{"id":593,"date":"2018-11-14T08:00:29","date_gmt":"2018-11-14T08:00:29","guid":{"rendered":"http:\/\/www.emaren.com\/?p=593"},"modified":"2023-03-27T10:27:08","modified_gmt":"2023-03-27T09:27:08","slug":"phishinganatomy","status":"publish","type":"post","link":"https:\/\/nealon.uk\/blog\/phishinganatomy\/","title":{"rendered":"Anatomy of a brilliant Phishing attack"},"content":{"rendered":"<p>There has been an increase in the number of e-mails and text messages that are landing in my spam folders recently. I am not sure why the upturn is happening, but some of the e-mails are getting very convincing.<\/p>\n<p>It was not long ago that I would get badly spelled, poorly constructed e-mails that were easy to spot,<\/p>\n<p><strong>Subject:<\/strong> Yuor Natwast account has ten tnarsactions pending.<\/p>\n<p>Now, not only do I not have a Natwest account, but the typo&#8217;s in the subject line made it super obvious.<\/p>\n<p>Yesterday I got an e-mail.<\/p>\n<p><strong>Subject:<\/strong> Lloyds Bank Fraud Alert.<!--more--><\/p>\n<p>Which looked legit to me at first glance.<\/p>\n<p><strong>Sender:<\/strong> FraudAlert@lloyds.co.uk<\/p>\n<p>Not bad &#8211; but a quick check (by hovering over the senders name) showed that the domain was not lloyds &#8211; that was the sender name, the actual account sending the e-mail was something like<\/p>\n<p><em>Fraud.Alert@lloyds.bank.user332798712379821.net<\/em><\/p>\n<p>Additionally it was sent to an e-mail address that I do not use for banking. The e-mail address was one of the e-mail addresses that was part of a previous attach on Talk Talk &#8211; where many thousands of e-mail and hashed passwords were obtained, along with partial credit card details.<\/p>\n<p>The body of the e-mail looked perfect, it looked just like a Lloyds e-mail.<\/p>\n<p>It was addressed to me too, although it was First and Last names, not Mr. M R &nbsp;&#8211; so that gave things away slightly. But it was subtle, it had my name on it, which upgrades from a phishing attack to a spear phishing attack<\/p>\n<p>What was even more interesting was that the &#8216;click to sign in&#8217; looked like it would took me to https:\/\/signin.lIoydsfraudaIerts.com.user332798712379821.net\/(my email address) &#8211; again hover over the link and you see the full thing.<\/p>\n<p>Which again, at a glance looked super legitimate the extra junk in the domain would probably only be visible when viewed in most browsers it was very impressive.<\/p>\n<p>Out of interest, I fired up a VM and visited the site.<\/p>\n<p>HTTPS was valid &#8211; chrome reported the site as secure &#8211; someone had bought a certificate for this.<\/p>\n<p>The sign-in page was very nicely done, this was very impressive. Most of the links took me back to the same page though&#8230;.<\/p>\n<p>Then the actual login piece was very clever indeed.<\/p>\n<ul>\n<li>It wanted my user-name : I entered zzzzhhhhhzzzz which is not my user-name.<\/li>\n<li>It wanted my password : I entered password1 &#8211; again, not my password<\/li>\n<li>It wanted character 3,4,6 of my secret code : I entered a,a,a which is not mine.<\/li>\n<li>It told me that my secret information was incorrect, and asked for 1,2,5 : I entered a,a,a<\/li>\n<li>It told me that it needed to send me a secret key and suggested I enter my phone number<\/li>\n<\/ul>\n<p>I bailed at this point. I deleted the VM, just in case and sat thought about this.<\/p>\n<p>After this, I got an email that contained a PDF that was a fake &#8216;Lloyds Satisfaction Survey&#8217; &#8211; which had I opened it on a windows machine would have installed a worm&#8230;..<\/p>\n<p>This was super good, it was a Spear-Phishing attempt. It was tailored to me. I should be honoured.<\/p>\n<p>But look at what it could have collected.<\/p>\n<ul>\n<li>My Bank Login<\/li>\n<li>My Password<\/li>\n<li>Six of the characters in my secret data<\/li>\n<li>My phone number<\/li>\n<\/ul>\n<p>Holy shit &#8211; that is <em>brilliant<\/em>.<\/p>\n<p>It looked very official, it took me to a secure site, it was setup to trap useful information that would give people access to my bank account. The satisfaction survey PDF was a lovely touch too.<\/p>\n<p>This is one of the best attempts I have ever seen, I am sure that the average person would have given away some or all of their information.<\/p>\n<p><strong>Let&#8217;s recap.<\/strong><\/p>\n<p>My e-mail address was harvested along with partial credit card details in the Talk-Talk breach. This gave an attacker my First and Last names, a valid e-mail address and potentially the bank I used based on the partial credit card data.<\/p>\n<p>Knowing that I bank at Lloyds (great customer service BTW) and armed with decent spelling and grammar, customised e-mails were easy to generate, and custom landing pages to harvest the information too.<\/p>\n<p>The PDF satisfaction survey was brilliant, the worm, had I been on Windows, looked like it would have run riot all over my network unless I was absolutely up-to-date on my update, virus protection and using an admin (not user) account.<\/p>\n<p>Very, very nicely done.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>There has been an increase in the number of e-mails and text messages that are landing in my spam folders recently. I am not sure why the upturn is happening, but some of the e-mails are getting very convincing. It was not long ago that I would get badly spelled, poorly constructed e-mails that were [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[108,34],"tags":[],"class_list":["post-593","post","type-post","status-publish","format-standard","hentry","category-security","category-technology"],"_links":{"self":[{"href":"https:\/\/nealon.uk\/blog\/wp-json\/wp\/v2\/posts\/593","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/nealon.uk\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/nealon.uk\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/nealon.uk\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/nealon.uk\/blog\/wp-json\/wp\/v2\/comments?post=593"}],"version-history":[{"count":2,"href":"https:\/\/nealon.uk\/blog\/wp-json\/wp\/v2\/posts\/593\/revisions"}],"predecessor-version":[{"id":2028,"href":"https:\/\/nealon.uk\/blog\/wp-json\/wp\/v2\/posts\/593\/revisions\/2028"}],"wp:attachment":[{"href":"https:\/\/nealon.uk\/blog\/wp-json\/wp\/v2\/media?parent=593"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/nealon.uk\/blog\/wp-json\/wp\/v2\/categories?post=593"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/nealon.uk\/blog\/wp-json\/wp\/v2\/tags?post=593"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}