1 / 42

Lunker : The Advanced Phishing Framework

Lunker : The Advanced Phishing Framework. Joshua Perrymon CEO, PacketFocus. Agenda. Intro What is Lunker ? What can it do? Attack Theory Payloads The Old Way Demo Questions. Who am I?. Joshua Perrymon, CEO PacketFocus 12 yrs Experience “Ethical Hacking”

shira
Télécharger la présentation

Lunker : The Advanced Phishing Framework

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. Lunker: The Advanced Phishing Framework Joshua Perrymon CEO, PacketFocus

  2. Agenda • Intro • What is Lunker? • What can it do? • Attack Theory • Payloads • The Old Way • Demo • Questions

  3. Who am I? • Joshua Perrymon, CEO PacketFocus • 12 yrs Experience “Ethical Hacking” • Over 200 Spear-Phishing attacks in 4-5 languages • 85% Success ratio using “Blacklist” emails from the Internet • MUCH higher using “Whitelist” Emails

  4. What is Phishing • Phishing is a method of Social Engineering used to gain credentials, or have users perform a specific action. • We have all gotten these types of emails. • Sent out to Millions • Usually triggers SPAM filtering alerts • Uses a known phishing site that is usually takes down within a couple days if possible

  5. What is Spear Phishing • A directed Phishing Attack • Only targets a handful of users • Emails are harvested from the Internet or other public places • Very hard to stop as the attack isn’t sent out all over the Internet

  6. Attacking up the OSI • We have been moving up the OSI (Open System Interconnection) model with attacks.

  7. Attacking up the OSI model cont.

  8. How these attacks work

  9. Doing this the “OLD” Way • This takes time. But doesn’t require a lot of technical skills. • Find emails • Find site to be phished • Create the site • Setup php mail spoof • Test • Send • Monitor

  10. Using the Phishing Framework • Easy and repeatable

  11. PacketFocus.com 2008 - Jperrymon Step 1.

  12. PacketFocus.com 2008 - Jperrymon Step 2: Enter Client Info

  13. PacketFocus.com 2008 - Jperrymon Client Details • This is entered into the local database. This allows an audit trail of tests configuration and results. The idea is to document each step automatically, because no-one else wants to do it. • Enter URL and IP Info if provided

  14. PacketFocus.com 2008 - Jperrymon Step3: Email Recon

  15. PacketFocus.com 2008 - Jperrymon But everyone uses their company email address right???? • This is hard to protect against most times. Usually, internal email addresses must be used in business communication. This can be leaked to the Internet Search Engines. • Search “@acme.com” and look through the results.

  16. PacketFocus.com 2008 - Jperrymon Step 4: Phishing Analysis

  17. PacketFocus.com 2008 - Jperrymon On the lookout • This module will actively search the target URL’s and IP’s in scope to identify potential Phishing Targets. • Any site that requires credentials remotely should be considered and identified. • Top targets include Webmail, VPN, and website logins. • The tool will identify these portals and return analysis based on previous information gathered.

  18. PacketFocus.com 2008 - Jperrymon Step5: Select the Bait

  19. PacketFocus.com 2008 - Jperrymon Email is easy • Most often, a simple email from spoofed technical support will be enough to have a user form over login and password details. • Analysis will identify token passwords. Numeric entries should trigger token MITM functions. • Start analysis timers.

  20. PacketFocus.com 2008 - Jperrymon Verify it works

  21. PacketFocus.com 2008 - Jperrymon Now what? • Login to the Phishing site locally to make sure it captures the password. • It’s easy to email the credentials. Be responsible and store them encrypted. • Modules could auto login based on template used. Get email(), Get Attachment(), Get Keyword(), Get Subject().

  22. PacketFocus.com 2008 - Jperrymon Redirect Confusion

  23. PacketFocus.com 2008 - Jperrymon Where am I? • Redirection must be used after the user logs in the first time. Error message, Google, etc • Redirect to real site. • Delete email sent to user after getting credentials.

  24. PacketFocus.com 2008 - Jperrymon Spoof the email

  25. PacketFocus.com 2008 - Jperrymon Tony.. Tony Montana • Setup a spoofed email. • To goal is to have the user perform a pre-defined action. • Authority, realism, and language play a vital role in a successful attacks. • The key is gain trust as soon as possible. • NLP (Neuro-Linguistical Programming) • Milgram Experiment

  26. PacketFocus.com 2008 - Jperrymon Select Footer

  27. PacketFocus.com 2008 - Jperrymon Footer • If you want to write a custom body, select a footer template to give the attack structure.

  28. PacketFocus.com 2008 - Jperrymon Scenario Options

  29. PacketFocus.com 2008 - Jperrymon Pick one. • Pre-defined spoofed email scenarios are included with the framework. These are selected conversations that usually get the response desired based on actual field results. • Scenarios: • Tech Support • Internal IT • 3rd Party IT • End-User

  30. PacketFocus.com 2008 - Jperrymon Stealthy

  31. PacketFocus.com 2008 - Jperrymon Email Head • Sometimes you need to modify the email headers. • We will probably put something in here to identify the tool once it goes public.

  32. PacketFocus.com 2008 - Jperrymon Load the Ammo

  33. PacketFocus.com 2008 - Jperrymon Money Shot. • This is what makes the framework stand out. • The ability to add custom payloads to the phishing email. • XSS, Browser Exploit, Recon, Trojans, Exploits, Backdoors, etc.. • Welcome to hack 2.0

  34. PacketFocus.com 2008 - Jperrymon Test Environment

  35. PacketFocus.com 2008 - Jperrymon Test 1.2.3. • This module launches the local email client and the locally hosted phishing site at the same time. • The tester sends the spoofed email to a locally configured account. This account is checked by the Email Client as would a normal user. • Look for mistakes. The smallest error can cause the attack not to work.

  36. Local Mode

  37. PacketFocus.com 2008 - Jperrymon Start the Audit

  38. PacketFocus.com 2008 - Jperrymon Just a little patience… • Monitor the web server, db, MTA, and monitor. • Setup MITM scripts to auto • Configure alarms and real-time logic. • Setup login options • Capture • Capture/Login • Capture/Login/Scrape

  39. DEMO • Lets have a look at the current working version. • How to bypass Outlook 2007 Phishing filters.

  40. PacketFocus.com 2008 - Jperrymon What's Next • MITM- 2nd Factor Authentication • Advanced Payloads • XSS • CRSF • Browser Exploits • Recon to determine user browser, OS, etc. • Reporting  • Forum Support • Template Sharing • Training Modules • User reaction analysis module • Ability to customize the Templates

  41. Thank You • Thanks for sitting through this presentation. The main aspect to take away from this is how attacks are moving up the OSI model and targeting the user (layer 8). • It doesn’t take a lot of technical skills to perform these types of attacks. • User Awareness is the only way to mitigate this risk. We can’t rely on technology.

More Related