Slashdot Log In
How Phishers Think, Act, and Make a Profit
Posted by
timothy
on Thu Aug 07, 2008 08:29 PM
from the good-laugh-at-your-expense dept.
from the good-laugh-at-your-expense dept.
whitehartstag writes with a write up of "the excellent session at Black Hat that detailed 'how phishers create sites, share info and code, and basically are lazy.' They store their stolen data 'on websites that they have hacked into, or on [publically available] sites like guestbooks. And even worse, they are not protecting their stolen data ... which means that all one needs to do to find this info is to reverse engineer a real phisher's website, look at their PHP script, and find out where they are storing the data.'"
Related Stories
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
How is this useful for law-abiding citizens? (Score:5, Interesting)
I wish the article had good suggestions for how to prevent phishing attacks. Instead, it seems like this article is suggesting I can easily steal already stolen credit-card data.
Re: (Score:2, Funny)
Re:How is this useful for law-abiding citizens? (Score:5, Interesting)
Offhand, the only 'good' thing you could do would be to hoop the database. If it's poorly secured, you could get it to delete all the current records. If it's more secure, you could fill it with slightly bogus data [like real names and addresses, but phony credit card numbers.
This could result in:
-fills up the drive on the computer it's stored on, which would at least temporarily halt more stupid people from adding their data to it
-make it difficult to filter out good entries from bad. The data is kind of correct, they might have to actually pass it to the credit card company to actually check if it's good or not
-if they can't filter out the bad entries, it makes using the database to do 'bulk' transactions easier for the credit card companies to notice [assuming they put much effort into it instead of just passing the cost onto merchants] as it happens, instead of 30 days later when people complain.
Parent
Re:How is this useful for law-abiding citizens? (Score:5, Informative)
Certainly over here in Europe you will have just committed an offence. The unauthorised access of someone else's computer is illegal, yes, even those computers being used by criminals. There is no "Robin Hood Excuse" that will change the fact that your actions are illegal. Now, as the US has just been successful in claiming the extradition of a British cracker, I'm sure that the US will be equally happy to extradite all those Americans who hack into European criminals' computers to face charges over here. Alternatively, you might have been suggesting that all phishers are American and that as long as such actions are contained inside the USA it is all entirely acceptable.
That's one of the problems of being a vigilante, you often have to be a criminal to do what you 'believe' to be justice. It doesn't make the vigilante any better in my eyes.
Parent
Re: (Score:3, Interesting)
Remember illegal access to a computer is illegal, but anyone running a database full of stolen credit card numbers is probably not going to call the cops on you, especially since to prove you access the system they'd have to keep it pretty much intact.
Re:How is this useful for law-abiding citizens? (Score:5, Insightful)
legality is an issue - why should *you* make the judgement on whether that data is in fact stolen - perhaps that data has been placed their by banking regulators/NHTCU using 'honeypot' card numbers so that tracing can occur to recover funds.
A well known Scottish bank (that I used to work at) were well known for chasing money launderers who have (ab)used their systems to the ends of the earth - often spending more than the consequential fraud loss to do so. In the old days, they used to use marked cheques - nowadays they have hotscan products that will trace payments to affiliated payment networks across international borders.
Yeah, breaking into phishing sites is a lot of fun, but before you "drop table", think about your actions and whether you are breaking the computer misuse act (UK) [opsi.gov.uk] or the Police and Justice Act (Scotland) [opsi.gov.uk] or indeed any law from the host nation.
The Gary MacKinnon [wikipedia.org] case has shown that a rather underrated cracker (poking around with Term Services looking for blank passwds -- for FS!) can cause an extradition to a foreign country well known for its human rights abuses - is just shocking.
Parent
Re:How is this useful for law-abiding citizens? (Score:4, Insightful)
Remember illegal access to a computer is illegal, but anyone running a database full of stolen credit card numbers is probably not going to call the cops on you, especially since to prove you access the system they'd have to keep it pretty much intact.
There is however a marginal risk that the legitimate owner of the system would notice you instead of the phisher. And call the relevant authorities on you. Which might prove uncomfortable.
Parent
Re: (Score:3, Informative)
Maybe, but you could spoof the IP and/or MAC address of the phishing site, and you've got the code the guy is using to update the database, so you could probably get really close to looking like the real phishing site.
Of course, if the phisher is storing the data on some 3rd party guestbook, you may not want throw thousands of entries a second at it...
And this could easily cross over to the illegal side... Technically, it probably is illegal to write bogus entries into a hackers data, as it would be gainin
Re:How is this useful for law-abiding citizens? (Score:5, Informative)
I wish the article had good suggestions for how to prevent phishing attacks.
Super secret information! Don't share with anyone! Majestic Clearance only! [google.com]
Parent
Re: (Score:2, Interesting)
So the only thing keeping poor Billy from stealing data is that he hasn't thought about it and a timely article on /. is going to push him over the edge?
Probably not.
Re: (Score:2)
The article increases awareness of a security vulnerability.
Awareness means people can reprioritize how important it is to fix something: ie. if phishers handle private data so carelessly that it can be stolen by more parties than just that initially gathering it (and the party they sell it to), that provides a justification for even more vigilance than would otherwise be used, and a talking point to use when telling people how important it is to be cautious about potential phishing sites.
Re:How is this useful for law-abiding citizens? (Score:5, Insightful)
Parent
Re: (Score:3, Informative)
Re: (Score:2)
Re: (Score:2)
They're what you wear before sleeping with Mr. Bishop's wife and daughter. Never know where them New Reno chicks have been.
Re:How is this useful for law-abiding citizens? (Score:4, Insightful)
Parent
How to prevent phising attacks. (Score:5, Insightful)
Engage brain before clicking.
