Slashdot Log In
Child Porn Accusation As Online Extortion Tactic
Posted by
timothy
on Wed Oct 27, 2004 12:07 PM
from the sounds-like-an-fbi-method dept.
from the sounds-like-an-fbi-method dept.
Glenn writes "There's a story on silicon.com about a new twist in the tactics used by online extortionists trying to blackmail ecommerce sites with denial of service attacks. Yesterday one blackmailer threatened to send out child pornography emails in UK gambling site Blue Square's name if it didn't pay up 7000 Euros." This sounds even worse than simple DoS threats.
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
It's all SMTP's fault! (Score:5, Insightful)
SMTP is wide open to the kind of attack that is being discussed here. Since there's no authentication of the sender, anybody can send out messages with the "From:" address of the desigated victim, and can smear their reputation into being anything from a spammer to a pornographer.
The only surprise to me is that it took the bad guys this long to make the connection into this being something to make extortion threats over. It's not like this was a well-hidden problem with SMTP, sender spoofing has been done by spammers and phishers for years.
We need to retire this standard and find a better way to move e-mail with the ability to authenticate that the claimed sender is the real sender. It'd solve this problem and a whole bunch of other ones at the same time.
Re:It's all SMTP's fault! (Score:5, Insightful)
Phase 1: Retire SMTP
Phase 2: Panic
Phase 3: Develop, implement and distribute new e-mail sending system (maybe profit)
Personally, I fear Phase 2!
Parent
Re:It's all SMTP's fault! (Score:5, Funny)
Phase 1: Retire SMTP
Phase 2: Panic
Phase 3: Develop, implement and distribute new e-mail sending system (maybe profit)
Personally, I fear Phase 2!
But...your fear is developing according to your plan...so it is good, isn't it?
Parent
Re:It's all SMTP's fault! (Score:4, Insightful)
Parent
Re:It's all SMTP's fault! (Score:4, Insightful)
Phase 2: Panic
Phase 3: Develop, implement and distribute new e-mail sending system (maybe profit)
Phase 4: Learn to cope with all the spam on the new system
Phase 5: Wonder why you have to pay for every email
Phase 6: Develop, implement, and distribute something SMTP-like again, and start signing emails.
Parent
Re:It's all SMTP's fault! (Score:4, Insightful)
Parent
Re:It's all SMTP's fault! (Score:5, Insightful)
Parent
Re:It's all SMTP's fault! (Score:4, Insightful)
If I'm Citigroup, I'd sure like to be able to place restrictions on mail coming from citigroup.com, because otherwise people might think a falsified communication is actually from their bank -- bad news. If I'm the owner of "alumni.almamata.edu" I probably don't care.
Spam has zero, zilch, zip to do with any of this since a spammer can easily own a DNS record. The only goal of systems like SPF is to prevent fraud. Sometimes spammers commit fraud but SPF does nothing to address those who do not.
Parent
Re:It's all SMTP's fault! (Score:3, Informative)
For that matter, alumni.almamater.edu could check SPF records and let
Sigh, so many scumbags and thugs. (Score:5, Interesting)
And, it scares me miserably that I would even think about that as a tradeoff.
Parent
Re:Sigh, so many scumbags and thugs. (Score:3, Insightful)
If a free country, it probably protects more scumbags by a margin of 100:1, but getting rid of it might turn it into a non-free country.
In a non-free country, its invaluable as a method to get information.
I think the main point of the anyonymity is to keep government tracking practically impossible to at least very very hard. If the FBI started tracking all online activity, it would be hell. I'd probably move out of the country. And you know if they could, they would.
I think things wil
Re:Sigh, so many scumbags and thugs. (Score:5, Insightful)
Parent
Re:It's all SMTP's fault! (Score:3, Funny)
When do we have to replace the entire Internet? Or is IPv6 sufficiently robust?
Re:It's all SMTP's fault! (Score:3, Funny)
Re:It's all SMTP's fault! (Score:5, Insightful)
because basically the threat is that their name would get associated with child pornography.
you can't really fight against such threats any other way than making it national news that someone is extorting you that way...
Parent
Re:It's all SMTP's fault! (Score:5, Insightful)
Scary thing about such threats is that even that doesn't work. I wonder how many people out there will never go see another "The Who" show as long as they live because of the Pete Townshend incident.
First it was "innocent until proven guilty", then it was "guilty until proven innocent"
If someone accuses you of being a pedofile it doesn't matter if you're guilty or not
Parent
Re:It's all SMTP's fault! (Score:5, Insightful)
But we have technology that works almost perfectly with existing SMTP servers that combats this very threat. SPF, Sender ID et al are designed to confirm that the sender or sending domain is reflected accurately.
Why should we change every MUA & MTA, almost certainly handing control of email to big business in the process, when we hold a solution in our hands. If your ISP doesn't support SPF, point them to this and suggest they adopt it. If you don't publish SPF records, set some up. If you get a virus warning from another company where your email address was forged, email them and suggest they start SPF checking. There are alwyas going to be threats to internet protocols - this threat is one we can already deal with.
