6 ms·

As much as I think things like this can be fun, depending on your jurisdiction (and tbh the US loves extraditing people for silly computer crimes), it might not

As much as I think things like this can be fun, depending on your jurisdiction (and tbh the US loves extraditing people for silly computer crimes), it might not be advisable. This is all but certainly illegal at least within the US. I’m sure most competent security experts have been tempted to do things like this, or SQLi a scammer’s form and nuke their DB, and usually bad things won’t happen to you, you might find that you’re hacking something you weren’t expecting, and might piss someone off other than a scammer.

darkwater 6y ago
How can it be illegal sending a few fake data to a website? And anyway I doubt they will ever sue you, at most you could be targeted for some revenge attack if they are really pissed off and you don't hide your traces.
- StreamBright 6y ago
  This can be classified as denial of service attack because of the rate your are sending the requests. Depends on the law (and on the interpretation as well). I doubt that the phising guys behind this will file a complaint though.
  - socket0 6y ago
    Many phishing pages reside on compromised domains. Bob's Plumbing Supplies might wonder why their Wordpress site loaded with plug-ins has stopped working, ask someone to take a look, and see your IP address all over the logs.
    - berkes 6y ago
      Or the webhost where Bob's Plumbing Supplies is hosted detects an attack and files a complain. Or the SAAS/server rental sees this, puts you on some automatic blacklist and puts in on the "to be investigated" blacklist. Too many parties involved whom you are "hurting" that might get back to you. Not saying this to keep anyone from repeating this, though; just that when doing so, keep in mind that you're probably not just hurting a scammer alone.
    - pbhjpbhj 6y ago
      If you're messing with criminals using an IP traceable to you then the police might be the least of your problems.
  - darkwater 6y ago
    To poison some phishing data you don't need to overload any server. Although the act itself of poisoning data could be seen as a DoS but since the service in question is an illegal one IANAL but I don't think it would stand in court.
    - StreamBright 6y ago
      It is very important to understand this from the legal stand point. If you overload a legitimate or illegitimate service you might commit a crime (depending on the country). I can give you a simple example of this in a different context. In our country you cannot go after the criminal who committed the crime and cannot cause them harm. Few years back a lady got robbed by two guys on a motorbike and she went after them and hit the motorbike with her car. She was prosecuted for assault. This is a very similar situation here. Again, depending on your country, state etc. this _might_ be a bad idea.
      - darkwater 6y ago
        I see your point but anyway I think that phishers hardly will sue you for poisoning their data, because you probably just uncovered one phishing campaign but they run tens of them. Putting Justice in the loop would be much riskier for them, I believe.
- noodlesUK 6y ago
  IANAL: This is what I expect the relevant text in the CFAA is... knowingly causes the transmission of a program, information, code, or command, and as a result of such conduct, intentionally causes damage without authorization, to a protected computer;
  - deleted 6y ago
    [deleted]
  - mirekrusin 6y ago
    Is it a damage if you damage damaging thing? If effect of your damage is less damage maybe it's not damage after all?
    - Sebb767 6y ago
