Slashdot Mirror
Hackers vs. Phishers
An anonymous reader writes "Some hackers out there don't like to do all the hard work of running a successful phishing campaign. Instead, they developed a simple online service to 'steal' account details from the hard-working phishers. Named AutoWhaler, the service allows anyone to scan a phishing server for log files that contain juicy information such as usernames and passwords."
That's the hacker culture allright. Use inventivity rather than "hard work" to get your result with the least possible effort :)
In other news, some Slashdot users don't like to do all the hard work of writing inspiring posts to build karma. Instead, they developed a simple online service to 'steal' karma from the hardworking posters. The service allows anyone to scan Slashdot articles for underrated comments and automatically post replies urging moderators to "mod parent up".
FBI: Why do you rob banks?
Willie Sutton: Because that's where the money is.
Liberal? Conservative? Compare perspectives at Left-Right
Criminals stealing from criminals? Doesn't surprise me. It happens all the time in the physical world.
(Before the deluge of malice-laden replies regarding "how I make all hackers out to be villians," yes, I know the difference between white hat and black hat.)
(((dB)))
People of ill repute do things of ill repute. Even to each other. Is anyone really surprised?
This is no different from a car thief stealing cars from another car thief, aside from it involving the internet (therefore probably making it newly patentable!) and perhaps a matter of scale.
Hard-working phishers? What? Did we cross over into the Twilight Zone, here?
Screw the rules, I have green hair!
Suddenly sounds like they are all bankers to me.
Great fleas have little fleas upon their backs to bite 'em,
And little fleas have lesser fleas, and so ad infinitum.
And the great fleas themselves, in turn, have greater fleas to go on;
While these again have greater still, and greater still, and so on.
There is always a bigger fish.
-- Qui-Gon Jinn
Only to idiots, are orders laws.
-- Henning von Tresckow
In a web 3.0 show-down who would win?
1) Hackers.
2) Pirates.
3) Phishers.
4) Ninjas.
5) The Man.
5) Cowboy Neal.
Missing option being a tag-team of Chuck Norris and Angelina Jolie.
Regards, Phil
I've always wanted to say this.
Pretty good is actually pretty bad.
These young hackers causing all this hutinanity and without any real work.
Back in my days youngans, Hacking or cracking as it was sometimes called, while still illegal was something to be respected, you had to know what you were doing to break into a system and the harder the break-in the more respect you got... Now todays you kids got all comerical and you can break into computers without having the break into them. You just ask someone for the passwords and they give them to you... Dag-nabbit that is not hacking that sounds like politicians to me.
If something is so important that you feel the need to post it on the internet... It probably isn't that important.
"mod parent up" This comment was generated by HackBot 01928
"Some hackers out there don't like to do all the hard work of running..." Nuff said.
People of ill repute do things of ill repute. Even to each other. Is anyone really surprised?
This is no different from a car thief stealing cars from another car thief, aside from it involving the internet (therefore probably making it newly patentable!) and perhaps a matter of scale.
I think the subtext here is that hackers aren't necessarily bad guys and so it's more like repo men stealing from car thieves, still not completely shocking but somewhat more interesting.
...all it does is to try access a number of pre-defined files from the root directory of the probed host: passwords.txt, logs.txt, l0gz.txt, accounts.txt etc. -- talk about sophisticated hacker tool! massive all phreaker big-up! what a joke...
the tool also "epically fails" if you supply a host that is not encapsuled in http:// ... /
Is it just me or is there more and more biology-like complexity evolving?
thegodmovie.com - watch it
"Great fleas have little fleas upon their backs to bite 'em,
And little fleas have lesser fleas, and so ad infinitum.
And the great fleas themselves, in turn, have greater fleas to go on,
While these again have greater still, and greater still, and so on."
Hackers vs. Phishers.
Two go in. One comes out.
