How Phishers Think, Act, and Make a Profit

whitehartstag writes with a write up of "the excellent session at Black Hat that detailed 'how phishers create sites, share info and code, and basically are lazy.' They store their stolen data 'on websites that they have hacked into, or on [publically available] sites like guestbooks. And even worse, they are not protecting their stolen data ... which means that all one needs to do to find this info is to reverse engineer a real phisher's website, look at their PHP script, and find out where they are storing the data.'"

Comments

How is this useful for law-abiding citizens?

[Enderandrew]

I wish the article had good suggestions for how to prevent phishing attacks. Instead, it seems like this article is suggesting I can easily steal already stolen credit-card data.

Re:How is this useful for law-abiding citizens?

[urcreepyneighbor]

I wish the article had good suggestions for how to prevent phishing attacks.

Super secret information! Don't share with anyone! Majestic Clearance only!

Re:How is this useful for law-abiding citizens?

[LostCluster]

Isn't that the reason they call it "Black Hat" instead of "White Hat"?

Re:How is this useful for law-abiding citizens?

[davester666]

Offhand, the only 'good' thing you could do would be to hoop the database. If it's poorly secured, you could get it to delete all the current records. If it's more secure, you could fill it with slightly bogus data [like real names and addresses, but phony credit card numbers.

This could result in:
-fills up the drive on the computer it's stored on, which would at least temporarily halt more stupid people from adding their data to it
-make it difficult to filter out good entries from bad. The data is kind of correct, they might have to actually pass it to the credit card company to actually check if it's good or not
-if they can't filter out the bad entries, it makes using the database to do 'bulk' transactions easier for the credit card companies to notice [assuming they put much effort into it instead of just passing the cost onto merchants] as it happens, instead of 30 days later when people complain.

Re:How is this useful for law-abiding citizens?

[teh moges]

This article isn't about that, its about how they think. The information it does have, while brief, is exactly the type of information that I was expecting when I clicked the link.

Re:How is this useful for law-abiding citizens?

[davester666]

Maybe, but you could spoof the IP and/or MAC address of the phishing site, and you've got the code the guy is using to update the database, so you could probably get really close to looking like the real phishing site.

Of course, if the phisher is storing the data on some 3rd party guestbook, you may not want throw thousands of entries a second at it...

And this could easily cross over to the illegal side... Technically, it probably is illegal to write bogus entries into a hackers data, as it would be gaining improper access to a companies information [probably some federal statue].

Re:How is this useful for law-abiding citizens?

[janrinok]

Certainly over here in Europe you will have just committed an offence. The unauthorised access of someone else's computer is illegal, yes, even those computers being used by criminals. There is no "Robin Hood Excuse" that will change the fact that your actions are illegal. Now, as the US has just been successful in claiming the extradition of a British cracker, I'm sure that the US will be equally happy to extradite all those Americans who hack into European criminals' computers to face charges over here. Alternatively, you might have been suggesting that all phishers are American and that as long as such actions are contained inside the USA it is all entirely acceptable.

That's one of the problems of being a vigilante, you often have to be a criminal to do what you 'believe' to be justice. It doesn't make the vigilante any better in my eyes.

Re:How is this useful for law-abiding citizens?

[rapiddescent]

legality is an issue - why should *you* make the judgement on whether that data is in fact stolen - perhaps that data has been placed their by banking regulators/NHTCU using 'honeypot' card numbers so that tracing can occur to recover funds.

A well known Scottish bank (that I used to work at) were well known for chasing money launderers who have (ab)used their systems to the ends of the earth - often spending more than the consequential fraud loss to do so. In the old days, they used to use marked cheques - nowadays they have hotscan products that will trace payments to affiliated payment networks across international borders.

Yeah, breaking into phishing sites is a lot of fun, but before you "drop table", think about your actions and whether you are breaking the computer misuse act (UK) or the Police and Justice Act (Scotland) or indeed any law from the host nation.

