Someone used my IPFS gateway for phishing
incoherency.co.uk
Someone used my IPFS gateway for phishing
1–10 of 44 posts
Re: Someone used my IPFS gateway for phishing
#2How does GMA.html send the creds back to their server?
Interesting question of who has culpability:
- Server receiving creds seems clearly in wrong
- OneDrive hosting the html file which can be used to exfiltrate creds is a bit murkier
- Hosting a link to the onedrive url on IPFS is murkier still.
Re: Someone used my IPFS gateway for phishing
#3How does GMA.html send the creds back to their server? Interesting question of who has culpability: - Server receiving creds seems clearly in wrong - OneDrive hosting the html file which can be used to exfiltrate creds is a bit murkier - Hosting a link to the onedrive url on IPFS is murkier still.
Note that the link to the OneDrive URL does not come from IPFS. It comes from the URL fragment, which makes it even more murky as to whether the IPFS hash should even be blocked! Perfectly legitimate sites could be using exactly the same content with no knowledge of the phishing attack. It is just copy and pasted from https://itty.bitty.site/
I didn't look into how GMA.html works, but a quick look just now shows that it posts to https://searchurl.bid/joyceesther0101/finish1.php
Re: Someone used my IPFS gateway for phishing
#4How does GMA.html send the creds back to their server? Interesting question of who has culpability: - Server receiving creds seems clearly in wrong - OneDrive hosting the html file which can be used to exfiltrate creds is a bit murkier - Hosting a link to the onedrive url on IPFS is murkier still.
Note that the link to the OneDrive URL does not come from IPFS. It comes from the URL fragment, which makes it even more murky as to whether the IPFS hash should even be blocked! Perfectly legitimate sites could be using exactly the same content with no knowledge of the phishing attack. It is just copy and pasted from https://itty.bitty.site/ I didn't look into how GMA.html works, but a quick look just now shows that…
Ah, I didn't catch that the Base64 string was part of the query param, not stored in IFPS. Yeah, seems like IFPS data isn't offending whatsoever in this case.
Interesting that it is 'facilitating' phishing (as in dependency in attack chain), but only to the extent that would apply to a number of general-purpose open source libraries, or the browser, or any OS or ISP.
Seems like DigitalOcean made the wrong choice, but the technical complexity of the situation is enough to not put too much blame on them. Unresponsive support is disappointing.
Re: Someone used my IPFS gateway for phishing
#5Hmm, doesn't bode well of IPFS. To the extent that bad actors can "easily" disable swaths of infrastructure in a difficult to parse/manage way.
Re: Someone used my IPFS gateway for phishing
#6How does GMA.html send the creds back to their server? Interesting question of who has culpability: - Server receiving creds seems clearly in wrong - OneDrive hosting the html file which can be used to exfiltrate creds is a bit murkier - Hosting a link to the onedrive url on IPFS is murkier still.
Note that the link to the OneDrive URL does not come from IPFS. It comes from the URL fragment, which makes it even more murky as to whether the IPFS hash should even be blocked! Perfectly legitimate sites could be using exactly the same content with no knowledge of the phishing attack. It is just copy and pasted from https://itty.bitty.site/ I didn't look into how GMA.html works, but a quick look just now shows that…
Looks like they are using 'Vesta', here's their control panel https://searchurl.bid:8083/login/
https://forum.vestacp.com/viewtopic.php?p=68594#p68594
https://www.digitalocean.com/community/questions/how-do-i-de...
Appears there was a vulnerability in this panel, seems plausible that 'owner' of this page is an additional victim of the attacker.
Re: Someone used my IPFS gateway for phishing
#7Hmm, doesn't bode well of IPFS. To the extent that bad actors can "easily" disable swaths of infrastructure in a difficult to parse/manage way.
Web-IPFS gateways are not part of the IPFS infrastructure, nor are they essential.
Re: Someone used my IPFS gateway for phishing
#8Sorry to hear, but you are not alone [0]. It was matter of time for a new tech to be exploited like that. Providing IPFS gateway is like opening up public HTTP proxy (popular back in 90s). You had good intentions, but there will be lot of nasty things going thru your machine. Of course guys like Cloudflare can absorb arising liability but I think they will shutdown their gateway at some point.
I think the best way to popularize IPFS will be out-of-the box support in major browsers. I think Mozilla may be the first one here.
[0] https://www.bleepingcomputer.com/news/security/phishing-atta...
Re: Someone used my IPFS gateway for phishing
#9Hmm, doesn't bode well of IPFS. To the extent that bad actors can "easily" disable swaths of infrastructure in a difficult to parse/manage way.
Web-IPFS gateways are not part of the IPFS infrastructure, nor are they essential.
They are, however, essential for the transition to it; at least as long as they continue the goal of becoming the new web.
Re: Someone used my IPFS gateway for phishing
#10> (although their hosting provider doesn't appear to have switched their networking off).
I doubt that Microsoft Azure is going to switch off the networking for all of Microsoft OneDrive over this.