So you DDOSed their backend but they could've whitelist their IP range and blacklist all the others for incoming requests.
What you did does nothing against flexible and adaptive adversaries.
Stopping phishing campaigns with Bash
31–40 of 169 posts
Re: Stopping phishing campaigns with Bash
#32All banks in the EU are required to use 2FA, I'm curious how these hackers get around that.
1. One SMS every 90 days, because the security teams have no idea how MFA works (I know, I work there). Even if you hop devices. See https://try.popho.be/psd2.html
2. It's just a little dev step away: http://blog.cmpxchg8b.com/2020/07/you-dont-need-sms-2fa.html . Phish kits will evolve, UX will still be bad, and phishing will still happen.
Re: Stopping phishing campaigns with Bash
#33I stoped 2 webshops which basically sell expensive stuff 20% off by wire transfer (bank transfer?!) which then never send the goods of course! I did the following: - I found out where it was hosted and send them an email explaining them why and how that shop is a scam - I found out where they hosted the domain and wrote the registrar an abuse email - I wrote an email to the banks where the bank accounts where active…
I like to think it helped out, but at the same time, these people are professionals and will have automation to generate new instances and scam campaigns easily. At least it should be more difficult for them to set up new bank accounts though, they need ID for that, and / or a network of mules, and those are finite resources.
Re: Stopping phishing campaigns with Bash
#34Earlier quoted context omitted.
How can it be illegal sending a few fake data to a website? And anyway I doubt they will ever sue you, at most you could be targeted for some revenge attack if they are really pissed off and you don't hide your traces.
This can be classified as denial of service attack because of the rate your are sending the requests. Depends on the law (and on the interpretation as well). I doubt that the phising guys behind this will file a complaint though.
To poison some phishing data you don't need to overload any server. Although the act itself of poisoning data could be seen as a DoS but since the service in question is an illegal one IANAL but I don't think it would stand in court.
Re: Stopping phishing campaigns with Bash
#35"The way these things work is that they act like they're the real login form, steal your credentials and usually send you off to the real bank so you think you made a typo or something." If that's the case then surely you're also flooding the bank's real site with GET requests after the redirection.
Bash doesn't have to follow the redirect
Even if, I'm sure the bank appreciates someone working against phishing. A few GET requests is something they're meant to handle. They have to be resistant to DDoS attempts from malevolent actors
Re: Stopping phishing campaigns with Bash
#36"The way these things work is that they act like they're the real login form, steal your credentials and usually send you off to the real bank so you think you made a typo or something." If that's the case then surely you're also flooding the bank's real site with GET requests after the redirection.
From cURL the author can ignore the redirect to the bank's real site though.
Re: Stopping phishing campaigns with Bash
#37I know someone that DDoSed a forum spammer.
They hit back, ten times as hard, and completely destroyed a well-established forum, with thousands of users, that had experienced an annoying (but not crippling) "penis pill" spam attack.
Re: Stopping phishing campaigns with Bash
#38All banks in the EU are required to use 2FA, I'm curious how these hackers get around that.
1. One SMS every 90 days, because the security teams have no idea how MFA works (I know, I work there). Even if you hop devices. See https://try.popho.be/psd2.html 2. It's just a little dev step away: http://blog.cmpxchg8b.com/2020/07/you-dont-need-sms-2fa.html . Phish kits will evolve, UX will still be bad, and phishing will still happen. See also https://sakurity.com/blog/2015/07/18/2fa.html
Some banks know security better than others
And yes the login one might be every 90 days, but to do a transaction there might be an extra one
(yes Germany did away with paper tans (2fa codes) in 2019 yay - thankfully not all banks are that stupid)
Re: Stopping phishing campaigns with Bash
#39While this is all fun and games, I am curious if DOSing someone else’s server, even if it’s being used to run a phishing scam, is legal.
If they're hosted (e.g. shared hosting), then the hosting party may just lock you out if they had DDOS protection because you're using their resources. They're not happy with phishing sites being hosted on their sites, but also not - and they probably suffer more damage, even if it's "just" resources - from DDOS attacks.
Re: Stopping phishing campaigns with Bash
#40While this is all fun and games, I am curious if DOSing someone else’s server, even if it’s being used to run a phishing scam, is legal.
Probably not, but it's like stealing from a drug dealer. They can't report you without incriminating themselves. Of course stealing from drug dealers is known to have other ramifications...