Artists Against 419

http://www.bit-tech.net/bits/2005/11/08/artists_419_scam/1.html

 

It all sounds good, but surely their ISPs would be annoyed at the amount of bandwidth they use to take down the websites? Maybe I'm reading it wrong, but in order to take down a site, they use up all its bandwidth by refreshing images rapidly. Surely that would utilise a heck of a lot of your own too?

Either way, at least someone is doing something about these scammers...

 

if u read carefully it states that whilst it refreshes the image from the website, it doesn't refresh it on your end, a clever piece of internet knowledge. i personally think that this is wholly justified, ppl can make citizens arrests so i dont see why this isn't right as well. they give companies and isp's plenty of opportunity to fix their own problems and if they wont and the police won't then the public have a duty to.

three cheers!!

 

So has anyone got the lad vampire page up?

 

Ah that explains that then! Definately 3 cheers, as I know several people who have been caught out, as they're not in the know...

 

it doesnt hammer your own bandwidth as much as you think. yes, there is some bandwidth used, but its a very small amount.

consider this example. if you have a program that uses 1k of bandwidth per second its running leeching from the site. now, if 1024 people run this same program, all at once, then each person is only using 1k of their own bandwidth, but the website itself is having to send 1meg of traffic (1k * 1024 users == 1meg). this is the basic premise of any distributed denial of service attack (ddos), many users doing very little, all pointed at the same place. as the results of the flashmobs show, the results can be devastating for the target, but un-noticable for the attackers.

ive seen the aa419 site a couple of times in the past, and tbh, i think they are doing more good than harm. whilst i would not condone a ddos, i wouldnt call what they do a ddos. they are not trying to deny service to the website, simply make a big enough spike in the hosts logs so that a human will come to see what all the fuss is about, thus shutting down and illeagal site. i firmly agree with their tactics, its not like they are throwing around their bandwidth at everything that moves, they do make efforts to complain to the relative abuse departments before even considering spiking the traffic.

they are good guys, they dont want to break anything, they just want to make some noise so that someone comes to see whats wrong. grey-hats for sure, but then, arn't we all?

 

From what I can tell from their web site, they give ISPs ample opportunity to take these sites down, and a lot are taken down that way. Only when ISPs fail to listen to reason do they try hammering the site's bandwidth.

Seems like a good way to try out my new 8Mb broadband if you ask me.

 

Thanks for that great article!
I'm one of the Artists guys, and I really liked it.

Just a small correction: Our Fake Bank Database has reached the 5000 entries some time ago.

To answer a few of your questions and thoughts:
Yes, people who use the Lad Vampire or the Mugu Marauder are of course using some of their bandwith, but that has never upset any of theirISPs as they are paying for the bandwith (many people who participate have a flat rate).

And yes, you are right, only a very small amount of banks are killed with these two tools. The vast majority of banks are terminated with simple kill letters to the hosters. So the ones we DO kill with the Lad Vampire or Mugu Marauder are hosted by companies who either work together with the scammers or much more likely who don't care if there is illegal, criminal and fraudulent content on their servers (though all of them have ToS, which forbid that). And yes, these hosters don't like us very much, but honestly we don't care about that.

And to correct Zidane, we do only good and no harm. We are attacking only fraudulent websites. E.g. this one or this one or this one.
While these sites are not very convincing to people with some internet experience, the scammers are very successful with them to trick less experienced people into paying 10,000s of Dollars. The brain of many people just goes on stand-by when they see their very own name in an account on one of these "banks" with the figure $5,000,000 right besides it.
In case you are interested in the background of such a story and speak (read) German, here's a large article about 419 in Germany's #1 news magazine.

And to pick up the last line of the article: We appreciate eveyone who is teaching their friends, family etc about 419, however as long as Law Enforcement Organisations and the police in most countries of the world prefer to ignore this sort of criminality (either because they don't care or they don't have the knowledge) it's the internet community itself who has to take care of the problem. And that's what we do and we appreciate everyone's help.

