Hacker News Reader

Comment by tomxor | Hacker News Reader

I was sent one of these SMS today. I usually ignore but today I was in weird mood and started pulling apart the site. Stuff I found:

Google is the domain registrar. (reported)

Hotlinked to ups.com images, logos and css... Opportunity for some fun here UPS! (reported)

Uses hCaptcha on the landing page. (reported)

Nginx server with Plesk, and a plesk login page, no obvious stuff like ssh exposed, all latest versions, I'm not much of sec hacker so I didn't get very far. Started sending malformed and large requests to the credit card processing endpoint to see if I could break it, slowed it down a little, but then the captcha got blocked.

Of all of those hCaptcha was the first to respond and act, they've already banned the site's account within 5mins of my email... and this renders the site useless, so here's for hCaptcha! fighting fraud while the behemoths are slow and complicit... I know it's whackamole but it was a little bit of fun.

View on HN

also FYI a lot of places dont place limits on the size of their POST requests or timeouts.

I have been able to send scammers 500MB+ POST requests just by making the password field password=888888888888888888888888888888 (etc til its 100s of MB of data).

Use a tool like OWASP ZAP or Burp Suite and you can easily slam a scammers website full of 500mb+ requests that will quickly fill up their log files and cheap VPS harddrive and eventually the website will get an hdd full msg or just go offline til they fix it.

Cheap and easy way to take their website offline to prevent more people from getting scammed.

Even better if they use AWS or other service, and end up with a huge unexpected bill at the end of the month

Eh, the malicious actor would typically be using a compromised or carded account.

Which is another angle to suggest in reports to incentive quick action, because they’re losing money keeping the service up.

Then the billing spike will be spotted by the victim of that compromise and likely report it, I'd expect..

You'd have to find a reflection bug that makes them send everything back. Data into AWS is free https://aws.amazon.com/ec2/pricing/on-demand/#Data_Transfer "Data Transfer"

I’m pretty sure this is a felony. I’m not against the spirit but want to warn others that you could get slapped.

It’s now a felony to send api calls? Give me a break

The US unfortunately has intentionally vaguely written laws about misusing computer systems which can be interpreted to punish hackers and pentesters pretty harshly.

It's a crime to intentionally drive a car over someone. Legal systems vary across the world but I would imagine most of them account for mens rea.

So, crafting API calls to intentionally bring down a system most definitely can be a criminal offence.

Now if you're objection was to the use of felony as opposed to misdemeanor, then ignore whatever I said above.

It’s a felony to mail people things? Not usually, but if you send them a pipe bomb it sure is.

This is an absurd analogy from where this began... I'm at most slowing down a server in Russia that is trying to defraud people, no one is getting hurt, and It's unlikely I'm costing them any money. Come back to reality.

The CFAA is controversial because of how vague the statue is. It has no carveouts for vigilantes or "hack back", last I heard -- even though some in Congress were trying to push for "hack back" rights.

The DoJ is unlikely to prosecute a vigilante of scammers, but they have prosecuted others (eg. Aaron Swartz) who were doing a debatably morally upright actions while violating the letter of the law.

I'm sure it is, but a scammer or hacker committing a crime is most likely not going to report this. They would certainly get in trouble too.

Their ISP/host may report it.

How would the ISP know what data was sent over a https connection? The host may, but I doubt they care since the customer pays for the bandwidth.

Huge ingress traffic to a website which normally just serves stuff stands out from a pattern. Also, bad actors are often profitable customers of hosting companies and can ask/demand action without revealing themselves to a 3rd party.

To quote Nacho Varga: "I like ripping of thieves. They can't go to the cops. They have no recourse."

What exactly would the scammer/hacker say to the police/their lawyer? "Could you please help? I'm trying to scam innocent people out of their money, but some greyhat has filled up my server's logs with junk!"

If you use a password field can’t you reasonably argue that you want to actually have a really secure password? ;-)

I’m sick and tired of these 12b character limits on password complexity!

I always log requests as "http://example.com/foo/bar/... [1234 bytes]".

If a site is designed for scamming, it will likely log the contents of the form submissions -- sensitive fields like username + password combos or other PII.

You can also go after their ssl certificate provider if they have one. Doesn’t always work but it has at least once for me.

Unfortunately I’ve also observed a lot of Canadian phishing links will geo-redirect, so reporting them can sometimes go nowhere unless the checker uses the right vpn.

They almost all use LetsEncrypt, which has a documented policy of not terminating accounts for spam/fraud.

Gross. Why?

They have a published policy that explains it:

https://letsencrypt.org/2015/10/29/phishing-and-malware.html

Because it’s not their problem and would set a bad precedent

Their arguments are the same that any other layer involved could use to sit it out.

“We shouldn’t be the police, let some layer above or below us be the police, just anyone but us!”

What they don’t really say is that an abuse team costs money to run.

When self-regulation doesn’t work, you risk ending up with legally-imposed regulation. I’m sure that will really delight them.

Ssl is like the lowest on the chain. You have the domain registrar and the end host and perhaps cloudflare in the middle - and for phishing the mail starting point. All of these are better choices to report abuse than let’s encrypt provided free ssl that’s open for any one to use. I would place that at the level of a phishing site using nginx who could realistically add code to block a list of phishing domains somewhere in their code because it might be used by phishing sites - just no.

> Google is the domain registrar. (reported)

I wonder if this is the reason Google is getting rid of it's domain registration service? I imagine this is quite a pain to deal with

No, they set up their fraud prevention pipeline before they even launched their registrar. It’s a very expected part of going into that business, and they knew it and handled it well. The product was cancelled because there are huge internal incentives for launching new products, and subtle punishment for teams who perform maintenance.

Thank you

You are the hero we need.

Reply on news.ycombinator.com