Child Porn Accusation As Online Extortion Tactic 321
Glenn writes "There's a story on silicon.com about a new twist in the tactics used by online extortionists trying to blackmail ecommerce sites with denial of service attacks. Yesterday one blackmailer threatened to send out child pornography emails in UK gambling site Blue Square's name if it didn't pay up 7000 Euros." This sounds even worse than simple DoS threats.
It's all SMTP's fault! (Score:5, Insightful)
SMTP is wide open to the kind of attack that is being discussed here. Since there's no authentication of the sender, anybody can send out messages with the "From:" address of the desigated victim, and can smear their reputation into being anything from a spammer to a pornographer.
The only surprise to me is that it took the bad guys this long to make the connection into this being something to make extortion threats over. It's not like this was a well-hidden problem with SMTP, sender spoofing has been done by spammers and phishers for years.
We need to retire this standard and find a better way to move e-mail with the ability to authenticate that the claimed sender is the real sender. It'd solve this problem and a whole bunch of other ones at the same time.
Same solution as always (Score:1, Insightful)
In other words, once this scam is publicly known, it will be worthless for the scammers.
Distribution of child pornodraphy for profit (Score:5, Insightful)
It should, however, get the attentio of the authorities much more readily though.
These guys admit to having illegal photographic material in their possession and are attempting to use it to make a buck. Catching these would be much better publicity for the enterprising copppers than some two-bit hackers.
Re:It's all SMTP's fault! (Score:5, Insightful)
Phase 1: Retire SMTP
Phase 2: Panic
Phase 3: Develop, implement and distribute new e-mail sending system (maybe profit)
Personally, I fear Phase 2!
So, let the guy hurt himself (Score:2, Insightful)
blackEmail (Score:5, Insightful)
Re:It's all SMTP's fault! (Score:5, Insightful)
Re:It's all SMTP's fault! (Score:5, Insightful)
But we have technology that works almost perfectly with existing SMTP servers that combats this very threat. SPF, Sender ID et al are designed to confirm that the sender or sending domain is reflected accurately.
Why should we change every MUA & MTA, almost certainly handing control of email to big business in the process, when we hold a solution in our hands. If your ISP doesn't support SPF, point them to this and suggest they adopt it. If you don't publish SPF records, set some up. If you get a virus warning from another company where your email address was forged, email them and suggest they start SPF checking. There are alwyas going to be threats to internet protocols - this threat is one we can already deal with.
Re:It's all SMTP's fault! (Score:5, Insightful)
because basically the threat is that their name would get associated with child pornography.
you can't really fight against such threats any other way than making it national news that someone is extorting you that way...
It really took this long? (Score:4, Insightful)
good luck with that (Score:3, Insightful)
You seem to have forgotten that the internet doesn't end at the coasts?
This isn't about framing them legally - it's about smearing their reputation further. Any competent website op is going to have logs, and their tiering partners are going to have logs as well. It would be almost trivial to prove to the FBI the "bad stuff" didn't come from them, but it would likely be a fair sight harder getting the luser recipients of said material to believe it.
Re:Man... (Score:3, Insightful)
RTFA. These are online gambling sites. Most gambling has a large amount of organized crime involved. I think that getting fined/arrested should be the least of these scumbags' worries. And whatever the mob would do to them, they would deserve it.
-paul
Re:Same solution as always (Score:2, Insightful)
It's not so much about fear of actual jail/persacution as it is about fear of the shitstorm that arises in the time it inevitably takes for the truth to be found.
The charges were dropped against old Pete, but he still had his name mentioned in the same sentence as 'child porn' countless times in print and on the net.
It's all USPS's fault! (Score:5, Insightful)
USPS is wide open to the kind of attack that is being discussed here. Since there's no authentication of the sender, anybody can send out messages with the "From:" address of the desigated victim, and can smear their reputation into being anything from a spammer to a pornographer.
The only surprise to me is that it took the bad guys this long to make the connection into this being something to make extortion threats over. It's not like this was a well-hidden problem with USPS, sender spoofing has been done by spammers and phishers for years.
We need to retire this standard and find a better way to move mail with the ability to authenticate that the claimed sender is the real sender. It'd solve this problem and a whole bunch of other ones at the same time.
Re:Whatever happened to "Laws" and "Rules"? (Score:3, Insightful)
Perps: in Russia
Victims: UK and US
Victim contacts Scotland Yard or the FBI. If they have time, they'll investigate and figure out the perp is quite likely in Russia, but they can't be sure, because they used an anonymous proxy in South Korea. It's now about 3 months after the incident.
