of Sandboxed Phishing Kits Summary Motivation Sandboxed phishing - - PowerPoint PPT Presentation

▶
of sandboxed
SMART_READER_LITE
LIVE PREVIEW

of Sandboxed Phishing Kits Summary Motivation Sandboxed phishing - - PowerPoint PPT Presentation

Aug 16, 2023 316 likes •926 views

PhishEye: Xiao Han Nizar Kheir Live Monitoring Davide Balzarotti of Sandboxed Phishing Kits Summary Motivation Sandboxed phishing kits Implementation Results [APWG Phishing Activity Trends Report 2 nd Quarter 2016] All time high record

slide-1
SLIDE 1

PhishEye: Live Monitoring

  • f Sandboxed

Phishing Kits

Xiao Han Nizar Kheir Davide Balzarotti

slide-2
SLIDE 2

Summary

Motivation Sandboxed phishing kits Implementation Results

slide-3
SLIDE 3

[APWG Phishing Activity Trends Report 2nd Quarter 2016]

slide-4
SLIDE 4

[APWG Phishing Activity Trends Report 2nd Quarter 2016]

All time high record

slide-5
SLIDE 5

Motivation

  • PKs monitored only after being detected by anti-phishing

services

slide-6
SLIDE 6

Motivation

  • PKs monitored only after being detected by anti-phishing

services

  • Details about entire lifecycle of a phishing kit are still missing
slide-7
SLIDE 7

Motivation

  • PKs monitored only after being detected by anti-phishing

services

  • Details about entire lifecycle of a phishing kit are still missing
  • 71.4% of the domains that hosted phishing pages were

compromised websites [APWG global phishing report 2014]

slide-8
SLIDE 8
slide-9
SLIDE 9

Know your enemy: Phishing [Honeynet 05] Evil searching [FC 09]

slide-10
SLIDE 10

Browser plugin: N. Chou [NDSS 04] User education: P. Kumaraguru [TOIT 10]

slide-11
SLIDE 11

Learning to detect phishing emails [WWW 07] Discovering phishing dropboxes using email metadata [eCrime 12]

slide-12
SLIDE 12

Detection: Cantina [WWW 07], C. Whittaker [NDSS 10] Blocking: Google Safe Browsing (GSB), Phish Tank, … Take down: Examining the impact of website take-down on phishing [eCrime 07]

slide-13
SLIDE 13

Handcrafted fraud and extortion [IMC 14]

slide-14
SLIDE 14
slide-15
SLIDE 15

Incomplete and fragmented view of PKs lifecycle

slide-16
SLIDE 16

[Credits: Idea Sandbox, Neutronis ]

Web honeypot Attacker identification Privacy protection

slide-17
SLIDE 17

Sandboxed Phishing Kits

Global Picture:

  • Attackers, victims, and security researchers
  • Phishing blacklist services
  • Complete privacy protection
slide-18
SLIDE 18

Web Honeypot 5 vulnerable web applications x 100 domain names

  • D. Canali [NDSS 13]

Implementation

slide-19
SLIDE 19

5 vulnerable web applications x 100 domain names

  • D. Canali [NDSS 13]

Web Honeypot PK installation

Implementation

slide-20
SLIDE 20

5 vulnerable web applications x 100 domain names

  • D. Canali [NDSS 13]

Web Honeypot PK installation

Implementation

Attacker Identification

slide-21
SLIDE 21

5 vulnerable web applications x 100 domain names

  • D. Canali [NDSS 13]

Web Honeypot

Implementation

Attacker Identification Attacker Tracking

slide-22
SLIDE 22

5 vulnerable web applications x 100 domain names

  • D. Canali [NDSS 13]

Web Honeypot

Implementation

Attacker Identification Attacker Tracking YES

slide-23
SLIDE 23

5 vulnerable web applications x 100 domain names

  • D. Canali [NDSS 13]

Web Honeypot Checking

Implementation

Attacker Identification Attacker Tracking YES

slide-24
SLIDE 24

5 vulnerable web applications x 100 domain names

  • D. Canali [NDSS 13]

Web Honeypot Checking

Implementation

Attacker Identification Attacker Tracking YES

slide-25
SLIDE 25

5 vulnerable web applications x 100 domain names

  • D. Canali [NDSS 13]

Victims Web Honeypot

Implementation

slide-26
SLIDE 26

5 vulnerable web applications x 100 domain names

  • D. Canali [NDSS 13]

Web Honeypot

Implementation

Attacker Tracking

Victims

slide-27
SLIDE 27

5 vulnerable web applications x 100 domain names

  • D. Canali [NDSS 13]

Web Honeypot

Implementation

Attacker Tracking Client-side Data Mangling NO

Victims

slide-28
SLIDE 28

5 vulnerable web applications x 100 domain names

  • D. Canali [NDSS 13]

Web Honeypot

Implementation

Attacker Tracking Client-side Data Mangling NO

Victims Inject JavaScript to prevent data leakage

slide-29
SLIDE 29

5 vulnerable web applications x 100 domain names

  • D. Canali [NDSS 13]

Web Honeypot

Implementation

Attacker Tracking Client-side Data Mangling NO

Victims Inject JavaScript to prevent data leakage

slide-30
SLIDE 30

5 vulnerable web applications x 100 domain names

  • D. Canali [NDSS 13]

