6 ms·

Why Some Phishing Emails Are Mysteriously Disappearing

58 points by thedg 9y ago

ISL 9y ago
Is this equivalent to hell-banning censorship by an infrastructure layer? I understand the positive intent, but it feels wrong to have email content altered by infrastructure layers. A slippery-slope argument may apply.
- death_syn 9y ago
  But it isn't altering the mail content at all, it's altering the DNS records outside of it.
- durkie 9y ago
  it also seems like it could be easily technically circumvented: put an email address to which you have access on your phishing lists. see if it gets the mail as expected.
  - tomschlick 9y ago
    Solution: stop using CF services for phishing which is exactly what CF wants them to do
cypherpunks01 9y ago
I don't understand why it's better to surreptitiously alter records for ToS violators rather than simply close their accounts altogether. Seems like the definition of a slippery slope.
- deftnerd 9y ago
  I agree. If they're going to be doing this, why not also use the Cloudflare apps framework to insert a warning overlay on the page content saying that the domain has been reported for phishing. If that's too slippery slope, then so is the email _DMARC override settings. And doesn't this kind of behavior open them up to a lot of legal risk? By moderating _DMARC records, they're assuming responsibility for email content going into the future. If inappropriate content is then passed via email, and Cloudflare failed to blackhole it with _DMARC recordsy, then the can't they become liable for that content?
- mox1 9y ago
  Because evidence has shown when you waste the time of people doing this, they move on. If you instantly ban them, its easy to spot, easy to automate and doesn't really solve the problem. https://en.wikipedia.org/wiki/Stealth_banning https://en.wikipedia.org/wiki/Stealth_banning
  - Chaebixi 9y ago
    > Because evidence has shown when you waste the time of people doing this, they move on. I'm not convinced of this. At best, shadow-banning wastes a little bit of their time and delays slightly their inevitable creation of a new account. > If you instantly ban them, its easy to spot, easy to automate and doesn't really solve the problem. Shadowbanning only really works for unsophisticated users. If you know it's a possibility, it's easy to check for (just create another account and check with it). Phisher's are probably going to be fairly sophisticated, since they're working to make a profit, not to only disrupt or push a POV.
    - mox1 9y ago
      Correct this will not stop "sophisticated" users. The whole goal of this system is to cause bad actors to dedicate more resources to using your platform and add a shadow of doubt. Spammers, etc. all want a cheap easy payday, that's the entire point (money for minimal time). I run a service that spammers and pfishers love. I started by banning these people (and sending them an e-mail letting them know why). They didn't stop, they just grabbed another free e-mail and continued. Now I quietly just delete the data they submit and never ban accounts. I let them submit data, tell them its accepted, then some time later (1-120 seconds) just delete the data. Their account still works, they just can't do much with it. Once the system became unreliable for them, they just moved on to something else.
      - Chaebixi 9y ago
        > Spammers, etc. all want a cheap easy payday, that's the entire point (money for minimal time). I'm under the impression that spamming isn't as easy as it once was, and a fair amount of effort needs to be devoted to bypassing spam/abuse detection and blocks, which is exactly what a shadowban is. > Once the system became unreliable for them, they just moved on to something else. I would imagine that would depend on if there are equivalent services that the spammer could more easily migrate to. It sounds like they didn't move on from spamming, just from your service. Switching to drop in replacement would definitely be easier than writing a shadowban detector. I'm just disputing that shadowbanning is a more effective solution than straight bans. It's just not that much harder to detect.
- an_account 9y ago
  These are free accounts so if you flat ban it’s easy for them to pop up again and slightly alter their technique to avoid detection.
- jacquesm 9y ago
  Seeing this comment on HN has to be some record level of irony.
saurik 9y ago
