While this is all fun and games, I am curious if DOSing someone else’s server, even if it’s being used to run a phishing scam, is legal.
Probably as illegal as stealing a cocaine from a drug dealer.
Stopping phishing campaigns with Bash
51–60 of 169 posts
Re: Stopping phishing campaigns with Bash
#52As much as I think things like this can be fun, depending on your jurisdiction (and tbh the US loves extraditing people for silly computer crimes), it might not be advisable. This is all but certainly illegal at least within the US. I’m sure most competent security experts have been tempted to do things like this, or SQLi a scammer’s form and nuke their DB, and usually bad things won’t happen to you, you might find t…
While it may be technically illegal, considering the victims are themselves worse criminals caught in the act, I really doubt anyone is going to give you trouble over this. Unless authorities are looking for an excuse to prosecute you, of course, but there's plenty of bad PR to be had for authorities acting on behalf of criminals trying to steal people's banking credentials.
> While it may be technically illegal, considering the victims are themselves worse criminals caught in the act, I really doubt anyone is going to give you trouble over this.
Depends on who you fear more: law enforcement or organized crime.
Re: Stopping phishing campaigns with Bash
#53Earlier quoted context omitted.
I imagine it's illegal but I also assume that for it to be prosecutable, there would have to be a complainant. Good luck to that guy trying to prove that DDOS-ing a phishing site is worse than the phishing itself!
It is not unlikely that the phishing site is hosted on a hacked server that still serves legitimate websites (which you would also take down in the process). So there could be a legitimate complainant.
in this case however both sites I "took down" were still accessible afterwards, they just removed their backend. Still got an empty response or 404 with valid http certificate.
So probably the phishers were annoyed with the fake data and moved servers
Re: Stopping phishing campaigns with Bash
#54All banks in the EU are required to use 2FA, I'm curious how these hackers get around that.
In this case (with the second page) it looked like after you put in your credentials they put you in a loop while they tried to use your logins.
I assume that if the banking backend told them the verification sms or whatever is sent, they would have asked the user about it and just forwarded it
Re: Stopping phishing campaigns with Bash
#55I stoped 2 webshops which basically sell expensive stuff 20% off by wire transfer (bank transfer?!) which then never send the goods of course! I did the following: - I found out where it was hosted and send them an email explaining them why and how that shop is a scam - I found out where they hosted the domain and wrote the registrar an abuse email - I wrote an email to the banks where the bank accounts where active…
Abuse email/report to the registrar is also my goto. Usually results in a quick response
Re: Stopping phishing campaigns with Bash
#56While this is all fun and games, I am curious if DOSing someone else’s server, even if it’s being used to run a phishing scam, is legal.
Probably as illegal as stealing a cocaine from a drug dealer.
Probably less legal. No court will convict you of stealing that cocaine, but a lot of courts would convict you of computer attack. Don't forget that when attacking, you're almost certainly not attacking just the phisher, but a lot of middlemen.
Re: Stopping phishing campaigns with Bash
#57Earlier quoted context omitted.
While it may be technically illegal, considering the victims are themselves worse criminals caught in the act, I really doubt anyone is going to give you trouble over this. Unless authorities are looking for an excuse to prosecute you, of course, but there's plenty of bad PR to be had for authorities acting on behalf of criminals trying to steal people's banking credentials.
> While it may be technically illegal, considering the victims are themselves worse criminals caught in the act, I really doubt anyone is going to give you trouble over this. Depends on who you fear more: law enforcement or organized crime.
[deleted]
Re: Stopping phishing campaigns with Bash
#58Earlier quoted context omitted.
How can it be illegal sending a few fake data to a website? And anyway I doubt they will ever sue you, at most you could be targeted for some revenge attack if they are really pissed off and you don't hide your traces.
IANAL: This is what I expect the relevant text in the CFAA is... knowingly causes the transmission of a program, information, code, or command, and as a result of such conduct, intentionally causes damage without authorization, to a protected computer;
Is it a protected computer?
Re: Stopping phishing campaigns with Bash
#59noob question: what does an \ at the end of a bash script do? Is it the same as ; ?
In bash '\' would escape the character behind it. In this case, newline was escaped, which means you could ignore the newline character and treat those lines as one line.
Re: Stopping phishing campaigns with Bash
#60Hilarious story:
I was hired to look into why a WordPress site was so slow back in 2010. It turned out the site was hacked and they were hosting a spam viagra site on the side. When I brought it to their attention, the owner asked: "Can we keep it up? It will help our traffic numbers for investors and probably our Google ranking."
I literally face-palmed.