4 ms·

Someone used my IPFS gateway for phishing

170 points by jstanley 8y ago

cwkoss 8y ago
How does GMA.html send the creds back to their server? Interesting question of who has culpability: - Server receiving creds seems clearly in wrong - OneDrive hosting the html file which can be used to exfiltrate creds is a bit murkier - Hosting a link to the onedrive url on IPFS is murkier still.
- jstanley 8y ago
  Note that the link to the OneDrive URL does not come from IPFS. It comes from the URL fragment, which makes it even more murky as to whether the IPFS hash should even be blocked! Perfectly legitimate sites could be using exactly the same content with no knowledge of the phishing attack. It is just copy and pasted from https://itty.bitty.site/ https://itty.bitty.site/ I didn't look into how GMA.html works, but a quick look just now shows that it posts to https://searchurl.bid/joyceesther0101/finish1.php https://searchurl.bid/joyceesther0101/finish1.php
  - cwkoss 8y ago
    Ah, I didn't catch that the Base64 string was part of the query param, not stored in IFPS. Yeah, seems like IFPS data isn't offending whatsoever in this case. Interesting that it is 'facilitating' phishing (as in dependency in attack chain), but only to the extent that would apply to a number of general-purpose open source libraries, or the browser, or any OS or ISP. Seems like DigitalOcean made the wrong choice, but the technical complexity of the situation is enough to not put too much blame on them. Unresponsive support is disappointing.
    - jstanley 8y ago
      I agree that it's too complex to expect front-line abuse support to work out what's going on, but yes I did expect them to turn my networking back on after I blacklisted the hash.
      - miyuru 8y ago
        Digitalocean disabled network access to one of my droplets too. They won't respond to your emails, but poke them on twitter and hopefully you will get a response back. mine to 10 days to get a reply. I switched to scaleway afterwards.
  - cwkoss 8y ago
    Looks like they are using 'Vesta', here's their control panel https://searchurl.bid:8083/login/ https://searchurl.bid:8083/login/ https://forum.vestacp.com/viewtopic.php?p=68594#p68594 https://forum.vestacp.com/viewtopic.php?p=68594#p68594 https://www.digitalocean.com/community/questions/how-do-i-determine-the-impact-of-vestacp-vulnerability-from-april-8th-2018 https://www.digitalocean.com/community/questions/how-do-i-de... Appears there was a vulnerability in this panel, seems plausible that 'owner' of this page is an additional victim of the attacker.
    - danielhlockard 8y ago
      Wow, there's a lot of open ports on that box.
ChuckMcM 8y ago
Hmm, doesn't bode well of IPFS. To the extent that bad actors can "easily" disable swaths of infrastructure in a difficult to parse/manage way.
- LeoPanthera 8y ago
  Web-IPFS gateways are not part of the IPFS infrastructure, nor are they essential.
  - setr 8y ago
    They are, however, essential for the transition to it; at least as long as they continue the goal of becoming the new web.
    - imhoguy 8y ago
      Without major players joining - browser vendors, it will be like IPv6 transition.
      - ndnxhs 8y ago
        Firefox has partly added support recently. They recognise ipfs:// as a valid protocol and allow extensions to implement it.
        detaro 8y ago
        Extensions can't implement the raw IPFS protocol though, they need a companion application running the actual gateway, or can maybe use the WebRTC transport.
        lgierth 8y ago
        No, js-ipfs can run a full ipfs node right in a web page. It'll peer with other nodes over websockets, and do relaying if neccessary.
imhoguy 8y ago
Sorry to hear, but you are not alone [0]. It was matter of time for a new tech to be exploited like that. Providing IPFS gateway is like opening up public HTTP proxy (popular back in 90s). You had good intentions, but there will be lot of nasty things going thru your machine. Of course guys like Cloudflare can absorb arising liability but I think they will shutdown their gateway at some point. I think the best way to popularize IPFS will be out-of-the box support in major browsers. I think Mozilla may be the first one here. [0] https://www.bleepingcomputer.com/news/security/phishing-attacks-distributed-through-cloudflares-ipfs-gateway/ https://www.bleepingcomputer.com/news/security/phishing-atta...
- akerro 8y ago
  Mozilla talks a lot and don't do much in this direction, they promised Tor integration like 4-5 years ago and all they did is setup 3 middle-nodes. Brave Browser already has Tor integration in private tabs and working IPFS integration on -dev channel since beginning of this year https://github.com/brave/brave-browser/issues/819 https://github.com/brave/brave-browser/issues/819
  - diggan 8y ago
