Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Stopping phishing campaigns with Bash

blog.haschek.at

Post reply on HN
Print view View original

81–90 of 169 posts

Re: Stopping phishing campaigns with Bash

#81

Post by mcv »

TheAdamAndChe wrote: post #74
weinzierl wrote: post #52

Earlier quoted context omitted.

> While it may be technically illegal, considering the victims are themselves worse criminals caught in the act, I really doubt anyone is going to give you trouble over this. Depends on who you fear more: law enforcement or organized crime.

The comment you replied to did say "Unless authorities are looking for an excuse to prosecute you, of course." If you suspect you're being monitored by the FBI or some other entity, you don't want to push the envelope.

O think weinzierl suggests that the criminals behind this might be more eager to punish you than law enforcement. But of course for that it doesn't really matter whether or not this is legal.

Re: Stopping phishing campaigns with Bash

#82

Post by woko »

eitland wrote: post #66
mirekrusin wrote: post #44

Earlier quoted context omitted.

Is it a damage if you damage damaging thing? If effect of your damage is less damage maybe it's not damage after all?

Depends: around here you can break into a shop at night to put out a fire or - more realistically - break a car window to pull out a kid (or animal) left alone in the sun. I'd be careful with computer crimes on the Internet though.

> I'd be careful with computer crimes on the Internet though.

Exactly. Let us say you break into a shop owned by some mafia to put out a fire, then you might be fine w.r.t. authority, but you might be in trouble w.r.t. criminals. Similarly, say you break a car window to pull out a pit-bull left alone in the sun, you might have some issues with the owner if he turns out to be part of some drug trafficking gang.

There is no reason to believe that phishing websites are run by script-kiddies, there are obviously criminal rings running all sorts of businesses on the Internet too. I would rather leave the work to the authorities rather than risk going through trouble with unknown criminals, just so that I could have my funny revenge over them.

Re: Stopping phishing campaigns with Bash

#83

Post by beAbU »

Sebb767 wrote: post #61
beAbU wrote: post #50

A colleague and I did something similar recently. We got similar spam mails in our work inboxes. Whipped up a little ruby script that spammed bum login data to the spammer's form url. We had our scripts running on a couple of Heroku instances and all. At some stage we realized that the password field in the form accepted arbitrarily sized payloads. So we base64 encoded some 10MB file and sent that as the password. Th…

While funny, real-looking fake login data might be more useful, as it's probably real easy to filter the few large requests. Unless, of course, you bring down the server and stop the whole operation (for a time). It would be quite interesting to do a study on both options using a honeypot-account (to detect whether the login could be extracted by the spammer).

So the script we wrote created real email addresses and user names. The Ruby gem Faker (https://github.com/faker-ruby/faker) takes care of that.

But yeah you are probably right. 10MB passwords possibly made it too easy for the scammer to filter out the bum data.

We did only make the 10MB change very late in our attack, so the scammer got 1000's of fake names and emails before we cranked up the mass of each individual request.

Re: Stopping phishing campaigns with Bash

#84

Post by pbhjpbhj »

Cthulhu_ wrote: post #33
Wandfarbe wrote: post #28

I stoped 2 webshops which basically sell expensive stuff 20% off by wire transfer (bank transfer?!) which then never send the goods of course! I did the following: - I found out where it was hosted and send them an email explaining them why and how that shop is a scam - I found out where they hosted the domain and wrote the registrar an abuse email - I wrote an email to the banks where the bank accounts where active…

I like to think it helped out, but at the same time, these people are professionals and will have automation to generate new instances and scam campaigns easily. At least it should be more difficult for them to set up new bank accounts though, they need ID for that, and / or a network of mules, and those are finite resources.

I think the bank thing is done through students quite often: "Hey, I can't get a bank account as I'm a refugee fleeing a war, please help by receiving £5000 cash, we'll give you £100. Say it's a gift from your Aunty to buy a car with."

I've seen reports of this in the UK at least, maybe they managed to stop it.

