USPS text scammers duped his wife, so he hacked their operation

Hilarious. Exposing an LFI to view things like /etc/passwd and server logs, and a SQL injection in a PHP stack… I prob wrote code like this, when I was a 15 year-old self-described “webmaster” in 2002.

Actually, I’m not that far off.

> The creator is a current computer science student in China who is using the skills he’s learning to make a pretty penny on the side.

Very informative! I tried doing something similar to these sites months ago after getting multiple text messages from them, but didn’t really get anywhere. Very cool to see a professional walk through what they did!

It’s much more than people “just losing some money”, anyone who ever had anything stolen from them, or have been broken into can tell you that.

I’m speechless that they were able to reach that number of victims without consequences. Reeks of a lack of oversight, will, power or coordination on behalf of the investigators. I wonder which reasons they give.

Gifting a bit of existential fear to those scammers might not hurt, since they force it on thousands of others.

Scamming is partly intense psychological violence, and its financial and psychological consequences are far reaching, and here at an unfathomable scale – an entire city of people! In this sense they terrorize people. And they should likewise be relentlessly pursued and sentenced as a consequence. That city would go to war against them if they were one.

But yeah, i don’t know, maybe we need a new word for such criminals. The superlative for murderers is “mass murderers”. “Mass scammers?”

I recently came across NanoBaiter on YouTube. He baits scammers and hacks their systems, often disrupting their entire operation.

He identifies the culprits in detail, scares the hell out of them, reports them to police, and tries to inform / refund the victims. In at least one video, he accesses the scammer’s Stripe account and refunds the victims (often elderly) for their payments on bogus IT security products. I recall another video where gains access to the CCTV in the scammer’s office building, and captures a police raid on the scammers.

https://www.youtube.com/@NanoBaiter

Noticed the salt used for encrypting password, in the writeup?

“wangduoyu666!.+-“

Whoops, this looks like username -> wangduoyu666
(same for “wangduoyu8”, “wdy666666”. Seems like they’re incrementing numbers in username too, but probably false positives, maybe popular username)

Google it. Probably skid’s github, linkedin, etc. (not verified)

And looks like OP missed this.
Also name on telegram is fake of course, Wang Duo Yu is singer in China, so skid is using singer’s name as username and also as a full name in Telegram.

Ps.: From their backup telegram, also “wangduoyu12”

Ps2: From OP write up -> https://t.me/wangduoyu0 -> there is youtube channel https://www.youtube.com/@duoyuwang4820 which links in description to this telegram channel wangduoyu0

And it’s full of videos of someone making tutorials to bypass china firewall? etc. Multiple 30min-1hour videos, there must be treasure trove of info.
Videos is leaking these gmail accounts:
https://i.imgur.com/LUiKbF6.png

How do you know these are all the same person, instead of different people with the same name, or independently using the name of a singer they like?

> The Smishing Triad network sends up to 100,000 scam texts per day globally

This should not be possible. I guess the iMessage scams used e2ee, but the SMS scams should have been caught. It would be great if there was law enforcement that competently handled cybercrime, or at least triaged it.

More broadly, and at the risk of creating another TLA, the US needs a Blue Team version of the NSA. In other words, identify critical infrastructure, figure out how it can be hacked, and require that companies fix the issues. Use national security if need be. Banks have to undergo stress tests to prove they are solvent, there is no reason that critical infrastructure should be able to leave their doors unlocked.

Did he? He said:

>It would be great if there was law enforcement that competently handled cybercrime, or at least triaged it. (emphasis mine)

I’m not sure CISA fits that definition.

Spam filtering for SMS is still not particularly broadly implemented by network operators apparently.

I remember during Covid there was a few startups in that space trying to work with MVNO’s to get a foothold in the market, but don’t think any of that went anywhere.

I get 5-10 SMS messages a day filtered by Verizon’s anti-spam (still get notices for each though).

These days they are mostly political pleas, which are, ironically, in some semi-protected gray area. Haven’t noticed any USPS-related ones lately, but a few have gotten through in the last few months.

I can vouch for this. There were a myriad of cases I brought to my boss, the director of operations for a major wireless carrier that was absorbed into another one that still exists. “They are paying their bills, right?” was all I could get. I had text messages scrolling on my desk in a different workspace all day. Agencies would have me grep for homicide threats between gangs but that’s about it. I was not only required to support spammers and scammers, but also required to make sure everyone’s messages got through quickly, including those that were overloading my gateways from SS7 links controlled by obvious scammers. I was not allowed to get the hicap folks to decom nefarious SS7 links. This was a long time ago and I doubt the situation improved.

Works the same way as old-school junk mail. Your postal service gets paid well by junk mailers to put trash in your mailbox, so they’re disincentivized to fix the systemic issue. I can’t find a good quality source on this, but it’s been said that about 45-50% of USPS & Canada Post’s revenue comes from junk mail. They could fix it, but it would probably lead to a collapse of the entire post system due to revenue shortfalls. A true tragedy of the commons.

I was pissy one day after my mailbox was so full the mail carrier say it in front of the mailbox and I came up with a solution I haven’t tried — return to sender!

This would decrease their profit per-item by 1/2.

Key piece tho, are you able to return pre-sorted mail to sender?

> I can vouch for this. There were a myriad of cases I brought to my boss, the director of operations for a major wireless carrier that was absorbed into another one that still exists. “They are paying their bills, right?” was all I could get.

I would have loved to ask him if he’d do business with Stormfront or ISIS as long as they were “paying their bills.” It’s not just the top of the food chain, these middle managers are all morally bankrupt, too.

I can’t comment on ISIS and their ilk but I can say that wireless companies absolutely love drug dealers unofficially speaking of course. They pay cash, pay on time and always keep their accounts active. Some have multiple phones. A disabled phone is lost revenue.

> Agencies would have me grep for homicide threats between gangs

As an aside, it’s terrifying that our texts can just be read and mass processed like this.

