Schneier on Security

People do think, morons do not.

Despite the legions of active members on craigslist, only a handful of opportunist-thieves actually went. I do not buy "but the interwebs said so" position, they knew what they were doing was wrong -- backed up by the fact that even when they were rightly confronted in their get away, they refused to give anything back.

I heard the guy got some license plate numbers: I hope and expect these people will be prosecuted to the full extend of the law.

They literally took everything; and the kitchen sink.

Nice hack, now to implement ... considering some of the bad peoples I've experienced in this life ... just kidding.

How would one protect themselves from this sort of stuff? I don't get it, but the magic in the word 'free' is amazing. Furthered by "I saw it on the Internet hence, it must be true" mentality. More furthered by the (likely) melee at the residence of the victim.

I'm flashing back to a bit in one of Gladwell's books ... where a bunch of folks saw someone get shot, yet none called it in ...

Quick! Sprinkle everything with smart water!

Sadly, this isn't the first time someone pulled this stunt. In happened in Washington a while ago as well. I don't recall the details exactly, but I believe is was about a year ago in Tacoma.

The funny thing, not what happened to the guy but this story popping up here when it did... I had just got done reading about Alice sending 100 pizza guy's to Bob's house in Secrets and Lies (p 184). And then I see a real world example in my RSS feed not 5 minutes later.

I found the article on the previous hoax: http://archives.seattletimes.nwsource.com/cgi-bin/texis.cgi/web/vortex/display?slug=webhouse05m&date=20070405

A follow-up story: http://archives.seattletimes.nwsource.com/cgi-bin/texis.cgi/web/vortex/display?slug=craigslist17m&date=20070517

http://www.komotv.com/news/7539857.html

from local fish wrap

http://www.mailtribune.com/apps/pbcs.dll/article?AID=/20080323/NEWS/803230338

http://www.mailtribune.com/apps/pbcs.dll/article?AID=/20080324/NEWS/803240308

So ... easy revenge. Take those license plates, and post adverts on Craig's List -- "My husband just ran off with his secretary, and told me to sell his car. It's (license) and it's parked (here), just take it away."

Sweetest revenge is the kind you think about, chuckle a bit, and move on with your life ;)

I have no way of knowing if this example is genuine, but a friend of mine who has been severely harassed by neighbors was subjected to this hoax for real a year or so ago.
Fortunately, she was home and didn't lose much.

I don't get it. Did he have no lock on his door, and if he did, did the looters actually break in? Or was all his stuff just lying around the house?

I am not trying to blame the victim here, as the looters deserve punishment. But valuables should be secured against theft no matter what its cause is.

I had a friend who once told me that when someone undertake the burden of writhing a book, what he had written in shall be taken as true. This friend was an accomplished engineer and the very instant when he said that to me excluded any kind of joke or methaphoric sense. I did'nt wanted to vexe him but had keep certain reserve about his thought except for a embarashment smile. Alas, this story made me had this same funny smile, remembering a situation almost exacly like this one described above when a neighbor had his belonings taken by passerby who, an ad with a misspelled " to rid" intead of "for sale", returned home with whatever they could take from his garage just because it was written on this ad. And the arguing thed had to keep the stuff...

So to quote: @nonamethx
"People do think, morons do not."

Is a suitable and correct observation.

By the way, now, with this marvelous personnal printer, you know, this nicknamed "all-in-one", I do feel, except for the truly unfortunate designative nickname "moron", ready to own this planet and being very busy à this moment printing whatever necessary to prove to whom it belongs...

I'm surprised nobody got killed. Imagine if the owner had a shotgun... this could have ended in a bloodbath.

I have to ask, didn't he have locks and alarms?
I think that the two are a must in modern world.

You'll have to replace the SmartWater story in your next writeup about the security mindset with this anecdote, Bruce.

Forgetting the idiots who came to pick up the stuff, it should be whoever posted the notice online who gets the blame for this. They did the equivalent of screaming "fire" in a theater and even if people fell for it, they're the one to blame.

