Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Stopping phishing campaigns with Bash

blog.haschek.at

Post reply on HN
Print view View original

11–20 of 169 posts

Re: Stopping phishing campaigns with Bash

#11

Post by zwirbl »

godzillabrennus wrote: post #6
saagarjha wrote: post #4

While this is all fun and games, I am curious if DOSing someone else’s server, even if it’s being used to run a phishing scam, is legal.

I seriously doubt it is legal in the United States. Seems like a pretty clear abuse of a computer network.

The author lives in Austria and the phishing attempt itself was targeting a major Austrian bank, but I don't know if this is legal or if that's a gray area

Re: Stopping phishing campaigns with Bash

#12

Post by noodlesUK »

As much as I think things like this can be fun, depending on your jurisdiction (and tbh the US loves extraditing people for silly computer crimes), it might not be advisable. This is all but certainly illegal at least within the US. I’m sure most competent security experts have been tempted to do things like this, or SQLi a scammer’s form and nuke their DB, and usually bad things won’t happen to you, you might find that you’re hacking something you weren’t expecting, and might piss someone off other than a scammer.

Re: Stopping phishing campaigns with Bash

#13

Post by darkwater »

noodlesUK wrote: post #12

As much as I think things like this can be fun, depending on your jurisdiction (and tbh the US loves extraditing people for silly computer crimes), it might not be advisable. This is all but certainly illegal at least within the US. I’m sure most competent security experts have been tempted to do things like this, or SQLi a scammer’s form and nuke their DB, and usually bad things won’t happen to you, you might find t…

How can it be illegal sending a few fake data to a website? And anyway I doubt they will ever sue you, at most you could be targeted for some revenge attack if they are really pissed off and you don't hide your traces.

Re: Stopping phishing campaigns with Bash

#14

Post by ThePadawan »

1023bytes wrote: post #8

All banks in the EU are required to use 2FA, I'm curious how these hackers get around that.

"required to use 2FA" for login, or "required to use 2FA" to conduct transactions?

I'm asking because my (German) bank only very recently changed to requiring 2FA every X days for login. I'm very curious if they are actually compliant, since I used to be able to log in just with 1 factor to see my current balance (but not conduct any transactions).

Re: Stopping phishing campaigns with Bash

#16

Post by stephenmc77 »

saagarjha wrote: post #4

While this is all fun and games, I am curious if DOSing someone else’s server, even if it’s being used to run a phishing scam, is legal.

I imagine it's illegal but I also assume that for it to be prosecutable, there would have to be a complainant. Good luck to that guy trying to prove that DDOS-ing a phishing site is worse than the phishing itself!

Re: Stopping phishing campaigns with Bash

#17

Post by StreamBright »

darkwater wrote: post #13
noodlesUK wrote: post #12

As much as I think things like this can be fun, depending on your jurisdiction (and tbh the US loves extraditing people for silly computer crimes), it might not be advisable. This is all but certainly illegal at least within the US. I’m sure most competent security experts have been tempted to do things like this, or SQLi a scammer’s form and nuke their DB, and usually bad things won’t happen to you, you might find t…

How can it be illegal sending a few fake data to a website? And anyway I doubt they will ever sue you, at most you could be targeted for some revenge attack if they are really pissed off and you don't hide your traces.

This can be classified as denial of service attack because of the rate your are sending the requests. Depends on the law (and on the interpretation as well). I doubt that the phising guys behind this will file a complaint though.

Re: Stopping phishing campaigns with Bash

#18

Post by strogonoff »

anticristi wrote: post #2

Nice! If you are required to write an email address, it would be cool to use a canary, and see if it shows up on haveibeenpwned.com.

I don’t think HaveIBeenPwned makes an attempt to harvest data captured by fishing websites. It’s intended to track data leaked due to a breach of the actual system.

Re: Stopping phishing campaigns with Bash

#19

Post by noodlesUK »

darkwater wrote: post #13
noodlesUK wrote: post #12

As much as I think things like this can be fun, depending on your jurisdiction (and tbh the US loves extraditing people for silly computer crimes), it might not be advisable. This is all but certainly illegal at least within the US. I’m sure most competent security experts have been tempted to do things like this, or SQLi a scammer’s form and nuke their DB, and usually bad things won’t happen to you, you might find t…

How can it be illegal sending a few fake data to a website? And anyway I doubt they will ever sue you, at most you could be targeted for some revenge attack if they are really pissed off and you don't hide your traces.

IANAL:

This is what I expect the relevant text in the CFAA is...

knowingly causes the transmission of a program, information, code, or command, and as a result of such conduct, intentionally causes damage without authorization, to a protected computer;

Re: Stopping phishing campaigns with Bash

#20

Post by tdeck »

I have seen the code for some phish kits in the past. Many of them actually send an email on each submission rather than saving to a file (more resilient if the hacked WordPress site is taken down). They often also record the IP so it may be easier to filter out "phish-feeding" attempts like this.
Post reply on HN