13 ms·

Stopping phishing campaigns with Bash

457 points by geek_at 6y ago

Wandfarbe 6y ago
I stoped 2 webshops which basically sell expensive stuff 20% off by wire transfer (bank transfer?!) which then never send the goods of course! I did the following: - I found out where it was hosted and send them an email explaining them why and how that shop is a scam - I found out where they hosted the domain and wrote the registrar an abuse email - I wrote an email to the banks where the bank accounts where active The scammer had a webchat module active and he/she did wrote back to me, nothing came out through that, nonetheless: next day, both webshops were gone due to being taken offline from the hosters. I do believe, that they do have a chance because literaly no one cares. I have seen mentioning of one of those two shops older then 6 month. I pissed at them with very little effort in a very short time. I do hope i helped out.
- Cthulhu_ 6y ago
  I like to think it helped out, but at the same time, these people are professionals and will have automation to generate new instances and scam campaigns easily. At least it should be more difficult for them to set up new bank accounts though, they need ID for that, and / or a network of mules, and those are finite resources.
  - pbhjpbhj 6y ago
    I think the bank thing is done through students quite often: "Hey, I can't get a bank account as I'm a refugee fleeing a war, please help by receiving £5000 cash, we'll give you £100. Say it's a gift from your Aunty to buy a car with." I've seen reports of this in the UK at least, maybe they managed to stop it.
    - Geezus_42 6y ago
      At least in the US the people who accept the offer can be charged as money mules.
      - pbhjpbhj 6y ago
        I think that's true in UK too, but often the people aren't aware how wrong what they're doing is.
- berkes 6y ago
  I attended a meetup at our local registrar (SIDN) where they explained how data analysts on their payroll detect such fake webshops and how they then actively block those domains on DNS and registrar level.
  - jagged-chisel 6y ago
    I'm assuming you don't mean "employee payroll" right?
    - berkes 6y ago
      English is not my native language. I meant "they work for SIDN at SIDN". Employees.
- madarcho 6y ago
  Abuse email/report to the registrar is also my goto. Usually results in a quick response
  - parliament32 6y ago
    You'll get a response but it'll always be a polite "fuck off" unless you have some sort of actual authority (are you the trademark holder? are you LE? do you have a court order?). You'll have better luck contacting the hosting provider because they're actually responsible for the content.
mrvenkman 6y ago
"The way these things work is that they act like they're the real login form, steal your credentials and usually send you off to the real bank so you think you made a typo or something." If that's the case then surely you're also flooding the bank's real site with GET requests after the redirection.
- __s 6y ago
  Bash doesn't have to follow the redirect Even if, I'm sure the bank appreciates someone working against phishing. A few GET requests is something they're meant to handle. They have to be resistant to DDoS attempts from malevolent actors
- Cthulhu_ 6y ago
  From cURL the author can ignore the redirect to the bank's real site though.
mrkramer 6y ago
So you DDOSed their backend but they could've whitelist their IP range and blacklist all the others for incoming requests. What you did does nothing against flexible and adaptive adversaries.
- deleted 6y ago
  [deleted]
- scalableUnicon 6y ago
  Even if that's the case, it made the website unavailable for future victims who got the same text messages.
  - parliament32 6y ago
    Not if they just made the site return a 404/500 just to his IPs, which any half-decent adversary would do. The "play dead" strategy works great with these kind of vigilantes. We're employed similar tactics against DDoSers at work. Start returning 500s or just tarpit their requests, they think the site is down and they go home.
- nostoc 6y ago
  People who buy phishing kit and set them up are typically not flexible and adaptive adversaries.
anticristi 6y ago
Nice! If you are required to write an email address, it would be cool to use a canary, and see if it shows up on haveibeenpwned.com.
- strogonoff 6y ago
  I don’t think HaveIBeenPwned makes an attempt to harvest data captured by fishing websites. It’s intended to track data leaked due to a breach of the actual system.
  - Eremotherium 6y ago
    Mostly true but there things like Collection #1 and Anti Public Combo List which are amalgamations of unknown provenance. A lot of it is probably prior breaches but I wouldn't be surprised if it contained phishing data.
alufers 6y ago
Oh how cool, I thought I was the only one trying to mess with scammy sites when I find them. Although I can see that I could improve my methods, since I usually write a short user script which spams the forms with data from faker.js and let the open tab sit pinned in my browser for a week or so.
- mflower 6y ago
  I was thinking about something pretty similar -- rather than just try to overload the server, make it more difficult for phisherpeople to figure out which data is legitimate. Realistically, I don't think I'd do it though -- who knows what 0 days you are putting on your box when you connect to those sites.
saagarjha 6y ago
While this is all fun and games, I am curious if DOSing someone else’s server, even if it’s being used to run a phishing scam, is legal.
- godzillabrennus 6y ago
  I seriously doubt it is legal in the United States. Seems like a pretty clear abuse of a computer network.
  - zwirbl 6y ago
    The author lives in Austria and the phishing attempt itself was targeting a major Austrian bank, but I don't know if this is legal or if that's a gray area
- tracker1 6y ago
  If you're in the US, it could be a violation of the Computer Fraud and Abuse Act. I used to do stuff like this until I became aware of the potential felony behind it.
  - uzakov 6y ago
    Same for the UK in most cases - illegal.
- stephenmc77 6y ago
  I imagine it's illegal but I also assume that for it to be prosecutable, there would have to be a complainant. Good luck to that guy trying to prove that DDOS-ing a phishing site is worse than the phishing itself!
  - mhils 6y ago
    It is not unlikely that the phishing site is hosted on a hacked server that still serves legitimate websites (which you would also take down in the process). So there could be a legitimate complainant.
schappim 6y ago
I am all for this. Thank you.
1023bytes 6y ago
All banks in the EU are required to use 2FA, I'm curious how these hackers get around that.
- moviuro 6y ago
  1. One SMS every 90 days, because the security teams have no idea how MFA works (I know, I work there). Even if you hop devices. See https://try.popho.be/psd2.html https://try.popho.be/psd2.html 2. It's just a little dev step away: http://blog.cmpxchg8b.com/2020/07/you-dont-need-sms-2fa.html http://blog.cmpxchg8b.com/2020/07/you-dont-need-sms-2fa.html . Phish kits will evolve, UX will still be bad, and phishing will still happen. See also https://sakurity.com/blog/2015/07/18/2fa.html https://sakurity.com/blog/2015/07/18/2fa.html
