Shouldn't They Be Getting Better At This? The Unending Spear Phishing. Joel Anderson University Information Security

Transcription

1 Shouldn't They Be Getting Better At This? The Unending Spear Phishing Joel Anderson University Information Security

2 Or... Why DO Nigerian Scammers Say They are from Nigeria?

3 First, what you already know the Subject is STILL Spear Phishing that is aimed at tricking University community members into giving up their ID and password. Yes, they are still coming. Over 1800 unique campaigns reported since July

4 The scam mail uses alarming subject lines. Here's a word cloud of around two years of scams: Compiled from Spear Phish subject lines (proportional text from words in phish subject: lines)

5 WHAT are we doing about it? On report we block the phisher return addresses On report - we work to block phishing forms On report - we notify the Anti-Phishing Reply group On report we notify other schools about reported phisher addresses and compromised accounts On report we look for possible replies to phishing On report we contact phisher ISPs Alerts are triggered when users attempt to send a large volume of mail Alerts are triggered on logins from known phisher IPs

6 So far we've blocked many (MANY!) reply addresses. More and more each month.

7 We block the mail because we want to prevent Replies that divulge Name/Password combinations this was the original M.O. Of the scammers a simple letter asking for a reply.

8 Most reply addresses come from free services like live.com, hotmail, yahoo and gmail.

9 Disposable addresses, for the most part, and Blocking replies to them prevented user accounts from being compromised.

10 Trends in Phishing But the strategy has changed: Phishing has gone from A - mail sender expects reply to almost all E type mail mail that includes a form link to capture victim replies. Link/form style phish may be yielding better results. (data from APER group)

11 Not Only... The scammers also take advantage of marginally administered websites to set up phpform sites to process phishing responses. In those cases we will attempt to contact the site owner if necessary, we'll have our local DNS prevent users from going to the site.

12 This is what the scammer forms look like: Yes, that bad...

13 Free Hosting Services Increasingly we are seeing people use free services to host their phishing forms. These services are like Hotmail and Gmail free and disposable locations that can be used (at no cost) to receive responses from the targets. The good news is that since these are legitimate businesses they are pretty quick to respond to our requests to shut down these services. (Usually much more quickly than the free services).

14 Phishers are ALSO using free services to host forms

15 ...or, Google Docs!

16 If you get a request for a password in such a form - send it to phishing@umn.edu And NOW Google includes a warning below the SUBMIT button

17 And Google DOES make it easy to report these! Google forms always have an abuse link!

18 AND, here's a tip if someone is sharing a Google doc with you it ISN'T...

19 ...Going to look like THIS:

20 IF you do respond to one like that, we can guarantee three things: You WILL be sent to Google Docs You WON'T see any shared doc from your friend, and All YOUR contacts will probably get the shared doc from you!

21 Do They Work? Um, yeah :(

22 The phishers go to a lot of work sending out an untold number of their scam letters. Many, maybe most of them are deleted... Yet every month we see accounts that are compromised and used to send out hundreds of spam letters, leaving the victim with a flooded inbox full of complaints and bounced messages. There is a clear correlation between Phisher attempts and compromised accounts months with more attempts regularly lead to more compromised accounts..

23 Phishing 7/2009-3/2012 All reported phish compared to number of compromised accounts

24 Phishing 7/2009-3/2012 Return on Investment Compromised Accounts / Reported Phish

25 Imitation is the sincerest form of flattery So why aren't they trying harder to IMITATE? Virtually none of the phishing sites we've seen are making any serious attempt to look like a legitimate UMN.EDU website. Most are simple default screens with fields for name, userid and password.

26 So... Why do Nigerian Scammers Say They are from Nigeria? It's like those signs:

27 Why do Nigerian Scammers Say They are from Nigeria?

28 When Does Targeting Make Sense for an Attacker? How do so many Internet users escape harm? The range of attacks is enormous and growing, and we know that most users neglect even basic defense measures. Yet things somehow muddle along: 2 billion people use the Internet and seem to derive more good than harm from it. If security is only as good as the weakest link, why don t worst-case outcomes happen regularly? Why isn t everyone hacked every day? The answer might lie in economics rather than technology Herley, Cormac, "When Does Targeting Make Sense for an Attacker?," Security & Privacy, IEEE, vol.11, no.2, pp.89,92, March-April 2013

29 Anecdotal evidence suggests that the asking prices for stolen credit card numbers, passwords, botnet machines, and Captchasolving services have indeed been falling. Thus, scalable attacks value, Vs, tends to decrease with time. This echoes the regular economy: massproduced commodities tend to fall in value over time as the ability to scale up gets better. Herley, Cormac, "When Does Targeting Make Sense for an Attacker?," Security & Privacy, IEEE, vol.11, no.2, pp.89,92, March-April 2013

30 What Are You Going To Do About It? Different teams of OIT staff are continually looking at ways to refine our detection and prevention, but we can't do it alone. We do need reports of scams letters with complete text and headers. (Note: we are only looking for the mail that targets UMN accounts, not banking and other such fraud.) Encourage staff, faculty and student awareness that NO ONE will ask legitimately for their password. Don't create non-umn branded forms that reduce resistance to the bogus forms.

31 The University will NEVER ask for your password.

32 IF anyone claims to be from the U, AND asks for your password REPORT IT to