I’m sure, in the general sense, this information isn’t used for evil. But certainly I think it can be, like those Ring Doorbell employees who used their access to stalk their victims.

The case for secure messaging services only grows stronger, even for the innocent.

I guess we have to choose our poison. If the chat is RCS on both ends then it’s Google or Apple reading the text. I don’t buy any of the E2EE marketing. Some time force your phone onto LTE over Wifi and watch who it is talking to. Even with RCS every keypress on Android at least goes to the wireless provider over a VPN tunnel for spell check. I found it still does this even if I disable spell check, just less. If it’s plain text messaging then it’s still plain text over SS7 and the wireless provider can see it in their messaging gateways. I just assume any messaging sent over a phone insecure.

I’m sure, in the general sense, this information isn’t used for evil.

Maybe. I do know there have been cases of people bribing lower tier support in wireless providers to do SIM swapping. I don’t know how often this occurs or how often they get caught. Things are logged but someone would have to know to look at the logs. I’ve also heard that employee churn is high in support so they might be long gone by the time anyone looks.

Congress is hearing complaints and so getting interested in this. Thus providing incentive. Of course the incentive to carriers is to stop the scams congress will be interested in, while allowing the rest.

> The creator is a current computer science student in China who is using the skills he’s learning to make a pretty penny on the side.

There’s a strong argument right here for teaching technology ethics as part of a typical CS curriculum. I’m not saying that would have stopped this student from making his own unethical choices, but it does highlight the fact that we equip people with these really powerful technical skills, but we don’t even try to equip them with the ethics to be responsible about it. We just sort of hope they were raised right, I guess.

Anyone here have experience with a curriculum that includes the ethics aspect?

In high school (over 2 decades ago), I figured out how to crack the school security software (and obtain its master password, thank you Windows swap file!) and after doing so, I installed a keylogger on the school library computers. I got access to dozens of email accounts, instant messaging accounts, etc. I’m self-taught all the way. In fact I dropped out of high school junior year with a 1.76 GPA. I knew what was right and wrong, but not yet mature enough to fully grasp the harm it does. I don’t think any sort of ethics teachings would’ve changed anything.

Similar story here, though at a smaller scale, and with a better educational experience. I remember distinctly talking to my mom about the ethics of hacking, and my viewpoint at the time was – in the parlance of kids today – cringe.

My lesson came while ARP poisoning, when I saw that a teacher was using their social security number as their password.

Suddenly I realized even dumping passwords was an invasion of privacy, even if I didn’t use them. And that passwords should never contain sensitive information!

All ABET accredited programs are required to include ethics and have been required to do so for over 15 years.

We explicitly learned about voht IEEE and ACM code of ethics for example (though this was not the only thing we discussed) . We were even tested on the difference. I’m always confused when people don’t even get the baseline ethics training.

Yeah we all had to take it at Portland State because CS was ABET. Was kinda surprised to learn it wasn’t a standard CS requirement everywhere.

There was also an ethics module in one of the massive pre-weed out 100 level courses.

The ethics classes I took delved into what good and wrong are, different ways to look at things, and a whole lot of debate about the concept of ethics itself (i.e. reading old works of philosophers, including some of the weird racist ones, understanding their take on the world, and reflecting on the shifted ethical perspectives, but also lively discussions within the classroom). Everyone already knew “stealing from the elderly is bad”, so things were more focused on “what are the ethical reasons to restrict free speech” and “applying different ethical points of view onto a subject”.

In the end, ethics courses only teach you to be conscious about your actions and learning how to convince others that you’re ethical. An ethical person can easily pass an ethics exam. All of that knowledge, and being raised by good parents, do not completely prevent someone from becoming a criminal.

If you can set up a reasonably successful scamming business on your own as a student, you can earn enough money to move to the countryside and never need to work another day in your life, as long as you can manage to hide the money from the authorities. Or you can spend it all on drugs and other short-lives pleasures, like so many criminals do.

Cybercrime targeting vulnerable people is laughably easy and extremely lucrative. Hearing about how hard some people’s lives are because of their student loans, I’m a little surprised this stuff doesn’t happen more, really, especially with the growing resentment the younger generations seem to feel for the bad hand they’ve been dealt by the older generations.

Clearly you don’t understand Chinese mindset, do you think he has no ethics? He has a lot of ethics, because he wouldn’t dare to hack Chinese citizens, we know why 🙂 but everyone else (except Russians, of course) are open-season for them.

> He has a lot of ethics, because he wouldn’t dare to hack Chinese citizens

That has to do with fear, not ethics; the consequences of getting caught doing this to Chinese (vs foreigners) are significantly high (you do not f*k around with a system that has no due process)

Can you be prosecuted for hacking cybercriminals back? Because I am pretty certain that you, if you had something stolen from you, are not actually allowed to break and enter the thief’s house, take your stuff back and leave, and you’re definitely not allowed to make a copy of keys for their locks while you’re at it.

It’s pretty grey, there’s the computer abuse act or w/e. But it’s quite selectively enforced.

I don’t the US gov is gonna go after him for hacking a scam group AND he provided details to the authorities. Now, if he hacked them and used the stolen credit card details? Who knows.

> hacking a scam group AND he provided details to the authorities

So cyber-vigilantism is technically illegal but the authorities will tacitly pretend it is not, when it suits them fine, probably.

It’s almost as if the proliferation of stories like “the district prosecutor found no grounds to open a hit-and-run and DUI case against the young man who just so happens to be the son of the local MP/mogul” makes people disappointed in their government, law-enforcement agencies, and the political system in general.

If not, then why do those laws exist? Either we’re ok with those sorts of actions, and we should repeal the laws, or we’re not, and we should enforce them, equally and universally. Anything less leads to biased enforcement.

I say no, but I’d also prefer laws that are more written for more specific application. If a human can make the call that “it’s not right to apply this law here; doing so would lead to more lawlessness,” so can a penal code. And giving much discretion to the humans enforcing law leads, more often, to undesirable outcomes (eg. “by random chance wink wink, this law only seems to get enforced against Black people”).