  - raverbashing 6y ago
    Some banks know security better than others And yes the login one might be every 90 days, but to do a transaction there might be an extra one (yes Germany did away with paper tans (2fa codes) in 2019 yay - thankfully not all banks are that stupid)
  - kwhitefoot 6y ago
    > 1. One SMS every 90 days, Wow that's bad. Here in Norway we use a system called BankID that uses the SIM in your mobile and it does it every time I log in.
- VBprogrammer 6y ago
  For quite a long time my bank used cargo culted 2FA i.e. 2x things that you know. Pretty embarrassing really. Thankfully they now have a card reader device but it's only used for certain actions (like adding new payees).
  - distances 6y ago
    In the EU? That definitely wouldn't be compliant, unless we're talking about 90s or something.
groznyyi 6y ago
Done For You Services Affiliate Marketing System Insane Marketer Wesley Virgin and Ariella have created an offer that is not only making affiliates wealthy but they are helping 100s of millions of NEWBIES earn money online. Join Hore : https://bit.ly/3gpgGgd https://bit.ly/3gpgGgd
noodlesUK 6y ago
As much as I think things like this can be fun, depending on your jurisdiction (and tbh the US loves extraditing people for silly computer crimes), it might not be advisable. This is all but certainly illegal at least within the US. I’m sure most competent security experts have been tempted to do things like this, or SQLi a scammer’s form and nuke their DB, and usually bad things won’t happen to you, you might find that you’re hacking something you weren’t expecting, and might piss someone off other than a scammer.
- darkwater 6y ago
  How can it be illegal sending a few fake data to a website? And anyway I doubt they will ever sue you, at most you could be targeted for some revenge attack if they are really pissed off and you don't hide your traces.
  - StreamBright 6y ago
    This can be classified as denial of service attack because of the rate your are sending the requests. Depends on the law (and on the interpretation as well). I doubt that the phising guys behind this will file a complaint though.
    - socket0 6y ago
      Many phishing pages reside on compromised domains. Bob's Plumbing Supplies might wonder why their Wordpress site loaded with plug-ins has stopped working, ask someone to take a look, and see your IP address all over the logs.
      - berkes 6y ago
        Or the webhost where Bob's Plumbing Supplies is hosted detects an attack and files a complain. Or the SAAS/server rental sees this, puts you on some automatic blacklist and puts in on the "to be investigated" blacklist. Too many parties involved whom you are "hurting" that might get back to you. Not saying this to keep anyone from repeating this, though; just that when doing so, keep in mind that you're probably not just hurting a scammer alone.
tdeck 6y ago
I have seen the code for some phish kits in the past. Many of them actually send an email on each submission rather than saving to a file (more resilient if the hacked WordPress site is taken down). They often also record the IP so it may be easier to filter out "phish-feeding" attempts like this.
b0re 6y ago
noob question: what does an \ at the end of a bash script do? Is it the same as ; ?
- oddeyed 6y ago
  The opposite. ; is the same as a newline. Prepending the newline with a backslash \ is like saying "pretend this newline isn't here". So all of the -H arguments get applied to the same command in the example, rather than being treated as commands in their own right.
  - newswasboring 6y ago
    Oh... I am having one of those moments where I feel like everyone else but me knew this and I'm a dummy. But when put like this, I realize \ here is an escape character thing, making the newline into \\n.
- jtylr 6y ago
  The end of a bash script or a line? If it's at the end of the line it's just signifying that the line continues underneath and to run that block as "one line". It's just escaping the newline character.
- liuyong 6y ago
  In bash '\' would escape the character behind it. In this case, newline was escaped, which means you could ignore the newline character and treat those lines as one line.
ChrisMarshallNY 6y ago
I know someone that DDoSed a forum spammer. They hit back, ten times as hard, and completely destroyed a well-established forum, with thousands of users, that had experienced an annoying (but not crippling) "penis pill" spam attack.
- Aachen 6y ago
  So like... Backups? Restore, put it behind basic auth and email the password to the members active in the past few weeks, then at your leasure implement some captchas and go from there. Heck, restore the forum publicly as well and use that as a sandbox to see how they'll bypass it.
  - ChrisMarshallNY 6y ago
    Shirley, you jest. Backups are for, like, squares, dude. We live on the edge, dude! Extreme! YOLO! In all fairness, the person involved was a truly brilliant young man, and the experience pretty much shattered him, emotionally. He has yet to recover from it. In a way, it can be satisfying to be able to say "I told you so," but seeing the human cost kinda takes the fun out of smugness.
    - cutemonster 6y ago
      How did the spammers hit back? Can I ask what made it hard / infeasible to continue once the spammers had stopped hitting back? > seeing the human cost It seems the forum meant a lot to him/her
      - ChrisMarshallNY 6y ago
        I was not directly involved in the incident; hearing about it after the fact. My understanding is that a forum spammer started registering fake accounts, and then did what they do. The admin saw this. He was quite smart, and figured out who they were, then executed some kind of attack on their server. I think it was a DDoS attack. When they responded, the used a bunch of privilege escalation attacks to promote some of their registered users (It was a badly-maintained phpBB site; otherwise known as "Swiss Cheese"), and blew away a lot of the site structure and templates, so it basically imploded. Yeah, it was his "baby." He was also involved in a running battle of nerd egos with some other folks, who used the incident to discredit him, and drove him out.
beAbU 6y ago
A colleague and I did something similar recently. We got similar spam mails in our work inboxes. Whipped up a little ruby script that spammed bum login data to the spammer's form url. We had our scripts running on a couple of Heroku instances and all. At some stage we realized that the password field in the form accepted arbitrarily sized payloads. So we base64 encoded some 10MB file and sent that as the password. The thinking was if we could not DoS them, we can at least clog up their works with some real hefty payloads. More can be seen here: https://github.com/dj-louw/spamscam https://github.com/dj-louw/spamscam
- Sebb767 6y ago
