13 ms·

I was sent one of these SMS today. I usually ignore but today I was in weird mood and started pulling apart the site. Stuff I found: Google is the domain regis

by tomxor 3y ago

I was sent one of these SMS today. I usually ignore but today I was in weird mood and started pulling apart the site. Stuff I found: Google is the domain registrar. (reported) Hotlinked to ups.com images, logos and css... Opportunity for some fun here UPS! (reported) Uses hCaptcha on the landing page. (reported) Nginx server with Plesk, and a plesk login page, no obvious stuff like ssh exposed, all latest versions, I'm not much of sec hacker so I didn't get very far. Started sending malformed and large requests to the credit card processing endpoint to see if I could break it, slowed it down a little, but then the captcha got blocked. Of all of those hCaptcha was the first to respond and act, they've already banned the site's account within 5mins of my email... and this renders the site useless, so here's for hCaptcha! fighting fraud while the behemoths are slow and complicit... I know it's whackamole but it was a little bit of fun.

rtev 3y ago
[flagged]
- tomxor 3y ago
  In Russia, against a website committing credit card fraud while reporting everything to service providers, and actively preventing people from being defrauded?... I really couldn't give a poop, if the USA wants to come prosecute me and aid international fraudsters so be it (if you can even find them).
- valine 3y ago
  It shouldn’t be a crime. If I pull a skimmer off an ATM am I engaging in active measures against someone’s property? How is this any different?
  - morkalork 3y ago
    Theft and vandalism no doubt! /s
  - RockRobotRock 3y ago
    I agree with you but that's a horrible comparison.
  - vuln 3y ago
    What do you do with the skimmer once you pull it off? How do you prove that you’re in felony possession of fraud device? You also would be contaminating a crime scene. Most skimmers have limited memory and are sometimes controlled via Bluetooth. It’s best to leave it to the ones _authorized_ to fiddle with such things. I’m sure your fellow citizens appreciate your gumption though.
- hn_throwaway_99 3y ago
  This is FUD, and saying "This is a confession to a crime, just so you are aware." is really an overly strong statement that is not warranted. Yes, the CFAA is famously lax in what it's definition of "unauthorized access" is, and I know in the past some idiot politicians have tried to prosecute for a journalist clicking "view source" to see the HTML of a webpage, but one shouldn't confuse prosecutorial misconduct for "confessing to a crime". There is nothing in the statement that you are replying to that says that the user actively broke access control.
- walrus01 3y ago
  I don't think anyone should be particularly concerned about "criminal" actions conducted against a httpd/server host platform that's physically in Russia, operated by literal phishing criminals. What is the US going to do, extradite you to Russia for screwing with low-rent russian organized crime? As the other poster says, this is no more morally wrong than pulling a skimming device off an ATM.
- m4jor 3y ago
  That isnt a crime in the US.
- imiric 3y ago
  IANAL, but what's the actual crime in this case? They were doing some exploratory poking around a public system, and at no point did they access a system without authorization. All this information is available to anyone, and malformed requests can happen for many reasons. I suppose intent to gain unauthorized access might be a problem, and I'm sure some lawyer could find a case there.
  - mrguyorama 3y ago
    Intent matters. Sending a malformed request in an attempt to harm could probably be prosecuted. In much the same way that you usually are not allowed to shoot robbers in the street, people who are doing nefarious things but aren't yet convicted of a crime are not "fair targets". Especially when it comes to the CFAA, I don't think there's a concept of self defense. Is it a crime? Arguably. Does anyone care? Nah
m4jor 3y ago
also FYI a lot of places dont place limits on the size of their POST requests or timeouts. I have been able to send scammers 500MB+ POST requests just by making the password field password=888888888888888888888888888888 (etc til its 100s of MB of data). Use a tool like OWASP ZAP or Burp Suite and you can easily slam a scammers website full of 500mb+ requests that will quickly fill up their log files and cheap VPS harddrive and eventually the website will get an hdd full msg or just go offline til they fix it. Cheap and easy way to take their website offline to prevent more people from getting scammed.
- jrockway 3y ago
  I always log requests as "http://example.com/foo/bar/ http://example.com/foo/bar/... [1234 bytes]".
  - thephyber 3y ago
    If a site is designed for scamming, it will likely log the contents of the form submissions -- sensitive fields like username + password combos or other PII.
- gibolt 3y ago
  Even better if they use AWS or other service, and end up with a huge unexpected bill at the end of the month
  - vuln 3y ago
    Eh, the malicious actor would typically be using a compromised or carded account.
    - Scoundreller 3y ago
      Which is another angle to suggest in reports to incentive quick action, because they’re losing money keeping the service up.
    - mancerayder 3y ago
vivekv 3y ago
Thank you
dugite-code 3y ago
> Google is the domain registrar. (reported) I wonder if this is the reason Google is getting rid of it's domain registration service? I imagine this is quite a pain to deal with
- callalex 3y ago
  No, they set up their fraud prevention pipeline before they even launched their registrar. It’s a very expected part of going into that business, and they knew it and handled it well. The product was cancelled because there are huge internal incentives for launching new products, and subtle punishment for teams who perform maintenance.
Scoundreller 3y ago
You can also go after their ssl certificate provider if they have one. Doesn’t always work but it has at least once for me. Unfortunately I’ve also observed a lot of Canadian phishing links will geo-redirect, so reporting them can sometimes go nowhere unless the checker uses the right vpn.
- ghostpepper 3y ago
  They almost all use LetsEncrypt, which has a documented policy of not terminating accounts for spam/fraud.
  - voz_ 3y ago
    Gross. Why?
    - thephyber 3y ago
      They have a published policy that explains it: https://letsencrypt.org/2015/10/29/phishing-and-malware.html https://letsencrypt.org/2015/10/29/phishing-and-malware.html
    - fullspectrumdev 3y ago
      Because it’s not their problem and would set a bad precedent
      - Scoundreller 3y ago
        Their arguments are the same that any other layer involved could use to sit it out. “We shouldn’t be the police, let some layer above or below us be the police, just anyone but us!” What they don’t really say is that an abuse team costs money to run. When self-regulation doesn’t work, you risk ending up with legally-imposed regulation. I’m sure that will really delight them.
        quags 3y ago
dsabanin 3y ago
You are the hero we need.

