Vigilante Hackers use Old West Tactics for Justice 532
dismorphic writes "Angered by the growing number of Internet scams, online 'vigilantes' have started to take justice into their own hands by hacking into suspected fraud sites and defacing them. These hackers have targeted fake websites set up to resemble the sites of banks or financial institutions in recent weeks, and have inserted new pages or messages. Some say 'Warning - This was a Scam Site,' or 'This Bank Was Fraudulent and Is Now Removed.'" So maybe it's not a posse of horsemen, but it's still kinda cool that someone is taking care of those who would defraud the public.
justice (Score:5, Interesting)
Jury nullification (Score:5, Interesting)
Re:Jury nullification (Score:5, Insightful)
Re:Jury nullification (Score:5, Interesting)
Agreed. From the end of TFA:
And while your industry is sitting around doing nothing about these fake sites set up in countries where the local police care more about rounding up dissidents than stopping fraud, people are losing their life savings. I'll take my chances with the vigilantes. Even if they make mistakes, at least they're doing something
Re:Jury nullification (Score:5, Insightful)
What happens when they come after YOU, and you don't have due process to protect you?
-d
Re:Jury nullification (Score:3, Funny)
Re:Jury nullification (Score:5, Funny)
Re:Jury nullification (Score:5, Interesting)
Re:Jury nullification (Score:4, Funny)
Darwinism?
Re:Jury nullification (Score:3, Insightful)
Re:Jury nullification (Score:5, Insightful)
Self policing society (Score:5, Interesting)
On another level, Slashdot is the pulpit where the topic of freedom gets a lively and ongoing discussion. Freedom to use and create software, freedom to exchange ideas, data, tools, freedom of expression, etc., etc.
The 'net is not quite the free-for-all that some believe. And this self-regulation, self-policing, self-examination that is already the norm, is proof of the responsibility and maturity of so many here who make the net what it is; a cool place now, and a thing of hope for the future. So the idea of people going out and disrupting bad behavior on the 'net is a virtual tradition. To me this is a very good sign.
Let's continue working to keep the gummint's clumsy hands off the 'net. I know they made the net, but it has grown in size and importance because of public involvement.
Re:Self policing society (Score:5, Insightful)
- For instance, in the recent article about 911 and Vonage, virtually every post supporting Vonage and calling the victim 'stupid' was modded *up*, whereas virtually every one criticizing Vonage for it's misleading marketing material was modded *down*.
- In a recent article about militarizing space, virtually every article criticizing the Administration and misreading the various treaties was modded *up*, while pointers to correct interpretations of the treary was modded *down*.
- In virtually every article about the Shuttle, posts praising Soyuz are modded *up*, and posts pointing out that it's not as safe as propoganda would have you believe is modded *down*.
The same can be seen in any article about MicroSoft, SCO, and a vast variety of other topics.Slashdot is indeed ruled by a mob - a mob extremely intolerant of dissident views and facts that fail to meet it's fore-ordained conclusions.
Certainly - If you define 'freedom' as 'I can do whatever the hell the I want without any restrictions or respect for other peoples rights, except maybe the people I agree with'. The same Slashdot that gets annoyed about GPL violations is the same Slashdot who openly espouses theft of *other peoples* IP.And that's the ultimate tragedy of vigilante justice - it's almost always represents the views of the 'men on white horses', not those of society.
It's almost utterly unregulated and unpoliced - except for very small corners. And virtually all of those small corners are intolerant of anything 'not them'. They aren't about freedom - they are about bigotry and isolationism.Re:Self policing society (Score:3, Insightful)
Mob rule follows the loudest idiot and it can be rather dangerous if unatended . Not that i disgree in principle with swift vigilante justice against phishers , its just it can get out of hand
Yeah... (Score:5, Funny)
Re:Jury nullification (Score:5, Informative)
Not really. For example, if a person doesn't have appropriate charges brought up against them (or there are no such statutes), then there will never be an option for a jury to exercise. The jury might elect not to convict on something, but they can't cause a conviction (on other counts) where there should be one. This is particularly true where the nature of an act (like some innovative new form of online fraud, for example) hasn't been really contemplated by the justice system before.