  While funny, real-looking fake login data might be more useful, as it's probably real easy to filter the few large requests. Unless, of course, you bring down the server and stop the whole operation (for a time). It would be quite interesting to do a study on both options using a honeypot-account (to detect whether the login could be extracted by the spammer).
  - beAbU 6y ago
    So the script we wrote created real email addresses and user names. The Ruby gem Faker (https://github.com/faker-ruby/faker https://github.com/faker-ruby/faker) takes care of that. But yeah you are probably right. 10MB passwords possibly made it too easy for the scammer to filter out the bum data. We did only make the 10MB change very late in our attack, so the scammer got 1000's of fake names and emails before we cranked up the mass of each individual request.
withinboredom 6y ago
Hilarious story: I was hired to look into why a WordPress site was so slow back in 2010. It turned out the site was hacked and they were hosting a spam viagra site on the side. When I brought it to their attention, the owner asked: "Can we keep it up? It will help our traffic numbers for investors and probably our Google ranking." I literally face-palmed.
- mipmap04 6y ago
  Well, with a spam viagra site, I think the point is keeping it up. On topic, it's crazy how willing some people are to defraud their investors.
  - darkerside 6y ago
    Send like a missed opportunity to pivot into a spam viagra hosting site
    - x86_64Ubuntu 6y ago
      But then your costs get allocated to the spam operation. The owner of the website is benefiting because of the "traffic" they are receiving that is attributed to their non-spam venture. The hacker is benefiting because of the free hosting they are getting. The loser is anyone interested in buying the site and having the price hinge on the traffic.
- lr4444lr 6y ago
  Keeping it up with Viagra, huh...
Samuyi 6y ago
great stuff
NicoJuicy 6y ago
Well, I have something like HN running on https://handlr.sapico.me https://handlr.sapico.me ( automatically imports rss feeds) Wich had a lot of spammers and they worked around the Google Human verification script for logging in. Humans won't add a Title + Url + text since it shouldn't be used this way. So ... that flow now returns a xml bomb. Spam stopped immediately after deploying this. I'm a bit curious how long they spend looking why the memory of their server suddenly went through the roof :p
m-p-3 6y ago
I normally just report those sites on https://safebrowsing.google.com/safebrowsing/report_phish/ https://safebrowsing.google.com/safebrowsing/report_phish/ and it doesn't normally take long to end up with a phishing warning when you navigate to it with a modern browser. I also try to send an email to the registrar "abuse" email to let them know that a specific domain is hosting a phishing page (with the exact link as proof). That takes it down quickly as well, which forces the website owner to do some remediation.
- raverbashing 6y ago
  I think most URL shorteners have an abuse reporting facility (with bitly, add a + to the end of the URL to see more info)
RemySoc 6y ago
I was doing this 15 years ago. Does it mean that I'm old?
dandare 6y ago
A friend of mine fell victim to a renting scam here in Czechia. The phishing site was using the native .cz TLD, which is well within the reach of Czech authorities. I was particularly bored that day so I went to a local police department to report a crime. I advised the policeman to take down the phishing site - it was actively facilitating a crime. The poor cops had no idea what to do and in the end they told me that this crime is taking place on the internet and they have no means of investigating it :D.
- dependenttypes 6y ago
  This kind of thing always confused me. Scam sites and sites promoting illegal activities (such as fake dna tests) are everywhere. Surely the police could take them down in the same way that they take down child porn sites.
  - josefx 6y ago
    If you asked EU politicians a few years ago there was no way to take those down and we needed a great European firewall asap. Of course when their to secret list of illegal sites got leaked it turned out to be sites that could be taken down within a few hours by just contacting the hosting providers.
- ufmace 6y ago
  Probably whoever works at the desk there has no idea how to get in touch with the department responsible for investigating internet crimes. They're probably in another office far away, and never interact with each other.
rymurr 6y ago
I wonder how many 'fake news' sites and other tools designed to subvert democracy are this fragile. Seems like we could do a lot of good by disrupting those sites rather than slowing down phishers. Defending our democratic institutions > messing with scammers
lordnacho 6y ago
What do they do when they access the victim's bank account? Buy fungible goods with the money? Send it to another account?
gigatexal 6y ago
The author is a saint. This made my day.
daniel-s 6y ago
Is this a useful strategy that banks can or do employ? Filling a phisher's catch with spammed fake credentials may pollute their database enough that it's not worth selling.
generaljargon 6y ago
Legal issues aside, these lists are typically checked with a validation tool that runs through them to scrub malformed or invalid entries. An example of one such tool, taken from a krebsonsecurity post: https://krebsonsecurity.com/wp-content/uploads/2019/08/chasebrute-ed2.png https://krebsonsecurity.com/wp-content/uploads/2019/08/chase....
badrabbit 6y ago
It was probably a compromised site. Spinning up your own domain/vps has the drawback of it being a new site not trusted or classified by most corporate firewalls and proxies (if setup right). You'd be surprised how easy it is to scan+pwn some wordpress site left in default config or vulnerable to the latest joomla exploit. They then upload a $20 phishing kit and start spamming. If you look at the directories' root in the path you sometimes get lucky enough to get the zip/tar file they forgot to remove (includes their email, to which stolen creds are sent, you probably spammed the crap out of their mailbox too). A few times I've even found unsecured webshells they left behind (just booted them out, got emails of people who fell for it and did the standard rfc-whatever notification) One thing I wanted to try was to include tracker URLs when stuffing them with fake usernames like 'bob@bob.com https://bobscompany.com/login.php?trackerid=1345556' https://bobscompany.com/login.php?trackerid=1345556' or make it a 1x1 pixel image link so when they see the fake creds I will know their IP
catmistake 6y ago
This is great, bash ftw. Nice presentation, too. Regarding its legality, I will paraphrase Bishop Berkeley: if a tree falls in the forest, and no one is around to hear it, does it make a sound? What I am getting at is until there is a complaint, there is no crime, and as at least another pointed out, criminals will usually not report crimes that reveal their own crimes. "They kidnapped my kidnap-victim!"
- anonymfus 6y ago