It's easy to blame the fools who took things, but it's also easy to blame the troops for a war.. when, in fact, the trigger came from elsewhere.

To all the commenters talking about locks and all, please remember that you have a bunch of stuff in your yard that doesn't get locked up. Things like your lawn ornaments and statues, bird bath, lawn chairs, garden implements, and everything else that you normally leave outdoors. This guy had a horse, so he probably had a barn and various equipment that he leaves out for convenience. Are you supposed to take everything indoors every night including all your outside light fixtures, garden hoses, and so on? Get real, at some point of locking everything up, life becomes too cumbersome to be worth it. He doesn't want to live in a concrete bunker, he wants to live in his normal ranch house on a 2 or 3 acre lot with all the normal things that you probably have lying around outside right now. And he doesn't want to do anything more than you normally do to protect it. God forbid, he might even want to leave his car parked outside where anybody can just tow it away.

I wonder if Craigslist should be prosecuted.
Craigslist could claim that it was a identity theft.

Then, the court might challenge the notion of identity theft, and Bruce would be delighted.

@ wonder

I have a feeling that you really didn't think about the "chilling effect" on all the Internet which would result from a ruling against Craigslist in this incident. Right?

Not at all worthwhile even if it leads to some kind of better legal definition for "identity theft".

@Peter:

"They did the equivalent of screaming "fire" in a theater and even if people fell for it, they're the one to blame."

No, it's more like screaming "free drinks in the lobby" in a theatre really. People fall for it, but the difference is that they WANT to do so because they're greedy (a perfectly understandable human thing, but still).

Of course, the person who yelled "free drink" in the first place is the one who ultimately is and should be held responsible, but those who claimed to believe what he said because it was a convenient way for them to get a free drink without paying... those aren't exactly blameless, either. They SHOULD have known better, and even if they didn't, they had no excuse anymore after the theatre owner himself came in and said that no, whoever made that claim was not acting on his behalf.

I'm intrigued by the greed, really, not the hoax itself. Interesting how some people see "free" and immediately think "gotta get mine" -- the opposite, of course, to "I have enough".

I wonder what size community this took place in -- the gentleman has a horse so it must be fairly rural -- and the distance people traveled to get his stuff. Does 30 people represent an appalling number, or a reassuringly low number?

Maybe this is an example of why you should be nice to people, so that they don't arrange for all your stuff to be taken. Someone has to be pretty pissed off at you to send people to your house to take your stuff.

Sure, it could have been random, but how often is your car being keyed random?

I bet those folks here with the "security mindset" could come up with a lot more attacks like this one. Are there other examples of people tricking morons into doing their dirty revenge work for them? I can't think of any really good ones off the top of my head, but I bet others here can come up with ideas in the genre...

I don't think that those individuals sincerely believed the ad. I think that they used the ad as a pretext for theft. The owner confronts them and tells them it is a hoax, but they take away his things anyway. That's not an honest mistake. It's akin to juror nullification. The ad is just an excuse for theft.

@Joel Odom

"but I bet others here can come up with ideas in the genre..."

Joe Frank (http://jfwiki.org/index.php/Main_Page) produced a show called "Warheads" (http://jfwiki.org/index.php/Warheads) where there is a brief monolog where one guy exacts revenge on someone by calling him on the phone, and after 'explaining' he works for a cab company, threatens to come over to his house with a crowbar to deal with the guy. After hanging up, he then orders a cab to the targets house, casually noting that someone's baggage is stuck (or some other excuse -- it has been years since I have heard this show), and could the driver please bring a crowbar to the door to help?

Wow, and the crew posting here today doesn't think about the really malicious angle? Break in, rob the place of the items you want, then invite everyone down to get free stuff.

Talk about compromising a crime scene...

Everyone would be so busy talking about the craigslist abuse that the actual crime might be overlooked.

