Slashdot Mirror
Spies In the Phishing Underground
An anonymous reader sends us to Net-Security.org for an interview with security researchers Nitesh Dhanjani and Billy Rios, who recently managed to infiltrate the phishing underground. What started as a simple examination of phishing sites turned into an extraordinary tour through the ecosystem that supports the business of phishing. In the interview they expose the tactics and tools that phishers use, illustrate what happens when your confidential information gets stolen, and discuss how phishers communicate and how they phish each other.
The situation's the same with botnets, spamming, and malware. Why should things be different? Taking a peak at some phishing sites, there are obviously a great deal of similarities between them. I don't know why this is a revolution to these guys.
P.s.: Damn, there's a lot of advertising on that site.
Don't mind the extra X. Alex
To summarize:
Six pages? I was hoping for at least the transcript of a chat with a phisher.
John
3..
2..
1.
The simple truth is that interstellar distances will not fit into the human imagination
- Douglas Adams
So they skimmed botnet servers, scammed scammers, talked with phishers and "infiltrated" their network and got a hand onto phishing kits. Ok. Various AV researchers have done so for at the very least a year now, many for over two years, full time, with a hand deeply in the whole process.
:)
Should I write a book now or something?
Gaining such information is actually not that hard. Many have done that, but the majority so far had the brains to keep their mouth shut about it. First of all, nobody in that scene likes a loudmouth, it makes your work incredibly hard if you talk too much. And second, the last thing we need is more people trying to get into the "market".
But then, as we've read last week, you probably get a trojaned kit anyway.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
So, what TFA is saying is that the phishing community is just another community of skiddies, just like the rest of the modern "hacker underground" or whatever you want to call it. This is news how?
Besides the obvious hacker/cracker naming issue, the fact is that today's "hacking" community bears little resemblance to the real hacker heroes of the past. The hacking/cracking issue has been hashed out enough around here, so i'll leave that issue alone.
Of the people that call themselves hackers in the modern, media-approved sense, there are only a few out there with the intelligence to write their own stuff. The rest are script kiddies, and just mooch off of the work that has already been done.
So now someone spends months wandering around the phishing scene, and is surprised to discover that its not any different then the rest of the hackers of today's world. I fail to see how this is newsworthy.
"Both Nitesh and Billy are well-known security researchers that have recently managed to infiltrate the phishing underground. What started as a simple examination of phishing sites, turned into an extraordinary view of the ecosystem that supports the phishing effort that plagues modern day financial institutions and their customers.
They saw an extraordinary amount of sensitive customer account information, obtained the latest phishing kits, located and examined the tools used by phishers, trolled sites buying and selling identities, and even social engineered a few scammers.
In this interview, they expose the tactics and tools that phishers use, illustrate what happens when your confidential information gets stolen, discuss how phishers communicate and even how they phish each other.
What are phishing kits and how are they distributed?
Dhanjani: A phishing kit is the most important tool in a phisher's arsenal. Think of a popular company that executes financial transactions on the web. All the source code and static content such as images and logos needed to setup a phishing site for the company you just thought of is most likely to be present in a phishing kit. Let us suppose you get hold of such a kit and you want to deploy a phishing site. All you would have to do is the following: 1) Unzip the kit 2) Pick the directory corresponding the company you want to target 3) Edit a single file in the directory to input the email address you want the results emailed to 4) Deploy the directory onto a compromised host on the internet, and voila! - you have yourself a phishing site. If you take a look at the client side code (HTML and JavaScript) presented to your browser on a phishing site that targets a particular company, you will notice that other phishing sites that target the same company have similar characteristics. This is because, more often than not, the sites are deployed using popular phishing kits. The code within the kits is quite simple, mostly consisting of a web form that does the dirty work, along with image files and static content. The kits are often distributed amongst the phisher communities on message boards, and at times sold or traded for money or identities.
Rios: Phishing kits are the tip of the iceberg, they are the piece of the phishing eco system that everyone sees and knows about. The typical phishing kit consists of the HTML that makes up the forged site that the user sees and the backend logic that used to steal the victims information. Most phishing kits are probably created by a small number of individuals and typically sold on phishing forums. Although the various kits have different front ends and HTML content, the back end logic is surprisingly similar for most of the kits we've seen. These kits are used over and over again and most of the phishing sites you've seen are probably a variant of small set of phishing kits. Many think that phishing sites are all custom jobs that a particular phisher has developed and deployed. The reality is pre-made, ready-to-deploy, turnkey sites are already created for practically every major organization that you can think of. All a phisher has to do is purchase the latest kit and deploy, no technical expertise or coding skills are really required. All the phisher typically has to do is place their email address into one line of code and they have a ready to deploy phishing site.
