Yesterday, I got this charming little item in my email inbox - a rather slick attempt to steal my credit card information:

Dear PayPal Customer

PayPal is currently performing regular maintenance of our security measures. Your account has been randomly selected for this maintenance, and placed on Limited Access status. Protecting the security of your PayPal account is our primary concern, and we apologize for any inconvenience this may cause. To restore your account to its regular status, you must confirm your email address by logging in to your PayPal account using the form below:

Email Address: Password: Bank Account Enter Bank Account #: Credit Card Enter Credit Card #: Exp. date : 01 02 03 04 05 06 07 08 09 10 11 12 / 03 04 05 06 07 This notification expires March 31, 2003

Thanks for using PayPal!

This PayPal notification was sent to your mailbox. Your PayPal account is set up to receive the PayPal Periodical newsletter and product updates when you create your account. To modify your notification preferences and unsubscribe, go to https://www.paypal.com/PREFS-NOTI and log in to your account. Changes to your preferences may take several days to be reflected in our mailings. Replies to this email will not be processed. If you previously asked to be excluded from Providian product offerings and solicitations, they apologize for this e-mail. Every effort was made to ensure that you were excluded from this e-mail. If you do not wish to receive promotional e-mail from Providian, go to http://removeme.providian.com/. Copyright© 2002 PayPal Inc. All rights reserved. Designated trademarks and brands are the property of their respective owners.

I'm embarrassed to say, if this thing had been just a little more clever I might have fallen for it, too. If it had just asked me to log in - instead of entering my credit card info - I probably would have done it.

Of course, once the bad guy has my paypal account name and password, he could easily get my credit card number right from there. Being as how this "bad guy" is probably some snot-nosed 14 year old in the Philippines so I suppose I should not be surprised.

The moral of the story? Email is easy to fake. When in doubt, fire up your browser and go directly to the website in question. And remember - no legitimate vendor should ever ask for sensitive information by email or over the phone.

On a related note, The Register offers a link to an excellent browser test which checks for common security holes. Turn off your pop-up blocker before you visit.

comment

A terrible, terrible nightclub fire killed at least 50 people last night in West Warwick, Rhode Island, and injured over a hundred and sixty more. About 300 people - most of whom were to become casualties - gathered to watch the band Great White, which normally uses large, sparkler-type pyrotechnics as part of their show. Ironically, a local news cameraman was on the scene, gathering footage for a story about nightclub safety in the wake of trampling incident in Chicago that killed 21 people last week.

The camera catches it all. Within seconds of the sparklers being lit, the eggcrate soundboard behind the band catches fire, and the fire quickly spreads to the ceiling.

While the cameraman is already making his way to the door, other patrons can be heard commenting on how cool the fire looks, unaware that the situation has gone horribly out of control.

Seconds later - literally, just a few seconds - the club is filled with thick, black, toxic smoke, the kind of stuff that will drop you to the ground after one good breath of it.

From what I have heard from initial news reports, the club was not overcrowded, and the emergency exits were not blocked. From what I have seen of the footage, I'm amazed that so many people were able to escape at all.

Reportedly, no permits were granted for the use of the pyrotechnics, and the band's pyrotechnic expert was not on the scene for this particular show. Presumably, the band does this all the time, and their crew just set up the gear the way they always do. Nobody seemed to notice that the eggcrate wall was not fireproof; nobody took the time to set a fire extinguisher within reach. Nobody took in the whole picture, and saw the danger of putting fire at the base a styrofoam wall in a crowded, wooden nightclub.

That camera footage is just chilling. My heart goes out to the people who are suffering through this now.

After all those people died in Chicago, my brother made a comment that is worth repeating here.

If this had been a terrorist incident instead of a tragic accident, the media would have freaked out. We'd have seen weeks of "America In Mourning" news reports, seen endless interviews with brave heroes, seen miles of ribbons and flags and listened to politicians and pundits describing every aspect of this thing for months. As it is, the Chicago incident is already forgotten and this one will probably vanish from the media radar before the month is out. Yes, it really was terrible, and yes, we ought to fix whatever it was that needs fixing. And then we just move on.

