Sunday, August 07, 2005
Internet Scammers Keep Working in Nigeria
LAGOS, Nigeria (AP) - Day in, day out, a strapping, amiable 24-year-old who calls himself Kele B. heads to an Internet cafe, hunkers down at a computer and casts his net upon the cyber-waters.
Blithely oblivious to signs on the walls and desks warning of the penalties for Internet fraud, he has sent out tens of thousands of e-mails telling recipients they have won about $6.4 million in a bogus British government "Internet lottery."
"Congratulation! You Are Our Lucky Winner!" it says.
So far, Kele says, he has had only one response. But he claims it paid off handsomely. An American took the bait, he says, and coughed up "fees" and "taxes" of more than $5,000, never to hear from Kele again.
 |
In Festac Town, an entire community of scammers overnights on the Internet. By day they flaunt their smart clothes and cars and hang around the Internet cafes, trading stories about successful cons and near misses, and hatching new plots.
Festac Town is where communication specialists operating underground sell foreign telephone lines over which a scammer can purport to be calling from any city in the world. Here lurk master forgers and purveyors of such software as "e-mail extractors," which can harvest e-mail addresses by the million.
Now, however, a 3-year-old crackdown is yielding results, Nigerian authorities say.
Nuhu Ribadu, head of the Economic and Financial Crimes Commission, says cash and assets worth more than $700 million were recovered from suspects between May 2003 and June 2004. More than 500 suspects have been arrested, more than 100 cases are before the courts and 500 others are under investigation, he said.
The agency won its first big court victory in May when Mike Amadi was sentenced to 16 years in prison for setting up a Web site that offered juicy but phoney procurement contracts. Amadi cheekily posed as Ribadu himself and used the agency's name. He was caught by an undercover agent posing as an Italian businessman.
This month the biggest international scam of all - though not one involving the Internet - ended in court convictions. Amaka Anajemba was sentenced to 2 1/2 years in prison and ordered to return $25.5 million of the $242 million she helped to steal from a Brazilian bank.
The trial of four co-defendants is to start in September.
Why Nigeria? There are many theories. The nation of 130 million, Africa's most populous, is well educated, and English, the lingua franca of the scam industry, is the official language. Nigeria bursts with talent, from former NBA star Hakeem Olajuwon to Nobel literature laureate Wole Soyinka.
But with World Bank studies showing a quarter of urban college graduates are unemployed, crime offers tempting career opportunities - in drug dealing, immigrant-trafficking, oil-smuggling, and Internet fraud.
The scammers thrived during oil-rich Nigeria's 15 years of brutal and corrupt military rule, and democracy was restored only six years ago.
"We reached a point when law enforcement and regulatory agencies seemed nonexistent. But the stance of the present administration has started changing that," said Ribadu, the scam-busting chief.
President Olusegun Obasanjo is winning U.S. praise for his crackdown. Interpol, the FBI and other Western law enforcement agencies have stepped in to help, says police spokesman Emmanuel Ighodalo, and Nigerian police have received equipment and Western training in combating Internet crime and money-laundering.
Experts say Nigerian scams continue to flood e-mail systems, though many are being blocked by spam filters that get smarter and more aggressive. America Online Inc. Nicholas Graham says Nigerian messages lack the telltale signs of other spam - such as embedded Web links - but its filters are able to be alert to suspect mail coming from a specific range of Internet addresses.
Also, the scams have a limited shelf life.
In the con that Internet users are probably most familiar with, the e-mailer poses as a corrupt official looking for help in smuggling a fortune to a foreign bank account. E-mail or fax recipients are told that if they provide their banking and personal details and deposit certain sums of money, they'll get a cut of the loot.
But there are other scams, like the fake lotteries.
Kele B., who won't give his surname, says he couldn't find work after finishing high school in 2000 in the southeastern city of Owerri, so he drifted with friends to Lagos, where he tried his hand at boxing.
Then he discovered the Web.
Now he spends his mornings in Internet cafes on secondhand computers with aged screens, waiting "to see if my trap caught something," he says.
Elekwa, a chubby-faced 28-year-old who also keeps his surname to himself, shows up in Festac Town driving a Lexus and telling how he was jobless for two years despite having a diploma in computer science.
His break came four years ago when the chief of a fraud gang saw him solve what seemed like "a complex computer problem" at a business center in the southeastern city of Umuahia and lured him to Lagos.
He won't talk about his scams, only about their fruits: "Now I have three cars, I have two houses and I'm not looking for a job anymore."source:http://apnews1.iwon.com//article/20050806/D8BQHJROA.html
Massive spyware-based identity theft ring uncovered
Researchers from a little-known security software company named Sunbelt Software have seemingly uncovered a criminal identity theft ring of massive proportions. According to one of their employees, Alex Eckelberry, during the course of one of their recent investigations into a particular Spyware application—rumored to be called CoolWebSearch—they've discovered that the personal information of those "infected" was being captured and uploaded to a server.