Many have become victims of phishing and we see the attackers using new methods all the time. In your opinion, what is their skill level? Who are we dealing with?
Dhanjani: This is an important question, and I'm glad you asked it. When we think of phishers, we often guess that they are a group of highly skilled ninja hackers. They have collectively caused billions of dollars in losses, and ruined the lives of many citizens whose identities they have stolen and abused. These people have got to be pretty smart, right? Wrong. Just think about what a typical phisher is really doing: installing
The implication in the title is that these "security experts" actually got in with one of the rings. As a matter of fact, they simply downloaded a phishing kit and signed up for a forum. They didn't talk to anyone who wrote one (not that much skill is required in that). They didn't gain access to any dark-nets. They didn't gain access to secure IRC channels. In short, they're just a couple of guys. Their agenda seems clear to me: push the IE anti-phishing UI. They make reference to it (though not by name) twice in TFA:
...the(sic) are abusing a few fundamental flaws such as lack of awareness, lack of standards around browser UI that clearly highlights high assurance websites... Instead we need to come up with browser UI standards that allow the users to clearly and easily distinguish high assurance domains and websites.They also talk about the need for a system that works without static identifiers like credit card and social security numbers, though they don't postulate any such system. They claim that writing secure code is secondary to this as-yet unknown system that doesn't use personally identifiable information to identify you. My thoughts: until we figure out how to identify you without using identifiers, maybe we should concentrate on the secure code angle for a while.
"Please describe the scientific nature of the 'whammy'" - Agent Scully
So the phishers are trying to phish the phishers who are phishing for... what? (That's some quality writing, right there.)
Seriously, the article seems like something you'd see featured on the evening news as a scare tactic.
Reporter: Is your identity safe? It could be at risk and you don't even know it. Top researchers say there are hacker communities out there that will likely only continue to grow! Are you stupid enough to stay tuned until the end of our worthless program and find out?
Wait... Is this really even Slashdot? Why does my browser say http://it.slashd0t.org/? Son of a...
Make the browser highlight the domain part of the url in bold. Even if this helps just a few users recognize the scam easier it's worth it. Besides, it will somewhat improve usability for regular use as well. I often scan the URL line for to get an idea of what a tab displays, and this will save a few milliseconds of my brain time each time I do it.
Yup. The weakest link in computer security is the user. Now, while in companies you might have some administrator who might or might not be actually security conscious and lock down user PCs (as far as he can, due to company policy and program requirements), the average machine in a user's home is horribly insecure. Not because of remote exploits or inherently bad security, but because users are gullible and can easily be tricked into clicking pretty much everything.
... dunno?
Now, I know a lot of people will claim that you can lock down a system sensibly. No, you cannot. Unless you forbid the user to run whatever code he wants (i.e. let him only run 'signed' code that some signing authority deemed ok), you cannot. The key problem is that you, the maker of the system, cannot decide whether the actions caused by the program are wanted by the user or not. Yes, you can ask the user about every even so trivial thing, but then you're where Vista is: You ask him questions he cannot answer, failing to understand just what you are asking there. Access the registry? Access the internet? I
Locking away the system and allowing only "user space" programs to run doesn't cut it either. Because most home computers are only used by one person, it does not matter whether you run only for this one person or for the whole system, they're the same.
So, basically, what security comes down to is user knowledge. Most trojans today use social engineering to get onto a user's PC. They don't use backdoors or exploits, they simply use tricks to have the user open and run them.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
net banking that requires sms verification of transfers.
public, televised floggings for anyone convicted of fraud or petty theft.
only the banks can make these happen (including option 3 as well i might add, polical lobbying ftw). hell i know i'd tune into watch some scammers take a beating.
If you mod me down, I will become more powerful than you can imagine....
I infiltrated a phish show once; other than a lot of hippies smoking dope and some weird meandering drone-rock, I'm not sure what the big deal was.