Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Stopping phishing campaigns with Bash

blog.haschek.at

Post reply on HN
Print view View original

21–30 of 169 posts

Re: Stopping phishing campaigns with Bash

#21

Post by [deleted] »

noodlesUK wrote: post #19
darkwater wrote: post #13

Earlier quoted context omitted.

How can it be illegal sending a few fake data to a website? And anyway I doubt they will ever sue you, at most you could be targeted for some revenge attack if they are really pissed off and you don't hide your traces.

IANAL: This is what I expect the relevant text in the CFAA is... knowingly causes the transmission of a program, information, code, or command, and as a result of such conduct, intentionally causes damage without authorization, to a protected computer;

[deleted]

Re: Stopping phishing campaigns with Bash

#23

Post by jtylr »

b0re wrote: post #22

noob question: what does an \ at the end of a bash script do? Is it the same as ; ?

The end of a bash script or a line?

If it's at the end of the line it's just signifying that the line continues underneath and to run that block as "one line". It's just escaping the newline character.

Re: Stopping phishing campaigns with Bash

#24

Post by oddeyed »

b0re wrote: post #22

noob question: what does an \ at the end of a bash script do? Is it the same as ; ?

The opposite. ; is the same as a newline. Prepending the newline with a backslash \ is like saying "pretend this newline isn't here". So all of the -H arguments get applied to the same command in the example, rather than being treated as commands in their own right.

Re: Stopping phishing campaigns with Bash

#25

Post by mhils »

stephenmc77 wrote: post #16
saagarjha wrote: post #4

While this is all fun and games, I am curious if DOSing someone else’s server, even if it’s being used to run a phishing scam, is legal.

I imagine it's illegal but I also assume that for it to be prosecutable, there would have to be a complainant. Good luck to that guy trying to prove that DDOS-ing a phishing site is worse than the phishing itself!

It is not unlikely that the phishing site is hosted on a hacked server that still serves legitimate websites (which you would also take down in the process). So there could be a legitimate complainant.

Re: Stopping phishing campaigns with Bash

#26

Post by GlitchMr »

ThePadawan wrote: post #14
1023bytes wrote: post #8

All banks in the EU are required to use 2FA, I'm curious how these hackers get around that.

"required to use 2FA" for login, or "required to use 2FA" to conduct transactions? I'm asking because my (German) bank only very recently changed to requiring 2FA every X days for login. I'm very curious if they are actually compliant, since I used to be able to log in just with 1 factor to see my current balance (but not conduct any transactions).

Currently 2FA (legally known as "strong customer authentication") for logging to payment services (like banks) when one wasn't performed in 90 days is required in EEA.

IMO implementing the bare minimum this does nothing for security. However, often banks do that, and even if you try to look intentionally suspicious (say, use a VPN in United States with another web browser on another operating system) they don't care and won't ask you for 2FA.

Re: Stopping phishing campaigns with Bash

#27

Post by socket0 »

StreamBright wrote: post #17
darkwater wrote: post #13

Earlier quoted context omitted.

How can it be illegal sending a few fake data to a website? And anyway I doubt they will ever sue you, at most you could be targeted for some revenge attack if they are really pissed off and you don't hide your traces.

This can be classified as denial of service attack because of the rate your are sending the requests. Depends on the law (and on the interpretation as well). I doubt that the phising guys behind this will file a complaint though.

Many phishing pages reside on compromised domains. Bob's Plumbing Supplies might wonder why their Wordpress site loaded with plug-ins has stopped working, ask someone to take a look, and see your IP address all over the logs.

Re: Stopping phishing campaigns with Bash

#28

Post by Wandfarbe »

I stoped 2 webshops which basically sell expensive stuff 20% off by wire transfer (bank transfer?!) which then never send the goods of course!

I did the following:

- I found out where it was hosted and send them an email explaining them why and how that shop is a scam

- I found out where they hosted the domain and wrote the registrar an abuse email

- I wrote an email to the banks where the bank accounts where active

The scammer had a webchat module active and he/she did wrote back to me, nothing came out through that, nonetheless:

next day, both webshops were gone due to being taken offline from the hosters.

I do believe, that they do have a chance because literaly no one cares. I have seen mentioning of one of those two shops older then 6 month. I pissed at them with very little effort in a very short time.

I do hope i helped out.

Re: Stopping phishing campaigns with Bash

#29

Post by mrvenkman »

"The way these things work is that they act like they're the real login form, steal your credentials and usually send you off to the real bank so you think you made a typo or something."

If that's the case then surely you're also flooding the bank's real site with GET requests after the redirection.

Re: Stopping phishing campaigns with Bash

#30

Post by uzakov »

tracker1 wrote: post #7
saagarjha wrote: post #4

While this is all fun and games, I am curious if DOSing someone else’s server, even if it’s being used to run a phishing scam, is legal.

If you're in the US, it could be a violation of the Computer Fraud and Abuse Act. I used to do stuff like this until I became aware of the potential felony behind it.

Same for the UK in most cases - illegal.
Post reply on HN