We will need to get that way about terrorism, too, and I suppose after the fifth or sixth incident, we probably will. We do not need the media freakshows any more. We don't need to renegotiate the very foundations of our republic every time something bad happens. We don't need to elevate each terrible local tragedy into a full-scale national crisis.

We bury our dead, fix what needs fixing, and move on.

He's right, of course, but it does seem a little cold to be saying that sort of thing now. I think it's because of that camera footage - you can see it, and believe it, and really begin to understand, at a gut level, what a hideous thing has just happened there. The incident in Chicago happened without the benefit of a news crew inside at the time, the horror was hidden from us and it was easy to forget about it the following day.

Maybe that's a good thing, and maybe it's not. All I can say is, I don't think I'll ever sit in a bar again with thinking about that fire, and thinking about how fast I can get my sorry ass out.

comment

There is an old saying - presumably a curse - which has been rattling around in my head for some weeks now:

"May you live in interesting times."

Things may be getting pretty interesting soon.

Obviously, we will be occupying Iraq, one way or another, in the coming months. War is an uncertain enterprise and there is always the very real risk of an unfortunate surprise, but honestly, I'm not all that concerned about the fighting there. In my gut, I feel like it will turn out pretty well.

The bad guys have been busy over the last year, in a bumbling, half-assed sort of way. They got caught brewing ricin in London, they tried (and failed) to blow up one jetliner and shoot another jetliner down, they knocked a hole in a French oil tanker and assassinated a handful of people overseas. However, there has been little uncovered, as of yet, concerning a major attack on US soil.

The optimists among us see this as a hopeful sign. We have been pounding the bad guys incessantly, and we might very well have crippled their ability to respond in a massive, coordinated way. With the leadership in disarray, their communications compromised, and their current operations disrupted, they might be unable to offer more than the occasional Richard Reed in response to our assault.

Those with darker hearts see something different; from a strategic standpoint, we believe that the bad guys understand that they simply must outdo themselves this time around. If their next major attack on US soil is smaller than 9/11 it will look as if they are losing, but if they manage something bigger, even if it takes them years to pull it off, they will once again be a global power to be feared.

I have three specific reasons why I believe that the darker version of events is probably the more accurate of the two:

1) We have not foiled a major attempt on our soil since 9/11. Either this means they have not attempted it, or it means we have simply not seen what they have been up to. I do not believe that they have abandoned their efforts here, and frankly, I'd be feeling a lot better if we had broken up a large-scale plan by now.

2) We know that they have mature capability that they have not deployed. Consider the lifecycle of a large-scale terrorist attack: first, you dream up something clever, then you work out all the details, then you run some tests to see that everything will work the way you hope; then, you start training people, you get your logistical train in place, you get personnel and equipment positioned where you need them. Finally, you start executing your plan, maybe a few years from the time you first dreamed it up.

Some of the people we arrested in the wake of the 9/11 attacks had licenses to drive Hazmat trucks. This was not just part of their cover, not just a way for them to make money while they blended in to American society. This was the implementation level of a mature plan, probably just weeks away from execution. These specific operatives are gone but much of the work that had gone into this plan presumably remains intact.

Other mature technologies? We have our ricin lab in London, of course (the ricin itself remains unaccounted for) and we have Richard Ried's small, non-metallic, jetliner-killing bomb. They can make a dozen more of these things if they want to, and there is not an airport in the world that can detect them.

3) Historically, the big attacks have come years apart. The sort of delay we are seeing now is typical, and not unusual at all.

Update: I was literally just finishing this post when Drudge featured the following MSNBC report:

The State Department warned Americans abroad Thursday of the threat of new terrorist attacks using chemical or biological weapons. The worldwide alert came as U.S. security officials told NBC News that they were considering raising their assessment of the threat of terrorist attacks to orange, its second-highest level, citing intelligence indications of plans for a "major attack" as early as next week.

Interesting, huh?

comment