I got the following email from the Motley Fool the other day, here are some excerpts:
The two words Bill Gates doesn't want you to hear...
They spooked the Microsoft founder into early retirement. Now they're going to bring down his empire and make a handful of investors rich. You can join them -- but you must act now.
Dear Opportunistic Investor,
On October 30, 2005, something incredible happened... In Redmond, Washington, one of the world's richest -- and most powerful -- businessmen sent an urgent memo to his top engineers and most-trusted managers.
It sounded the alarm that a very disruptive "wave" was about to wash over the entire world -- forever changing the way we get information and do business.
It also warned this would wipe out the $300 billion business empire he'd spent his life building.
And that's precisely why the two words "cloud computing" scare the hell out of Bill Gates. You see, he realizes that thanks to the thousands of miles of fiber-optic cable laid during the late 1990s, the speed of computer networks has finally caught up to the speed of the computer processors.
Buying this tech juggernaut today is like buying Microsoft in 1990...
My point in reprinting this is that the entire email is a sensationalistic message about how cloud computing is going to revolutionize the industry, how you need to subscribe to their newsletter in order to get the three names that you can make a pile of money on, and how Bill Gates was so afraid of this development that he's decided to go into early retirement.
Is it just me, or is this a near perfect example of stock spam?
- It says that the companies contained within are going to take off through the roof.
- It says that you have to get in now!
- It contains some obfuscation... the names are not in the newsletter but instead you have to subscribe to the service.
- But one slight difference -- it borrows from real life by throwing around a credible name (Bill Gates) that acknowledges that cloud computing is the way of the future.
The Motley Fool is supposed to have a reputation that they are on the side of the average investor. But by publishing stuff like this, I really don't think that they are much different than financial television shows and, dare I say stock spammers, that sensationalize stocks. Really, I expect better from the Motley Fool. Stop publishing such nonsense.
Incidentally, their claims about Bill Gates are ridiculous. To begin with, Gates went into early retirement in order to focus more time and effort on his charitable work through the Gates Foundation, which supports such causes like fighting AIDS and malaria in the 3rd world. He announced this two years ago and spent that time transitioning out.
Secondly, Microsoft is hardly scared of cloud computing. We have tons and tons of products that make use of cloud computing. Heck, the division I work for (Exchange Hosted Services) does cloud computing. We filter your mail in the cloud, and our archiver stores your mail in the cloud. Pretty much everyone in senior management believes that cloud computing is going to be extremely important going forward which is why a big part of our fastest growing and cool services, like Sharepoint, Office Live and Live Mesh, are cloud-based components.
Seriously, Motley Fool, do your homework next time. Microsoft is on the leading edge of Cloud Computing.
I sometimes read Star Wars books based upon the Expanded Universe, that is, books written by authors about characters in the Star Wars movies but not officially sanctioned by LucasArts. Being a Jedi, I like to read stories of my order's history.
But the one thing that annoys me about the expanded universe is that it's virtually impossible to kill off a popular character. Other writers bring them back to life! Observe:
- Boba Fett drops into the Sarlacc pit in Return of the Jedi. Yet in the Expanded Universe, Fett survives and lives to hunt another day.
- Emperor Palpatine dies in Return of the Jedi, but in the Expanded Universe, they bring him back with a clone.
- LucasFilm animation created the Clone Wars animated TV series in 2003 and had a Sith-like character named Asajj Ventress. Anakin Skywalker kills her in a battle, yet in the Expanded Universe, it wasn't a death blow and she survives.
- The one exception is Grand Admiral Thrawn. Timothy Zahn invented him and almost brought him back to life in Specter of the Past/Vision of the Future with a clone. Luckily, the clone died before it could be resurrected.
I bring this up because a similar situation happened to me. Over a year ago, I came up with an idea for a feature. Being a Program Manager, I have to make decisions about what projects live, which ones are postponed and which ones die. Sometimes after doing a cost/benefit analysis, a feature is just too expensive to develop. The amount of time it would take to create the feature, coupled with the monopolization of dev resources in the face of competing projects sentences a project to the death bed -- strong are we in resources, but not that strong.
This feature I came up with over a year ago first got postponed. But towards the end of the year we tried to bring it back. But the cost/benefit analysis of it was too high. It started to spiral out of control and we decided that it was too expensive to bring it through to fruition. I decided to strike it down, assuming it wouldn't become more powerful than I could imagine. And that was that, or so I thought.
