I hadn’t heard of this one before. In New Zealand, people viewing adult websites—it’s unclear whether these are honeypot sites, or malware that notices the site being viewed—get a pop-up message claiming it’s from the NZ Police and demanding payment of an instant fine for viewing illegal pornography.
EDITED TO ADD (2/12): There’s a Japanese variant of this called “one-click fraud.”
trapspam.honeypot • March 4, 2013 2:25 PM
Who in their right mind would be looking at porn on the Interwebz. OK strike that. Who in their right mind would believe a popup saying they are being warned and to enter data about their bank account.
deoxyt2 • March 4, 2013 2:37 PM
This has been widely investigated in Spain.
http://unaaldia.hispasec.com/2012/03/el-virus-de-la-policia-evoluciona-e.html
http://unaaldia.hispasec.com/2012/02/vuelve-el-troyano-que-se-hace-pasar-por.html
Gweihir • March 4, 2013 2:41 PM
Not new, but with some efforts in NZ to ban online pornography (the nature of which I am unclear about, but some “feminists” seem to be behind it), people may be scared first and think later.
And, lets face it, the majority of men and even quite a few women are doing that and hence the target audience for such a scam are huge. At the same time almost nobody is willing to admit doing it, so most of those targeted will not ask others for help or insights. Kind of a though crime simulation. Some people will just arrive at the wrong conclusions and pay. This scam does exploit a rather severe bug in the way repression is still done today and the way most people deal with anything that has “sex” somewhere in it.
I would no get to see it though: I have long blocked any and all pop-ups via browser settings. There never was anything worthwhile in these pop-ups.
paul • March 4, 2013 3:05 PM
This is brilliant. I wonder if it would be a rational strategy for “free” sites…
Didn’t you cover a Japanese version of this?
Mark • March 4, 2013 3:19 PM
I always feel the need to comment on anything to do with NZ just to represent…
I’ve never really seen any NZ-specific porn sites (not that I’ve spent that much time searching, mind you…). I guess it’s more likely someone is doing an IP address lookup and showing the NZ police logo if the IP address belongs to NZ.
ALexT • March 4, 2013 3:41 PM
I have seen similar things at various clients computers…
I hear that their conversion rate is between 5 and 7% – a very lucrative business…
seanysean • March 4, 2013 4:13 PM
As somebody who occasionally fixes computers for acquaintances, i’ve seen this a lot.
The worst is the one where they show a kiddie porn picture, something I never wish to see ever again, with a Metropolitan Police logo asking for £200 in UKash to forget about it.
It got onto the computer by the son of a friend, and she was in bits. I wanted to kick the shinola out of her son for putting her through this, but being 15 he didn’t care. Neither did he download the kiddie porn to be fair, but he didn’t understand the magnitude of what was on there. If she had the money, she would have paid it.
Not a new scam – it’s been over Europe for years!
Dennis • March 4, 2013 4:33 PM
Not new, but also not limited to porn sites. A colleague’s computer was hit with one of these a few weeks ago visiting her doctor’s website. It claimed that the FBI had detected the computer accessing child porn or depictions of bestiality, subject to a $200 fine. This was a rather thorough ransomware Trojan; our security team couldn’t isolate it and wound up re-imaging the machine.
Nicolas Christin • March 4, 2013 5:23 PM
@gwern: There is a Japanese variant of this called “one-click fraud.” Described in extenso in our academic paper:
Nicolas Christin, Sally Yanagihara, and Keisuke Kamataki. Dissecting One Click Frauds. In Proceedings of the 17th ACM Conference on Computer and Communications Security (CCS 2010), pages 15-26. Chicago, IL. October 2010.
Available at: https://www.andrew.cmu.edu/user/nicolasc/publications/CYK-CCS10.pdf
jouser • March 4, 2013 5:40 PM
Google for the BKA Trojaner…..recent one of the scams targeted by Interpol…
Figureitout • March 4, 2013 11:03 PM
Who in their right mind would be looking at porn on the Interwebz.
@trapspam.honeypot
–People leading the elitist of attackers to a torrent of filth, clouding their hypothalamus and preventing them from attacking others while they attack “dead animals”. Btw, happy hunting.
Nobody • March 5, 2013 7:15 AM
I don’t think anyone can take NZ authorities seriously after passing such a silly law. (“Silly” and law… they do not go together, but people have been doing this for ages.)
Miguel • March 5, 2013 8:54 AM
There’s similar cases reported coming from Portugal.
We have this in Ireland… in Irish!
http://blog.eset.ie/2012/09/20/ransomware-in-irish-part-of-global-cyber-extortion-attack/
Harry Johnston • March 5, 2013 8:24 PM
@Gweihir: while I’m sure there are a few organized groups trying to ban online pornography in NZ, I haven’t heard anything to suggest that anybody is taking them seriously.
You’re not thinking of Iceland?
http://www.nzherald.co.nz/world/news/article.cfm?c_id=2&objectid=10865994
Harry Johnston • March 5, 2013 8:27 PM
@Nobody: what law are you thinking of?
Subscribe to comments on this entry
Sidebar photo of Bruce Schneier by Joe MacInnis.
Thomas Sewell • March 4, 2013 2:15 PM
There’s a U.S./Europe version of that as well which has been around for a while. Claims either Interpol or FBI authority, says it’s a “warning” and that your computer has been locked while running malware to prevent you from leaving the window and popping it back up after a restart. Does have integrated support to pay your fine online though… unusually good customer service obviously giving away that it’s not a real government program. 🙂