Bitcoin Forum
December 05, 2016, 02:31:53 AM *
News: To be able to use the next phase of the beta forum software, please ensure that your email address is correct/functional.
 
   Home   Help Search Donate Login Register  
Pages: [1] 2 3 4 »  All
  Print  
Author Topic: Casascius phishers demanding a ransom  (Read 5800 times)
casascius
Mike Caldwell
VIP
Legendary
*
Offline Offline

Activity: 1344


The Casascius 1oz 10BTC Silver Round (w/ Gold B)


View Profile WWW
October 26, 2011, 07:04:22 PM
 #1

Open response to the e-mail below:

Dear anonymous John Smith,

Thank you for the interest you have shown in the coins I've been producing.

While it's disappointing that you're interested in attacking my service, I find it to be a highly novel application that Bitcoin can be used for anonymous extortion.  You and I are both aware that I can pay you, and can never identify you, nor can I ever know whether the next person to demand a fee from me is the same you.  For the technology's sake, I will be highly amused if one day in the future I hear in the news that a ship is being held ransom and the demand is in Bitcoins.  If it happens, you could call yourself a pioneer.

While you clearly have the genius to see this novel application for Bitcoin, I also think you may misunderstand my purpose in creating and offering physical Bitcoins for sale.

My purpose in promoting physical Bitcoins is to promote the concept of Bitcoin and other ways it can be used by the public, without needing a software program that's only useful for geeks and which puts them at risk for theft from hackers.  If you try to disrupt my physical Bitcoin sales with attacks, you will probably succeed.  I probably will not go to much effort to try and counter a serious effort to attack it.  I am not persuaded that paying the fee you have asked will serve to stop the attacks.

I should qualify how you might succeed.  You might succeed in shutting my site down or diverting people to a phishing site, but you won't succeed in stealing any of the value on physical Bitcoins, or my bitcoins which I keep on paper wallets virtually full time.  You will probably agree, offline private keys are immune to pretty much all online attacks.

Further, you should know there is a limit to how many coins I can produce right now - I really can't sustain a very large volume in sales, so it is very possible I may be "DDoSed" in the near future simply by the legitimate business interest that is probably an indirect result of your scam site.  Either way, I have clearly succeeded in evangelizing the idea of physical cryptocurrency (with all due respect to BitBills), and I hope the community takes the idea a step further and does a better job than me at some point.

I don't believe that these attacks are damaging my personal reputation.  I do believe, however, they damage the reputation of Bitcoin and make it unattractive to those not involved with technology.  That's unfortunate, but that's one of its features - anonymous really means anonymous.  I would prefer not to have another round of media coverage telling the world yet again another reason why using Bitcoin is risky.  But that's under your control.  Since you've clearly taken the time to understand how Bitcoin works, I assume and hope you would prefer that Bitcoin grow and succeed, than to attack its public perception.

I would be happy to send you two or three of my coins free of charge to any physical address you choose at my own expense, just for having taken an interest.  Perhaps you can find a way to attack the physical coins, I'll be interested to hear if you manage to succeed.  Give me the address of a trusted stranger or acquaintance who will safely forward them to you with the same "txt" method you have used below, and I will oblige.

Respectfully,

Mike Caldwell

Quote
From: John Smith [mailto:1n5e5oqy7jplcgcqwnjafwxf27cb33z4dq@webmail.co.za]
Sent: Wednesday, October 26, 2011 12:24 PM
To: casascius@mc2cs.com
Subject: do not relax

do not relax, we just started playing.

i will be happy to start real work with you untill i will not tired.
there are so many interesting things waiting for you.

but you can pay me to avoid of all this shit. my price today is 300 bitcoins and this is much less than the quality ddos protection and reputation losing during scam. price will grow.

as soon i receive payment i drop off all my scam domains that affected you and will never interfere with your business.

pay here: 1N5E5oqY7JpLCgcqWNjafWXF27Cb33Z4Dq

verify me by TXT record of net domain.

check for example here www.whatsmyip.us/txt <- casascius dot net

I advise you to pay in 3 days.


Headers:
Quote
<local stuff snipped>
Received: from mailgate.wmint.net (mailgate.wmint.net [80.247.237.19])   by
 mail98c0.megamailservers.com (8.13.6/8.13.1) with ESMTP id p9QIOQw9018419   for
 <casascius@mc2cs.com>; Wed, 26 Oct 2011 14:24:28 -0400
Received: from www.webmail.co.za (iweb4.wmint.net [192.168.100.6])   by
 mailgate.wmint.net (Postfix) with ESMTP id 53618380001A3   for
 <casascius@mc2cs.com>; Wed, 26 Oct 2011 20:24:25 +0200 (SAST)
X-Mailer: Hastymail2 1.0
Received: from unknown ([201.35.4.203]) authenticated user
        1n5e5oqy7jplcgcqwnjafwxf27cb33z4dq@webmail.co.za by www.webmail.co.za
 with        HTTP; Wed, 26 Oct 2011 20:24:25 +0200
To: <casascius@mc2cs.com>
From: John Smith <1n5e5oqy7jplcgcqwnjafwxf27cb33z4dq@webmail.co.za>
Subject: do not relax
Date: Wed, 26 Oct 2011 20:24:25 +0200
Content-Type: text/plain; charset="UTF-8"; format=fixed
MIME-Version: 1.0
Message-ID: <df1a51b4de2c7cab24c8ab4d463aa1c9@www.webmail.co.za>
Content-Transfer-Encoding: 8bit
X-MMR: 0
X-CSC: 0
X-CHA: v=1.1 cv=aPPZer4WAhGcx+vP3fBwqKtPsjyFzNUAiOP+sulbenA= c=1 sm=1
      a=BLceEmwcHowA:10 a=IkcTkHD0fZMA:10 a=d0tj6I8CGchA31JZUvxdow==:17
      a=gGsXarMTAAAA:8 a=irAyJklUAAAA:8 a=8ByQLoDwAAAA:8 a=qkRcwGf7Vyti2Gyff24A:9
      a=QEXdDO2ut3YA:10 a=d0tj6I8CGchA31JZUvxdow==:117
Return-Path: 1n5e5oqy7jplcgcqwnjafwxf27cb33z4dq@webmail.co.za
X-OriginalArrivalTime: 26 Oct 2011 18:24:14.0125 (UTC) FILETIME=[76D76DD0:01CC940C]
X-MS-Exchange-Organization-SCL: 5

Companies claiming they got hacked and lost your coins sounds like fraud so perfect it could be called fashionable.  I never believe them.  If I ever experience the misfortune of a real intrusion, I declare I have been honest about the way I have managed the keys in Casascius Coins.  I maintain no ability to recover or reproduce the keys, not even under limitless duress or total intrusion.  Remember that trusting strangers with your coins without any recourse is, as a matter of principle, not a best practice.  Don't keep coins online. Use paper wallets instead.
1480905113
Hero Member
*
Offline Offline

Posts: 1480905113

View Profile Personal Message (Offline)

Ignore
1480905113
Reply with quote  #2

1480905113
Report to moderator
1480905113
Hero Member
*
Offline Offline

Posts: 1480905113

View Profile Personal Message (Offline)

Ignore
1480905113
Reply with quote  #2

1480905113
Report to moderator
1480905113
Hero Member
*
Offline Offline

Posts: 1480905113

View Profile Personal Message (Offline)

Ignore
1480905113
Reply with quote  #2

1480905113
Report to moderator
Advertised sites are not endorsed by the Bitcoin Forum. They may be unsafe, untrustworthy, or illegal in your jurisdiction. Advertise here.
1480905113
Hero Member
*
Offline Offline

Posts: 1480905113

View Profile Personal Message (Offline)

Ignore
1480905113
Reply with quote  #2

1480905113
Report to moderator
genjix
Legendary
*
Offline Offline

Activity: 1232


View Profile
October 26, 2011, 07:14:11 PM
 #2

Such a shame. What a loser.
cbeast
Donator
Legendary
*
Offline Offline

Activity: 1722

Let's talk governance, lipstick, and pigs.


View Profile
October 26, 2011, 07:32:58 PM
 #3

Just change the website name to something else and grab all the variations. Not enough people really know about them yet, do they?

Any significantly advanced cryptocurrency is indistinguishable from Ponzi Tulips.
genjix
Legendary
*
Offline Offline

Activity: 1232


View Profile
October 26, 2011, 07:34:39 PM
 #4

Yeah, I never liked the name Casascius anyway. It's too much of a tongue twister.
DeathAndTaxes
Donator
Legendary
*
Offline Offline

Activity: 1218


Gerald Davis


View Profile
October 26, 2011, 07:37:35 PM
 #5

Just change the website name to something else and grab all the variations. Not enough people really know about them yet, do they?