Yet, rather humorously, just this past week, the feature resurrected itself. Customers are demanding a solution, and this is one we had in the archives (apparently we forgot to erase it from there). And just like that, it looks like this feature is going to come back because it does represent the best way to fix this problem. Yes, we know it's going to be a big project to develop... but the other options are less appealing and I guess we have to do it. Just like the Expanded Universe, a feature that I thought was dead has now come back.
Just so you know, I'm not complaining. It really was a cool feature. But I did think that the analogy to the Expanded Universe was amusing. Now, this is not the post you are looking for. Move along, move along.
I've lamented that automating analysis of something that requires a human to examine is exceedingly difficult. Still, there a few rules of thumb when it comes to spam that I have picked up over the years.
- Use statistics in analysis, but make sure that there's room for noise.
In my previous post, I said that I like to look for occurrences that are outside the 3x standard deviation from the average. However, this only works when you have a large enough sample size. If you have an observation set that runs between 1 and 2 and one day you get a 3, that can trigger an alert. There should be some minimum threshold before you start using the statistical analysis technique.
- Allow for weekends.
Weekends are days where legitimate email drops by a factor of 3. When doing analysis, make sure that you allow for weekends by examining what day of the week you are examining. The same is true for holidays.
- Track corner cases.
I have discovered that we have a lot of email aliases that show up every single day in our outbound logs that have consistent patterns of mail marked as spam. However, these aliases are legitimate and usually are forwarding from one email address to another.
To that end, I build a text file of corner cases to exclude, that is, search for email addresses that have a pattern of spamming, but exclude the following exceptions...
- Allow for user error/noise and accept the fact you'll miss something.
When it comes to processing feedback loops, there's a lot of noise. Users regularly mark non-spam as spam. We have feedback loops with some large free email providers, and if we followed up on everything, we'd be going through billing reports, email notifications, etc. Users don't seem to be able to tell the difference between spam and their monthly billing.
To that end, we have thresholds for each feedback loop. The one above requires at least 25 instances of abuse in the past 24 hours before we take action or it shows up on our screens. Perhaps there is a legitimate case of 24 instances and our filters screen it out. I accept the fact that we'll miss that, and usually if it's a problem we'll get a ton of more complaints. Spammers usually go big, not small.
- Compress information where it makes sense.
In one of my scripts, I parse through logs and get a summary view. One such thing I do is look for null senders with mail marked as spam. I don't bother to get a customer by customer breakdown of this data, I simply store the aggregate of all this information in the database. From my point of view, the compressed information, namely the aggregate total, is useful to me whereas who is sending the messages are not because at the moment I don't plan to take action on it.
If the situation changes in the future, then maybe I'd start to store it. But not before then.
Those are some of the tips I have learned. Nothing revolutionary I guess, but it's nice to have it burned into my memory so next time I don't have to start from scratch and re-learn everything.
One of the tools that I like to use when I want to automate human analysis of logs is to use statistics. How do you detect anomalies using statistical theory?
When pouring over logs, tables and stats, the one thing that we need to realize is that we don't need to recognize that things are normal but instead search for things that are abnormal. When I look for things that are abnormal, I like to find things that are seriously out of the ordinary. To do this, I make some assumptions about the nature of the data.
Suppose I was looking for a customer that had gotten compromised and started sending outbound spam. One case to search for is the case that we see a sudden, rapid increase in outbound mail delivered for an IP. To detect this:
- Get a daily average of the IP's sending history
- Find the standard deviation
- Look for any days where the sending history exceeds the average + 3 standard deviations
By definition, the average + 3 standard deviations contains 99% of all values. If we see an IP with sending history that exceeds this range, then we have detected an anomaly. Why would an IP suddenly start sending so much mail that it exceeds its average by a wide margin? We can't necessarily take action on this automatically (perhaps it is a newsletter) but we can flag it for investigation.
I refine this process a little by taking timing into account. I exclude weekends from the average of the IP history because legitimate traffic on weekends declines by at least a factor 3. However, when looking for days that exceed the average, I do include them. I have found that this technique is very useful for alerting me to anomalies.
When we encountered the problem of outbound spam, one of the big problems is that of the automation of analysis.
