Hello everybody and welcome back to salted hash I'm your host Steve Ragan
senior staff writer at CSO online and today we're going to talk about phishing
kits more specifically what our fishing kits stay with me
we'll be right back
all right welcome back and like I said today we're gonna answer a question that
got sent to me a couple of weeks ago and it was something that my boss said
mentioned as well what are phishing kits to those of you
in the security industry that the answer is really simple but for anyone not
familiar with the term it could be a bit confusing so the shortest answer I can
give you is a fishing kit is the web component to a phishing attack normally
phishing starts via email it's it's centered in email and the object is to
get you to do something that's what the criminal wants the criminal needs you to
take an action of sorts so they use social engineering in order to entice
you to take that action now this could be opening an attachment clicking a leg
giving up personal information or even in some cases sharing sensitive
information via email attachment but a fishing kit is the backend component to
a lot of of the the more common phishing attacks you see so for example when you
look at email attacks they're looking for your fishing credential or they're
looking for your email connections so the phishing attack will lead you to a
webpage that looks like Microsoft's login portal or Apple's login portal so
let's start off by giving you a quick look at some of the phishing kits we've
collected here in the lab and as you can see we've broken them down by type but
to start off with this is an older alibaba fish and it's meant to spoof one
of the login portals for Alibaba and what this was at the time was a sale
that they were they were running and some of the kits directed people to
login to take advantage of giving discount or a promo sometimes
they were telling you that your order was messed up or there's been a problem
either way when you click the link you would have landed on this page and given
up your credentials another one should be familiar to a lot of you this one is
a very standard 365 fishing kit it was last used early in 2017 I haven't really
seen this circulated a lot but you would get an email telling you there's a
problem with your your account at work or your account at school it could be
that you're about to be suspended it could be that you're over quota there's
messages held for review whatever the goal would be to click you to get you to
click that link and you would see a page like this and if you fell for it you
would enter in your credentials and that's how the criminal would get it
other office phishing attacks usually say you know here's an adopter here's a
document you need to read and you would click on it and you would think you're
clicking an email attachment but reality what you're doing is opening a website
and when you would land on it you would see this so in this case the fish told
you it was an Excel document but it's asking you for your email address and
password to view it now when you fill this out the criminal gets your
credentials and you're shown a very generic looking image that's sometimes
related to the email sometimes not but it's not an excel file itself something
a lot of you are familiar with again these are very common Microsoft fishes
what they're looking for is your email address and your password so that they
can further compromise you a lot of people tend to use their their work
credentials or their personal email to back up access to all of their social
media accounts banking accounts and things like this so if a criminal can
compromise your email they're gonna get access to all of that other stuff if
they try just resetting passwords with your account at various places in this
case this is a more improved version of the previous office phishing attacks
because they're now cloning the Microsoft login page to look more
realistic and then this one is social media a lot
of times people think that criminals when they do phishing attacks are only
after your email credentials that you would use for like hotmail Outlook
things like this in reality they're gonna get anything that they can get
they're happy to take all of your passwords and this is just an example of
of Instagram and this kit actually has detection to show whether or not you're
on a browser or whether or not you're on a phone and the login page will adjust
itself accordingly but again the goal here is just to capture Instagram IDs
LinkedIn a popular service a lot of us use and of course there are phishing
kits dedicated just for that now imagine the chaos if somebody compromised your
LinkedIn ID what could they do with that they could build a network they could
target other people in your network especially if you're a well-connected
individual next we've got Google very standard Google Docs fishing kit of
course this one is happy to take credentials for whatever service you
want to use but it's mainly targeting your Gmail secure drop another one is
for this this is Dropbox but again it's looking for whatever credentials and
it's going to open up a new web page just to get you to log in most of these
kids particularly like a kit like this they're very generic when they go out
the email attachment it's like hey there's a file you need to review log in
here to see it it's not very specific to an individual these type of kits are
mail blasts basically the criminal gets a few hundred thousand email addresses
and they send out the same message to all of them in the hopes of getting
people to give up their credentials it works Dropbox
again another clever way to get your Dropbox credentials as well as your
email credentials one of the risks was sharing your password among multiple
services is that you know if you shared your Gmail password with your Dropbox
account so they're the same compromising your Gmail gives
access or Dropbox but here the enticement is to tell you there's a file
or something you need to view on Dropbox so log in with your credentials to see
it docu signs another popular service that's targeted by fishing again they're
looking for email credentials here and the goal is to use docu signs brand that
you're familiar with to get you to sign in to view whatever attachment they've
promised again fishings all about enticing they're trying to get you to do
something and all the examples you've seen right now the do something was
click a link or open an attachment and give up your credentials that's what
they're looking for here this is a digital currency um really cute that
this fishing kit tells you to beware of phishing and warns you to make sure