@havvok:

Now that I think about it, I'll bet the poster was among those participating. He probably used the Craig's List ad to cover his tracks and make an excuse in case he got caught with the stuff.

@RonK

I do think that everyone publishing or citing phone numbers (or locations or emails or other contact details) either should have checked the consent of their contacts, or should clearly state on the same web page that any contact detail is unchecked, banned and should be denounced to the webmaster.

I'm moving to Australia and giving away all my stuff because I'm independently wealthy. Here are my US addresses - just come on by and take anything you like (The guards are just there for show, ignore them.):

1600 Pennsylvania Ave., Washington, DC 20520
Pentagon, Washington, DC 20001

I had a front yard that the previous owners had removed the grass and replaced it with red rock (apparently due to allergies). Last summer I put in sod and so I had to get rid of the red rock. I put a "Free Red Rock, Come and Get it" ad up on Craig's List and, sure enough, people started showing up and taking it away. I noticed that there were some who would verify that they could take it by calling and/or knocking on the door. However, there were some who simply showed up and took the rock.

Now, Craig's List obviously can't be held responsible for this. In my opinion, entering someone else's property and taking any of their belongings with out first having had permission physically given by the owner (not just phone/email/fax/internet) is theft. This seems to be a case of actual thieves seeing an opportunity combined with some people who place ignorant and naive trust in the internet.

Similar thing happened in Springfield Oh, a couple of years back. Someone called to a local "unskilled workers for hire" place, claimed he had a house that needed knocked down and gave them an address. A bunch of people with hammers and crowbars went there, demolished the suburban residence - and then the owner came home and had a fit upon discovering someone had destroyed his house.

Wouldnt you be suspicious when you went to knock down a home and it still had TV, appliances, clothing and water/power/cable/phone still worked?

@N: He probably did - someone took it...

Some time in the next few months I'm planning to move away from my current apartment and I really will be giving away many of my belongings. The key differences are that I'll be present at the time to hand the items over and make clear what is and isn't up for grabs; I can easily prove, and people already know, that I really am the legitimate resident of the apartment in question; and I'll be distributing the ad for it by email to people I already know, not to Craigslist.

Perhaps Craigslist under fire, suddenly?

I note that both these events occurred in Oregan.

Saw this hours ago on CNN, the photo was a horrible depiction of a bloody baby, apparantly from the site:

http://www.kptv.com/news/15710398/detail.html

"... Craigslist Ad Lists Baby For Sale For $1,000 ..."

"... LEBANON, Ore. -- A Lebanon couple said Tuesday they were the victims of a sick joke after someone used their name to list a baby for sale.

An ad on Craigslist.org said the baby’s mother wasn’t coming back. It also said the posters of the ad were out of “tweak,” or drugs, and would sell the baby for $1,000.

An e-mail address attached to the ad included the name Birdie Avery. But a woman who shares the same name in Lebanon said she doesn’t recognize the baby. She said she and her husband don’t own a computer.

“I don’t know if this is somebody’s really sick April fools joke," said Avery's husband, Rick Avery. ..."

This seems like a natural extension of the online Joe Job. And ultimately not really possible to deal with except in social fashion (or by somehow forbidding giveaway ads except under carefully regulated conditions)

@Tamas: The guy stops a truck that's filled with his stuff, demands it back, and the drivers show him the fake ad and refuse to return the goods. Do you honestly think that people like that would hesitate to break a window or bust down a door? At any rate, even if he forgot to lock one of his doors, it's still like asking why a murder victim wasn't wearing body armor.

@N: Hopefully, that's what will happen next time. If we get an incident where a bunch of the looters are killed, then future Craigslist looters will think twice before going through with it. It's not like the looters showed even the slightest hint of remorse.

@konrads: I already went over the lock thing, but I should add that very few people in rural areas (which I assume this to be) have (or need) alarms.