Sure, I’d be all for removing a huge chunk of laws that exist today. In the meantime I don’t think anyone actually wants every law to be enforced every time it is broken. Our legal system would grind to a halt.

some times its even endorsed like when the government just let Microsoft take control of the No-IP’s domains a few years back because. despite the fact Microsoft didn’t have any standing and just decided they were internet sheriff. I was a customer of No-ip at the time had Microsoft just black-holed the routing of everyone myself included because some users were using their dynamic dns service for malicious purposes

Who are they going to call, the cops?

(This is also why criminals tend to seek illegal firearms; self-defense from other criminals is a more salient issue than it is for the average citizen for this reason.)

I’ve learned to leave hackers and scammers alone; no matter how much they piss me off.

Most of them are quite capable of delivering a nasty counterattack. Some, IRL.

Had a friend hack a spammer that hijacked his server, and they blasted his server into LEO.

definitely this..you are messing with a group of folks, and potentially stopping their flow of money.
unless you have great opsec, you may just cause problems for yourself you dont want. personally never heard of it escalating beyond online attacks, but it’s not worth the drama imho

We have a lot of progress under the form of STIR/SHAKEN. Now it doesn’t prevent all types of spoofing but it makes the calls traceable back to the originating carrier.

What happens is scammers get numbers with small carriers who interconnect with major ones. Eventually the reputable carriers notice spam from these smaller carriers and start dropping their calls (or banning them altogether). So the smaller carriers decide whether they want to see their legitimate traffic dropped or just ban the offending users (which is eventually what ends up happening). Scammers end up hopping to a different carrier so it’s a cat-and-mouse game, but it’s a lot more expensive to play now than it was with simple number spoofing.

In parallel, numbers are starting to get reputations attached to them, similar to IP addresses. Some filtering takes advantage of that.

Of course, spearfishing can continue unimpeded with someone buying a prepaid cell phone and using that to call a specific target. 🙁

https://transnexus.com/whitepapers/understanding-stir-shaken…

At least for people in the US, the solution is simple: make internationally-sourced communications opt-in. By default any calls or texts originating from a non-US carrier will be dropped. Then, any spam coming in must be from a US entity, and can be investigated & prosecuted. People who do need to receive internationally-sourced communications can turn it on with their carrier. While they’ll still be at risk of receiving spam, the value of sending that spam in the first place will go way down because the vast majority of it will just get dropped. It’s an easy solution, and it solves call/text spam for everybody.

I’m reasonably sure that countries like France will sign a treaty to not allow spoofed numbers in this way. They don’t want to be a source of scams anyway and so will do their part to prevent them. The details of this matter of course, but France should be an easy automatically opt-in. (I picked France because I can spell it, there are several dozen others that I’m confident can be in the automatic opt-in list as nothing from them is a scam)

I have never once got a spam call from an international number, just local numbers. So your plan doesn’t work when some local proxy is happy to take the traffic.

A lot of the time spam calls might look like they’re a local number, but they’re just manipulating caller ID. Often the actual call can originate anywhere on the planet and look like a local number to you.

Up until very recently, caller ID was stupid easy to spoof if the originating phone company didn’t care.

Until recently I would get spam text messages from my own cell phone number. Telecommunication companies are complicit in all of this for allowing phone number spoofing. As long as they make money I guess it’s OK for them.

> AND force operators to filter out scams attempts.

How do you expect that to be implemented without requiring them to read everyone’s texts (requiring either no encryption or a backdoor) and judge their worthiness?

This works great for e-mail…

Actually…

Doesn’t it now take a significant amount of effort to get a valid company e-mail whitelisted by the incumbents exactly because of this and yet I have received multiple emails today about diplomatic correspondence…

… and create a new opportunity to do a denial-of-service attack on any person by reporting her phone number as a source of unwanted calls. If the reporting happens via a web page this DOS attack can be automated and sold as a service.

Yeah, I’m not sure why but a lot of comments here tend to go down the “governments must stop this with law enforcement” route when there is probably much better ways to do this technically without forming international task forces.

Sure, but the Telcos seem perfectly fine with taking the monies from the scammers until they are forced to do something.

I mean, it’s validly been 25 years since I received my first scam text and I still sporadically get them once in a while.

I don’t want an exception – there is too much potential for someone innocent to be framed and attacked. I want the FBI and CIA to be given more funding to track this down. Sometimes the CIA will need to attack scammers like this because there is no diplomatic option, but not random people outside of them. (The FBI being limited to the US should take everything to court)

I used to get frequent iMessages that look just like this, except with links to a different domain name. Last one was July 21, linking to https://us-usps-mg.top/us

Seems it’s no longer active. If I send “Y”, the message is not delivered. The domain points to 404 on a “King Ice” website selling jewelry shaped like guns or penises, I’m not joking.

What’s quite interesting about this is the iMessage integration, as this is a good example that directly contradicts Apple supporters claims on this very site.

I wonder if these are the ones I constantly get saying I have a package at USPS and they need info but the texts all originate from an international number, so they are obviously fake to me.

When I have the time, I like to script an attack on phishing sites by posting false data. The idea is to fill their databases with trash, and make it more difficult for the criminals to weed out real data entered by victims.

I almost did this the other day when I got a fake Docusign phishing email. Unfortunately, I found that the webpage it led to was sending collected credentials to an apparently innocent but hacked third-party wordpress site, which I assume forwarded the info elsewhere. I didn’t want to waste the third party’s bandwidth so I used their contact form to explain the situation. Didn’t expect a response, but I just checked and they fixed it!

Amazing over 400K people entered their credit card information.. mind boggling to me yet like all to most of us here we just about ignore every phone call and text message not from someone already in our contacts.

I always thought there should be a driver license and test to use the Internet to cut down on people being ignorant. As well or a class you must pass in high school that teaches ignore all phone calls, text, emails and etc from people you have not met offline. If you do meet them online make them snap or facetime you fairly quickly to verify veracity.

