Slashdot Mirror
New Phishing Toolkit Uses Whitelisting To 'Bounce' Non-Victims
chicksdaddy writes "Researchers at RSA say that a new phishing toolkit allows attackers to put a velvet rope around scam web pages – bouncing all but the intended victims. The new toolkit, dubbed 'Bouncer,' was discovered in an analysis of attacks on financial institutions in South Africa, Australia and Malaysia in recent weeks. It allows attackers to generate a unique ID for each intended victim, then embed that in a URL that is sent to the victim. Outsiders attempting to access the phishing page are redirected to a '404 page not found' error message. Other phishing kits have used IP address blacklists to block anti malware companies from viewing their malicious pages, but this is the first known use of whitelisting, RSA said. The phishing attacks that RSA technicians discovered that used the Bouncer kit were designed to harvest login credentials from financial services firms. The whitelisting feature may well work, especially given the volume of potential phishing pages that security companies review each day. Getting a 404 message may be enough to get a forensic investigator or security researcher to move on to the next phishing site, rather than investigating."
.
So which is it? Aren't they using IP addy to verify the identity of the sucker? Or is their some other source (their unique URL that they post)?
.
If it's by unique URL with a referral code at the post, then security checks wouldn't see it. IF it's just the unique URL, anyone else testing that URL would see it too.
It looks like banks and gov departments can no longer be trusted as normal web sites. They have to be setup to be only available through SSL and must use client certificates for authentication with some way of verifing that the server certificate matches the client certificate.
Only then could the software (possibly a custom configuration of a web browser, maybe an normal one) actually be sure of defeating a phishing attack.
Of course the main reason it'd work is that with a client certificate there's no password to "phish" for.
Something tells me that the banks are too lazy to do this; every other web site will have to be SSL before they get on the bandwaggon.
Getting a 404 message may be enough to get a forensic investigator or security researcher to move on to the next phishing site, rather than investigating."
The past tense should have been used in that sentence. Any security researcher worth their salt will *not* now move onto the next site upon getting a 404.
In a cybernetic fit of rage she pissed off to another age...
I think I saw this 7 years ago...
pretty obvious thing to do!
So while it might afford some protection to the phishing site, it doesn't seem very likely that it would protect them from further scrutiny.
I think a bigger benefit for phishers is they can identify users who click on these links they can focus their attention on them rather than on users who don't. Somebody dumb enough to click on these links and fill in data is obviously a more valuable target than someone who never responds.
Personally I think the best way to combat phishers would be for major mail providers to work with banks and credit institutions to poison phishing sites with bogus data and flagged cards / accounts.
Certificates can be stolen by spyware. As others pointed out, you need a 2 factor authentication and proper prevention of MitM attacks on both network level (SSL/TLS) and on the user's machine. You need it on the user's machine as well to prevent malware modifying the web page, hiding a malicious transaction from view, but still submitting it to the bank. In Europe a lot of countries use the chip part of the debit card with an OTP generator to generate responses to challenges sent by the bank website. This is guarded against physical debt by requiring the PIN for every transaction as well. This still leaves protection against MitM malware on the computers. Banks are currently studying how to deal with that, since it's quite a threat, given the enormous amount of flash, acrobat and java zero-days hitting users in Europe. Every week we get new attacks and they are getting better and better at faking content and hiding the exploits.
I was promised a flying car. Where is my flying car?
I've seen ones years ago that were PHP scripts that had different behavior based on who was coming in. (one of the more clever ones actually took over the site's main index ... but if the visitor was from the same domain as the server, it returned a near-duplicate of the original content and not the drug ads)
The 404 aspect does give me an idea that I think could make things trickier, but I'll be damned if I'm going to give spammers any ideas for things that they're not already using. (although, I guess it's possible that what I'm thinking of is what they're actually doing, but no security person would call a whitelist ... some person who's not really familiar with the security lingo might, though)
Build it, and they will come^Hplain.
Using a querystring parameter to identify recipients of an email is not new or news worthy.
Even in third-world countries like Indonesia, all major banks have incorporated token/OTP (or at least SMS) for all personal/business accounts.
But do you have cell carriers charging 0.20 USD (2000 rupiah) per received text message on entry-level plans?
Am I the only one not impressed by this? /404.php");
// display phishing page
Lets say url crafted is: http://www.example.com/some-spam-page.php?email=joe@example.com&id=f5b8fb60c6116331da07c65b96a8a1d1
<?php
$md5_check = md5($_GET['email'].'SomeSuperAwesomelyRandomSeedHere');
if($md5_check!=$_GET['id']){
header("Location:
die();
}
?>
Well that took me 30 seconds to come up with.
neorush