"Tom Scales" <tscales@xxxxxxxxxxxxx> moved upon the face of the 'Net and spake
thusly:
> Wow, that's weird. I can't imagine this would really work very well, as the
> 'real' seller would also email the buyer. The name actually sounds
> familiar.
It doesn't have to work "well".
This kind of "semantic attack" could be automated on a large scale,
and if only one in a thousand buyers fall for it, then the creep still
turns a profit. It just relies on the seller taking, say 24 hours to
get around to emailing the buyer, whereas the con artist's automated
system emails the buyer immediately.
If *I* was a black hat, I'd forge the email so that it appeared to
come from the seller, but gave the miscreant's mailing address. Most
victims would never know.
The unique characteristics of the Internet makes frauds possible[1] that
would be wildly unlikely to succeed in meatspace.
--cjb
[1] A very good discussion of these issues can be found in Bruce
Schneier's recent book _Secrets_and_Lies_.
--
Christopher Biggs -- chris@xxxxxxxxxxxxxx -- Stallion Technologies Australia.
There's a bug in my mailer that mangles my sig but V guvax V'ir svkrq vg abj.
Uneqyl jbegu qrpbqvat, jnf vg? Rznvy zr "Fhowrpg: fraqctcxrl" sbe zl CTC xrl.
< This message was delivered via the Olympus Mailing List >
< For questions, mailto:owner-olympus@xxxxxxxxxxxxxxx >
< Web Page: http://Zuiko.sls.bc.ca/swright/olympuslist.html >
|