10th annual nku cyber security symposium: phishing forensics - is it just suspicious or is it...
TRANSCRIPT
Phishing ForensicsIs it just suspicious or is it malicious?
October 13, 2017
Matt Scheurer
@c3rkah
Slides:
https://www.slideshare.net/cerkah
About Me
Matt Scheurer
Systems Security Engineer with First Financial BankMeeting Organizer for the CiNPA Security SIG
DerbyCon 5.0 & 7.0 SpeakerCertifications: CompTIA Security+, MCP, MCPS,
MCTS, MCSA, and MCITP
Yes, I have a day job. However...Yes, I have a day job. However...
Opinions expressed are solely my own and do not express the views or opinions of my employer.
Legal DisclaimerLegal Disclaimer
The material presented is made available for informational and educational purposes only. Use of these tools and techniques is at your own risk! The presenter hereby disclaims any and all liability to any party for any direct, indirect, implied, punitive, special, incidental or other consequential damages arising directly or indirectly from any use of these materials, which are provided as is, and without warranties.
Let’s BeginLet’s Begin
● Situation: You or a coworker receive a suspicious email, or a ticket comes in from another employee seeking guidance concerning a suspicious email
● The email looks like it could possibly be legitimate
● Nowadays it’s getting very hard to tell…● Lets start by looking at the message headers
Viewing Email Headers - OutlookViewing Email Headers - Outlook
● Option 1– Click on the expander
icon to the right of the “Tags” ribbon
Viewing Email Headers - OutlookViewing Email Headers - Outlook
● Option 2, Step 1– Click on the “File”
menu
Viewing Email Headers - OutlookViewing Email Headers - Outlook
● Option 2, Step 2– Click on the
“Properties” button
Viewing Email Headers - OutlookViewing Email Headers - Outlook
● Message Headers appear at the bottom of the Properties window
Viewing Headers ContinuedViewing Headers Continued
● In Mozilla Thunderbird– Options > View > Headers > All
– More > View Source
● In other email clients– https://mxtoolbox.com/Public/Content/EmailHeaders/
Viewing Message Source - OutlookViewing Message Source - Outlook
● Right click in the message body whitespace, and select “View Source” if available
● NOTE: Sometimes this functionality is disabled by JavaScript
Viewing Message Source - OutlookViewing Message Source - Outlook
● Option 2, Step 1● Click on the “Actions”
menu
Viewing Message Source - OutlookViewing Message Source - Outlook
● Option 2, Step 2● Expand the “Other
Actions” menu
Viewing Message Source - OutlookViewing Message Source - Outlook
● Option 2, Step 3● Select “View Source”
Next Steps (Demo)Next Steps (Demo)
● Inspect the email message headers for clues● Inspect the email message source code for
clues and traps● Inspect any attachment(s) for more potential
traps
Tools to useTools to use
● URL Expander● Online web page scanner (VirusTotal.com)● Attachment to image file converter● Web site Screen Shot generator● Online web site source code viewer● WHOIS engines / Abuse contacts
URL ExpanderURL Expander
● Search Engine Query– URL Expander
● www.checkshorturl.com
● Short URL:http://bit.ly/2yhmFOU
● Long URL:http://ricetillicolla.com/id150319942000/information/customer_center/cus tomer-IDPP00C475/myaccount/settings/
Online web page scannerOnline web page scanner
● http://www.virustotal.com/
● Tests with a large number of scanners simultaneously
● Now owned and operated by Google
● Scans files as well as web site addresses for malware
Attachment to image file converterAttachment to image file converter
● Search Engine Query
● Native Extension to Image File Extension
● i.e., pdf2jpg.net
Web site screen shot generatorWeb site screen shot generator
● Search Engine Query
● online website screenshot generator
● i.e., screenshotmachine.com
Web site source code viewerWeb site source code viewer
● Search Engine Query
● online website source code viewer
● i.e., www.visiospark.com
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
<title>PayPal Safety & Security </title>
<link rel="shortcut icon" type="image/x-icon" href="../../lib/img/favicon.ico">
<link rel="apple-touch-icon" href="../../lib/img/apple-touch-icon.png">
<meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-scale=1, user-scalable=yes">
<!---------------------------- FONTS ROBOT CONDDENSED ----------------------------->
<link href="https://fonts.googleapis.com/css?family=Roboto+Condensed" rel="stylesheet">
<!------------------------------- FILES CSS STYLE --------------------------------->
<link rel="stylesheet" href="../../lib/css/G-Z118.css">
</style>
WHOIS engines / Abuse contactsWHOIS engines / Abuse contacts
● Domain WHOIS– ICANN (https://whois.icann.org/en/)
● Regional Internet Registries, WHOIS– AFRINIC
– ARIN
– APNIC
– LACNIC
– RIPE
Additional Tools and ResourcesAdditional Tools and Resources
● DNS Records● NSLOOKUP● DIG● Web sites (domaintools.com, network-
tools.com, etc.)● Mxtoolbox.com (Blacklists)● SpamCop.net
Beware of Gotcha’sBeware of Gotcha’s
● Obfuscation by URL Shortener● Evasion Code / DGA● iFrames● Redirects and Forwards● Relying too heavily on your defenses / tools...
Jotti Malware Scan - messageJotti Malware Scan - message
VirusTotal Scan - messageVirusTotal Scan - message
Jotti Malware Scan - attachmentJotti Malware Scan - attachment
VirusTotal Scan - attachmentVirusTotal Scan - attachment
This technique now has a nameThis technique now has a name
● Crane Hassold, Senior Security Threat Researcher at PhishLabs referred to this technique in a recent Webinar as “Docuphish”
ImpactImpact
● This attack technique is highly effective at defeating our best-in-class security products and best practices to reach Inboxes across the enterprise– Including
● Defense-In-Depth● AV / Anti-Malware● Firewalls / Secure email gateways● Inline URL Sandboxing
The End GameThe End Game
● Determining what and/or where the final landing page actually is!
PreventionPrevention
● The only foolproof solutions to the Docuphish problem I am aware of are– 100% pure email sandboxing
– Completely stripping out all email attachments
● However, the appetite to do so at most organizations is low
ConclusionsConclusions
● Block discovered bad domains and IP addresses
● User education and reporting will remain key until vendors catch back up to to combat the growing Docuphish threat
● Report these incidents to the managing hosting company or service provider
● Utilize RBL’s and Threat Feeds
● In lieu of being able to prevent this from coming in, analyze what is going out of your network
When all else failsWhen all else fails
● Contact the purported message sender to find out about the message’s authenticity
– Phone call
– In person visit, if possible
– Instant message
– Email directly to the person● BEWARE: If the other person’s email has been
compromised, it will be difficult to tell if it is really them replying back to you!
QuestionsQuestions
Who ...
What ...
When ...
Where ...
Why ...
How ...
Thank you for attending!
October 13, 2017
Matt Scheurer
@c3rkah
Slides:
https://www.slideshare.net/cerkah