@Peter: The looters are absolutely guilty. They had to know that the ad was a fake. For a long time, a hit man could be found guilty of murder, but his employer couldn't. Then the idea was developed that both could be 100% guilty. So why can't we place complete blame both the hoaxer and the looters?

@RonK: What "chilling effect"? While there is a legitimate need for anonymous speech, there is no need for anonymous advertising. The only people who benefit from anonymous classifieds are hoaxers and crooked companies that want to carry out deceptive advertising campaigns (bait-and-switch, etc.) with plausible deniability.

@Joshua Volz: Go to hell. Lots of crimes are random, or because the perpetrator was unjustifiably angry at the victim. Paul Craig Roberts once related the story of a family that was approached by a sheriff's deputy who wanted to buy their property for a fraction (say a quarter) of its actual value. They declined, and ever since have been harassed by the sheriff's department, even to the point of the son being framed for a drug offense. They may have "pissed him off", as you would put it by declining his "offer", but it's impossible to say that they were unreasonable or "not nice". You're basically saying, "His house was looted. He must have been a real asshole." Way to blame the victim, dude.

By the way, you've "pissed me off", so please post a link to a high-res scan of your driver's license, I have an ad to place. I assume you won't complain. (Or does that only apply to other people?)

@havvok: I'm sure you're right.

My second thought when seeing this story was, "Hm, if you're really pissed at someone and you have insurance, just put your photo albums and important papers lockbox under the house, then drive over to their place and wardrive their wifi. Log into Craigslist via their Internet connection, and post this ad. Then go on vacation."

Worst thing happens, you claim the loss on your insurance. Best thing happens, your enemy gets blamed for it.

Ah, the joys of rural living. I knew someone who lived on a ranch. When her dad told the son of the family on the next property not to hunt on his property, the guy came back that night and maimed their horse with a shotgun. The sheriff couldn't make any charges stick, because no one actually saw the suspect shoot the horse. Purely circumstantial evidence. I wouldn't be surprised if this Craigslist thing was based on a similar petty dispute, but with a higher tech "solution" to being pissed. Lucky nothing worse happened.

you think people would know by now:

security cameras on your home pointed in every direction will eventually pay for itself over and over again!

by late Monday afternoon, items were "starting to piling up" in Salisbury's driveway.

Hate to be that grammar guy, but if that isn't a misprint, it's certainly telling ;).

"Three alleged software pirates face criminal copyright infringement charges for selling illegal copies of popular software titles on Craigslist."
"Lnu offered the deepest discounts, selling 18 titles worth $9,900 for only $45."
http://www.internetnews.com/bus-news/article.php/3637991

Craigslist seems to be empowering thieves of all sorts.
Security tip: AVOID CRAIGSLIST

More CL Morons
"Police have the person they say is responsible for an ad trying to sell a baby on Craigslist in custody. Dallas, Oregon"

I've lived most of my life in rural areas where people hardly even bother to lock their house, let alone the barn and toolshed. Thieves aren't much of a problem for two reasons: Most thieves are the kind of person that finds rural life too boring, and if they do burglarize country places they're apt to be shot.

Salisbury just didn't have the correct tool to straighten these vultures out.

"I've lived most of my life in rural areas where people hardly even bother to lock their house, let alone the barn and toolshed. Thieves aren't much of a problem for two reasons: Most thieves are the kind of person that finds rural life too boring, and if they do burglarize country places they're apt to be shot."

This is changing with the rapid influx of migrant workers from Mexico, appearing in all corners of the U.S.. Sure, many of them are good people just looking for work and to live in a better place, but that's so often not the case. Talk to anyone living in a rural area and you'll often hear stories of migrant workers breaking in and stealing their stuff. It's more common than you think.