  The kidnap-victim or their relatives can. So: >Sadly the server didn't enable indexing otherwise I would have seen all victims, but it was funny nonetheless. It's actually very lucky for Haschek, because otherwise the only thing stopping Raiffeisen from suing him for stealing credentials would be a bad publicity.
jitteriest 6y ago
Not really important but: `cat /dev/urandom | tr -dc '0-9' | fold -w 7 | head -n 1` Can be accomplished in two steps instead of 4: `tr -dc '0-9' < /dev/urandom | head -c 7`
- gshubert17 6y ago
  When I tried either of these, on my macOS, I got tr: Illegal byte sequence which I got around by changing the locale: ( export LC_ALL=C; tr -dc '0-9' < /dev/urandom | head -c 7 ) with help from: https://unix.stackexchange.com/questions/141420/tr-complains-of-illegal-byte-sequence https://unix.stackexchange.com/questions/141420/tr-complains...
n0on3 6y ago
That's really... not an appropriate response, and not only for the legal reasons others mentioned. Phishing sites can be / are often served by compromised hosts, so you might as well end up doxing a box who is not run by the bad guy, causing all sorts of mayem for the legitimate owners / admins (in addition to they be compromised). Plus, you didn't solve anything, from the pattern you used it's pretty easy to cleanup the data for the adversary, get rid of your garbage and put the thing back on the next day, so you've only temporarily disrupted their operation. A more appropriate response is to report the abuse who manages the infrastructure (most likely a legitimate provider) and the domain registar; both usually have appropriate channels and response procedures just for that. If you feel kind and keen to do some free work, you can find out if the infrastructure has also a legitimate purpose and contact the legitimate administrator. Also, there are a lot of abuse lists that accept contributions, as in submitions for malicious sites, where you can report this (so it gets fetched by a variety of stuff and blocked by others while it's operational before it gets eradicated). I understand this does not give you any credit or allow you to write a blog post about looping requests in bash but still.
- pavel_lishin 6y ago
  I would be wary about sending a warning email from an email address that could be traced back to me. Some people panic, and assume that you're the person responsible, or lash out at the only person they can strike - you.
  - n0on3 6y ago
    The infrastructure provider (if any) has likely seen more of these than you can imagine and again, they have proper channels for this and the people who monitor them know how to handle it, they won't lash out on you. Same goes for the domain registar. As per the box legitimate owner, while I agree that there is all kind of crazy out there and you can avoid this if it makes you uncomfortable (abuse-at-provider will most likely contact them shortly without involving you), I don't see the lash out or strike at you scenarios likely, in my experience usually you get a thank you. To be clear, I'm not suggesting email "Bro, you are compromised, bye", I mean, you can just inform them that you received the link and were taken to a phishing site that looks like hosted on his machine, attach screens, advice them on next steps if you want to go the extra mile in niceness. You're doing them a favour without breaking any law, why would they get mad at you?
suixo 6y ago
This reminds me of something similar I did about 5 years ago: https://blog.securem.eu/projects/2015/03/08/flooding-the-phisherman/ https://blog.securem.eu/projects/2015/03/08/flooding-the-phi... One important thing is to report the phishing attempt, both to the hosting providers involved and to the mail service used to send the emails.
heipei 6y ago
The same IP that hosted this guys phishing page also hosted phishing pages targeting Italian banks WeBank, Banca Intesa Sanpaolo and Banca Sella over the past 14 days, all with wildcard certs issued by the same CA. So not really surprising, just run of the mill phishkit activity most likely. If you have fun spamming their inbox knock then yourself out, but it's not gonna make a dent in the thousands of phishkits deployed every day. Source: https://urlscan.io/ip/89.46.110.15 https://urlscan.io/ip/89.46.110.15
thrownaway954 6y ago
fyi... just cause you get a 404 error doesn't mean the site is down, it might mean you are blocked. IIS for example has the request filtering module inwhich you can return a status code when a certain filter is hit. it is very easy to create a filter where is a query parameter is over a certain character limit to return a 404 (filters are just regular expression). this is why you should always check a site from https://downforeveryoneorjustme.com/downforme.com https://downforeveryoneorjustme.com/downforme.com
atum47 6y ago
I have made something similar couple of years ago, but I took down the video that I recorded doing it cause I was afraid it could turn back on me. These days I usually try to write an email to the abusar and to the hosting services. I also did a bunch of this "flags" on Instagram ads. Instagram is the worst, cause they open a website in their app, hiding the true URL of the phishing site. I sent a complain to them about that. Never heard back.
miguelmota 6y ago
> cat /dev/urandom | tr -dc '0-9' | fold -w 7 | head -n 1 Useless use of cat http://porkmail.org/era/unix/award.html http://porkmail.org/era/unix/award.html
jitendrac 6y ago
That is really a good way to make them drop all the target. but rather if I were to do it I will do it with set of different signature snuffling randomly to make them un-filterable and limit the rate of submission such that they dont immediately notice me and I can make their database full of dummy data which makes it useless for them. Many times you can also get to execute arbitrary sql-injection and can delete the database. In fact, in past when in collage I was trying to learn some hacking basics to find vulnerable servers. And as on the googled article like most scripting kiddies, I searched and found a vulnerable site which was already hacked and had installed shell.php on it. What that vulnerability did was, it found a way to inject the browser navigator name into php script using /proc/self/environ. after studying attack what I did was, remove the shell and patched the vulnerable file with some obfuscation. I was so naive(what would have happened if my IP was tracked and I became suspected criminal),now seeing past luckily I never got my self involved in legal things.
hrgiger 6y ago
Sorry for off topic question but are there any dirty link sharing platforms ,that you can share those links safely and warn the user and force it to copy paste?
chadrs 6y ago
I've done stuff like this but behind Tor. I tried to make the data random enough it would be tough to see which records were real. I remember once my IP was getting blocked after a certain amount of requests (not sure if via some automated fail2ban or a human) but Tor has an API to swap to a new outbound IP, so I just had it do that in the case of a timeout.

