Spear Phishing. October 12, 2015 TLP: WHITE.

Transcription

1 Spear Phishing October 12, 2015 TLP: WHITE

2 Agenda How it s made Soo easy to find victims Inventory of evils documents The art of spoofing How to react to phishing Basics things to do Security awareness Ey Questions & Answers

3 How it s made How to phish an organisation? 1. Find victims s 2. Send a mail to a victim with an evil payload 3. If needed convince him to execute the payload

4 Soo easy to find victims is based on old protocols No security in mind No trust anywhere in the protocol Some protocol patches

5 Soo easy to find victims Google, Bing, Exalead, etc Instantly with tools $./theharvester.py -b all -d excellium-services.com Full harvest.. [-] Searching in Google.. Searching 0 results... Searching 100 results... [-] Searching in PGP Key server.. [-] Searching in Bing.. Searching 50 results... Searching 100 results... [-] Searching in Exalead.. Searching 50 results... Searching 100 results... Searching 150 results... [+] s found: [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected]

6 Soo easy to find victims With one valid you got the «format», If not usually;

7 Soo easy to find victims got the «format»? Linkedin do the rest

8 How it s made Sometimes, you just have to ask to the mail gateway Who look s to the external gateway log anyway! $ nc smtp.victim.org smtp.victim.org ESMTP Postfix ehlo ns2.attacker.org 250-smtp.victim.org mail from: [email protected] Ok rcpt to:[email protected] <[email protected]>: Recipient address rejected: User unknown in local recipient table rcpt to:[email protected] <[email protected]>: Recipient address rejected: User unknown in local recipient table rcpt to:[email protected] <[email protected]>: Recipient address rejected: Greylisted

9 How it s made If you use tri/quadgram, it s also bruteforcable [email protected] [email protected] 9

10 Inventory of evil documents A website or a File.

11 Inventory of evil documents «Classical phising» Credentials stealing 11

12 Inventory of evil documents Software exploitation is a reality Flash Player

13 Inventory of evil documents Sometime just KISS Send executables (exe, cpl, scr, pif, etc ) Send scripts (vbs, bat, cmd, etc ) The матрёшка solution (zip, cab, 7zip, zip in zip, etc ) Encrypt the file with a password Use an office document 13

14 Inventory of evil documents Sometime just KISS

15 Inventory of evil documents Office document have macros! How to convice a user to activate macros?

16 Inventory of evil documents

17 The art of spoofing How to convice someone to open something? Ascii homographic attack ->

18 The art of spoofing How to convice someone to open something? Unicode homographic attack Use internationalized domain (IDN) Use cyrillic, greek, hebrew or roman letters.

19 The art of spoofing How to convice someone to open something?

20 The art of spoofing How to convice someone to open something? SMTP PART BODY PART 20

21 The art of spoofing How to convice someone to open something? Body «from» field manipulation 21

22 The art of spoofing Some statistics 34,40% Follow the link 65,60% Don't click

23 Spear phishing How to react to phishing

24 How to react to phishing Control/Harden what you have in place Sensible files should be blocked Crypted file should warn Spoofing should be blocked Deploy Spf / Dkim / Dmarc Mail gateway should be monitored Deploy Anti-exploitation tool

25 How to react to phishing Train people to recognize phising Learn them what is possible Learn them to detect key points. Learn them to report incidents.

26 How to react to phishing Reduce response time Setup policies and processes Incident Response plan Continuus integration

27 Ey assessment Spoofing Tests File extension Phishing Communiaction with C&C User Awareness Top 10 Clickers 11/03/ :00 11/03/ :24 10/03/ :48 10/03/ :12 09/03/ :36 09/03/ :00 Clicks over the time

28 Ey assessment Aware people reduce risk and increase detection; 34,40% 21,75% 28

29 Ey assessment Validate gateway configuration Spoofing tests ( + Body) Attachements and variations Who block s.wsf and.hta? + 20 File types x 18 Variations per files More than 350 security controls 29

30 Ey assessment Spear as an exercise; Perform a spear phishing in your infrastructure Evaluate your staff security awareness Evaluate your detection and alerts process Assess Browser and plugins versions 30

31 EyeWeb assessment Web Surfing Security Review: EyeWeb Bypass web proxy Fingerprint Patch/plugin management Workstation attack Authentication spoofing Administrator awarness 31

32 EyeWeb assessment 32

33 Thanks!