Hi everybody welcome back to salted hash, my name is Steve Reagan. I'm the senior staff writer at CSO online today
We're gonna talk about some fishing stuff. That's going on lately
It this isn't the the run-of-the-mill stuff this is kind of like a
Personal attachment to these emails because all of them have either targeted me or my co-workers, so these aren't phishing campaigns that
You've seen in the headlines
These are the ones that we catch in-house and I just wanted to show them off to you
so you can see the the kind of basics that are out there and
you know I
want to stress that
While some of these emails, I'm going to show you look really generic garbage in fact
Don't discount them the thing is even though
They're they're written towards the lowest common denominator
Somebody working at a fast clip or not paying attention could easily fall for these especially once. They click a link and you
See the the landing pages
So the first email you see here is actually a message. That was sent on October 27th to my boss
Amy is the executive editor of both CSO and CIO, and what happened was she got this this random email?
She recognized it for what it was and sent it off to me so that I could play with it because I kind of collect
These things and I just want you to look at the message real quick
So the the complete your password request subject matter. You know, it's it's coming from an account called security notice. It's
directed to Amy but if you look there it says dear Editor and
The email address that was sent to was I think it's editor at CIO. I'd have to check but
what this tells you is they've scraped the website for contact information and
Basic email address and then they blasted off this
So what you're not seeing in this particular email something
I've removed is the fact that this was sent from a compromised company
there is a legitimate company on the east coast of the United States that has been compromised and
That compromised account was used to send this email to us
It's a typical BC attack business email compromise and these types of attacks are very common
They have been
gaining in popularity over the last couple of years
And I think it was the FBI sent it like 1.5 billion in losses were attributed to
BC compromised and
This is just one example, so let's say Aimee fell for this trick and she clicked on the link in the message
What happens is that she's going to be directed to a landing page? It looks exactly like this
now
This landing page when it loads up in your browser looks nice and fancy really official. It's got
You know you are our URL string at the top that
comes off as
You know
Legitimate just because there's so many random
characters that are strung through it, but the thing is the the domain itself is actually a
Second victim so it's not the victim that sent the email. It's a different victim. You just had their web server compromised and
This phishing page is being hosted in a subdirectory on that domain
Now it uses
HTTPS, but that doesn't mean anything in this case because it's still not the official Microsoft
landing page, but if you were to enter your password and
Go ahead and submit on this dis landing page there
what would happen is is she would be forward and she being a me would have been forwarded to the legitimate Microsoft portal and
The criminal behind this attack would have just compromised their
credentials so
Another example is one that happened recently this this particular email targeted me
and if you look there it comes from the email security team you know it's a
Account security alert and once again. This is coming to it an address that I maintain that
Really isn't used anymore
But I still get email at it and in this particular case what they're wanting to do is steal my credentials again, so I was
Intrigued by this message because this particular template came to me and a few other other
Contacts of mine all in the same day in fact two of us were talking on Twitter recently and we got
this particular email within minutes of each other
But we work for completely separate entities. We are not related to each other via
You know email at all so his company and my company got it
And then another another guy's company got the same message within minutes of each other
So what happens is you know again a very generic looking kid?
But if you're not paying attention, it's entirely possible that
Somebody might click on this now in this particular image if you see there. I've highlighted that the
the
Address from the verify now box is not an ID G domain in my case
So I know it's not a company email. I know this is fake from the get-go, but if you were to click on it
What you see is a?
Very basic
Email template like this is the lowest common
Denominator of templates but to give it a little bit of urgency if you look there in the lower right corner
You see that there's a countdown
Now I set and watch this thing go all the way down to zero
Absolutely nothing happens and also if you click either one of the buttons there to stop this action now or ignore the warning this is
what you'll see it's just a pop-up box and
This particular pop-up box when it when it comes up?
It's just another
Confirmation form again the point of this particular attack is just to harvest my outlook credentials
it's not to drop Mau or anything like that and
This form will respond no matter what you give it
There is no forwarding on this end you know it's not gonna pass me over to actual Microsoft or anything in fact
The script itself is kind of broken because instead of carrying over the variable for the victims email address
When you put a password in hit continue
this is what you see and it's action taken, but if you notice it's actually missing my
my email token so
what I did was I
dug around on the web did some searching and I actually found you know the
The hosted area for this particular script and the criminal behind
He doesn't secure his things very well, so this is the form part of
the the phishing attack that came after me, this is what targeted me and
What the source code does is it pulls up?
