4 ms·

I brought down a scamming operation with 15 bytes of PHP

46 points by _yyku 3y ago

jacquesm 3y ago
This is funny but: you are breaking the law and this could backfire spectacularly.
- quickthrower2 3y ago
  Agreed. Vigilantism is no defence.
- _yyku 3y ago
  Author here. I did wrong. And I'm sorry I didn't stay on the right side of the law. I advise against doing the thing I did. I know it can be found on archive.org. I removed the post so people don't follow it for "guidance" on how to break the law. Sorry to everyone. I wish I could remove this post from hacker news. It is a dark page for me today.
namanyayg 3y ago
Hilarious. Did you find out how their scam actually worked? Are they just harvesting user credentials of those who sign up and then later trying to hack the accounts?
- stop50 3y ago
  I think an certain youtuber would have loved that shell access to make a video about it
- _yyku 3y ago
  They harvest username, email and passwords from users (If someone not too tech savvy uses the same email/password combination for more than one service they can access their accounts). The main function of this scam campaign is to steal "gas fees" money (no actual minting involved, looked at the code). They ask 0.15 ETH for each entry. In my case they could've got something around 6000$. There are people that have fallen for this scam.
vntok 3y ago
> I brought down a scamming operation This seems like clickbait. Being told your server's Apache config has been deleted and you need to recreate it is barely an inconvenience for a scammer whose operation probably brings home much more cash than the hour it will take them to get back to normal ops... Why would you even tell them what you did to their server in the first place?
- yellow_lead 3y ago
  Yeah you need to install a rootkit or something more persistent.
- dewey 3y ago
  > for a scammer whose operation probably brings home much more cash There's probably a very long tail of scamming operations that are only profitable because the operator is in a country with very low cost of living. Based on the short list of domains on the server, it might not be the biggest operation.
- _yyku 3y ago
  Author here. I did wrong. And I'm sorry I didn't stay on the right side of the law. I advise against doing the thing I did. I know it can be found on archive.org. I removed the post so people don't follow it for "guidance" on how to break the law. Sorry to everyone. I wish I could remove this post from hacker news. It is a dark page for me today.
gnfargbl 3y ago
This is well-meant, but the author seems to be based in Italy, and this is illegal in Italy [1]. I know how tempting it is to retaliate against these people, but you have to stay on the right side of the law. If you choose not to stay on the right side of the law, then at a minimum you really should avoid blogging about your crimes. [1] https://iclg.com/practice-areas/cybersecurity-laws-and-regulations/italy https://iclg.com/practice-areas/cybersecurity-laws-and-regul...
- psiops 3y ago
  I think he took the hint and removed the post.
  - ta1243 3y ago
    The internet rarely forgets though https://web.archive.org/web/20230907091046/https://www.eliseomartelli.it/blog/2023-09-06-scammer https://web.archive.org/web/20230907091046/https://www.elise...
  - deleted 3y ago
    [deleted]
- _yyku 3y ago
  Author here. I did wrong. And I'm sorry I didn't stay on the right side of the law. I advise against doing the thing I did. I know it can be found on archive.org. I removed the post so people don't follow it for "guidance" on how to break the law. Sorry to everyone. I wish I could remove this post from hacker news. It is a dark page for me today.
  - gnfargbl 3y ago
    FWIW, I don't think you should worry too much. I'm not at all familiar with the Italian justice system, but it's hard to imagine that anyone is going to investigate this case unless the injured party complains -- which they aren't going to do, because they were committing a crime themselves at the time. Just let this post drop away, learn from it, move on. Don't let it spoil your day.
lemper 3y ago
where should I contact Italian authority? there's this malicious person who damages other people's property without legal justification.
- Etheryte 3y ago
  Quick, someone is jaywalking, call the police!
  - ta1243 3y ago
    Apparently such an odd "crime" (banning people from walking in a public place) exists in some countries, where is seems you will have half a dozen armed police officers wrestle you to the ground for such an action. http://news.bbc.co.uk/1/hi/6251431.stm http://news.bbc.co.uk/1/hi/6251431.stm
    - jraph 3y ago
      > half a dozen armed police officers wrestle you to the ground or being kept in a cell for 8 hours for jaywalking is crazy. Now I jaywalk all the time, but let's not call it simply "walking in a public place". It has safety implication. It's dangerous for you, and it can also endanger / have severe implications on other people who haven't asked anything. Road safety is no joke and should not be taken lightly.
      - ta1243 3y ago
        The burden is on the person operating 2 tons of machinery in a way that can kill someone If your assertion that walking along/across the road is dangerous, how come pedestrian deaths in the US where such things are illegal are 22 per million population per year, and in the UK where such things are perfectly legal outside of a small number of dedicated roads is just 5 per million population. Perhaps the problem is the culture which puts cars above people.
        jraph 3y ago
pmontra 3y ago
Sending a mockery video with one's own name takes some courage. Some criminal organizations could find where he lives and ring his bell. The page went 404 while I was writing this comment.
deleted 3y ago
[deleted]
GRBLDeveloped 3y ago
Seems the comments about being illegal have gotten to the author, content not found 52 minutes from posting.
gumballindie 3y ago
Ah yes, a classic remote file inclusion exploit. Nothing new, but fun to see in the wild as of 2023.
- _yyku 3y ago
  Author here. I did wrong. And I'm sorry I didn't stay on the right side of the law. I advise against doing the thing I did. I know it can be found on archive.org. I removed the post so people don't follow it for "guidance" on how to break the law. Sorry to everyone. I wish I could remove this post from hacker news. It is a dark page for me today.
  - gumballindie 3y ago
    > Author here. I did wrong. And I'm sorry I didn't stay on the right side of the law. Oh I don't care frankly. I know it's not the right thing to do, but I am refering strictly to the technical content of the blog. I am not a judge nor do I plan becoming one. I would notify the domain owners about issues in their websites, but I am not a lawyer and I don't know the implications of it.
mowthie 3y ago
Well, I am no member of law enforcement organisation, but I was really hoping to read that. Does anyone have a copy, by chance?
- _yyku 3y ago
  Author here. I did wrong. And I'm sorry I didn't stay on the right side of the law. I advise against doing the thing I did. I know it can be found on archive.org. I removed the post so people don't follow it for "guidance" on how to break the law. Sorry to everyone. I wish I could remove this post from hacker news. It is a dark page for me today.
- comprev 3y ago
  see elsewhere in this thread for Internet Archive copy
- hurutparittya 3y ago
  https://archive.vn/hhn6C https://archive.vn/hhn6C
mrtksn 3y ago
Removing the Apache config was a bit anticlimactic considering that the thing the OP did is illegal itself. If you are after a vigilante justice, I would suggest doing something substantial like exposing the identities or tipping of the authorities and most importantly: don't reveal your own identity. Back in the day when the internet was mostly a lawless place you could have done something like that and recoup the clout and be the hero of the people but that's not the case anymore.
- _yyku 3y ago
  Author here. I did wrong. And I'm sorry I didn't stay on the right side of the law. I advise against doing the thing I did. I know it can be found on archive.org. I removed the post so people don't follow it for "guidance" on how to break the law. Sorry to everyone. I wish I could remove this post from hacker news. It is a dark page for me today.
  - mrtksn 3y ago
    You probably will be fine but you are risking yourself. I'm not anti-vigilante, its always fun to read about people going after the scammers but the clout of it isn't worth advertising it with your real identity.

