Stopping phishing campaigns with Bash • Hacker News Board

Re: Stopping phishing campaigns with Bash

#131

Post by onetimeusename » Thu, Aug 13, 2020, 3:53 PM UTC

n0on3 wrote: post #129

onetimeusename wrote: post #127

Earlier quoted context omitted.

I used to report these things but ran into some issues: 1) There is no way I can see to contact anyone at Ali Cloud to report abuse and no expectation they will do anything and I've seen an increasing number of scams hosted on offshore providers with no apparent abuse reporting system. 2) Some registrars and hosting providers want you to sign up with an account first to be able to create a support ticket to report ab…

You should be able to find the registar abuse contact information in the whois, in the fields "Registrar Abuse Contact Email" and "Registrar Abuse Telephone Number". Registrars are required to provide these for the accreditation to ICANN [0]. Both email and valid phone number are required. [0] https://www.icann.org/resources/pages/faqs-2013-11-26-en

yes, I meant that more for hosting providers. However, I have never received a response from a registrar when I have contacted them about abuse so I am not sure how useful it is.

Re: Stopping phishing campaigns with Bash

#132

Post by n0on3 » Thu, Aug 13, 2020, 4:03 PM UTC

yosamino wrote: post #130

n0on3 wrote: post #112

That's really... not an appropriate response, and not only for the legal reasons others mentioned. Phishing sites can be / are often served by compromised hosts, so you might as well end up doxing a box who is not run by the bad guy, causing all sorts of mayem for the legitimate owners / admins (in addition to they be compromised). Plus, you didn't solve anything, from the pattern you used it's pretty easy to cleanup…

> A more appropriate response is to report the abuse who manages the infrastructure (most likely a legitimate provider) and the domain registar; both usually have appropriate channels and response procedures just for that. Unless of course it's behind Cloudflare - then you cannot find out whose infrastructure the criminals are operating from and Cloudflare itself does not give a fuck. Best case scenario: they will fo…

They claim they will do all this for you if they are (allegedly) proxying malicious content. Source: their abuse form [1], selecting "Phishing & Malware". Did you have bad experiences with this? Might be worth sharing.

[1] https://www.cloudflare.com/abuse/form

Re: Stopping phishing campaigns with Bash

#133

Post by outworlder » Thu, Aug 13, 2020, 4:06 PM UTC

n0on3 wrote: post #112

That's really... not an appropriate response, and not only for the legal reasons others mentioned. Phishing sites can be / are often served by compromised hosts, so you might as well end up doxing a box who is not run by the bad guy, causing all sorts of mayem for the legitimate owners / admins (in addition to they be compromised). Plus, you didn't solve anything, from the pattern you used it's pretty easy to cleanup…

I agree in principle. But...

> Phishing sites can be / are often served by compromised hosts, so you might as well end up doxing a box who is not run by the bad guy, causing all sorts of mayem for the legitimate owners / admins (in addition to they be compromised).

Well, they are already compromised. If they were lucky, it was just an automated system that scanned for vulnerabilities and only dropped the phishing webserver – for now. It could be used as a jump box to compromise further systems in the host's network. Who knows what else may be running in the box. If it is being used for 'legitimate purposes', whatever purpose it is, it is at a large risk.

The fact that it is still compromised indicates that it is not actively/properly monitored.

Taking it out will draw much more attention to the system from their owners. If I had a compromised system that I didn't know about and it was taken out, I'd be thankful it wasn't left running for longer.

It's not the 'correct' thing to do, but I'm not convinced that putting the system out of comission is more harmful than leaving it running doing who knows what.

Re: Stopping phishing campaigns with Bash

#134

Post by outworlder » Thu, Aug 13, 2020, 4:15 PM UTC

mushufasa wrote: post #124

valuearb wrote: post #118

Earlier quoted context omitted.

If your insecure site has been hijacked by phishing campaigns, you deserve to have it brought to its knees. Security is your responsibility.

This is prevalent logic in the security community, but it sounds strange applied to other domains. "Porch pirates are justified because you should have secured your amazon delivery." "She deserved harassment because she was dressed provocatively" "Your country didn't have a wall so it deserved to be invaded."

They sound strange because they are bad analogies.

This is a case where a resource was hijacked and is being used against other people. A similarly bad analogy, but more accurate, is if you had a car that was stolen, and subsequently used to commit crimes. If it got stopped, it would be beneficial to society, even if it could cause you financial harm.

Re: Stopping phishing campaigns with Bash

#135

Post by outworlder » Thu, Aug 13, 2020, 4:18 PM UTC

valuearb wrote: post #120

KMag wrote: post #89

Earlier quoted context omitted.

Maybe if you don't cause any collateral damage, you might have a low chance of conviction by a jury because the victim is highly non-sympathetic. (I'm not a lawyer. This is NOT LEGAL ADVICE.) That doesn't mean you won't get charged and incur a ton of legal costs if you pursue a jury trial rather than settling. Always remember that U.S. courts are courts of law, not courts of justice. That's usually a good thing (less…

Jury nullification allows them to become courts of justice.

