Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Stopping phishing campaigns with Bash

blog.haschek.at

Post reply on HN
Print view View original

61–70 of 169 posts

Re: Stopping phishing campaigns with Bash

#61

Post by Sebb767 »

beAbU wrote: post #50

A colleague and I did something similar recently. We got similar spam mails in our work inboxes. Whipped up a little ruby script that spammed bum login data to the spammer's form url. We had our scripts running on a couple of Heroku instances and all. At some stage we realized that the password field in the form accepted arbitrarily sized payloads. So we base64 encoded some 10MB file and sent that as the password. Th…

While funny, real-looking fake login data might be more useful, as it's probably real easy to filter the few large requests. Unless, of course, you bring down the server and stop the whole operation (for a time).

It would be quite interesting to do a study on both options using a honeypot-account (to detect whether the login could be extracted by the spammer).

Re: Stopping phishing campaigns with Bash

#62

Post by szatkus »

berkes wrote: post #49
1023bytes wrote: post #8

All banks in the EU are required to use 2FA, I'm curious how these hackers get around that.

Wouldn't a phishing site be able to proxy the challenge and then record and proxy the response which the user types in? I.e. MITM the 2fa?

Depends what you want to achive. With wire transfers there's usually (always?) info about amount and last few digits of the account you're transfering money to on your 2FA provider.

Re: Stopping phishing campaigns with Bash

#63

Post by mipmap04 »

withinboredom wrote: post #60

Hilarious story: I was hired to look into why a WordPress site was so slow back in 2010. It turned out the site was hacked and they were hosting a spam viagra site on the side. When I brought it to their attention, the owner asked: "Can we keep it up? It will help our traffic numbers for investors and probably our Google ranking." I literally face-palmed.

Well, with a spam viagra site, I think the point is keeping it up.

On topic, it's crazy how willing some people are to defraud their investors.

Re: Stopping phishing campaigns with Bash

#64

Post by Sebb767 »

mirekrusin wrote: post #44
noodlesUK wrote: post #19

Earlier quoted context omitted.

IANAL: This is what I expect the relevant text in the CFAA is... knowingly causes the transmission of a program, information, code, or command, and as a result of such conduct, intentionally causes damage without authorization, to a protected computer;

Is it a damage if you damage damaging thing? If effect of your damage is less damage maybe it's not damage after all?

> Is it a damage if you damage damaging thing?

When in doubt - yes. It's the same reasoning forbidding you from shooting criminals in the street, you'd just open up mob justice.

Of course, this is a pretty clear cut case and you might argue that this is an emergency (as people are clearly in danger of being scammed unless you act right now), but overall this is a very blurry line.

Re: Stopping phishing campaigns with Bash

#66

Post by eitland »

mirekrusin wrote: post #44
noodlesUK wrote: post #19

Earlier quoted context omitted.

IANAL: This is what I expect the relevant text in the CFAA is... knowingly causes the transmission of a program, information, code, or command, and as a result of such conduct, intentionally causes damage without authorization, to a protected computer;

Is it a damage if you damage damaging thing? If effect of your damage is less damage maybe it's not damage after all?

Depends: around here you can break into a shop at night to put out a fire or - more realistically - break a car window to pull out a kid (or animal) left alone in the sun.

I'd be careful with computer crimes on the Internet though.

Re: Stopping phishing campaigns with Bash

#67

Post by darkerside »

mipmap04 wrote: post #63
withinboredom wrote: post #60

Hilarious story: I was hired to look into why a WordPress site was so slow back in 2010. It turned out the site was hacked and they were hosting a spam viagra site on the side. When I brought it to their attention, the owner asked: "Can we keep it up? It will help our traffic numbers for investors and probably our Google ranking." I literally face-palmed.

Well, with a spam viagra site, I think the point is keeping it up. On topic, it's crazy how willing some people are to defraud their investors.

Send like a missed opportunity to pivot into a spam viagra hosting site

Re: Stopping phishing campaigns with Bash

#68

Post by NicoJuicy »

Well, I have something like HN running on https://handlr.sapico.me ( automatically imports rss feeds)

Wich had a lot of spammers and they worked around the Google Human verification script for logging in.

Humans won't add a Title + Url + text since it shouldn't be used this way.

So ... that flow now returns a xml bomb.

Spam stopped immediately after deploying this. I'm a bit curious how long they spend looking why the memory of their server suddenly went through the roof :p

Re: Stopping phishing campaigns with Bash

#69

Post by m-p-3 »

I normally just report those sites on https://safebrowsing.google.com/safebrowsing/report_phish/ and it doesn't normally take long to end up with a phishing warning when you navigate to it with a modern browser.

I also try to send an email to the registrar "abuse" email to let them know that a specific domain is hosting a phishing page (with the exact link as proof). That takes it down quickly as well, which forces the website owner to do some remediation.

Post reply on HN