46 points by _yyku 3y ago

jacquesm 3y ago

This is funny but: you are breaking the law and this could backfire spectacularly.

quickthrower2 3y ago
Agreed. Vigilantism is no defence.
_yyku 3y ago
Author here. I did wrong. And I'm sorry I didn't stay on the right side of the law. I advise against doing the thing I did. I know it can be found on archive.org. I removed the post so people don't follow it for "guidance" on how to break the law. Sorry to everyone. I wish I could remove this post from hacker news. It is a dark page for me today.

namanyayg 3y ago

Hilarious. Did you find out how their scam actually worked? Are they just harvesting user credentials of those who sign up and then later trying to hack the accounts?

stop50 3y ago
I think an certain youtuber would have loved that shell access to make a video about it
_yyku 3y ago
They harvest username, email and passwords from users (If someone not too tech savvy uses the same email/password combination for more than one service they can access their accounts). The main function of this scam campaign is to steal "gas fees" money (no actual minting involved, looked at the code). They ask 0.15 ETH for each entry. In my case they could've got something around 6000$. There are people that have fallen for this scam.

vntok 3y ago

> I brought down a scamming operation This seems like clickbait. Being told your server's Apache config has been deleted and you need to recreate it is barely an inconvenience for a scammer whose operation probably brings home much more cash than the hour it will take them to get back to normal ops... Why would you even tell them what you did to their server in the first place?

yellow_lead 3y ago
Yeah you need to install a rootkit or something more persistent.
dewey 3y ago
> for a scammer whose operation probably brings home much more cash There's probably a very long tail of scamming operations that are only profitable because the operator is in a country with very low cost of living. Based on the short list of domains on the server, it might not be the biggest operation.
_yyku 3y ago
Author here. I did wrong. And I'm sorry I didn't stay on the right side of the law. I advise against doing the thing I did. I know it can be found on archive.org. I removed the post so people don't follow it for "guidance" on how to break the law. Sorry to everyone. I wish I could remove this post from hacker news. It is a dark page for me today.

gnfargbl 3y ago

This is well-meant, but the author seems to be based in Italy, and this is illegal in Italy [1]. I know how tempting it is to retaliate against these people, but you have to stay on the right side of the law. If you choose not to stay on the right side of the law, then at a minimum you really should avoid blogging about your crimes. [1] https://iclg.com/practice-areas/cybersecurity-laws-and-regulations/italy https://iclg.com/practice-areas/cybersecurity-laws-and-regul...