"Craigslist seems to be empowering thieves of all sorts.
Security tip: AVOID CRAIGSLIST"

I wouldn't blame Craigslist, I would blame the ugly side of humanity. Shit like this will happen so long as humans exist, no matter the medium. There are forces at work who would love to see Craigslist go under, anything free or cheap is always scuttled by the corporations. Give it time, someone will plant other people for other stories and try to blacken Craiglist's name further. I don't even use Craiglist, but without it how many popular alternatives do you have to e-screwme-bay?

When I first heard this story, I did not believe it. After reading various accounts of this story, I realized how easy an ad of this sort could be posted.

Although Craigslist is a good thing, we have to have some level of accountability stated in which messages like these are vetted and confirmed for accuracy.

It is scary, because I travel frequently and this could happen to me. Although my 110 Giant Schaunzer would not let this happen! :-)

-NW

they caught the folks who did posting, but here is the best part, they did it to cover up their own thefts..

http://www.mailtribune.com/apps/pbcs.dll/article?AID=/20080401/NEWS/804010316

Someone's trying to scam me too. He (claims to be Marina, some keny's girlfriend) has been mailing me about an apartment that he would like to rent me (since I had posted an ad about wanting to rent a place in Vienna). He writes from the email id: kenywiliams@yahoo.com and says :

No i am Marina and my boyfriend is kenny...Anyway i am sorry i cant wait till you arrive before making the payment..Rather here is a suggestion

If you can Put the Money for the
rents and Security deposit together at
the Western Union office in the name of
your friend,relatives or your partner as
the receiver but it will be sent to a UK
address but if you dont have
anyone,then you can use mine(Arlington
street Westminster London sw1a UK)
then you show a proof of the payment
like a scanned copy of the receipt or the
details on it so that i can check with
western union if the money is truly
available with them and the amount is
correct then we will fix a meeting date
next week and upon meeting in my flat
we will sign the contract if you are ok
with the terms and condition in it then
you can now go back to western union
office to take the money for me or you
can easily change the receiver name to
my name so that i can pick up the
money..

Waiting for your decisions

vishnus@iitk.ac.in wrote:

Hello,

So is your name not Keny? I'm sorry if I sound suspicious because I just
read the advice on craigsite regarding money transfers using western
union, etc. When would you get back to Vienna? I would be willing to make
the deposit only in person once I get to Vienna in May. So the deposit
for June would be made well in advance but I would like to meet someone
in person and pay through a cheque or something that I have proof of. I
would also need the pics before I make any deals about this. I would get
somebody to visit the address with the pics and look at the place because
I'd like one of my friends in Vienna to make sure I'm doing the right
thing. So thank you for your patience.

