Slashdot Mirror
Spies In the Phishing Underground
An anonymous reader sends us to Net-Security.org for an interview with security researchers Nitesh Dhanjani and Billy Rios, who recently managed to infiltrate the phishing underground. What started as a simple examination of phishing sites turned into an extraordinary tour through the ecosystem that supports the business of phishing. In the interview they expose the tactics and tools that phishers use, illustrate what happens when your confidential information gets stolen, and discuss how phishers communicate and how they phish each other.
And here's a look at the piracy underground.
The situation's the same with botnets, spamming, and malware. Why should things be different? Taking a peak at some phishing sites, there are obviously a great deal of similarities between them. I don't know why this is a revolution to these guys.
P.s.: Damn, there's a lot of advertising on that site.
Don't mind the extra X. Alex
To summarize:
Six pages? I was hoping for at least the transcript of a chat with a phisher.
John
3..
2..
1.
The simple truth is that interstellar distances will not fit into the human imagination
- Douglas Adams
So they skimmed botnet servers, scammed scammers, talked with phishers and "infiltrated" their network and got a hand onto phishing kits. Ok. Various AV researchers have done so for at the very least a year now, many for over two years, full time, with a hand deeply in the whole process.
:)
Should I write a book now or something?
Gaining such information is actually not that hard. Many have done that, but the majority so far had the brains to keep their mouth shut about it. First of all, nobody in that scene likes a loudmouth, it makes your work incredibly hard if you talk too much. And second, the last thing we need is more people trying to get into the "market".
But then, as we've read last week, you probably get a trojaned kit anyway.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
So, what TFA is saying is that the phishing community is just another community of skiddies, just like the rest of the modern "hacker underground" or whatever you want to call it. This is news how?
Besides the obvious hacker/cracker naming issue, the fact is that today's "hacking" community bears little resemblance to the real hacker heroes of the past. The hacking/cracking issue has been hashed out enough around here, so i'll leave that issue alone.
Of the people that call themselves hackers in the modern, media-approved sense, there are only a few out there with the intelligence to write their own stuff. The rest are script kiddies, and just mooch off of the work that has already been done.
So now someone spends months wandering around the phishing scene, and is surprised to discover that its not any different then the rest of the hackers of today's world. I fail to see how this is newsworthy.
"Both Nitesh and Billy are well-known security researchers that have recently managed to infiltrate the phishing underground. What started as a simple examination of phishing sites, turned into an extraordinary view of the ecosystem that supports the phishing effort that plagues modern day financial institutions and their customers.
They saw an extraordinary amount of sensitive customer account information, obtained the latest phishing kits, located and examined the tools used by phishers, trolled sites buying and selling identities, and even social engineered a few scammers.
In this interview, they expose the tactics and tools that phishers use, illustrate what happens when your confidential information gets stolen, discuss how phishers communicate and even how they phish each other.
What are phishing kits and how are they distributed?
Dhanjani: A phishing kit is the most important tool in a phisher's arsenal. Think of a popular company that executes financial transactions on the web. All the source code and static content such as images and logos needed to setup a phishing site for the company you just thought of is most likely to be present in a phishing kit. Let us suppose you get hold of such a kit and you want to deploy a phishing site. All you would have to do is the following: 1) Unzip the kit 2) Pick the directory corresponding the company you want to target 3) Edit a single file in the directory to input the email address you want the results emailed to 4) Deploy the directory onto a compromised host on the internet, and voila! - you have yourself a phishing site. If you take a look at the client side code (HTML and JavaScript) presented to your browser on a phishing site that targets a particular company, you will notice that other phishing sites that target the same company have similar characteristics. This is because, more often than not, the sites are deployed using popular phishing kits. The code within the kits is quite simple, mostly consisting of a web form that does the dirty work, along with image files and static content. The kits are often distributed amongst the phisher communities on message boards, and at times sold or traded for money or identities.
