing this to go on.

gs172• 2 years ago

AND force operators to filter out scams attempts.

How do you expect that to be implemented without requiring them to read everyone's texts (requiring either no encryption or a backdoor) and judge their worthiness?

prmoustache3• 2 years ago

If you have a mecanism that allow users to report scammers you could automatically ban callers/senders that are reported by a sufficiently large number of persons very quickly.

kelnos7• 2 years ago

Aren't they already doing this, for SMS/MMS, at least?

batch12• 2 years ago

One wife is enough I guess

speed_spread• 2 years ago

That's the title of the next James Bond movie

merek• 2 years ago

I recently came across NanoBaiter on YouTube. He baits scammers and hacks their systems, often disrupting their entire operation.

He identifies the culprits in detail, scares the hell out of them, reports them to police, and tries to inform / refund the victims. In at least one video, he accesses the scammer's Stripe account and refunds the victims (often elderly) for their payments on bogus IT security products. I recall another video where gains access to the CCTV in the scammer's office building, and captures a police raid on the scammers.

https://www.youtube.com/@NanoBaiter

ChrisMarshallNY5• 2 years ago

I've learned to leave hackers and scammers alone; no matter how much they piss me off.

Most of them are quite capable of delivering a nasty counterattack. Some, IRL.

Had a friend hack a spammer that hijacked his server, and they blasted his server into LEO.

spydum• 2 years ago

definitely this..you are messing with a group of folks, and potentially stopping their flow of money. unless you have great opsec, you may just cause problems for yourself you dont want. personally never heard of it escalating beyond online attacks, but it's not worth the drama imho

Fokamul6• 2 years ago

Yes, since the guy who made the writeup, has exactly 0% opsec. -> ridiculous. But I would be more scared of 3letters.

ChrisMarshallNY5• 2 years ago

never heard of it escalating beyond online attacks

Krebs gets SWATted.

insane_dreamer2• 2 years ago

And the bigger the operation, the more $ is at stake for them and the more resources they have to allocate to stopping you and/or revenge.

VikingCoder2• 2 years ago

Remember *69? You'd get the phone number of the person who just called you? (Theoretically - it didn't always work.)

How in the hell do we not have a trivial "report a scam" option on phone calls and text messages? Which reports it to the FTC or FBI or something?

shkkmo• 2 years ago

The easier reporting becomes, the more the average quality of reports decreases.

So making reporting easier is good only if you already have atleast sufficient resources to process and follow up on the current report volume. My understanding is that we don't currently have enough resources dedicated to handling the reports we do get of people who got scammed. If that is the case, then making it easier to report potential scams doesn't help until we increase the resources for tracking down and stopping scammers.

VikingCoder2• 2 years ago

You really think the quality of bug reports go down the easier it is to report bugs?

I find when I can send feedback in a way that captures enough context that the resulting bugs are very high quality.

If I could report a call from a scammer in such a way that the investigator heard the entire conversation...? I think that would be incredibly damning.

LinuxBender4• 2 years ago

The numbers are spoofed via private SS7 links connected to messaging platforms, VoIP systems, etc... SS7 was designed to be an entirely closed trusted telco controlled network so there is no security.

The only solution I can think of would be to get rid of all the SS7 to mapi gateways and force all cell phones to use internet based secure routing over RCS or preferably something better and also ensure that phones are not allowed to do spell check over the wireless carrier VPN. That would be a world wide project and requires cooperation from every nation. Either that or make specific countries walled gardens blocking all SS7 messaging and just accepting some things will break. I fully support breaking things that are already fundamentally broken. I would personally prefer direct phone to phone true E2EE taking the carriers, Apple and Google out of the picture even if there is some friction. It should be a physical phone-to-phone sync of sorts so you smack each others cell phones together, high five, do the hokey pokey and now you are E2EE with no layer 7 servers in the middle instead talking to a L4 VPN router that only knows how to connect one VPN to another over UDP. Everything else performed entirely by the phones using a different encryption cipher, hash, key, etc... Maybe using QUIC. For people that can't tap phones together maybe a fallback option for QR codes over video chat so you know you are syncing with someone you know, AI fakes excluded.

paul7986• 2 years ago

Amazing over 400K people entered their credit card information.. mind boggling to me yet like all to most of us here we just about ignore every phone call and text message not from someone already in our contacts.

I always thought there should be a driver license and test to use the Internet to cut down on people being ignorant. As well or a class you must pass in high school that teaches ignore all phone calls, text, emails and etc from people you have not met offline. If you do meet them online make them snap or facetime you fairly quickly to verify veracity.

UncleEntity2• 2 years ago

My Great-Aunt got scammed out of something like $30k back in the late 80s and all she had was a landline...

jeffwask• 2 years ago

I wonder if these are the ones I constantly get saying I have a package at USPS and they need info but the texts all originate from an international number, so they are obviously fake to me.

idunnoman1222• 2 years ago

How come vigilanteeism is accepted for computer related crimes but not other ones?

cvoss• 2 years ago

The creator is a current computer science student in China who is using the skills he's learning to make a pretty penny on the side.

There's a strong argument right here for teaching technology ethics as part of a typical CS curriculum. I'm not saying that would have stopped this student from making his own unethical choices, but it does highlight the fact that we equip people with these really powerful technical skills, but we don't even try to equip them with the ethics to be responsible about it. We just sort of hope they were raised right, I guess.

Anyone here have experience with a curriculum that includes the ethics aspect?

signalToNose• 2 years ago

Not ethics per se but all students at university in Norway take basic philosophy

https://en.wikipedia.org/wiki/Examen_philosophicum

bix6• 2 years ago

The Markkula Center at SCU is fantastic.

https://www.scu.edu/ethics/about-the-center/center-news/inte...

mlavrent• 2 years ago

The Brown CS curriculum has in the past few years started including “socially responsible computing” material across intro and non-intro level courses.

