taint.org: Justin Mason’s Weblog

/. posted a link to this interview with Nitesh Dhanjani and Billy Rios, two guys who have infiltrated the “phishing underground”.

It’s a good article — lots of detail on the current toolset of a typical phisher, and some details on the community itself:

I had always thought that most phishers were clever hackers evading authorities using the latest evasion techniques and tools. The reality of the matter is most of the phishers we tracked were sloppy and unsophisticated. The tools they used were rarely created by the phisher deploying the actual scam, and for the most part it seemed the phisher merely downloaded kits and tools from some place and reused over and over and over again. It also seemed that many phishers don’t even really understand how the phishing kits they’ve deployed work! We also came across many phishing kits and tools that had simple backdoors written into the source code (essentially, phishers phishing phishers). These backdoors are easily spotted by anyone who has even a basic idea of how the source code flow worked, yet was undetected by many phishers. Maybe a few phishers out there are skilled, but the majority are clueless.

Here’s something I’ve noted about spammers, too — there’s no honour among thieves:

The number of backdoors we saw was staggering. The servers serving the phishing sites had backdoors, the code used in the phishing kits had backdoors, the tools used by phishers had backdoors. Phishers aren’t afraid to steal from regulars people and they are also not afraid to steal from other phishers. Some of the backdoors were meant to keep control over a compromised server, while other simply stole information that had been stolen by other phishers! We came across several forums where phishers, scammers, and carders basically identified other phishers, scammers, and carders that had scammed them. These shady characters may work with each other but they sure don’t trust each other, that’s for sure.

And this is a very important point about blacklists:

Phishers are likely to abuse the blacklists published for [anti-phishing] plugins for their own benefit. The blacklists are a list of known phishing sites that the plugins consume in order to identify what websites are fraudulent. These blacklists therefore contain IP addresses and host names of servers hosting phishing sites. Since phishing sites are commonly installed on servers that have been compromised, and phishers don’t bother to patch systems they have installed their kits on, this list translates to a ‘list of easily compromisable hosts’ for other phishers.

On the latter point, this is one of the key benefits of DNS blocklists, compared to the downloaded, text-based style that Google initially used for its anti-phishing toolbar. To query a DNSBL, you need to know the address you’re looking for first of all; but with a text file, you can read the lists in their entirety, without knowing the address in advance. (Google is now apparently tending to use the enchash format, which fixes this.)

And a final word:

For the next few years, we are going to continue to apply band-aids around the problem of data leakage, and continue to play whack-a-mole with the phishers without solving the actual problem at hand. In order to make any significant progress, we must come up with a brand new system that does away with depending on static identifiers. We will know weâ??ve accomplished this when we will be able to publish our credit reports publicly without fearing for our identities.

(I’d place more importance on the liability of the financial institutions, myself — I think they get away with placing too much blame on the victims of fraud and identity theft.)

Good interview — worth reading.

Tags: blacklists, blocklists, dnsbls, infiltration, interviews, phish, phishing, scams

Ballardian.com just posted an interview with Bruce Sterling about J.G. Ballard by Chris Nakashima-Brown. One of my favourite authors talks about the other — it’s amazing!

A couple of highlights:

… The assumptions behind The Crystal World were so radically different and ontologically disturbing compared to common pulp-derived SF. If you just look at the mechanisms of the suspension of disbelief in The Crystal World, it’s like, okay, time is vibrating on itself and this has caused the growth of a leprous crystal … whatever. There’s never any kind of fooforah about how the scientist in his lab is going to understand this phenomenon, and reverse it, and save humanity. It’s not even a question of anybody needing to understand what’s going on in any kind of instrumental way. On the contrary, the whole structure of the thing is just this kind of ecstatic surreal acceptance. All Ballard disaster novels are vehicles of psychic fulfilment.

….

My suspicion is that in another four to five years you’re going to find people writing about climate change in the same way they wrote about the nuclear threat in the 50s. It’s just going to be in every story every time. People are going to come up with a set of climate-change tropes, like three-eyed mutants and giant two-headed whatevers, because this is the threat of our epoch and it just becomes blatantly obvious to everybody. Everybody’s going to pile on to the bandwagon and probably reduce the whole concept to kindling. That may be the actual solution to a genuine threat of Armageddon — to talk about it so much that it becomes banal.

To me these late-Ballard pieces, these Shepperton pieces — Cocaine Nights, Super-Cannes and so forth — really seem like gentle chiding from somebody who’s recognized that his civilisation really has gone mad. They’re a series of repetitions that say, ‘Look, we’re heading for a world where consensus reality really is just plain unsustainable, and the ideas that the majority of our people hold in their heart of hearts are just not connected to reality’. I think that may be a very prophetic assessment on his part. I think we may in fact be in such a world right now — where people have really just lost touch with the ‘reality-based community’ and are basically just living in self-generated fantasy echo chambers that have no more to do with the nature of geopolitical reality than Athanasius Kircher or Castaneda’s Don Juan.

Tags: bruce-sterling, climate-change, interviews, jg-ballard, scifi