Slashdot Log In
Phishing Group Caught Stealing From Other Phishers
Posted by
samzenpus
on Wed Jan 23, 2008 08:58 PM
from the what's-good-for-the-goose dept.
from the what's-good-for-the-goose dept.
An anonymous reader writes "Netcraft has written about a website offering free phishing kits with one ironic twist — they all contain backdoors to steal stolen credentials from the fraudsters that deploy them.
Deliberately deceptive code inside the kits means that script kiddies are unlikely to realize that any captured credit card numbers also end up getting sent to the people who made the phishing kits. The same group was also responsible for another backdoored phishing kit used against Bank of America earlier this month."
Related Stories
Submission: Phishing group caught stealing from other phishers by Anonymous Coward
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
How times have changed: you can't trust.....wait! (Score:3, Interesting)
Re:How times have changed: you can't trust.....wai (Score:5, Interesting)
Parent
Re:How times have changed: you can't trust.....wai (Score:5, Insightful)
Parent
Re: (Score:3, Interesting)
It really does not matter how much is fraudulantly charged on my credit card. I am not responsible for either amount.
Looking at the larger picture, I want as small amount of fraud as possible because the cost of goods will be cheaper. Somebody has to recoup that $4000 or $8000 in your example, but what happens, everyone pays for fraud, but spread o
Re: (Score:3, Insightful)
That doesn't keep ID theft from happening. Someone gets your SSN and opens up an account in your name, you're screwed anyway.
Just do what I did, open up a bunch of cards, bury yourself, get bad credit. You can't
Re:How times have changed: you can't trust.....wai (Score:4, Insightful)
Parent
Re: (Score:2, Funny)
Re: (Score:3, Interesting)
Exactly, in the chat rooms the criminals are far more worried about each other than the forces of law and order. OK they are concerned that the person might be from a security company (our guys) or a police officer. But they are rather more angry about 'rippers' -criminals who take the money but never deliver the goods or
Re:How times have changed: you can't trust.....wai (Score:5, Insightful)
Personally, I still want to see financial institutions implement a system where you can get trojan account numbers to give to the phishers that appear just like real numbers. If the phisher uses them, immediately the institution knows to look for fraudulent activity from that source. Then everyone receiving this spam can provide so many bad account numbers that phishing is very difficult to do without drawing attention to yourself.
Parent
Re: (Score:3, Interesting)
Re: (Score:2)
Re:How times have changed: you can't trust.....wai (Score:5, Interesting)
One of my ATM cards has 2 different pin numbers. If I use the alternative one, the transaction is completed normally (so no one on the spot gets wiser), but the institution will flag it and notify the police at once, providing my identity and location. I have to pay a little extra for eat (about US$ 3/month), but it is well worth it. It is considered (and marketed as) an insurance. I have this since 1996, and I'm happy to say I never needed.
So yes, the banks know this kind of thing can be done. I wonder why other institutions don't do it or even why this is not mandatory for all cards.
I really don't mind the extra US$ 3/month for this service.
Parent
Re:How times have changed: you can't trust.....wai (Score:4, Informative)
Parent
Re: (Score:3)
Re: (Score:2)
In the case of palindromic codes, just flip them inside out. i.e. 1221 becomes 2112.
Re: (Score:2)
Re: (Score:3, Informative)
Re: (Score:2)
This isn't the same... (Score:4, Insightful)
Parent
Re: (Score:2)
Re:How times have changed: you can't trust.....wai (Score:2)
I read an even better possibility into this. What if the kit was released by VISA/Master card, Discover, and American Express. They would have a front line into shutting down stolen card numbers, canceling cards and getting great data including IP addresses. Working with merchants, they could follow the canceled sales for a great bust of the ring. Brilliant if true.
Share (Score:4, Funny)
If they reall wanted to do it right, they could just pool all their resources and split the rewards. They could even invite others to join in, with a BotNet@Home project. Lend your computer to the BotNet, and get a prorated share of the take from stolen credit cards credited to your PayPal account.
Re: (Score:3, Funny)
Re: (Score:2)
In soviet russia... (Score:5, Funny)
Re: (Score:2, Funny)
Not so hard...
Proverb (Score:5, Funny)
Give a man a phishing kit and you take advantage of him for a lifetime.
(of course by "man" we mean spotty-faced script kiddie, and by "lifetime" we mean until he wipes his harddisk, but proverbs are meant to be pithy and brief, not accurate.)
Re: (Score:2)
I wish it were possible to zoom in... (Score:2)
Naturally Netcraft won't tell you the real site name
Re: (Score:3, Funny)
Re:I wish it were possible to zoom in... (Score:5, Informative)
However, Google is your friend. Within 30 seconds of looking over the Netcraft article for helpfully unique strings, I found it. And went looking with lynx
They've got ready-rolled scams for abbey.co.uk, bankofamerica.com, cahoot.co.uk, chase.com, egold.com, ebay.com, hsbc,co.uk, lloydstsb.com, moneybookers.com, nationwide.co.uk, nbk.com.kw, paypal.com, regions.com, stgeorge.com.au, wachovia.com and westernunion.com - and in some cases, they have more than one for particular organisations.
Cool. Now who has a spare botnet, is willing to wade through this arsehole's source, and is willing to send garbage values to al-brain@hotmail.fr and albrain08@yahoo.fr?
Parent
Re: (Score:2)
All the e-mail formatting seems to come from the "Mr-Brain.php" file. I'm not sure about how this Mr-Brain character licenses his software, but I figure it is some form of creative commons or (L)GPL, so I should be fine with attribution. So: the following source code was created by Mr-Brain and last updated 2008-Jan-07. If you would like to contact him, please send an e-mail to al-brain@hotmail.fr [mailto] or albrain08@yahoo.fr [mailto].