I broke into VT-100 terminals (the real ones, not the modern terminal app derivative) at my university library over 40 years ago.

Can’t tell you how, it’s been a minute.

Heres my off the cuff take on law enforcement not going after scammers to the fullest extant that I think we can all agree they should…

The US has roughly 340 million people now.

The US gdp is roughly 28 trillion dollars.

Which means that on average the dollar value per citizen is roughly 82 thousand dollars…

Divided by days in year, hours and minutes its roughly 15 cents per minute.

So if we assume 100% of the population is getting at least one scam a day of some sort and that the disruption to thought to get back on track as result of the anger induced is about 30 minutes…

That puts the loss to the US at little over 1.5 trillion dollars in lost productivity.

The US currently spends roughly 840 billion on defense…

So almost twice the yearly national defense budget is potentially lost to scams.

Seems crazy, as I said off the cuff. I would love to see some way more accurate numbers.

But arguing in dollar amounts I think will go a long way to putting the problem in perspective. And who knows, maybe we’ll get to some drone strikes on scammers in our lifetime.

It’s illogical to calculate the thing you are looking for, but lets run with it just for the sake of it.

Let’s go with your “one scam a day”. The person then has to see it, choose to read it and then act on it (delete/ignore/get scammed). Not even considering the practical effects of receiving 4 before lunch, and none getting past spam filters the rest of the week.

Then you come up with 30 minutes for each individual scam? If it evens goes trough the above mentioned phases, nobody is non-profitable for a full 30 minutes, for every scam attempt, every single day of the year.

Using your 15 cents per minute, we could stick with just a minute of lost value. That translates into 340 000 000 * $0.15 * 365 days = 18 billion.

Still a totaly useless number because it’s impossible to measure, but at least much further from ‘ridiculous’ than 10% of the GDP you came up with.

I hate that it kicks off with “DISCLAIMER: This is not my work. I would never and don’t condone illegal hacking of scammers”

You know what? I do. We all should. These scammers are awful people and deserve to be attacked. I am tired of toothless authorities like CISA and the alphabet agencies in the US doing next to nothing about it unless some YouTube scam baiter does the work for them. Scammers destroy people, not just financially, but emotionally as well, even driving some victims to suicide. As far as I am concerned, any wannabe hacker out there should be using these scammers for target practice.

Disclaimers exist for legal reasons, not for moral ones or a personal opinion.

I think we all agree that hacking scammers is a net positive for society.

I don’t think disclaimers really work. I think it’s just urban legend that they do.

I find it hard to believe if some scammer is hacked and the evidence shows the hacker learned everything from solely this video then this disclaimer won’t mean anything legally.

I think disclaimers are just a bit of noise that people put in out of an abundance of caution.

Disclaimers can be shown in court if it comes that far. If you seem to be an expert on something but make a mistake you can get into trouble for practicing (law/medicine/…) without a license. By putting in a disclaimer you make it clear that while you seem to know something you are not claiming to be an expert which can protect you. If you actually are an expert it is even more important because someone might take your generic advice as specific even though there is some complex detail about their situation that makes it not apply.

Most of the time this won’t matter. People and courts generally know advice isn’t to be trusted, if this goes to court it will probably be laughed out before they even see your disclaimer. However since there is trusted advice on the internet and courts/the law hasn’t figured out where there is always risk and a disclaimer helps protect you against the court deciding you were playing an expert.

Of course I’m not a lawyer, I’m only guessing as to what will happen. I’m reasonably sure no lawyer will comment on this for reasons above.

Out of curiosity, are you a lawyer or is this comment missing the IANAL disclaimer that is customary when opining about legal matters?

At least some disclaimers aren’t just noise—they add context that would otherwise be missing to help the reader navigate the subtext. The “this is not my work” portion of that disclaimer is highly relevant and useful information for interpreting the blog. The afformentioned IANAL disclaimer helps readers to understand whether your opinion has any stronger basis in law than their own.

I also strongly suspect that some disclaimers would have legal value in the event of someone misusing information being dispensed, but IANAL.

When a lawyer posts on a forum topic related to the law they usually tell you they’re a lawyer, but not your lawyer and it’s not legal advice.

Safe to assume everyone else is not a lawyer.

Probably safe, yes, though it’s still polite to leave the marker for other people to follow later.

And, to the topic at hand: if lawyers consistently do that, that again speaks to the legal value of at least some disclaimers.

Appeal to authority is considered a courtesy nowadays? Fascinating.

Like the previous commenter points out, actual lawyers are quite clear that their statements in this kind of non-professional capacity hold no more weight than any other random Joe. There is no situation of authority. IANAL/IAAL may have once been a funny meme – albeit one quite tired at this point – but doesn’t add anything, and may be a detractor if one falls prey to the logically fallacy it potentially introduces.

Concluding that a statement holds greater significance because it was stated by an expert === appeal to authority. The person is irrelevant. Just as lawyers regularly point out, their work done outside of a professional context is no different than work done by anyone else. Their expertise is only significant in that when work is done in a professional context they promise to go over and above to put in the proper care to ensure that the work stands up to scrutiny. But even then the work must stand alone! They cannot just throw down whatever gobbledygook and call it something notable just because they are acting as a lawyer. The person is irrelevant.

As before, it used to be a funny meme – albeit one that has become tired – but there is no significance to it. Who the person is tells absolutely nothing about the rest of the comment.

> Just as lawyers regularly point out, their work done outside of a professional context is no different than work done by anyone else.

This is not at all what “I’m not your lawyer” means—that’s a disclaimer to say that they’re not taking legal liability for their advice to you because you’re not paying them. They’re still far more qualified than I am to talk about law in the abstract and dismissing that as “appeal to authority” is a false appeal to egalitarianism.

> They’re still far more qualified than I am to talk about law in the abstract

While they have the capacity to be more qualified to talk about the law, that does not imply that they will choose to exercise those qualifications. Lawyers can be trolls just like everyone else.