Parent
Re:It's all SMTP's fault! (Score:3, Funny)
Re:It's all SMTP's fault! (Score:3, Funny)
Re:It's all SMTP's fault! (Score:5, Informative)
For example, using a combination of SPF and SMTP/AUTH you can easily prevent anyone who uses SPF from accepting invalid mail "from" your domain(s) while continuing to use the world's most pervasive mail transfer protocol.
Problem is that people aren't willing to apply the time and effort required to do this globally.
The next step is reputation, and as soon as you can be sure that the person claiming to be joe@example.com is in fact from example.com, you can begin assigning example.com a reputation. You'll see dozens of distributed reputation databases, just like IP-based blacklists, overnight.
Want to move the process along? Add an SPF record for your domain and add an SPF milter (or equivalent for your MTA technology) to your mail server. The sooner forgeries stop, the sooner we can start building reputation and end this.
Parent
Re:It's all SMTP's fault! (Score:5, Insightful)
- Lots of sites never got their RDNS entries right.
- DNS is unreliable.
- DNS resolution is usually not parallelizable.
The result is that the spam we have now could be a denial of service attack in two ways:- By overloading DNS servers of small companies.
- By using bogus domain names that cause 30 second stalls in your inbound traffic.
It also fails to solve the phishing problem by providing no real, legitimate means to track the email back to an actual person, as it is trivial to register a domain like ebay-secure.com....To make a long story short, mechanisms like Sender-ID are impractical and aren't even a stop-gap solution because they don't solve the -real- problem, which is determining the source of a message. Instead, they solve an irrelevant side problem, that of being able to send a message with a faked source domain. That would have solved the spam problem five years ago (when this was the usual means for sending this stuff). Now, it's too little, too late.
We need a mechanism based on verifiable key signing with the public keys transferred as an attachment to the message itself. With such a mechanism, you'd be able to track your way back through a chain of a handful of certifying keys until you get back to the certifying agency key. At that point, you have a verifiable audit trail for determining who sent the email message, and spammers will be effectively shut out unless they're willing to send messages that can be traced back to their home postal address, real email address, and real telephone number.
Further, with a key-based mechanism, a list of legitimate IP numbers for the domain could also be sent along with the message, signed with the private key. This would give the (modest) added benefit of Sender-ID without the (potentially devastating) use of DNS to do it.
Just my $0.03 (price adjusted due to inflation).
Parent
It's all USPS's fault! (Score:5, Insightful)
USPS is wide open to the kind of attack that is being discussed here. Since there's no authentication of the sender, anybody can send out messages with the "From:" address of the desigated victim, and can smear their reputation into being anything from a spammer to a pornographer.
The only surprise to me is that it took the bad guys this long to make the connection into this being something to make extortion threats over. It's not like this was a well-hidden problem with USPS, sender spoofing has been done by spammers and phishers for years.
We need to retire this standard and find a better way to move mail with the ability to authenticate that the claimed sender is the real sender. It'd solve this problem and a whole bunch of other ones at the same time.
Parent
Whatever happened to "Laws" and "Rules"? (Score:5, Interesting)
-Jesse
Re:Whatever happened to "Laws" and "Rules"? (Score:3, Insightful)
Perps: in Russia
Victims: UK and US
Victim contacts Scotland Yard or the FBI. If they have time, they'll investigate and figure out the perp is quite likely in Russia, but they can't be sure, because they used an anonymous proxy in South Korea. It's now about 3 months after the incident.
They contact the South Korean network with the open proxy. They answer after a month or two saying they didn't keep logs. Pass go,
Distribution of child pornodraphy for profit (Score:5, Insightful)
It should, however, get the attentio of the authorities much more readily though.
These guys admit to having illegal photographic material in their possession and are attempting to use it to make a buck. Catching these would be much better publicity for the enterprising copppers than some two-bit hackers.
good luck with that (Score:3, Insightful)
You seem to have forgotten that the internet doesn't end at the coasts?
This isn't about framing them legally - it's about smearing their reputation further. Any competent website op is going to have logs, and their tiering partners are going to have l
blackEmail (Score:5, Insightful)
heh (Score:5, Interesting)
The virus would load a couple of nastypics onto the victims machine, then send out an email to the FBI. The first virus that would get you arrested.
It was just an idea, I have never written a virus that has been let loose into the wild...
Re:heh (Score:4, Funny)
I'm going to have to use slashdot as a programming interface more often.
Parent
Existing problem, of course... (Score:4, Interesting)
It might be bad publicity for the company, but it almost certainly will have no legal ramifications for them.
Which brings me to the next question - is there an agency, organization, department, etc. that receives and processes these kinds of threats? If my company got something like this, to whom would I report it? And what would be done?
If there's nobody out there handling these, I suggest a bounty hunter system. The kind with bows and arrows.