      > Is it a damage if you damage damaging thing? When in doubt - yes. It's the same reasoning forbidding you from shooting criminals in the street, you'd just open up mob justice. Of course, this is a pretty clear cut case and you might argue that this is an emergency (as people are clearly in danger of being scammed unless you act right now), but overall this is a very blurry line.
    - eitland 6y ago
      Depends: around here you can break into a shop at night to put out a fire or - more realistically - break a car window to pull out a kid (or animal) left alone in the sun. I'd be careful with computer crimes on the Internet though.
      - woko 6y ago
        > I'd be careful with computer crimes on the Internet though. Exactly. Let us say you break into a shop owned by some mafia to put out a fire, then you might be fine w.r.t. authority, but you might be in trouble w.r.t. criminals. Similarly, say you break a car window to pull out a pit-bull left alone in the sun, you might have some issues with the owner if he turns out to be part of some drug trafficking gang. There is no reason to believe that phishing websites are run by script-kiddies, there are obviously criminal rings running all sorts of businesses on the Internet too. I would rather leave the work to the authorities rather than risk going through trouble with unknown criminals, just so that I could have my funny revenge over them.
mcv 6y ago
While it may be technically illegal, considering the victims are themselves worse criminals caught in the act, I really doubt anyone is going to give you trouble over this. Unless authorities are looking for an excuse to prosecute you, of course, but there's plenty of bad PR to be had for authorities acting on behalf of criminals trying to steal people's banking credentials.
- weinzierl 6y ago
  > While it may be technically illegal, considering the victims are themselves worse criminals caught in the act, I really doubt anyone is going to give you trouble over this. Depends on who you fear more: law enforcement or organized crime.
  - deleted 6y ago
    [deleted]
  - TheAdamAndChe 6y ago
    The comment you replied to did say "Unless authorities are looking for an excuse to prosecute you, of course." If you suspect you're being monitored by the FBI or some other entity, you don't want to push the envelope.
    - mcv 6y ago
      O think weinzierl suggests that the criminals behind this might be more eager to punish you than law enforcement. But of course for that it doesn't really matter whether or not this is legal.
- shitloadofbooks 6y ago
  VPS owners will if your flooding causes issues for their (other) clients on the same hardware, etc. It's definitely better to not do this.
- KMag 6y ago
  Maybe if you don't cause any collateral damage, you might have a low chance of conviction by a jury because the victim is highly non-sympathetic. (I'm not a lawyer. This is NOT LEGAL ADVICE.) That doesn't mean you won't get charged and incur a ton of legal costs if you pursue a jury trial rather than settling. Always remember that U.S. courts are courts of law, not courts of justice. That's usually a good thing (less left to interpretation), but it does have downsides.
pantalaimon 6y ago
What do you think the scammers are going to do, call the police?
- bartvk 6y ago
  I have a colleague who is a security researcher. And every now and then, he tells me he got a threat from an internet criminal about "how they know where he lives".
- macNchz 6y ago
  They presumably wouldn't call the police to report you for messing with their scam, but it's not unthinkable–if they're able to identify who you are–that they could SWAT you. I believe Brian Krebs has been SWAT'ed multiple times, and has had heroin mailed to his house to frame him.

