Slashdot Mirror
Artists Against 419 Releases Mugu Marauder
An anonymous reader writes "Similar in scope to the (now defunct) screensaver created by Lycos that targeted spam sites, the newly-released Mugu Marauder is intended to take fraudulent bank sites off the air by sponging up their bandwidth. Mugu Marauder can be downloaded at www.aa419.org/mm/ It's currently only available for Windows, though a Linux port is allegedly in the works."
Beware of getting slammed by your ISP with a "friendly" letter, after consuming tons of bandwidth using something like this.
Why not just post a link to them on Slashdot.
Once these sites get hit they redirect the dns towards legitamate services and change addresses.
So this will probably just end up DDoS'ing the real banks instead of the fake ones, these fake banks move around a lot and create extra damage in their wake as a result of something like this.
Fighting fire with fire just doesn't work like it should.
Just like the Lycos screensaver that strangled spammer's bandwidth by not-quite-DDOS-ing them, this is a stupid idea. Legally you'd be opening yourself up to all kind of problems running this kind of thing: ISPs don't tend to take to kindly to this sort of denial of service attack.
It's not sexy, or headline-grabbing, but the correct way to go about this is the same as it's always been: go after the ISPs to pull their accounts. If they're RFC-ignorant, add their IP blocks to the usual blacklists until they comply or are connected to an intranet.
Happy marauding...
The Official Steve Ballmer Webpage
I like this, but prefer the lad vampire at the same site. There is something somehow more satisfying about watching the images flash by.
Just put it in a browser tab and let it run!
Vigilante justive via DDOS. Well, that won't set a horrible precedent for people knobbling the web site's of those they don't like. Who's next? Radical pro-life groups DDOS'ing websites with abortion information?
(Yes, I know this has a slippery-slope element to it, but there are plenty of activist groups out there willing to be vigilantes, because they believe their actions to be either unambiguously moral, or divinely inspired.)
Athletic Scholarships to universities make as much sense as academic scholarships to sports teams.
On the other hand, the rest of us pay thrice: once for the victimization of regular people not yet wise to this game, once for the waste of bandwidth because of the huge amount of spam being sent out for this scam, and now once for do-gooders pumping loads of worthless data back through our shared Internet at these websites, which are replaced faster than they go down.
On the surface it looks like a good idea, but it's just adding to the damage like all these other vigilante anti-spam tactics. A better technical solution already exists; switch from e-mail to instant messaging within a company and save all your instant messages.
Try not. Do or do not, there is no try.
-- Dr. Spock, stardate 2822-3.
legal?
I don't care who you're or how pretty the screensaver, just don't download programs for network abuse like this and expect your ISP to take it lightly. If you really want to take action against a phising site, call the ISP hosting it and complain to them. Same principle, less innocent parties affected along the way. If you don't get a response from that ISP, call the ISP further upstream... this is how we deal with network abuse; it's slow but it's legal, and it works.
Matthew @ Bytemark Hosting
Well, as a starter, most of these fraudalent sites work IP based because they dont have the real domain.
So I'm guessing this problem you mention would not happen if you just attack the IP. When you attack the IP you'd be attacking their server, even if they point their domains to some other site.
Most scammers use shared hosting (usually signing up with a fraudulent credit card) and hence any such attacks can affect the whole server taking out hundreds of web sites
That's a bonus!!!! If those affected website owners complain enough then the ISP will pull the offender!
>It's currently only available for Windows,
Why? I once saw a webpage that did this using only javascript. A simple page reload would give you updated arrays of images which your browser then loaded over and over and over again to exhaust the spamvertized sites bandwidth.
Belief is the currency of delusion.
And will probably work just as well... vigilante justice never works and should not be tolerated.
The owls are not what they seem
aa419.org, that is. They apparently think it's legal and acceptable, so they won't complain.
It assigns a UID when the installer is run.
Each one is something like this:
620ad934fc97bebb65f77bc883211351
That makes me wonder - just what does each one represent?
Striking fear in the authors of godawful fanfiction, I am here, appearing in darkness, Tuxedo Jack!
Imagine a 419-scammer sitting in an internet café in Lagos, getting thousands and thousands of mails appearing to be from people genuinely interested in the proposal, and having to follow up on them all just in case one or two are from real persons...
The implementation sucks. Who needs a screensaver?
But there's a seed of a good idea here, if you throttle it. It would not take any serious bandwidth hogging to crud up the phishing net with data that the phisher has to carefully check by hand because it could lead the police to him/her. Likewise the spammers. Eat their profits by eating their time.
Taking networks down to squash the cockroach is bad, but there is no reason not to lay a little boric acid out, so to speak.
One of the links from the flashmob page is for bash scripts suitable for Linux/*nix (and presumably OS X et al).
Copyrights, Patents, Trademarks: temporary loans from the Public Domain, not real property ("intellectual" or otherwise)
It makes far more sense for a centralised block list, regularly updated, hosted by a reputible body.