I am not a lawyer (and I use Acronyms sparingly), but stealing accounts from other phishers may be a DMCA violation!!!
"If a boss demands loyalty, give him integrity. But if he demands integrity, give him loyalty." (John Boyd, 1927-1997)
from the jargon file:
hacker: n.
[originally, someone who makes furniture with an axe]
1. A person who enjoys exploring the details of programmable systems and how to stretch their capabilities, as opposed to most users, who prefer to learn only the minimum necessary. RFC1392, the Internet Users' Glossary, usefully amplifies this as: A person who delights in having an intimate understanding of the internal workings of a system, computers and computer networks in particular.
2. One who programs enthusiastically (even obsessively) or who enjoys programming rather than just theorizing about programming.
3. A person capable of appreciating hack value.
4. A person who is good at programming quickly.
5. An expert at a particular program, or one who frequently does work using it or on it; as in ‘a Unix hacker’. (Definitions 1 through 5 are correlated, and people who fit them congregate.)
6. An expert or enthusiast of any kind. One might be an astronomy hacker, for example.
7. One who enjoys the intellectual challenge of creatively overcoming or circumventing limitations.
8. [deprecated] A malicious meddler who tries to discover sensitive information by poking around. Hence password hacker, network hacker. The correct term for this sense is cracker.
The term ‘hacker’ also tends to connote membership in the global community defined by the net (see the network. For discussion of some of the basics of this culture, see the How To Become A Hacker FAQ. It also implies that the person described is seen to subscribe to some version of the hacker ethic (see hacker ethic).
It is better to be described as a hacker by others than to describe oneself that way. Hackers consider themselves something of an elite (a meritocracy based on ability), though one to which new members are gladly welcome. There is thus a certain ego satisfaction to be had in identifying yourself as a hacker (but if you claim to be one and are not, you'll quickly be labeled bogus). See also geek, wannabee.
This term seems to have been first adopted as a badge in the 1960s by the hacker culture surrounding TMRC and the MIT AI Lab. We have a report that it was used in a sense close to this entry's by teenage radio hams and electronics tinkerers in the mid-1950s.
Note that the perjorative use has been deprecated.
The Phish, from Vermont...are the poo poo.
I'll try anything once. Twice if it tastes good
... that had the same password as their account names on various servers over the years:
Thank you for the laughs.
And no, I don't have your phished data. I didn't want it. I'm the guy who recursively deleted all of it. As much as I could find.
I love seeing that little tilde in the target address I'm supposed to click in your spam.
The only time I was really interested in phishing was when I was a young teenager - more years ago than I sometimes care to remember. I used to love going to the end of Eastbourne pier but despite a lot of effort and determination, all I ever seemed to 'catch' were crabs and the occasional tiddler. These days I don't bother - older and the fact I'm not near the coast probably contribute to that. Oh well, c'est la vie.
Sometimes I convince myself that this person's wall of text/stream of conciseness will say something insightful or meaningful, and I should read it.
So I read it.
- Learn to proof read
- Learn to focus on a single topic
- Please do not have any more children
I'm sad that someone choose to marry you, and I really doubt that anyone cares about your mommy/daddy issues.
please take your antipsycotic meds
"...I'm sad that someone choose to marry you..."
While I don't wholeheartedly disagree with your summation of the aforementioned post, when posting a flame, at least take your own advice -- namely your first point.
"I love lamp."
Since you kept repeating this incorrectly for 50 times, i had to correct you.
The correct definition of "hacking" a device or application is,
making the device or application function in a way that was not intended by the original author.
The definition brought forward by the media only focuses on hacking remote devices for malicious purposes.
The correct definition of "hacking" a device or application is,
making the device or application function in a way which was not intended by the original author.
The definition brought forward by the media only focuses on hacking remote devices for malicious purposes.
It is perfectly cromulant to embiggen ones vocabulary.
Is this a Markov chain text generator or something?