Parent
Re: (Score:2, Interesting)
Engage brain before clicking.
I think you proved subtly that we have a Darwinian mechanism at work through phishers and crackers.
Re: (Score:3, Interesting)
I wish the article had good suggestions for how to prevent phishing attacks.
But it does. Given that the miscreants are apparently posting information into public forums, simply enter your credit card number into a google search from time to time and see if it turns up. (Note for those without a sense of humor: don't do that.)
Seriously, what did you expect from a two paragraph writeup (one of which isn't actually about phishing but sale of CCs) of a talk at a conference that says with a wink and a nudge th
Hmm (Score:2, Funny)
Re:Hmm (Score:5, Funny)
The next logical step would be hackers hacking hacker-hacking hackers.
Parent
Re: (Score:3, Funny)
Re:Hmm (Score:4, Funny)
Buffalo buffalo Buffalo buffalo buffalo buffalo Buffalo buffalo [wikipedia.org].
Parent
Re: (Score:3, Funny)
Oh yeah? Well I see your smelly Buffalo, and raise you a James while John had had had had had had had had had had had a better effect on the teacher [wikipedia.org]
I wish I knew about this while I was in high school and had to write boring 500 word essays. A few of these and I would be nearly done! :D
Hey! (Score:5, Funny)
"...[Phishers] basically are lazy"
I'm lazy, maybe I could be a phisher king...
"...all one needs to do to find this info is to reverse engineer a real phisher's website, look at their PHP script..."
Shit, I instrinsically fail.
Re: (Score:2)
"...[Phishers] basically are lazy"
I'm lazy, maybe I could be a phisher king...
"...all one needs to do to find this info is to reverse engineer a real phisher's website, look at their PHP script..."
Shit, I instrinsically fail.
Well ..That's the easier part, since the poster of TFA already figured out the much harder "..." part of the sequence: ....
1 - Think
2 -
3 - Profits
The Phisher Job Description (Score:4, Funny)
Phishers Are Lazy Because People Are So Dumb (Score:2)
Re: (Score:2)
Re: (Score:3, Interesting)
Re: (Score:2)
And who end up footing the bill? ... yeah. It raises the cost for everyone else like shoplifting and any kind of fraud does.
Old Hat (Score:5, Funny)
Re: (Score:2, Funny)
Confucius say:
There is black hat and white hat, but your sig is just old hat.
Re:Old Hat (Score:5, Funny)
Give a man fire and he'll be warm for a day. Set him on fire and he'll be warm for the rest of his life.
Parent
Re:Old Hat (Score:5, Funny)
Parent
Apologies to Juvenal (Score:2)
I have to know (Score:3, Interesting)
The title and summary suggest that phishers are somehow less. Lazy? What, are drug dealers not lazy? Pimps more business savvy?
That is just bothering me. Anyone else think that is just wrong? Lazy? WTF exactly would a non-lazy phisher do? Setup a data center in the Caymans? Seriously!
The law will protect us! (Score:3, Funny)
And even worse, they are not protecting their stolen data
Clearly, the answer is to pass a law requiring that phishers disclose all breaches of the personal data they have collected. That will undoubtly shame them into increasing their security to better protect our personal information.
And even worse (Score:3, Funny)
Phishers ain't more techsavvy than the average Joe (Score:4, Interesting)
With the advent of MPack and other tools from the RBN, it doesn't take a "hacker" anymore to phish. You buy a toolkit, you buy the exploit, you buy a trojan and the scripts for your server, and off you go. The reason why it's successful is simply that there are people who know less than the attacker about security.
Detach yourself from the idea that phishers are in any way required to be security gurus, or that they're in some way intimate with the inner workings of PCs or networks. Those that know how to code don't attack anymore. They sell their attacking toolkits to others who then conduct the attacks.
The Perfect Crime (Score:3, Insightful)
Idiots fooling around do all the dirty work, and the serious crooks just snatch all their work without them even knowing it.
I am guessing phishing is risky. I am guessing that only phishing can gather information in such a large scale. If this is true, then while the idiots are getting caught, the really smart people and gaining a ton of really useful information as we speak.
If this is the case, I would be *very* worried.
People who steal are lazy (Score:3, Interesting)
Who would have thought such a thing? I thought that people who steal would make specific GUI's for them selves like you see in the movies and do all that other stuff.
OK, end the sarcasm. People who steal want to take a shortcut to the money. They want to have the money with the least possible effort. As the data they stole is not theirs and protecting them will take effort, why would they do it?
It is as if saying that you are surprised that if people rob your house they make a mess of it. Why would they not?
How Phishers Think, Act, and Make a Profit: (Score:3, Funny)
2. Somebody set up us the phishing website
3. ???
4. Profit!
Re: (Score:3, Funny)
Re: (Score:2)
Re: (Score:3, Interesting)
Re:One time... (Score:5, Funny)
"even who-is'd him for them in the e-mail (it appeared to be an Indian name).... I called the number on the ad... He had a thick Indian accent. Same guy? Coincidence?"
No way that was a coincidence. I mean, how many Indians are there?
Parent
You know, this one time... (Score:5, Funny)
... I saw two white guys in a day. And was like, whoa -- are you folks following me?
Then I saw another one. I knew it. Never trust white guys.
-- A white guy (but just because I'm paranoid doesn't mean I'm not out to get me!)
Parent
Re: (Score:3, Funny)
> Because obviously everyone has to nick-pick every fact...
Umm, yeah, that would be "nit-pick".
Re: (Score:3, Informative)
This like pretty much every other networking task imaginable requires a client(it connects the ssl connection and handles the routing as appropriate).
Cisco makes one, as do a number of other vendors(CheckPoint comes to mind, but only because it's the client I have to use for my work vpn connection).
All they're saying was that