Bogus "account hacked" message

[Guy Dunphy]

At 08:56 PM 8/01/2019 -0600, you wrote:
>On 01/08/2019 04:33 PM, Fred Cisin via cctalk wrote:
>> On Tue, 8 Jan 2019, allison via cctalk wrote:
>>> SStandard lockout after three fails i 15 minutes.�
>>
>> Howzbout:
>> a quarter second lockout after a fail;
>> double that for each subsequent fail.
>> Three tries to get it right will not be inconvenienced.
>> But, by 32 tries, it's up to a biillion seconds.
>>
>Interesting observation I made a few years ago.  I run a web 
>store, and was being inundated with ssh login attempts.  
>About 1000/day!  I decided this was serious, they'd 
>eventually get lucky.
>So, searching available software, I found denyhosts.  It 
>checks the logs for login failures, and after a set 
>threshold, it puts the source IP into the hosts.deny list, 
>and your machine effectively disappears from that source 
>IP's view.  I set the rules very strictly, so that after 3 
>login failures over a 2 month span, that IP was blocked for 
>a year.  Something very interesting happened.
>The number of attempts did not diminish immediately, as the 
>botnets had a large number of compromised machines.  But, 
>suddenly, two weeks to the EXACT HOUR when I set up 
>denyhosts, the attacks dropped from 1000/day to 3!  Just 
>like flipping a switch!  So, these hackers have a dark net 
>list somewhere where they trade IP addresses of machines 
>they would like to hack, and what they can figure out about 
>the security measures implemented on them.  When they have 
>demonstrated by coordinated attempts that your lockout 
>horizon is over two weeks, they put out the word that your 
>site is not going to bear any fruit.
>
>I currently have 9000-some blocked IPs in hosts.deny, I 
>wonder how much that slows down my store.  Ugh, the stuff we 
>are forced to go through.
>
>Jon

I've been receiving the same 'hacked your account, sending this from your account, send bitcoins' scam
emails for a while.
They are NOT from 'my account' (what does that even mean?) although the sender email address is same as
one or more of mine. But that is spoofable. I ignore them.
I can see all the headers, which include lines like:
  X-Mailer: Microsoft Outlook Express 6.00.2900.3022
  X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.3022
Since I'd rather die than use MS Outlook Express, or even install it an any system of mine,
I know they lie (and for other reasons.)

Recently one quoted 'my password' as evidence. It's a password I used on a porn site long ago, and that
site changed hands and became a junk site sometime since. Maybe the new owners branched into extortion scams?

I also at times receive a lot of scamming phone calls to my landline. Sometimes several a day.
These have such a consistent format that I'm sure they must come from some group, even though they
use different names.
The phone rings, I pick up, there's a variable duration interval of silence, then a pooiip! popping
sound (their system connecting this call to one of their operators, now that I answered), then a
usually very Indian sounding voice (M or F) says something like "Hello, this is Microsoft security service"
or "Hello this is product testing group."
I never bother to go along with it to see what their intent is. Just hang up usually.


We all know the government has total surveilance of all electronic communications. Don't argue, this
is not a 'conspiracy theory'. I've even had dinner with a guy who was my interpreter wife's boss at the
time, as head of the Sydney branch of Australia's national crime commission's intercepts division.
Discussed the Echelon system (as it was named then) system with him, which he acknowledged existed.

I asked so, what percentage of ALL communications (voice and digital) does the system capture and analyze
for keywords?

  (Echelon used a 'dictionary' of keywords and phrases of interest, put together each week by the NATO
  powers, and shared among them all. Intercepts in each country are done on coms backbones, with each site
  existing as a diplomatic enclave, manned by intelligence staff who are acting on behalf of 'foreign
  allies' hence getting around local surveilance legal limitations. Any intelligence of interest is passed
  to local intelligence services as a diplomatic communication, so the local gov was not 'spying on
  their own citizens.' Ha ha ha. It sucks, but that is how it worked nearly 20 years ago. Certainly much
  worse now. I don't know what the equivalent system is called these days.)

His answer: around 98%.

Now here's the thing. Another interesting observation one could make:

You'd think these kind of scamming emails and phone calls should be illegal, and easily prosecutable.
You'd think it would require almost no effort at all from law enforcement and coms carriers, to
identify the sources. Given that they have total transparency of the telecoms infrastructure.
Not to mention that if Indian call centers are involved there would be international carrier contracts
and national entry points that would stand out like searchlights in traffic analysis.
Same goes for Asian paid web click farms, etc. Even botnets with encrypted command channels - I can't
believe it can be technically impossible to shut these down.
So, how does this bullsh*t continue?

One can only conclude that the large scale scamming operations are conducted with the knowledge of,
and probably complicity of, government at some level.

The real question is why.
I can make guesses about that too. But doubt many here would find it comfortable. Or on topic.

Guy