Let's say we sign up for feedback loops. Many of these FBLs contain a lot of noise. It often takes a human to take a look and verify that the message is, indeed, actual outbound spam and not someone reporting their telco bill as spam.
How do we parse through logs and look for outbound spammers? We can see, sometimes, that an IP exceeds its historical outbound mail count. But how do you know if a particular email address, say admin@example.com, has a lot of messages flagged as spam and those messages really are legitimate? Let's say we go further to parse through the logs and decode the action taken on a message (so we can see what antispam rules a message hit). It takes somebody experienced with antispam techniques to make a judgment call that the outbound customer in question is spamming and that the filter is not generating false positives.
This comes down to what I refer to as "The automation of analysis." We can generate data, but how do we analyze that data? We can do it easily enough for a few days for a few users, but the problem is one of scale. We have millions of users and we simply can't dedicate someone full time to perform this analysis every day because it consumes so much time.
In the next couple of posts, I will aim to propose some solutions to the problem of analysis automation. Data gathering is one thing, scaling up that analysis such that it is automated (or with minimal human intervention) is another.
Just a note to readers who send me email: I read all email that you guys send me. If you send me a link with a suggestion to check it out and I don't respond, it's not that I don't think it's a good idea. I'm simply lazy and sometimes I get way behind on email and simply don't respond to it in a timely manner.
Thanks.
Bulletproof spam hosting services (ie, internet service providers that will host your site and ignore spam complaints) are one of the techniques that spammers use to put up spam sites. Knowing that their provider will never take them down, they can put up their stuff and not have to worry about authorities coming down on them.
However, there's a bit of a cost to this; they have to pay their spammy providers a fee in order to have this privilege. To that end, some spammers have moved to abusing free tools like Windows Live Spaces and Blogspot accounts. Spammers will use bots to sign up for accounts and then upload a new spam suite. Below is an example of a Windows Live Space account:
This is a spammer trade-off. On the one hand, their costs are lowered because they don't have to pay their provider for bulletproofing hosting. On the other hand, these accounts are far from bulletproof; in fact, they are big targets because Google and Microsoft will shut down right away if they discover that the web pages are abusive. In addition, both Google and Microsoft are always working on their security algorithms so the automation of setting up these accounts is hit and miss.
In reality, these types of spammer tricks are nothing new. It's pretty much the same as the Geocities and Tripod sites outbreaks a few years ago. They are simply now using more of the free tools at their disposal.
It's been around seven or eight months since I last blogged about how to mitigate the problem of outbound spam. Hosted email filters like ourselves, MessageLabs and Postini are all kind of in the same boat - we're not ISPS, and we're not ESPs. Well, actually, we are kind of like ISPs except we don't provide the I-service, we only provide the E-relaying service. We're sort of a closed relayer of mail.
We implemented a partial solution this past April and the results have been mixed. On the one hand, it cut down on a lot of spam flowing out through our outbound servers. On the other hand, it hasn't fixed everything. But perhaps the key component is that it has revealed a lot about the quality of mail flowing out through us, in other words, we've been able to mine our logs to reconstruct common scenarios.
Over the past couple of weeks, I have personally been researching our outbound spam problem, along with one of my co-workers. Here's what we have learned so far:
- Customers get compromised routinely.
There are a certain class of users that routinely send out spam. Now, there are two major types - people who have their email accounts broken into so the spammer sends out spam in their name, and organizations that get hacked and send out spam but not in anyone's name in particular. For example:
john@example.com --> Individual user getting hacked
qfrt@example.org
bgft@example.org
vbcx@example.org
In the first example, it's a user who's credentials have been acquired by the spammer. In the second, it's an organization that is infected, and the bot is clever enough to know what the organization is and sends out spam in their name. We can see, however, the email addresses are quite spammy.
It's not always the same organization, no matter how many I catch, there's going to be a new one either tomorrow or next week.
- Customers who get compromised once before are likely to have it done to them again.
I see this frequently as well. If you show up once in one of my scans, I'll probably see you again sometime in the next month.
- False positives are routine.
I've had our client services department follow up on a lot of suspicious looking email addresses that our filters think are spam. But in many, many cases, the messages are legitimate. Sometimes they are newsletters, sometimes they are advertisements, sometimes they are going to foreign-language recipients and our content filter simply doesn't understand the charset as well (ie, the spam rules are intended for English language mails and "accidentally" fire).