This is even worse than "we don't like you so we are no longer selling you our service", which is already problematic :/. Deciding "we know what you are doing with our service, so we are going to keep selling you our service but make it do something different" should probably just be illegal. As it stands, if they really want to do this, I hope they realize it makes them de facto responsible for all email that goes through their service (and if they don't, then they are even bigger idiots than I normally paint them to be, as they literally are involved in a similar case in court right now). This is equivalent to "I know you are going to use our invitation service to invite people to a meeting of your local gang, so we have made the emails go out with a typo in the location and phone number field", which has the same sort of "wait, are you sure it is a gang? how do you define a gang? is the gang even doing something harmful today?" problem that comes with the term "phishing". While this is much better than them claiming to block "spam" (which I will claim has so nebulous of a definition as to be meaningless), this is still a slightly ambiguous classification of any given communication due to how it interacts with trademark law. Regardless, now that they have shown that they are interested in modifying the behavior of their platform to stop "using the Cloudflare platform for evil" (a direct quote from their blog post), clearly they now also should be using similar techniques to stop people from sending email about drug paraphernalia, and they should stop people from sending email with hate speech, and they should stop sending email about terrorism. They also should, of course, stop people from sending email about software piracy, or sending email about services designed to undermine copyright like SciHub, or sending email advertising "obscene" pornography. They have now shown both the ability to do this and an interest in doing this, which is exactly what they recently demonstrated with the Daily Stormer SNAFU, where they showed the ability and interest to block use of their service "for evil"; in that case, the people were "Nazis", which may or may not be more clear cut than "phishers", but the scenario is essentially the same... and they are now having to backpedal their actions in court as this is being used as evidence for why they should be responsible for blocking piracy on their platform. The reality is that once you show an ability and an interest in policing content, what kinds of content you are forced to police will be taken from you and given to the state. https://torrentfreak.com/daily-stormer-termination-haunts-cloudflare-in-online-piracy-case-170929/ https://torrentfreak.com/daily-stormer-termination-haunts-cl... Cloudflare's decision today is going to be devastating not only for them, but for the Internet as a whole (as usual :/).
badrabbit 9y ago
If a mail client does not support dmarc,or happens to move reject policy emails to junk (as opposed to not delivering at all). And the user loses all their money to a phishing campaign,would cloudflare be held responsible? I get the intent but in these situations,no solution is better than a half-cooked solution. If I happened to be a victim in my hypothetical scenario above,sure I would get pissed at my (web)mail client,but also at cloudflare for not terminating the phisher's service when they were so sure of the malicious content hosted they went as far as sabotaging dmarc records. From a more practical point of view,most phishing campaings like to use compromised websites or email accounts to send the email. Now the email itself will typically have a link to some nasty site or an attachment that eventually ends up "dropping" a second stage malware from some other nasty site. So, if these nasty sites sit behind Cloudflare,how does it make sense to not hold Cloudlfare responsible? Historically,their defense was "we are just the network transport provider". But what now? They can sabotage dmarc records but not A records? Their legal team must either be sleeping on the job or so good that an obvious liability like this isn't seen as a business risk.
- matt4077 9y ago
  > If a mail client does not support dmarc,or happens to move reject policy emails to junk (as opposed to not delivering at all). And the user loses all their money to a phishing campaign,would cloudflare be held responsible? No. This argument is based on a long-outdated understanding of the law. Section 230 of the Communications Decency Act extends immunity even to services exercising editorial control over content. See Zeran v. AOL: [L]awsuits seeking to hold a service liable for its exercise of a publisher's traditional editorial functions – such as deciding whether to publish, withdraw, postpone or alter content – are barred. The purpose of this statutory immunity is not difficult to discern. Congress recognized the threat that tort-based lawsuits pose to freedom of speech in the new and burgeoning Internet medium. [...] Section 230 was enacted, in part, to maintain the robust nature of Internet communication [...] ." "Congress' clear objective in passing §230 of the CDA was to encourage the development of technologies, procedures and techniques by which objectionable material could be blocked or deleted."[5] Since distributor liability would have the effect of disincentivizing the filtering of content by third parties, the court found that such laws were in conflict with the "purpose and objectives of congress," and were thus preempted