darkwater 6y ago

How can it be illegal sending a few fake data to a website? And anyway I doubt they will ever sue you, at most you could be targeted for some revenge attack if they are really pissed off and you don't hide your traces.

StreamBright 6y ago
This can be classified as denial of service attack because of the rate your are sending the requests. Depends on the law (and on the interpretation as well). I doubt that the phising guys behind this will file a complaint though.
- socket0 6y ago
  Many phishing pages reside on compromised domains. Bob's Plumbing Supplies might wonder why their Wordpress site loaded with plug-ins has stopped working, ask someone to take a look, and see your IP address all over the logs.
  - berkes 6y ago
    Or the webhost where Bob's Plumbing Supplies is hosted detects an attack and files a complain. Or the SAAS/server rental sees this, puts you on some automatic blacklist and puts in on the "to be investigated" blacklist. Too many parties involved whom you are "hurting" that might get back to you. Not saying this to keep anyone from repeating this, though; just that when doing so, keep in mind that you're probably not just hurting a scammer alone.
  - pbhjpbhj 6y ago
    If you're messing with criminals using an IP traceable to you then the police might be the least of your problems.
- darkwater 6y ago
  To poison some phishing data you don't need to overload any server. Although the act itself of poisoning data could be seen as a DoS but since the service in question is an illegal one IANAL but I don't think it would stand in court.
  - StreamBright 6y ago
    It is very important to understand this from the legal stand point. If you overload a legitimate or illegitimate service you might commit a crime (depending on the country). I can give you a simple example of this in a different context. In our country you cannot go after the criminal who committed the crime and cannot cause them harm. Few years back a lady got robbed by two guys on a motorbike and she went after them and hit the motorbike with her car. She was prosecuted for assault. This is a very similar situation here. Again, depending on your country, state etc. this _might_ be a bad idea.
    - darkwater 6y ago
      I see your point but anyway I think that phishers hardly will sue you for poisoning their data, because you probably just uncovered one phishing campaign but they run tens of them. Putting Justice in the loop would be much riskier for them, I believe.
noodlesUK 6y ago
IANAL: This is what I expect the relevant text in the CFAA is... knowingly causes the transmission of a program, information, code, or command, and as a result of such conduct, intentionally causes damage without authorization, to a protected computer;
- deleted 6y ago
  [deleted]
- mirekrusin 6y ago
  Is it a damage if you damage damaging thing? If effect of your damage is less damage maybe it's not damage after all?
  - Sebb767 6y ago
    > Is it a damage if you damage damaging thing? When in doubt - yes. It's the same reasoning forbidding you from shooting criminals in the street, you'd just open up mob justice. Of course, this is a pretty clear cut case and you might argue that this is an emergency (as people are clearly in danger of being scammed unless you act right now), but overall this is a very blurry line.
  - eitland 6y ago
    Depends: around here you can break into a shop at night to put out a fire or - more realistically - break a car window to pull out a kid (or animal) left alone in the sun. I'd be careful with computer crimes on the Internet though.
    - woko 6y ago
      > I'd be careful with computer crimes on the Internet though. Exactly. Let us say you break into a shop owned by some mafia to put out a fire, then you might be fine w.r.t. authority, but you might be in trouble w.r.t. criminals. Similarly, say you break a car window to pull out a pit-bull left alone in the sun, you might have some issues with the owner if he turns out to be part of some drug trafficking gang. There is no reason to believe that phishing websites are run by script-kiddies, there are obviously criminal rings running all sorts of businesses on the Internet too. I would rather leave the work to the authorities rather than risk going through trouble with unknown criminals, just so that I could have my funny revenge over them.

mcv 6y ago

While it may be technically illegal, considering the victims are themselves worse criminals caught in the act, I really doubt anyone is going to give you trouble over this. Unless authorities are looking for an excuse to prosecute you, of course, but there's plenty of bad PR to be had for authorities acting on behalf of criminals trying to steal people's banking credentials.

weinzierl 6y ago
> While it may be technically illegal, considering the victims are themselves worse criminals caught in the act, I really doubt anyone is going to give you trouble over this. Depends on who you fear more: law enforcement or organized crime.
- deleted 6y ago
  [deleted]
- TheAdamAndChe 6y ago
  The comment you replied to did say "Unless authorities are looking for an excuse to prosecute you, of course." If you suspect you're being monitored by the FBI or some other entity, you don't want to push the envelope.
  - mcv 6y ago
    O think weinzierl suggests that the criminals behind this might be more eager to punish you than law enforcement. But of course for that it doesn't really matter whether or not this is legal.
shitloadofbooks 6y ago
VPS owners will if your flooding causes issues for their (other) clients on the same hardware, etc. It's definitely better to not do this.
KMag 6y ago
Maybe if you don't cause any collateral damage, you might have a low chance of conviction by a jury because the victim is highly non-sympathetic. (I'm not a lawyer. This is NOT LEGAL ADVICE.) That doesn't mean you won't get charged and incur a ton of legal costs if you pursue a jury trial rather than settling. Always remember that U.S. courts are courts of law, not courts of justice. That's usually a good thing (less left to interpretation), but it does have downsides.

pantalaimon 6y ago

What do you think the scammers are going to do, call the police?

bartvk 6y ago
I have a colleague who is a security researcher. And every now and then, he tells me he got a threat from an internet criminal about "how they know where he lives".
macNchz 6y ago
They presumably wouldn't call the police to report you for messing with their scam, but it's not unthinkable–if they're able to identify who you are–that they could SWAT you. I believe Brian Krebs has been SWAT'ed multiple times, and has had heroin mailed to his house to frame him.