Recommended
More Related Content
Similar to A Night of Phishing @ IUPUI Cyber Security Club
Similar to A Night of Phishing @ IUPUI Cyber Security Club (20)
More from Curtis Brazzell
Recently uploaded
Recently uploaded (20)
A Night of Phishing @ IUPUI Cyber Security Club
- 1. Phishing IUPUI Cyber Security Club Curtis Brazzell Principal Security Consultant
- 2. THREAT HUNTING AND RESPONSE | SECURITY CONSULTING CONTENTS Introduction Phishing vs Spear-phishing Reconnaissance Statistics Campaign Creation Techniques Demo? Q & A
- 3. THREAT HUNTING AND RESPONSE | SECURITY CONSULTING 01 | INTRODUCTION
- 4. THREAT HUNTING AND RESPONSE | SECURITY CONSULTING PHISHING INTRO » Purpose • Security Awareness • NOT for Humiliation » Phishing vs Spear-Phishing • KnowBe4, etc » Lateral » Under the Umbrella of Social Engineering
- 5. THREAT HUNTING AND RESPONSE | SECURITY CONSULTING 02 | PHISHING VS SPEAR-PHISHING
- 6. THREAT HUNTING AND RESPONSE | SECURITY CONSULTING » Phishing • Casts a Wide Net • Not as Effective • lack of personalization / too generic • spam filters • poor grammar • 1% of 1,000 is still 10 • Scams and Spams • Scripted and Automated » Spear-phishing • Targeted Attacks • Mission / Objective Based • Highly Effective • Takes Time / Not Easily Automated PHISHING vs SPEAR- PHISHING
- 7. THREAT HUNTING AND RESPONSE | SECURITY CONSULTING 03 | RECONNAISSANCE
- 8. THREAT HUNTING AND RESPONSE | SECURITY CONSULTING OSINT RECONNAISSANCE » What is OSINT? » Doing Our Homework (sorry) » Targets • Organizations • Individuals
- 9. THREAT HUNTING AND RESPONSE | SECURITY CONSULTING ORGANIZATIONS RECON - OSINT » Subdomains / Attack Surface • Mail Server • Remote Access (MFA?) • Citrix / TeamViewer / Logmein / VMWare Horizon, etc • VPN • Careers Portal • Contact Us • Wappalyzer • OS Fingerprinting » Information Disclosure • Google Dorking (Files, Dir Listing, Exposed Portals) • Configuration Mistakes » Vulnerabilities (Legitimate URLs) • Cross-Site Scripting (XSS) • Content Modification (iframes) • Redirects • Form Jacking • Session Hijacking • Click Jacking • Open Redirects • Unrestricted File Uploads » URL Encoding Techniques / Obfuscation
- 10. THREAT HUNTING AND RESPONSE | SECURITY CONSULTING ORGANIZATIONS RECON - OSINT » Tools • Passive vs Active Enumeration • Active - MailSniper - Application Vuln Scanners (Burp Suite, ZAP, etc) - Network Vuln Scanners (Nessus, Nexpose, Qualys, OpenVAS, etc) • Passive - Shodan - Discover - Dnstwist - Amass - Dnsdumpster - Prowl
- 11. THREAT HUNTING AND RESPONSE | SECURITY CONSULTING INDIVIDUALS RECON - OSINT » Breach Lists • HIBP / Paste sites • Shared Creds • SSO » About Us » Google » LinkedIn » Tools (Limited List) • LinkedINT • Recon-ng • theHarvester • Maltego
- 12. THREAT HUNTING AND RESPONSE | SECURITY CONSULTING » Spear-phishing (Targeted) • Information Gathering • Company’s “About Us” Page PONDURANC E 12 INDIVIDUALS RECON - OSINT
- 13. THREAT HUNTING AND RESPONSE | SECURITY CONSULTING » Spear-phishing (Targeted) • Information Gathering • Social Media (Linked-In, etc) PONDURANC E 13 INDIVIDUALS RECON - OSINT
- 14. THREAT HUNTING AND RESPONSE | SECURITY CONSULTING » Spear-phishing (Targeted) • Information Gathering • Recon-ng PONDURANC E 14 INDIVIDUALS RECON - OSINT
- 15. THREAT HUNTING AND RESPONSE | SECURITY CONSULTING » Spear-phishing (Targeted) • Information Gathering • Breach Lists PONDURANC E 15 INDIVIDUALS RECON - OSINT
- 16. THREAT HUNTING AND RESPONSE | SECURITY CONSULTING » Spear-phishing (Targeted) • Information Gathering • Maltego PONDURANC E 16 INDIVIDUALS RECON - OSINT
- 17. THREAT HUNTING AND RESPONSE | SECURITY CONSULTING » Non-Targeted • Information Gathering • TheHarvester PONDURANC E 17 INDIVIDUALS RECON - OSINT
- 18. THREAT HUNTING AND RESPONSE | SECURITY CONSULTING 04 | STATISTICS
- 19. THREAT HUNTING AND RESPONSE | SECURITY CONSULTING TRACKING STATISTICS » Ties Back to Purpose - Reporting » Opened Emails • 1x1 Pixel Image <IMG SRC="https://DOMAIN.com/campaigns?target=EMAIL@RECIPIENT.COM&camp aignname=ITCAMPAIGN" height="1" width="1">
- 20. THREAT HUNTING AND RESPONSE | SECURITY CONSULTING TRACKING STATISTICS » Link Clicks • Landing Page Requests • BeEF Hooking • Google Analytics, etc
- 21. THREAT HUNTING AND RESPONSE | SECURITY CONSULTING TRACKING STATISTICS » Captured Credentials • Password Strength • Password Uniqueness • HIBP • Internal » Compromised Hosts
- 22. THREAT HUNTING AND RESPONSE | SECURITY CONSULTING 05 | CAMPAIGN CREATION