    I don't know how they worked on the Tor integration, but I do know they are actively working towards helping dweb implementations in the browser. https://github.com/mozilla/libdweb https://github.com/mozilla/libdweb is one of the efforts, and it provides experimental APIs needed in Firefox to have a nice experience. So AFAIK, Mozilla not only talks about dweb, but also helps with the effort.
  - jerheinze 8y ago
    > they promised Tor integration like 4-5 years ago and all they did is setup 3 middle-nodes. They never promised any Tor integration for the near future, see: https://news.ycombinator.com/item?id=17205441 https://news.ycombinator.com/item?id=17205441 and the first comment. Brave can do Tor integration because its user bases is much smaller than Mozilla's (scaling the Tor network to support the load from all FF users still requires much work).
- 8y ago
mynameisvlad 8y ago
> (although their hosting provider doesn't appear to have switched their networking off). I doubt that Microsoft Azure is going to switch off the networking for all of Microsoft OneDrive over this.
- 0xffff2 8y ago
  Yes, that is indeed the joke.
- notriddle 8y ago
  I wouldn't guarantee that. Depends on whether it's automated or manual.
- rhplus 8y ago
  That's not a OneDrive URL ("https://onedrivepreinhabitat.**blob.core.windows.net**" https://onedrivepreinhabitat.**blob.core.windows.net**") - it's Azure Blob Storage (equiv to Amazon S3). Microsoft could absolutely disable that account.
  - deleted 8y ago
    [deleted]
iknowstuff 8y ago
>Around the same time that this email was forwarded to me, DigitalOcean disabled the network interface on my VPS in order to stop the phishing attack from working. Fair enough, can't really expect them to do any more than that. I disagree. I don't think this is okay. Aside from this IPFS story, DigitalOcean in general does not care about abuse. Unlike providers such as OVH, DigitalOcean will simply nullroute you when you fall victim to a DDoS attack. I wish they stepped up their game - until then, after hearing those stories, I will not be using their service for anything I care about.
- rmdoss 8y ago
  Yep, both DO and Linode do the same thing. Just null route your IP and take forever to remove it once you fixed whatever problem it was (even if it was a false alarm).
Scaevolus 8y ago
Proxies are XSS-as-a-service, so you should expect abuse complaints. At least the US provides some protections as a carrier.
paranoidrobot 8y ago
"And if you know a hosting provider that is less likely to switch your networking off, I'm all ears." No reputable hosting provider is going to ignore abuse complaints. The best you can hope for is a 24-72 hour window to respond to any complaint.
sitepodmatt 8y ago
It's very shitty of DigitalOcean to not at least give you a small window of opportunity to investigate and remove offending content, especially if first complaint. Given that their investigation would of been limited too (unlike yours) it makes it somewhat easy to knock off someone on DigitalOcean with a flimsy complaint.
- deleted 8y ago
  [deleted]
- askmike 8y ago
  > especially if first complaint Well: > It was sent by PhishLabs to DigitalOcean, and DigitalOcean forwarded it to me. I don't think this is the first complaint from PhishLabs to DigitalOcean. I do think DO would have "investigated" up to the level where they'd click the link and see "yep, that's a google sign in form". It's not up to DO to dispute claims made by people who send them abuse e-mails. As for the dispute itself, we all seem to think the IPFS was not hosting the content. But I'm not sure if that holds up in a legal case (the PirateBay is also not hosting any illegal content).
  - jstanley 8y ago
    IPFS isn't even linking to illegal content. IPFS has no knowledge of the illegal content whatsoever, it all comes from the URL fragment and Microsoft Azure.
    - sitepodmatt 8y ago
      By the same merit, any site (big, small, government or otherwise) with an XSS like el.outerHTML = window.location.search or el.outerHTML = window.location.query is vunerable to be shutdown if hosted on DO. Makes one think..
- zaarn 8y ago
  If you don't want to be nullrouted at the first abuse or DMCA complaint, I recommend more professional hosters like Hetzner or OVH. They will forward abuse mail to you first and only react themselves if you ignore the mails entirely and repeatedly do nothing about it.
AdequateLobster 8y ago
What’s going to be the next article here? “Someone set up a Tor exit node and it got used for illegal stuff”?
gassed 8y ago
Leaving an IPFS gateway open seems as intelligent as running a Tor exit node.
- mindslight 8y ago
  Indeed it is - stage 6. Individually acting for the good of others and the future, rather than short term self interest. https://en.wikipedia.org/wiki/Lawrence_Kohlberg%27s_stages_of_moral_development https://en.wikipedia.org/wiki/Lawrence_Kohlberg%27s_stages_o...
sigi45 8y ago
We all should take actions against evil participants. Blocking that URL is part of it.

