Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!

 



Forgot your password?
typodupeerror
Spam

Security Firm Creates Chatbot To Respond To Scam Emails On Your Behalf (theverge.com) 70

An anonymous reader shares a report: Chatbots. They're usually a waste of your time, so why not have them waste someone else's instead? Better yet: why not have them waste an email scammer's time. That's the premise behind Re:scam , an email chatbot operated by New Zealand cybersecurity firm Netsafe. Next time you get a dodgy email in your inbox, says Netsafe, forward it on to me@rescam.org, and a proxy email address will start replying to the scammer for you, doing its very utmost to waste their time.

Security Firm Creates Chatbot To Respond To Scam Emails On Your Behalf

Comments Filter:
  • by Baron_Yam ( 643147 ) on Friday November 10, 2017 @10:24AM (#55525791)

    Anything that increases the cost of spam scams relative to the returns is worth investigating to see if it's practical, because ultimately you have to attack the economics to kill the beast.

    I'd actually like to see this run on my local system, though.

    • Unless of course they end up selling your email addresses to spammers. What guarantee do you have that they won't? Or someone hacks them. Or a "rogue employee". This is 2017, you can't take anything at face value. Even though plenty do.
      • by Anonymous Coward

        Plus, if the spammer actually gets a reply, how do you know they don't send you on to their friends or mark the address as a "known good" address or a "possible sucker" address. Or heck, lots of the early emails are probably computer generated, so what you really get is bots replying to bots.

        • by gnick ( 1211984 )

          The summary says that they'll reply using a "proxy e-mail address". TFA gives little details and I'm not going to explore their site at work. It's not clear whether there will be enough information in Rescam's reply for the scammer to identify where the original message was sent. Is it common to include your target's information in the body of your initial scam invitation?

          TFA does acknowledge that their efforts will result in a lot of bots talking to other bots.

          • Is it common to include your target's information in the body of your initial scam invitation?

            Of course. With HTML-ized email, it is almost standard practice to include at a minimum a 1 pixel blank image with an encoded URL. You don't see it, but the website logs that you retrieved it. That not only tells them that the email address is valid, but that someone reads the email going there.

            And when the question is asked about "selling your email address to spammers", it's not the Re.scam people you need to worry about. It's the spammer who sent you the probe to see if the email address was valid. Gett

            • I would say the business model is you freely send them information about Spam you have received so that they can improve security services like a spam filter that they sale but they appear to be a non-profit that receives support from various local and state government departments that they work with so I guess not.

        • how do you know they don't send you on to their friends or mark the address as a "known good" address or a "possible sucker" address.

          That's a feature, it makes it like a virus!

      • by gnick ( 1211984 )

        What guarantee do you have that they won't?

        None, but it doesn't seem likely. Unless there are buyers looking specifically for the demographic of people that would forward spam to anti-scammers, there are much easier ways [wikipedia.org] to harvest e-mail addresses. Any group that you share your email address with is subject to the risk of hacks or "rogue employees". We all set our own threshold for risk when we decide where to disclose our personal information. Developing a chat bot designed to frustrate scammers in an effort to collect data to sell to those scamme

        • How many things happened in the last year that "didn't seem likely" or were "too bizarre"? They could be 100% honest, but when someone says "Here, I'll take care of that for you." beware.
          • by gnick ( 1211984 )

            Of course, an event being unlikely to occur does not guarantee it won't. But I decide on my actions based on perceived likelihood. If I think there's a 99% chance that Rescam will sell my email address to scammers, I won't use them. If I think there's a 1% chance (I think it's lower), I'll be much more inclined to use them. You can't go into every situation you encounter planning on the worst possible outcome, however unlikely. Well, you can, but I don't; you do you.

            • Just saying be careful. Lots of pitfalls out there. Can't remember the last time I was 99% sure of anything.
              • by gnick ( 1211984 )

                Can't remember the last time I was 99% sure of anything.

                When I left for work this morning, I was 99%+ sure I'd make it to work alive. Not 100% sure, but sure enough to take the risk. I'm less sure that Rescam wouldn't sell my email address, but still beyond 99% because it makes that little sense to me.

