Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Someone used my open source project to phish people

andrej.sh

Post reply on HN
Print view View original

41–50 of 64 posts

Re: Someone used my open source project to phish people

#41

Post by reconnecting »

eggbrain wrote: post #4

There will always be a subset of users whose goal is to not use your service, but to arbitrage your service into the maximum value for themselves. For example -- let's say you offer $100 in free AWS credits by signing up to your platform. Expect a malicious user to eventually come to your platform, realize they can resell those $100 in credits for $50, and start using your platform for their own gain. Unless the mech…

You're mixing up bonus abuse here. The people behind phishing are more like hackers, whereas bonus abuse is usually run by non-technical people or bot farms. Scammers are much more dangerous, because they're typically behind operations far wider than just phishing, this might include actual financial fraud, international money laundering, and so on.

Bonus abuse is a small shop, whereas phishing through third-party services is much more likely to be an organized crime group.

Re: Someone used my open source project to phish people

#42

Post by floren »

JRandomHacker42 wrote: post #11
no_multitudes wrote: post #7

Earlier quoted context omitted.

The sentence construction, choice of vocabulary, and continually breathless tone are all clear indicators this was written by an llm and barely edited. I threw part of it into pangram to get a second opinion: https://www.pangram.com/history/8d6a7de3-86ac-4ce0-86c5-4f93...

> There was no exploit. No vulnerability disclosure. No CVE for me to write. was a dead giveaway in my mind when I read it.

That was the sentence that made me close the tab.

Re: Someone used my open source project to phish people

#43

Post by eggbrain »

reconnecting wrote: post #41
eggbrain wrote: post #4

There will always be a subset of users whose goal is to not use your service, but to arbitrage your service into the maximum value for themselves. For example -- let's say you offer $100 in free AWS credits by signing up to your platform. Expect a malicious user to eventually come to your platform, realize they can resell those $100 in credits for $50, and start using your platform for their own gain. Unless the mech…

You're mixing up bonus abuse here. The people behind phishing are more like hackers, whereas bonus abuse is usually run by non-technical people or bot farms. Scammers are much more dangerous, because they're typically behind operations far wider than just phishing, this might include actual financial fraud, international money laundering, and so on. Bonus abuse is a small shop, whereas phishing through third-party se…

To the end platform, what's the difference? Mitigation techniques largely remain the same, in that you make it more time / energy / money than what the end result of their abuse is worth. The platform cares about stopping the abuse -- not neccesarily correctly identifying whether the people abusing their platform are small shop "bot farms" vs organized crime.

Re: Someone used my open source project to phish people

#44

Post by mapmeld »

cobertos wrote: post #12

Is this the new norm for trying to make software projects in the wild? The 14000 sends over 3 hours ( Wondering if LLM-assisted vulnerability hunting will lead to the same gains in scale for bad actors wanting to find spammable channels in applications. The barrier to entry becomes so much greater because any small project, once found, can be wrung dry of all its trust signals by third parties

If you have a website somewhere with an unrestricted comment box, it gets spammed. That doesn't take a special AI, because for years there have been script kiddies scanning new domains, IP addresses on AWS, common wp-admin URLs, etc.

Re: Someone used my open source project to phish people

#47

Post by reconnecting »

eggbrain wrote: post #43
reconnecting wrote: post #41

Earlier quoted context omitted.

You're mixing up bonus abuse here. The people behind phishing are more like hackers, whereas bonus abuse is usually run by non-technical people or bot farms. Scammers are much more dangerous, because they're typically behind operations far wider than just phishing, this might include actual financial fraud, international money laundering, and so on. Bonus abuse is a small shop, whereas phishing through third-party se…

To the end platform, what's the difference? Mitigation techniques largely remain the same, in that you make it more time / energy / money than what the end result of their abuse is worth. The platform cares about stopping the abuse -- not neccesarily correctly identifying whether the people abusing their platform are small shop "bot farms" vs organized crime.

To the platform, the difference shows up exactly in the mitigation math. The 'make it cost more than it's worth' model only works when both sides of that ratio are knowable and bounded. With bonus abuse, the reward is fixed and the math is clear, so you can reliably price the abuser out.

With organized criminals, you can't actually see what the abuse is 'worth' to them. And they can escalate almost infinitely: mimicking real user behavior, routing through residential IP proxies, using email addresses with established reputation, and at the top of the pyramid we've seen full mimics with real social network profiles and activity, they even answer phone calls.

That's why it's worth collecting events before acting: what the account is about, which IP network they use, whether they fake devices, whether there's any warmup prior to registration. Because that's what helps estimate whether your mitigation will actually work, and lets you respond in a balanced manner instead of under- or over-reacting.

Re: Someone used my open source project to phish people

#48

Post by pressbuttons »

no_multitudes wrote: post #7
pressbuttons wrote: post #6

Earlier quoted context omitted.

Why do you think this is LLM-generated? Reads perfectly fine to me.

The sentence construction, choice of vocabulary, and continually breathless tone are all clear indicators this was written by an llm and barely edited. I threw part of it into pangram to get a second opinion: https://www.pangram.com/history/8d6a7de3-86ac-4ce0-86c5-4f93...

To each their own, I suppose. I personally enjoyed the style, and it definitely pre-dates LLMs. For example:

> You want to know the benefits of free trade? Food is cheaper. Food is cheaper! Clothes are cheaper. Steel is cheaper. Cars are cheaper. Phone service is cheaper. You feel me building a rhythm here? That's because I'm a speech writer - I know how to make a point. It lowers prices, it raises income. You see what I did with 'lowers' and 'raises' there? It's called the science of listener attention. We did repetition, we did floating opposites, and now you end with the one that's not like the others. Ready? Free trade stops wars. Heh, and that's it.

It sounds like this: https://youtu.be/8dGkiJcEK78?si=MGfv2FM_GksGoMho

Re: Someone used my open source project to phish people

#49

Post by zahlman »

pressbuttons wrote: post #48
no_multitudes wrote: post #7

Earlier quoted context omitted.

The sentence construction, choice of vocabulary, and continually breathless tone are all clear indicators this was written by an llm and barely edited. I threw part of it into pangram to get a second opinion: https://www.pangram.com/history/8d6a7de3-86ac-4ce0-86c5-4f93...

To each their own, I suppose. I personally enjoyed the style, and it definitely pre-dates LLMs. For example: > You want to know the benefits of free trade? Food is cheaper. Food is cheaper! Clothes are cheaper. Steel is cheaper. Cars are cheaper. Phone service is cheaper. You feel me building a rhythm here? That's because I'm a speech writer - I know how to make a point. It lowers prices, it raises income. You see wh…

The style demonstrated in the blog post is really not the same.

Re: Someone used my open source project to phish people

#50

Post by reconnecting »

reconnecting wrote: post #39

Captcha here will only harm your real users' experience and won't protect against this kind of abuse, since it comes from real scammers, not fully automated bots. I've dealt with these and similar issues over the last 8 years, which led our team to develop a security tool 5 years ago that is now open-sourced. https://github.com/tirrenotechnologies/tirreno

Perhaps the downvotes come from scammers.
Post reply on HN