As the little old lady tought Betrand Russel, it's turtles all the way down !!!
the preceding comment is my own and in no way reflects the opinion of the Joint Chiefs of Staff
I prescribe some Zyprexa twice daily
Adults chat in the online world,
decide to meet for coffee.
To great effect she did a-twirl,
sparks fly that scare Khadafi.
Until one day she chatted coy,
paid nary a thought to time.
Turns out it was a 12 year old,
they charged her with a crime.
Want to improve your Karma? Instead of "Post Anonymously", try the "Post Humously" option.
This would've been considered as an act of war, and the next thing you know people in the streets are cutting each others in half with tommy guns.
ELOI, ELOI, LAMA SABACHTHANI!?
If you can get the phishers to concentrate on the hackers, while the hackers are concentrating on the phishers, maybe they will leave the rest of us alone.
Who would win this election: Andrew Weiner vs Andrew Weiner's weiner.
as I said before take your meds
That's the real hacker -> http://catb.org/~esr/faqs/hacker-howto.html
I would be tempted to use this for honourable reasons (ie wait for phishers to email me, then get the details off their site and let someone know that these account details had been stolen) but I'm not sure how. I strongly suspect actually posting them on a website would likely get you in trouble with the authorities, and I'm not sure how effective emailing either the bank(s) or websites in question, or the people whose details were stolen, would be.
I've seen that, too. Recently, Stanford University came up on our short list of major sites being exploited by phishers. I was surprised, because Stanford is usually good about stopping that. It was a weird subdomain under "stanford.edu", and at first I thought someone had compromised Stanford's DNS to get their site under the "stanford.edu" domain. But no, it was just some minor machine that had had a break-in.
The directory with the phishing page was readable as a web page and contained the log of captured passwords, so I sent those to Stanford security and Bank of America security. Haven't heard back from either. After the end of the weekend, the site was taken down, and that took Stanford off the blacklist.
We've been reasonably successful at cleaning up that list. We're trying to popularize the idea that one verified phishing URL blacklists the whole domain until the problem is fixed. (The idea behind SiteTruth is to take a hard-line approach and measure the collateral damage so it can be minimized.) The oldest sites on that list are ones which won't respond to complaints by e-mail or phone. In some cases we've sent faxes.
The worst offenders are Piczo and FortuneCity. Piczo is some kind of social network/hosting service for teenage girls, and it's full of phishing pages, mostly for Habbo logins. PhishTank counts 15, and there are probably more. The phony pages are often not in English, and the Piczo abuse department may not recognize a French Habbo phishing page. This may be the next trend in phishing - put your page on a site run by someone unlikely to understand the page. I've seen a phishing page in Greek on an Indian site.
It's getting harder to run a phishing site. Since the end of "domain tasting", the business of high-volume bogus domain registration has tapered off. We haven't seen an "open redirector" on a major site in a while; eBay, Yahoo, and Microsoft Live all used to have at least one. The "url shorteners" are getting very aggressive about killing links to phishing sites. This might be winnable.
Now, if the hackers were *really* smart, they'd download the data files, and replace them with randomly-generated but plausible data, thus ensuring that the phishers would not get the stolen card details stomped on by Visa, MC, et al. too soon for the hackers to use them.
Back in our day, we had to move the electrons around with tweezers.
Since the tool is not run locally you can only assume that all the submitted url's are going into someone's database.
That someone is going to collect a lot of hacked accounts very quickly.
Hackers vs Phishers vs Hosted Hacked account collection Service?
Yesterday the Auto Whaler was something I would thumb up for. Now when I finally got my chance to abuse it, it somewhat became old news too quick.
During my sleep I finally received some phising mails to test with the Auto Whaler.
First one gave no hits Second one gave green lines all over. Trying to open one of the text files I was just redirected to a sub page on the site where all the red lights starts flashing. Tons of malware trying to be installed.
So do not let the phishers fool you, they too know about Whales.