58 points by thedg 9y ago

ISL 9y ago

Is this equivalent to hell-banning censorship by an infrastructure layer? I understand the positive intent, but it feels wrong to have email content altered by infrastructure layers. A slippery-slope argument may apply.

death_syn 9y ago
But it isn't altering the mail content at all, it's altering the DNS records outside of it.
durkie 9y ago
it also seems like it could be easily technically circumvented: put an email address to which you have access on your phishing lists. see if it gets the mail as expected.
- tomschlick 9y ago
  Solution: stop using CF services for phishing which is exactly what CF wants them to do

cypherpunks01 9y ago

I don't understand why it's better to surreptitiously alter records for ToS violators rather than simply close their accounts altogether. Seems like the definition of a slippery slope.

deftnerd 9y ago
I agree. If they're going to be doing this, why not also use the Cloudflare apps framework to insert a warning overlay on the page content saying that the domain has been reported for phishing. If that's too slippery slope, then so is the email _DMARC override settings. And doesn't this kind of behavior open them up to a lot of legal risk? By moderating _DMARC records, they're assuming responsibility for email content going into the future. If inappropriate content is then passed via email, and Cloudflare failed to blackhole it with _DMARC recordsy, then the can't they become liable for that content?
mox1 9y ago
Because evidence has shown when you waste the time of people doing this, they move on. If you instantly ban them, its easy to spot, easy to automate and doesn't really solve the problem. https://en.wikipedia.org/wiki/Stealth_banning https://en.wikipedia.org/wiki/Stealth_banning
- Chaebixi 9y ago
  > Because evidence has shown when you waste the time of people doing this, they move on. I'm not convinced of this. At best, shadow-banning wastes a little bit of their time and delays slightly their inevitable creation of a new account. > If you instantly ban them, its easy to spot, easy to automate and doesn't really solve the problem. Shadowbanning only really works for unsophisticated users. If you know it's a possibility, it's easy to check for (just create another account and check with it). Phisher's are probably going to be fairly sophisticated, since they're working to make a profit, not to only disrupt or push a POV.
  - mox1 9y ago
    Correct this will not stop "sophisticated" users. The whole goal of this system is to cause bad actors to dedicate more resources to using your platform and add a shadow of doubt. Spammers, etc. all want a cheap easy payday, that's the entire point (money for minimal time). I run a service that spammers and pfishers love. I started by banning these people (and sending them an e-mail letting them know why). They didn't stop, they just grabbed another free e-mail and continued. Now I quietly just delete the data they submit and never ban accounts. I let them submit data, tell them its accepted, then some time later (1-120 seconds) just delete the data. Their account still works, they just can't do much with it. Once the system became unreliable for them, they just moved on to something else.
    - Chaebixi 9y ago
      > Spammers, etc. all want a cheap easy payday, that's the entire point (money for minimal time). I'm under the impression that spamming isn't as easy as it once was, and a fair amount of effort needs to be devoted to bypassing spam/abuse detection and blocks, which is exactly what a shadowban is. > Once the system became unreliable for them, they just moved on to something else. I would imagine that would depend on if there are equivalent services that the spammer could more easily migrate to. It sounds like they didn't move on from spamming, just from your service. Switching to drop in replacement would definitely be easier than writing a shadowban detector. I'm just disputing that shadowbanning is a more effective solution than straight bans. It's just not that much harder to detect.
an_account 9y ago
These are free accounts so if you flat ban it’s easy for them to pop up again and slightly alter their technique to avoid detection.
jacquesm 9y ago
Seeing this comment on HN has to be some record level of irony.