Re:Jury nullification (Score:3, Insightful)
It sounds like you are saying that if a person comes up with a new fraud scheme, he can't be tried and convicted. I think fraud is a very flexible term. Basically, any transaction in which Fraudster
Re:Jury nullification (Score:4, Informative)
Re:Jury nullification (Score:4, Informative)
The punchline? Possession of paraphenalia isn't a crime where he lives. (Of course, he wasn't convicted, either.)
Full story here [proliberty.com].
Re:Jury nullification (Score:3, Interesting)
Re:Jury nullification (Score:3, Interesting)
Even for a single-hosted box, the person running the box may not be aware of what it's doing.
Those caveats having been stated, however, I think that it's a nice thing to see being done. I've sent emails to the sites being spoofed suggesting that they ask for this sort of change,
Re:Jury nullification (Score:5, Insightful)
Re:Jury nullification (Score:5, Insightful)
I agree (Score:5, Insightful)
Oh, your concept of right and wrong is different from mine?
Re:I agree (Score:4, Funny)
Re:I agree (Score:2)
There is also a big practical difference between a crime against another criminal (who is unlikely to report or prosecute) and a crime against a non-crimial.
Re:I agree (Score:2)
The original sites are criminal, as defined by the laws of most nations. (Find me one where fraud by impersonating a financial institution is legal.)
There is a difference between "criminal", as defined by the laws of the nation/state/society and your "opinion" of "unwanted".
If the people doing the defacing were just picking stuff they didn't like, instead of stuff that is criminal, then you might have a point.
-Charles
Re:I agree (Score:5, Insightful)
Re:justice (Score:2, Insightful)
It's both (n/t) (Score:2)
Re:justice (Score:4, Insightful)
If you don't have a trial with evidence, all you are doing is creating cycles of revenge, with no resolution. With a justice system, wrongs can be righted, and then we are done with the matter.
There is no justice system that is totally perfect, but resorting to vigilantism when justice isn't perfect would make the situation much much worse.
Re:justice (Score:5, Insightful)
Re:justice (Score:4, Insightful)
That said I really don't care about these sites getting defaced, if they accidently deface a legitimite site well then I think they should be punished.
Re:justice (Score:2)
A similar argument could be made for vigilantism. The problem is is that the line has to be drawn somewhere. What if defacing the sites isn't good enough? What if somebody thinks it's funny to put goatse or something on their site? What if they DoS attack the site with zombie computers? Etc.
I can imagine you're s
Re:justice (Score:5, Insightful)
Re:justice (Score:5, Insightful)
Actually, slippery slopes sometimes start like this. With a clear cut case of right and wrong. But tomorrow it might be used as precedents for other actions. For example, DMCA "violators" might find their site defaced with a sign that says: "This software brakes the law and the author is a criminal".
When someone bypasses the rule of the law and proper procedures and takes justice into his own hands, and "the system" looks the other way or even condones the action, it opens the door to all other sort of vigilantism.
Re:justice (Score:3, Interesting)
If I see someone getting pickpocketed and I can aid them in getting their money back,... What am I going to do? Stand idly by and not say anything?
Slippery slope not a valid argument? (Score:3, Insightful)
"This type of argument is by no means invariably fallacious, but the strength of the argument is inversely proportional to the number of steps between A and Z, and directly proportional to the causal strength of the connections between adjacent steps. If there are many intervening steps, and the causal connections between them are weak, or even unknown, then the resulting argument will be very weak, if not downright fallacious."
ie: The strength of the slippe
Re: (Score:3, Interesting)
Re:justice (Score:2)
I've often thought of writing a script to flood bogus data into scam sites, so that at least they couldn't get any real data out of it after the script had started.... Anyone think that would work, or am I overlooking something?
Smart scammers will keep track of IP addresses via a script running on the server, and block you after a while. Of course, as we all know from some of the spam and scams out there, the bad guys are not always all that bright.
