Spies In the Phishing Underground

An anonymous reader sends us to Net-Security.org for an interview with security researchers Nitesh Dhanjani and Billy Rios, who recently managed to infiltrate the phishing underground. What started as a simple examination of phishing sites turned into an extraordinary tour through the ecosystem that supports the business of phishing. In the interview they expose the tactics and tools that phishers use, illustrate what happens when your confidential information gets stolen, and discuss how phishers communicate and how they phish each other.

Duh

Rios: This is one of the more surprising aspects of the research we (Nitesh and I) conducted. I had always thought that most phishers were clever hackers evading authorities using the latest evasion techniques and tools. The reality of the matter is most o

Re:Duh

P.s.: Damn, there's a lot of advertising on that site.

Yeah, not only that but I thought it was kinda strange that i had to enter my credit card details just to read the article.

Re:Duh

It is in the best interest of skilled hackers to make these things available to, essentially, anyone.

In a sea of phishers law enforcement is likely to catch those who have the least amount of skill simply because its easier for them. The time they spend on those cases is less time they have for people who really know what's going on.

Re:

"addblock plus , no-script and a host file with 16,875 add servers pointed to 127.0.0.1"
Any chance you'd post that hosts file? I could use it too.

Re:Duh

Excellent point.

Too bad it's not that way in government agencies. My impression is that their dominant mindsets are:

• No use of "not invented here" techniques or technology
  
• We'll never win this "war", the best we can do is to get ourselves promoted
  
• Open software and other new technologies are tools of the enemy
  
• Let's use my cousin Bob's company to get this done
  

I would be surprised and delighted to learn that things are any different at all. Having served in the military, I retain a smug sense of superiority, even though I know that there must be intelligent life in government. It's frustrating to keep finding that we're being taxed and led by selfish, incompetent people.

It's like growing up in a home infested with vermin, where the parents just shrug and say that they can't do anything about it, when it's obvious that they're just spending their money and attention on something else. Their willful ignorance might allow me to get away with whatever I want. The trade-off is finding that my possessions have been gnawed by mice or encountering cockroaches that look at me defiantly when I turn on the light.

As long as they let me alone, I'm OK with it. When they step in and try to suddenly impose discipline, I want to say, "Where were you when I needed you?"

No, the government isn't my parents, but it's been getting closer to the asymptote. Public school has been mandatory since before I was born. Income tax is beyond mandatory. Laws have become more and more restrictive, and we are now being monitored without warrants. That's pretty close to what I remember of my own parents, except that in this case, I own all of the responsibility.

On a national level, it's not as simple as moving out. The analog to running away from home is participation in some underground economy.

Weak article

Not a lot of new information there.

To summarize:

• Phishers have forums where they trade with other phishers.
• Most phishers are script kiddies. Phishing is usually done with pre-made phishing kits. The phisher plugs in their email address and uploads it to a compromised server.
• The phishing kits are riddled with backdoors, where the original kit author does stuff like send copies of the victims data to their own email address.
• Anti-phishing browser plugins lead to a ready-made list of compromised servers. Hackers know that any server on the list is hackable.

Six pages? I was hoping for at least the transcript of a chat with a phisher.

Re:

Anti-phishing browser plugins lead to a ready-made list of compromised servers. Hackers know that any server on the list is hackable.

Put presumably since these servers find themselves on a well circulated "blacklist", they get closed pretty soon? No?

Re:

Ever work in a fortune 500 ? It takes an act of congress to be able bring a server down and reimage it to a known good state if it's been compromised. And they are usually the places with enough bandwidth that they may never find the compromised boxen , un

Re:

I doubt a chat with a phisher would be helpful. It'd probably incredibly dull, and filled with brackets due to typos on their part. Besides, as in most shadow communities, phishers tend to assume you either know everything, or you're a complete idiot to be

Re:Weak article

I doubt a chat with a phisher would be helpful. It'd probably incredibly dull, and filled with brackets due to typos on their part. Besides, as in most shadow communities, phishers tend to assume you either know everything, or you're a complete idiot to be ignored. I'm willing to bet that you couldn't get a (current) phisher to tell all."

