Spies In the Phishing Underground

An anonymous reader sends us to Net-Security.org for an interview with security researchers Nitesh Dhanjani and Billy Rios, who recently managed to infiltrate the phishing underground. What started as a simple examination of phishing sites turned into an extraordinary tour through the ecosystem that supports the business of phishing. In the interview they expose the tactics and tools that phishers use, illustrate what happens when your confidential information gets stolen, and discuss how phishers communicate and how they phish each other.

Comments

Weak article

[plover]

Not a lot of new information there.

To summarize:

• Phishers have forums where they trade with other phishers.
• Most phishers are script kiddies. Phishing is usually done with pre-made phishing kits. The phisher plugs in their email address and uploads it to a compromised server.
• The phishing kits are riddled with backdoors, where the original kit author does stuff like send copies of the victims data to their own email address.
• Anti-phishing browser plugins lead to a ready-made list of compromised servers. Hackers know that any server on the list is hackable.

Six pages? I was hoping for at least the transcript of a chat with a phisher.

Re:Weak article

[Opportunist]

Who you're dealing with is quite simple. A mix of people, as usual. You have the crowd that knows nothing, but wants a piece of the cake. They're mostly harmless. They buy some phishing kit and try to get a few bucks. Usually they're caught. They're much like the average bank robber that goes into a bank with a gun but without a plan.

Then you have the ones that want to try it just to see if they can. They're just as harmless. They just get your ID and then don't do anything about it. Except maybe bragging to their friends, which usually turns into them getting caught when one of their friends decides they don't want to be friends anymore.

And finally you have some well organized groups that actually cause the problem. And there you usually get to see the type of people that you expect from such groups. You have the ones that write the code, usually quite smart people who know their shit and who also get quite a bit of money for their work (I was honestly tempted to switch sides...). Imagine an unemployed top notch programmer in an east europe country and the chance to see 4-5 digits per month, and you know what I mean. Then you have the people who can provide the necessary "hardware", i.e. acquire servers and the necessary connections to keep them running for a few weeks. In smaller groups, this is often the same person who does the coding, but even in this shadow business you notice tendencies to 'outsource' work, i.e. buy kits or hire people to do the server shifting. These are usually not the people you will talk to, unless they have reason to contact you (i.e. when they consider you someone who can get them servers or provide code).

Then you have the people who hire the goons to grab the money and run, and fools with bank accounts. These are usually the ones you will talk to when they try to find someone gullible enough to provide their bank account for transfers. And finally you have the goons that go to Western Union to collect the loot. These are the ones you usually catch when you do a sting. They're much like the average street drug dealer, the lowest on the chain and the ones that are easy to replace. Usually some poor guy, homeless or asylum seeker, is hired for a few pennies to risk it.

So, in general, unless they have good reason to talk to you, you won't get to hear from anyone who is up far enough on the ladder to be interesting.

Re:Duh

[russ1337]

P.s.: Damn, there's a lot of advertising on that site.

Yeah, not only that but I thought it was kinda strange that i had to enter my credit card details just to read the article.