See https://responsible.cs.brown.edu/

dgfitz2• 2 years ago

Why does it have to be social? Why not just “responsible computing” instead?

eadler• 2 years ago

All ABET accredited programs are required to include ethics and have been required to do so for over 15 years.

We explicitly learned about voht IEEE and ACM code of ethics for example (though this was not the only thing we discussed) . We were even tested on the difference. I'm always confused when people don't even get the baseline ethics training.

ewoodrich• 2 years ago

Yeah we all had to take it at Portland State because CS was ABET. Was kinda surprised to learn it wasn’t a standard CS requirement everywhere.

There was also an ethics module in one of the massive pre-weed out 100 level courses.

0xdeadbeefbabe2• 2 years ago

This person has lots of fellow students who aren't doing this. Maybe his CS classes aren't challenging enough.

ryandrake3• 2 years ago

Let's not blame CS classes for the unethical actions of one pupil. My CS classes weren't exactly challenging either, but I never wrote or sold a scamming toolkit.

PhasmaFelis• 2 years ago

Gotta be careful, though. If you teach them too much ethics then they won't want to work for most corporations.

Fokamul6• 2 years ago

Clearly you don't understand Chinese mindset, do you think he has no ethics? He has a lot of ethics, because he wouldn't dare to hack Chinese citizens, we know why :) but everyone else (except Russians, of course) are open-season for them.

insane_dreamer2• 2 years ago

He has a lot of ethics, because he wouldn't dare to hack Chinese citizens

That has to do with fear, not ethics; the consequences of getting caught doing this to Chinese (vs foreigners) are significantly high (you do not f*k around with a system that has no due process)

djmips• 2 years ago

I feel like you don't understand the word ethics the same way I do.

y-c-o-m-b• 2 years ago

In high school (over 2 decades ago), I figured out how to crack the school security software (and obtain its master password, thank you Windows swap file!) and after doing so, I installed a keylogger on the school library computers. I got access to dozens of email accounts, instant messaging accounts, etc. I'm self-taught all the way. In fact I dropped out of high school junior year with a 1.76 GPA. I knew what was right and wrong, but not yet mature enough to fully grasp the harm it does. I don't think any sort of ethics teachings would've changed anything.

pavel_lishin2• 2 years ago

Similar story here, though at a smaller scale, and with a better educational experience. I remember distinctly talking to my mom about the ethics of hacking, and my viewpoint at the time was - in the parlance of kids today - cringe.

BlueGh0st• 2 years ago

My lesson came while ARP poisoning, when I saw that a teacher was using their social security number as their password.

Suddenly I realized even dumping passwords was an invasion of privacy, even if I didn't use them. And that passwords should never contain sensitive information!

jeroenhd• 2 years ago

The ethics classes I took delved into what good and wrong are, different ways to look at things, and a whole lot of debate about the concept of ethics itself (i.e. reading old works of philosophers, including some of the weird racist ones, understanding their take on the world, and reflecting on the shifted ethical perspectives, but also lively discussions within the classroom). Everyone already knew "stealing from the elderly is bad", so things were more focused on "what are the ethical reasons to restrict free speech" and "applying different ethical points of view onto a subject".

In the end, ethics courses only teach you to be conscious about your actions and learning how to convince others that you're ethical. An ethical person can easily pass an ethics exam. All of that knowledge, and being raised by good parents, do not completely prevent someone from becoming a criminal.

If you can set up a reasonably successful scamming business on your own as a student, you can earn enough money to move to the countryside and never need to work another day in your life, as long as you can manage to hide the money from the authorities. Or you can spend it all on drugs and other short-lives pleasures, like so many criminals do.

Cybercrime targeting vulnerable people is laughably easy and extremely lucrative. Hearing about how hard some people's lives are because of their student loans, I'm a little surprised this stuff doesn't happen more, really, especially with the growing resentment the younger generations seem to feel for the bad hand they've been dealt by the older generations.

jdnndjxjen• 2 years ago

I see no argument for an ethics part in a CS curriculum. It's already quite watered down.

TrackerFF• 2 years ago

I will say this:

Some cultures have a very strong "if you can scam someone and get away with it, you'd be a fool not to" mentality, often combined with the mindset that you should do everything in your power to improve your life, and that you're living in a constant state of scarcity - so if any opportunity pops up, you'd better take it.

And if it's some random faceless person on the other side of the world, even better.

hot_gril2• 2 years ago

I used to get frequent iMessages that look just like this, except with links to a different domain name. Last one was July 21, linking to https://us-usps-mg.top/us

Seems it's no longer active. If I send "Y", the message is not delivered. The domain points to 404 on a "King Ice" website selling jewelry shaped like guns or penises, I'm not joking.

smm11• 2 years ago

I broke into VT-100 terminals (the real ones, not the modern terminal app derivative) at my university library over 40 years ago.

Can't tell you how, it's been a minute.

wdb• 2 years ago

Why are they not accepting a whole bunch of credit card (types)?

RockRobotRock• 2 years ago

Opps wanted some initiative, blew up their entire quadrant

rererereferred• 2 years ago

I got one of these texts just last week. In Spanish and pretending to be my country's national postal office. Also using a .top domain.

What's freaky is I just got a package through the post office a few days before. These guys are maybe accessing package tracking tools looking for phone numbers. I would expect that's not heavily secured data.

Edit: I reported the domain to the registrar and they took it down.

USPS text scammers duped his wife, so he hacked their operation

Related Stories