It begs the question, in dealing with the phishing community, who are we dealing with -- the uneducated, the merely poor, the greedy, the antisocial, or worse? Is the phishing community an outlet for the antisocial/maladjusted/borderline mentally ill? I'd like to pose the following question: assuming that such people always have and always will exist in the world, is the tech community remiss in taking this into account? When we create a piece of hardware or software, do we need to ask the question, "what if someone with an 'LSD in the reservoir' mentality gets his hands on this?" In connecting the world via the Internet, we've also connected ourselves to every flavor of person we would rather avoid in real life. Does there need to be a shift in the way we view our responsibilities as tech authors/creators?

Re:Weak article

Does there need to be a shift in the way we view our responsibilities as tech authors/creators?

This is very much like the "security through obscurity" argument. In security it's always assumed that the bad guys know or can learn the algorithms, weaknesses, etc., everything but the key. In the case of technology such as phishing kits, there may be no reason for a legitimate developer to write such a thing, but there's nothing stopping an unethical person from writing one.

Don't get me wrong: training software engineers in ethics is a good thing. Professionals need to understand their responsibilities. But bad people can't be stopped from writing malicious software. The bar for writing software is already too low, and is getting lower by the day.

Re:

Dude, security through obscurity totally works. Have you ever talked to a woman? Best security EVER. No man has ANY idea what they're thinking. *amazing*.

Re:Weak article

Who you're dealing with is quite simple. A mix of people, as usual. You have the crowd that knows nothing, but wants a piece of the cake. They're mostly harmless. They buy some phishing kit and try to get a few bucks. Usually they're caught. They're much like the average bank robber that goes into a bank with a gun but without a plan.

Then you have the ones that want to try it just to see if they can. They're just as harmless. They just get your ID and then don't do anything about it. Except maybe bragging to their friends, which usually turns into them getting caught when one of their friends decides they don't want to be friends anymore.

And finally you have some well organized groups that actually cause the problem. And there you usually get to see the type of people that you expect from such groups. You have the ones that write the code, usually quite smart people who know their shit and who also get quite a bit of money for their work (I was honestly tempted to switch sides...). Imagine an unemployed top notch programmer in an east europe country and the chance to see 4-5 digits per month, and you know what I mean. Then you have the people who can provide the necessary "hardware", i.e. acquire servers and the necessary connections to keep them running for a few weeks. In smaller groups, this is often the same person who does the coding, but even in this shadow business you notice tendencies to 'outsource' work, i.e. buy kits or hire people to do the server shifting. These are usually not the people you will talk to, unless they have reason to contact you (i.e. when they consider you someone who can get them servers or provide code).

Then you have the people who hire the goons to grab the money and run, and fools with bank accounts. These are usually the ones you will talk to when they try to find someone gullible enough to provide their bank account for transfers. And finally you have the goons that go to Western Union to collect the loot. These are the ones you usually catch when you do a sting. They're much like the average street drug dealer, the lowest on the chain and the ones that are easy to replace. Usually some poor guy, homeless or asylum seeker, is hired for a few pennies to risk it.

So, in general, unless they have good reason to talk to you, you won't get to hear from anyone who is up far enough on the ladder to be interesting.

Re:Weak article

I'd like to disagree with you on this. There is a threshold involved, that of actually getting someone's fiscal data rather than their home address or telephone number or computer password, that automatically means they are beyond the normal "hacker" exploits. If all you want to do is look around, you can do it with a sense of self restraint that gets you people's personal email or passwords, not their money information.

I'm also afraid that bragging to their friends does not, in fact, usually get them caught. The number of hackers, crackers, phishers, and other people who poke around other's computers seems to consistently be much larger than the number arrested or even caught. Most companies don't bother to pursue such frauds: they just say "is it worth our time and money to track them down? will we get our money back, or will it stop the next round from trying the same stunt", decide it won't, and ignore it as a part of doing business.