457 points by geek_at 6y ago

I stoped 2 webshops which basically sell expensive stuff 20% off by wire transfer (bank transfer?!) which then never send the goods of course! I did the following: - I found out where it was hosted and send them an email explaining them why and how that shop is a scam - I found out where they hosted the domain and wrote the registrar an abuse email - I wrote an email to the banks where the bank accounts where active The scammer had a webchat module active and he/she did wrote back to me, nothing came out through that, nonetheless: next day, both webshops were gone due to being taken offline from the hosters. I do believe, that they do have a chance because literaly no one cares. I have seen mentioning of one of those two shops older then 6 month. I pissed at them with very little effort in a very short time. I do hope i helped out.

Cthulhu_ 6y ago
I like to think it helped out, but at the same time, these people are professionals and will have automation to generate new instances and scam campaigns easily. At least it should be more difficult for them to set up new bank accounts though, they need ID for that, and / or a network of mules, and those are finite resources.
- pbhjpbhj 6y ago
  I think the bank thing is done through students quite often: "Hey, I can't get a bank account as I'm a refugee fleeing a war, please help by receiving £5000 cash, we'll give you £100. Say it's a gift from your Aunty to buy a car with." I've seen reports of this in the UK at least, maybe they managed to stop it.
  - Geezus_42 6y ago
    At least in the US the people who accept the offer can be charged as money mules.
    - pbhjpbhj 6y ago
      I think that's true in UK too, but often the people aren't aware how wrong what they're doing is.
berkes 6y ago
I attended a meetup at our local registrar (SIDN) where they explained how data analysts on their payroll detect such fake webshops and how they then actively block those domains on DNS and registrar level.
- jagged-chisel 6y ago
  I'm assuming you don't mean "employee payroll" right?
  - berkes 6y ago
    English is not my native language. I meant "they work for SIDN at SIDN". Employees.
madarcho 6y ago
Abuse email/report to the registrar is also my goto. Usually results in a quick response
- parliament32 6y ago
  You'll get a response but it'll always be a polite "fuck off" unless you have some sort of actual authority (are you the trademark holder? are you LE? do you have a court order?). You'll have better luck contacting the hosting provider because they're actually responsible for the content.

mrvenkman 6y ago

"The way these things work is that they act like they're the real login form, steal your credentials and usually send you off to the real bank so you think you made a typo or something." If that's the case then surely you're also flooding the bank's real site with GET requests after the redirection.

__s 6y ago
Bash doesn't have to follow the redirect Even if, I'm sure the bank appreciates someone working against phishing. A few GET requests is something they're meant to handle. They have to be resistant to DDoS attempts from malevolent actors
Cthulhu_ 6y ago
From cURL the author can ignore the redirect to the bank's real site though.

mrkramer 6y ago

So you DDOSed their backend but they could've whitelist their IP range and blacklist all the others for incoming requests. What you did does nothing against flexible and adaptive adversaries.

deleted 6y ago
[deleted]
scalableUnicon 6y ago
Even if that's the case, it made the website unavailable for future victims who got the same text messages.
- parliament32 6y ago
  Not if they just made the site return a 404/500 just to his IPs, which any half-decent adversary would do. The "play dead" strategy works great with these kind of vigilantes. We're employed similar tactics against DDoSers at work. Start returning 500s or just tarpit their requests, they think the site is down and they go home.
nostoc 6y ago
People who buy phishing kit and set them up are typically not flexible and adaptive adversaries.

anticristi 6y ago

Nice! If you are required to write an email address, it would be cool to use a canary, and see if it shows up on haveibeenpwned.com.

strogonoff 6y ago
I don’t think HaveIBeenPwned makes an attempt to harvest data captured by fishing websites. It’s intended to track data leaked due to a breach of the actual system.
- Eremotherium 6y ago
  Mostly true but there things like Collection #1 and Anti Public Combo List which are amalgamations of unknown provenance. A lot of it is probably prior breaches but I wouldn't be surprised if it contained phishing data.

alufers 6y ago

Oh how cool, I thought I was the only one trying to mess with scammy sites when I find them. Although I can see that I could improve my methods, since I usually write a short user script which spams the forms with data from faker.js and let the open tab sit pinned in my browser for a week or so.

mflower 6y ago
I was thinking about something pretty similar -- rather than just try to overload the server, make it more difficult for phisherpeople to figure out which data is legitimate. Realistically, I don't think I'd do it though -- who knows what 0 days you are putting on your box when you connect to those sites.

saagarjha 6y ago

While this is all fun and games, I am curious if DOSing someone else’s server, even if it’s being used to run a phishing scam, is legal.

godzillabrennus 6y ago
I seriously doubt it is legal in the United States. Seems like a pretty clear abuse of a computer network.
- zwirbl 6y ago
  The author lives in Austria and the phishing attempt itself was targeting a major Austrian bank, but I don't know if this is legal or if that's a gray area
tracker1 6y ago
If you're in the US, it could be a violation of the Computer Fraud and Abuse Act. I used to do stuff like this until I became aware of the potential felony behind it.
- uzakov 6y ago
  Same for the UK in most cases - illegal.
stephenmc77 6y ago
I imagine it's illegal but I also assume that for it to be prosecutable, there would have to be a complainant. Good luck to that guy trying to prove that DDOS-ing a phishing site is worse than the phishing itself!
- mhils 6y ago
  It is not unlikely that the phishing site is hosted on a hacked server that still serves legitimate websites (which you would also take down in the process). So there could be a legitimate complainant.

schappim 6y ago

I am all for this. Thank you.