psiops 3y ago
I think he took the hint and removed the post.
- ta1243 3y ago
  The internet rarely forgets though https://web.archive.org/web/20230907091046/https://www.eliseomartelli.it/blog/2023-09-06-scammer https://web.archive.org/web/20230907091046/https://www.elise...
- deleted 3y ago
  [deleted]
_yyku 3y ago
Author here. I did wrong. And I'm sorry I didn't stay on the right side of the law. I advise against doing the thing I did. I know it can be found on archive.org. I removed the post so people don't follow it for "guidance" on how to break the law. Sorry to everyone. I wish I could remove this post from hacker news. It is a dark page for me today.
- gnfargbl 3y ago
  FWIW, I don't think you should worry too much. I'm not at all familiar with the Italian justice system, but it's hard to imagine that anyone is going to investigate this case unless the injured party complains -- which they aren't going to do, because they were committing a crime themselves at the time. Just let this post drop away, learn from it, move on. Don't let it spoil your day.

lemper 3y ago

where should I contact Italian authority? there's this malicious person who damages other people's property without legal justification.

Etheryte 3y ago
Quick, someone is jaywalking, call the police!
- ta1243 3y ago
  Apparently such an odd "crime" (banning people from walking in a public place) exists in some countries, where is seems you will have half a dozen armed police officers wrestle you to the ground for such an action. http://news.bbc.co.uk/1/hi/6251431.stm http://news.bbc.co.uk/1/hi/6251431.stm
  - jraph 3y ago
    > half a dozen armed police officers wrestle you to the ground or being kept in a cell for 8 hours for jaywalking is crazy. Now I jaywalk all the time, but let's not call it simply "walking in a public place". It has safety implication. It's dangerous for you, and it can also endanger / have severe implications on other people who haven't asked anything. Road safety is no joke and should not be taken lightly.
    - ta1243 3y ago
      The burden is on the person operating 2 tons of machinery in a way that can kill someone If your assertion that walking along/across the road is dangerous, how come pedestrian deaths in the US where such things are illegal are 22 per million population per year, and in the UK where such things are perfectly legal outside of a small number of dedicated roads is just 5 per million population. Perhaps the problem is the culture which puts cars above people.
      - jraph 3y ago

pmontra 3y ago

Sending a mockery video with one's own name takes some courage. Some criminal organizations could find where he lives and ring his bell. The page went 404 while I was writing this comment.

deleted 3y ago

[deleted]

GRBLDeveloped 3y ago

Seems the comments about being illegal have gotten to the author, content not found 52 minutes from posting.

gumballindie 3y ago

Ah yes, a classic remote file inclusion exploit. Nothing new, but fun to see in the wild as of 2023.

_yyku 3y ago
Author here. I did wrong. And I'm sorry I didn't stay on the right side of the law. I advise against doing the thing I did. I know it can be found on archive.org. I removed the post so people don't follow it for "guidance" on how to break the law. Sorry to everyone. I wish I could remove this post from hacker news. It is a dark page for me today.
- gumballindie 3y ago
  > Author here. I did wrong. And I'm sorry I didn't stay on the right side of the law. Oh I don't care frankly. I know it's not the right thing to do, but I am refering strictly to the technical content of the blog. I am not a judge nor do I plan becoming one. I would notify the domain owners about issues in their websites, but I am not a lawyer and I don't know the implications of it.

mowthie 3y ago

Well, I am no member of law enforcement organisation, but I was really hoping to read that. Does anyone have a copy, by chance?

_yyku 3y ago
Author here. I did wrong. And I'm sorry I didn't stay on the right side of the law. I advise against doing the thing I did. I know it can be found on archive.org. I removed the post so people don't follow it for "guidance" on how to break the law. Sorry to everyone. I wish I could remove this post from hacker news. It is a dark page for me today.
comprev 3y ago
see elsewhere in this thread for Internet Archive copy
hurutparittya 3y ago
https://archive.vn/hhn6C https://archive.vn/hhn6C

mrtksn 3y ago

Removing the Apache config was a bit anticlimactic considering that the thing the OP did is illegal itself. If you are after a vigilante justice, I would suggest doing something substantial like exposing the identities or tipping of the authorities and most importantly: don't reveal your own identity. Back in the day when the internet was mostly a lawless place you could have done something like that and recoup the clout and be the hero of the people but that's not the case anymore.

_yyku 3y ago
Author here. I did wrong. And I'm sorry I didn't stay on the right side of the law. I advise against doing the thing I did. I know it can be found on archive.org. I removed the post so people don't follow it for "guidance" on how to break the law. Sorry to everyone. I wish I could remove this post from hacker news. It is a dark page for me today.
- mrtksn 3y ago
  You probably will be fine but you are risking yourself. I'm not anti-vigilante, its always fun to read about people going after the scammers but the clout of it isn't worth advertising it with your real identity.