A small change in functionality to your web browser so that when you attempt to connect to a site on your blocklist. your browser informs you and the reason why and then asks you if you want to proceed anyway.
its a much more economic use of resources and could be added to by local police agencys as victims become known or perhaps a phishing notify button added to our browsers.
when we wander upon a site thats dodgy that url can be passed on to the hosts of the blocking lists, a site would be verified to prevent malicious use and if checked out as being ok, it wouldnt be reexamined till a certain number of other referals took place.
No waste of bandwidth, no denial of service attack on any site just a hazard warning in your browser that the site may be harmful.
perhaps the banking sites might even care to host such a list.
Blarney Quality Restaurant, Plants
You mean to say Artists Against 419, after finally capturing Dr. Mugu Marauder, are now releasing him?
sudo ergo sum
It is nice to know that the IT industry is full of experts who fail to do the first thing when presented with something new..... Try researching things guys. 1. The Mugu Marauder operates exactly the same as a web browser repeatedly refreshing with no cache on a specified list of target URL's (normally images because they typically have a large filesize compared to HTML pages). 2. The UID number generated for the application is used to tally stats for individual users, so just drop the paranoia. 3. FFS The sites targetted ARE NOT related in any way to legitimate banks. As I said if you did a little research before sprouting your "me too" crap you might realise just EXACTLY The Artists Against 419 are fighting against. 4. A DoS attack is defined as the act of deliberately trying to make a service on the attacked machine unavailable by flooding it with requests, sometimes using deliberately corrupted data packets. Now, I dont know where you tool come from or whether you sympathize with cyber criminals or are simply too dense to comprehend ths. We are downloading images from *CRIMINAL* fake banks after having tried to contact the hoster and shut down these *CRIMINALS* in vain at least two times or mopre. Then, and then only, do we actually start trying to deliberately exceed the allowed bandwidth of these *CRIMINALS*, so they cant use their bogus banks to prey on unsuspecting victims. It is *NOT* an attack on the servers, but on the *CRIMINAL* websites only.
Dear Verizon Subscriber:
I am Dr. Muntange Dwambo, the nephew of the director of your internet service provider's Accepatble Use Enforcement division.
It has come to our attention that you are consuming an unusual amount of bandwidth. I am therefore here to give you a one-time opportunity. My uncle has recently passed away, and left me in control of THREE HUNDRED THOUSAND GIGABYTES PER MONTH of bandwidth. Unfortunately that bandwidth is only available to Verizon subscribers, and that company does not yet offer their services in my native Nigeria.
Am I the only one who heard Roxette to sing "I'm gonna get blitzed for some sex"?
Why are they not using their botnets to DDOS the phishing sites and spammers?
I mean, then MS security vulnerabilities would suddenly make sense.
-silence
Dyslectics of the world, untie!
Of course, this will have no real impact on taking down phishing sites. The people that set up most phishing sites follow these simple steps:
1) Find a vulnerable server and root it, or get just enough access (through something like a phpBB exploit) to upload a phishing site to the right directory. They will end up with a URL that probably looks like "http://aaa.bbb.ccc.ddd/online/wamu.html". Phishing sites don't bother with mundane details like DNS or domains (waste of time and energy) because the URL will be conviently hidden with javascript by your favorite HTML email client anyway.
2) Repeat the above step as often as you like to have a "cluster" of phishing sites.
3) Send out tons of spam advertising the phishing sites, randomly picking one of the above URLs to use for the login page.
4) By the time the phishing sites are detected, reported, and disabled (could be as long as a week or two or four), hundreds of people could have attempted to log into each of the fake login sites.
5) In most cases, the owner of the server being used for the phishing site is completely oblivious of the phishing site. (The rest of their web sites are working fine, so why should they be aware of any problems?) DDoS'ing them will only attack a confused victim.
--guru
or just link the offending website on /.
I mod down so you can mod up. Your welcome.
Comment removed based on user account deletion
From http://aa419.org/content/bandwidth.php:
"Every image on our web site is hosted on a 419er's server."
So when you load their website, it also pulls images from 419-scam sites. Do you understand?
Seems to me that filling their dB with useless information would be more effective. (Increasing the victim to fake ratio). These forms are where they are actually taking bank acct numbers. Taking their bandwidth is s temporary band-aid when they are opening webhosting accounts for free, or at most $5.
t art.php h tm
Couldn't someone make a bookmarklet or javascript to fill forms with fake info? Here are some of the forms they use to get personal information.
http://www.raboswiss.com/housec/ACCSETUP.HTM
http://www.swissroyallbank.com/onlinebanking/gets
http://www.kashbankcorp.com/contact_us.php
http://www.alphapbonline.com/aibb/online_servces.
http://www.alliance-ctb.com/ebank/apply.asp
http://www.libertystrongholdgroup.com/aindex.html
http://www.fichnet.net/contact.php