Hacker News Reader

Comment by sublimefire | Hacker News Reader

The title is misleading. It should be called "The low, low effort of ...". There is no dollar value expressed in conducting such a simple attack. One needs to buy emails, then setup dns and host the files on some servers. How do you pay for those servers? There are a bunch of interesting parts of this that were just not covered in the article nor there was any attempt to show the actual cost, nor did it prove it is actually cheap. The cost would be dictated by the amount of valuable emails you have and the ability to squeeze them into one campaign (minus the effort).

View on HN

> There is no dollar value expressed in conducting such a simple attack.

"Cost" encompasses things like effort, loss, and sacrifice too.

For crimes where the criminal's "happy path" result is to take somewhere from $50 to $50,000, you'd expect that the most important cost element would be risk of getting caught and punished, although I have the impression that enforcement is not actually that strict.

That risk is practically zero, especially if you are operating out of a country that won't extradite to the country of your targets.

Remember Ukrainian cybercriminal that was caught when he crossed into Poland? Yeah you will need to remember to never go to any of those countries for the rest of your life. If criminal wants ever to live a nice lifestyle (which is probably why become criminal right?) then getting caught is high cost

>How do you pay for these servers?

For probably much of cybercrime you don't pay for these servers. Many are usually security compromised servers that were put up for legit business and left some config file out in the open or some other silly mistake. In the case of phishing, they are hijacked and by the time anyone notices, enough emails have been sent to create a lot of damage for the good guys, and a decent profit for the bad guys.

As always, something will only be done to fix the unbearable lightness of committing a cybercrime when there is a realization that the price being paid for those that have the power make a difference outweighs their benefits.

Often people only notice their badly maintained website has been hijacked to host phishing pages under some subdirectory when their whole site ends up in Google’s safe browsing shitlist.

I’ve investigated a metric fuckload of these cases at work.

Usually, the emails are from public leaks. So, free email list.

The hosting? More often than not, we find phishing panels on hacked web servers exploited through vulnerable Wordpress plugins or whatnot. So the servers are free.

Sending the emails? Usually a shitty PHP bulk mailer uploaded to the same compromised server as the phishing kit.

The effort on a lot of this is incredibly low, the cost is “time”, etc. public mail lists, infra compromised using public exploits, etc.

Reply on news.ycombinator.com