1023bytes 6y ago

All banks in the EU are required to use 2FA, I'm curious how these hackers get around that.

moviuro 6y ago
1. One SMS every 90 days, because the security teams have no idea how MFA works (I know, I work there). Even if you hop devices. See https://try.popho.be/psd2.html https://try.popho.be/psd2.html 2. It's just a little dev step away: http://blog.cmpxchg8b.com/2020/07/you-dont-need-sms-2fa.html http://blog.cmpxchg8b.com/2020/07/you-dont-need-sms-2fa.html . Phish kits will evolve, UX will still be bad, and phishing will still happen. See also https://sakurity.com/blog/2015/07/18/2fa.html https://sakurity.com/blog/2015/07/18/2fa.html
- raverbashing 6y ago
  Some banks know security better than others And yes the login one might be every 90 days, but to do a transaction there might be an extra one (yes Germany did away with paper tans (2fa codes) in 2019 yay - thankfully not all banks are that stupid)
- kwhitefoot 6y ago
  > 1. One SMS every 90 days, Wow that's bad. Here in Norway we use a system called BankID that uses the SIM in your mobile and it does it every time I log in.
VBprogrammer 6y ago
For quite a long time my bank used cargo culted 2FA i.e. 2x things that you know. Pretty embarrassing really. Thankfully they now have a card reader device but it's only used for certain actions (like adding new payees).
- distances 6y ago
  In the EU? That definitely wouldn't be compliant, unless we're talking about 90s or something.

groznyyi 6y ago

Done For You Services Affiliate Marketing System Insane Marketer Wesley Virgin and Ariella have created an offer that is not only making affiliates wealthy but they are helping 100s of millions of NEWBIES earn money online. Join Hore : https://bit.ly/3gpgGgd https://bit.ly/3gpgGgd

noodlesUK 6y ago

As much as I think things like this can be fun, depending on your jurisdiction (and tbh the US loves extraditing people for silly computer crimes), it might not be advisable. This is all but certainly illegal at least within the US. I’m sure most competent security experts have been tempted to do things like this, or SQLi a scammer’s form and nuke their DB, and usually bad things won’t happen to you, you might find that you’re hacking something you weren’t expecting, and might piss someone off other than a scammer.

darkwater 6y ago
How can it be illegal sending a few fake data to a website? And anyway I doubt they will ever sue you, at most you could be targeted for some revenge attack if they are really pissed off and you don't hide your traces.
- StreamBright 6y ago
  This can be classified as denial of service attack because of the rate your are sending the requests. Depends on the law (and on the interpretation as well). I doubt that the phising guys behind this will file a complaint though.
  - socket0 6y ago
    Many phishing pages reside on compromised domains. Bob's Plumbing Supplies might wonder why their Wordpress site loaded with plug-ins has stopped working, ask someone to take a look, and see your IP address all over the logs.
    - berkes 6y ago
      Or the webhost where Bob's Plumbing Supplies is hosted detects an attack and files a complain. Or the SAAS/server rental sees this, puts you on some automatic blacklist and puts in on the "to be investigated" blacklist. Too many parties involved whom you are "hurting" that might get back to you. Not saying this to keep anyone from repeating this, though; just that when doing so, keep in mind that you're probably not just hurting a scammer alone.

tdeck 6y ago

I have seen the code for some phish kits in the past. Many of them actually send an email on each submission rather than saving to a file (more resilient if the hacked WordPress site is taken down). They often also record the IP so it may be easier to filter out "phish-feeding" attempts like this.

b0re 6y ago

noob question: what does an \ at the end of a bash script do? Is it the same as ; ?

oddeyed 6y ago
The opposite. ; is the same as a newline. Prepending the newline with a backslash \ is like saying "pretend this newline isn't here". So all of the -H arguments get applied to the same command in the example, rather than being treated as commands in their own right.
- newswasboring 6y ago
  Oh... I am having one of those moments where I feel like everyone else but me knew this and I'm a dummy. But when put like this, I realize \ here is an escape character thing, making the newline into \\n.
jtylr 6y ago
The end of a bash script or a line? If it's at the end of the line it's just signifying that the line continues underneath and to run that block as "one line". It's just escaping the newline character.
liuyong 6y ago
In bash '\' would escape the character behind it. In this case, newline was escaped, which means you could ignore the newline character and treat those lines as one line.

ChrisMarshallNY 6y ago

I know someone that DDoSed a forum spammer. They hit back, ten times as hard, and completely destroyed a well-established forum, with thousands of users, that had experienced an annoying (but not crippling) "penis pill" spam attack.

Aachen 6y ago
So like... Backups? Restore, put it behind basic auth and email the password to the members active in the past few weeks, then at your leasure implement some captchas and go from there. Heck, restore the forum publicly as well and use that as a sandbox to see how they'll bypass it.
- ChrisMarshallNY 6y ago
  Shirley, you jest. Backups are for, like, squares, dude. We live on the edge, dude! Extreme! YOLO! In all fairness, the person involved was a truly brilliant young man, and the experience pretty much shattered him, emotionally. He has yet to recover from it. In a way, it can be satisfying to be able to say "I told you so," but seeing the human cost kinda takes the fun out of smugness.
  - cutemonster 6y ago
    How did the spammers hit back? Can I ask what made it hard / infeasible to continue once the spammers had stopped hitting back? > seeing the human cost It seems the forum meant a lot to him/her
    - ChrisMarshallNY 6y ago
      I was not directly involved in the incident; hearing about it after the fact. My understanding is that a forum spammer started registering fake accounts, and then did what they do. The admin saw this. He was quite smart, and figured out who they were, then executed some kind of attack on their server. I think it was a DDoS attack. When they responded, the used a bunch of privilege escalation attacks to promote some of their registered users (It was a badly-maintained phpBB site; otherwise known as "Swiss Cheese"), and blew away a lot of the site structure and templates, so it basically imploded. Yeah, it was his "baby." He was also involved in a running battle of nerd egos with some other folks, who used the incident to discredit him, and drove him out.

beAbU 6y ago

A colleague and I did something similar recently. We got similar spam mails in our work inboxes. Whipped up a little ruby script that spammed bum login data to the spammer's form url. We had our scripts running on a couple of Heroku instances and all. At some stage we realized that the password field in the form accepted arbitrarily sized payloads. So we base64 encoded some 10MB file and sent that as the password. The thinking was if we could not DoS them, we can at least clog up their works with some real hefty payloads. More can be seen here: https://github.com/dj-louw/spamscam https://github.com/dj-louw/spamscam