Rios: Phishing kits are the tip of the iceberg, they are the piece of the phishing eco system that everyone sees and knows about. The typical phishing kit consists of the HTML that makes up the forged site that the user sees and the backend logic that used to steal the victims information. Most phishing kits are probably created by a small number of individuals and typically sold on phishing forums. Although the various kits have different front ends and HTML content, the back end logic is surprisingly similar for most of the kits we've seen. These kits are used over and over again and most of the phishing sites you've seen are probably a variant of small set of phishing kits. Many think that phishing sites are all custom jobs that a particular phisher has developed and deployed. The reality is pre-made, ready-to-deploy, turnkey sites are already created for practically every major organization that you can think of. All a phisher has to do is purchase the latest kit and deploy, no technical expertise or coding skills are really required. All the phisher typically has to do is place their email address into one line of code and they have a ready to deploy phishing site.
Many have become victims of phishing and we see the attackers using new methods all the time. In your opinion, what is their skill level? Who are we dealing with?
Dhanjani: This is an important question, and I'm glad you asked it. When we think of phishers, we often guess that they are a group of highly skilled ninja hackers. They have collectively caused billions of dollars in losses, and ruined the lives of many citizens whose identities they have stolen and abused. These people have got to be pretty smart, right? Wrong. Just think about what a typical phisher is really doing: installing
The implication in the title is that these "security experts" actually got in with one of the rings. As a matter of fact, they simply downloaded a phishing kit and signed up for a forum. They didn't talk to anyone who wrote one (not that much skill is required in that). They didn't gain access to any dark-nets. They didn't gain access to secure IRC channels. In short, they're just a couple of guys. Their agenda seems clear to me: push the IE anti-phishing UI. They make reference to it (though not by name) twice in TFA:
...the(sic) are abusing a few fundamental flaws such as lack of awareness, lack of standards around browser UI that clearly highlights high assurance websites... Instead we need to come up with browser UI standards that allow the users to clearly and easily distinguish high assurance domains and websites.They also talk about the need for a system that works without static identifiers like credit card and social security numbers, though they don't postulate any such system. They claim that writing secure code is secondary to this as-yet unknown system that doesn't use personally identifiable information to identify you. My thoughts: until we figure out how to identify you without using identifiers, maybe we should concentrate on the secure code angle for a while.
"Please describe the scientific nature of the 'whammy'" - Agent Scully
Not that hard to infiltrate... ever been to 711chan.org? xD Also, just a pet peeve, why do they break up the article into 6 pages instead of just putting it all on one? >:P
Weaksauce as they say...
Of course they infiltrated their underground. All it took was their credit card number and SS#.
Absolute power corrupts absolutely. indymedia
Just to make it interesting. Go to a known phishing site, enter in a fake ID and SSN, and follow it down the pipes.
These idiots just set up a site and wrote a story about it. I've done more than this on a single weekend collecting data for LE Agencies or trainings I provide to Judges/Lawyers and Gov't IT Workers. Hell, I've set up a Linux VMware server that hosts all the current phishing sites on a single instance.
The genius here, going by the name "Brain", provides first class phishing sites with a catch - he has encrypted his email address and integrated it into the pages he's written. When Script Kiddies like the ones in this article set up the "Brain" sites, a copy of the stolen credentials gets secretly sent to Brain as well as the Phisherman... making Brain the first Commercial Phisherman I have encountered.
Give a man fire, you keep him warm for a day. Set a man on fire and you'll keep him warm for the rest of his life.
Joel Helgeson
Good security is based upon reality and common sense. Common sense is a function of having common knowledge.
I was just reading an interview in either Inc. or Fast Company with the head of the research division inside one of the big anti-virus vendors. He said that most encryption and security issues have been solved. The real threat now is humans, meaning weaknesses in how we interact with others, i.e., trust, building a rapport, lies, etc. Humans are the weakest link and no amount of technology will help. It'll always be possible to hack a system if you think your little old Grandma is on the other end is asking for your help.
How to Download YouTube Videos
We pay the FBI a lot of money to infiltrate and bring to justice these organized criminal networks. But the FBI isn't bothering.
Of course, the banks are supposed to defend their trademarks from anyone, including phishers, who uses them to pretend to be the bank. But they're not bothering.
--
make install -not war
So the phishers are trying to phish the phishers who are phishing for... what? (That's some quality writing, right there.)
Seriously, the article seems like something you'd see featured on the evening news as a scare tactic.
