Fighting Phishing with AJAX...

I have often thought &mdash what better way to beat the capture of confidential information from gullible users than to flood phishing databases with useless data? The main problem is that it takes a little time, some programming expertise, and a web server to really do a good job.

My guess is that the proportion of technically savvy people who receive phishing attempts has to be at least as high as the proportion of gullible users. So if those of us with web skills generate scripts that in turn generate thousands of bogus requests, we at least make life difficult for the criminal element.

The benefit of AJAX is that you can use it to generate automated page requests right from the browser. A relatively simple bit of JavaScript code can put random data into a request, then direct it at the rogue server. You can share this page with your not-so-savvy friends, just to make IP address filtering more difficult for them.

The process is pretty simple: look at the source of the scam page, figure out what fields are in the form's request back to the server, then create an AJAX request that fills the form with random but correctly formatted data. Post the request to the server, then loop back and do it again. Repeat until someone takes the server down.

Someone could even write a little library to generate phone numbers, valid state codes, valid postal codes and credit card numbers, and then it would be even easier. I wish I had the time.