It's not all bad (Score:4, Interesting)
How will that be a bad thing?
People have said that. (Score:4, Interesting)
It really took this long? (Score:4, Insightful)
this reminds me... (Score:3, Interesting)
Interesting... (Score:4, Informative)
OT discussion follows: My first reaction was, what a stupid idea -- all it takes is one faked entry on the list to turn it into a great weapon against whoever you hate today. Then I remembered Artists Against 419 [aa419.com] and its many clones. Funny how I'm willing to trust one but not the other...
I swear... (Score:4, Funny)
nothing new. (Score:4, Interesting)
People have been using the boogymen like that for decades... Even when proven innocent it will haunt the accused for their life.
It's too easy to accuse without proof and be sure it will cause huge damage.
Re:nothing new. (Score:3, Informative)
Sure, you can document the sick twisted case of the totally whacked out career child killer freak all you like, but those are the extreme exceptions to the rul
Joe Jobs. (Score:5, Interesting)
Oh look (Score:3, Interesting)
Anyone seeing a problem here? If we start spoofing things like this is becomes much harder ro prove person X did send e-mail Y..
SPF helps here (Score:4, Informative)
This is somewhat like posting a "no trespassing" sign, and a chain link fence around your property. It doesn't prevent the people from cutting through the fence and getting hurt on your property, but it lets you show to the courts that you took reasonable steps to prevent it.
This is also a good reason to check SPF records. If your company or ISP lets child porn email go through that the domain owner explicitly said should not be allowed, you may have to show why you aren't contributing to the libelling of the domain owner and why you didn't protect your employees/customers from preventable child porn.
Yeah, at this instant, SPF is not enough of a standard to give you strong protection, but in 5-10 years, I think that will change.
This is what happens... (Score:5, Insightful)
If times were different the threat might be to send Communist propaganda.
Re:This is what happens... (Score:4, Informative)
Yeah that would be a reasonable definition. You'd think the law ended there. There was a case in 2001 where a law (the Child Pornography Prevention Act of 1996) banning "virtual child porn"- i.e. cartoons- was struck down by the Supreme Court in a 6-3 decision on First Amendment grounds. That went close to defining a thought crime. The Child Obscenity and Pornography Prevention Act of 2002 amended the law by adding the words "virtually indistinguishable from" to the statute- creating an exemption for obvious things like cartoons- but still covers "generated images" and "computer generated images" if they're "virtually indistinguishable from" real child porn with real children. That one passed the House but was never considered in the Senate. The Child Obscenity and Pornography Prevention Act of 2003 was included as an amendment to the PROTECT Act (outlawing digitally morphed images, where you paste the kid's head on a naked body). That one doesn't care about whether it's real or fake. It simply outlaws any solicitation to buy or sell child porn advertised as such. See here for details. [washingtonpost.com]
It's a lot like flag burning- where constitutional amendments often sit squarely in the way of a desire to be seen as "doing something".
Parent
Risk vs Reward ? (Score:5, Interesting)
I think the extra risk this behavior exposes the perpetrator to will go a long way to self regulate this trend.
Extortion is outdated... do people fall for this? (Score:3, Informative)
2. Let em do what they claim they're gonna do. It won't hurt your company.
Anyone with a brain will be able to realize, "Hey, maybe it isn't them doing this nasty deed."
Do you REALLY think if Best Buy spams some dog sex images that people would think, "Best Buy is sick! What are they doing?!" Nah.
That's like getting those "Arnold Says 'Don't be a girlie man and vote for Bush'" spams and thinking Arnold actually approved it.
C'mon... people know better. Extortion is outdated.
There is only one way... (Score:4, Interesting)
So the real question isn't, "how do we stop spam by getting rid of SMTP" but it's, "what can a new protocol do that will up the ante in functionality so that everyone and his brother just HAS to have it"? Personally, I have a completely different solution that I've been using with friends and family using freely available open source tools. Think about your phone numbers (work, home, cell) and you'll get the idea... (Come on folks! I can't feed you everything
Re:Man... (Score:3, Insightful)
RTFA. These are online gambling sites. Most gambling has a large amount of organized crime involved. I think that getting fined/arrested should be the least of these scumbags' worries. And whatever the mob would do to them, they would deserve it.
-paul
Slander hurts, even if your reputation is good. (Score:3, Insightful)
Re:So, let the guy hurt himself (Score:3, Insightful)
People will believe anything that they read on the internet - the fact that everyone is still falling for phishing scams and getting rooted via email tojans should be proof enough of that fact.
Hmmm... (Score:5, Insightful)
On reading the headline I thought the extortionists were threatening to upload child pornography to their servers then call the authorities.
This would likely get their servers seized at least long enough to figure out that they'd been hacked. To an on-line business, that may just be long enough to put them out of business.
With just emailing in their name, all the extortionists are doing is causing a breif blip of bad publicity before they get the word out that they're being framed.
Parent