>> (p.1)
    Author Topic: Casascius phishers demanding a ransom  (Read 6539 times)
    casascius (OP)
    Mike Caldwell
    VIP
    Legendary
    *
    Offline Offline

    Activity: 1386
    Merit: 1141


    The Casascius 1oz 10BTC Silver Round (w/ Gold B)


    View Profile WWW
    October 26, 2011, 07:04:22 PM
     #1

    Open response to the e-mail below:

    Dear anonymous John Smith,

    Thank you for the interest you have shown in the coins I've been producing.

    While it's disappointing that you're interested in attacking my service, I find it to be a highly novel application that Bitcoin can be used for anonymous extortion.  You and I are both aware that I can pay you, and can never identify you, nor can I ever know whether the next person to demand a fee from me is the same you.  For the technology's sake, I will be highly amused if one day in the future I hear in the news that a ship is being held ransom and the demand is in Bitcoins.  If it happens, you could call yourself a pioneer.

    While you clearly have the genius to see this novel application for Bitcoin, I also think you may misunderstand my purpose in creating and offering physical Bitcoins for sale.

    My purpose in promoting physical Bitcoins is to promote the concept of Bitcoin and other ways it can be used by the public, without needing a software program that's only useful for geeks and which puts them at risk for theft from hackers.  If you try to disrupt my physical Bitcoin sales with attacks, you will probably succeed.  I probably will not go to much effort to try and counter a serious effort to attack it.  I am not persuaded that paying the fee you have asked will serve to stop the attacks.

    I should qualify how you might succeed.  You might succeed in shutting my site down or diverting people to a phishing site, but you won't succeed in stealing any of the value on physical Bitcoins, or my bitcoins which I keep on paper wallets virtually full time.  You will probably agree, offline private keys are immune to pretty much all online attacks.

    Further, you should know there is a limit to how many coins I can produce right now - I really can't sustain a very large volume in sales, so it is very possible I may be "DDoSed" in the near future simply by the legitimate business interest that is probably an indirect result of your scam site.  Either way, I have clearly succeeded in evangelizing the idea of physical cryptocurrency (with all due respect to BitBills), and I hope the community takes the idea a step further and does a better job than me at some point.

    I don't believe that these attacks are damaging my personal reputation.  I do believe, however, they damage the reputation of Bitcoin and make it unattractive to those not involved with technology.  That's unfortunate, but that's one of its features - anonymous really means anonymous.  I would prefer not to have another round of media coverage telling the world yet again another reason why using Bitcoin is risky.  But that's under your control.  Since you've clearly taken the time to understand how Bitcoin works, I assume and hope you would prefer that Bitcoin grow and succeed, than to attack its public perception.

    I would be happy to send you two or three of my coins free of charge to any physical address you choose at my own expense, just for having taken an interest.  Perhaps you can find a way to attack the physical coins, I'll be interested to hear if you manage to succeed.  Give me the address of a trusted stranger or acquaintance who will safely forward them to you with the same "txt" method you have used below, and I will oblige.

    Respectfully,

    Mike Caldwell

    Quote
    From: John Smith [mailto:1n5e5oqy7jplcgcqwnjafwxf27cb33z4dq@webmail.co.za]
    Sent: Wednesday, October 26, 2011 12:24 PM
    To: casascius@mc2cs.com
    Subject: do not relax

    do not relax, we just started playing.

    i will be happy to start real work with you untill i will not tired.
    there are so many interesting things waiting for you.

    but you can pay me to avoid of all this shit. my price today is 300 bitcoins and this is much less than the quality ddos protection and reputation losing during scam. price will grow.

    as soon i receive payment i drop off all my scam domains that affected you and will never interfere with your business.

    pay here: 1N5E5oqY7JpLCgcqWNjafWXF27Cb33Z4Dq

    verify me by TXT record of net domain.

    check for example here www.whatsmyip.us/txt <- casascius dot net

    I advise you to pay in 3 days.


    Headers:
    Quote
    <local stuff snipped>
    Received: from mailgate.wmint.net (mailgate.wmint.net [80.247.237.19])   by
     mail98c0.megamailservers.com (8.13.6/8.13.1) with ESMTP id p9QIOQw9018419   for
     <casascius@mc2cs.com>; Wed, 26 Oct 2011 14:24:28 -0400
    Received: from www.webmail.co.za (iweb4.wmint.net [192.168.100.6])   by
     mailgate.wmint.net (Postfix) with ESMTP id 53618380001A3   for
     <casascius@mc2cs.com>; Wed, 26 Oct 2011 20:24:25 +0200 (SAST)
    X-Mailer: Hastymail2 1.0
    Received: from unknown ([201.35.4.203]) authenticated user
            1n5e5oqy7jplcgcqwnjafwxf27cb33z4dq@webmail.co.za by www.webmail.co.za
     with        HTTP; Wed, 26 Oct 2011 20:24:25 +0200
    To: <casascius@mc2cs.com>
    From: John Smith <1n5e5oqy7jplcgcqwnjafwxf27cb33z4dq@webmail.co.za>
    Subject: do not relax
    Date: Wed, 26 Oct 2011 20:24:25 +0200
    Content-Type: text/plain; charset="UTF-8"; format=fixed
    MIME-Version: 1.0
    Message-ID: <df1a51b4de2c7cab24c8ab4d463aa1c9@www.webmail.co.za>
    Content-Transfer-Encoding: 8bit
    X-MMR: 0
    X-CSC: 0
    X-CHA: v=1.1 cv=aPPZer4WAhGcx+vP3fBwqKtPsjyFzNUAiOP+sulbenA= c=1 sm=1
          a=BLceEmwcHowA:10 a=IkcTkHD0fZMA:10 a=d0tj6I8CGchA31JZUvxdow==:17
          a=gGsXarMTAAAA:8 a=irAyJklUAAAA:8 a=8ByQLoDwAAAA:8 a=qkRcwGf7Vyti2Gyff24A:9
          a=QEXdDO2ut3YA:10 a=d0tj6I8CGchA31JZUvxdow==:117
    Return-Path: 1n5e5oqy7jplcgcqwnjafwxf27cb33z4dq@webmail.co.za
    X-OriginalArrivalTime: 26 Oct 2011 18:24:14.0125 (UTC) FILETIME=[76D76DD0:01CC940C]
    X-MS-Exchange-Organization-SCL: 5

    Companies claiming they got hacked and lost your coins sounds like fraud so perfect it could be called fashionable.  I never believe them.  If I ever experience the misfortune of a real intrusion, I declare I have been honest about the way I have managed the keys in Casascius Coins.  I maintain no ability to recover or reproduce the keys, not even under limitless duress or total intrusion.  Remember that trusting strangers with your coins without any recourse is, as a matter of principle, not a best practice.  Don't keep coins online. Use paper or hardware wallets instead.
Page 1
Viewing Page: 1