I remember reading an article on Slashdot about this sp
Re:justice (Score:2)
If they know how to hack a site they know how to go through an anonymous proxy.
Re:justice (Score:2)
My memory is failing me be it sounds akin to ..... *thinking: brain wishing I'd had breakfast and a good night's sleep with a nun* ... here it is: Make Love, Not Spam [makelovenotspam.com].
Click the little "click here" if you click the link I made above -- interesting factoids. I remember being all happy about this and saddened that it got sh
Re:justice (Score:4, Funny)
There is no way you are going to bring down their site.
Re:justice (Score:5, Interesting)
I do this all the time. It is easy with the Firefox Web Developer extension. I just turn the post into a get, remove the field limits, and fill the fields with hundreds of characters. I usually take some text from Project Gutenberg. Then I stuff the big GET into a wget command in a looping bash script and let it run for a few hours. These sites are usually just php mailers, and so I get the satisfaction of filling a scammers mail box.
Probably useless, but it makes me feel better.
(arg, slashdot says I'm a script!, that is it, I done coding for the day and I'm going for a beer)
Re:justice (Score:3, Insightful)
kinda cool though.
Re:justice (Score:3, Informative)
If you don't fight back, you are perceived as weak. Criminals prefer to prey on the weak. So by not fighting back, you are making yourself an attractive target, and will be exploited.
Vigilante justice occurs when a group is doing something that the general public can openly agree
Re:justice (Score:2)
I might agree with you if I thought people generally had a good sense of proportion.
Re:justice (Score:5, Funny)
ahhh... (Score:5, Funny)
Re:ahhh... (Score:4, Funny)
gov. crackdown (Score:3, Insightful)
Re:gov. crackdown (Score:2)
Re:gov. crackdown (Score:2, Interesting)
Re:gov. crackdown (Score:3, Insightful)
Western Justice, eh ... (Score:2, Funny)
It's not a dupe... (Score:2)
If only they could hack the email servers as well (Score:5, Funny)
My name is Dr. Samouismai from the royal family of Nigeria and I would like to offer you a proposal that you may find compelling.
I have recently come into an inheritance of goatse pics and I feel that I can not hold all of it safely. I would propose that if you agree I will hold 26 million of these pics in trust for you to deposit at whatever place you wish to keep them.
I would like to meet to arrange this as soon as possible. If this deal succeeds, I would also like to discuss the possibility of you acquiring my collection of 4.3 million woopie cushions.
Sincerely,
I forgot my real name but I usually go by Jack Ass
Hmmmm (Score:2)
Hacking into these legitimate companies doesn't do anything to hurt the scammers.
Depends (Score:3, Insightful)
If the vigilantes take down the scam site, then they may prevent some people from falling victim to it. It may not hurt the scammer, but it might protect the innocent.
And, frankly, these "legitimate companies" should do more to prevent the use of their services for fraudulent purposes. Say, writing a script to search though the hosted material for the phrase "bank account" and flag any occurrences for human review.
I can't s
Re:Hmmmm (Score:5, Insightful)
?
You think that it doesn't hurt phishers when their "closer" is rendered inoperational? Maybe I'm wrong, but I'm going to bet that some phisher that used their botnet to send out millions of emails (losing a number of their bots in the process) is going to be pretty pissed when some whitehat knocks their server offline before all of the morons enter their username and password.
Re:Hmmmm (Score:2)
The industry itself... (Score:5, Insightful)
So would we.
Hackers not always bad (Score:2)
Retribution (Score:5, Insightful)
Any halfway intelligent phisher would record the IP address of each submission and just dump all of mine when he saw there were bogus, but it makes me feel good that I at least wasted some of his time
Re:Retribution (Score:2, Funny)
Re:Retribution (Score:4, Interesting)
Seriously, how hard is it to find a phishing site's servers and the owners? I forward links, emails w/headers, whois info (one guy had his real name, address, etc. in the whois for the domain!), etc. to the authorities any time I get the emails. If you can find the hosting company, server, etc. and track down the account owner, that might work.