This.  I would continue to sell your existing coins but if/when you decide to go for round 2 come up with a completely different name and this time spend the $80 or so to bulk register alternate versions.
RodeoX
Legendary
*
Offline Offline

Activity: 2100


The revolution will be monetized!


View Profile
October 26, 2011, 07:44:46 PM
 #6

Call me vindictive, but if I got an extortion letter it would inspire me to go on the offensive. Instead of sending him 300BTC, I would pay 600BTC to a very bad man willing to get vengeance for me.
Getting even is one area that I split from logical cost/benefit analysis.   Cool

The gospel according to Satoshi - https://bitcoin.org/bitcoin.pdf

Free bitcoin=https://bitcointalk.org/index.php?topic=1610684
Bitcoin Oz
Hero Member
*****
Offline Offline

Activity: 700


Wat


View Profile WWW
October 26, 2011, 08:17:17 PM
 #7

They would have fun trying to ddos google appspot fwiw.

If youre manufacturing the coins and they are sold on numerous websites wtf can they do about it ?

evoorhees
Legendary
*
Offline Offline

Activity: 994


Democracy is the original 51% attack


View Profile
October 26, 2011, 08:21:25 PM
 #8

Mike - I liked your response to him. Well-written and pretty clever =)
wallet.dat
Sr. Member
****
Offline Offline

Activity: 253


View Profile
October 26, 2011, 08:32:23 PM
 #9

Quote
do not relax, we just started playing.

i will be happy to start real work with you untill i will not tired.
there are so many interesting things waiting for you.

but you can pay me to avoid of all this shit. my price today is 300 bitcoins and this is much less than the quality ddos protection and reputation losing during scam. price will grow.

as soon i receive payment i drop off all my scam domains that affected you and will never interfere with your business.

pay here: 1N5E5oqY7JpLCgcqWNjafWXF27Cb33Z4Dq

verify me by TXT record of net domain.

check for example here www.whatsmyip.us/txt <- casascius dot net

I advise you to pay in 3 days.

ROFL WTF, do all these stalkers get their material from the same fill-in-the-blanks template or something?

"MOOOOOOOM! THE MEATLOAF!!! F**K!"
casascius
Mike Caldwell
VIP
Legendary
*
Offline Offline

Activity: 1344


The Casascius 1oz 10BTC Silver Round (w/ Gold B)


View Profile WWW
October 26, 2011, 08:36:56 PM
 #10

What I don't get... I've posted significant bounties for development things I'd like to see happen in Bitcoin.

Someone with lots of skills and no idea what to do with them ought to consider implementing some features I think will help bitcoin, like sweepprivkey (as described in Wiki).

Companies claiming they got hacked and lost your coins sounds like fraud so perfect it could be called fashionable.  I never believe them.  If I ever experience the misfortune of a real intrusion, I declare I have been honest about the way I have managed the keys in Casascius Coins.  I maintain no ability to recover or reproduce the keys, not even under limitless duress or total intrusion.  Remember that trusting strangers with your coins without any recourse is, as a matter of principle, not a best practice.  Don't keep coins online. Use paper wallets instead.
BitcoinPorn
Hero Member
*****
Offline Offline

Activity: 560


Posts: 69


View Profile WWW
October 26, 2011, 08:41:03 PM
 #11

Well someone is hitting at the right time.  Look Mike, you are on CNET!

http://news.cnet.com/8301-17938_105-20125470-1/are-physical-bitcoins-legal/

Edit: Yesterdays news it seems, just caught it in my news feed though.  You should contact CNET and let them know of your issues regarding this.  See if they want to spin a story on Bitcoin and anonymous attackers.

deepceleron
Legendary
*
Offline Offline

Activity: 1470



View Profile WWW
October 26, 2011, 09:18:59 PM
 #12

Sounds like it's time to do an ICANN domain dispute or an ACPA expedited domain name dispute, they were hosting your copyrighted material, committing fraud, and now extortion.