Even getting the police involved against the worst crackers and phishers is difficult. Getting police to act across state lines, or worse international borders, is a nightmare of arcane turf wars among governmental security groups who frankly will not bother with small thefts. They can only be convinced to pursue it when the amount exceeds some threshold, which varies from agency to agency and from month to month, but a few thousand stolen from any individual is like losing your wallet on a bus. They just won't bother doing anything about it besides sending you a form letter to fill out, which is promptly ignored.

Re:

In connecting the world via the Internet, we've also connected ourselves to every flavor of person we would rather avoid in real life.

In a sense though, this is a good thing. I'm arguing that complete worldwide social cohesion is required before the world'

Re:

It begs the question, in dealing with the phishing community, who are we dealing with -- the uneducated, the merely poor, the greedy, the antisocial, or worse? Is the phishing community an outlet for the antisocial/maladjusted/borderline mentally ill?

Wow, doesn't sound that much different from the fishing community!

Back when Jeff Foxworthy came out, my cousins were listening to one of his routines. One of them goes "Holy shit, I have been too drunk to fish!"

To my cousins' credit, none of their cars ar

Re:

you missed what i thought was the most interesting point... phishers exploit blacklisted phishing lists because usually all the servers listed are unpatched and still vulnerable. sometimes there's multiple phishers using a box at once.

Re:

six pages has become the norm for a "spam the crap out of a popularinteview" hasn't it? Even if the interview is only 20 sentences, we can squeeze at least six sets of banner hits out of it cant we?

This one did better than most, I think we got at least te

You know what's next, don't you?

Nitesh Dhanjani and Billy Rios can expect any site they are associated with to be DDOSed in....

3..

2..

1.

Re:

Profit!!??!

And the news is...?

So they skimmed botnet servers, scammed scammers, talked with phishers and "infiltrated" their network and got a hand onto phishing kits. Ok. Various AV researchers have done so for at the very least a year now, many for over two years, full time, with a hand deeply in the whole process.

Should I write a book now or something?

Gaining such information is actually not that hard. Many have done that, but the majority so far had the brains to keep their mouth shut about it. First of all, nobody in that scene likes a loudmouth, it makes your work incredibly hard if you talk too much. And second, the last thing we need is more people trying to get into the "market".

But then, as we've read last week, you probably get a trojaned kit anyway. :)

Re:

So who shat on your cornflakes this morning, sunshine?

Re:

Self proclaimed experts in general.

Maybe I should just shut my mouth and even increase the mystique and magic that surrounds the "hackers", flash around my "security expert" tag and walk around like my farts don't stink, but bluntly, I get fed up by people

Re:

But then, as we've read last week, you probably get a trojaned kit anyway. :)

What - Sony are selling Phishing Kits now?

PhS3 anyone?

Re:

Slightly unfortunate you feel this way. The big wheel spinning is based on the sole fact that the more you perpetuate and stimulate, the more you get challenged. If we all stopped wanting to get involved and being fewer people as you say, then less and les

Re:

As with M$ vs. Linux, the only reason Linux isn't as vulnerable, is that it isn't as popular.

Hmmmm ..... and all this time, I thought that little, insignificant things like architecture & design might have at least *something* to do with it. Didn't r

Nothing new

So, what TFA is saying is that the phishing community is just another community of skiddies, just like the rest of the modern "hacker underground" or whatever you want to call it. This is news how?

Besides the obvious hacker/cracker naming issue, the fac

Re:

Oh, I'm fairly sure every 15 year old wants to be a "hacker". Hey, hackers are cool. Cooler than robots, zombies, pirates and ninjas combined. And even if not, tech ain't here yet to become a robot, it's not really fancy to be a zombie, pirates are outdate

The text (site has it spread of six damn pages)

"Both Nitesh and Billy are well-known security researchers that have recently managed to infiltrate the phishing underground. What started as a simple examination of phishing sites, turned into an extraordinary view of the ecosystem that supports the phishing effort that plagues modern day financial institutions and their customers.