They contact the South Korean network with the open proxy. They answer after a month or two saying they didn't keep logs. Pass go, do not go to prison.
They then contact the Russian authorities. The Russians answer you have no proof this falls under Russian jurisdiction, and even if you did, you have failed to show how which Russian law was broken, and even if you did prove Russian law was broken, the punishment under Russian law is 5 months probation, and no, we will not extradite the criminal to the US or UK.
We're now at 5 - 6 months after the incident.
That's assuming it's not the Russian mafia, who really doesn't give a shit whether or not the Russian cops bust them for $7K extortion scam.
Comment removed (Score:3, Insightful)
Re:So, let the guy hurt himself (Score:2, Insightful)
Re:People have said that. (Score:2, Insightful)
maybe it's just me..... (Score:2, Insightful)
Re:It's all SMTP's fault! (Score:4, Insightful)
Re:It's all SMTP's fault! (Score:2, Insightful)
On that note, all of the technical people already know this so the smear campaign will not work against them. I can not even make a guess about the percentage of "plain folks" that might be fooled but probably not as many as you think. I'm sure every person in the world with an email account has got and noticed email with a fake from field considering the amount of spam and worm artifacts flying around. Child porn is a different level when compared to a scam email, a virus, a security breach, a click me from your friend, m0Rtg4Ge L000an, or a phishing attempt. Child porn would stand out as something a business obviuosly would not send. I do not believe the impact would be that great, maybe some sour feelings by the business owners and employees but not much bottom line impact. Maybe I am wrong..
Slander hurts, even if your reputation is good. (Score:3, Insightful)
Re:Sigh, so many scumbags and thugs. (Score:2, Insightful)
Yes, we may get a high noise-to-signal ratio by allowing ANYONE to say things and be anonymous, but otherwise we would end up with only those people speaking the party propaganda actually safe from harm. (Think PRAVDA, or other Soviet-era news outlets).
And 'filtering' free speech, by definition, makes it non-free.
Re:So, let the guy hurt himself (Score:3, Insightful)
People will believe anything that they read on the internet - the fact that everyone is still falling for phishing scams and getting rooted via email tojans should be proof enough of that fact.
Hmmm... (Score:5, Insightful)
On reading the headline I thought the extortionists were threatening to upload child pornography to their servers then call the authorities.
This would likely get their servers seized at least long enough to figure out that they'd been hacked. To an on-line business, that may just be long enough to put them out of business.
With just emailing in their name, all the extortionists are doing is causing a breif blip of bad publicity before they get the word out that they're being framed.
This is what happens... (Score:5, Insightful)
If times were different the threat might be to send Communist propaganda.
Re:Huh? (Score:1, Insightful)
Re:It's all SMTP's fault! (Score:5, Insightful)
To make a long story short, mechanisms like Sender-ID are impractical and aren't even a stop-gap solution because they don't solve the -real- problem, which is determining the source of a message. Instead, they solve an irrelevant side problem, that of being able to send a message with a faked source domain. That would have solved the spam problem five years ago (when this was the usual means for sending this stuff). Now, it's too little, too late.
We need a mechanism based on verifiable key signing with the public keys transferred as an attachment to the message itself. With such a mechanism, you'd be able to track your way back through a chain of a handful of certifying keys until you get back to the certifying agency key. At that point, you have a verifiable audit trail for determining who sent the email message, and spammers will be effectively shut out unless they're willing to send messages that can be traced back to their home postal address, real email address, and real telephone number.
Further, with a key-based mechanism, a list of legitimate IP numbers for the domain could also be sent along with the message, signed with the private key. This would give the (modest) added benefit of Sender-ID without the (potentially devastating) use of DNS to do it.
Just my $0.03 (price adjusted due to inflation).
Re:Sigh, so many scumbags and thugs. (Score:5, Insightful)
Re:It's all SMTP's fault! (Score:4, Insightful)
If I'm Citigroup, I'd sure like to be able to place restrictions on mail coming from citigroup.com, because otherwise people might think a falsified communication is actually from their bank -- bad news. If I'm the owner of "alumni.almamata.edu" I probably don't care.
Spam has zero, zilch, zip to do with any of this since a spammer can easily own a DNS record. The only goal of systems like SPF is to prevent fraud. Sometimes spammers commit fraud but SPF does nothing to address those who do not.
Re:It's all SMTP's fault! (Score:4, Insightful)
Phase 2: Panic
Phase 3: Develop, implement and distribute new e-mail sending system (maybe profit)
Phase 4: Learn to cope with all the spam on the new system
Phase 5: Wonder why you have to pay for every email
Phase 6: Develop, implement, and distribute something SMTP-like again, and start signing emails.
