Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Someone used my IPFS gateway for phishing

incoherency.co.uk

Post reply on HN
Print view View original

11–20 of 44 posts

Re: Someone used my IPFS gateway for phishing

#11

Post by jstanley »

cwkoss wrote: post #4
jstanley wrote: post #3

Earlier quoted context omitted.

Note that the link to the OneDrive URL does not come from IPFS. It comes from the URL fragment, which makes it even more murky as to whether the IPFS hash should even be blocked! Perfectly legitimate sites could be using exactly the same content with no knowledge of the phishing attack. It is just copy and pasted from https://itty.bitty.site/ I didn't look into how GMA.html works, but a quick look just now shows that…

Ah, I didn't catch that the Base64 string was part of the query param, not stored in IFPS. Yeah, seems like IFPS data isn't offending whatsoever in this case. Interesting that it is 'facilitating' phishing (as in dependency in attack chain), but only to the extent that would apply to a number of general-purpose open source libraries, or the browser, or any OS or ISP. Seems like DigitalOcean made the wrong choice, but…

I agree that it's too complex to expect front-line abuse support to work out what's going on, but yes I did expect them to turn my networking back on after I blacklisted the hash.

Re: Someone used my IPFS gateway for phishing

#12

Post by imhoguy »

setr wrote: post #9
LeoPanthera wrote: post #7

Earlier quoted context omitted.

Web-IPFS gateways are not part of the IPFS infrastructure, nor are they essential.

They are, however, essential for the transition to it; at least as long as they continue the goal of becoming the new web.

Without major players joining - browser vendors, it will be like IPv6 transition.

Re: Someone used my IPFS gateway for phishing

#13

Post by jstanley »

setr wrote: post #9
LeoPanthera wrote: post #7

Earlier quoted context omitted.

Web-IPFS gateways are not part of the IPFS infrastructure, nor are they essential.

They are, however, essential for the transition to it; at least as long as they continue the goal of becoming the new web.

If you want to use IPFS without using a public gateway, it is very easy to install and use a local gateway.

If you also use a browser extension like "IPFS Companion", it can automatically redirect all IPFS-looking URLs to your local gateway.

I agree this doesn't help for casual users who have never heard of it, but it's at least better than "everyone has to use a public gateway all the time".

Re: Someone used my IPFS gateway for phishing

#14

Post by iknowstuff »

>Around the same time that this email was forwarded to me, DigitalOcean disabled the network interface on my VPS in order to stop the phishing attack from working. Fair enough, can't really expect them to do any more than that.

I disagree. I don't think this is okay. Aside from this IPFS story, DigitalOcean in general does not care about abuse. Unlike providers such as OVH, DigitalOcean will simply nullroute you when you fall victim to a DDoS attack. I wish they stepped up their game - until then, after hearing those stories, I will not be using their service for anything I care about.

Re: Someone used my IPFS gateway for phishing

#15

Post by sneak »

jstanley wrote: post #13
setr wrote: post #9

Earlier quoted context omitted.

They are, however, essential for the transition to it; at least as long as they continue the goal of becoming the new web.

If you want to use IPFS without using a public gateway, it is very easy to install and use a local gateway. If you also use a browser extension like "IPFS Companion", it can automatically redirect all IPFS-looking URLs to your local gateway. I agree this doesn't help for casual users who have never heard of it, but it's at least better than "everyone has to use a public gateway all the time".

Neither of these things you mention are very easy on my primary computer, an iPad Pro.

Re: Someone used my IPFS gateway for phishing

#18

Post by ndnxhs »

imhoguy wrote: post #12
setr wrote: post #9

Earlier quoted context omitted.

They are, however, essential for the transition to it; at least as long as they continue the goal of becoming the new web.

Without major players joining - browser vendors, it will be like IPv6 transition.

Firefox has partly added support recently. They recognise ipfs:// as a valid protocol and allow extensions to implement it.

Re: Someone used my IPFS gateway for phishing

#19

Post by phyzome »

sneak wrote: post #15
jstanley wrote: post #13

Earlier quoted context omitted.

If you want to use IPFS without using a public gateway, it is very easy to install and use a local gateway. If you also use a browser extension like "IPFS Companion", it can automatically redirect all IPFS-looking URLs to your local gateway. I agree this doesn't help for casual users who have never heard of it, but it's at least better than "everyone has to use a public gateway all the time".

Neither of these things you mention are very easy on my primary computer, an iPad Pro.

You don't have a general-purpose computer, you have a locked down browser.

(But point taken, a lot of people aren't using general-purpose computers.)

Re: Someone used my IPFS gateway for phishing

#20

Post by rmdoss »

iknowstuff wrote: post #14

>Around the same time that this email was forwarded to me, DigitalOcean disabled the network interface on my VPS in order to stop the phishing attack from working. Fair enough, can't really expect them to do any more than that. I disagree. I don't think this is okay. Aside from this IPFS story, DigitalOcean in general does not care about abuse. Unlike providers such as OVH, DigitalOcean will simply nullroute you when…

Yep, both DO and Linode do the same thing. Just null route your IP and take forever to remove it once you fixed whatever problem it was (even if it was a false alarm).
Post reply on HN