They saw an extraordinary amount of sensitive customer account information, obtained the latest phishing kits, located and examined the tools used by phishers, trolled sites buying and selling identities, and even social engineered a few scammers.

In this interview, they expose the tactics and tools that phishers use, illustrate what happens when your confidential information gets stolen, discuss how phishers communicate and even how they phish each other.


What are phishing kits and how are they distributed?

Dhanjani: A phishing kit is the most important tool in a phisher's arsenal. Think of a popular company that executes financial transactions on the web. All the source code and static content such as images and logos needed to setup a phishing site for the company you just thought of is most likely to be present in a phishing kit. Let us suppose you get hold of such a kit and you want to deploy a phishing site. All you would have to do is the following: 1) Unzip the kit 2) Pick the directory corresponding the company you want to target 3) Edit a single file in the directory to input the email address you want the results emailed to 4) Deploy the directory onto a compromised host on the internet, and voila! - you have yourself a phishing site. If you take a look at the client side code (HTML and JavaScript) presented to your browser on a phishing site that targets a particular company, you will notice that other phishing sites that target the same company have similar characteristics. This is because, more often than not, the sites are deployed using popular phishing kits. The code within the kits is quite simple, mostly consisting of a web form that does the dirty work, along with image files and static content. The kits are often distributed amongst the phisher communities on message boards, and at times sold or traded for money or identities.

Rios: Phishing kits are the tip of the iceberg, they are the piece of the phishing eco system that everyone sees and knows about. The typical phishing kit consists of the HTML that makes up the forged site that the user sees and the backend logic that used to steal the victims information. Most phishing kits are probably created by a small number of individuals and typically sold on phishing forums. Although the various kits have different front ends and HTML content, the back end logic is surprisingly similar for most of the kits we've seen. These kits are used over and over again and most of the phishing sites you've seen are probably a variant of small set of phishing kits. Many think that phishing sites are all custom jobs that a particular phisher has developed and deployed. The reality is pre-made, ready-to-deploy, turnkey sites are already created for practically every major organization that you can think of. All a phisher has to do is purchase the latest kit and deploy, no technical expertise or coding skills are really required. All the phisher typically has to do is place their email address into one line of code and they have a ready to deploy phishing site.


Many have become victims of phishing and we see the attackers using new methods all the time. In your opinion, what is their skill level? Who are we dealing with?

Dhanjani: This is an important question, and I'm glad you asked it. When we think of phishers, we often guess that they are a group of highly skilled ninja hackers. They have collectively caused billions of dollars in losses, and ruined the lives of many citizens whose identities they have stolen and abused. These people have got to be pretty smart, right? Wrong. Just think about what a typical phisher is really doing: installing

Not Underground

The implication in the title is that these "security experts" actually got in with one of the rings. As a matter of fact, they simply downloaded a phishing kit and signed up for a forum. They didn't talk to anyone who wrote one (not that much skill is required in that). They didn't gain access to any dark-nets. They didn't gain access to secure IRC channels. In short, they're just a couple of guys. Their agenda seems clear to me: push the IE anti-phishing UI. They make reference to it (though not by name) twice in TFA:

...the(sic) are abusing a few fundamental flaws such as lack of awareness, lack of standards around browser UI that clearly highlights high assurance websites...

Instead we need to come up with browser UI standards that allow the users to clearly and easily distinguish high assurance domains and websites.

They also talk about the need for a system that works without static identifiers like credit card and social security numbers, though they don't postulate any such system. They claim that writing secure code is secondary to this as-yet unknown system that doesn't use personally identifiable information to identify you. My thoughts: until we figure out how to identify you without using identifiers, maybe we should concentrate on the secure code angle for a while.

