So you DDOSed their backend but they could've whitelist their IP range and blacklist all the others for incoming requests. What you did does nothing against flexible and adaptive adversaries.
[deleted]
Stopping phishing campaigns with Bash
41–50 of 169 posts
Re: Stopping phishing campaigns with Bash
#42So you DDOSed their backend but they could've whitelist their IP range and blacklist all the others for incoming requests. What you did does nothing against flexible and adaptive adversaries.
Even if that's the case, it made the website unavailable for future victims who got the same text messages.
Re: Stopping phishing campaigns with Bash
#43Nice! If you are required to write an email address, it would be cool to use a canary, and see if it shows up on haveibeenpwned.com.
I don’t think HaveIBeenPwned makes an attempt to harvest data captured by fishing websites. It’s intended to track data leaked due to a breach of the actual system.
Mostly true but there things like Collection #1 and Anti Public Combo List which are amalgamations of unknown provenance. A lot of it is probably prior breaches but I wouldn't be surprised if it contained phishing data.
Re: Stopping phishing campaigns with Bash
#44Earlier quoted context omitted.
How can it be illegal sending a few fake data to a website? And anyway I doubt they will ever sue you, at most you could be targeted for some revenge attack if they are really pissed off and you don't hide your traces.
IANAL: This is what I expect the relevant text in the CFAA is... knowingly causes the transmission of a program, information, code, or command, and as a result of such conduct, intentionally causes damage without authorization, to a protected computer;
Is it a damage if you damage damaging thing? If effect of your damage is less damage maybe it's not damage after all?
Re: Stopping phishing campaigns with Bash
#45Earlier quoted context omitted.
This can be classified as denial of service attack because of the rate your are sending the requests. Depends on the law (and on the interpretation as well). I doubt that the phising guys behind this will file a complaint though.
Many phishing pages reside on compromised domains. Bob's Plumbing Supplies might wonder why their Wordpress site loaded with plug-ins has stopped working, ask someone to take a look, and see your IP address all over the logs.
Or the webhost where Bob's Plumbing Supplies is hosted detects an attack and files a complain. Or the SAAS/server rental sees this, puts you on some automatic blacklist and puts in on the "to be investigated" blacklist. Too many parties involved whom you are "hurting" that might get back to you.
Not saying this to keep anyone from repeating this, though; just that when doing so, keep in mind that you're probably not just hurting a scammer alone.
Re: Stopping phishing campaigns with Bash
#46All banks in the EU are required to use 2FA, I'm curious how these hackers get around that.
"required to use 2FA" for login, or "required to use 2FA" to conduct transactions? I'm asking because my (German) bank only very recently changed to requiring 2FA every X days for login. I'm very curious if they are actually compliant, since I used to be able to log in just with 1 factor to see my current balance (but not conduct any transactions).
For me its only 2FA for transactions.
Re: Stopping phishing campaigns with Bash
#47I stoped 2 webshops which basically sell expensive stuff 20% off by wire transfer (bank transfer?!) which then never send the goods of course! I did the following: - I found out where it was hosted and send them an email explaining them why and how that shop is a scam - I found out where they hosted the domain and wrote the registrar an abuse email - I wrote an email to the banks where the bank accounts where active…
I attended a meetup at our local registrar (SIDN) where they explained how data analysts on their payroll detect such fake webshops and how they then actively block those domains on DNS and registrar level.
Re: Stopping phishing campaigns with Bash
#48As much as I think things like this can be fun, depending on your jurisdiction (and tbh the US loves extraditing people for silly computer crimes), it might not be advisable. This is all but certainly illegal at least within the US. I’m sure most competent security experts have been tempted to do things like this, or SQLi a scammer’s form and nuke their DB, and usually bad things won’t happen to you, you might find t…
While it may be technically illegal, considering the victims are themselves worse criminals caught in the act, I really doubt anyone is going to give you trouble over this.
Unless authorities are looking for an excuse to prosecute you, of course, but there's plenty of bad PR to be had for authorities acting on behalf of criminals trying to steal people's banking credentials.
Re: Stopping phishing campaigns with Bash
#49All banks in the EU are required to use 2FA, I'm curious how these hackers get around that.
Wouldn't a phishing site be able to proxy the challenge and then record and proxy the response which the user types in? I.e. MITM the 2fa?
Re: Stopping phishing campaigns with Bash
#50A colleague and I did something similar recently.
We got similar spam mails in our work inboxes. Whipped up a little ruby script that spammed bum login data to the spammer's form url. We had our scripts running on a couple of Heroku instances and all.
At some stage we realized that the password field in the form accepted arbitrarily sized payloads. So we base64 encoded some 10MB file and sent that as the password. The thinking was if we could not DoS them, we can at least clog up their works with some real hefty payloads.
More can be seen here: https://github.com/dj-louw/spamscam