Online Scams and Phishing Scams

 I saw a post on LinkedIn about "pig butchering scams". What a magnificent term! I do feel sorry for the pigs. They're metaphorical, no pigs were harmed, though I wonder if there is some historic fake pork scam involved --- "a pig in a poke"?  Wikipedia defines these as "a type of long-term scam and investment fraud in which the victim is gradually lured into making increasing contributions".

According to the Tennessee Department of Commerce and Insurance  "It is one of the leading scams reported to the FBI and is still underreported."

This isn't anything new. I've seen similar things many times. It's been a while since I was last targeted personally but I've certainly seen the approach. What I found interesting about this, and the movie ""No More Bets" that this inspired, was the background of people trafficking to enable this. 

I've always wondered about the people that are the front end operators of these schemes. They know they're doing crime, or at least taking advantage of the gullible. And the prevalence of spam, phishing, advance fee fraud and all the other methods of capitalizing on people's gullibility  show that they work. Spam  is a big business. 

It looks like some of the people doing the work are doing it under duress. A bit like women being lured with fake jobs in bars or restaurants finding themselves in the sex industry, password confiscated. A less violent iteration of Taken, or the mega violent Rambo:Last Blood.  Distasteful.   

The more recent "Beekeeper" movie made the working scammers a bit more complicit and more directly involved in profiting from the activity. The call centres are shiny and new. Inviting even. Still distasteful, still preying on the gullible, careless, greedy, desperate or sometimes just unlucky. 

How many times do you see in the media someone who gets taken for everything who really ought to have known better. The Wikipedia article blames pig butchering for the failure of a Bank in Kansas, where the manager embezzled $47M to  partake in one of these scams. You generally assume a bank manager knows what he's doing. 

So two things from this: I have bad taste in movies, and you really really always ought to repeat, over and over, "if it sounds too good to be true, it isn't".  

1. https://en.wikipedia.org/wiki/Pig_butchering_scam
2.  https://www.tn.gov/commerce/blog/2024/1/31/what-is-a-pig-butchering-scam.html
3.  https://en.wikipedia.org/wiki/No_More_Bets
4.  https://en.wikipedia.org/wiki/Taken_(film)
5.  https://en.wikipedia.org/wiki/Rambo:_Last_Blood

 

NIST on Passwords. Some form of Sanity prevails

 A 'forever' frustration has been auditors demanding password expiry and bizarre password requirements. I usually just said "write down that I don't comply, and that I accept the risk". Mainly because the risk was lower doing it differently from the auditors.

Some of the requirements for passwords were derived from anecdotal evidence or applied military requirements to the average user. 

I've found that some of the most annoying complexity requirements have been imposed by sites protecting irrelevant assets.  My cinema club login password is more complex than almost anything else I use. But my popcorn credit is secure!

For some insight into how we got to the previous requirements, which were bizarre, read this https://www.riskinsight-wavestone.com/en/2021/11/the-evolution-of-the-nist-password-complexity-rules-a-mandatory-step-before-a-passwordless-world/

NIST in  "https://pages.nist.gov/800-63-4/sp800-63b.html"     now say:

Password Authenticators

Passwords SHALL either be chosen by the subscriber or assigned randomly by the CSP.

If the CSP disallows a chosen password because it is on a blocklist of commonly used, expected, or compromised values (see Sec. 3.1.1.2), the subscriber SHALL be required to choose a different password. Other complexity requirements for passwords SHALL NOT be imposed. A rationale for this is presented in Appendix A, Strength of Passwords.

Password Verifiers

The following requirements apply to passwords:

1. Verifiers and CSPs SHALL require passwords to be a minimum of eight characters in length and SHOULD require passwords to be a minimum of 15 characters in length.
2. Verifiers and CSPs SHOULD permit a maximum password length of at least 64 characters.
3. Verifiers and CSPs SHOULD accept all printing ASCII [RFC20] characters and the space character in passwords.
4. Verifiers and CSPs SHOULD accept Unicode [ISO/ISC 10646] characters in passwords. Each Unicode code point SHALL be counted as a single character when evaluating password length.
5. Verifiers and CSPs SHALL NOT impose other composition rules (e.g., requiring mixtures of different character types) for passwords.
6. Verifiers and CSPs SHALL NOT require users to change passwords periodically. However, verifiers SHALL force a change if there is evidence of compromise of the authenticator.
7. Verifiers and CSPs SHALL NOT permit the subscriber to store a hint that is accessible to an unauthenticated claimant.
8. Verifiers and CSPs SHALL NOT prompt subscribers to use knowledge-based authentication (KBA) (e.g., “What was the name of your first pet?”) or security questions when choosing passwords.
9. Verifiers SHALL verify the entire submitted password (i.e., not truncate it).