Date: Fri 06-Feb-1998

Publication: Bee

Author: CURT

Quick Words:

iinfo-Spam-Scam-Yahoo

Full Text:

INTERNET INFO FOR REAL PEOPLE: The Yahoo! Scam

By Bob Brand

I watched it unfold before my very eyes!

Many small ISPs (Internet Service Providers) effectively compete against large

national providers by extra hard work, sharing ideas and cooperation when

emergencies arise. A very active listserv (ISP-CHAT e-mail discussion list)

provides the conduit for these activities. This e-list is available for

everyone to read (mailto:join-isp-chat@isp-chat.com). As a spectator, I

watched the following events unfold through the posting of messages.

In mid December, a message appeared alerting the group to a new scam/spam

(junk e-mail). The scam involved an announcement that the recipient had won a

free US Robotics X2 modem. All that was required was for the reader to e-mail

his name, address, phone number, credit card number (with expiration date) and

method of delivery. The "winner" would only have to pay the freight on the

prize. The bogus e-mail carried the subject: "You are a winner from Yahoo!"

and carried a legitimate Yahoo address.

On the Trail

The insidious nature of the scam generated a barrage of messages from ISPs

across the country. Chuck Mead, the director of Internet Operations at

ci2.net, posted a copy of the bogus spam to the group in its entirety

(including all header information). The header is the first part of an e-mail

message that shows the recipient in full detail how the message traveled over

the Internet before reaching its final mailbox.

By careful examination of header information, the ISPs traced back the origin

of the sending location e-mail. Spammers try their best to forge this

information in an attempt to hide their identity. ISPs are rarely fooled by

these tactics. Comments were offered by ISPs as they poured over the clues

contained in the e-mail headers and the body of the spam itself.

The spammer had left behind the user ID (identification) `vrchvr.' The trail

lead to a New Jersey website: www.dark-empire.com. A visit to the website

allowed the bloodhounds to view the source code (the raw HTML code that

generated the text and graphics). This revealed the author's name: óMETA

NAME="Author" CONTENT="Donnie Bielak"ò óMETA NAME="GENERATOR"

CONTENT="Mozilla/4.04 [en] (Win95; I ) [Netscape]"ò

Just a Kid

Ken Leland, president of Monmouth Internet Corporation, an ISP, was one member

of the fox hunt that brought the perpetrator to ground. The trail led to his

server. Leland shut down the account on December 17 without revealing the name

of the customer. It appears that the spammer was a 13-year-old kid. According

to an article covering this story in Wired News, the mother said: "My son is

13 years old. It looks like somebody is trying to get him involved in

something."

Right! The FBI was contacted to bring charges of on-line credit card fraud.

While I tried to follow up on this story, there is no further information

available on the Net at this time.

Be Wary

This incident is instructive on many levels. This spam/scam was amateurish.

E-mail requesting credit card information for any reason whatsoever should

flag a danger signal in every netster's mind. The brazen nature of a teenager

(or someone using his account) speaks to the disregard misdirected individuals

have toward users of the Internet. Frankly, some people unwittingly supplied

their credit card numbers.

The speed with which this scam was uncovered and eliminated was quick.

However, this type of scam continues to pop up on the Net. Be careful. If it

looks too good to be true, it probably is!

URLs (Uniform Resource Locators) of interest:

http://www.wired.com/news/news/tehcnology/story/9289.html

http://www.zdnet.com/zdnn/content/inwo/1219/265121.html

(This is the 89th of a series of elementary articles designed for surfing the

Internet. Next, "Cyber-booze" is the subject on tap. Stay tuned. Until next

week, happy travels through cyberspace.

Previous issues of Internet Info for Real People (including links to sites

mentioned in this article) can be found at http://www.thebee.com. Please

e-mail comments and suggestions to rbrand@JUNO.com or editor@thebee.com.)