Sunday, January 24, 2010

What Category is This?

Today, I got my first social engineering tell in Aion.

Sure, I've got plenty of gold spam whispers, gold spam mails, gold spam apologies over the combined worlds of City of Heroes, Warhammer and Aion. (How odd, the spammers never bothered setting up camp in Age of Conan - I guess they smelled imminent collapse just as fast as we did.)

This morning marks the first time some randomly named character sent me a whisper, telling me that my account has been banned because it has been detected participating in real money for Kinah activities and to please go to XXX site with na-ncsoft and other legitimately looking but ultimately bogus words in the link.

Wow, they must be getting desperate. And I have to say, I bet a ton of people fall for it. Those not net savvy enough or forewarned or just with a teensy bit of guilt on their minds for using RMT perhaps.

I immediately blocked the character and sat through 15 minutes of inconvenience attempting to submit a petition via Aion's somewhat dodgy UI and lousy character limit.

I didn't manage to copy all of the whisper that was sent to me before running out of space, but presumably the intent of the message came through.

I also realised that I didn't quite have a name for this sort of activity.

Gold spam conveys a spammed advertisement for gold. That's not quite it.

Social engineering is too long and clunky and this specific type of activity is only a subset of this category.

Account theft is what it HOPES to be, but you cannot accuse the fella of having stolen your account yet unless you participate in it and follow through with being stupid.

Attempted impersonation of an NCsoft staff is also sort of factually correct, but misses the point and the urgency of getting this mongrel offed as soon as possible.

Harassment, nuisance, being a pain in the arse, and so on is too general as well.

Using scare tactics in order to encourage someone to visit a keylogging site and/or enter their name and password is too specific.

Oh. It just hit me. Phishing. Is that what this is called? Or at least the first step of it.

Sucks that I have to think so long and hard to figure out exactly what type of attempted criminal or at least iffy behavior needed to be reported.

No comments: