Casting with the Pros Tips and Tricks for Effective Phishing Nathan - - PowerPoint PPT Presentation

▶
casting with the pros
SMART_READER_LITE
LIVE PREVIEW

Casting with the Pros Tips and Tricks for Effective Phishing Nathan - - PowerPoint PPT Presentation

Sep 04, 2022 115 likes •456 views

Casting with the Pros Tips and Tricks for Effective Phishing Nathan Sweaney @sweaney nathan@secureideas.com Nathan Sweaney Security Consultant with Secure Ideas BSidesOK Organizer ISSA Oklahoma OWASP Tulsa @sweaney

slide-1
SLIDE 1

Casting with the Pros

Tips and Tricks for Effective Phishing

Nathan Sweaney @sweaney nathan@secureideas.com

slide-2
SLIDE 2

secureideas.com

  • Security Consultant with Secure Ideas
  • BSidesOK Organizer
  • ISSA Oklahoma
  • OWASP Tulsa
  • @sweaney
  • nathan@secureideas.com

Nathan Sweaney

slide-3
SLIDE 3

secureideas.com

Campaign Design Targeting Infrastructure Setup Bypassing Defenses

Agenda

slide-4
SLIDE 4

secureideas.com

  • Meatware is vulnerable
  • Recent Breaches
  • User Awareness Training
  • Executive Impact

Why Phish?

slide-5
SLIDE 5

secureideas.com

Latest & Greatest Executable Payloads

slide-6
SLIDE 6

secureideas.com

Campaign Design

slide-7
SLIDE 7

secureideas.com

  • What’s the org hoping to get?
  • Goal-oriented tests vs Awareness training
  • Consider white-box/grey-box testing
  • Levels of Simulation

Campaign Design > Assessment Goals

slide-8
SLIDE 8

secureideas.com

  • Click links to a malicious site
  • Download & execute a file
  • Remote access
  • Provide credentials
  • XSS
  • Establish rapport

Campaign Design > Desired Outcome

slide-9
SLIDE 9

secureideas.com

  • Use current events

– Especially emotionally-charged events – But be careful

  • Holidays
  • Target-specific situations
  • Existing technologies

Campaign Design > Ruse Considerations

slide-10
SLIDE 10

secureideas.com

  • Start with Recon

–

Learn what the target is used to seeing

–

3rd Party services? (HR, Payroll, Training, etc)

  • Familiar/Similar Domains

–

companymail.com

–

mail.company.mailserver.com

  • Generic Domains

–

mail-sender.com

–

eventcoordinator.com

  • Punycode

–

portal.xn--securideas-f7a.com

–

portal.securéideas.com

–

www.xn--securedeas-2ub.com

–

www.secureıdeas.com

Campaign Design > Domain Name Selection

slide-11
SLIDE 11

secureideas.com

  • Humans are easily controllable

– Urgency – Emotion – Familiarity – Eagerness to help/serve

  • Critical Faculty

– Spell check – Mimic email signatures – Realistic & similar domains – Context-appropriate language – Existing conversations

  • Be Evil

Campaign Design > Use Psychology

slide-12
SLIDE 12

secureideas.com

But not TOO evil

slide-13
SLIDE 13

secureideas.com

Examples

slide-14
SLIDE 14

secureideas.com

slide-15
SLIDE 15

secureideas.com

slide-16
SLIDE 16

secureideas.com

slide-17
SLIDE 17

secureideas.com

slide-18
SLIDE 18

secureideas.com

Targeting

slide-19
SLIDE 19

secureideas.com

  • One/Several/Everyone?
  • Remember the goal
  • Response Time
  • Prairie dog issue

Targeting > Number of Victims

slide-20
SLIDE 20

secureideas.com

  • Particularly vulnerable

– Legal – HR – Accounting – Sales

  • Particularly privileged

– Sys Admins/Network Admins – Executives – Helpdesk

Targeting > Victim Type

slide-21
SLIDE 21

secureideas.com

  • Social Media

– LinkedIn

  • Lead Generation sites

– site:zoominfo.com “domainname.com" – Bizshark – Pipl – Clearbit – RIP data.com

  • Tools

– Recon-ng – theHarvester – datasploit

Targeting > Finding Victims

slide-22
SLIDE 22

secureideas.com

  • The company’s website

– Blog – Metadata

  • 3rd Party tools

– Github

  • Data breach dumps
  • AD
  • Phishing/Vishing

Targeting > Finding More Victims

slide-23
SLIDE 23

secureideas.com

Infrastructure

slide-24
SLIDE 24

secureideas.com

  • Your laptop
  • Hosted

– AWS/Azure/etc (cloud-based) – Gmail/Office365 – MailChimp, SendGrid, etc – Target’s mail servers (open relays)

  • Considerations

– Server age – Domain age – IP Reputations

Infrastructure > SMTP Server

slide-25
SLIDE 25

secureideas.com

  • Sendmail
  • Toolkits

– GoPhish – Modlishka – Evilginx2 – Phishing Frenzy – King Phisher – Social Engineering Toolkit

  • LetsEncrypt
  • PhishMe, KnowBe4, etc

Infrastructure > Technology

slide-26
SLIDE 26

secureideas.com

  • SMS
  • Facebook/Twitter/LinkedIn
  • What’s App
  • Slack
  • NextDoor
  • Think outside the box

– Suspicion is context-sensitive

Infrastructure > Alternatives to Email

slide-27
SLIDE 27

secureideas.com

Bypassing Defenses

slide-28
SLIDE 28

secureideas.com

  • AV

– https://github.com/Veil-Framework/Veil – Online Scanners

  • VirusTotal
  • MetaScan (https://metadefender.opswat.com)
  • VirSCAN (http://www.virscan.org)
  • NoDistribute (https://nodistribute.com)
  • Hybrid Analysis (https://www.hybrid-analysis.com)
  • Watch out for automated sandbox analysis
  • EDR Tools

– Good luck – Keep it simple

Bypassing Defenses > Anti-malware

slide-29
SLIDE 29

secureideas.com

  • Content Filtering Submission Forms

–

Symantec/Bluecoat https://sitereview.bluecoat.com/#/

–

WatchGuard/ForcePoint/Websense http://mtas.surfcontrol.com/mtas/WatchGuardTest-a-Site.php

–

Cisco Umbrella/OpenDNS https://community.opendns.com/domaintagging/submit/

–

Cisco/Talos https://talosintelligence.com/reputation_center/support

–

Palo Alto https://urlfiltering.paloaltonetworks.com/query/

–

Barracuda http://www.barracudacentral.org/report

–

McAfee https://trustedsource.org

  • Recently Expired Domains

–

https://www.expireddomains.net

–

https://freshdrop.com

Bypassing Defenses > Content Filtering

slide-30
SLIDE 30

secureideas.com

  • SPF, DKIM, & DMARC
  • Consider sending via Gmail or O365
  • Check Blacklists

– https://www.talosintelligence.com/reputation_center

  • Online Spam Checks

– Google’s Postmaster Tools

https://postmaster.google.com

– SenderScore https://www.senderscore.org – Mail Tester https://www.mail-tester.com

  • Discuss with the client

Bypassing Defenses > Anti-Spam

slide-31
SLIDE 31

secureideas.com

  • Duplicate real sites vs Build your own
  • Unique user identifiers
  • Source IP restrictions

– Automated sandbox analysis

  • Time restrictions
  • JavaScript obfuscation
  • Subdomains vs directories

Bypassing Defenses > Landing Pages

slide-32
SLIDE 32

secureideas.com

  • Constant battle

– No more shikata-ga-nai

  • Use hosted known sites
  • Test, Burn, & repeat
  • “Encrypted” Excel file

Bypassing Defenses > Payloads

slide-33
SLIDE 33

secureideas.com

  • Remember the goal
  • Use back channels with clients
  • Keep it simple
  • Make it familiar
  • Don’t be TOO evil

Final Thoughts

slide-34
SLIDE 34

Questions?

Nathan Sweaney @sweaney nathan@secureideas.com