saurik 9y ago

This is even worse than "we don't like you so we are no longer selling you our service", which is already problematic :/. Deciding "we know what you are doing with our service, so we are going to keep selling you our service but make it do something different" should probably just be illegal. As it stands, if they really want to do this, I hope they realize it makes them de facto responsible for all email that goes through their service (and if they don't, then they are even bigger idiots than I normally paint them to be, as they literally are involved in a similar case in court right now). This is equivalent to "I know you are going to use our invitation service to invite people to a meeting of your local gang, so we have made the emails go out with a typo in the location and phone number field", which has the same sort of "wait, are you sure it is a gang? how do you define a gang? is the gang even doing something harmful today?" problem that comes with the term "phishing". While this is much better than them claiming to block "spam" (which I will claim has so nebulous of a definition as to be meaningless), this is still a slightly ambiguous classification of any given communication due to how it interacts with trademark law. Regardless, now that they have shown that they are interested in modifying the behavior of their platform to stop "using the Cloudflare platform for evil" (a direct quote from their blog post), clearly they now also should be using similar techniques to stop people from sending email about drug paraphernalia, and they should stop people from sending email with hate speech, and they should stop sending email about terrorism. They also should, of course, stop people from sending email about software piracy, or sending email about services designed to undermine copyright like SciHub, or sending email advertising "obscene" pornography. They have now shown both the ability to do this and an interest in doing this, which is exactly what they recently demonstrated with the Daily Stormer SNAFU, where they showed the ability and interest to block use of their service "for evil"; in that case, the people were "Nazis", which may or may not be more clear cut than "phishers", but the scenario is essentially the same... and they are now having to backpedal their actions in court as this is being used as evidence for why they should be responsible for blocking piracy on their platform. The reality is that once you show an ability and an interest in policing content, what kinds of content you are forced to police will be taken from you and given to the state. https://torrentfreak.com/daily-stormer-termination-haunts-cloudflare-in-online-piracy-case-170929/ https://torrentfreak.com/daily-stormer-termination-haunts-cl... Cloudflare's decision today is going to be devastating not only for them, but for the Internet as a whole (as usual :/).

badrabbit 9y ago

If a mail client does not support dmarc,or happens to move reject policy emails to junk (as opposed to not delivering at all). And the user loses all their money to a phishing campaign,would cloudflare be held responsible? I get the intent but in these situations,no solution is better than a half-cooked solution. If I happened to be a victim in my hypothetical scenario above,sure I would get pissed at my (web)mail client,but also at cloudflare for not terminating the phisher's service when they were so sure of the malicious content hosted they went as far as sabotaging dmarc records. From a more practical point of view,most phishing campaings like to use compromised websites or email accounts to send the email. Now the email itself will typically have a link to some nasty site or an attachment that eventually ends up "dropping" a second stage malware from some other nasty site. So, if these nasty sites sit behind Cloudflare,how does it make sense to not hold Cloudlfare responsible? Historically,their defense was "we are just the network transport provider". But what now? They can sabotage dmarc records but not A records? Their legal team must either be sleeping on the job or so good that an obvious liability like this isn't seen as a business risk.

matt4077 9y ago
> If a mail client does not support dmarc,or happens to move reject policy emails to junk (as opposed to not delivering at all). And the user loses all their money to a phishing campaign,would cloudflare be held responsible? No. This argument is based on a long-outdated understanding of the law. Section 230 of the Communications Decency Act extends immunity even to services exercising editorial control over content. See Zeran v. AOL: [L]awsuits seeking to hold a service liable for its exercise of a publisher's traditional editorial functions – such as deciding whether to publish, withdraw, postpone or alter content – are barred. The purpose of this statutory immunity is not difficult to discern. Congress recognized the threat that tort-based lawsuits pose to freedom of speech in the new and burgeoning Internet medium. [...] Section 230 was enacted, in part, to maintain the robust nature of Internet communication [...] ." "Congress' clear objective in passing §230 of the CDA was to encourage the development of technologies, procedures and techniques by which objectionable material could be blocked or deleted."[5] Since distributor liability would have the effect of disincentivizing the filtering of content by third parties, the court found that such laws were in conflict with the "purpose and objectives of congress," and were thus preempted