In determining whether the domain name registrant has a bad faith intent to profit a court may consider many factors including nine that are outlined in the statute:

-whether the domain name contains the registrant’s legal or common name;
-the registrant’s prior use of the domain name in connection with the bona fide offering of goods or services;
-the registrant’s bona fide noncommercial or fair use of the mark in a site accessible by the domain name;
-the registrant’s intent to divert customers from the mark owner’s online location that could harm the goodwill represented by the mark, for commercial gain or with the intent to tarnish or disparage the mark;
-the registrant’s offer to transfer, sell, or otherwise assign the domain name to the mark owner or a third party for financial gain, without having used the mark in a legitimate site;
-the registrant’s providing misleading false contact information when applying for registration of the domain name;
-the registrant’s registration or acquisition of multiple domain names that are identical or confusingly similar to marks of others; and
the extent to which the mark in the domain is distinctive or famous.[11]


The scammers have now met every requirement. Plus you get to find out their registration info so fellow Russian bitcoiners can go kick them in the nuts.

mizerydearia
Hero Member
*****
Offline Offline

Activity: 574



View Profile
October 26, 2011, 09:19:12 PM
 #13

For reference, this phishing issue first documented here

Well someone is hitting at the right time.  Look Mike, you are on CNET!

http://news.cnet.com/8301-17938_105-20125470-1/are-physical-bitcoins-legal/

Edit: Yesterdays news it seems, just caught it in my news feed though.  You should contact CNET and let them know of your issues regarding this.  See if they want to spin a story on Bitcoin and anonymous attackers.

Do it!

Sounds like it's time to do an ICANN domain dispute or an ACPA expedited domain name dispute, they were hosting your copyrighted material, committing fraud, and now extortion.

In determining whether the domain name registrant has a bad faith intent to profit a court may consider many factors including nine that are outlined in the statute:

-whether the domain name contains the registrant’s legal or common name;
-the registrant’s prior use of the domain name in connection with the bona fide offering of goods or services;
-the registrant’s bona fide noncommercial or fair use of the mark in a site accessible by the domain name;
-the registrant’s intent to divert customers from the mark owner’s online location that could harm the goodwill represented by the mark, for commercial gain or with the intent to tarnish or disparage the mark;
-the registrant’s offer to transfer, sell, or otherwise assign the domain name to the mark owner or a third party for financial gain, without having used the mark in a legitimate site;
-the registrant’s providing misleading false contact information when applying for registration of the domain name;
-the registrant’s registration or acquisition of multiple domain names that are identical or confusingly similar to marks of others; and
the extent to which the mark in the domain is distinctive or famous.[11]


The scammers have now met every requirement. Plus you get to find out their registration info so fellow Russian bitcoiners can go kick them in the nuts.

Do it!
BitcoinPorn
Hero Member
*****
Offline Offline

Activity: 560


Posts: 69


View Profile WWW
October 26, 2011, 09:26:55 PM
 #14

casascius, there is definitely some interesting options here.  That CNET idea sounds better the more I think about it.  As you could easily contact a few news sources regarding this.  All the news reports of the big hacking incidents with Bitcoin after the fact, Gox, Mybitcoin, whatever.   This time the news can possibly take care of some of the investigating.   Might expose some flaws in Bitcoin we aren't seeing without that outside perspective being more hands on with what is going on, as they always do seem to report well after things are done, and usually misreported.

sadpandatech
Hero Member
*****
Offline Offline

Activity: 504



View Profile
October 26, 2011, 09:30:28 PM
 #15

For reference, this phishing issue first documented here

Well someone is hitting at the right time.  Look Mike, you are on CNET!

http://news.cnet.com/8301-17938_105-20125470-1/are-physical-bitcoins-legal/

Edit: Yesterdays news it seems, just caught it in my news feed though.  You should contact CNET and let them know of your issues regarding this.  See if they want to spin a story on Bitcoin and anonymous attackers.

Do it!

Sounds like it's time to do an ICANN domain dispute or an ACPA expedited domain name dispute, they were hosting your copyrighted material, committing fraud, and now extortion.