170 points by jstanley 8y ago

How does GMA.html send the creds back to their server? Interesting question of who has culpability: - Server receiving creds seems clearly in wrong - OneDrive hosting the html file which can be used to exfiltrate creds is a bit murkier - Hosting a link to the onedrive url on IPFS is murkier still.

jstanley 8y ago
Note that the link to the OneDrive URL does not come from IPFS. It comes from the URL fragment, which makes it even more murky as to whether the IPFS hash should even be blocked! Perfectly legitimate sites could be using exactly the same content with no knowledge of the phishing attack. It is just copy and pasted from https://itty.bitty.site/ https://itty.bitty.site/ I didn't look into how GMA.html works, but a quick look just now shows that it posts to https://searchurl.bid/joyceesther0101/finish1.php https://searchurl.bid/joyceesther0101/finish1.php
- cwkoss 8y ago
  Ah, I didn't catch that the Base64 string was part of the query param, not stored in IFPS. Yeah, seems like IFPS data isn't offending whatsoever in this case. Interesting that it is 'facilitating' phishing (as in dependency in attack chain), but only to the extent that would apply to a number of general-purpose open source libraries, or the browser, or any OS or ISP. Seems like DigitalOcean made the wrong choice, but the technical complexity of the situation is enough to not put too much blame on them. Unresponsive support is disappointing.
  - jstanley 8y ago
    I agree that it's too complex to expect front-line abuse support to work out what's going on, but yes I did expect them to turn my networking back on after I blacklisted the hash.
    - miyuru 8y ago
      Digitalocean disabled network access to one of my droplets too. They won't respond to your emails, but poke them on twitter and hopefully you will get a response back. mine to 10 days to get a reply. I switched to scaleway afterwards.
- cwkoss 8y ago
  Looks like they are using 'Vesta', here's their control panel https://searchurl.bid:8083/login/ https://searchurl.bid:8083/login/ https://forum.vestacp.com/viewtopic.php?p=68594#p68594 https://forum.vestacp.com/viewtopic.php?p=68594#p68594 https://www.digitalocean.com/community/questions/how-do-i-determine-the-impact-of-vestacp-vulnerability-from-april-8th-2018 https://www.digitalocean.com/community/questions/how-do-i-de... Appears there was a vulnerability in this panel, seems plausible that 'owner' of this page is an additional victim of the attacker.
  - danielhlockard 8y ago
    Wow, there's a lot of open ports on that box.

ChuckMcM 8y ago

Hmm, doesn't bode well of IPFS. To the extent that bad actors can "easily" disable swaths of infrastructure in a difficult to parse/manage way.

LeoPanthera 8y ago
Web-IPFS gateways are not part of the IPFS infrastructure, nor are they essential.
- setr 8y ago
  They are, however, essential for the transition to it; at least as long as they continue the goal of becoming the new web.
  - imhoguy 8y ago
    Without major players joining - browser vendors, it will be like IPv6 transition.
    - ndnxhs 8y ago
      Firefox has partly added support recently. They recognise ipfs:// as a valid protocol and allow extensions to implement it.
      - detaro 8y ago
        Extensions can't implement the raw IPFS protocol though, they need a companion application running the actual gateway, or can maybe use the WebRTC transport.
        lgierth 8y ago
        No, js-ipfs can run a full ipfs node right in a web page. It'll peer with other nodes over websockets, and do relaying if neccessary.

imhoguy 8y ago

Sorry to hear, but you are not alone [0]. It was matter of time for a new tech to be exploited like that. Providing IPFS gateway is like opening up public HTTP proxy (popular back in 90s). You had good intentions, but there will be lot of nasty things going thru your machine. Of course guys like Cloudflare can absorb arising liability but I think they will shutdown their gateway at some point. I think the best way to popularize IPFS will be out-of-the box support in major browsers. I think Mozilla may be the first one here. [0] https://www.bleepingcomputer.com/news/security/phishing-attacks-distributed-through-cloudflares-ipfs-gateway/ https://www.bleepingcomputer.com/news/security/phishing-atta...

