Risk
8/19/2008
09:46 AM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

Free Spear-Phishing Tool on Tap

Open source tool aimed at penetration testers lets them customize phishing attacks on their organizations

A researcher next month will unleash a new, free open-source tool for conducting targeted phishing attacks in-house.

Targeted phishing attacks, also known as spear-phishing, are increasingly becoming the hacker’s method of choice for infecting and/or infiltrating a specific organization. These attacks can be eerily convincing, often using identical message footers and IP addresses as those within an organization, and can easily dupe unsuspecting users into opening them and following their malicious links. Just last week, a spear-phishing attack on New Zealand-based University of Otago resulted in an estimated 1.55 million spams generated from the university’s server within 60 hours. (See Spear Phishing Attack Unleashes 1.5M Spam Messages.)

A recent report from iDefense Labs found that over 15,000 corporate victims in the past 15 months have been hit by spear phishing attacks.

The new Lunker phishing attack and audit tool is aimed at the penetration tester, so it comes with some advanced hacking features, and doesn’t use canned scenarios, but rather templates that can be customized. “Spear phishing is a huge risk. You’ve really got to start testing for this,” says Joshua Perrymon, who developed the Lunker tool. “You’ve got to start measuring the effectiveness of your [organization’s] security awareness and policies.”

Last month, boutique security firm Intrepidus Group rolled out a software-as-a-service offering called PhishMe that lets companies find the weakest links in their targeted phishing defense, as well as give their users a real-world taste of just what a spear-phishing attack looks and feels like. (See 'PhishMe' Tool Lets Businesses Spear-Phish Themselves.)

Lunker is aimed at the in-house hacker or outside researcher, Perrymon, CEO of PacketFocus, says. It includes an email reconnaissance feature that crawls the major search engines for corporate email accounts, but can also use lists provided by the would-be targeted organization. It also probes the target for weak links and suggests the most effective template for an attack, based on the emails and other analysis it has conducted on the target. And it comes with monitoring features that analyze the phished user’s actions in response to the phishing email.

“I decided to make this open source,” Perrymon says, so organizations can get see how easy these attacks can be done and to find ways to secure themselves. “There’s no reason for the bad guys” to only have that knowledge and ability, he says.

Perrymon will release the new spear-phishing tool next month at the OWASP Conference, where it will be bundled with the OWASP LiveCD, an application security testing set of tools. He’ll also provide a stand-alone version of Lunker sometime after that.

Another feature he hopes to add to Lunker is some user training features. “But the biggest need is for organizations to understand these attacks first, so the big push has been getting it to work for pen-testers,” Perrymon says. Lunker runs on PHP-based Web servers.

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Kelly Jackson Higgins is Executive Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading Tech Digest, Dec. 19, 2014
Software-defined networking can be a net plus for security. The key: Work with the network team to implement gradually, test as you go, and take the opportunity to overhaul your security strategy.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-4632
Published: 2015-01-31
VMware vSphere Data Protection (VDP) 5.1, 5.5 before 5.5.9, and 5.8 before 5.8.1 does not properly verify X.509 certificates from vCenter Server SSL servers, which allows man-in-the-middle attackers to spoof servers, and bypass intended backup and restore access restrictions, via a crafted certifica...

CVE-2014-7287
Published: 2015-01-31
The key-management component in Symantec PGP Universal Server and Encryption Management Server before 3.3.2 MP7 allows remote attackers to trigger unintended content in outbound e-mail messages via a crafted key UID value in an inbound e-mail message, as demonstrated by the outbound Subject header.

CVE-2014-7288
Published: 2015-01-31
Symantec PGP Universal Server and Encryption Management Server before 3.3.2 MP7 allow remote authenticated administrators to execute arbitrary shell commands via a crafted command line in a database-backup restore action.

CVE-2014-8266
Published: 2015-01-31
Multiple cross-site scripting (XSS) vulnerabilities in the note-creation page in QPR Portal 2014.1.1 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) title or (2) body field.

CVE-2014-8267
Published: 2015-01-31
Cross-site scripting (XSS) vulnerability in QPR Portal 2014.1.1 and earlier allows remote attackers to inject arbitrary web script or HTML via the RID parameter.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
If you’re a security professional, you’ve probably been asked many questions about the December attack on Sony. On Jan. 21 at 1pm eastern, you can join a special, one-hour Dark Reading Radio discussion devoted to the Sony hack and the issues that may arise from it.