[Phono-L] OT - eBay Phishing

Loran T. Hughes loran at oldcrank.com
Sun Feb 3 07:52:40 PST 2008


Look, you're really just wasting your time by reporting phishing scams  
to eBay. All it does is make you feel like you've done something about  
it. eBay can't stop phishing any more than you can stop the wind. All  
they can do is try to shut down the web site linked in the phishing  
email. By the time they do that, it's already too late for a number of  
victims.

Here's how your email address got on the phisher's list. You sent an  
email to a friend. It's just that simple. Rewind 7 months - when your  
friend bought his computer, it likely came with a "free" 6 mo.  
subscription to an antivirus program. He didn't renew, then he got an  
email telling him that someone sent him an e-greeting card. He clicked  
on the link and unwittingly downloaded a trojan to his computer. The  
trojan scanned for personal information, including his contact list  
(that your email address is now on) and sent it off to a Russian spam  
gang. Then it recruited his computer into a huge botnet.

The spam gang collated a huge email list and sold them to other spam/ 
phisher gangs on the black market. Your email address is now in the  
hands of hundreds - if not thousands - of scammers all over the world.  
They don't know if you have an eBay or WaMu account, and they don't  
care. They're playing a numbers game - send out the scam to as many  
people as possible and you will reel some in. They buy time on a  
botnet, inject their scam, and your friends computer - along with  
thousands of others - starts grinding out phishing emails to the  
masses. A few of the computers in the botnet host the fake web site  
that's linked in the email.

Botnets use sophisticated software - if you cut off the computer that  
controls the botnet, control just switches to another computer. It's  
like playing "whack a mole," and ISP's do little to cut off infected  
zombie computers.

What can you do? Other than changing your email address every couple  
of months, the best option is to use an email service with a good spam  
filter. One of the best out there at the moment is gmail.

Most importantly, keep your antivirus updated! I'll get off the  
soapbox now.

Loran


More information about the Phono-L mailing list