3 ms·

How does GMA.html send the creds back to their server? Interesting question of who has culpability: - Server receiving creds seems clearly in wrong - OneDriv

by cwkoss 8y ago

How does GMA.html send the creds back to their server? Interesting question of who has culpability: - Server receiving creds seems clearly in wrong - OneDrive hosting the html file which can be used to exfiltrate creds is a bit murkier - Hosting a link to the onedrive url on IPFS is murkier still.

jstanley 8y ago
Note that the link to the OneDrive URL does not come from IPFS. It comes from the URL fragment, which makes it even more murky as to whether the IPFS hash should even be blocked! Perfectly legitimate sites could be using exactly the same content with no knowledge of the phishing attack. It is just copy and pasted from https://itty.bitty.site/ https://itty.bitty.site/ I didn't look into how GMA.html works, but a quick look just now shows that it posts to https://searchurl.bid/joyceesther0101/finish1.php https://searchurl.bid/joyceesther0101/finish1.php
- cwkoss 8y ago
  Ah, I didn't catch that the Base64 string was part of the query param, not stored in IFPS. Yeah, seems like IFPS data isn't offending whatsoever in this case. Interesting that it is 'facilitating' phishing (as in dependency in attack chain), but only to the extent that would apply to a number of general-purpose open source libraries, or the browser, or any OS or ISP. Seems like DigitalOcean made the wrong choice, but the technical complexity of the situation is enough to not put too much blame on them. Unresponsive support is disappointing.
  - jstanley 8y ago
    I agree that it's too complex to expect front-line abuse support to work out what's going on, but yes I did expect them to turn my networking back on after I blacklisted the hash.
    - miyuru 8y ago
      Digitalocean disabled network access to one of my droplets too. They won't respond to your emails, but poke them on twitter and hopefully you will get a response back. mine to 10 days to get a reply. I switched to scaleway afterwards.
- cwkoss 8y ago
  Looks like they are using 'Vesta', here's their control panel https://searchurl.bid:8083/login/ https://searchurl.bid:8083/login/ https://forum.vestacp.com/viewtopic.php?p=68594#p68594 https://forum.vestacp.com/viewtopic.php?p=68594#p68594 https://www.digitalocean.com/community/questions/how-do-i-determine-the-impact-of-vestacp-vulnerability-from-april-8th-2018 https://www.digitalocean.com/community/questions/how-do-i-de... Appears there was a vulnerability in this panel, seems plausible that 'owner' of this page is an additional victim of the attacker.
  - danielhlockard 8y ago
    Wow, there's a lot of open ports on that box.

by cwkoss 8y ago

jstanley 8y ago

Note that the link to the OneDrive URL does not come from IPFS. It comes from the URL fragment, which makes it even more murky as to whether the IPFS hash should even be blocked! Perfectly legitimate sites could be using exactly the same content with no knowledge of the phishing attack. It is just copy and pasted from https://itty.bitty.site/ https://itty.bitty.site/ I didn't look into how GMA.html works, but a quick look just now shows that it posts to https://searchurl.bid/joyceesther0101/finish1.php https://searchurl.bid/joyceesther0101/finish1.php

cwkoss 8y ago
Ah, I didn't catch that the Base64 string was part of the query param, not stored in IFPS. Yeah, seems like IFPS data isn't offending whatsoever in this case. Interesting that it is 'facilitating' phishing (as in dependency in attack chain), but only to the extent that would apply to a number of general-purpose open source libraries, or the browser, or any OS or ISP. Seems like DigitalOcean made the wrong choice, but the technical complexity of the situation is enough to not put too much blame on them. Unresponsive support is disappointing.
- jstanley 8y ago
  I agree that it's too complex to expect front-line abuse support to work out what's going on, but yes I did expect them to turn my networking back on after I blacklisted the hash.
  - miyuru 8y ago
    Digitalocean disabled network access to one of my droplets too. They won't respond to your emails, but poke them on twitter and hopefully you will get a response back. mine to 10 days to get a reply. I switched to scaleway afterwards.
cwkoss 8y ago
Looks like they are using 'Vesta', here's their control panel https://searchurl.bid:8083/login/ https://searchurl.bid:8083/login/ https://forum.vestacp.com/viewtopic.php?p=68594#p68594 https://forum.vestacp.com/viewtopic.php?p=68594#p68594 https://www.digitalocean.com/community/questions/how-do-i-determine-the-impact-of-vestacp-vulnerability-from-april-8th-2018 https://www.digitalocean.com/community/questions/how-do-i-de... Appears there was a vulnerability in this panel, seems plausible that 'owner' of this page is an additional victim of the attacker.
- danielhlockard 8y ago
  Wow, there's a lot of open ports on that box.