Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

11/5/2014
05:33 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

Hackers Devise New Simplified Phishing Method

Researchers identify a technique that makes it easier for attackers to launch phishing campaigns.

Just in time for the holiday season, phishers have devised a more efficient way to get unwary online shoppers to part with their personal data and financial account information.

The new technique, dubbed Operation Huyao by the security researchers at Trend Micro who discovered it, basically lessens the time and effort needed for attackers to mount a phishing campaign while also making such attacks harder to spot.

For conventional phishing attacks to work, attackers have to typically create a realistic looking copy of the website they are targeting so that would-be victims have no idea they are actually on a malicious page.

It is a process that requires attackers to capture, copy and modify the code of a target organization's website and then host the malicious code on their own site, Trend Micro senior threat researcher Noriaki Hayashi wrote on the Security Intelligence Blog on Wednesday.

The new technique allows phishers to skip some of these steps by inserting a proxy program between a would-be victim and the target website, he said.

"The proxy relays traffic between the website and the victim and controls what the victim sees regardless of the device they are using. "So long as the would-be victim is just browsing around the site, they see the same content as they would on the original site," Hayashi said.

It is only when the user actually attempts to make a purchase that the proxy program serves up a modified page that walks the victim through a checkout progress designed to extract personal information and payment card or bank account information, he said.

Trend Micro observed the new technique being used to steal information from customers of a department store in Japan. In that particular instance, the malicious payments page served up by the web proxy asked users for their full names and addresses, email and phone numbers, website password, and detailed payment card information along with expiration dates and card verification codes.

For the attack, the phishers employed various blackhat SEO techniques to ensure that people doing specific product-related searches online were served up with results containing malicious links to the targeted store. Users who clicked on the links were then routed to the department store's website via the malicious proxy.

"This really is like a standard phishing attack from the [victim's] point of view," said Christopher Budd, threat communications manager at Trend Micro via email.

"The attacker lures the target to a bogus site under the attacker's control. The key difference here is that the attacker is proxying back to the legitimate site on the backend to increase the believability of the bogus site."

If the attack technique catches on, it could become a very worrisome development, Hayashi wrote.

"This makes phishing harder to detect by end users, as the phishing sites will be nearly identical to the original sites," he said. In addition, attackers will no longer have to exert effort on duplicating entire shopping sites because all they need to do is duplicate a target website's payment page.

Operation Huyao shows that phishers are devising new ways to resist attempts at stopping them.

According to the Anti-Phishing Working Group (APWG), the average and median "uptimes" for phishing attacks remain near historic lows, suggesting that efforts to stop them are proving successful.

In the first half of 2014 for instance, the median uptime for phishing attacks was 8 hours and 42 minutes, meaning that half of all phishing attackers were active for less than nine year, the APWG has noted.

Even so, phishing continues to be a major problem. In the first six months of 2014, the industry group counted more than 123,700 unique phishing attacks which was the highest since the second half of 2009. A total of 756 institutions were specifically targeted in these attacks, the largest number ever during a six-month period.

Of these companies, Apple was the most phished brand.

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Darth Nul
50%
50%
Darth Nul,
User Rank: Strategist
11/7/2014 | 4:29:46 PM
not really new...
This is more of a combination of existing tools rather than something new.  Doesn't the victim's browser pop up a warning about the proxy's certicate being invalid for the shopping site they think they're on?  Or is the proxy plain http on the victim side, and https only on the store side?
PZav
50%
50%
PZav,
User Rank: Author
11/5/2014 | 8:28:48 PM
Phishing enhancement
Interesting that as anti-Phishing techniques improve, we're witnessing Phishing techniques evolve. Detecting phishing using proxies seems particularly problematic as it makes blacklisting that much more difficult. 
Overcoming the Challenge of Shorter Certificate Lifespans
Mike Cooper, Founder & CEO of Revocent,  10/15/2020
US Counterintelligence Director & Fmr. Europol Leader Talk Election Security
Kelly Sheridan, Staff Editor, Dark Reading,  10/16/2020
7 Tips for Choosing Security Metrics That Matter
Ericka Chickowski, Contributing Writer,  10/19/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Special Report: Computing's New Normal
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
How IT Security Organizations are Attacking the Cybersecurity Problem
How IT Security Organizations are Attacking the Cybersecurity Problem
The COVID-19 pandemic turned the world -- and enterprise computing -- on end. Here's a look at how cybersecurity teams are retrenching their defense strategies, rebuilding their teams, and selecting new technologies to stop the oncoming rise of online attacks.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-26895
PUBLISHED: 2020-10-21
Prior to 0.10.0-beta, LND (Lightning Network Daemon) would have accepted a counterparty high-S signature and broadcast tx-relay invalid local commitment/HTLC transactions. This can be exploited by any peer with an open channel regardless of the victim situation (e.g., routing node, payment-receiver,...
CVE-2020-26896
PUBLISHED: 2020-10-21
Prior to 0.11.0-beta, LND (Lightning Network Daemon) had a vulnerability in its invoice database. While claiming on-chain a received HTLC output, it didn't verify that the corresponding outgoing off-chain HTLC was already settled before releasing the preimage. In the case of a hash-and-amount collis...
CVE-2020-5790
PUBLISHED: 2020-10-20
Cross-site request forgery in Nagios XI 5.7.3 allows a remote attacker to perform sensitive application actions by tricking legitimate users into clicking a crafted link.
CVE-2020-5791
PUBLISHED: 2020-10-20
Improper neutralization of special elements used in an OS command in Nagios XI 5.7.3 allows a remote, authenticated admin user to execute operating system commands with the privileges of the apache user.
CVE-2020-5792
PUBLISHED: 2020-10-20
Improper neutralization of argument delimiters in a command in Nagios XI 5.7.3 allows a remote, authenticated admin user to write to arbitrary files and ultimately execute code with the privileges of the apache user.