You can attack the extension
- Fuck Adblock
- Fuck Fuck Adblock
- Fuck Fuck Fuck Adblock
I'm not clear on how this works, but if you know what the script is called/and or get your hands on a copy of it, you can easily begin a sort of 'arms race' against this chrome extension.
You can try to identify the browser application
Then blacklist the hell outta them, but this might just ignite an arms race, where they find countermeasures for your countermeasures etc..
You can screw with their application
If you can get your hands on their scripts and stuff, you can definitely screw with them in the following ways:
- Identify how they get the password, and feed it fake information
- Probability of failure for their methods
- Honeycombed area after login to collect information on updates their scripts may have gotten
You can add two factor authentication/ ip login stuffs
2FA is a brick wall to hackers.
You can ruin automation
In order to get passwords, they're probably scraping the field's identifier. Bots I make use getelementbyid so if you can generate the username and password field ID on the fly, that could be frustrating for the hackers. Might be really frustrating for people that use password autofill though.
In any case, your priorities are
- get your hands on their code
- figure out a way to identify their login attempts
- their IP, subpoena their ISP etc etc etc
With these things, you can do any array of things, including playing 'Mr. Passive Aggressive,' where you can move the hacker's session to a different gui compared to everyone else where it can't get any information/get wrong information 50%/50% of the time. Or utilize any methods listed above. In any case, make it difficult for them to identify the methods you use. If you're too hard a target, they'll move on and find someone else.