    • by tlhIngan ( 30335 )

      Anything that increases the cost of spam scams relative to the returns is worth investigating to see if it's practical, because ultimately you have to attack the economics to kill the beast.

      I'd actually like to see this run on my local system, though.

      There was an older tool that was basically an automated version of FormF*cker. Basically it went to the spam web pages and filled in the forms with crap. After all, back then spam sent you a link to get more information from you, so the tools would fill in the

  • We need more of such ideas.
    • by Anonymous Coward

      A voice chat bot like this on the phone system? *666 and some bot can talk about all my detected viruses and overdue tax problems

    • by pr0nbot ( 313417 ) on Friday November 10, 2017 @11:40AM (#55526343)

      Sir,

      I am having many!! such ideas. In fact I have been a succesfull businesman more than 23 years and am in possession of a substantial!! quantity of monies. But, unfortunately I, am most Sorrowfully in dispute with the Ghanaian tax authorities who have frozen my accounts. However my esteemed solicitor, Dr Goodlove Simons III has assured me that through the payment of a fine of no more than $250US I will be able able to transfer these monies with much expeditiousness to an overseas bank account. I am prepared to offer a reward of $2500 in exchange for your immediate trnafser of $250US to the following account: IBAN002300203 Acct holder Ghanaian Tax Authorities, Apt 3b Rhodes House N2389 Lagos, Nigeria

      In anticipation of your excellent assistance, and with many!! thanks, Rev Alfons Dauphine

  • ... got quite surprised with the persistence and poor-understanding skills of some spammers/scammers. I was doing it manually and just for fun (+ kind of contributing to reduce crap). I think that this was one of the first times when I realised about how deep stupidity can go. Although I prefer the current much-clearer-ideas myself, some times I kind of miss those moments when I was still expecting other outputs rather than stupidity always remaining stupidity.
  • by Anonymous Coward

    The skeptic in me says that this is a great way to harvest legitimate e-mail addresses for a future purpose.

  • Can I program my mail system to automatically forward spam?

    • Can I program my mail system to automatically forward spam?

      Um.. .yeah of course. It's trivially easy.

      • Um.. .yeah of course. It's trivially easy.

        If it were so trivially easy then I wouldn't still be getting spam and there wouldn't be valid emails showing up in my spam filters.

        It is trivially easy to automate forwarding of email, that is true, at least for some email systems. What is hard is perfect detection of what is and is not spam. I doubt your friends would appreciate getting some chat-bot response to an email they send you that was improperly classified.

      • Sometimes hard to believe that this used to be a tech site which had the tagline News for Nerds.

    • by HiThere ( 15173 )

      The problem is false positives. Otherwise it's trivial on any decent email system. But the false positive problem can be significant.

  • Jolly Roger (Score:2, Interesting)

    by Anonymous Coward

    See: http://www.jollyrogertelco.com/ . Keep telemarketers on the phone talking to a bot.

  • just start replying using lots of fake email addresses and sending them what starts out as clear readable text that quickly degenerates in to nonsense like lorem ipsum or something like that
  • by ilsaloving ( 1534307 ) on Friday November 10, 2017 @11:20AM (#55526177)

    The only reason these phishing scams work is because they are so low effort on the part of the scammer. You just vomit spam and then handle the responders.

    This idea will turn the tables on them by making them do the same thing they're trying to do to others. Of course, it will turn into a cat and mouse game as the scammers figure out what's going on, and implement a cheap test to weed out the automation as quickly as possible.

    Of course, then I wonder if the scammers will start automating their own responses... it'll be like watching cleverbot talk to itself.

    • Re:Brilliant idea (Score:4, Insightful)

      by goose-incarnated ( 1145029 ) on Friday November 10, 2017 @12:09PM (#55526509) Journal
      These Nigerians are barely computer literate and barely literate at all. They will struggle to pass a Turing test themselves. I think that even Eliza level chatbots will fool them. The idea is that they will have to manually sift through thousands of emails per day to find the real mark, and I think that this idea will work.
      • The idea is that they will have to manually sift through thousands of emails per day to find the real mark,

        If Re.scam is to engage them in an ongoing conversation to waste their time, then Re.scam must use a valid, replyable email address. The "proxy address" that the summary refers to.

