With this in mind, are the RSA say its OK to DDoS fake login pages that the public think are phishing sites with fake information to take the phishing sites down? Or maybe the RSA didn't think too far into it before making their "illegal tactics" public. I guess nobody in the industry learned from
<a href="http://makelovenotspam.com">makelovenotspam.com</a> and the whole Lycos affair.<br><br>
<div><span class="gmail_quote">On 3/31/06, <b class="gmail_sendername">n3td3v</b> <<a href="mailto:n3td3v@gmail.com">n3td3v@gmail.com</a>> wrote:</span>
<blockquote class="gmail_quote" style="PADDING-LEFT: 1ex; MARGIN: 0px 0px 0px 0.8ex; BORDER-LEFT: #ccc 1px solid">
<div style="DIRECTION: ltr">But do you remmeber back to the Make love not spam saga? Yeah, the big players tried to "attack" the bad guys and look were they ended up. You, by attacking anything, forwhatever reason, with the same method as the attacker, could land you in jail. While with your attack you may lock up phishers in coordination with banks, the phishers lawyers could also claim by law, that the anti-phishing site was also breaking the law by flooding a database, even if the database is malicious or otherwise legitmate,
</div>
<div style="DIRECTION: ltr"><span class="e" id="q_10a52829858584fb_1"><br><br>
<div><span class="gmail_quote">On 3/31/06, <b class="gmail_sendername">Steven</b> <<a onclick="return top.js.OpenExtLink(window,event,this)" href="mailto:steven@lovebug.org" target="_blank">steven@lovebug.org</a>> wrote:
</span>
<blockquote class="gmail_quote" style="PADDING-LEFT: 1ex; MARGIN: 0px 0px 0px 0.8ex; BORDER-LEFT: #ccc 1px solid">Well I think they took a pretty neat and somewhat unique approach to the<br>whole thing. I don't think the claim to have thought of some groundbreaking
<br>perfect solution to stop phishers. However, they are combing through over a<br>billion e-mails a day and looking for a phishing sites. They've tied<br>themselves into some top vendors and are working to get the sites shut down.
<br>They are actually making calls and sending e-mails that have been translated<br>appropriately. On top of that they are flooding the sites with bogus<br>information. How exactly they are doing that.. I don't know. Are they
<br>using different sessions and IP addresses for each bogus request they send?<br>Are they typing in gibberish or stuff that appears completely legit? As<br>many of us know, credit card numbers can instantly be checked to see if they
<br>are even a valid number before you even go through the process of verifying<br>expiration, zip code, cvv, or anything else. Is this company actually<br>taking credit card numbers that could potentiallity be legit account numbers
<br>and inserting them? If not then it would be only take seconds to sort<br>through hundreds of fake and real account numbers.<br><br>Anyway -- I am not sure how they are doing everything, but they are taking a<br>better approach than many. Maybe some of the boneheads lurking about this
<br>mailing list and reply back and let us know if they've been thwarted by this<br>company in any way. :-)<br><br>Steven<br><br>----- Original Message -----<br>From: "ducki3" <<a onclick="return top.js.OpenExtLink(window,event,this)" href="mailto:duckie37@gmail.com" target="_blank">
duckie37@gmail.com</a>><br>To: <<a onclick="return top.js.OpenExtLink(window,event,this)" href="mailto:full-disclosure@lists.grok.org.uk" target="_blank">full-disclosure@lists.grok.org.uk</a>><br>Sent: Friday, March 31, 2006 5:04 PM
<br>Subject: [Full-disclosure] Re: RSA HAVE CRACKED PHISHING, NO SERIOUSLY <br><br><br>> In any case, it's clear that the person who posted that response has *no<br>> idea*<br>> how most bank's anti-fraud systems work.
<br>><br>> First off, the phishers *can't* just run through all the data they've <br>> gotten<br>> in just a few seconds, unless they distributed the work across a bunch of<br>> botnet<br>> zombies - hits for more than a few dozen different accounts from the same
<br>> IP<br>> in the same timespan are suspicious at the very least. <br>><br>> Secondly, the phishers can currently usually be sure that the victims have<br>> given them reasonably good data (unless the victim is a dweeb who can't
<br>> enter<br>> their DoB or account number correctly). On the other hand, if the phished <br>> data<br>> has been polluted by 90% bad data, then only 1 of 10 attempted<br>> transactions<br>> will succeed - and the fact that they're trying lots of different bad data
<br>> will<br>> again hopefully trigger an alert. If you only succeed every 10th time, <br>> and you<br>> get locked out after 3 attempts with different bad data, it's going to<br>> take you<br>> a lot longer to figure out which ones are good and which ones are bad....
<br><br><br>Consider that some of these fake accounts could also be used as Honey keys. <br>They would of course have to work in conjunction with the banks /<br>sites to utilize this.<br><br>It would be rather difficult for a phisher to sort through thousands
<br>of Id's when IP addresses keep getting shut off based on a Honey Key. <br><br>You would have to own a lot of BOTs and a lot of patience.<br><br><br>Duck<br><br>_______________________________________________<br>Full-Disclosure - We believe in it.
<br>Charter: <a onclick="return top.js.OpenExtLink(window,event,this)" href="http://lists.grok.org.uk/full-disclosure-charter.html" target="_blank">http://lists.grok.org.uk/full-disclosure-charter.html</a><br>Hosted and sponsored by Secunia -
<a onclick="return top.js.OpenExtLink(window,event,this)" href="http://secunia.com/" target="_blank">http://secunia.com/</a><br><br><br>_______________________________________________<br>Full-Disclosure - We believe in it.
<br>Charter: <a onclick="return top.js.OpenExtLink(window,event,this)" href="http://lists.grok.org.uk/full-disclosure-charter.html" target="_blank">http://lists.grok.org.uk/full-disclosure-charter.html</a><br>Hosted and sponsored by Secunia -
<a onclick="return top.js.OpenExtLink(window,event,this)" href="http://secunia.com/" target="_blank">http://secunia.com/ </a><br></blockquote></div><br></span></div></blockquote></div><br>