by tomxor 3y ago

rtev 3y ago

[flagged]

tomxor 3y ago
In Russia, against a website committing credit card fraud while reporting everything to service providers, and actively preventing people from being defrauded?... I really couldn't give a poop, if the USA wants to come prosecute me and aid international fraudsters so be it (if you can even find them).
valine 3y ago
It shouldn’t be a crime. If I pull a skimmer off an ATM am I engaging in active measures against someone’s property? How is this any different?
- morkalork 3y ago
  Theft and vandalism no doubt! /s
- RockRobotRock 3y ago
  I agree with you but that's a horrible comparison.
- vuln 3y ago
  What do you do with the skimmer once you pull it off? How do you prove that you’re in felony possession of fraud device? You also would be contaminating a crime scene. Most skimmers have limited memory and are sometimes controlled via Bluetooth. It’s best to leave it to the ones _authorized_ to fiddle with such things. I’m sure your fellow citizens appreciate your gumption though.
hn_throwaway_99 3y ago
This is FUD, and saying "This is a confession to a crime, just so you are aware." is really an overly strong statement that is not warranted. Yes, the CFAA is famously lax in what it's definition of "unauthorized access" is, and I know in the past some idiot politicians have tried to prosecute for a journalist clicking "view source" to see the HTML of a webpage, but one shouldn't confuse prosecutorial misconduct for "confessing to a crime". There is nothing in the statement that you are replying to that says that the user actively broke access control.
walrus01 3y ago
I don't think anyone should be particularly concerned about "criminal" actions conducted against a httpd/server host platform that's physically in Russia, operated by literal phishing criminals. What is the US going to do, extradite you to Russia for screwing with low-rent russian organized crime? As the other poster says, this is no more morally wrong than pulling a skimming device off an ATM.
m4jor 3y ago
That isnt a crime in the US.
imiric 3y ago
IANAL, but what's the actual crime in this case? They were doing some exploratory poking around a public system, and at no point did they access a system without authorization. All this information is available to anyone, and malformed requests can happen for many reasons. I suppose intent to gain unauthorized access might be a problem, and I'm sure some lawyer could find a case there.
- mrguyorama 3y ago
  Intent matters. Sending a malformed request in an attempt to harm could probably be prosecuted. In much the same way that you usually are not allowed to shoot robbers in the street, people who are doing nefarious things but aren't yet convicted of a crime are not "fair targets". Especially when it comes to the CFAA, I don't think there's a concept of self defense. Is it a crime? Arguably. Does anyone care? Nah