akerro 8y ago
Mozilla talks a lot and don't do much in this direction, they promised Tor integration like 4-5 years ago and all they did is setup 3 middle-nodes. Brave Browser already has Tor integration in private tabs and working IPFS integration on -dev channel since beginning of this year https://github.com/brave/brave-browser/issues/819 https://github.com/brave/brave-browser/issues/819
- diggan 8y ago
  I don't know how they worked on the Tor integration, but I do know they are actively working towards helping dweb implementations in the browser. https://github.com/mozilla/libdweb https://github.com/mozilla/libdweb is one of the efforts, and it provides experimental APIs needed in Firefox to have a nice experience. So AFAIK, Mozilla not only talks about dweb, but also helps with the effort.
- jerheinze 8y ago
  > they promised Tor integration like 4-5 years ago and all they did is setup 3 middle-nodes. They never promised any Tor integration for the near future, see: https://news.ycombinator.com/item?id=17205441 https://news.ycombinator.com/item?id=17205441 and the first comment. Brave can do Tor integration because its user bases is much smaller than Mozilla's (scaling the Tor network to support the load from all FF users still requires much work).
8y ago

mynameisvlad 8y ago

> (although their hosting provider doesn't appear to have switched their networking off). I doubt that Microsoft Azure is going to switch off the networking for all of Microsoft OneDrive over this.

0xffff2 8y ago
Yes, that is indeed the joke.
notriddle 8y ago
I wouldn't guarantee that. Depends on whether it's automated or manual.
rhplus 8y ago
That's not a OneDrive URL ("https://onedrivepreinhabitat.**blob.core.windows.net**" https://onedrivepreinhabitat.**blob.core.windows.net**") - it's Azure Blob Storage (equiv to Amazon S3). Microsoft could absolutely disable that account.
- deleted 8y ago
  [deleted]

iknowstuff 8y ago

>Around the same time that this email was forwarded to me, DigitalOcean disabled the network interface on my VPS in order to stop the phishing attack from working. Fair enough, can't really expect them to do any more than that. I disagree. I don't think this is okay. Aside from this IPFS story, DigitalOcean in general does not care about abuse. Unlike providers such as OVH, DigitalOcean will simply nullroute you when you fall victim to a DDoS attack. I wish they stepped up their game - until then, after hearing those stories, I will not be using their service for anything I care about.

rmdoss 8y ago
Yep, both DO and Linode do the same thing. Just null route your IP and take forever to remove it once you fixed whatever problem it was (even if it was a false alarm).

Scaevolus 8y ago

Proxies are XSS-as-a-service, so you should expect abuse complaints. At least the US provides some protections as a carrier.

paranoidrobot 8y ago

"And if you know a hosting provider that is less likely to switch your networking off, I'm all ears." No reputable hosting provider is going to ignore abuse complaints. The best you can hope for is a 24-72 hour window to respond to any complaint.

sitepodmatt 8y ago

It's very shitty of DigitalOcean to not at least give you a small window of opportunity to investigate and remove offending content, especially if first complaint. Given that their investigation would of been limited too (unlike yours) it makes it somewhat easy to knock off someone on DigitalOcean with a flimsy complaint.

deleted 8y ago
[deleted]
askmike 8y ago
> especially if first complaint Well: > It was sent by PhishLabs to DigitalOcean, and DigitalOcean forwarded it to me. I don't think this is the first complaint from PhishLabs to DigitalOcean. I do think DO would have "investigated" up to the level where they'd click the link and see "yep, that's a google sign in form". It's not up to DO to dispute claims made by people who send them abuse e-mails. As for the dispute itself, we all seem to think the IPFS was not hosting the content. But I'm not sure if that holds up in a legal case (the PirateBay is also not hosting any illegal content).
- jstanley 8y ago
  IPFS isn't even linking to illegal content. IPFS has no knowledge of the illegal content whatsoever, it all comes from the URL fragment and Microsoft Azure.
  - sitepodmatt 8y ago
    By the same merit, any site (big, small, government or otherwise) with an XSS like el.outerHTML = window.location.search or el.outerHTML = window.location.query is vunerable to be shutdown if hosted on DO. Makes one think..
zaarn 8y ago
If you don't want to be nullrouted at the first abuse or DMCA complaint, I recommend more professional hosters like Hetzner or OVH. They will forward abuse mail to you first and only react themselves if you ignore the mails entirely and repeatedly do nothing about it.

AdequateLobster 8y ago

What’s going to be the next article here? “Someone set up a Tor exit node and it got used for illegal stuff”?

gassed 8y ago

Leaving an IPFS gateway open seems as intelligent as running a Tor exit node.

mindslight 8y ago
Indeed it is - stage 6. Individually acting for the good of others and the future, rather than short term self interest. https://en.wikipedia.org/wiki/Lawrence_Kohlberg%27s_stages_of_moral_development https://en.wikipedia.org/wiki/Lawrence_Kohlberg%27s_stages_o...

sigi45 8y ago

We all should take actions against evil participants. Blocking that URL is part of it.