Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Stopping phishing campaigns with Bash

blog.haschek.at

Post reply on HN
Print view View original

161–169 of 169 posts

Re: Stopping phishing campaigns with Bash

#161

Post by darkwater »

StreamBright wrote: post #159
darkwater wrote: post #34

Earlier quoted context omitted.

To poison some phishing data you don't need to overload any server. Although the act itself of poisoning data could be seen as a DoS but since the service in question is an illegal one IANAL but I don't think it would stand in court.

It is very important to understand this from the legal stand point. If you overload a legitimate or illegitimate service you might commit a crime (depending on the country). I can give you a simple example of this in a different context. In our country you cannot go after the criminal who committed the crime and cannot cause them harm. Few years back a lady got robbed by two guys on a motorbike and she went after the…

I see your point but anyway I think that phishers hardly will sue you for poisoning their data, because you probably just uncovered one phishing campaign but they run tens of them. Putting Justice in the loop would be much riskier for them, I believe.

Re: Stopping phishing campaigns with Bash

#162

Post by kwhitefoot »

moviuro wrote: post #32
1023bytes wrote: post #8

All banks in the EU are required to use 2FA, I'm curious how these hackers get around that.

1. One SMS every 90 days, because the security teams have no idea how MFA works (I know, I work there). Even if you hop devices. See https://try.popho.be/psd2.html 2. It's just a little dev step away: http://blog.cmpxchg8b.com/2020/07/you-dont-need-sms-2fa.html . Phish kits will evolve, UX will still be bad, and phishing will still happen. See also https://sakurity.com/blog/2015/07/18/2fa.html

> 1. One SMS every 90 days,

Wow that's bad.

Here in Norway we use a system called BankID that uses the SIM in your mobile and it does it every time I log in.

Re: Stopping phishing campaigns with Bash

#163

Post by VBprogrammer »

distances wrote: post #160
VBprogrammer wrote: post #10

Earlier quoted context omitted.

For quite a long time my bank used cargo culted 2FA i.e. 2x things that you know. Pretty embarrassing really. Thankfully they now have a card reader device but it's only used for certain actions (like adding new payees).

In the EU? That definitely wouldn't be compliant, unless we're talking about 90s or something.

I didn't have internet banking in the 90s but it's probably been 10 years or so since they sent out the card readers.

Found some random blog which suggests it was circa 2007. http://www.craigmurphy.com/blog/?p=634

Re: Stopping phishing campaigns with Bash

#164

Post by cutemonster »

ChrisMarshallNY wrote: post #90
Aachen wrote: post #85

Earlier quoted context omitted.

So like... Backups? Restore, put it behind basic auth and email the password to the members active in the past few weeks, then at your leasure implement some captchas and go from there. Heck, restore the forum publicly as well and use that as a sandbox to see how they'll bypass it.

Shirley, you jest. Backups are for, like, squares , dude. We live on the edge , dude! Extreme! YOLO! In all fairness, the person involved was a truly brilliant young man, and the experience pretty much shattered him, emotionally. He has yet to recover from it. In a way, it can be satisfying to be able to say "I told you so," but seeing the human cost kinda takes the fun out of smugness.

How did the spammers hit back?

Can I ask what made it hard / infeasible to continue once the spammers had stopped hitting back?

> seeing the human cost

It seems the forum meant a lot to him/her

Re: Stopping phishing campaigns with Bash

#165

Post by pbhjpbhj »

Geezus_42 wrote: post #155
pbhjpbhj wrote: post #84

Earlier quoted context omitted.

I think the bank thing is done through students quite often: "Hey, I can't get a bank account as I'm a refugee fleeing a war, please help by receiving £5000 cash, we'll give you £100. Say it's a gift from your Aunty to buy a car with." I've seen reports of this in the UK at least, maybe they managed to stop it.

At least in the US the people who accept the offer can be charged as money mules.

I think that's true in UK too, but often the people aren't aware how wrong what they're doing is.

Re: Stopping phishing campaigns with Bash

#166

Post by heavyset_go »

rileytg wrote: post #150
n0on3 wrote: post #112

That's really... not an appropriate response, and not only for the legal reasons others mentioned. Phishing sites can be / are often served by compromised hosts, so you might as well end up doxing a box who is not run by the bad guy, causing all sorts of mayem for the legitimate owners / admins (in addition to they be compromised). Plus, you didn't solve anything, from the pattern you used it's pretty easy to cleanup…

I had a similar situation happen to me. Someone was catfishing (dogfishing?) using my dog; they have him listed for sale... I phished the seller into giving me their Zelle email which was a full name and presumably tied to a legit bank account with a legit person associated with it. I reported them, will all the facts I'd collected to the AG office in the state I believed them to be in (OH- b/c they offered shipping…

> "Johnny" is my dog. That photo is in front of my old apartment.

I've successfully used the DMCA against spammers who used my photos in their spam. Hosting providers and platforms usually have process in place to deal with copyright infringement even if they're turning a blind eye to fraud.

Unfortunately, that is the only success I've had against them.

Re: Stopping phishing campaigns with Bash

#167

Post by ChrisMarshallNY »

cutemonster wrote: post #164
ChrisMarshallNY wrote: post #90

Earlier quoted context omitted.

Shirley, you jest. Backups are for, like, squares , dude. We live on the edge , dude! Extreme! YOLO! In all fairness, the person involved was a truly brilliant young man, and the experience pretty much shattered him, emotionally. He has yet to recover from it. In a way, it can be satisfying to be able to say "I told you so," but seeing the human cost kinda takes the fun out of smugness.

How did the spammers hit back? Can I ask what made it hard / infeasible to continue once the spammers had stopped hitting back? > seeing the human cost It seems the forum meant a lot to him/her

I was not directly involved in the incident; hearing about it after the fact.

My understanding is that a forum spammer started registering fake accounts, and then did what they do. The admin saw this. He was quite smart, and figured out who they were, then executed some kind of attack on their server. I think it was a DDoS attack.

When they responded, the used a bunch of privilege escalation attacks to promote some of their registered users (It was a badly-maintained phpBB site; otherwise known as "Swiss Cheese"), and blew away a lot of the site structure and templates, so it basically imploded.

Yeah, it was his "baby." He was also involved in a running battle of nerd egos with some other folks, who used the incident to discredit him, and drove him out.

Re: Stopping phishing campaigns with Bash

#168

Post by berkes »

jagged-chisel wrote: post #91
berkes wrote: post #47

Earlier quoted context omitted.

I attended a meetup at our local registrar (SIDN) where they explained how data analysts on their payroll detect such fake webshops and how they then actively block those domains on DNS and registrar level.

I'm assuming you don't mean "employee payroll" right?

English is not my native language. I meant "they work for SIDN at SIDN". Employees.

Re: Stopping phishing campaigns with Bash

#169

Post by cutemonster »

ChrisMarshallNY wrote: post #167
cutemonster wrote: post #164

Earlier quoted context omitted.

How did the spammers hit back? Can I ask what made it hard / infeasible to continue once the spammers had stopped hitting back? > seeing the human cost It seems the forum meant a lot to him/her

I was not directly involved in the incident; hearing about it after the fact. My understanding is that a forum spammer started registering fake accounts, and then did what they do. The admin saw this. He was quite smart, and figured out who they were, then executed some kind of attack on their server. I think it was a DDoS attack. When they responded, the used a bunch of privilege escalation attacks to promote some o…

> blew away a lot of the site structure and templates

Crazy spammers who have time for such things

Sad to hear how this affected him

Post reply on HN