One can only speculate about why someone would do such a thing; the amount of data that could be gathered would almost certainly be daunting for even a few people to sift through and exploit. On the other hand, the researchers at Sunbelt have personally uncovered the personal information of two individuals who, combined, could be taken for well over US$350,000.
The list of stolen information includes not only bank accounts but website passwords, eBay accounts, what sort of adult images you fancy, and, supposedly, even more. The researchers initially had tried in vain to get a hold of someone who could take action on this issue but didn't get a response right away:
We have notified the FBI, but of course no response (too busy doing other more important things). We have notified a few of the parties involved...If anyone has any other ideas, send 'em to us. Right now, we're sitting upon literally thousands of pages of stolen identities that are being used right now.
Good news came today, though, that the FBI had responded and are currently working the case. We've emailed Alex and tried to see if we could get any more details about the whole thing out of him, but at the time of publication, we had not received a response. Hopefully the people who've perpetrated this massive-scale theft of personal data can be quickly caught and brought to justice due to the quick actions of Alex Eckelberry and the researcher who discovered the crime, Patrick Jordan.
Updated (08/06/2005 4:24PM CDT): I've received a little bit more information on what's going on from the employees of Sunbelt Software. What follows is more or less the exact email I received from Alex Eckelberry:
Basically, it went like this:
Patrick Jordan, our CoolWebSearch expert, was doing research on a CWS exploit. During the course of the research, he disovered that a) the machine he was testing became a spam zombie and b) it send a call back to a remote server. He traced back the remote server and found what you have heard about.
The scale is unimaginable. There are thousands of machines pinging back in a day. There is a keylogger file that grows and grows, and then is zipped off and then the cycle continues again.
It is sophisticated. There are nifty little PHP scripts that help the criminals get reports. There is a special upload area.
Updated (08/06/2005 5:38PM CDT): Here's more information from Eric Sites, VP of R&D at Sunbelt:
While one of my spyware researchers was tracking down new variants of CoolWebSearch he came a cross a payload of crap that was downloaded to his VMware. This payload included a program that monitored the users internet traffic, chat activity and Windows protected storage store. When using Internet Explorer with autocomplete turned on, your autocomplete info gets stored in protected storage.
This piece ofspyware collected your protected storage info plus URLs, chat activity and website usernames and passwords. The real problem with this spyware was that it collected this information and posted it back to a public website that anyone could go to and read all of your personal information. Some examples of this include all the credit card info entered on HTML forms while purchasing something online. It did not matter that the webpage was using HTTPS.
This website had collected over 500 different computers very private information within a 24 hours period. Including chat activity and login info to online bank accounts. One company had over $380,000 in a compromised account. The information was not the normal info collected for hacking purposes. It was collected to steal your money, SSN, credit card info, address, and identity. We have already found two variants of this spyware with multiple locations for its stolen info upload. We are working with the FBI and Secret Service to track everything back to the source.
This article will be updated with any more information we receive or uncover about the ID theft incident.
source:http://arstechnica.com/news.ars/post/20050805-5175.html
Make Fire From Water
No idea on how much this thing will cost, though apparently it’ll be out some time this summer. Now excuse us as we attempt to lift our jaws off the floor.
source:http://www.gizmodo.com/gadgets/home/make-fire-from-water-116027.php
An Eagle Eye on Retail Scams
Receipt-fraud expert Mark Hilinski details a few of the latest tricks in the grifters' ever-changing game
Fraud schemes affect the bottom line at every retailer that accepts returns (see BW Online, 8/5/05, "Many Unhappy Returns for Retailers"). Mark Hilinski, co-founder of The Return Exchange, a software company that provides fraud- and abuse-detection products to retailers, has been tracking these schemes and trends since 1999. He came to the business with sales and marketing experience in technology and services from Risk Data Corp. and HNC Software.
For the first year, The Return Exchange handled straight customer returns for retailers before focusing on collecting and analyzing data to prevent fraud. "There hasn't been a central repository for this kind of information," Hilinski notes. "So we've been doing store surveys, talking to managers, and trying to identify things along the way."
BusinessWeek intern Elizabeth Woyke recently spoke to Hilinski from his base in Irvine, Calif., about the new, high-tech ways thieves are scamming stores' return policies -- and what retailers can do to protect themselves.
Q: What's new about return fraud?
A: Return fraud has existed for years. But the schemes have gotten more sophisticated. The quality of scanners and printers has increased, and that has allowed the same kind of scams to be replicated in new ways.
The days where you used to cross out numbers on a receipt and fill them in with a typewriter are gone. Now you have receipts that are scanned in and altered and reprinted. You can even print receipts in the parking lot, because everything's portable.
Q: How does receipt fraud work?
A: What's really on the rise is that journal tape, the [paper] that runs through registers, is somehow being taken out of store rooms and registers and sold. You can do a lot once you have this tape. There are printers you can buy at your local electronics center that can reprint and recast receipts fairly well.