Regards,
VIshnu

> Here are my details Marina Borrell; 44 Colebrooke Row Canary Wharf London
> N1 8AF.; Holder of Passport Number: XD109309
>
> vishnus@iitk.ac.in wrote: Hi,
>
> Can I have your name, current address and passport id so that I can
> confirm your details too before I actually make any kind of transfer of
> money? I had already sent you my mailing address. I will send you my
> passport id after you reply with your personal details. Thank you.
>
>
> Regards,
> Vishnu
>
>
>
>> Hi,thanks for your quick response.It gives me impression that you are
>> really serious about renting the place.Sorry i am not in the country at
>> the moment as i have return to UK where i work.So i can only send you
>> pics
>> to help you decide if you will be renting it or not.Ok?You can begin
>> rent
>> from either May or June
>> To get the place reserved for yourself,you will have to make the payment
>> to me here in London by western union but before payment we both will
>> have
>> to sign a rental agreement form in which i will be needing your
>> following
>> details such as
>> your full names and address
>> your move in and out date
>> your passport ID number
>> Also i will need and address where you would need me to post the keys
>> as
>> soon as the contract is signed and payment is confirmed.Waiting to read
>> from you
>>
>> vishnus@iitk.ac.in wrote: Hello Keny,
>>
>> I sure am interested! I will get to Vienna on the 5th of May. Right
>> now,
>> I need the place only for the month of June. I have asked my host
>> institute if I'd need to find a place of May and July as well because
>> they had initially told me that they would do that for me and that I
>> would have to find a place only for June. SO that is how it stands now
>> but in the event that they are unable to find me a place for May and
>> July, I would need to rent it for those two months as well but at the
>> moment, I can only commit to the month of June. I would like to wait a
>> few days until monday or tuesday when their office opens so that they
>> can
>> tell me whether to rent a place for June only or for all three months
>> (May, June and July).
>>
>> Could you send me pictures of the bedroom and the apartment?
>>
>> My mailing address is:
>>
>> Vishnu Sreekumar
>> Room No. A 307
>> Hall 1
>> Indian Institute of Technology (I.I.T), Kanpur,
>> Kanpur 208016
>> Uttar Pradesh (U.P)
>> India.
>>
>> I would like you to wait until I get a response from my host professor
>> about this issue of renting for June only or for all three months. Would
>> you wait until Monday or Tuesday before we finalize this?
>>
>> About the deposit, is it okay if I make the deposit in the month of May
>> after I get there so that I can meet you and hand you the deposit
>> directly?
>>
>> I will be working from 5th May - 24th July at:
>>
>> Institut fur Shallforschung
>> Wohllebengasse 12-14
>> A 1040 Wien
>>
>> How far is the apartment from here?
>>
>> Thank you.
>>
>> Sincerely,
>> Vishnu
>>
>>
>>> I read some ad on craigslist and i found yours among some
>>> interesting ads and i want to give you a trial. below is the detail
>>> for
>>> the
>>> available flat that you will be renting or probably sharing .Hope you
>>> like it?And hope you're serious as i have a lot of people interested
>>> to
>>> rent and some people have wasted my time before in the past. this flat
>>> is located in city center of Vienna very close to the UNI and for free
>>> access to any where in Vienna .Await your reply back so i can forward
>>> you
>>> agreement form to read and sign back if its ok with you.Get back to me
>>> with
>>> your full name and address to mail the agreement
>>> Rent: 100euro Per Week ( 400euro Per Calender Month) Deposit:
>>> 600euro Utilities include: electricity, gas, cable, phone.
>>> internet access
>>> Available: 1/01/2008 Minimum stay:Weeks or months Flatmate
>>> Description
>>> Personal info: kenny , 28 yrs. old , Female , Straight ,
>>> Professional working with a delivery company here in Oxford ,
>>> Capricorn
>>> Preferred flatmate description
>>> Age: from 18 to 45 yrs. old
>>> Gender: Doesn't matter
>>> Smoker: Outside smoking
>>> Orientation: Doesn't matter
>>> Pet: Doesn't matter
>>> Room and apartment description Features: Brownstone, Flat #,
>>> Parking available,No parking cost, 3 Bedrooms, 3 Bathrooms
>>> Neighborhood:
>>> N/A
>>> Home amenities: Alarm system, Cable ready,Washer/Dryer,
>>> Dishwasher,Microwave, Kitchen access, Storage.House amenities:
>>> Furnished, Air
>>> conditioning, Private entrance,Private bath, Phone jack, TV, Cable
>>> jack,
>>> Closet. Hope you like it?
>>>
>>>
>>> vishnus@iitk.ac.in wrote: Hi Keny,
>>>
>>> I was not looking to rent an entire flat because I would not be able
>>> to
>>> afford it. I can pay upto a max of 450 euros per month for a room. If
>>> you
>>> have something like that, please let me know. Let me know the rent for
>>> your flat anyway and details about it. Thanks.
>>>
>>> Regards,
>>> Vishnu
>>>
>>>
>>>> I just read you ad and i am pleased to let you know that i have a
>>>> lovely
>>>> flat that i am willing to rent out to you.So do get back to me if you
>>>> are
>>>> interested
>>>>

Yes, I confirm the Marina Borrell story. It also happened to me with a flat in Stockholm.
What can I say ? BE CAREFUL ! And when you think it is weird, it is because it is weird.