Hello everybody and welcome back to salted hash. I'm your host Steve Reagan senior staff writer at CSO online
and today we're going to talk about phishing kits more specifically what our
Fishing kits stay with me. We'll be right back
All right, welcome back
and like I said today we're gonna answer a question that got sent to me a couple of weeks ago and it was something that
My boss said mentioned as well. What are
phishing kits
To those of you in the security industry that the answer is really simple, but for anyone not familiar with the term
It could be a bit confusing. So the
shortest answer I can give you is a fishing kit is the
web
component to a phishing attack
Normally phishing starts via email. It's it's centered in email and the object is to
Get you to do something. That's what the criminal wants. The criminal needs you to take an action of sorts
So they use social engineering in order to entice you to take that action
Now this could be opening an attachment clicking a link giving up personal information
or even in some cases sharing sensitive information via email attachment but a fishing kit is
the back end component to a lot of
the the more common phishing attacks you see
So for example, when you look at email attacks, they're looking for your fishing credential or they're looking for your email commercials
so the phishing attack will
Lead you to a webpage that looks like Microsoft's login portal or Apple's login portal
so let's start off by giving you a
Quick look at some of the phishing kits we've collected here in the lab
And as you can see, we've broken them down by type but to start off with this is an older
alibaba fish and it's meant to
spoof one of the login portals for Alibaba and what this was at the time was a
Sale that they were they were running and some of the kits
directed people to login to take advantage of
given discount or a promo
Sometimes they we're telling you that your order was messed up or there's been a problem
Either way when you click the link you would have landed on this page and given up your credentials
another one
Should be familiar to a lot of you. This one is a very standard
365 fishing kit
it was
last used
Early in 2017. I haven't really seen this circulate a lot but
You would get an email telling you there's a problem with your your account at work or your account at school
It could be that you're about to be suspended. It could be that you're over quota. There's messages held for review
whatever the goal would be to click you to get you to click that link and you would see a page like this and
If you fell for it, you would enter in your credentials and that's how the criminal would get it other office phishing attacks
Usually say you know, here's an ax doctor
here's a document you need to read and you would click on it and
You would think you're clicking an email attachment. But reality what you're doing is opening a
Website and when you would land on it you would see this. So in this case the fish told you it was an Excel document
But it's asking you for your email address and password to view it now
When you fill this out, the criminal gets your credentials and you're shown a very generic looking
Image that's sometimes related to the email sometimes not but it's not an excel file itself
Something a lot of you are familiar with again, these are very common Microsoft fishes
What they're looking for is your email address and your password so that they can further compromise you a lot of people
tend to use their their work credentials or their
Personal email to back up access to all of their social media accounts banking accounts and things like this
So if a criminal can compromise your email
they're gonna get access to all of that other stuff if they try just resetting passwords with your account at various places in
This case. This is a
more improved version of the previous office
Phishing attacks because they're now cloning the Microsoft login page to look more realistic
and then
This one is social media. A lot of times people think that
Criminals when they do phishing attacks are only after your email credentials that you would use for like hotmail
Outlook things like this in reality. They're gonna get anything that they can get
they're happy to take all of your passwords and this is just an example of
Instagram and this kit
actually has
Detection to show whether or not you're on a browser or whether or not you're on a phone and the login page will adjust itself
Accordingly, but again, the goal here is just to capture Instagram IDs
LinkedIn a popular service a lot of us use and of course there are phishing kits
Dedicated just for that now imagine the chaos. If somebody compromised your Linkedin ID, what could they do with that?