This doesn't come as a big surprise to me, it confirms what I always believed from the start which is why treating outbound like inbound (ie, a junk mail folder) is not a great idea.
- If you tell a customer they are spamming, they usually respond pretty quick.
Whenever I ask for follow up about something suspicious, I generally get action from the customer very quickly. They either fix the problem or confirm that nothing is wrong. Most of the time they don't push back hard.
I've also managed to find one customer with improperly set up SPF records. We got them to fix them so that their mail would not fail SPF checks anymore.
Those are some of the big ones. The automation of this task is still a work in progress.
This is the second part of the article on the Day in the Life of a Phisher.
You can protect yourself – here’s how:
Never post any personal information in an Internet forum, chat room, or blog. Doing this allows programs like the one described above to harvest and use it for other reasons. This can be anywhere from full blown identity theft to using your email address as the “From” address in their spam; most likely getting your account closed by your email provider in the process.
Search on yourself. Go out to search engines like Microsoft Live Search and enter your name in the search box. You may be surprised by the results [editor - I'm not, I'm number 1 on Google, Live Search and Yahoo]. Something as innocent as being listed in the phone book can get you listed on the Internet. Each data provider has different methods that you must take to remove the information, if you choose to do so.
Enroll in an identity protection program. Today, every credit card, mortgage, or other lender offers some type of identity protection program. Do your homework and find the one that monitors all three major credit reporting agencies: Experian, Equifax, and TransUnion, and which fits in your budget. A good service will send you a proactive report each quarter. The higher-end services offer real time alerts to your phone or email. You should only need one program for all of your accounts.
Change your account information. Changing your password is not enough. You must also change your secret questions and it is recommended that you also change other information. Maybe change your house phone to your cell phone or your house address to your mother’s address. Not every account warrants the same change, but your critical ones do. Put up as many barriers to social engineering phishes as possible.
Ensure you are running virus protection, malware protection, and a firewall. Ensure that they are all current with updates. Although this is now becoming a truth along the lines of you should look both ways before crossing a street, I cannot stress enough the importance of this item. In my days as an independent consultant, I worked with many clients and businesses that could have saved both time and money, in the case of my bill and their lost work, if they had only installed and turned on their security software. Microsoft offers products like Windows Defender and Windows Live OneCare that together offer a unified platform for users wanting to protect their personal information and computer systems.
Don’t let your ATM/credit card out of your sight. This one isn’t easy sometimes, especially in restaurants, but do you best to maintain visual contact with your ATM/credit card at all times. The news of the day is all the online identity theft. That is because the traditional method of manually stealing names and numbers through garbage sifting and unethical service employees is old hat. If your card leaves your sight, be diligent about reviewing your statement. Shred all personal documents, such as account statements, pill bottle labels, and even the pre-approved credit offers, when you discard them.
Own your information. Many people do not realize that they own their personal information. Even more people do not exercise that right. Each pre-approved credit offer is a check on your credit score. Each time you list in your local phonebook’s white pages, you also list in their online directories. The way to maintain and control this information is different in each case. Some are tedious, like removing yourself from all pre-approval lists after buying a new home, to others which are much simpler, like merely submitting a request to the company. At Microsoft, privacy is one of our top concerns and we have a very strict privacy policy. Every employee at Microsoft must complete a privacy training course annually.
In closing…
The scope and prevalence of this crime is that we must protect ourselves and our family. Law enforcement agencies the world over are understaffed and overworked in trying to shut down identity theft rings. Be safe and be sure. Be the one who is protecting your identity.
Until the next time…
This article originally appeared on the Windows Live Hotmail Tech Support blog. I thought I'd repost part of it here and the rest of it tomorrow.
Phish – (MSN Encarta - commit fraud to get financial information: to trick somebody into providing bank or credit-card information by sending a fraudulent e-mail purporting to be from a bank, Internet provider, etc. asking for verification of an account number or password)
A day in the life of a Phisher
Evil Ed sits in his easy chair with his laptop, watching TV. He’s doing web searches on names that he found from various Internet forums and chat rooms. Ed has written a computer program to read these sites and gather names and email addresses. The program puts these names into a file on his computer.
Ed loves his house. Everything in it was bought and paid for by someone else. He grins as he begins the day’s work. First, he calls a contact that is looking for email addresses. Ed has just finished creating the list of new emails his program found that week. His database now has over 40 million unique addresses.
