Download to read offline
Phish Phry- Analysis paper
- 1. Vulnerability Analysis Paper1 PHISH PHRY Joydeep Banerjee, M.S. University of Illinois at Springfield Author Note Contact: Email-jbane2@uis.edu
- 2. Vulnerability Analysis Paper2 Table of Contents Preface................................................................................................................................ 3 Phishing.............................................................................................................................. 4 Introduction to Phishing............................................................................................. 4 Phishing Techniques .................................................................................................... 4 Case in Point: - Phish Phry ......................................................................................... 6 Modus Operandi .......................................................................................................... 6 Egypt Chapter.......................................................................................................... 6 United States Chapter............................................................................................. 6 Mitigation Techniques ................................................................................................. 6 Current Status of the Attack.................................................................................... 7 Word of Caution from Ground Zero...................................................................... 7 References.......................................................................................................................... 8 Acknowledgement............................................................................................................. 9
- 3. Vulnerability Analysis Paper3 Preface This analysis paper essentially covers the fundamentals of Phishing and the techniques employed for its accomplishment in real time scenarios. Phishing is one of the very common ways applied by the cyber criminals and hackers to bait the users into sharing confidential data and information. The data or information, so gathered, is used to perform nefarious activities often leading to huge financial loses, bankruptcy and identity theft. The paper also discusses on one of most notorious phishing scams of the decade Phish Phry which amounted to a loss of 1 million dollars and compromising confidential data of thousands of customers of two very reputed banks of the USA. The scam finally got busted in the year 2011 convicting 47 people in the federal court. Like many security experts of the world today, Dave Jevans, an industry expert, exclaimed, “As far as a dent in the number of phishers out there and the phishing gangs, it's probably not significant.”
- 4. Vulnerability Analysis Paper4 Phishing Introduction to Phishing Phishing is a kind of social engineering technique often used to steal personal and private information of users. The attacker masquerades as a popular or trusted or reputed entity or a person and tries to deceive the user by maintaining a very convincing approach. The hacker dupes a user into clicking on a link or press a button or open a certain webpage that leads to installation of malware or revelation of confidential data and information. Phishing Techniques Phishing can be accomplished using mediums like social websites, banks, email, messenger applications and auction websites. Mentioned below are a few techniques of performing a phishing attack: Email Email Phishing is one of the most common phishing techniques where the scammers broadcast the same email to millions of users. The users are usually asked to provide personal information and often their financial information as well. The scammers often create a sense of urgency or emergency in the minds of the users to persuade them to fill in the information. The gathered information is generally sold or used for nefarious activities. Link Manipulation Link Manipulation Phishing is a technique where a scammer sends or broadcasts a hyperlink to user(s) using instant messaging and manipulates them to click on that link. As the user opens the link, it directs him to a fake website which has a look and feel of an authentic website. The user might put in his credentials which in turn reaches the hands of the phishers. Web Based Delivery Web Based Delivery Phishing is a technique where a phisher plays as the man-in-the- middle between a website and the system. The phisher collects information passed on by the user keeping the user completely in the dark. Trojan horse Trojans are malwares that are installed in the users’ machines without their knowledge or consent to gather information from their machines.
- 5. Vulnerability Analysis Paper5 Key Loggers Key Loggers are also malware programs that records the keyboard inputs and sends the information to the phisher. The information then can be used to break passcodes or other confidential information. Session Hacking Session Hacking is a way where the hacker uses a sniffer to access information illegally from a webserver. Phone Phishing Phone phishing is a kind of phishing where the hacker calls the user over phone and asks for confidential information impersonating themselves as someone from a recognized organization like banks, credit card companies etc. Content Injection Content Injection is a type of phishing where the phisher doctors a page in an authentic website to deceive the users and lead them to fake pages where they are asked to enter confidential information. System Reconfiguration Hackers often message a user to change the settings of the computer. The message generally is sent from a web address that looks like an authentic site. Search Engine Phishing Search Engine is a technique where users are taken or lured to websites where products are sold at cheaper prices. These sites are used to gather credit card or net banking details of the users. Phishers have been attacking bank customers and online payment service users to usurp their financial information. Earlier the attacks used to be indiscriminate with a hope that few might fall for the trap. With the advent of sophisticated techniques like data mining and data analytics and illegal practices like insider trading and selling of data, attackers are now able to perform targeted phishing. The phishing mails are sent to classified, highly potential victims and the hit rate has increased considerably in the recent times. This has culminated to large scale identity thefts and huge financial losses like in one of the most notorious phishing cases of all times - Phish Phry.