Reporter: Is your identity safe? It could be at risk and you don't even know it. Top researchers say there are hacker communities out there that will likely only continue to grow! Are you stupid enough to stay tuned until the end of our worthless program and find out?
Wait... Is this really even Slashdot? Why does my browser say http://it.slashd0t.org/? Son of a...
Make the browser highlight the domain part of the url in bold. Even if this helps just a few users recognize the scam easier it's worth it. Besides, it will somewhat improve usability for regular use as well. I often scan the URL line for to get an idea of what a tab displays, and this will save a few milliseconds of my brain time each time I do it.
net banking that requires sms verification of transfers.
public, televised floggings for anyone convicted of fraud or petty theft.
only the banks can make these happen (including option 3 as well i might add, polical lobbying ftw). hell i know i'd tune into watch some scammers take a beating.
If you mod me down, I will become more powerful than you can imagine....
Spies sappin' mah underground!
I infiltrated a phish show once; other than a lot of hippies smoking dope and some weird meandering drone-rock, I'm not sure what the big deal was.
So if these phishers are using low-tech stuff like Formmail, then you should just autofill their forms with randomly generated bogus personal information for hours on end. It would make it very hard to sort the legitimate data from the trash. Assuming of course that their sites don't store IP information in the email messages.
Only thing to worry about would be getting DDOS'ed by a less clueless phisher.
...even though I want to. I read the first page, then saw that it is six full pages, with no Print function. Six pages with about 1:4 content:advertising space. No thanks. I hate C|Net for pioneering the ideas of a paragraph a page, and I won't read Phoronix for the same reason. They will get my ad impressions (and I always click interesting ads on interesting content, to help the webmasters who write the content) when they stop forcing it upon me. It's crap like this that leads to Adblock.
It is dangerous to be right when the government is wrong.
"Any chance you'd post that hosts file? I could use it too." - by Anonymous Coward on Monday January 28, @07:44AM You can get one here that has over 28,000 adbanner servers blocked that might house malicious script, and a WHOLE lot more to secure yourself:
HOW TO SECURE Windows 2000/XP/Server 2003 & VISTA:
http://forums.pcpitstop.com/index.php?s=adfdf51b0561d4af950c266aa4e313e8&showtopic=150310
Enjoy the tips/tricks/techniques for securing yourself vs. today's myriad online threats present on the public internet... it all just works!
(... and, it is made far easier + more fun to do, with the CIS Tool (noted in COMPUTERWORLD & other sites online that are reputable, as a GOOD tool for security) acting as your guide, & even making it FUN to do!)
APK
If you feed in enough bogus usernames and passwords, it becomes much harder for the phishers to tell the real ones from the fakes. If the phishers check by IP to prevent this, do it from many different machines with many different IP addresses.
"What started as a simple examination of phishing sites, turned into an extraordinary view of the ecosystem that supports the phishing effort that plagues modern day financial institutions and their customers"
The real story is who built such an 'ecosystem' that makes phishing such a sucessfull enterprise and what imdemnification does the maker of such systems offer the end user."
"They have collectively caused billions of dollars in losses, and ruined the lives of many citizens whose identities they have stolen and abused"
What end user Operating System do these phishing efforts require in order to me sucessfull. For instance how many phising efforts have been sucessfull on the current Apple Mac OS?
davecb5620@gmail.com
I can see a phisher buying a kit that looks like an ebay or paypal or bank site login page. I can see them buying access to some elementary school's compromised web server and copying their stuff into a directory on it. But how do they make //compromisedneighborhoodschoolserver.org/somefolder/someother/myebaykit/ look like a plausible URL? Don't they have to register something somewhere, leaving a trail behind that could be used to find them? Or do they not bother and assume the victims won't look at the URL?
Yah, so we need a new tag, which can warn others to stay away from clicking to the article due to a blatant attempt to generate ad revenue.
I offer 'adFarming' for starters..
Requiem for the American Dream
Let us all report phishing. In Gmail you can report the phishing method. Instead of reporting as SPAM, we should mark as phsihing. In this way phishing can be stopped. The tech people are the key to stopping spam (besides education).
Visit http://www.kaizenlog.com