After agreeing on a price for the complete list, Ed hangs up the phone and begins his real money maker; stealing people’s identity. Ed has another computer program that takes all the names it found with the email addresses and sends them through all the search engines he can find. When the search returns numbers or words like “street”, “avenue”, or a city, it catalogs those to a smaller file.
It’s here that the work begins. First, Ed cross references the information he finds in Internet white pages with any public records that are available, such as deeds, death notices, or marriage licenses. When he finds connections, those people can expect to have their cell phone companies, Internet Service Providers, and any other discoverable business relationship phished.
Ed calls a dating site he found and presents himself as innocent@somedomain.com. “Here’s my address I used to sign up for an account. What are the last four digits of my credit card? Hmmm, well I know I used a few different ones during that time, I think it was a Visa®?” The agent, trying to be helpful answers yes, no, or provides a helpful hint, “No, it was a MasterCard®.” Ed hangs up the phone.
He immediately calls back and now phishes for the last four digits of the MasterCard®. This is called social engineering and you can see where this goes. How about the people that didn’t have any connections to accounts or other information? Well, Ed still has the email address and the web site it was found on, as well as the email provider (e.g. Hotmail, Yahoo, Gmail, etc). Ed now creates an email that looks exactly like it is from that provider. The email tells the user that their account is expiring, in violation, or needs more information. Click this link now to save this account! Each person that clicks that link, and enters that information, has now been caught in the phishing net.
Ed ends his day by heading out to the mailbox. It’s about 3:30 in the afternoon now. He hopes that the letter from his cousin Andy has arrived. Andy works in a refreshment booth at one of the many tourist attractions in his area. Every month, Andy mails Ed a list of credit card numbers and names that he has copied into his notebook. He gets these numbers from people paying for their food and drinks.
Ed chuckles to himself; just because the Internet Age is here, why ignore the original methods of identity theft?
Windows Live Mail users (ie, Hotmail users) got a message today from the Windows Live Hotmail Team advising of tips to avoid email scams. Since not everyone is a Hotmail user, I thought I'd reprint them here since I agree with all of them.
1) Be wary of e-mails asking for your personal information.
Any e-mail asking for your name, birth date, social security number, e-mail username, e-mail password, or any other type of personal information, no matter who the e-mail appears to be from, is almost certainly a scam.
If you have any reason to believe it may be legitimate, do not reply to the e-mail or click any hyperlinks; instead copy and paste the web URL or go to that company's website for contact information. Don't hesitate to contact the company's support channel to confirm legitimacy or check out a site such as snopes.com which lists e-mail scams.
2) Carefully read e-mails that appear suspicious.
E-mails that are poorly worded, have typos, or have phrases such as "this is not a joke" or "forward this message to your friends" are generally scam e-mails.
Sometimes company names or brands are misspelled or inaccurate; such as saying Windows Hotmail (instead of Windows Live™ Hotmail) or Bank of Amarika (instead of Bank of America).
3) Protect your Hotmail password.
[tzink] Or any email password, for that matter. We have a problem with our outbound mail in that people's email accounts get compromised and spammers use them to spew out spam. [/tzink]
Create a strong password for your Hotmail account by using more than 7 characters and having a combination of upper and lower case characters, numbers, and special characters, like the @ or # symbols. It's also a good idea to change your password on a regular basis. Learn More.
If you receive a notification from Microsoft Customer Support confirming your request to change your password and you haven't recently changed your password, that's a signal that someone else may be trying to gain access to your Hotmail account, and you should immediately change your password.
To do so, either go to http://account.live.com, or within Hotmail, click Options, then View and Edit your Personal Information. You will be prompted to log in again. Once you do, look for "Password reset information" under your name at the top. Change both your password and your Secret Question/Secret Answer as both may have been compromised.
4) Take action!
If you think someone has accessed your Hotmail account, that the Windows Live ID sign-in page looks fraudulent, or you receive a suspicious e-mail that tries to confirm a password change you didn't authorize, change your password immediately via the instructions above, or go to: http://account.live.com. Next, help ensure your PC has not been infected with a virus or malware by running a free full-PC scan.
5) Help us identify new scams.
If you're using the Full version of Hotmail, you can select the dropdown next to "Junk", then select "Report phishing scam". Whatever you do, do not reply back to the sender. Or, if you are an Exchange Hosted Services customer, you can submit the spam message to us using the appropriate submission method.