Re:

Static security. Your pin number, id, password, bank bar code, address, birthday, employer, maiden name, SSN, drivers license number. Anything static does not get changed often enough, and people "courts" stupidly trust them as unique ID's. Which is why it

Re:

key sequence generators which use your initial pin to generate a new pin every few hours/mins/seconds

So if you learn the original PIN, you can calculate the current PIN at any later point in time. Besides, how do you actually use this to identify anyon

This is asinine

These idiots just set up a site and wrote a story about it. I've done more than this on a single weekend collecting data for LE Agencies or trainings I provide to Judges/Lawyers and Gov't IT Workers. Hell, I've set up a Linux VMware server that hosts all t

Re:

And then the use of the phrase "the Underground" is itself a joke. This implies that they try to hide their activities. What a joke! They operate out in the open, swapping and sharing information, harvesting data. The use of that term "The Underground" is

Real Security Threat: You

I was just reading an interview in either Inc. or Fast Company with the head of the research division inside one of the big anti-virus vendors. He said that most encryption and security issues have been solved. The real threat now is humans, meaning weakne

Re:

Yup. The weakest link in computer security is the user. Now, while in companies you might have some administrator who might or might not be actually security conscious and lock down user PCs (as far as he can, due to company policy and program requirements

Where's the FBI?

We pay the FBI a lot of money to infiltrate and bring to justice these organized criminal networks. But the FBI isn't bothering.

Of course, the banks are supposed to defend their trademarks from anyone, including phishers, who uses them to pretend to be the

Re:

The FBI is more interested in tracking down terrorists nowadays. Running down all those false leads from the illegal wiretaps really eats up man power. Aside from that, phishing often crosses national boundaries. Now you have to get cooperation from other

What?

So the phishers are trying to phish the phishers who are phishing for... what? (That's some quality writing, right there.)

Seriously, the article seems like something you'd see featured on the evening news as a scare tactic.

Reporter: Is your identity

Simple partial solution:

Make the browser highlight the domain part of the url in bold. Even if this helps just a few users recognize the scam easier it's worth it. Besides, it will somewhat improve usability for regular use as well. I often scan the URL line for to get an idea of what a tab displays, and this will save a few milliseconds of my brain time each time I do it.

Re:

"Make the browser highlight the domain part of the url in bold"

Anything that relies on the end user doing or not doing something is bound to fail. You're dealing with idiots that can't prevent themselves in clicking on anything. For instance click here

I have the solution to phishing

One time credit card numbers.

net banking that requires sms verification of transfers.

public, televised floggings for anyone convicted of fraud or petty theft.

only the banks can make these happen (including option 3 as well i might add, polical lobbying ftw). hell i know i'd tune into watch some scammers take a beating.

Re:

My bank already does this. Except instead of one time numbers I have credit card number which I can load with enough money to just buy something and then unload it so no one can take money from it without my consent. Sms verification is very convenient, it

Re:

"public, televised floggings for anyone convicted of fraud or petty theft."

Sure, allow the rich fuckers to get away with it, white collar criminals, corporate executives etc.

But as soon as a poor kid steals a chocolate bar, public floggings!

Because, rememb

Big deal, I did this too

I infiltrated a phish show once; other than a lot of hippies smoking dope and some weird meandering drone-rock, I'm not sure what the big deal was.

Fill their inbox with crap

So if these phishers are using low-tech stuff like Formmail, then you should just autofill their forms with randomly generated bogus personal information for hours on end. It would make it very hard to sort the legitimate data from the trash. Assuming of

I am _not_ reading that article...

...even though I want to. I read the first page, then saw that it is six full pages, with no Print function. Six pages with about 1:4 content:advertising space. No thanks. I hate C|Net for pioneering the ideas of a paragraph a page, and I won't read Phoron

Why not flood the phishing sites with bogus data

If you feed in enough bogus usernames and passwords, it becomes much harder for the phishers to tell the real ones from the fakes. If the phishers check by IP to prevent this, do it from many different machines with many different IP addresses.

the real story ..

"What started as a simple examination of phishing sites, turned into an extraordinary view of the ecosystem that supports the phishing effort [net-security.org] that plagues modern day financial institutions and their customers"

The real story is who built such an 'ecosyst

Re:

Some fake sites are smart enough to do a man in the middle attack. If your login to the real site fails, the error is bounced. I have seen this on several sites I have tried to poison.

I haven't tried entering real info, so I don't know if the site simply