But if that information is false, giving them a valid account with a "honeytoken" like you describe would be a great way of continuing your search. It's more likely that the scammer has taken precautions on their hosting account than they will when they try to use the invalid account information.
Re:Retribution (Score:5, Funny)
>documentary "Enemy of the State".
Yeah, I wish Time had put documentaries in their Top 100 films list. That one surely would have been right there.
Did you notice how the mainstream media just ignored that, treating it like just another movie?
I added another layer of foil to the bomb shelter after I saw it.
Re:Retribution (Score:4, Interesting)
Come on... post the script!
Re:Retribution (Score:5, Informative)
for ($i = 0; $i 100; $i++) {
$ssn = sprintf("%03d%02d%04d", rand(100, 999), rand(0, 99), rand(0, 9999));
$cardnumber = sprintf("%04d%04d%04d%04d", rand(0, 9999), rand(0, 9999), rand(0, 9999), rand(0, 9999));
if (rand(0,1)) $cardnumber
$expmonth = sprintf("%02d", rand(1, 12));
$expyear = rand(2005, 2011);
$cardpin = sprintf("%04d", rand(0, 9999));
for($len=10,$r1='';strlen($r1)$len;$r1.=chr(!mt
mt_rand(48,57):(!mt_rand(0,1)?mt_rand(6
(97,122))));
for($len=10,$r2='';strlen($r2)$len;$r2.=chr(!mt
mt_rand(48,57):(!mt_rand(0,1)?mt_rand(6
(97,122))));
$email = "{$r1}@{$r2}.com";
echo "$ssn\n$cardnumber\n$expmonth\n$expyear\n$cardpin
$ch = curl_init();
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, "ssn={$ssn}&cardnumber={$cardnumber}&expmonth={$e
{$cardpin}&e
curl_setopt($ch, CURLOPT_URL, 'http://www.ewwf.ro/KeyBank/enroll.php');
curl_s
');
curl_setopt($ch, CURLOPT_REFERER, 'http://www.marumitu.com/KeyBank/enroll_auth.html
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($ch, CURLOPT_HEADER, 1);
curl_setopt($ch, CURLOPT_TIMEOUT, 300);
$result=curl_exec($ch);
curl_close($ch);
}
Re:Retribution (Score:5, Informative)
I hope you're giving the phishing sites numerically valid credit card numbers- essentially there's a checksum hidden in a card number. Phishers can screen out completely randomly generated card numbers because their checksum doesn't match.
Here's a link to the algorithm*
http://www.beachnet.com/~hstiles/cardtype.html [beachnet.com]
Enjoy.
*No, reverse-engineering the algorithm won't generate a valid card, but it'll generate a "not obviously invalid" card.
Re:Retribution (Score:5, Informative)
Post it on Planet Source Code [planet-source-code.com] -- thousands of people could be using it tomorrow.
Re:Retribution (Score:3, Interesting)
What if you generate and submit a valid, existing, card number by accident?
Re:Retribution (Score:3, Interesting)
Be wary of... (Score:2, Informative)
"link to the bank's real web site"
he he he he he he
Regards
Arash Partow
_______________________________________________ _ __
Be one who knows what they don't know,
Instead of being one who knows not what they don't know,
Thinking they know everything about all things.
http://www.partow.net/ [partow.net]
Hacker Man! (Score:5, Funny)
Does whatever a hacker can
pwns fake websites, any size
Catches phishers, just like flies
Look out! There goes the Hacker-man!
Is he strong? Listen, Bud!
He's got caffinated blood.
Can he type from a chair?
Take a look over there.
Hey there, there sits the Hacker-man!
In the chill of night,
At the scene of the crime
Like a streak of light
He arrives just in time
Hacker-man, Hacker-man
Friendly neighborhood Hacker-man
Wealth and fame, he's ignored
Action is his reward
To him, life is a great big bang-up
Wherever there's a scam-up
You'll find the Hacker-man!