In determining whether the domain name registrant has a bad faith intent to profit a court may consider many factors including nine that are outlined in the statute:

-whether the domain name contains the registrant’s legal or common name;
-the registrant’s prior use of the domain name in connection with the bona fide offering of goods or services;
-the registrant’s bona fide noncommercial or fair use of the mark in a site accessible by the domain name;
-the registrant’s intent to divert customers from the mark owner’s online location that could harm the goodwill represented by the mark, for commercial gain or with the intent to tarnish or disparage the mark;
-the registrant’s offer to transfer, sell, or otherwise assign the domain name to the mark owner or a third party for financial gain, without having used the mark in a legitimate site;
-the registrant’s providing misleading false contact information when applying for registration of the domain name;
-the registrant’s registration or acquisition of multiple domain names that are identical or confusingly similar to marks of others; and
the extent to which the mark in the domain is distinctive or famous.[11]


The scammers have now met every requirement. Plus you get to find out their registration info so fellow Russian bitcoiners can go kick them in the nuts.

Do it!


  +1 +1. But I kinda liked RodeoX's idea as well. ;p

If you're not excited by the idea of being an early adopter 'now', then you should come back in three or four years and either tell us "Told you it'd never work!" or join what should, by then, be a much more stable and easier-to-use system. - GA
It is being worked on by smart people. -DamienBlack
oOoOo
Full Member
***
Offline Offline

Activity: 238


View Profile
October 26, 2011, 09:54:39 PM
 #16

Quote
do not relax, we just started playing.

i will be happy to start real work with you untill i will not tired.
there are so many interesting things waiting for you.

but you can pay me to avoid of all this shit. my price today is 300 bitcoins and this is much less than the quality ddos protection and reputation losing during scam. price will grow.

(...)

I advise you to pay in 3 days.


It's a bluff. That guy is not able to do anything. Ignore.
.
tvbcof
Legendary
*
Online Online

Activity: 1974


View Profile
October 26, 2011, 09:54:56 PM
 #17

Call me vindictive, but if I got an extortion letter it would inspire me to go on the offensive. Instead of sending him 300BTC, I would pay 600BTC to a very bad man willing to get vengeance for me.
Getting even is one area that I split from logical cost/benefit analysis.   Cool

Revenge does not strike me as illogical from a cost/benefit analysis given that the same scam could happen again and again and end up costing a lot.  But it is something of a slippery slope which could easily land a person in one (or more) of several pools of hot liquid.  Probably best avoided unless one is quite savvy with such things.

A friend of mine who knew a lot about big cats once explained what to me was a mystery about why leopard would risk life and limb to 'get even' with a park ranger who poked him with a stick.  He says that with overlapping ranges, competing animals (hyenas, leopards, etc) will run across the same individual numerous times.  So there is a distinct net benefit to having it be known that a specific individual is not to be fucked with.  I could see such a thing happening in the Bitcoin Serengeti at these early times.

Bitcoin Oz
Hero Member
*****
Offline Offline

Activity: 700


Wat


View Profile WWW
October 26, 2011, 10:36:14 PM
 #18

Phishing site shows up hosted at a Russian hosting company, someone starts demanding extortion fees, and all the sudden BitcoinExpress shows up. I may have been born in the day but it wasn't yesterday.

 Lips sealed

repentance
Hero Member
*****
Offline Offline

Activity: 840


View Profile
October 27, 2011, 07:10:04 AM
 #19

Quote
do not relax, we just started playing.

i will be happy to start real work with you untill i will not tired.
there are so many interesting things waiting for you.

but you can pay me to avoid of all this shit. my price today is 300 bitcoins and this is much less than the quality ddos protection and reputation losing during scam. price will grow.

(...)

I advise you to pay in 3 days.


It's a bluff. That guy is not able to do anything. Ignore.
.

I'm a bit inclined to agree.  If they had something real up their sleeve and wanted to give you an incentive to pay then they should have given you a demonstration of their ability to attack you directly.  Instead they set up a fake website to scam people - something which requires very little technical ability.

All I can say is that this is Bitcoin. I don't believe it until I see six confirmations.
CA Coins
Donator
Sr. Member
*
Offline Offline

Activity: 306


View Profile
October 27, 2011, 07:21:02 AM
 #20

Good luck casascius!

This John Smith character is a loser.
Pages: [1] 2 3 4 »  All
  Print  
 
Jump to:  

Sponsored by , a Bitcoin-accepting VPN.
Powered by MySQL Powered by PHP Powered by SMF 1.1.19 | SMF © 2006-2009, Simple Machines Valid XHTML 1.0! Valid CSS!