Ethics Question

By joining our community you will have the ability to post topics and access other forums reserved for members. Registration is quick, simple and absolutely free. Join our community today by clicking here.

Posted: Sun Jun 21, 2009 11:12 pm

This concerns those fake bank account sites that ask for banking information including the PIN. I know the first thing I need to do is report it immediately, before doing anything else. But, I’m wondering if it’s considered ethical to mess with the lads while it’s being shut down.

By messing with them I mean just entering random numbers in those fields. If you enter just a bunch of random numbers, the odds of getting anything valid are astronomical.

Account number – There are 9,999,999,999,999,999 possible combinations
Security Code – 999 possible combinations
PIN – 9999 possible combinations
Expiration Date – 120 possible combinations (that’s assuming they’re giving you a 10 year range to choose from)

So, to determine how many possible combinations there are for just those 4 fields, it would be

(Account Number) x (Security Code) x (PIN) x (Expiration Date) =
9,999,999,999,999,999 x 9999 x 999 x 120 x =

1,198,680,119,999,999,880,139,880

And that’s not including the fact the name you give is crap to begin with.

So, I find a fake bank site, the very first thing is to report it and get it shut down. That is the #1 priority. But, once I report it, how about going back and just start entering garbage until it’s shut down. Hopefully the lad is copying all that information or printing it or doing something with it. He’s wasting his time of course, it’s all bogus. I have time to give him 10 or 20 bogus accounts to waste his time.

So, is this considered ethical according to this forum rules?

Posted: Mon Jun 22, 2009 4:59 am

I don't think it's really covered in our rules, as those mainly concern baiting behaviour. This is, in fact, just spamming his database. You could also search for an automatic form-filling bot that does all the work for you...

Personally I think this would be a waste of bandwidth (and my time!!) and wouldn't bother, if you simply report it to the ISP it will get closed down fast enough...

Baiting Guru Joined: 19 Apr 2007 Posts: 3123

I think the advice given by such tools as the Lad Vampire, wasting bandwidth is just plain in-effective. Go with the commonly accepted method of reporting fake sites.

Posted: Mon Jun 22, 2009 12:19 pm

Jack Pump wrote:

This concerns those fake bank account sites that ask for banking information including the PIN.

Phishing sites? We aren't concerned with them. Nothing unethical about messing with them, but it isn't really what we do.

Baiting Guru Joined: 04 Jan 2006 Posts: 3193

These aren't Fake banks, as we use the term. There is no ethical argument I have ever heard against doing what you are suggesting. If I remember correctly, there used to be a site that was supposed to do what you suggest, phish-food or something. You gave them a site address and they did the rest, although there was some question whether they did in fact do what they said they did.

Posted: Mon Jun 22, 2009 4:08 pm

Are you talking about the fake bank sites that have a "register" link? Either way, it's probably not worth your time and effort to bother.

419Eater is my life Joined: 10 Jul 2008 Posts: 366

The phishing scammers generally use the banks they are spoofing to verify the information.

Phishing scams victimizes many truely inocent people. It is important to report these as fast as possible to the hosting ISP and the bank security to minimize the danage they can cause.

Killing phishing scams is not anywhere near as much fun as baiting.

p.

Posted: Mon Jun 22, 2009 7:40 pm

It's effective and useful though, all good work to be doing.

Don't forget to put it in the "fake banks" section of the site so we can have a nose round, and we'll watch it burn.

Posted: Mon Jun 22, 2009 8:36 pm

If you want to bury phishers with false data, just go to http://phishfighting.com/.

Posted: Wed Jun 24, 2009 4:14 am

^^ thank you for that link.

but phishfighting is up for sale now as the owner says he cannot devote time to maintaining it.
is this an activity that 419eater might want to move into?
i'm not suggesting we buy the site, but the concept can probably be replicated easily