They could build a network they could target other people in your network, especially if you're a well-connected individual
Next we've got Google
very standard Google Docs fishing kit, of course
This one is happy to take credentials for whatever service you want to use, but it's mainly targeting your Gmail
secure drop
another one is
For this this is Dropbox, but again, it's looking for whatever credentials and it's going to open up a new web page
Just to get you to log in
Most of these kids particularly like a kit like this
They're very generic when they go out the email attachment. It's like hey, there's a file
You need to review log in here to see it. It's not
Very specific to an individual these type of kits are mail blasts
basically
the criminal gets a
Few hundred thousand email addresses and they send out the same message to all of them in the hopes of getting people to give up
Their credentials it works
Dropbox again, another clever way to get your Dropbox credentials as well as your email credentials
One of the risks was sharing your password among multiple services is that you know, if you shared your Gmail password
With your Dropbox account, so they're the same
Compromising your Gmail gives access or Dropbox
But here the enticement is to tell you there's a file or something. You need to view on Dropbox
So log in with your credentials to see it
Docu signs another popular service that's targeted by fishing
Again, they're looking for email credentials here and the goal is to use docu signs brand that you're familiar with to get you
to sign in to view whatever attachment they've promised again fishings all about
Enticing they're trying to get you to do something and all the examples you've seen right now
The do something was click a link or open an attachment and give up your credentials. That's what they're looking for here
This is a digital currency, um
Really cute that this fishing kit tells you to beware of phishing and warns you to make sure you're on the HTTPS here
But if you look up, nope, we're not on the secure web site, but most people won't pay attention to that
They won't see it. They're gonna see the familiar login page and they're gonna enter their credentials and they're gonna lose their money
PayPal again
very standard very common victim
People target PayPal a lot because there's money involved. Of course PayPal accounts are very valuable in the underground market
So you will see, you know credentials for PayPal being highly priced and traded among people
Again, if they get a hold of your PayPal account, they've got your banking. They've got your credit cards, you know, they have your money
Speaking of money TD Ameritrade big financial institution if you're into stocks, you're probably being targeted
Maybe there's a problem with a trade. Maybe there's a
new hot commodity you need to look into or maybe there's just a
Problem with your TD bank account and you need to login either way the email will direct you to a website that looks like this
And at the time this kit was active. This is what the TD website looked like so they were very
Very successful to to fishing because they cloned it almost exactly
Chase a lot of Chase customers again
This kit hasn't been used for a while
But the login page will look familiar to a lot of people and again, there's been a problem with your account
Maybe there's an erroneous deposit or with draw
They're gonna draw your attention to this page and the goal is to get you to log in with your banking credentials
I don't think we need to explain what banking credentials
How valuable they are or what could happen
If you lost them
The same could be said for Capital One lots of capital one card holders out there Capital One Bank members and again
They're trying to get your credentials for this
Now here's an interesting one the global service exchange for Apple
This type of website is more of a directed fish. But again, they're looking for your Apple ID and your password
but the the lure to get you here what they're doing is either taking advantage of a
Broken item or a phone or they're trying to get you to exchange things to get yourself in there
The fish I saw with this was actually telling the victim
That their order was ready to be picked up like they'd had a service order
And so they've got a log in to get this taken care of
I'm not entirely sure because I'm not an Apple user how the global service exchange works, but it was a
Fairly convincing email to the victim itself because they did log in now
They're fine. They didn't lose, you know, they lost access to their stuff for about a day, but they were able to recover it
So it's all good the point being though. This was convincing enough for them to log in
Same with this page
We showed this in an earlier video and if you remember that video
This fishing portal and the real Apple portal were
identical except for a few things the font and the
Login panel here. Otherwise at a glance. It was a perfect replica
Adobe is another big target for fishers and you see a lot of stuff like this
This document needs you to log in to view it. And again the email itself. The lore is just you know, here's this
Sensitive urgent document you need to view
So these are your kids this is this is what they look like but on the back end
Some of the kits can be pretty complicated
Here's a a Apple fishing kit that we found recently that we haven't actually unlocked
you see when you try to load this age and
Get it to come up. You actually have to register the kit with the criminal and
Unlock it. If you don't it turns itself off. It won't function for you. Now. We haven't cracked it yet
We will and we'll get it working. But some of the things that that happened in this kit are rather interesting
Depending on what kind of procs are using. It's gonna shift you off to a different website
It checks for that stuff the minute you log in it's got a standard security package if you you log in here
One of the things this website does is it?
watches for the IP address of the visitor and if it matches any of the known
services for like security companies or
cloud providers researchers things like this
It kicks them off won't let them on also notice this creates a blank index.php page
Which means you can't access this folder directly from a browser. It's just gonna show up as blank for you
Another thing this this kit does
rather well actually is
Keep track of visitors and how many times they're coming back. So if you come back more than once it actually stops you
And kicks you off to the other page. So one of the interesting things this isn't just an apple fishing kit
It's actually going after banks and if we look here we could see that
CC info so that's collecting what's called fulls basically all of your credit card and personal information and
It's still using the the Apple back-end when it sends the email but what it's actually doing is spoofing Bank of America
So this kit does a couple of different things it's
Quite complex. Most phishing kits don't look like this. In fact if we were to go back to
The one Apple kit you were looking at earlier the global exchange, for example
It's a very basic kit. There's not a lot of back into it at all. In fact when you load up the
the page itself, you know the
Index.html. It's pulling from this that's it. When you log in, it's just going to email your credentials off
and of course it could do phone stuff as well, but
We're not talking really complex operation here. We're just dealing with a
Here's your credentials email them off to the criminal type environment and even on the back end
The other Apple kit that I showed you
What you see here every time two page loads
It clones itself from these files and creates a new account
And the reason why the new account is created is so that it looks more legit when you're viewing it in the browser
So these are just randomly generated folder names
That actually contain everything you need for the fishing kit. And of course the
Big key is the built-in security array again. If you fall within one of these IP ranges, it'll kick you off
But again the goal really simple
It's just to get your username and password. That's all it's really looking for here. It's not trying to
You know do anything else other than
Steal your password so that they can log in and use your Apple account as well
So those are the basics that's what a fishing kit looks like
Hopefully that answers some questions again fishing kits are just the backend side to an email that you would get trying to compromise you
But if you'd like to know more feel free to reach out to us at CSO online.com
Again, my name is Steve Reagan, and it's been salted hash. Have a great day
You