The the IP address information depending on geolocation so when the form is submitted
He'll know where in the world. I am and
Then of course you see the the basic. You know
type of message construction format
You know right here thug life legend is what he wants to be known as apparently
But all of the harvested credentials all the compromised accounts being sent to Gmail
Before anybody asks. Yeah, I did report that the account but
he's using Gmail as a drop and I
Don't I just it's very amateurish, but
This is just one example of some of the stuff. I've seen like another message. I got recently
actually comes with
the a a a choice in the body itself
It's warning me that my inbox is about to be deleted
And you know my password has been compromised so I can continue to remove the email message
Or I can cancel the removal either way it takes me to a landing page
Which once again wants my Outlook credentials and once again?
You know forwards them over to an attacker the interesting thing is this particular email was sent to me twice I got it
Once on the 24th, and then I got again on the 26th, and when I say the exact same email
I mean the same message the same template it came from the same compromised company it has the same
Text in the the the Microsoft Office part, so you've got the little fancy Oh up there
I know there's a term for that and I forgot it
But the point being is this exact message came to me twice so either somebody's not scrubbing their lists or they're just blasting everyone out
another one
is
actually one of the messages that first got me really interested in who was coming after the cxo domain was because
this particular
message comes from configuration at and the
At address is actually to default
Fqdn for a VPN and what it is is basically it's like getting a mail
mail from the email daemon itself
But this particular server is completely compromised. There are several websites on it all of them hosting phishing pages
It's been linked to a number of different outlook attacks this year alone, but this particular email again
It's telling me to take action or my my accounts gonna be deleted and when you click on the message
It's just a basic generic loading page, and I think what's interesting is some of these loading pages. They don't look like
The actual outlook page a lot of companies use custom branded things
And you know in this case attacks like this will fail on that front that visual cue alone will set off red flags
And another thing that I noticed is a lot of times
The criminals themselves are somehow keeping track of who's who?
I
recently got an email from
An account that I had ran down confirmed
It was fishing and everything like this now what had happened was that same account emailed me like a week later and said we haven't
Heard from you you need to take action
So they're following up in some cases, which is just bizarre, but I have to wonder if it works
so
The bottom line and I guess the point of me showing you all of this stuff with the phishing is the fact that
while these are generic looking attacks
They're still real attacks, and they are really working they compromised
by my count at least 30 different companies just this month alone, and those are the companies that have emailed me I
Have no idea how far that reach goes, but if you think about it?
That's 30 victims, and this is the quality of the phishing attack. We're not talking advanced scripting
We're not talking clever writing or anything like that. We're talking pretty basic stuff, and it's working
The only way to combat stuff like this
thoroughly is
to clue your people in not just with awareness training, but also give them the kind of background as to why a
particular process processor policy exists to give you an example
Do your employees know what an actual email?
From IT would look like not just you know like the formatting or wording
But do they know what one would look like who's in IT do they know like it's there a special signature is
Could there be a special signature
Why not why not give your employees the clue that unless you see this at the bottom of the email
You know it's not real because this will always be there
You know do you do you address employees by their first and last name. Do you just use first name?
These little things should be a part of your awareness program, and if they're not that's why
generic messages like this work
You know one of the things in our training that I am allowed to talk about is the fact that?
We have a standard process for contacting IP IT and being contacted by IT
Anything outside of that norm its fake?
So that that any any deviation from that policy
Literally is a red flag for us
And that's what we're trained on so this is why a lot of these these basic campaigns
they really fall out of scope for us because I
Know for a fact that if I see anything addressed the way that some of these emails were it's not to me
it's fake because that's not how I team will call me and
And that that is a valid point you know a lot of times for serious matters IT would never send an email
You know they would actually call us if there was something serious and important going on I could probably expect a phone call
but
That's neither here nor there on the side of thing my point being is just
Go with the awareness training tailor it to the users and these types of threats
Maybe we can put a stop to them
But not anytime soon, you know phishing is gonna. Be around forever because it works, but hopefully we can make some sort of small debt
Anyway, I just thought you'd like to keep up the breasts on what we're seeing here with some fishing stuff in my office
Let me know if you've got anything similar
I'd love to hear your stories feel free to reach out to me either on Twitter or directly via email
My contact information is public. My name is Steve Reagan. This is salted. Hash. We'll talk to you soon