Never mind, I ran into the lameness filter of Slashdot for this guy's sourc
The real backdoor email address... (Score:2, Informative)
Looking at the code more carefully you'll see..
details.php includes this in the phishing page form:
logon.php has these lines of code:
$d="details.php";
$erorr=file_get_contents($d);
$IP=pack("H
Re: (Score:2)
I would hope that would be the security guys at abbey.co.uk, bankofamerica.com, cahoot.co.uk, chase.com, egold.com, ebay.com, hsbc,co.uk, lloydstsb.com, moneybookers.com, nationwide.co.uk, nbk.com.kw, paypal.com, regions.com, stgeorge.com.au, wachovia.com and westernunion.com.
All they have to do is send some trogan card numbers that "w
Re: (Score:2)
Mr-Brain's site (Score:5, Informative)
This is really sad.. (Score:5, Interesting)
Really though, this is nothing new. IIRC, some builds of Sub7 [wikipedia.org] had a reverse backdoor (not covered in the wiki article), as well as a master password that let the Sub7 crew take over a server (covered by the wiki article), and some builds even included hard drive killer when the master password was in use.
Re: (Score:2)
Nuke the phishers (Score:4, Insightful)
It reminds me of the ol' days on instant messaging when people would pass around a supposed 'Nuke' program that would allow them to reboot people's computers, only to discover that their own computer crashed soon after.
Re:Nuke the phishers (Score:5, Informative)
The law, mostly. It's just as illegal for someone to make "counter-malware" to break into a computer uninvited as it is for anyone else to make malicious software that breaks in.
Parent
Just what is stopping law enforcement? (Score:4, Interesting)
Isn't it trivial for a government agency like the FBI or Treasury to track payments charged to any kind of electronic banking back to the recipient? Wouldn't an investigation "following the money" ultimately lead you to either the thief or at least greatly disrupt his activities? At a minimum it would expose the people that made their transactions work (banks, hosting companies, other otherwise "normal" business people).
A couple of decent RICO prosecutions and you would drive this stuff out of the United States and greatly reduce the scale of it.
But it never happens, and I can only think that somehow the government has somehow turned these people into some espionage rabbit hole and high level prosecutions would disrupt intelligence gathering. Because there is little reason the government couldn't do something about it if they wanted to.
Parent
Re:Just what is stopping law enforcement? (Score:5, Informative)
For the most part, these have been made federal crimes, even to the extent of superseding existing state laws. A few years ago, several states had passed fairly strong anti-spam laws. If someone violated the law, you could file against them in your local small claims court, and secure a guaranteed judgement (good luck collecting, but that's another story) if they didn't show. Slashdot regular Bennett Haselton made boilerplate of that process, as I recall. Then along came CAN-SPAM, which created huge loopholes and essentially declared that individual state laws about spam, if less tolerant than the federal statute, were no longer enforceable.
So now it's up to the feds to prosecute spammers, phishers, and other ill-willed malfeasants. Most of the time, the feds have better things to worry about, and unless you personally can prove tens of thousands in damages, they're unlikely to raise an eyebrow. You do remember how the FBI's last few technology initiatives turned out, right? The penultimate example being "Virtual Case File," a/k/a "Virtual Money Sink." What amounts to a data warehouse with a client app to query it, $200 million later and it's scrapped. Two hundred MILLION dollars down the drain on a failed initiative to, in essence, secure some data feeds, create some transformations, and develop a GUI to query the whole shebang. You really expect these guys to track down John Dodrescu in Romania who's spoofing a Bank of America website on some zombie PCs in Italy, oh wait, that was 10 minutes ago before the TTL on the DNS expired, now it's some zombie PCs in France?
Give me, a non-gov IT professional, a team of 10 people of my choosing, fund me with one single million dollars and some travel vouchers, and agree to keep the project going for one year. A lot of these assholes will be out of business inside of 6 months, with many of their contemporaries scared shitless of becoming the next statistic. No fatalities, just a lot of people behind bars. But the federal government doesn't work that way because as many of us are well aware, it isn't profitable to run an IT department. They'd rather hire 1,000 guys who may or may not be able to tell you which of (XM|XP|XTC) is a version of Windows, at $50K a year apiece, then bitch and moan that they can't stop the problem with $50mil so they can justify a bigger budget next year.
America is spending more money per day in Iraq than it would take to adequately investigate, build cases against, and convict all of the prolific spammers in the entire world.
No, I don't often wonder why these problems haven't been solved. The federal government has been tasked with solving them, and that's all the why I need.
Parent
Re: (Score:2)
Without actually getting money, you could use the bots to order things on the internet and get them shipped to a large apt building or your 90 year old neighbor who can't get up to answer the door.
When I worked for a mail-order sports store, there were zipcodes that they wouldn't deliver to because of fraud.
Re: (Score:2)
Are law enforcement actually interested in persuing these kind of criminals in the first place?
Phishing... (Score:4, Interesting)
Reminds me of a Star Wars quote... (Score:2)
funny (Score:3, Funny)
Customer support is available... (Score:2)
Re: (Score:2)
Re:Script kiddies? (Score:4, Interesting)
From Wikipedia [wikipedia.org]:
In hacker culture, a script kiddie (occasionally script bunny, skidie, script kitty, script-running juvenile (SRJ), or similar) is a derogatory term used for an inexperienced malicious cracker who uses programs developed by others to attack computer systems, and deface websites. It is generally assumed that script kiddies are kids who lack the ability to write sophisticated hacking programs on their own,[1] and that their objective is to try to impress their friends or gain credit in underground cracker communities.
And that's exactly what's happening.
Parent