If I have a receipt for $100 for a sweater and I copy it, now I have the ability to take back as many of those sweaters as I can get my hands on. Some people also get receipts from the trash or reuse their own receipts multiple times. Within receipt fraud, that's fairly easy to do if there are no controls.
Q: Aren't most stores able to recognize a forged receipt?
A: If your system is smart enough to be able to track receipted returns, which we're in favor of and is a service we provide to some of our clients, that's great. Then, if you have a receipt for three items that are $100 apiece and you return $300 on that receipt, there's no way to return more on it.
But if I have a receipt and you're not tracking returns by consumer, I could do that once a day [until my live receipt expires]. We've even seen Web sites that were offering to buy and sell live receipts that were under 90 days old paid for in cash. All you have to do is get these garments or products and take them back.
Q: Is receipt fraud the most common return-fraud scam?
A: The largest group in this category of fraud and abuse is still by and large the "renting" population. That's the customer that comes in and buys on Friday, wears on Saturday, and returns on Sunday, on purpose.
Of course, it's not always clear who's doing that intentionally. The way we look at it is, someone making returns 50 times in one day at 12 different stores, you could argue pretty easily that that's a problem. We're talking about a very small percentage. Within a one-year period 75% to 80% of consumers don't make returns. Of those who do, only 1% fall into this outlier category.
Q: Does this mostly affect clothing retailers?
A: We've also been seeing an increase in the "renting" of consumer electronics. In the last five years, there has been an uptick in high-end digital video cameras, for example. You don't think of people "renting" cameras, but people do exactly that for graduations, weddings, special events. We see a lot of that being taken advantage of.
Q: It seems people aren't ashamed to do this.
A: We're seeing both an uptick in numbers and in the brazen attitudes of consumers that utilize this. They're not sheepish anymore about bringing things back.
It could be a pair of tennis shoes that they've worn for 90 days and the soles are wearing out. And they say, "Listen, these don't fit anymore, I'd like a new pair because I've got a prom date tonight" or whatever.
We see a lot of this out in the open, whereas before we think it was less visible. Consumers feel they're entitled to make a return at any time for any reason. And that seems to be more pervasive now than it was five years ago.
Q: What about this other kind of return fraud, price arbitrage?
A: At its simplest, price arbitrage involves buying differently priced, similar-looking items and returning the cheaper one as the expensive item.
Let's use watches as an example. You may have a $100 timepiece and one that's very similar that costs $50. And the only thing that's different is maybe the inside face. The store associates don't necessarily know the look and feel of every single watch that they sell. So if I buy the $100 and the $50 one and go home and put the inexpensive one in the expensive box, I'll get my $100 back and I'll give them the $50 watch.
Those watches aren't being taken out of the box and checked. The employees are trying to move the transaction along and provide great customer service.
Q: How exactly does return fraud cost stores money?
A: A certain percentage of returned merchandise must be discounted or discarded in order to sell it. For example, out-of-season clothing may go directly to the sale rack. The lingerie department in most department stores may discard returned items for health reasons.
In the best-case scenario, the item gets put back on the shelf exactly where it was and the next consumer buys it. The problem is, by allowing a return that's fraudulent to come back into the store you lose the gross margin on that sale. You don't get that back in the new sale. You also lose restocking time, which is time an associate could be spending with a consumer on a new sale.
Q: What role do auction Web sites play in all this?
A: Retailers have stopped giving cash back in many different cases. Instead, they do refunds in the form of gift cards or store credits or store value cards. If a crook can get enough of those, he might sell $2,500 worth of gift cards for $2,000 online. It's a benefit for the buyer, who gets a discount and will use those gift cards. And the person who has manipulated the return-scam system has a way to [make money]. But the retailers lose out.
They're also a way for people to get liquid. If I want to make money [as a shoplifter], the best way for me to do that is to return [stolen goods] for full value plus tax. In the case where I'm unable to do that, as with our retailers who are able to stop that from happening, Web sites can be a great place to resell merchandise that was acquired inappropriately.
Q: Is the Internet exacerbating return fraud in other ways?
A: [Return-fraud] information is shared over the Internet publicly, in different blogs. If I want to steal from ABC retailer I can go and search pretty quickly for the best way to do it, the best time of day, the best store in some cases.
Web sites keep popping up and getting shut down -- by the groups themselves so they don't get caught or to maintain some sort of distance. We've seen the same site available, then offline two minutes later, then available again 30 days later and then dead for three months.
Some seem to have short shelf lives, because the retailers find out about them and call authorities. On the retail side, it doesn't take them long to get organized-crime units involved from the operations side or loss prevention side and alert the appropriate authorities.
Q: Are more people starting to realize this is a problem?
A: Retailers have struggled with this for years. People are starting to talk more openly about it, we're getting more information about the problems, and we have better tools and technology to help retailers combat them.
source:http://www.businessweek.com/bwdaily/dnflash/aug2005/nf2005085_7387_db008.htm?campaign_id=rss_daily
