Free Spear-Phishing Tool on Tap
Open source tool aimed at penetration testers lets them customize phishing attacks on their organizations
A researcher next month will unleash a new, free open-source tool for conducting targeted phishing attacks in-house.
More Security Insights
- Forrester Study: The Total Economic Impact of VMware View
- Securing Executives and Highly Sensitive Documents of Corporations Globally
- Innovations in Integration: Achieving Holistic Rapid Detection and Response
- Optimize Your SQL Environment for Performance & Flexibility
Targeted phishing attacks, also known as spear-phishing, are increasingly becoming the hackers method of choice for infecting and/or infiltrating a specific organization. These attacks can be eerily convincing, often using identical message footers and IP addresses as those within an organization, and can easily dupe unsuspecting users into opening them and following their malicious links. Just last week, a spear-phishing attack on New Zealand-based University of Otago resulted in an estimated 1.55 million spams generated from the universitys server within 60 hours. (See Spear Phishing Attack Unleashes 1.5M Spam Messages.)
A recent report from iDefense Labs found that over 15,000 corporate victims in the past 15 months have been hit by spear phishing attacks.
The new Lunker phishing attack and audit tool is aimed at the penetration tester, so it comes with some advanced hacking features, and doesnt use canned scenarios, but rather templates that can be customized. Spear phishing is a huge risk. Youve really got to start testing for this, says Joshua Perrymon, who developed the Lunker tool. Youve got to start measuring the effectiveness of your [organizations] security awareness and policies.
Last month, boutique security firm Intrepidus Group rolled out a software-as-a-service offering called PhishMe that lets companies find the weakest links in their targeted phishing defense, as well as give their users a real-world taste of just what a spear-phishing attack looks and feels like. (See 'PhishMe' Tool Lets Businesses Spear-Phish Themselves.)
Lunker is aimed at the in-house hacker or outside researcher, Perrymon, CEO of PacketFocus, says. It includes an email reconnaissance feature that crawls the major search engines for corporate email accounts, but can also use lists provided by the would-be targeted organization. It also probes the target for weak links and suggests the most effective template for an attack, based on the emails and other analysis it has conducted on the target. And it comes with monitoring features that analyze the phished users actions in response to the phishing email.
I decided to make this open source, Perrymon says, so organizations can get see how easy these attacks can be done and to find ways to secure themselves. Theres no reason for the bad guys to only have that knowledge and ability, he says.
Perrymon will release the new spear-phishing tool next month at the OWASP Conference, where it will be bundled with the OWASP LiveCD, an application security testing set of tools. Hell also provide a stand-alone version of Lunker sometime after that.
Another feature he hopes to add to Lunker is some user training features. But the biggest need is for organizations to understand these attacks first, so the big push has been getting it to work for pen-testers, Perrymon says. Lunker runs on PHP-based Web servers.
Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.