The work must stand on its own. If it is of high quality, then it is of high quality. It does not matter who wrote it. If an infinite number of monkeys wrote it, it is still of equal value.

The person is irrelevant.

I am not a lawyer, but didn’t include the disclaimer because I don’t think it’s relevant to my comment.

Even were I a lawyer, it should carry the same weight. Some random, kind internet stranger sharing ideas.

I think it distracts from the conversation as I wasn’t giving legal advice but just thinking about how useful and relevant disclaimers are.

The comment is more about too much bullshit language used in our lives, so I think minimizing (or at least intending and attempting to) bullshit in my own comments is something I can control.

Until we find out later that the scammers masked themselves using someone elses identity and they hacked an innocent person.

We have all received email from a legitimate place where a scammer uses your email to spam and then legitimate company thinks your email sent it.

I don’t because some scammers will find ways to frame their enemies. If you attack the person/organizations doing the scam fine – but don’t attack an innocent organization. Most of vigilantes are not careful to tell the difference.

Exactly! People are not trained in gathering and interpreting evidence. And when they are “investigating” something that is personally affecting them there is probably even greater chance of them jumping to conclusions and acting rashly. Emotions will cloud judgement. And judgement was lacking in the first place because they are not trained in how to investigate matters and they are not familiar with tactics that criminals use to make it appear like they are someone else.

Several years ago when I still had a Facebook account there was a guy that DMed me yelling at me and accusing me of trying to “hack him”. His evidence? The reverse DNS record for a server was pointing to a domain I owned. I replied and told him the reverse record was out of date. I had previously rented a VPS with that IP address and I had had the reverse record point to my domain. I had since cancelled the rental of that VPS and now the hosting company had assigned the IP to someone else. Apparently the hosting company had not bothered to remove the reverse DNS record from their systems so it was still pointing to my domain. The guy that was yelling at me was of course too stupid to understand this when I explained it to him so I gave up on trying to educate him and blocked him from being able to send me any more DMs.

Now imagine if this guy had started a full-on retaliation campaign based on his misguided “evidence”. Luckily for me I never heard or seen from him again.

But yeah, that kind of thing is exactly why “vigilante justice” is such an incredibly dangerous and stupid idea.

Yes, that is true as well. I wrongly assumed that just like how I expect the VPS host to safely overwrite storage of when the VPS is deleted/decommissioned that they would automatically remove PTR records from their DNS servers relating to that VPS. There is, after all, absolutely no reason why they shouldn’t delete the PTR records that a customer created for an IP address when that IP address is no longer in control of the customer. But indeed the whole ordeal would have been avoided had I myself gone and deleted the PTR before I removed the VPS.

back around 2007, the scam: “send you a check for a mistakenly huge amount and ask you to refund the difference” was in full swing. In their email they said they’d overnight a check, and I thought “good, overnight shipping is very expensive, at least if I scam them I’m costing them $20 in fees”, but no. Brought the envelope to a friend at UPS, he gave it to their fraud department, and behold the letter was sent using a stolen corporate shipping account. Maybe I helped by getting that account shut down, but I also ended up costing them money.

> These scammers are awful people and deserve to be attacked.

Some of them are being held prisoner and are being forced to run these scams under threat of torture. There was a Search Engine episode about this in the last year.

The problem with John Oliver is that his stuff can be really good, or it can be incredibly one-sided and inaccurate, and the viewer can never tell because his over the top style just kind of relentlessly overwhelms you and is engineered to elicit strong emotions. It’s good entertainment but as an informational source his show is very fraught.

It’s not a karma thing. It’s a basic desire to play well in the community.

I’m quite aware that not everyone is on the same page, and this just helps to indicate a basic respect for others that may not like him.

As you can see, that didn’t actually work, as just the mention of his name, got a ding.

This was 100% apolitical. A lot of his stuff is, and his team really does their homework.

The stuff he says before the main story, tends to be quite political, but the main story, itself, is often apolitical.

Do you think the slaves would be happy if you set fire to the awful enslaver’s cotton field while they were working?

Some might, but it’s their choice to make, no yours.

vigilantism can spiral out of control. While it makes sense in this scenario, it’s because the scammer is obviously breaking some law and is criminal. What happens if it wasn’t so obvious?

The parent commenter said “pursue and punish”, not “put in jail”.

There are other forms of punishment besides jail time. But really I’m more concerned that the scam organization is shut down, even if the main scammer isn’t put behind bars. If nothing else, it’ll slow down and reduce the scams.

Fair enough. Maybe I’m splitting hairs here, but at least in the US you will almost certainly spend a bit of time in a jail when being charged, booked, and arraigned.

Given that we’re talking about legal, rather than extra judicial, pursuit and punishment I would expect jail to be a part of that process.

We deem vigilantes criminals because we have no way to hold them accountable if they infringe on someone’s rights.

Society is supposed to take an active role, but sometimes they have other priorities.

Big companies getting hacked or scammed make headlines and generate FBI action. People like me, not so much.

Unless I’m mistaken, we vigilantes are deemed criminals because it is, ironically, against the law to enforce the law on someone else without being granted that authority by the state.

Its still not quite accurate to deem vigilantes as criminals though. Unless they’ve been charged and convicted they aren’t technically a criminal.

> it is, ironically, against the law to enforce the law on someone else without being granted that authority by the state.

Not sure why that’s “ironic”. Seems reasonable. Only people trained and accountable should be doing things that would violate people’s civil rights and take away their freedom or possessions.

Obviously the reality of our legal systems fall far short of ideal, but IMO vigilantism is not the answer to that.

> Its still not quite accurate to deem vigilantes as criminals though. Unless they’ve been charged and convicted they aren’t technically a criminal.

You sound like the kind of kid who would put their hand an inch from their sibling’s face and constantly utter “not touching! still not touching!” and think that you were “technically” not breaking the rules, so your behavior was ok.

> Not sure why that’s “ironic”. Seems reasonable. Only people trained and accountable should be doing things that would violate people’s civil rights and take away their freedom or possessions.

