Phishing Group Caught Stealing From Other Phishers

An anonymous reader writes "Netcraft has written about a website offering free phishing kits with one ironic twist — they all contain backdoors to steal stolen credentials from the fraudsters that deploy them. Deliberately deceptive code inside the kits means that script kiddies are unlikely to realize that any captured credit card numbers also end up getting sent to the people who made the phishing kits. The same group was also responsible for another backdoored phishing kit used against Bank of America earlier this month."

Comments

Mr-Brain's site

[aerthling]

Here's his site: http://thebadboys.org/Brain/

Re:Nuke the phishers

[FLEB]

What is stopping a law enforcement agency from putting out a 'phishing' kit that actually phished the phishers?

The law, mostly. It's just as illegal for someone to make "counter-malware" to break into a computer uninvited as it is for anyone else to make malicious software that breaks in.

Re:I wish it were possible to zoom in...

[Mr. Roadkill]

Naturally Netcraft won't tell you the real site name :-)

Naturally. And who can blame them? I certainly don't - who knows what kind of nasties they might have lurking on those pages waiting for unsuspecting CEO's and CIO's and security experts who ought to know better?

However, Google is your friend. Within 30 seconds of looking over the Netcraft article for helpfully unique strings, I found it. And went looking with lynx :-) I won't give the URL, to protect the stupid from themselves, but it's not that hard to find.

They've got ready-rolled scams for abbey.co.uk, bankofamerica.com, cahoot.co.uk, chase.com, egold.com, ebay.com, hsbc,co.uk, lloydstsb.com, moneybookers.com, nationwide.co.uk, nbk.com.kw, paypal.com, regions.com, stgeorge.com.au, wachovia.com and westernunion.com - and in some cases, they have more than one for particular organisations.

Cool. Now who has a spare botnet, is willing to wade through this arsehole's source, and is willing to send garbage values to al-brain@hotmail.fr and albrain08@yahoo.fr?

Re:Just what is stopping law enforcement?

[ShaunC]

Don't you ever wonder why there have been so few significant arrests of spammers/phishers/etc?

No, not really.

For the most part, these have been made federal crimes, even to the extent of superseding existing state laws. A few years ago, several states had passed fairly strong anti-spam laws. If someone violated the law, you could file against them in your local small claims court, and secure a guaranteed judgement (good luck collecting, but that's another story) if they didn't show. Slashdot regular Bennett Haselton made boilerplate of that process, as I recall. Then along came CAN-SPAM, which created huge loopholes and essentially declared that individual state laws about spam, if less tolerant than the federal statute, were no longer enforceable.

So now it's up to the feds to prosecute spammers, phishers, and other ill-willed malfeasants. Most of the time, the feds have better things to worry about, and unless you personally can prove tens of thousands in damages, they're unlikely to raise an eyebrow. You do remember how the FBI's last few technology initiatives turned out, right? The penultimate example being "Virtual Case File," a/k/a "Virtual Money Sink." What amounts to a data warehouse with a client app to query it, $200 million later and it's scrapped. Two hundred MILLION dollars down the drain on a failed initiative to, in essence, secure some data feeds, create some transformations, and develop a GUI to query the whole shebang. You really expect these guys to track down John Dodrescu in Romania who's spoofing a Bank of America website on some zombie PCs in Italy, oh wait, that was 10 minutes ago before the TTL on the DNS expired, now it's some zombie PCs in France?

Give me, a non-gov IT professional, a team of 10 people of my choosing, fund me with one single million dollars and some travel vouchers, and agree to keep the project going for one year. A lot of these assholes will be out of business inside of 6 months, with many of their contemporaries scared shitless of becoming the next statistic. No fatalities, just a lot of people behind bars. But the federal government doesn't work that way because as many of us are well aware, it isn't profitable to run an IT department. They'd rather hire 1,000 guys who may or may not be able to tell you which of (XM|XP|XTC) is a version of Windows, at $50K a year apiece, then bitch and moan that they can't stop the problem with $50mil so they can justify a bigger budget next year.

America is spending more money per day in Iraq than it would take to adequately investigate, build cases against, and convict all of the prolific spammers in the entire world.

No, I don't often wonder why these problems haven't been solved. The federal government has been tasked with solving them, and that's all the why I need.

Re:How times have changed: you can't trust.....wai

[nacturation]

I have to pay a little extra for eat (about US$ 3/month), but it is well worth it. It is considered (and marketed as) an insurance. I have this since 1996, and I'm happy to say I never needed. I have a solution as well: use your credit card so that there's no liability to you even if someone does use it fraudulently. And since 1996, you've spent about $400 on this insurance you didn't need. The only time I could see that as being useful is if someone robs you while you're in the process of making a withdrawal at an ATM.