Which is why is screened for at the jury selection stage.

Re: Stopping phishing campaigns with Bash

#136

Post by wolco » Thu, Aug 13, 2020, 4:34 PM UTC

kayson wrote: post #122

gnfargbl wrote: post #116

Earlier quoted context omitted.

Have you ever tried reporting a phishing site through those legitimate channels? I have, and my experiences have been that: * The domain registrars are apologetic and well-meaning, but tend to explain that they aren't empowered to take this stuff down without being ordered to by Law Enforcement or similar. There typically isn't a mechanism available for getting LE to respond before the phish campaign is over. * The h…

I've had a similar experience. I ran into a scam that was masquerading as a popular Canadian clothing store (Roots) where everything was 50% off. I reported the domain to Namecheap and they said they're not responsible for the content since its hosted elsewhere. I pointed out that the domain itself was also trying to pass as legitimate and they told me unless I was the trademark owner they couldn't do anything. I als…

Did you expect the domain company to take down the domain based on a copyright issue reported by an entity where they are not the copyright holder?

Think of all of the false take down requests registers would receive.

Re: Stopping phishing campaigns with Bash

#137

Post by wolco » Thu, Aug 13, 2020, 4:38 PM UTC

outworlder wrote: post #133

n0on3 wrote: post #112

That's really... not an appropriate response, and not only for the legal reasons others mentioned. Phishing sites can be / are often served by compromised hosts, so you might as well end up doxing a box who is not run by the bad guy, causing all sorts of mayem for the legitimate owners / admins (in addition to they be compromised). Plus, you didn't solve anything, from the pattern you used it's pretty easy to cleanup…

I agree in principle. But... > Phishing sites can be / are often served by compromised hosts, so you might as well end up doxing a box who is not run by the bad guy, causing all sorts of mayem for the legitimate owners / admins (in addition to they be compromised). Well, they are already compromised. If they were lucky, it was just an automated system that scanned for vulnerabilities and only dropped the phishing web…

It becomes a defensive against hacking legimate sites.

Anyone could hack a site put malware and if they are caught claim they hacked in to remove the malware they put.

Re: Stopping phishing campaigns with Bash

#138

Post by n0on3 » Thu, Aug 13, 2020, 4:38 PM UTC

outworlder wrote: post #133

n0on3 wrote: post #112

That's really... not an appropriate response, and not only for the legal reasons others mentioned. Phishing sites can be / are often served by compromised hosts, so you might as well end up doxing a box who is not run by the bad guy, causing all sorts of mayem for the legitimate owners / admins (in addition to they be compromised). Plus, you didn't solve anything, from the pattern you used it's pretty easy to cleanup…

I agree in principle. But... > Phishing sites can be / are often served by compromised hosts, so you might as well end up doxing a box who is not run by the bad guy, causing all sorts of mayem for the legitimate owners / admins (in addition to they be compromised). Well, they are already compromised. If they were lucky, it was just an automated system that scanned for vulnerabilities and only dropped the phishing web…

Not much against taking a compromised system down, but the provider can (should?) do that according to their ToS (and whatever containment / response procedures they have in place), not some targeted victim playing vigilante by running what is basically a trivial DOS attack. My point was this is not a good thing to show off / encourage people to do and can have unexpectedly bad consequences.

Re: Stopping phishing campaigns with Bash

#139

Post by wolco » Thu, Aug 13, 2020, 4:45 PM UTC

mcv wrote: post #48

noodlesUK wrote: post #12

As much as I think things like this can be fun, depending on your jurisdiction (and tbh the US loves extraditing people for silly computer crimes), it might not be advisable. This is all but certainly illegal at least within the US. I’m sure most competent security experts have been tempted to do things like this, or SQLi a scammer’s form and nuke their DB, and usually bad things won’t happen to you, you might find t…

While it may be technically illegal, considering the victims are themselves worse criminals caught in the act, I really doubt anyone is going to give you trouble over this. Unless authorities are looking for an excuse to prosecute you, of course, but there's plenty of bad PR to be had for authorities acting on behalf of criminals trying to steal people's banking credentials.

Until you realized you have been setup. The box you log into has child porn or those logs you download have them.

Now you pay up or cops are called.

Trying to play a hacker may get you in more trouble unless you really are one.

Re: Stopping phishing campaigns with Bash

#140

Post by layoutIfNeeded » Thu, Aug 13, 2020, 5:02 PM UTC

mushufasa wrote: post #124

valuearb wrote: post #118

Earlier quoted context omitted.

If your insecure site has been hijacked by phishing campaigns, you deserve to have it brought to its knees. Security is your responsibility.

This is prevalent logic in the security community, but it sounds strange applied to other domains. "Porch pirates are justified because you should have secured your amazon delivery." "She deserved harassment because she was dressed provocatively" "Your country didn't have a wall so it deserved to be invaded."

It's more like: "She deserves to get her car's tires slashed because her car was stolen and is being driven on the sidewalk hitting innocent pedestrians"

In which case my answer would be: of course, by all means!