Maybe ironic wasn’t a great fit there, I stand by the rest of the comment though. I blame Alanis Morissette for my inability to recognize irony accurately.

> You sound like the kind of kid who would put their hand an inch from their sibling’s face and constantly utter “not touching! still not touching!” and think that you were “technically” not breaking the rules, so your behavior was ok.

There’s a legal definition of “criminal”. Is it being an annoying little brother to think definitions are important?

Just realized I had a very meaningful typo in the last comment and its been to long to edit.

I meant to say “the vigilantes” not “we vigilantes.” I don’t take part in it and don’t condone it as long as we collectively agree to live under a legal system.

I agree with you though, vigilantes are imposing “justice” on innocent people. The right to a fair trial and a jury of your peers is a really important check on power. Vigilantes skip that whole process.

That only works if you aren’t in a:

Anarcho-tyranny

A stage of governmental dysfunction in which the state is anarchically hopeless at coping with large matters but ruthlessly tyrannical in the enforcement of small ones

https://m.wikidata.org/wiki/Q64594123

Then you get your door kicked in for not paying taxes on $50 venmo transaction, or saying the wrong thing online but when there is a school shooter (or presidential assassin) the cops wait for them to finish while they play with their phones.

While it is true that the justice system is often used to disproportionately hurt the poor, nobody is getting their door kicked in for not paying taxes on a venmo transaction.

Civil asset forfeiture is indeed horrible and often used to basically just steal from the poor. It is also totally different than having your door kicked down for failing to pay taxes or being arrested for saying the wrong thing online.

Sure, but it does match the GP’s point about tyrannical enforcement against small violations. The examples GP provided weren’t apt, you pointed that out, I’m providing another one.

Red light ticket revenue funding small town budgets is another. Brake-light rationales for traffic stops…I could go on.

The key is what you pointed out, that these are never used against the elite class.

thanks for that example, it really paints a picture of the impotence of the state, tho watching the video it’s easy to blame the failure on the hundreds of individuals that didn’t take action, but they are meant to be the vangaurd; we handed the monopoly on violence to these people and for what?

Precisely correct. People have a natural right to receive justice, so IF the government abdicates its assumed responsibility to provide justice people have every moral and ethical right to enact justice themselves.

> People have a natural right to receive justice

There’s no such thing as a “natural right”. Rights are granted, not innate. In the US we might think freedom of speech is a “natural right”, but go to a country that doesn’t have that, and you’ll see how “natural” it really is. (And hell, even in the US, free speech rights are curtailed all the time.)

> IF the government abdicates its assumed responsibility to provide justice people have every moral and ethical right to enact justice themselves.

I don’t agree with that. Look at how (for example) the 1800s in the US west looked when it came to so-called “justice”, when the government wouldn’t or couldn’t prevent or track all that much crime. That’s not a world I want to experience.

Other countries violating rights doesn’t mean those rights don’t exist. I speak of natural rights and not legal rights for this reason.

And not that I have not denied the negative consequences of vigilantism for society as a whole. Those consequences are the reason governments are supposed to seek justice in a more orderly and accountable manner. It is when governments renege on that responsibility that they bare the blame for the consequences, as people seek justice on their own (because they know justice is their right and will seek it themselves if nobody else will for them. This innate understanding of being entitled to justice is the proof that a natural right to justice does exist.)

People with every moral and ethical right to enact justice are the types that can acquire clearance and join various authorities in the pursuit.

Vigilante’s don’t abide by the laws so aren’t well positioned to dispense justice in a non hypocritical way.

Maybe carve out a low level clearance that gives grey hat types a little room for counter red team activity.

People have a duty to defer the enactment of justice to the government only if there exists a government which fulfills their end of the deal. If no such government exists, then people are ethically and morally free to do it themselves.

A government which is effective at prosecuting phone scammers? That government doesn’t exist in America. Victims who turn to vigilantism are therefore justified and the negative consequences of this are the responsibility of the government which is neglecting their duty to victims.

As much as I want to agree with you and become a beekeeper I still see holes in reasoning. Governments have prosecuted a number of sim swappers and sms scammers. They are not effective at doing this at volume in my opinion but that can be argued.

I never read any comic book, sorry..

In absence of a government willing or able to enforce laws, vigilantism creates a public pressure to fix the government. Either way though, people are entitled to justice. If the government doesn’t provide it, then the government is responsible for the harmful consequence of the resulting vigilantism.

Then society would quickly condemn the vigilantes. Vigilantism works precisely in those cases where the criminals being persecuted is obvious. It seems to me that there is an optimal amount of vigilantism and it’s greater than zero in those rare cases where there is a person skilled enough to carry out the retribution.

If we’re going to invoke “vigilantism” (as opposed to notions of
reasonable and proportionate self-defence) let’s acknowledge how
U.S. American culture at least in the 80s and 90s is drenched in a
deep love of vigilante justice… The A-Team, Knight Rider, The
Equaliser, even Batman! Who doesn’t dream of a secret base inside a
mountain, filled with surveillance gear, an anti-crime computer and a
personal Apache attack helicopter waiting on the pad to rain fire down
on miscreants?

Let’s say that’s more than just individual morality but a concrete
cultural relation to wealth, power, justice and social contract of the
state.

The trouble with vigilatism is that it involves a usurpation of state authority that one does not possess. State authority can be deputized under certain conditions, of course, and self-defense is an example (I can shoot someone trying to commit murder, for example; or consider citizen’s arrest), but it isn’t arbitrary and isn’t vigilatism.

Of course, when the state demonstrates a dereliction of duty and becomes feckless in its ability to punish criminals in proportion to their crimes, this creates outrage and a strong temptation to engage in vigilatism. The state then shares responsibility for the resulting vigilatism.

People who are the victims in a controlling relationship will usually say things that the controller wants them to say, even when the controller is not there. Ask me how I know.

I can well believe it, and my sympathies to you.

Hopefully the suggestion gave them an idea to reflect on later — I don’t know of anything better that can be done when on the receiving end of a phone call.