Re: Stopping phishing campaigns with Bash

#85

Post by Aachen »

ChrisMarshallNY wrote: post #37

I know someone that DDoSed a forum spammer. They hit back, ten times as hard, and completely destroyed a well-established forum, with thousands of users, that had experienced an annoying (but not crippling) "penis pill" spam attack.

So like... Backups? Restore, put it behind basic auth and email the password to the members active in the past few weeks, then at your leasure implement some captchas and go from there. Heck, restore the forum publicly as well and use that as a sandbox to see how they'll bypass it.

Re: Stopping phishing campaigns with Bash

#86

Post by moduspol »

eli wrote: post #71
xamde wrote: post #58

Earlier quoted context omitted.

Is it a protected computer?

Yes. It’s defined incredibly and ridiculously broadly in the law. Pretty much any server you can get to on the internet is “protected”

Looks accurate. It apparently does have a legal definition.

https://en.wikipedia.org/wiki/Protected_computer

Re: Stopping phishing campaigns with Bash

#87

Post by shitloadofbooks »

mcv wrote: post #48
noodlesUK wrote: post #12

As much as I think things like this can be fun, depending on your jurisdiction (and tbh the US loves extraditing people for silly computer crimes), it might not be advisable. This is all but certainly illegal at least within the US. I’m sure most competent security experts have been tempted to do things like this, or SQLi a scammer’s form and nuke their DB, and usually bad things won’t happen to you, you might find t…

While it may be technically illegal, considering the victims are themselves worse criminals caught in the act, I really doubt anyone is going to give you trouble over this. Unless authorities are looking for an excuse to prosecute you, of course, but there's plenty of bad PR to be had for authorities acting on behalf of criminals trying to steal people's banking credentials.

VPS owners will if your flooding causes issues for their (other) clients on the same hardware, etc.

It's definitely better to not do this.

Re: Stopping phishing campaigns with Bash

#89

Post by KMag »

mcv wrote: post #48
noodlesUK wrote: post #12

As much as I think things like this can be fun, depending on your jurisdiction (and tbh the US loves extraditing people for silly computer crimes), it might not be advisable. This is all but certainly illegal at least within the US. I’m sure most competent security experts have been tempted to do things like this, or SQLi a scammer’s form and nuke their DB, and usually bad things won’t happen to you, you might find t…

While it may be technically illegal, considering the victims are themselves worse criminals caught in the act, I really doubt anyone is going to give you trouble over this. Unless authorities are looking for an excuse to prosecute you, of course, but there's plenty of bad PR to be had for authorities acting on behalf of criminals trying to steal people's banking credentials.

Maybe if you don't cause any collateral damage, you might have a low chance of conviction by a jury because the victim is highly non-sympathetic. (I'm not a lawyer. This is NOT LEGAL ADVICE.) That doesn't mean you won't get charged and incur a ton of legal costs if you pursue a jury trial rather than settling.

Always remember that U.S. courts are courts of law, not courts of justice. That's usually a good thing (less left to interpretation), but it does have downsides.

Re: Stopping phishing campaigns with Bash

#90

Post by ChrisMarshallNY »

Aachen wrote: post #85
ChrisMarshallNY wrote: post #37

I know someone that DDoSed a forum spammer. They hit back, ten times as hard, and completely destroyed a well-established forum, with thousands of users, that had experienced an annoying (but not crippling) "penis pill" spam attack.

So like... Backups? Restore, put it behind basic auth and email the password to the members active in the past few weeks, then at your leasure implement some captchas and go from there. Heck, restore the forum publicly as well and use that as a sandbox to see how they'll bypass it.

Shirley, you jest.

Backups are for, like, squares, dude.

We live on the edge, dude!

Extreme! YOLO!

In all fairness, the person involved was a truly brilliant young man, and the experience pretty much shattered him, emotionally. He has yet to recover from it.

In a way, it can be satisfying to be able to say "I told you so," but seeing the human cost kinda takes the fun out of smugness.

Post reply on HN