News for hackers. Stuff that matters.

A comment on Someone used my IPFS gateway for phishing. Parent comment

Re:Someone used my IPFS gateway for phishing by jstanley on Thursday October 04, 2018 @05:47PM (#18143947)
Note that the link to the OneDrive URL does not come from IPFS. It comes from the URL fragment, which makes it even more murky as to whether the IPFS hash should even be blocked! Perfectly legitimate sites could be using exactly the same content with no knowledge of the phishing attack. It is just copy and pasted from https://itty.bitty.site/

I didn't look into how GMA.html works, but a quick look just now shows that it posts to https://searchurl.bid/joyceesther0101/finish1.php

[ Parent | on HN ]
Re:Someone used my IPFS gateway for phishing by cwkoss on Thursday October 04, 2018 @05:51PM (#18143978)
Ah, I didn't catch that the Base64 string was part of the query param, not stored in IFPS. Yeah, seems like IFPS data isn't offending whatsoever in this case.

Interesting that it is 'facilitating' phishing (as in dependency in attack chain), but only to the extent that would apply to a number of general-purpose open source libraries, or the browser, or any OS or ISP.

Seems like DigitalOcean made the wrong choice, but the technical complexity of the situation is enough to not put too much blame on them. Unresponsive support is disappointing.

[ Parent | on HN ]
Re:Someone used my IPFS gateway for phishing by jstanley on Thursday October 04, 2018 @06:23PM (#18144202)
I agree that it's too complex to expect front-line abuse support to work out what's going on, but yes I did expect them to turn my networking back on after I blacklisted the hash.
[ Parent | on HN ]
Re:Someone used my IPFS gateway for phishing by miyuru on Friday October 05, 2018 @12:44AM (#18145781)
Digitalocean disabled network access to one of my droplets too. They won't respond to your emails, but poke them on twitter and hopefully you will get a response back. mine to 10 days to get a reply.

I switched to scaleway afterwards.

[ Parent | on HN ]
Re:Someone used my IPFS gateway for phishing by cwkoss on Thursday October 04, 2018 @05:57PM (#18144021)
Looks like they are using 'Vesta', here's their control panel https://searchurl.bid:8083/login/

https://forum.vestacp.com/viewtopic.php?p=68594#p68594

https://www.digitalocean.com/community/questions/how-do-i-de...

Appears there was a vulnerability in this panel, seems plausible that 'owner' of this page is an additional victim of the attacker.

[ Parent | on HN ]
Re:Someone used my IPFS gateway for phishing by danielhlockard on Thursday October 04, 2018 @11:14PM (#18145466)
Wow, there's a lot of open ports on that box.
[ Parent | on HN ]