how-to block ads
|
|  | | wilburyan
join:2002-08-01 | Re: USB drive Not if it's a Westurn Union Money order... a con artist's best friend  | |
| | | 
Jason Levine
Premium
join:2001-07-13
USA | Re: USB drive Nope, it's an e-Gold account. I'm guessing the Feds have either already had the account frozen or are keeping it running at the moment just to track who's logging into it. | |
| |
Jason Levine
Premium
join:2001-07-13
USA
1 edit | Exactly. If anything, this is a dumb criminal scheme.
First of all, they have an e-mail address (removed for purposes of the screenshot, but I'm sure it's fully visible in the "live" version). This is apparently a box that's being checked by the extortionists in some way, shape, or form. (Otherwise, how would they arrange for those $200 payments?) There's got to be a way to track who's accessed that account and from where.
In addition, it relies on redirecting users to a website to download the trojan. Find out who set up that website and you've found your scammer (or at least one of them).
Failing that, the authorities could e-mail the address pretending to be a user whose data files were locked out. (For additional authenticity, they could intentionally infect a sacrificial box that didn't have anything important on it.) Once contact is made, payment arrangements can be set up and the criminals tracked down.
This guy (group?) has left many ways to track them down. I wouldn't be surprised to hear of an arrest in this case in the not too distant future. (Law enforcement can take it's time in order to get things right sometimes, so that might slow down the actual arrest announcement somewhat.)
EDIT: The Websense article reveals that the payment method is an e-Gold account. This should be very easy to trace. In addition, the whole thing should be easy to take offline. Take down the website hosting the trojan and shut down the e-Gold account. (Sure, the scammers will release another version that connects to a different website and e-Gold account, but it'll take them offline for awhile.)
--
-Jason Levine
http://www.jasons-toolbox.com/
http://www.PCQandA.com/
http://www.urateit.com/ | |
| | | 
Jerm
join:2000-04-10
Richland, WA
| Just FWIW... The websites aren't hosted on actual servers like you and I are used to: The website that downloads the trojans to the PC are actually hosted on infected zombie machines - ie cable modem, DSL, and other various broadband connection hacked machines.
Want to read more about zombie attacks? Great read here:
»grc.com/dos/grcdos.htm | |
| | | |
|
·
·
·
·