 

I fully support and agree with what the Artists are doing. Mobbing is the best way to catch somebodys attention and rouse action.

BTW, is anybody here familiar with novels "The Magic of Recluce" by L. E. Modesitt Jr.? He presents the exact idea between being on black, white, and grey side, except wizardry in this case.

 

i would disagree. whilst on the whole, you guys do a great deal of good, as a network administrator i have seen the effects ddos's on servers before and know that whilst you will be very effective in taking out a single site, if there are other sites hosted on the same server or within a routed segment of that hosts network, they will also suffer. aa419 cannot avoid doing a little harm with flashmob bandwidth attacks due to the nature of the hosts (i.e. several sites hosted on virtual servers on the same machines, routing chokepoints, etc).

i should make clear, im not condemming you or suggesting that your doing anything wrong, on the contrary, i wholeheartedly support your tactics when 'flashmobbing' a site. your tools seem very well written to move on from a particular site when it is showing signs of disruption, and you limit your activities to specific dates and times, and specific targets, which you publicise in advance, and you take measures to try to avoid the need to 'flashmob' a site.

as you have stated, your intention is not to ddos the site out of existence, but simply to create a large enough spike in the traffic to ensure a human takes notice. i have to admit that you guys seem to take extraordinary efforts to avoid causing any disruption to anything but scam sites, but some will inevitibly occur.

personally, i can only agree with your tactics. if one of my own servers were affected for a day because it was hosted on the same machine as a scam site, you can be sure as hell i'd be poking the hell out of my host to sort it out. sometimes a little harm does everyone a lot of good, and from what ive read in the article and from your site on previous visits, it would seem you have done everything you can to minimize the harm.

 

i think this is great. I appluad everyone that supports this by running the tools. great idea i will definately be involved in the next flashmob.

 

We want to thank you all for the positive responses and Wil for the great article. Not all journalists do research a matter as thoroughly as you do. So a big for you!

We are happy to answer all questions you people may have or to discuss suggestions or improvements, either here or on our forum.

As already said by loPloP we need and appreciate all help we can get either with spreading the word or with killing fake banks. You are all invited to participate in the next Flashmob. If you don't want to miss it you can sign up for our newsletter (no spam, of course, no advertising or teasing stuff, you'll get just a reminder for the Flashmobs).

The Lad Vampire and the Mugu Marauder are updated permanently, so there's no need to wait till the next Flashmob, if you want to use them.

 

Sounds like a great idea, I will also try to be part of the next flashmob when I am at home. My college is kind of picky about bandwidth usage and I really don't need any more attention. But if there is one while I am at home I will definately join in.

 

your tactics are good. I would disaprove of you if you didn't send the letters out first though

(might join you in one of your mobbing actions soon)

 

def a white hat organization, i really appreciate the work you guys do, to keep the internet working for the rest of us

personal shoutout from me
thanx, Warrior_Rocker

 

While I would normally not condone or encourage such actions. It seems that in this case care has been taken to refrain from permanently damaging equipment and property. Hopefully as hosting companies begin to take notice the need for flashmobbing will fall and letters will be all that is needed.

 

I'm all for the idea, but anyone else think it sounds a lot like a DDOS attack?

In any case, I'll abuse my tabbed browsing powers and have some fun.

 

I think the fact that they do not actually bring the site down lends a lot of support for their tactics. They are walking a thin legal line, mind you, it will be interesting to see if there is legislation in the future to make these flash mobs illegal, which wouldn't surprise me judging from the fact of how out of touch with the times the government has become.

However I guess you could call this an early evolutionary form of cyber police. Hopefully as aa419 begins to grow in reputation they will begin to command more and more respect among ISPs world wide, and a simple letter will be enough to bring the scammers down, although I wouldn't mind seeing the people behind the sites prosicuted, so that they don't just set up a new site.

 

Just natural selection at play here, get caught out with this kind of scam, you don't really deserve the right to use the net unsupervised.

 

I am running the Mugu Marauder...

I just started now, and it's kinda neat! it even minimizes to the system tray so you aren't bothered by it...