Reminds me of... (Score:2, Insightful)
Re:Reminds me of... (Score:3, Informative)
According to a recent article [slashdot.org], many phishing websites are run on already insecure systems that are hacked by the phishers. This is a "good" idea from their perspective, as it makes them harder to trace. However, in such cases, the only element of choice given to the ph
a better tactic? (Score:2)
wouldn't it be a better idea to find the people behind them (it's not too hard...) and go from there?
Why didn't they create EFFECTIVE anti-phish system (Score:2)
If they are smart and talented enough to break into a webserver, they could use those skills to set up some sort of clearinghouse for phish sites to avoid that could be done as some sort of proxy + RBL for phish sites. Better yet, program a web proxy program that does something simple:
Compare the href tags in downloaded webpages with the displayed links. If the 'root' domains don't match, imbed a warning in the HTML page before it is sent to the browser for the user to see.
Re:Why didn't they create EFFECTIVE anti-phish sys (Score:2)
Because it doesn't take much intelligence, talent or initiative to 0wn a web server that is running unpatched software?
Vigilante activism (Score:5, Interesting)
#!/usr/bin/perl
# This is a perl script I wrote to piss off the phishers. What this
# script does is generate fake credit card numbers that look like real
# credit card numbers. This way, I can add bogus information to
# phishing sites that looks legitimate
# License: Public domain
sub verify {
my($cardnum) = @_;
my($a,$b,@cc);
for($a = 0;$a < 16; $a++) {
$cc[$a] = substr($cardnum,$a,1); }
for($a = 0; $a < 16; $a+= 2) {
$b = $cc[$a] * 2;
if($b > 9) {
$b -= 9;
}
$cc[$a] = $b;
}
$b = 0;
for($a = 0 ; $a < 16; $a++) {
$b += 0 + $cc[$a];
}
return $b % 10 == 0;
}
for(;;) {
$d = "54"; # Some phishing sites only accept cards where the
# first numbers look like they come from a bank
# This looks like a generic US MasterCard number
# (MasterCard is actually 5[1-5], but I'm too
# lazy to make the second digit a random number
# from 1 to 5)
for($c = 2 ; $c < 16; $c++) {
$d = $d . int(rand(10));
}
#print $d . "\n";
if(verify($d) == 1) {
print $d . "\n";
sleep(1);
}
}
Mod parent down (Score:5, Funny)
It was fake; here's the real one (Score:3, Interesting)
do {
my ($cc, $sum) = '54' . (join '', (map { $_ = int rand 10 } (1..13))) . '0';
foreach $digit (split
foreach $digit (split
$cc =~ s/.$//;
print $cc, 9 - ($sum % 10), "\n"
} while (sleep 1);
Anarchy (Score:2)
2nd Amendment (Score:4, Funny)
I believe our Founding Fathers, well-versed in the technology of the day, said it best:
Easy way to get phishing sites closed down (Score:5, Funny)
That way, the FBI, RIAA, MPAA will all be round there in about 10 minutes flat.
someone is biased against horses (Score:2, Funny)
I take issue with this statement. Yes horses are not as popular as they once were, but that doesn't mean they are completely out of the picture. Why you automatically assume that everyone else subscribes to your horseless worldview, I have no idea.
The Real Truth (Score:2, Funny)
Hackers should know better. (Score:3, Insightful)
Sorry, I know good engineering work is harder, much less exciting, and much less satisfying than hacking the enemy directly, but why play whack-a-mole when you can make them obsolete? Ok, enough ranting. I hope y'all had fun.
"Old West Tactics" (Score:5, Informative)
This really isn't an "Old West" tactic, but a tactic used in the United States, UK and other nations with a tradition of Common Law or the inclusion of extensive non-statutory law reflecting a consensus of centuries of judgements by working jurists.
As times changed laws became codified and the power of the People to enforce the law were erodded in the United States and other countries.