you're on the HTTPS here but if you look up nope we're not on the secure web site
but most people won't pay attention to that they won't see it they're gonna see
the familiar login page and they're gonna enter their credentials and
they're gonna lose their money PayPal again very standard very common
victim people target PayPal a lot because there's money involved of course
PayPal accounts are very valuable in the underground market so you will see you
know credentials for PayPal being highly priced and traded among people again if
they get a hold of your PayPal account they've got your banking they've got
your credit cards you know they have your money speaking of money TD
Ameritrade big financial institution if you're into stocks you're probably being
targeted maybe there's a problem with a trade maybe there's a new hot commodity
you need to look into or maybe there's just a problem with your TD bank account
and you need to login either way the email will direct you to
a website that looks like this and at the time this kit was active this
is what the TD website looked like so they were very very successful to to
fishing because they cloned it almost exactly chase a lot of Chase customers
again this kit hasn't been used for a while but the login page will look
familiar to a lot of people and again there's been a problem with your account
maybe there's an erroneous deposit or with draw they're gonna draw your
attention to this page and the goal is to get you to log in with your banking
credentials I don't think we need to explain what banking credentials how
valuable they are or what could happen if you lost them the same could be said
for Capital One lots of capital one card holders out there Capital One Bank
members and again they're trying to get your credentials for this now here's an
interesting one the global service exchange for Apple this type of website
is more of a directed fish but again they're looking for your Apple ID and
your password but the the lure to get you here what they're doing is either
taking advantage of a broken item or a phone or they're trying to get you to
exchange things to get yourself in there the fish I saw with this was actually
telling the victim that their order was ready to be picked up like they'd had a
service order and so they've got a log in to get this taken care of I'm not
entirely sure because I'm not an Apple user how the global service exchange
works but it was a fairly convincing email to
the victim itself because they did log in now they're fine they didn't lose you
know they lost access to their stuff for about a day but they were able to
recover it so it's all good the point being though this was convincing enough
for them to log in same with this page we showed this in an earlier video and
if you remember that video this fishing portal and the real Apple portal were
identical except for a few things the font and the login panel here otherwise
at a glance it was a perfect replica Adobe is another big target for fishers
and you see a lot of stuff like this this document needs you to log in to
view it and again the email itself the lore is just you know here's this
sensitive urgent document you need to view so these are your kids this is this
is what they look like but on the back end some of the kits can be pretty
complicated here's a a Apple fishing kit that we found recently that we haven't
actually unlocked you see when you try to load this
age and get it to come up you actually have to register the kit with the
criminal and unlock it if you don't it turns itself off it won't function for
you now we have a crack that yet we will and we'll get it working but some of the
things that that happened in this kit are rather interesting depending on what
kind of procs are using it's gonna shift you off to a different website it checks
for that stuff the minute you log in it's got a standard security package if
you you log in here one of the things this website does is it watches for the
IP address of the visitor and if it matches any of the known services for
like security companies or cloud providers researchers things like this
it kicks them off won't let them on also notice this creates a blank index.php
page which means you can't access this folder directly from a browser it's just
gonna show up as blank for you another thing this this kit does rather well
actually is keep track of visitors and how many times they're coming back so if
you come back more than once it actually stops you and kicks you off to the other
page so one of the interesting things this isn't just an apple fishing kit
it's actually going after banks and if we look here we could see that CC info
so that's collecting what's called fulls basically all of your credit card and
personal information and it's still using the the Apple back-end when it
sends the email but what it's actually doing is spoofing Bank of America so
this kit does a couple of different things it's quite complex most phishing
kits don't look like this in fact if we were to go back to the one Apple kit you
were looking at earlier the global exchange for example it's a very basic
kit there's not a lot of back into it at all in fact when you load up the the
page itself you know the the index.html it's pulling from this that's it when
you log in it's just going to email your credentials off
and of course it could do phone stuff as well but we're not talking really
complex operation here we're just dealing with a here's your credentials
email them off to the criminal type environment and even on the back end
the other Apple kit that I showed you what you see here every time two page
loads it clones itself from these files and creates a new account and the reason
why the new account is created is so that it looks more legit when you're
viewing it in the browser so these are just randomly generated folder names
that actually contain everything you need for the fishing kit and of course
the big key is the built-in security array again if you fall within one of
these IP ranges it'll kick you off but again the goal really simple it's just
to get your username and password that's all it's really looking for here it's
not trying to you know do anything else other than steal your password so that
they can log in and use your Apple account as well so those are the basics
that's what a fishing kit looks like hopefully that answers some questions
again fishing kits are just the backend side to an email that you would get
trying to compromise you but if you'd liked a little more feel free to reach
out to us at CSO online.com again my name is Steve Reagan and spin salted
hash have a great day
you