Stopping phishing campaigns with Bash • Hacker News Board

Re: Stopping phishing campaigns with Bash

#91

Post by jagged-chisel » Thu, Aug 13, 2020, 1:09 PM UTC

berkes wrote: post #47

Wandfarbe wrote: post #28

I stoped 2 webshops which basically sell expensive stuff 20% off by wire transfer (bank transfer?!) which then never send the goods of course! I did the following: - I found out where it was hosted and send them an email explaining them why and how that shop is a scam - I found out where they hosted the domain and wrote the registrar an abuse email - I wrote an email to the banks where the bank accounts where active…

I attended a meetup at our local registrar (SIDN) where they explained how data analysts on their payroll detect such fake webshops and how they then actively block those domains on DNS and registrar level.

I'm assuming you don't mean "employee payroll" right?

Re: Stopping phishing campaigns with Bash

#92

Post by flareback » Thu, Aug 13, 2020, 1:09 PM UTC

noodlesUK wrote: post #19

darkwater wrote: post #13

Earlier quoted context omitted.

How can it be illegal sending a few fake data to a website? And anyway I doubt they will ever sue you, at most you could be targeted for some revenge attack if they are really pissed off and you don't hide your traces.

IANAL: This is what I expect the relevant text in the CFAA is... knowingly causes the transmission of a program, information, code, or command, and as a result of such conduct, intentionally causes damage without authorization, to a protected computer;

Is it damage if you're just sending data to an endpoint to see what happens. Sounds like he didn't try to send a SQL Injection, he just sent more characters than what was expected.

Re: Stopping phishing campaigns with Bash

#93

Post by daniel-s » Thu, Aug 13, 2020, 1:09 PM UTC

Is this a useful strategy that banks can or do employ? Filling a phisher's catch with spammed fake credentials may pollute their database enough that it's not worth selling.

Re: Stopping phishing campaigns with Bash

#94

Post by generaljargon » Thu, Aug 13, 2020, 1:12 PM UTC

Legal issues aside, these lists are typically checked with a validation tool that runs through them to scrub malformed or invalid entries. An example of one such tool, taken from a krebsonsecurity post: https://krebsonsecurity.com/wp-content/uploads/2019/08/chase....

Re: Stopping phishing campaigns with Bash

#95

Post by _8j50 » Thu, Aug 13, 2020, 1:14 PM UTC

It was probably a compromised site. Spinning up your own domain/vps has the drawback of it being a new site not trusted or classified by most corporate firewalls and proxies (if setup right).

You'd be surprised how easy it is to scan+pwn some wordpress site left in default config or vulnerable to the latest joomla exploit. They then upload a $20 phishing kit and start spamming. If you look at the directories' root in the path you sometimes get lucky enough to get the zip/tar file they forgot to remove (includes their email, to which stolen creds are sent, you probably spammed the crap out of their mailbox too). A few times I've even found unsecured webshells they left behind (just booted them out, got emails of people who fell for it and did the standard rfc-whatever notification)

One thing I wanted to try was to include tracker URLs when stuffing them with fake usernames like 'bob@bob.com https://bobscompany.com/login.php?trackerid=1345556' or make it a 1x1 pixel image link so when they see the fake creds I will know their IP

Re: Stopping phishing campaigns with Bash

#96

Post by mflower » Thu, Aug 13, 2020, 1:18 PM UTC

alufers wrote: post #3

Oh how cool, I thought I was the only one trying to mess with scammy sites when I find them. Although I can see that I could improve my methods, since I usually write a short user script which spams the forms with data from faker.js and let the open tab sit pinned in my browser for a week or so.

I was thinking about something pretty similar -- rather than just try to overload the server, make it more difficult for phisherpeople to figure out which data is legitimate.

Realistically, I don't think I'd do it though -- who knows what 0 days you are putting on your box when you connect to those sites.

Re: Stopping phishing campaigns with Bash

#97

Post by catmistake » Thu, Aug 13, 2020, 1:19 PM UTC

This is great, bash ftw. Nice presentation, too.

Regarding its legality, I will paraphrase Bishop Berkeley: if a tree falls in the forest, and no one is around to hear it, does it make a sound?

What I am getting at is until there is a complaint, there is no crime, and as at least another pointed out, criminals will usually not report crimes that reveal their own crimes. "They kidnapped my kidnap-victim!"

Re: Stopping phishing campaigns with Bash

#98

Post by josefx » Thu, Aug 13, 2020, 1:20 PM UTC

dependenttypes wrote: post #76

dandare wrote: post #72

A friend of mine fell victim to a renting scam here in Czechia. The phishing site was using the native .cz TLD, which is well within the reach of Czech authorities. I was particularly bored that day so I went to a local police department to report a crime. I advised the policeman to take down the phishing site - it was actively facilitating a crime. The poor cops had no idea what to do and in the end they told me tha…

This kind of thing always confused me. Scam sites and sites promoting illegal activities (such as fake dna tests) are everywhere. Surely the police could take them down in the same way that they take down child porn sites.

If you asked EU politicians a few years ago there was no way to take those down and we needed a great European firewall asap. Of course when their to secret list of illegal sites got leaked it turned out to be sites that could be taken down within a few hours by just contacting the hosting providers.

Re: Stopping phishing campaigns with Bash

#99

Post by freeone3000 » Thu, Aug 13, 2020, 1:37 PM UTC

flareback wrote: post #92

noodlesUK wrote: post #19

Earlier quoted context omitted.

IANAL: This is what I expect the relevant text in the CFAA is... knowingly causes the transmission of a program, information, code, or command, and as a result of such conduct, intentionally causes damage without authorization, to a protected computer;

Is it damage if you're just sending data to an endpoint to see what happens. Sounds like he didn't try to send a SQL Injection, he just sent more characters than what was expected.

Yes. It's even damage if you're sending expected requests, but the owner of the server didn't want you to. See: Aaron Schwartz.

Re: Stopping phishing campaigns with Bash

#100

Post by anonymfus » Thu, Aug 13, 2020, 1:38 PM UTC

catmistake wrote: post #97

This is great, bash ftw. Nice presentation, too. Regarding its legality, I will paraphrase Bishop Berkeley: if a tree falls in the forest, and no one is around to hear it, does it make a sound? What I am getting at is until there is a complaint, there is no crime, and as at least another pointed out, criminals will usually not report crimes that reveal their own crimes. "They kidnapped my kidnap-victim!"

The kidnap-victim or their relatives can. So:

>Sadly the server didn't enable indexing otherwise I would have seen all victims, but it was funny nonetheless.

It's actually very lucky for Haschek, because otherwise the only thing stopping Raiffeisen from suing him for stealing credentials would be a bad publicity.