The Gary MacKinnon case has shown that a rather underrated cracker (poking around with Term Services looking for blank passwds -- for FS!) can cause an extradition to a foreign country well known for its human rights abuses - is just shocking.

Re:How is this useful for law-abiding citizens?

[Fred_A]

Remember illegal access to a computer is illegal, but anyone running a database full of stolen credit card numbers is probably not going to call the cops on you, especially since to prove you access the system they'd have to keep it pretty much intact.

There is however a marginal risk that the legitimate owner of the system would notice you instead of the phisher. And call the relevant authorities on you. Which might prove uncomfortable.

Hey!

[Vectronic]

"...[Phishers] basically are lazy"

I'm lazy, maybe I could be a phisher king...

"...all one needs to do to find this info is to reverse engineer a real phisher's website, look at their PHP script..."

Shit, I instrinsically fail.

The Phisher Job Description

[Nymz]

...does involve 'securing' data, just not in the way you think it does.

Re:Hmm

[Eudial]

The next logical step would be hackers hacking hacker-hacking hackers.

Old Hat

[Pandare]

This article is an old Trope. In fact, Confucius once said: "Give a man a fish, he eats once. Teach a man to phish and he gets a post in /."

Re:Old Hat

[Yvan256]

Give a man fire and he'll be warm for a day. Set him on fire and he'll be warm for the rest of his life.

Re:Old Hat

[Darkness404]

But give a man Ramen Noodles and you don't have to teach him anything.

How to prevent phising attacks.

[Anonymous Coward]

Engage brain before clicking.

Re:One time...

[c0nsole]

Sounds like a coincidence to me. I charge way more than that to install any OS on any computer, as the job usually involves backup and migragation of the client's files, tracking down drivers, and other mundane stuff. For $35 it sounds like the guy was just trying to pickup some cash on the side. Even in the technical fields at my university I know there were *many* people who would never attempt something as trivial as installing an OS. Downloading and installing a printer driver is voodoo to those people, even though they themselves installed the printer via the 'quick setup poster' that came with it when it was new. Trying to show these sorts of people how to do this stuff themselves is an exercise in futility. I doubt the phisher in question would have the know-how to even be able to install Vista anyways...I heard they're quite lazy. :)

Re:Hmm

[Mesa MIke]

Buffalo buffalo Buffalo buffalo buffalo buffalo Buffalo buffalo.

And even worse

[narcberry]

...they aren't protecting it? The fact that my personal information is in the hands of people with intentions of using it, is not as bad as them not protecting it? I'd hate to imagine the kinds of people that might get their hands on my personal information!

Re:One time...

[Anonymous Coward]

"even who-is'd him for them in the e-mail (it appeared to be an Indian name).... I called the number on the ad... He had a thick Indian accent. Same guy? Coincidence?"

No way that was a coincidence. I mean, how many Indians are there?

Phishers ain't more techsavvy than the average Joe

[Opportunist]

With the advent of MPack and other tools from the RBN, it doesn't take a "hacker" anymore to phish. You buy a toolkit, you buy the exploit, you buy a trojan and the scripts for your server, and off you go. The reason why it's successful is simply that there are people who know less than the attacker about security.

Detach yourself from the idea that phishers are in any way required to be security gurus, or that they're in some way intimate with the inner workings of PCs or networks. Those that know how to code don't attack anymore. They sell their attacking toolkits to others who then conduct the attacks.

Re:Hmm

[Clandestine_Blaze]

Oh yeah? Well I see your smelly Buffalo, and raise you a James while John had had had had had had had had had had had a better effect on the teacher

I wish I knew about this while I was in high school and had to write boring 500 word essays. A few of these and I would be nearly done! :D

You know, this one time...

[patio11]

... I saw two white guys in a day. And was like, whoa -- are you folks following me?

Then I saw another one. I knew it. Never trust white guys.

-- A white guy (but just because I'm paranoid doesn't mean I'm not out to get me!)