I think you’re probably right. I came to the opinion a while ago that one of the very best things you can do to help someone who is a victim of a controlling relationship is to tell them things that are indisputably true in such a way that they can ignore you if they aren’t ready to hear it or are unable to respond, but so that their mind will have something to chew on and slowly form the roots of a rediscovery of truth.

This is what I did with a scammer. He kept rationalizing his theft, claiming he’s just taking “a little” from many people who are well off and wouldn’t miss it. Of course, not only is that bullshit, but it wouldn’t justify the theft even if it were true. I appealed to his conscience, sternly, and didn’t give him an inch. I ended the conversation by wishing that he will come to renounce his evil ways.

The very fact that he didn’t hangup, that he felt he had to explain away his guilt to me (a few times) shows that he himself wasn’t convinced of his rationalization and that he himself believed he was doing something wrong. I can only hope that the guilt gnawed its way into his conscious and that the worm that never dies led him to rethink his life and to pick up some honest work.

May the guilty lose sleep, and may their ill-gotten goods taste of ash, and thus be led to remorse and reform and the righteous path. This is love of neighbor.

Hmm what’s your point? I’d think they’re under time pressure, and if they see they can’t fool you, they’ll immediately proceed with the next target instead. (Regardless of if they’re working for themselves or being trafficked & forced)

If they’re a good person in a bad place, a union can help — and I suspect that if the calls are monitored, the villains who coerce them will want to avoid future calls to a number that regularly undermines their authority over those they traffic.

On the other hand, the examples people commonly share of where someone contacts a knowing scammer to appeal to their humanity, is that the scammers laugh at their victims — so if the people on the phone are the villains, then I think them hanging up immediately may cause more emotional pain than the stream of expletives they’re used to.

Regardless, it saves me time.

This approach may not be so useful now that GenAI, both LLMs and synthetic voices, are getting good.

> This approach may not be so useful now that GenAI, both LLMs and synthetic voices, are getting good.

They are getting REALLY good, it is the old “it is photoshopped” except with sound. The problem though is not being able to differentiate, especially not the people scammers usually target (the elderly).

You cannot believe your own eyes AND ears now, sadly. It might sound dramatic, but it takes “trust no one and nothing” to a whole new level.

Mm, indeed.

I expect that, at some point in my lifetime, bio-printing and tissue culture will probably reach the point we can’t even have trust in real life, not even with fingerprints and a DNA test.

Will this happen before or after we become post-scarcity? I don’t know.

A union cannot help them. They generally are in places where there isn’t a better option. Go on strike, we will just find someone else to replace you. Unions work when you are hard to replace. (hard is a trade off between many things, not just the cost of training someone new; but also things like the legal climate or future strikes)

Unions also give you a team that is rooting for you (even the mere psychological aspect can be surprisingly valuable), and potentially access to a legal fund.

chii wrote: “What happens if it wasn’t so obvious?”

Is Musk a scammer? Bitcoin? The commission Apple charges on the App Store? The Fortnight monetisation system? Facebook’s claim to be able to accurately target adverts? Vaccines and masks? OpenAI?

People on this website have said so about each of those examples.

That is why it’s bad to go down that path.

I think the point they’re trying to make is that determining who is a criminal and what kind of punishment they deserve is a very difficult task that depends largely on perspective.

https://en.wikipedia.org/wiki/Rhetorical_question

If the question’s answer was obvious and resolving false then none would have been described thusly, if it was obvious and resolving true then you wouldn’t be denying it.

Merely asserting that they are not, in your opinion (though hey, look at those legal cases they have between them…) does nothing to remove the fact that they have been called this.

It also does nothing to help with the lack of legitimacy of vigilantes. Nor, in this case, jurisdiction: part of the problem here is international cooperation, because right now the USA (where the victim is) and China (where the gang is) are a bit chilly towards each other.

> people will take actions into their own hands.

Amateurs sending a bomb their way? That’s one way to describe how WW1 started.

The existence of a gray area in between “obviously fine” and “obviously wrong” doesn’t mean that there is nothing in those outer categories.

It is, at least hypothetically, possible to define “scammer” clearly enough that the more egregious and clear-cut types are taken care of more expeditiously.

Not sure if there’s a way to actually enforce that better, but “it is possible to disagree over whether some things are scams” is not the same as “there’s no way to agree on whether anything is a scam”.

In principle, when the legal system handles the cases, I agree: don’t let the perfect be the enemy of the good.

In this specific case, when it comes to vigilantes in particular? Then no. I think that a society which allows it will end up somewhere between lynching and anarchy.

Better law enforcement, which does not even have to mean “more laws”? Good. Batman wannabes? Bad.

Really, really sounds like you don’t have many real problems in your life and don’t know who to blame for societal issues.

People here will lament about the exploited H1Bs causing literal genocides at Meta until the cows come home, but literally other any person working a job they don’t necessarily like and in a living situation that’s undoubtedly worse deserve to be literally bombed because they sent you a text message.

Jesus Christ.

They have to or they may get in trouble due to our stupid laws. From the article: “Initially, Smith says, he was wary about going public with his research, as this kind of “hacking back” falls into a “gray area”: It may be breaking the Computer Fraud and Abuse Act, a sweeping US computer-crimes law, but he’s doing it against foreign-based criminals.”

Why is the author afraid of getting sued by scammers? I think there should be some legal protections for people like them. Better yet – a licensing program to allow them to do this without legal repercussions as long as it’s done within the guardrails of the framework.

> Why is the author afraid of getting sued by scammers?

Being civilly sued by scammers isn’t the fear, it’s being prosecuted by the state for committing CFAA (or similar) crimes.

Self-defense isn’t banned anywhere, the kind of ‘self-defense’ murder that some people in the US occasionally get away with is, though.

(For example, if your idea of self-defense starts with ‘I’ll be following someone around in my truck…’, most other countries would let you hang.)

The solution here is to fix the law enforcement apparatus, not condone vigilantism. Yes, I know that’s a hard thing to fix.

