{"id":122,"date":"2006-03-28T23:43:27","date_gmt":"2006-03-28T23:43:27","guid":{"rendered":"http:\/\/neosmart.net\/blog\/?p=122"},"modified":"2013-08-26T18:09:01","modified_gmt":"2013-08-26T23:09:01","slug":"the-pirt-blunder","status":"publish","type":"post","link":"https:\/\/neosmart.net\/blog\/the-pirt-blunder\/","title":{"rendered":"The PIRT Blunder?"},"content":{"rendered":"

PIRT<\/a> (Phishing Incident Reporting and Termination) is making<\/a> headlines<\/a> around the web, but take their plans with a grain’s worth of salt for now. For those of you that haven’t heard or can’t be troubled to follow the links, PIRT is a non-profit organization comprised of volunteers, dedicated to tracking links in spam to phishing websites and concentrating their efforts on "shutting those sites down." It may sound like a valiant and praise-worthy effort, but our researchers are unearthing more details that may cast a shadow of doubt on this organizations methods and goals.<\/p>\n

PIRT’s methods for "shutting down" sites aren’t too clearly defined, their homepage mentions contacting hosts and ISPs and requesting their cooperation, but as Netcraft<\/a> reports<\/a>, most phishing schemes launch from the same netblocks repeatedly:<\/p>\n

\n

Fraudsters will often host their sites in developing countries with limited law enforcement resources and incentivize the hosting company to keep the site running as long as it possibly can. Indeed, some unscrupulous hosting companies actually promote fraud hosting as a service. Some hosting companies offer fraud hosting as a service whereby they are incentivized to keep the site up as long as possible, and this necessitates more extensive action<\/u>.<\/p>\n<\/blockquote>\n

Which leads us to question what the most common response in this vast majority of the situation will be, if we accept that these hosts will not help PIRT in its endeavor. Will PIRT ignore ~87+% of the phishing schemes? But their site and ZDNet report a minimum 50% success rate… Is DDOS the answer?<\/p>\n

The first and most obvious question is that of responsibility. Alex Eckelberry of the spyware-removal company "Sunbelt Software" together with Paul Laudanski of CastleCops, an online security community, and his wife, Robin Laudanski, established PIRT a couple of months ago. Both are men of good standing and trustworthy history, but they are normal citizens, not affiliated with the government or ICANN, and as such, are liable to make the same mistakes anyone else would. The biggest cause for concern comes in the lack of a bullet-proof method with which PIRT can verify that a site is indeed engaged in knowing<\/em> phishing techniques. Quite often the most "professional" of phishers will take control over a block on the net and host their sites there for as long as they can keep control over it. In such a case it may very well be that the best course of action is to attack the said netblock with any means necessary, no one will complain if a developing nation’s only server is DDOS’d off the net and the costs incurred and the effect(s) on the citizens and governments of these countries…. or is it?<\/p>\n

Let’s assume they play its not a developing nation then. By doing that we lower the probability of an entire netblock being controlled as well as the number of occurrences that fall under this category. In such a case, it is more likely that a phisher will use exploits and vulnerabilities on servers to compromise the systems, sometimes as surreptitiously as adding a single page and leaving the rest intact. In such a case, an attack or<\/strong> an email to the host will hurt the real owner of the server.. Maybe not fair but definitely not an unworthy sacrifice, and the host will hopefully heed the signs and upgrade\/patch all machines under their control. Check!<\/p>\n

The last category is that of an amateur, a script kiddy if you will. 10 dollars with a stolen\/borrowed credit card will get him\/her shared hosting with PHP, 10 minutes later the emails start going out, and sooner or later they will hit PIRT. In such an occasion can shutting down a "first-timer" justify DDOSing an entire shared server with thousands of users? Is it legal? Morally\/ethically tolerable?<\/p>\n

In the end it boils down to this: as a non-privileged, third-party, ‘volunteer corp’ the choice is limited to either effect-less words or resorting to "suspicious" (but effective) means. Now once\/if PIRT makes it big what stops fake ‘volunteers’ from faking messages from a domain, pointing the emails to a legit competing online business’ sales page and pretending its a phishing scheme, and getting PIRT to do their dirty work for them?<\/p>\n

All in all, we are not bashing the idea of a 3rd party phishing control committee, but it is something that takes more organization and control than a mediawiki site, a couple of well-meaning volunteers, and mass media attention. It has many variables and possibilities that need to be finalized and polished, for the safety of the web and for the organization to remain; after all, of what use is a task-force wherein one false positive can trigger a lawsuit that quickly brings its untimely demise?<\/p>\n

Update: <\/strong>Our concerns have been reassured & addressed by CastleCops, please see the comments below for more details.<\/p>\n","protected":false},"excerpt":{"rendered":"

PIRT (Phishing Incident Reporting and Termination) is making headlines around the web, but take their plans with a grain’s worth of salt for now. For those of you that haven’t heard or can’t be troubled to follow the links, PIRT is … Continue reading →<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"jetpack_post_was_ever_published":false,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[1],"tags":[],"class_list":["post-122","post","type-post","status-publish","format-standard","hentry","category-software"],"aioseo_notices":[],"jetpack_featured_media_url":"","jetpack_shortlink":"https:\/\/wp.me\/p4xDa-1Y","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/neosmart.net\/blog\/wp-json\/wp\/v2\/posts\/122","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/neosmart.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/neosmart.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/neosmart.net\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/neosmart.net\/blog\/wp-json\/wp\/v2\/comments?post=122"}],"version-history":[{"count":2,"href":"https:\/\/neosmart.net\/blog\/wp-json\/wp\/v2\/posts\/122\/revisions"}],"predecessor-version":[{"id":1899,"href":"https:\/\/neosmart.net\/blog\/wp-json\/wp\/v2\/posts\/122\/revisions\/1899"}],"wp:attachment":[{"href":"https:\/\/neosmart.net\/blog\/wp-json\/wp\/v2\/media?parent=122"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/neosmart.net\/blog\/wp-json\/wp\/v2\/categories?post=122"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/neosmart.net\/blog\/wp-json\/wp\/v2\/tags?post=122"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}