Web Honeypot Inject JavaScript to prevent data leakage

Implementation

Attacker Tracking Client-side Data Mangling NO Server-side Protection

Victims

slide-31
SLIDE 31
  • Five months from September 2015 to the end of January 2016
  • 474 phishing kits (PayPal, Apple, Google, Facebook …)

Overview

1min Installation Upload

slide-32
SLIDE 32
  • Five months from September 2015 to the end of January 2016
  • 474 phishing kits (PayPal, Apple, Google, Facebook …)

Overview

1min Installation Upload 10min Testing

slide-33
SLIDE 33
  • Five months from September 2015 to the end of January 2016
  • 474 phishing kits (PayPal, Apple, Google, Facebook …)

Overview

1min Installation Upload 10min Testing 2 days First victim

slide-34
SLIDE 34
  • Five months from September 2015 to the end of January 2016
  • 474 phishing kits (PayPal, Apple, Google, Facebook …)

Overview

1min Installation Upload 10min Testing 2 days First victim 10 days Last victim

slide-35
SLIDE 35
  • Five months from September 2015 to the end of January 2016
  • 474 phishing kits (PayPal, Apple, Google, Facebook …)

Overview

1min Installation Upload 10min Testing 2 days First victim 10 days Last victim 12 days Blacklist

slide-36
SLIDE 36

Phishing Attack Global Picture

slide-37
SLIDE 37

Phishing Attack Global Picture

slide-38
SLIDE 38

Phishing Attack Global Picture

slide-39
SLIDE 39

Phishing Attack Global Picture

slide-40
SLIDE 40

Phishing Attack Global Picture

Installation was very quick

slide-41
SLIDE 41

Phishing Attack Global Picture

471 attackers (IP, User Agent) 70% visited the phishing pages 58% submitted fake credentials

slide-42
SLIDE 42

Phishing Attack Global Picture

Only one attempt to use the compromised system to send the phishing emails

slide-43
SLIDE 43

Phishing Attack Global Picture

2,468 potential victims connected to 127 distinct phishing kits 215 users (9%) posted credentials

slide-44
SLIDE 44

Phishing Attack Global Picture

Estimated lifetime is eight days on average.

slide-45
SLIDE 45

Phishing Attack Global Picture

98% blacklisted by GSB and Phish Tank Average detection latency is 12 days Fire-and-forget approach

slide-46
SLIDE 46

Blacklist Evasion

$random=rand(0,100000000000); $md5=md5("$random"); $base=base64_encode($md5); $dst=md5("$base");

New connection

slide-47
SLIDE 47

Blacklist Evasion

$random=rand(0,100000000000); $md5=md5("$random"); $base=base64_encode($md5); $dst=md5("$base"); $src=“source"; recursive_copy( $src, $dst );

New connection Copy

slide-48
SLIDE 48

Blacklist Evasion

$random=rand(0,100000000000); $md5=md5("$random"); $base=base64_encode($md5); $dst=md5("$base"); $src=“source"; recursive_copy( $src, $dst ); header("location:$dst");

Copy Redirection

slide-49
SLIDE 49

Blacklist Evasion

[12/Nov/2015:18:57:41] 14.xx.xxx.198 GET /kit/ 302 User-Agent: curl/7.25.0

First connection

slide-50
SLIDE 50

Blacklist Evasion

[12/Nov/2015:18:57:41] 14.xx.xxx.198 GET /kit/ 302 User-Agent: curl/7.25.0 [12/Nov/2015:19:01:35] 213.xx.xxx.100 GET /kit/8c5fcf4518e94a9f272d60ee75c309a7 301 User-Agent: Mozilla/4.0 [12/Nov/2015:19:20:45] 213.xx.xxx.100 GET /kit/8c5fcf4518e94a9f272d60ee75c309a7/redirection.php 200 User-Agent: Mozilla/4.0

First connection Reported phishing URL

slide-51
SLIDE 51

Early Victims

? ?

After blacklisting After blacklisting

slide-52
SLIDE 52

Early Victims

Before blacklisting After blacklisting Before blacklisting After blacklisting

slide-53
SLIDE 53

Flash Crowd Effect

?

After blacklisting

slide-54
SLIDE 54

Flash Crowd Effect

Third party visitors:

  • Universities
  • Security vendors

After blacklisting Before blacklisting

slide-55
SLIDE 55

Real-time Drop Email Detection

68 distinct drop email addresses (Gmail, Yahoo, …) Only 4 were disabled or unreachable

slide-56
SLIDE 56

Conclusion

  • Novel approach to sandbox live phishing kits
  • Observe the entire lifecycle of a phishing kit
  • Findings
  • Attackers manually test their PKs
  • Separate hosting and spamming infrastructures
  • Many PKs with few victims each
  • Blacklist very effective to protect users, but detection is not fast enough
  • Attackers move quickly between PKs once they get blacklisted
slide-57
SLIDE 57
slide-58
SLIDE 58

Appendix

Elimination of Other Malicious Files

  • Heuristics
  • Manual classification
slide-59
SLIDE 59

Appendix

Data Exfiltration by Client-Side Side Channels

  • Disguised as a HTML img
  • Defeated by our client-side protection