- 6. Vulnerability Analysis Paper6 Case in Point: - Phish Phry Phish Phry is one of the largest phishing cases till date that has entailed almost 100 people charged in the US and Egypt. The criminals primarily targeted U.S. banks, namely Wells Fargo and Bank of America, and as many as thousands of customers by stealing and misusing their financial data and confidential information to transfer almost $1.5 million to their own fake accounts. The fraudsters are indicted for computer fraud, identity theft, conspiracy to commit bank fraud and money laundering. Modus Operandi Attackers or Phishers used to contact the customers by sending them fake emails that seemed like official ones from banks or credit card companies. The emails then used to take the victims to fake websites with a real look and feel. The users then would enter account details, passcodes and confidential identification information. Egypt Chapter In Egypt the financial information collected from the fake website were used to hack into the bank accounts. Then, the hackers and their handlers used to inform their counterparts in U.S. through text messages or phone calls or online messengers. The U.S. handlers would then facilitate the transferring of the money from the victims’ accounts to the freshly created fake accounts. United States Chapter The U.S. chapter of the scam was looked after by: 1. Nichole Michelle Merzi, 25, of Oceanside, CA; 2. Kenneth Joseph Lucas, 26, of Los Angeles, CA; and 3. Jonathan Preston Clark, 26, of Los Angeles, CA. These 3 scamsters ordered recruitments to open bank accounts to transfer the stolen money. Then an agreed portion of the money used to be withdrawn and wired to the Egyptian handlers. Mitigation Techniques Phishing attack Phish Phry could have been detected and neutralized had the affected users performed the following preventive actions : Using caution when checking emails or clicking any link in the email without verifying the authenticity of the source. Never falling prey to the scare tactics or sense of urgency created by attackers to get confidential or private information
- 7. Vulnerability Analysis Paper7 Setting Spam filters to high will keep the inbox free from spam mailers Using right anti-virus program will help in detecting and neutralizing the unwanted programs or viruses or malwares Checking website URLs carefully to avoid visiting look-alike spoofed versions of websites with almost similar URLs Avoiding to chat with any stranger over internet and giving out any private information or changing any privacy settings on being asked or advised Raising awareness and educating peers to maintain precaution as stated above. Current Status of the Attack The attack has been contained and the customers are compensated by both the banks for the loses. Both Wells Fargo and Bank of America have increased their awareness campaigns and customer education in a bid to combat phishing practices. Wells Fargo has an emergency dial and mail address to report suspicious mails or messages. Bank of America, too, has an emergency mail address to flag phishing attempts. Efforts are on in full swing to educate the customers but at the end of the day it’s the customers whose caution can save themselves from being victimized. Word of Caution from Ground Zero “Cybercrime might not seem real until it hits you,” Mueller said. “But every personal, academic, corporate, and government network plays a role in national security.” The Bureau wants the law enforcement and intelligence agencies to work hand-in-hand to fight against cybercrimes like phishing. Even though the government is working hard to keep high standards and building partnerships, Mueller added, “we are still outnumbered by cyber criminals.” His piece of advice for the users using smart devices to use firewalls, antiviruses and maintain a strong password policy or practice. “We all have a responsibility to protect the infrastructure that protects the world,” Mueller said.
- 8. Vulnerability Analysis Paper8 References 1. http://searchsecurity.techtarget.com/definition/Operation-Phish-Phry 2. http://www.computerworld.com/article/2528769/cybercrime-hacking/operation- phish-phry-hooks-100-in-u-s--and-egypt.html 3. https://archives.fbi.gov/archives/news/stories/2009/october/phishphry_100709 4. http://www.phishing.org/phishing-techniques/ 5. http://www.forbes.com/sites/billsinger/2012/05/15/feds-catch-their-illegal-limit- in-operation-phish-phry/#140d6e02411a 6. https://en.wikipedia.org/wiki/Phishing 7. https://www.wellsfargo.com/privacy-security/fraud/report/phish/ 8. https://www.bankofamerica.com/privacy/report-suspicious-email.go
- 9. Vulnerability Analysis Paper9 Acknowledgement Before I conclude I would like to take this opportunity to express my sincere gratitude to the Department of Computer Science, University of Illinois at Springfield, for providing me the scope to engage myself into research based learning. I owe my deep regards to Professor Mark Huson for being the guide and the torchbearer during the course of writing this paper. I thank my family and my God for being a constant source of inspiration for me. I hope I have been able to deliver to the best of my abilities to prepare this paper in its present shape. Thank you so much. Cheers!