- 23. THREAT HUNTING AND RESPONSE | SECURITY CONSULTING BELIEVABILITY » How to create a convincing email? • Choose a scenario • Work from Home • Employee Gift Card Raffle • Management Request • IT Department • PhishAPI has a re-usable repository • Will be community driven soon PONDURANC E 23
- 24. THREAT HUNTING AND RESPONSE | SECURITY CONSULTING BELIEVABILITY CAMPAIGN CREATION » Customized • TO field instead of BCC • Match formatting of body and writing style • Grab an email signature • Sales Reps • Customer Support • Job Application • Create your own w/ Logo
- 25. THREAT HUNTING AND RESPONSE | SECURITY CONSULTING BELIEVABILITY CAMPAIGN CREATION » Exploit Relationships Between Employees • HR • IT • Hierarchy of Seniority » Social Tactics • Scare • Urgent • Context • Calendar Events • Ticketing Portals / Help Desk
- 26. THREAT HUNTING AND RESPONSE | SECURITY CONSULTING • Spoof the Sender PONDURANC E 26 BELIEVABILITY
- 27. THREAT HUNTING AND RESPONSE | SECURITY CONSULTINGPONDURANC E 27 • Spoof the Sender BELIEVABILITY
- 28. THREAT HUNTING AND RESPONSE | SECURITY CONSULTINGPONDURANC E 28 • Spoof the Sender BELIEVABILITY
- 29. THREAT HUNTING AND RESPONSE | SECURITY CONSULTINGPONDURANC E 29 • If spoofing isn’t an option, create similar domain BELIEVABILITY
- 30. THREAT HUNTING AND RESPONSE | SECURITY CONSULTING OBJECTIVES CAMPAIGN CREATION » Credentials • Fake Landing Pages (New Citrix Login, Finance Page, etc) • Existing Cloned Pages w/ Company Logo • OWA / VPN / Remote Admin Portals » Malicious Documents (maldocs) • Hashes • Macros • Credentials » Malware • Trojans, Keyloggers, Ransomware, etc
- 31. THREAT HUNTING AND RESPONSE | SECURITY CONSULTING CREDENTIALS CAMPAIGN CREATION » Components • Keep Independent • Front-end • Static Web Page - GitHub Pages - Google Sites - EC2 • Submits Critical Info (Project, Target, etc) • Back-end • Receives Requests • Processes Results • Alert Capability - Necessary for MFA tokens - Time is critical for account takeover, especially when suspicious » Cloning Tools • Social Engineering Toolkit (SET) • PhishAPI • Manual • Browser Tools • Backend
- 32. THREAT HUNTING AND RESPONSE | SECURITY CONSULTING CREDENTIALS CAMPAIGN CREATION » Exploit User’s Misunderstanding of Security • Subdomains • secure-iupui.edu VS secure.iupui.edu • HTTPS • LetsEncrypt • Mention “Security” in the body • Disable “Protected View” • Double security banners (lol) • Hash Stealing in email (“But I didn’t open it!”) • BeEF Hooking (“But I didn’t enter my credentials!”) • Failure to Properly Terminate Sessions / Persistence
- 33. THREAT HUNTING AND RESPONSE | SECURITY CONSULTING CREDENTIALS CAMPAIGN CREATION » Tools for Capturing Credentials (Limited List) • Phishery • Plaintext Creds via Basic Auth • Evilnginx • Session Tokens via Transparent Proxy • Modlishka • Session Tokens via Transparent Proxy • PhishAPI • Plaintext Creds with Real-time Alerting (+ Basic Auth and Hashes) • Old School (netcat, verbose python simple web server, etc) » Once Captured • Use Domain / SSO Creds to Log Into External Services (Email, VPN) • Reset Passwords for Third Party Sites (MFA Services, etc) • Search keywords in inboxes (“password”, “vault”, etc) • Check Cloud Storage for Goodies (OneDrive if O365 / Google Drive, etc) • Phish Laterally • Inbox Rules - Delete Replies, Password Reset Emails / Sent Messages - Alert on keywords
- 34. THREAT HUNTING AND RESPONSE | SECURITY CONSULTING MALDOCS CAMPAIGN CREATION » Examples • PDF Adobe Reader Zero Day • Weaponized MS Office Documents • Macros • Basic Auth Requests - Captured Plaintext Credentials • SMB / UNC Requests - Hash Disclosure • Other Techniques - DDE - Protected View Bypass - HTTP Calls (Information Disclosure)
- 35. THREAT HUNTING AND RESPONSE | SECURITY CONSULTING MALWARE CAMPAIGN CREATION » Traditional Malware » Compromise of Internal Environment » Leverage Cloud Storage • OneDrive Sharing • Google Drive Sharing » More Easily Detected » File Type Blocking
- 36. THREAT HUNTING AND RESPONSE | SECURITY CONSULTING 06 | TECHNIQUES
- 37. THREAT HUNTING AND RESPONSE | SECURITY CONSULTING TECHNIQUES » Phish early or late in the day » Calendar invites » MFA bypass » SIM swapping » Hashes in email body » Check Out of Office in O365 » Establish persistence • Log in with multiple sessions • Try credentials on other services » Use valid creds to export GAL or phish laterally » Look for patterns • Password length / requirements • Repeated default passwords • Season + Year
- 38. THREAT HUNTING AND RESPONSE | SECURITY CONSULTING 07 | DEMO?
- 39. QUESTIONS? THANK YOU! THREAT HUNTING AND RESPONSE | SECURITY CONSULTING