BULLSHIT (Score:3, Insightful)
No, we most certainly don't.
SPF, Sender ID et al are designed to confirm that the sender or sending domain is reflected accurately.
And how, exactly, does this "combat" anything?
Assume a scammer wants to extort money from "UpstandingCo.com". What's to stop them from registering "UpstandingCo.cx", "Upstanding-Co.com", "UpstandingCompany.com", or any one of a zillion other domains, setting up the appropriate SPF/SenderID record, and using that to send out their hoax emails?
Anyone who would believe that "UpstandingCo.com" would send kiddie porn in the first place isn't going to be smart enough to realize that "Upstanding-Co.com" isn't the same outfit.
*THAT* is the problem here. It's not a technical problem, it's a social one - and you can't solve a social problem with a technical solution.
Couple of Things (Score:2, Insightful)
Second, there is no reason to believe that the person(s) making the threat actually has child pornography (not that I'm defending him/her/them). The posession of the material is not required to make the threat. The extortionist could be like a bank robber without a firearm, either claiming to have one but not, or having a toy pistol (having "barely 18" pornography that looks like child pornography).
In short, in order to actually pull something like this off without getting caught, one has to either be very smart or have a very stupid target.
~UP
Re:Sigh, so many scumbags and thugs. (Score:2, Insightful)
Free speech is more than complaining about the government, it's the ability to say dissenting opinions about any subject. Individuals and groups unfortunately, respond with violence against these people that are publicly identified with their speech and/or policies. (Think presidental assassinations, the assassination of Martin Luthor King, Bobby Kennedy, many Equal Rights speakers during the 60's, church burnings, random killing of openly gay individuals, bombings of Planned Parenthood clinics, the list goes on.) Unpopular opinions can get one killed. Without anonymity, most of these people afraid for their safety would simply shut up.
Even worse for the recipients? (Score:2, Insightful)
Aside from the utter fucking nastiness of getting this stuff, it is just as bad to get busted receiving this shit as it is to be busted for sending it, in a frame-up such as this.
I may be completely off here, but I seem to recall a case where a guy was persecuted/prosecuted based on some email he'd gotten via some group but hadn't requested. At least, that's what he claimed.
Even if it were true that he requested it, the problem is with the ambiguity in the law but the complete lack of ambiguity in public opinion. Even if he were eventually found completely innocent and publically touted as a model citizen, there are still going to be all kinds of people who now know way more about his masturbation habits than he'd like, and probably quite a few who refuse to believe that he didn't do it - where there's smoke there's fire.
I can't be certain, but I bet there are some people who have emailed child porn to people and then called the police to turn in the recipient, banking on exactly this kind of thing.
What we need is one of 2 things:
1: A system where we have some reasonable definition of what a person's intent is. Just because Joe Schmo signs up to recieve Hot Anal Action pictures from a Yahoo! group does not mean he is culpable when some asshole spams that group with child porn.
2: A way to absolutely verify where an email came from and then ruthlessly bitchslap the person or people responsible for this kind of shit.
In a reasonable world, I'd hope for 1, but who can say what'll happen.
Re:It's all SMTP's fault! (Score:5, Insightful)
Scary thing about such threats is that even that doesn't work. I wonder how many people out there will never go see another "The Who" show as long as they live because of the Pete Townshend incident.
First it was "innocent until proven guilty", then it was "guilty until proven innocent"
If someone accuses you of being a pedofile it doesn't matter if you're guilty or not
Why security matters (Score:3, Insightful)
Now, threatening with sending child porn with their email is not very serious. A lot of spam was sent with my email address (some spammers send spam with real email addresses instead of totally fake ones to try to have more luck, and being hit with that a few times), but checking mail headers normally clean a bit what really happened (why i would travel to mexico just to send spam? :).
Of course, if the mail server of this people is an open relay or is hacked, and is used to send child pornography, spam, 419 scams, Al-Qaeda advertisement or any kind of law-breaking stuff, well, there mail headers will not help a lot, and they will have a bit of responsibility on that.
Re:It's all SMTP's fault! (Score:4, Insightful)
Re:It's all SMTP's fault! (Score:2, Insightful)
Re:It's all SMTP's fault! (Score:3, Insightful)
Or perhaps the People might learn how thin is their illusion of privacy.
Or perhaps -- just perhaps -- someone is afraid it would actually succeed! I wonder... who might that be?
Perhaps.
Re:nothing new. (Score:3, Insightful)
Make it an offense to give in to blackmailers (Score:3, Insightful)
Re:It's all SMTP's fault! (Score:3, Insightful)
Re:This is what happens... (Score:1, Insightful)