Now, I know to many of us some of these suggestions seem obvious. But what is obvious to you and me is not so obvious to the people who are inexperienced with computers. If there are 300 million computer users out there and even 0.01% don't know this stuff, that's still 3000 potential accounts that can be abused. Spammers can do a lot of damage with 3000 accounts.
Have you ever wondered what the Microsoft campus looks like? Or what the rest of the buildings in the Puget Sound region look like?
Well, now you need wonder no longer! I have personally visited every single Microsoft building here in the Seattle area and I made a video about it. Check it out below.
Back when I was processing spam and false positives, I quite regularly came across very interesting things. The one thing I miss the most of the daily grind of spam analysis was that I came across so many cool things that I normally would not have stumbled across.
Perhaps the best Internet video that ever crossed my desktop was created by a guy by the name of Matt Harding, of wherethehellismatt.com. Matt is someone who has traveled around the world dancing in various locations and has created a video of his travels. He did it in 2005, and then has made subsequent videos in 2006 and 2008. Between my brother and I, we sometimes refer to him as "that guy from the video."
If you have never seen it, here is his latest video, and I think it is my favorite of the 3.
I really, really liked his videos. I liked them so much that I made my own when I traveled to Australia in 2006.
Now yesterday, September 2, 2008, Harding was at a travel bookstore in Seattle. I went down there because I thought it would be cool to see him. He gave a presentation about his travels and answered questions. Afterwards, he let a couple of people come up and take pictures of him as well as dance with him. I was thoroughly excited by the prospect.
I had brought along my digital camera and asked someone else to take our video dancing. We did the jig for about 10 seconds. I then said "Could we get one more picture? Just in case the video doesn't turn out?" I was worried that maybe the angle was weird or the lighting was off or something. We snapped the picture, I took a look at it, thanked Harding for his time and left. I was really quite happy, I had my picture and video taken with an Internet sensation.
I got home later that night and looked for the video and the picture. But when I checked the memory card, the video was no where to be seen! The guy shooting the video had screwed up and hadn't pressed the button! Argh! I was crushed! It felt like someone had punched me in the stomach when I saw that the video was no where on my camera.
But, at least I managed to snag the photo. So it's a partial victory and not a total defeat. I suppose I only have myself to blame for not double-checking to verify that the video was actually taken. You can bet I'll know better for next time and the next person I ask to shoot the video, I will ask them if it worked.
If you're familiar with television, the Internet and computers, no doubt you are familiar with the Mac vs PC commercials. They're humorous and they poke fun at some of the stereotypes of Windows/PCs.
In spam filtering, I've said it before and I'll say it again: I'm actually pretty neutral with regards to the platform used to fight spam. As a user, I use both Windows and Linux on a daily basis in my spam fighting. I use Windows to analyze data and make presentations, not to mention writing reports. The back-end work (especially Microsoft Office) is in the critical path of my daily work flow. I do a whole pile of research using Linux because many of the native Linux commands, like dig and awk, are incredibly convenient to use and they don't have Windows equivalents. I use Linux to acquire data. I use Windows to analyze and organize it.
The one advantage that Windows has, I think, is that various software bits like SQL Server, Exchange and IIS can be leveraged to integrate more smoothly because they are developed by the same company.
As a personal user, I use both platforms, but I also use the Mac to do video editing and some web surfing once in a while. So you see, different platforms can be used to accomplish different things. It all depends on what you use it for.
I get off my soapbox to embed this funny video I found on Youtube, it's a Mac vs PC vs Linux parody and I thought I'd post it here. It makes fun of all the platforms.
Spamwars reports that the SANS Internet Storm Center have reported a number of domain names containing the word "gustav" are being registered. In case you are unaware, Hurricane Gustav is the latest hurricane that threatens to pummel the southern US coast, similar to Katrina 3 years ago.
This domain-registering is significant because while it may be legitimate, it probably isn't. It's spammers and scammers getting a jump on everyone else in anticipation of a storm. When the storm hits, the spammers send out spam to people saying "Please donate here to Gustav relief!" Of course, the money goes to the scammer and nobody actually ever gets any aid (unless the spammer decides to make a donation).
I remember seeing this with Katrina a few years back. Let's hope Gustav misses so all the spammers end up wasting time and money.
