02.25
Phishing, $bank and the South African Connection..
We all know about it to some degree or other. If my mother, who fears computers with her life, can give me a vague idea about why these “nasty hackers” are trying to steal our money then we, as a security community, must be doing something right. Unfortunately, where phishing is concerned, that seems to be where it ends. But more on that later. This entry is an attempt to give a little more information on phishing attacks. It is based entirely on my experiences online and has very little scientific or black magic behind it. If I’ve gone wrong somewhere, please feel free to call me out on it…
The Setup
So, you receive an email in your inbox claiming to be from the Security/Anti-Fraud/Accounts division of $bank and most of the time the contents will be fairly alarming. Alarming enough that you will want to login via their provided link to update your details/reactivate your account/check for missing money. At first glance the emails look legitimate. The sender address looks correct. It’s only once you dig through the email headers that you’ll find that the sender isn’t really $bank but rather $compromised_server. Thankfully we have had it drilled into our heads by security people at work and by $bank officials that they will never ask for things like your PIN/account number etc. Or so we hope. With the prevalence of these attacks, it seems that this particular attack vector is still very much a bread winner.
But wait…how do these sites come into existance ?
This is where I am going to make the grave mistake of “assuming”. I don’t think I’m far wrong, but you never know.
So the emails you receive in your inbox contain links to $bank. But if you check the actual URL you’ll see that it actually links you to somethng like http://www.mysitesbeenhacked.com/content/images/$bank/login.html The actual landing page will look quite close to the real thing depending on how good the phishers are. The images will all be in the right place, only because they are directly linked from the original site. Sometimes these images are broken for whatever reason which should be give away #3413. Your first give away should be the URL. It’s not $banks URL and more importantly it’s not HTTPS. Which is why bookmarking the login page for your $bank of choice is probably a good thing…
I realise none of this explains how these pages get there in the first place. You will have to excuse me. Through $attack_vector_x attackers will upload a phishing kit to a compromised server and extract and set it up for use. How these sites are compromised is anyones guess. It could start from somehthing as simple as a remote file include which is then escalated to either a basic shell or even worse, complete root compromise. Regardless of the exact vector, the phishing kit has now been uploaded, extracted and the site is now live. From here the phishing emails are sent out with links to this siteN. Now it’s simply a game of waiting to see what comes through…
Hook, line and sinker…
We’re going to take the bait on one of these emails. Most of the time, you’ll click on a link and your web browser will tell you that the site is a web forgery or some such big, red warning sign ‘o doom. However, let’s just pretend for a second that the site works. You will land on a page that looks exactly like $bank login and for all intents and purposes it is – except for one little line of code that’s been added. From the kits I’ve seen, the line will look something like this:
<form name=”theForm” method=”POST” action=”logon1.php”…>
This should be a dead give away. Posting to a php file ? On a site that doesn’t use PHP ? But what gets posted ? Information about the server the kit is hosted on and some other miscellaneous information, but most importantly, the information you just entered into the account number and PIN fields of their login page. Depending on the login process of $bank there will be another step to grab the OTP or other out of band authentication token, but this too is simply a POST to a php page. All of this information is then neatly dumped and mailed out to an email address on the web somewhere. I didn’t see any preference for webmail service nor did I see any address more than once. What this says about the phishers, I’ll leave up to you.
It’s a very simple process. Take an existing site framework, modify the code slightly to get the users information back to you and you’re A for away. I would really like to know how much this still works. I think the $bank fraternity in South Africa has done a really good job with user education on phishing. The fact that my mother can spot a phishing email says alot. The down side ? There is still a very scary amount of phishing going on. This says that there are still people who fall prey or that the phishers don’t really care and are just carpet bombing email address space with their hooks.
SARS + Bank = Phishing double whammy
I’ve noticed lately that there has been an increase in the SARS/Bank phish here in South Africa. The email goes that SARS is going to give you money back (heaven forbid) and that you now need to login to your bank for reason X. The link takes you to a rather fancy looking SARS page with links to $banks. You can thne pick which bank you wish to log into. Process X then applies and your details are emailed out as described above. My question is, are these kits locally made ? Or is there a group out there who caters for all banks and you just pay them for specifics ? Either way, $banks have their work cut out for them to keep on top of this lot…
And there inlies the problem. As with things like IDS, Anti-Virus etc. combating phishing is very reactive. You’ll get the phish email, go to $site and try and get it removed. That can be very idifficult when 9 times of of 10, the site is not hosted in South Africa. Yes, things like OpenDNS and $browser checks do help, but at the end of the day, neither solution is ideal. There are groups of people doing what they can to assist and speed up the process, but with the prevalence of vectors like SQL injection still being used heavily, I feel we may be fighting a losing battle.