Sebb767 6y ago
While funny, real-looking fake login data might be more useful, as it's probably real easy to filter the few large requests. Unless, of course, you bring down the server and stop the whole operation (for a time). It would be quite interesting to do a study on both options using a honeypot-account (to detect whether the login could be extracted by the spammer).
- beAbU 6y ago
  So the script we wrote created real email addresses and user names. The Ruby gem Faker (https://github.com/faker-ruby/faker https://github.com/faker-ruby/faker) takes care of that. But yeah you are probably right. 10MB passwords possibly made it too easy for the scammer to filter out the bum data. We did only make the 10MB change very late in our attack, so the scammer got 1000's of fake names and emails before we cranked up the mass of each individual request.

withinboredom 6y ago

Hilarious story: I was hired to look into why a WordPress site was so slow back in 2010. It turned out the site was hacked and they were hosting a spam viagra site on the side. When I brought it to their attention, the owner asked: "Can we keep it up? It will help our traffic numbers for investors and probably our Google ranking." I literally face-palmed.

mipmap04 6y ago
Well, with a spam viagra site, I think the point is keeping it up. On topic, it's crazy how willing some people are to defraud their investors.
- darkerside 6y ago
  Send like a missed opportunity to pivot into a spam viagra hosting site
  - x86_64Ubuntu 6y ago
    But then your costs get allocated to the spam operation. The owner of the website is benefiting because of the "traffic" they are receiving that is attributed to their non-spam venture. The hacker is benefiting because of the free hosting they are getting. The loser is anyone interested in buying the site and having the price hinge on the traffic.
lr4444lr 6y ago
Keeping it up with Viagra, huh...

Samuyi 6y ago

great stuff

NicoJuicy 6y ago

Well, I have something like HN running on https://handlr.sapico.me https://handlr.sapico.me ( automatically imports rss feeds) Wich had a lot of spammers and they worked around the Google Human verification script for logging in. Humans won't add a Title + Url + text since it shouldn't be used this way. So ... that flow now returns a xml bomb. Spam stopped immediately after deploying this. I'm a bit curious how long they spend looking why the memory of their server suddenly went through the roof :p

m-p-3 6y ago

I normally just report those sites on https://safebrowsing.google.com/safebrowsing/report_phish/ https://safebrowsing.google.com/safebrowsing/report_phish/ and it doesn't normally take long to end up with a phishing warning when you navigate to it with a modern browser. I also try to send an email to the registrar "abuse" email to let them know that a specific domain is hosting a phishing page (with the exact link as proof). That takes it down quickly as well, which forces the website owner to do some remediation.

raverbashing 6y ago
I think most URL shorteners have an abuse reporting facility (with bitly, add a + to the end of the URL to see more info)

RemySoc 6y ago

I was doing this 15 years ago. Does it mean that I'm old?

dandare 6y ago

A friend of mine fell victim to a renting scam here in Czechia. The phishing site was using the native .cz TLD, which is well within the reach of Czech authorities. I was particularly bored that day so I went to a local police department to report a crime. I advised the policeman to take down the phishing site - it was actively facilitating a crime. The poor cops had no idea what to do and in the end they told me that this crime is taking place on the internet and they have no means of investigating it :D.

dependenttypes 6y ago
This kind of thing always confused me. Scam sites and sites promoting illegal activities (such as fake dna tests) are everywhere. Surely the police could take them down in the same way that they take down child porn sites.
- josefx 6y ago
  If you asked EU politicians a few years ago there was no way to take those down and we needed a great European firewall asap. Of course when their to secret list of illegal sites got leaked it turned out to be sites that could be taken down within a few hours by just contacting the hosting providers.
ufmace 6y ago
Probably whoever works at the desk there has no idea how to get in touch with the department responsible for investigating internet crimes. They're probably in another office far away, and never interact with each other.

rymurr 6y ago

I wonder how many 'fake news' sites and other tools designed to subvert democracy are this fragile. Seems like we could do a lot of good by disrupting those sites rather than slowing down phishers. Defending our democratic institutions > messing with scammers

lordnacho 6y ago

What do they do when they access the victim's bank account? Buy fungible goods with the money? Send it to another account?

gigatexal 6y ago

The author is a saint. This made my day.

daniel-s 6y ago

Is this a useful strategy that banks can or do employ? Filling a phisher's catch with spammed fake credentials may pollute their database enough that it's not worth selling.

generaljargon 6y ago

Legal issues aside, these lists are typically checked with a validation tool that runs through them to scrub malformed or invalid entries. An example of one such tool, taken from a krebsonsecurity post: https://krebsonsecurity.com/wp-content/uploads/2019/08/chasebrute-ed2.png https://krebsonsecurity.com/wp-content/uploads/2019/08/chase....

badrabbit 6y ago

It was probably a compromised site. Spinning up your own domain/vps has the drawback of it being a new site not trusted or classified by most corporate firewalls and proxies (if setup right). You'd be surprised how easy it is to scan+pwn some wordpress site left in default config or vulnerable to the latest joomla exploit. They then upload a $20 phishing kit and start spamming. If you look at the directories' root in the path you sometimes get lucky enough to get the zip/tar file they forgot to remove (includes their email, to which stolen creds are sent, you probably spammed the crap out of their mailbox too). A few times I've even found unsecured webshells they left behind (just booted them out, got emails of people who fell for it and did the standard rfc-whatever notification) One thing I wanted to try was to include tracker URLs when stuffing them with fake usernames like 'bob@bob.com https://bobscompany.com/login.php?trackerid=1345556' https://bobscompany.com/login.php?trackerid=1345556' or make it a 1x1 pixel image link so when they see the fake creds I will know their IP

catmistake 6y ago

This is great, bash ftw. Nice presentation, too. Regarding its legality, I will paraphrase Bishop Berkeley: if a tree falls in the forest, and no one is around to hear it, does it make a sound? What I am getting at is until there is a complaint, there is no crime, and as at least another pointed out, criminals will usually not report crimes that reveal their own crimes. "They kidnapped my kidnap-victim!"

