I wonder if scammers are intentionally misspelling subject lines because most security savvy people will just delete those as obvious scams and move on. This would have a two pronged effect:
1. it would filter out security savvy individuals from the actual payload, who might report the scam.
2. it would map to the least security conscious individuals who would be the most likely to fall for it.
> By sending an email that repels all but the most gullible the scammer gets the most promising marks to self-select, and tilts the true to false positive ratio in his favor.
I wonder about that - is there a bad spot where the obvious scam mail is so obvious that it prompts more people to troll the scammer back?
I mean the people who take the time to troll the scammer back want enjoyment out of it, and the chance of getting that enjoyment would seem to be heightened if the scammer seems more likely to be an idiot.
The next logical step after finding where the data is sent, is to use a script to fill the phisher's database with rubbish... there are sites like https://www.fakenamegenerator.com/ which will help you create fake-yet-plausible identities.
I remember many years ago I was sent a keylogger. I reversed it, found it was configured to upload keylogs to an FTP server on a free webhost, and promptly replaced the existing contents of it with as many copies of The Bible as would fit in the few MB of space available.
Is it ethical or possible to attack the attacker by spawning a few cloud instances that POST dummy but nearly legit responses to their website? This way they would have to comb through and hopefully verify a lot of crap to find victims' card numbers?
Unless of course they were clever enough to embed some fake cookie to track responses to specific emails...
It's a triple encoded payload that loads in a large HTML blob onto the page. The payload is 99% similar to Amex's actual page, it just submits the data to the attackers domain, and has a few extra fields like mothers maiden name, elementary school, etc.
The purpose of the obfuscation is 1) to prevent automated scanners and 2) prevent debugging of the script.
Since we did static analysis it did not impact the result.
1. it would filter out security savvy individuals from the actual payload, who might report the scam.
2. it would map to the least security conscious individuals who would be the most likely to fall for it.