Today, I got a phishing email impersonating a large bank. To my surprise, the link in the email pointed at a rather sophisticated phishing website which could potentially result in many victims. The bank had already been notified and it will probably try to take down the website and raise awareness for the presence of this phish among its customers. This made me wonder, what one could do for people that had already fallen for this phish.

The first thing I thought about was to flood the phishing website with potentially valid data. (Not random data) It is pretty easy to automate and over night the number of invalid entries in the database compared to the number of valid entries will be very large.

Of course, threat actors will try and automate their validation process as much as possible as well. However, I could offer the bank access to my fake dataset to cross reference with invalid logins. Besides that, maybe the fact that lots of invalid login attempts have to be made to find the valid ones will be good enough to trigger fraud detection at the bank.

At first glance, it seems as if this method could be effective but I was not able to find any documentation regarding usage of such a method. This implies that it is likely that there are some valid reasons against.

This leads me to the following questions: What would be the drawbacks of using the described method to remediate existing phishing attacks in terms of ethics and effectiveness? Why would a company that is often impersonated in phishing attacks use it or why not?

  • 1
    The first drawback is the legal one. Just because someone attacked you doesn't mean you can attack them back; your duty as a citizen is to protect others from harm... While that sometimes means harming someone who is acting dangerously (tackling someone about to attack another), more often than not the legal and ethical actions are simply to assist in getting others out of harm's way... even when you believe that those with the power and authority don't have the political ability, political will, or are too inept deal with the threat itself. – Ghedipunk Nov 26 '19 at 20:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.