        If you and I can filter email based on a domain, why don't you think that a spammer can do that, too? Especially spammers who don't care what your email reply is, they're looking for you to visit their website to order their scam products or log in or whatever?

      • These Nigerians are barely computer literate and barely literate at all.

        So where do they get their list of email addresses from? And how do they send bulk email (since any mail relay known for spam would be blacklisted immediately).
        There's clearly some smarts in the equation somewhere...

  • by ripvlan ( 2609033 ) on Friday November 10, 2017 @11:26AM (#55526229)

    I thought that many of the chat scams are via chatbots already. So won't this be like Google Go AI playing Google Go AI ?

    That'll be the future of the internet. A bunch of angry AI bots battling it out in a deadly embrace. That will be how the world ends !!

  • Someone needs to do a Cat Facts bot to keep spammers busy

    https://www.reddit.com/r/AskRe... [reddit.com]

  • Like that will lower the spam sent.... That sounds more like distributed email DoS.
    • Right, but it is the human scammer who is the point of failure being DoSed. When you say "email DoS" you make it sound like the email system is being DoSed, which would be bad. But that isn't the case.

  • Holy fuck - the bot is actually more coherent than the scammer.
    • Way more coherent. I went and looked after seeing your comment, and I'm really surprised. I've had emails back and forth with customers who were less coherent than that.

  • by Anonymous Coward

    Most often the sending and reply to addresses are spoofed, and you would be "entertaining" the wrong party.

    I was one of the early internet vigilante Paul Vixie Spam Fighters. I spent hours researching each turd that landed in my inbox and complaining to all the site hosting and system operators connected with the tripe.

    I discovered that besides getting my name on a spammers black list there was no gain, my hours spent were squandered as the vulnerable spammers quit sending me crap new spammers sprung up or

    • You seem to lack comprehension. If they don't provide a usable contact, it wasn't a real scam, it was just a mistake spam.

      As regards your past activities, you were part of a distributed effort. You had no information as to the number of people attempting to be spammers, or how many messages they were sending. So you had no way of knowing if your efforts should be expected to decrease the number of spams in your box, or if it would decrease the overall number in a way you can't detect, or if it would slow th

  • by akeeneye ( 1788292 ) on Friday November 10, 2017 @01:31PM (#55527033) Homepage
    Forward your spam to sp@mnesty.com . Hilarity ensues, once in a while (low response rate).
  • Now if we could get our spam filters to automatically route spam to the spambot, we'd really have something. Either a significant number of spammers would go out of business, or the universe would enter a recursive sequence and pop like a balloon.

  • In the day, we got chewed up when we mailbombed the scammers, is it OK now?

  • why is google delivering phishing emails?? they are sent to the LOL spam folder. well that's DELIVERING the email, why? I have reported 1000s of phishing emails to google email and ya know what they do? they put a stupid tag on it this MAY be phishing scam instead of just deleting it or allow us users to truly BLOCK an address or domain. i get tons of .jp phishing emails why cant we block them and by block i mean delete so it never getting into any folder ya ask me google in league with these phishing scamm
  • Lower the signal to noise ratio.
    • For scams, as in TFA.
    • For spam, don't just block it. Everyone's spam filter should reply to every spam email they get. If a spammer gets one reply per 10,000 spam emails they send, well now they have to dig through 10,000 fake replies to find each real one. If the spammers start wising up and blacklisting your email, well problem solved. They're not sending you spam anymore.
    • For sites that harvest your browsing data, pollute their data. Don't just block their cookies.
    • Everyone's spam filter should reply to every spam email they get.

      No, it shouldn't. The From: address is almost always taken at random from the same database where the To: address came from!

  • I guess James will have to shift to making videos about being replaced by robots....

  • I tried to email it, but it haven't responded

An Ada exception is when a routine gets in trouble and says 'Beam me up, Scotty'.

Working...