m4jor 3y ago

also FYI a lot of places dont place limits on the size of their POST requests or timeouts. I have been able to send scammers 500MB+ POST requests just by making the password field password=888888888888888888888888888888 (etc til its 100s of MB of data). Use a tool like OWASP ZAP or Burp Suite and you can easily slam a scammers website full of 500mb+ requests that will quickly fill up their log files and cheap VPS harddrive and eventually the website will get an hdd full msg or just go offline til they fix it. Cheap and easy way to take their website offline to prevent more people from getting scammed.

jrockway 3y ago
I always log requests as "http://example.com/foo/bar/ http://example.com/foo/bar/... [1234 bytes]".
- thephyber 3y ago
  If a site is designed for scamming, it will likely log the contents of the form submissions -- sensitive fields like username + password combos or other PII.
gibolt 3y ago
Even better if they use AWS or other service, and end up with a huge unexpected bill at the end of the month
- vuln 3y ago
  Eh, the malicious actor would typically be using a compromised or carded account.
  - Scoundreller 3y ago
    Which is another angle to suggest in reports to incentive quick action, because they’re losing money keeping the service up.
  - mancerayder 3y ago

vivekv 3y ago

Thank you

dugite-code 3y ago

> Google is the domain registrar. (reported) I wonder if this is the reason Google is getting rid of it's domain registration service? I imagine this is quite a pain to deal with

callalex 3y ago
No, they set up their fraud prevention pipeline before they even launched their registrar. It’s a very expected part of going into that business, and they knew it and handled it well. The product was cancelled because there are huge internal incentives for launching new products, and subtle punishment for teams who perform maintenance.

Scoundreller 3y ago

You can also go after their ssl certificate provider if they have one. Doesn’t always work but it has at least once for me. Unfortunately I’ve also observed a lot of Canadian phishing links will geo-redirect, so reporting them can sometimes go nowhere unless the checker uses the right vpn.

ghostpepper 3y ago
They almost all use LetsEncrypt, which has a documented policy of not terminating accounts for spam/fraud.
- voz_ 3y ago
  Gross. Why?
  - thephyber 3y ago
    They have a published policy that explains it: https://letsencrypt.org/2015/10/29/phishing-and-malware.html https://letsencrypt.org/2015/10/29/phishing-and-malware.html
  - fullspectrumdev 3y ago
    Because it’s not their problem and would set a bad precedent
    - Scoundreller 3y ago
      Their arguments are the same that any other layer involved could use to sit it out. “We shouldn’t be the police, let some layer above or below us be the police, just anyone but us!” What they don’t really say is that an abuse team costs money to run. When self-regulation doesn’t work, you risk ending up with legally-imposed regulation. I’m sure that will really delight them.
      - quags 3y ago

dsabanin 3y ago

You are the hero we need.