anonymfus 6y ago
The kidnap-victim or their relatives can. So: >Sadly the server didn't enable indexing otherwise I would have seen all victims, but it was funny nonetheless. It's actually very lucky for Haschek, because otherwise the only thing stopping Raiffeisen from suing him for stealing credentials would be a bad publicity.

jitteriest 6y ago

Not really important but: `cat /dev/urandom | tr -dc '0-9' | fold -w 7 | head -n 1` Can be accomplished in two steps instead of 4: `tr -dc '0-9' < /dev/urandom | head -c 7`

gshubert17 6y ago
When I tried either of these, on my macOS, I got tr: Illegal byte sequence which I got around by changing the locale: ( export LC_ALL=C; tr -dc '0-9' < /dev/urandom | head -c 7 ) with help from: https://unix.stackexchange.com/questions/141420/tr-complains-of-illegal-byte-sequence https://unix.stackexchange.com/questions/141420/tr-complains...

n0on3 6y ago

That's really... not an appropriate response, and not only for the legal reasons others mentioned. Phishing sites can be / are often served by compromised hosts, so you might as well end up doxing a box who is not run by the bad guy, causing all sorts of mayem for the legitimate owners / admins (in addition to they be compromised). Plus, you didn't solve anything, from the pattern you used it's pretty easy to cleanup the data for the adversary, get rid of your garbage and put the thing back on the next day, so you've only temporarily disrupted their operation. A more appropriate response is to report the abuse who manages the infrastructure (most likely a legitimate provider) and the domain registar; both usually have appropriate channels and response procedures just for that. If you feel kind and keen to do some free work, you can find out if the infrastructure has also a legitimate purpose and contact the legitimate administrator. Also, there are a lot of abuse lists that accept contributions, as in submitions for malicious sites, where you can report this (so it gets fetched by a variety of stuff and blocked by others while it's operational before it gets eradicated). I understand this does not give you any credit or allow you to write a blog post about looping requests in bash but still.

pavel_lishin 6y ago
I would be wary about sending a warning email from an email address that could be traced back to me. Some people panic, and assume that you're the person responsible, or lash out at the only person they can strike - you.
- n0on3 6y ago
  The infrastructure provider (if any) has likely seen more of these than you can imagine and again, they have proper channels for this and the people who monitor them know how to handle it, they won't lash out on you. Same goes for the domain registar. As per the box legitimate owner, while I agree that there is all kind of crazy out there and you can avoid this if it makes you uncomfortable (abuse-at-provider will most likely contact them shortly without involving you), I don't see the lash out or strike at you scenarios likely, in my experience usually you get a thank you. To be clear, I'm not suggesting email "Bro, you are compromised, bye", I mean, you can just inform them that you received the link and were taken to a phishing site that looks like hosted on his machine, attach screens, advice them on next steps if you want to go the extra mile in niceness. You're doing them a favour without breaking any law, why would they get mad at you?

suixo 6y ago

This reminds me of something similar I did about 5 years ago: https://blog.securem.eu/projects/2015/03/08/flooding-the-phisherman/ https://blog.securem.eu/projects/2015/03/08/flooding-the-phi... One important thing is to report the phishing attempt, both to the hosting providers involved and to the mail service used to send the emails.

heipei 6y ago

The same IP that hosted this guys phishing page also hosted phishing pages targeting Italian banks WeBank, Banca Intesa Sanpaolo and Banca Sella over the past 14 days, all with wildcard certs issued by the same CA. So not really surprising, just run of the mill phishkit activity most likely. If you have fun spamming their inbox knock then yourself out, but it's not gonna make a dent in the thousands of phishkits deployed every day. Source: https://urlscan.io/ip/89.46.110.15 https://urlscan.io/ip/89.46.110.15

thrownaway954 6y ago

fyi... just cause you get a 404 error doesn't mean the site is down, it might mean you are blocked. IIS for example has the request filtering module inwhich you can return a status code when a certain filter is hit. it is very easy to create a filter where is a query parameter is over a certain character limit to return a 404 (filters are just regular expression). this is why you should always check a site from https://downforeveryoneorjustme.com/downforme.com https://downforeveryoneorjustme.com/downforme.com

atum47 6y ago

I have made something similar couple of years ago, but I took down the video that I recorded doing it cause I was afraid it could turn back on me. These days I usually try to write an email to the abusar and to the hosting services. I also did a bunch of this "flags" on Instagram ads. Instagram is the worst, cause they open a website in their app, hiding the true URL of the phishing site. I sent a complain to them about that. Never heard back.

miguelmota 6y ago

> cat /dev/urandom | tr -dc '0-9' | fold -w 7 | head -n 1 Useless use of cat http://porkmail.org/era/unix/award.html http://porkmail.org/era/unix/award.html

jitendrac 6y ago

That is really a good way to make them drop all the target. but rather if I were to do it I will do it with set of different signature snuffling randomly to make them un-filterable and limit the rate of submission such that they dont immediately notice me and I can make their database full of dummy data which makes it useless for them. Many times you can also get to execute arbitrary sql-injection and can delete the database. In fact, in past when in collage I was trying to learn some hacking basics to find vulnerable servers. And as on the googled article like most scripting kiddies, I searched and found a vulnerable site which was already hacked and had installed shell.php on it. What that vulnerability did was, it found a way to inject the browser navigator name into php script using /proc/self/environ. after studying attack what I did was, remove the shell and patched the vulnerable file with some obfuscation. I was so naive(what would have happened if my IP was tracked and I became suspected criminal),now seeing past luckily I never got my self involved in legal things.

hrgiger 6y ago

Sorry for off topic question but are there any dirty link sharing platforms ,that you can share those links safely and warn the user and force it to copy paste?

chadrs 6y ago

I've done stuff like this but behind Tor. I tried to make the data random enough it would be tough to see which records were real. I remember once my IP was getting blocked after a certain amount of requests (not sure if via some automated fail2ban or a human) but Tor has an API to swap to a new outbound IP, so I just had it do that in the case of a timeout.