A Judge had to own 500 acres of land without debt on the land and they had the power to cherry pick what they wanted in terms of the law for the circumstances. Law then was terrible complicated, looking at a History of American Law by Lawrence M. Friedman shows that it's terrible complex and not nearly codified enough to just throw out a list of laws and punishments. Since the law on the frontier was often a copy/paste affair and made up by the Judges and not codified, a Judge had the power to make up laws. Like Evesdroping in 1808 or Droping a Dead Body into a River in 1821. Federal Judges started to go wild with common law crimes after U.S. V. Hudson and Goodwin in 1812.
This case allowed a Federal Judge or define a crime and issue a punishment for it. Codification would stop this by defining what was a crime, and stop a Judge from making up a crime.
A Posse wasn't normally a group of people acting as vigilanties, but a Posse is a group deputized by a Law Enforcment agent (Town Marshal, Sheriff, Federal Agent, etc) for a fixed duration or event since communities didn't have large standing forces.
Some examples from an essay I found on the web a while back while researching the law in the 1860s
Citizen's Arrest
Students of the law should note that both a statutory and common law basis for a certain degree of "vigilante behavior" is well founded. Indeed, in an era of lawlessness it is important that readers be advised as to their lawful right to protect their communities, loved ones and themselves by making lawful citizens' arrests.
First, what is an arrest?
We can thank Black's Law Dictionary for a good definition: "The apprehending or detaining of a person in order to be forthcoming to answer an alleged or suspected crime." See Ex parte Sherwood, (29 Tex. App. 334, 15 S.W. 812).
Historically, in Anglo Saxon law in medieval England citizen's arrests were an important part of community law enforcement. Sheriffs encouraged and relied upon active participation by able bodied persons in the towns and villages of their jurisdiction. From this legacy originated the concept of the posse comitatus which is a part of the United States legal tradition as well as the English. In medieval England, the right of private persons to make arrests was virtually identical to the right of a sheriff and constable to do so.
A strong argument can be made that the right to make a citizen's arrest is a constitutionally protected right under the Ninth Amendment as its impact includes the individual's natural right to self preservation and the defense of the others. Indeed, the laws of citizens arrest appear to be predicated upon the effectiveness of the Second Amendment. Simply put, without firepower, people are less likely going to be able to make a citizen's arrest. A random sampling of the various states as well as the District of Columbia indicates that a citizen's arrest is valid when a public offense was committed in the presence of the arresting private citizen or when the arresting private citizen has a reasonable belief that the suspect has committed a felony, whether or not in the presence of the arresting citizen.
District of Columbia Law 23- 582(b) reads as follows:
(b) A private person may arrest another -
(1) who he has probable cause to believe is committing in his presence -
(A) a felony, or
(B) an offense enumerated in section 23-581 (a)(2); or
(2) in aid of a law enforcement officer or special policeman, or other person authorized by law to make a
Re:"Old West Tactics" (Score:3, Informative)
law-enforcing citizen: somebody who punishes lawbreakers personally and illegally rather than relying on the legal authorities
Microsoft® Encarta® Reference Library 2005. © 1993-2004 Microsoft Corporation. All rights reserved.
This seems more like crime prevention. One would hope that the prevention of a crime, especially without causing harm, would be considered a duty.
I would like to say "good work" to the
Well, that explains it all (Score:3, Funny)
I never felt so insulted in all my life. Well, then. If that's people's gratitude, I'll just stop that and if they lose their credit cards, they're on their own.
Re:Natural progression (Score:2)
Or WILL not.
Re:Natural progression (Score:2)
Re:well... (Score:2)
fighting fire with fire sometimes works...
That or it just makes a bigger fire.
Re:Report yourself to the authorites? (Score:2)
The scammers' ISP?
"This guy hacked one of our customers' sites! Lock him up!"
Re:Report yourself to the authorites? (Score:5, Funny)
Well most comic book heroes have great powers, or amazing tools and weapons and um...oh yeah...They Don't Exist!
Re:They missed something. (Score:2)
Giggle giggle *SNORT* tee hee.
Thanks for the laugh! My anti-M$ bias needed a little stroking today.
Re:They missed something. (Score:2)
Re:Where are the authorities? (Score:4, Funny)
Having a doughnut.