Risk
8/19/2008
09:46 AM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

Free Spear-Phishing Tool on Tap

Open source tool aimed at penetration testers lets them customize phishing attacks on their organizations

A researcher next month will unleash a new, free open-source tool for conducting targeted phishing attacks in-house.

Targeted phishing attacks, also known as spear-phishing, are increasingly becoming the hacker’s method of choice for infecting and/or infiltrating a specific organization. These attacks can be eerily convincing, often using identical message footers and IP addresses as those within an organization, and can easily dupe unsuspecting users into opening them and following their malicious links. Just last week, a spear-phishing attack on New Zealand-based University of Otago resulted in an estimated 1.55 million spams generated from the university’s server within 60 hours. (See Spear Phishing Attack Unleashes 1.5M Spam Messages.)

A recent report from iDefense Labs found that over 15,000 corporate victims in the past 15 months have been hit by spear phishing attacks.

The new Lunker phishing attack and audit tool is aimed at the penetration tester, so it comes with some advanced hacking features, and doesn’t use canned scenarios, but rather templates that can be customized. “Spear phishing is a huge risk. You’ve really got to start testing for this,” says Joshua Perrymon, who developed the Lunker tool. “You’ve got to start measuring the effectiveness of your [organization’s] security awareness and policies.”

Last month, boutique security firm Intrepidus Group rolled out a software-as-a-service offering called PhishMe that lets companies find the weakest links in their targeted phishing defense, as well as give their users a real-world taste of just what a spear-phishing attack looks and feels like. (See 'PhishMe' Tool Lets Businesses Spear-Phish Themselves.)

Lunker is aimed at the in-house hacker or outside researcher, Perrymon, CEO of PacketFocus, says. It includes an email reconnaissance feature that crawls the major search engines for corporate email accounts, but can also use lists provided by the would-be targeted organization. It also probes the target for weak links and suggests the most effective template for an attack, based on the emails and other analysis it has conducted on the target. And it comes with monitoring features that analyze the phished user’s actions in response to the phishing email.

“I decided to make this open source,” Perrymon says, so organizations can get see how easy these attacks can be done and to find ways to secure themselves. “There’s no reason for the bad guys” to only have that knowledge and ability, he says.

Perrymon will release the new spear-phishing tool next month at the OWASP Conference, where it will be bundled with the OWASP LiveCD, an application security testing set of tools. He’ll also provide a stand-alone version of Lunker sometime after that.

Another feature he hopes to add to Lunker is some user training features. “But the biggest need is for organizations to understand these attacks first, so the big push has been getting it to work for pen-testers,” Perrymon says. Lunker runs on PHP-based Web servers.

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Kelly Jackson Higgins is Executive Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2015-4692
Published: 2015-07-27
The kvm_apic_has_events function in arch/x86/kvm/lapic.h in the Linux kernel through 4.1.3 allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact by leveraging /dev/kvm access for an ioctl call.

CVE-2015-1840
Published: 2015-07-26
jquery_ujs.js in jquery-rails before 3.1.3 and 4.x before 4.0.4 and rails.js in jquery-ujs before 1.0.4, as used with Ruby on Rails 3.x and 4.x, allow remote attackers to bypass the Same Origin Policy, and trigger transmission of a CSRF token to a different-domain web server, via a leading space cha...

CVE-2015-1872
Published: 2015-07-26
The ff_mjpeg_decode_sof function in libavcodec/mjpegdec.c in FFmpeg before 2.5.4 does not validate the number of components in a JPEG-LS Start Of Frame segment, which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via craft...

CVE-2015-2847
Published: 2015-07-26
Honeywell Tuxedo Touch before 5.2.19.0_VA relies on client-side authentication involving JavaScript, which allows remote attackers to bypass intended access restrictions by removing USERACCT requests from the client-server data stream.

CVE-2015-2848
Published: 2015-07-26
Cross-site request forgery (CSRF) vulnerability in Honeywell Tuxedo Touch before 5.2.19.0_VA allows remote attackers to hijack the authentication of arbitrary users for requests associated with home-automation commands, as demonstrated by a door-unlock command.

Dark Reading Radio
Archived Dark Reading Radio
What’s the future of the venerable firewall? We’ve invited two security industry leaders to make their case: Join us and bring your questions and opinions!