But think about “IRL crime”. Would we condone someone pulling out their gun and going after someone who they believed had stolen from them? I hope not.

The problems are the usual ones with vigilantism: ensuring a proportionate response to the alleged crime is impossible (vigilantism usually has a large emotional component, so good luck restraining someone there), and ensuring the vigilante is actually going after the right person, and hasn’t screwed up their investigation, causing them to target someone innocent.

Certainly holding law enforcement accountable is difficult and sometimes impossible. But at least there’s a process to fix that, and people are constantly working on this problem. There’s no process to fix cases where randos botch an amateur investigation and mess up the life of someone innocent.

An outlaw, in its original and legal meaning, is a person declared as outside the protection of the law. In pre-modern societies, all legal protection was withdrawn from the criminal, so anyone was legally empowered to persecute or kill them.

An extradition treaty doesn’t define what is and isn’t legal, it defines under what circumstances a country who is party to the treaty will surrender someone who is currently sheltering in their territory to face prosecution in another country.(1)

So for example some GRU agents came to the UK and attempted to murder a couple of Russian expats using a nerve agent called Novichok(2). As well as the original targets, three further people were poisoned and had to be hospitalised, one of whom died.

Unsurprisingly perhaps Russia won’t extradite their millitary intelligence officers back to the UK to face justice. This doesn’t change the fact that murder and attempted murder are definitely illegal in the UK.

(1) https://www.cfr.org/backgrounder/what-extradition

(2) https://en.wikipedia.org/wiki/Poisoning_of_Sergei_and_Yulia_…

Isn’t it?

Like if I fly from China to US and offer you a bridge in exchange for $20 and take the $20 and don’t give you a bridge, it’s a scam.

What’s the difference between that and doing it online? The offer is still posed on US soil; if anything it should expose you to the legality of both countries.

The difference is if I’m still in the US the US police will arrest me. If I’m in China the US police has to ask China to arrest me – if China refuses to arrest me than no crime was committed as far as I’m concerned since my government let me get away with it.

Technically the US can start a war with China, which could reach the point of the US military capturing me and bringing me to the US thus ensuring I don’t get away wit it. Realistically that isn’t happening though. There are also trade-war options which sometimes happen in high profile cases, but often they are seen as losing more than gained.

Note that most countries will arrest me and send me to the US if presented evidence. If you used France as your example country and so I’m exposed the the legality of both countries. Russia and North Korea are most well noted as protecting their own people against crimes like this committed elsewhere, so if you can get protection from those countries for this crime it isn’t a crime because nothing will happen (war of course is an option but it seems unlikely). China is a grey area – they sometimes protect their own, but often they will not, in general for this scam I’d expect they would arrest you for this scam, but not all of them.

> Note that most countries will arrest me and send me to the US if presented evidence.

I believe that’s actually very rare. I mean instances in which country A extraditing to country B one of its own citizens (who isn’t also a dual citizen of B). In the most common scenario, country A extradites a citizen of B back to B, or (less common) a citizen of some 3rd country C to B.

I couldn’t find a single instance in which a US citizen was extradited from American soil to a foreign country, for example, even though this is permitted by the extradition treaties. (I welcome any pointers to actual instances)

Foreign countries sometimes extradite their own citizens to the US, but I believe that to be very rare. Even the case of Gary McKinnon (1) was ultimately blocked, for example.

(1) https://en.wikipedia.org/wiki/Gary_McKinnon

The laws aren’t universally the same in all countries. Copyright/product counterfeiting can vary from country to country for instance, so you can do something legally in one country but the importation of such a product into another country would be illegal. China makes all kinds of knock-off DVDs and products, while US resellers can get themselves in a bunch of trouble for importing and selling such products. Large scale US resellers get arrested for selling these Chinese knock-offs, but it doesn’t mean that the Chinese manufacturers engaged in a legal activity in their own country are at risk of being arrested and deported to the US even though they’re the bigger fish.

With your bridge example different countries and jurisdictions could have different requirements for the purchase of real estate or that you even were buying real estate rather than like an NFT, toy model, etc. A scam in the US might not be considered a scam in a foreign jurisdiction and even within the US it might not be considered a scam, like if someone offers you a quit claim deed for whatever interests they have in a bridge for $20 that could be considered legal depending on what representations were made. In fact a person buying a quit claim deed for way below market value could find themselves in hot water being investigated for like elder abuse with them being seen as the one trying to pull a scam on a potentially vulnerable property owner.

For people that ransomware hospitals, I want Navy Seals (or equivalent) falling out of the sky and renditioning back to the appropriate country to stand trial.

It can be unusual as long as it is not cruel. It bans “cruel and unusual” not “cruel or unusual.” That’s why a judge can order, as punishment for shoplifting, that the perpetrator stands in front of the store with a sign saying “I shoplifted here.”

Here’s the test the Supreme Court established in 1972:

> The “essential predicate” is “that a punishment must not by its severity be degrading to human dignity”, especially torture.

> “A severe punishment that is obviously inflicted in wholly arbitrary fashion.” (Furman v. Georgia temporarily suspended capital punishment for this reason.)

> “A severe punishment that is clearly and totally rejected throughout society.”

> “A severe punishment that is patently unnecessary.”

Some may see usual punishment such as customary fines and jail time as cruel, but the usual-ness making the arguable cruelness moot is convenient as it eliminates the need to argue it.

As consequential as the crowd strike outage was, there is still a moral difference between an epic fuck up and deliberately hijacking people’s data for money. Especially when it affects people’s health.

Crowd strike immediately pushed a fix for the problem once they realized what happened. No, that didn’t prevent the global economic costs and general chaos that was caused. But they clearly weren’t deliberately trying to cause all that damage.

It doesn’t matter, the effect was still the same. Intent is important, but it’s not everything. And at this point, I’m really tired of professionals with responsibility playing dumb. “Oops, sowwy!” doesn’t work for engineers when a bridge collapses. Why do programmers and executives alike get away with it?