A unique opportunity

By joining our community you will have the ability to post topics and access other forums reserved for members. Registration is quick, simple and absolutely free. Join our community today by clicking here.

Posted: Tue Jun 14, 2011 6:53 pm

One of my e-mail accounts I've been baiting with has been used for strictly ASEMs of insults for lads from the list on 419baiter.com. Somehow, a lad has gotten the password and now he's sending scripts using it. I haven't let on to him that I know he's using the account and he hasn't changed the password on me, so I was thinking I could keep an eye on him this way, try baiting the account with one of my other baiting accounts, as well as warn any potential victims. I'll let everyone know how it works out.

Sex-starved Tikka Masala Joined: 04 Mar 2011 Posts: 259

I'd make sure that he's not directing them to a different addy rather than having them reply to your catcher. Furthermore, there's no guarantee that he's not bombing boxes with your catcher then deleting them from both the sent and the trash folders. It seems like a slippery slope. Perhaps more experienced baiters can weigh in...

Posted: Tue Jun 14, 2011 7:51 pm

At first I thought it would be a cool idea, but I couldn't figure out where to go from there, so I decided to change my password, and hopefully the lad quits trying to use the box.

Posted: Tue Jun 14, 2011 7:53 pm

Hi chrisredfield. While this may seem to be an interesting situation I would suggest that you immediately lock the lad out of your box by changing the password. Check that the reply to address of the box has not been changed and that the prompt question and answer are reset to something that cannot be guessed. Having set up the box originally and not locking out the lad, you may be held responsible for some of the damage that a lad could do from your box. Contact a moderator directly if you come across any potential victims. By all means, continue to bait the heck out this lad from other bait boxes.

Edit to add- Ninja'ed by chrisredfield!

Posted: Tue Jun 14, 2011 8:40 pm

^^Ya, that's what I was thinking. At first it looked like it could be a cool way to bait the lad, but then I'd be responsible for any damage he did as well, so on second thought, I figured locking him out would be my safest bet. Who knows? Maybe I'll come across him again.

Sex-starved Tikka Masala Joined: 04 Mar 2011 Posts: 259

If you find a reply-to addy in your catcher from him, inbox him there telling him what a small boy he is.

Posted: Tue Jun 14, 2011 9:22 pm

Personally I would also try ascertain how he got your password...most mail providers are not tolerant of brute force attempts, so either you have weak passwords or perhaps you have a trojan.

Posted: Tue Jun 14, 2011 9:46 pm

^^ a lad building a back door to your computer? that's new to me

Posted: Tue Jun 14, 2011 9:52 pm

Who do you think writes the extractor scripts for the lads?
Scammers are the least of your worries on line, and if a lad magically gets in to your mail box, then you have weak security, whether its passwords, or a key logger.

Posted: Wed Jun 15, 2011 1:48 am

I use alpha-numeric passwords, but I did change the PW. I'm not sure what he was doing, though, because isn't it normal for them to change the passwords, then use the contact list to send scripts out? Either way, all he was getting was other lads, but still, I'm not a fan of some lad using one of MY accounts.

Posted: Wed Jun 15, 2011 5:33 am

did you have the mails in the sent folder?
because I also had a script going out on the pop3 of my chatcher account two weeks ago. But it was not hacked for sure. It is just a mail provider without a secure pop3...
without somebody who replied to the sender mail instead of the reply-to I wouldn't have noticed at all...

Posted: Wed Jun 15, 2011 7:48 am

@Chris
If there is traffic information that suggests that the mail actually originated from your box and was not spoofed, then your box is compromised, whether shitty mail provider, or your own security.

I honestly think it's important not to write these things off, especially under "lads don't know computer stuff", there are lads who do, I have had four this last week using tracking gifs, while it's not high brow it still breaks the mantra of "lads do not understand IPs". Besides lads, there are people who sell services to lads, as much as lads enjoy magic, the internet is not magic.

If someone got into a mail account, that I don't use for personal reasons, so I'm probably less likely to have clicked a facebook link or whatever, I'd be damned interested in how they got in, because I wouldn't want the same to happen to a personal account.

Quote:

because isn't it normal for them to change the passwords, then use the contact list to send scripts out

No, this would be a stupid lad or one whose scam has a short life span. As soon as he does this, you are aware and can take steps to warn people. If he is doing it with stealth, he has the box for a longer time.

Posted: Wed Jun 15, 2011 11:24 am

I just disabled the POP for the account and I checked the login history. So far I am the only person to log on to the account since I changed the password, so I think there's no problem. I noticed it because there were a TON of mail delivery notices in the spam folder, so I actually got to see the lad's script.

Posted: Wed Jun 15, 2011 11:43 am

Check the headers of those mails, to see if the mail actually came from your account, or was simply spoofed and the victims/lads did not read the instructions to contact at the other address. I once had a guy (non scammer) spoofing my personal gmail, and many people sent me mails because they had created brand new one not using "reply-to".

If you are using gmail, check the filters tab and forwarding tab to make sure he (or she) has not placed anything in there.

After all of this, if you still have a tinfoil hat (as I would) scan your PC in safe mode with your anti-virus, and check that no ports are open that should be closed, a very very long shot but still a possibility could be a root-kit.

Just a bit of UI for everyone, hackers will/do sell of compromised boxes for spammers/scammers, please don't always just brush it off with "scammers are stupid", you don't have to be paranoid, but it is a reality.

My firewall picks up hits from india and holland atleast 10 times a day, and all my ports are supposedly in stealth, and my AV up to date. Don't just bait safe.