Geekblok

I can’t stand phishing, so when someone send me a link to login today, I decided to poison the phising pool. The site in question (hopefully disabled by now) asked for my Yahoo! account info.

So how to poison the phishing pool? Quite easy! Just send the phiser a lot of false data. So much that the real data of poor people is harder to filter out. Luckily with Perl, it’s quite easy to do so.

First, let’s look at the page. It looks like a Flickr login screen, but if you scan the source, you’ll see that the form isn’t being submitted to Flickr/Yahoo!, but to a mailto.cgi at www2.fiberbit.net. The source even shows where the mails are being forwarded to (the_kontrak@yahoo.com). After tweaking the page a little on my own server, I found out that the mailto.cgi script sends out a mail with the login info, aswell as HTTP_REFERER, IP address and browser information. So in order to fake our information we need to spoof everything.

What needs to be done?

1. Generate usernames
2. Generate passwords
3. Spoof referrer
4. Spoof IP address
5. Spoof browser information

The last three are all done at LWP::UserAgent level, so let’s look at the generation part first.

Yahoo! usernames usually contain some name and a rather pointless number. For this, we need names. Behind The Name offers us random names, so let’s use that. As for passwords, let’s just go the easy way: Text::Password::Pronounceable

The referrer and browser info are all decided at the client’s side, so claiming to be a MS Windows machine with Internet Explorer 6 and coming from the “evil form” isn’t so hard. Since the IP address is also being passed on to the attacker, we’ll use proxies. PublicProxyServers.com is a good place to start.

Here’s the script I’m using to spam the attacker (yes, I now am a spammer shrug):

use strict;
use LWP::UserAgent;
use Parallel::ForkManager;
use Text::Password::Pronounceable;

# Set up a ForkManager to speed things up a little
my $pm = new Parallel::ForkManager(15);

# Create the user agent object
my $ua = LWP::UserAgent->new;

# Yes sir! We're MSIE!
$ua->agent('Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)');

# Populate the proxy array
my @proxies = map { chomp; $_; } (<DATA>);

while(1) {
 my $pid = $pm->start and next;

 # Sorry behindthename.com! Don't want to hammer your server,
 # but have no other option :-S
   my $html = $ua->get('http://www.behindthename.com/random/random.php?'.
                       'number=2&gender=m&surname=&all=no&'.
                       'usage_dut=1&usage_eng=1');
if($html->content =~ m!<font class="heavymedium">(.+?)</font>!gs) {
      # Now we have the name with HTML crap in it
      my $name = $1;

      # Strip the HTML (horrible way; don't want to use a HTML parser
      $name =~ s!<[^>]+>!!g;

      # Strip whitespaces
      $name =~ s!^\s*!!;
      $name =~ s!\s*$!!;
      $name =~ s!\s+! !;

      # Lowercase the stuff
      $name = lc($name);

      # Include a random number ... sometimes
      $name .= int(rand(3000)) if(int(rand(10)) % 2 == 0);

      # Strip or substitute spaces
      if(int(rand(10)) % 2 == 0) {
         $name =~ s!\s!_!g;
      } else {
         $name =~ s!\s!!g;
      }

      # Generate a password
      my $password = 
         Text::Password::Pronounceable->generate(6, 20);

      # And we have our Yahoo! username and password handy.
      # Let's print it, so we can see what we're submitting
      print "Working with $name/$password\n";

      # Random proxy
      my $proxy = @proxies[int(rand(int(@proxies)))];

      # And post it to our evil mail script
      $ua->default_header('Referer' =>
         'http://www.geocities.com/klenthing/Album_Photo.html');
      $ua->proxy(['http', 'ftp'], $proxy);
      $ua->post('http://www2.fiberbit.net/form/mailto.cgi', {
         Mail_From      => 'Yahoo',
         Mail_To        => 'the_kontrak@yahoo.com',
         Mail_Subject   => 'New-ID-S',
         Next_Page      => 'http://www.geocities.com/bobs_new_fl_mail/',
         login          => $name,
         passwd         => $password,
      });

      $pm->finish;
   }
}

# Proxies taken from http://www.publicproxyservers.com/
__DATA__
http://213.209.104.8:3128/
http://200.26.114.131:3128/
... etc. ...

This seems to work fairly well. The output looks something like this:

Working with danedenholm/thobor Working with marijn_emery/tbthacthesthavicel
Working with chancemelville2274/cprorrryinses
Working with freek_alexander/agipromesmen
Working with ulysses_cairo106/visolealomb
Working with king_meino/simeiajailengbatofo
Working with dillon_louie1755/theolhfortl
Working with tony_geordie1850/wioashon
Working with garrettwalker/thsedess
Working with wilfanselm2654/hetithin
Working with ianindigo339/terdosasermssven
Working with bryce_andy1101/thalsongave
Working with christiaan_booker/inheesovep
Working with harrison_travers2653/thextrevilau
Working with joe_merv1305/titherbathesenge

And of course it’ll run forever (meaning, until you stop it or when Perl decides the value ‘1′ isn’t ‘true’ anymore).

Now the attacker’s mailbox is being flooded with false data. Hopefully so much that he’ll give up trying the information.

For more effect, listen to the melodramatic black metal of Drudkh while running this script. Seriously, it makes it so much more fun.