Lunker : The Advanced Phishing Framework

1. Lunker: The Advanced Phishing Framework Joshua Perrymon CEO, PacketFocus

2. Agenda • Intro • What is Lunker? • What can it do? • Attack Theory • Payloads • The Old Way • Demo • Questions

3. Who am I? • Joshua Perrymon, CEO PacketFocus • 12 yrs Experience “Ethical Hacking” • Over 200 Spear-Phishing attacks in 4-5 languages • 85% Success ratio using “Blacklist” emails from the Internet • MUCH higher using “Whitelist” Emails

4. What is Phishing • Phishing is a method of Social Engineering used to gain credentials, or have users perform a specific action. • We have all gotten these types of emails. • Sent out to Millions • Usually triggers SPAM filtering alerts • Uses a known phishing site that is usually takes down within a couple days if possible

5. What is Spear Phishing • A directed Phishing Attack • Only targets a handful of users • Emails are harvested from the Internet or other public places • Very hard to stop as the attack isn’t sent out all over the Internet

6. Attacking up the OSI • We have been moving up the OSI (Open System Interconnection) model with attacks.

7. Attacking up the OSI model cont.

9. How these attacks work

10. Doing this the “OLD” Way • This takes time. But doesn’t require a lot of technical skills. • Find emails • Find site to be phished • Create the site • Setup php mail spoof • Test • Send • Monitor

11. Using the Phishing Framework • Easy and repeatable

12. PacketFocus.com 2008 - Jperrymon Step 1.

13. PacketFocus.com 2008 - Jperrymon Step 2: Enter Client Info

14. PacketFocus.com 2008 - Jperrymon Client Details • This is entered into the local database. This allows an audit trail of tests configuration and results. The idea is to document each step automatically, because no-one else wants to do it. • Enter URL and IP Info if provided

15. PacketFocus.com 2008 - Jperrymon Step3: Email Recon

16. PacketFocus.com 2008 - Jperrymon But everyone uses their company email address right???? • This is hard to protect against most times. Usually, internal email addresses must be used in business communication. This can be leaked to the Internet Search Engines. • Search “@acme.com” and look through the results.

17. PacketFocus.com 2008 - Jperrymon Step 4: Phishing Analysis

18. PacketFocus.com 2008 - Jperrymon On the lookout • This module will actively search the target URL’s and IP’s in scope to identify potential Phishing Targets. • Any site that requires credentials remotely should be considered and identified. • Top targets include Webmail, VPN, and website logins. • The tool will identify these portals and return analysis based on previous information gathered.

19. PacketFocus.com 2008 - Jperrymon Step5: Select the Bait

20. PacketFocus.com 2008 - Jperrymon Email is easy • Most often, a simple email from spoofed technical support will be enough to have a user form over login and password details. • Analysis will identify token passwords. Numeric entries should trigger token MITM functions. • Start analysis timers.

21. PacketFocus.com 2008 - Jperrymon Verify it works

22. PacketFocus.com 2008 - Jperrymon Now what? • Login to the Phishing site locally to make sure it captures the password. • It’s easy to email the credentials. Be responsible and store them encrypted. • Modules could auto login based on template used. Get email(), Get Attachment(), Get Keyword(), Get Subject().

23. PacketFocus.com 2008 - Jperrymon Redirect Confusion

24. PacketFocus.com 2008 - Jperrymon Where am I? • Redirection must be used after the user logs in the first time. Error message, Google, etc • Redirect to real site. • Delete email sent to user after getting credentials.

25. PacketFocus.com 2008 - Jperrymon Spoof the email

26. PacketFocus.com 2008 - Jperrymon Tony.. Tony Montana • Setup a spoofed email. • To goal is to have the user perform a pre-defined action. • Authority, realism, and language play a vital role in a successful attacks. • The key is gain trust as soon as possible. • NLP (Neuro-Linguistical Programming) • Milgram Experiment

27. PacketFocus.com 2008 - Jperrymon Select Footer

28. PacketFocus.com 2008 - Jperrymon Footer • If you want to write a custom body, select a footer template to give the attack structure.

29. PacketFocus.com 2008 - Jperrymon Scenario Options

30. PacketFocus.com 2008 - Jperrymon Pick one. • Pre-defined spoofed email scenarios are included with the framework. These are selected conversations that usually get the response desired based on actual field results. • Scenarios: • Tech Support • Internal IT • 3rd Party IT • End-User

31. PacketFocus.com 2008 - Jperrymon Stealthy

32. PacketFocus.com 2008 - Jperrymon Email Head • Sometimes you need to modify the email headers. • We will probably put something in here to identify the tool once it goes public.

33. PacketFocus.com 2008 - Jperrymon Load the Ammo

34. PacketFocus.com 2008 - Jperrymon Money Shot. • This is what makes the framework stand out. • The ability to add custom payloads to the phishing email. • XSS, Browser Exploit, Recon, Trojans, Exploits, Backdoors, etc.. • Welcome to hack 2.0

35. PacketFocus.com 2008 - Jperrymon Test Environment

36. PacketFocus.com 2008 - Jperrymon Test 1.2.3. • This module launches the local email client and the locally hosted phishing site at the same time. • The tester sends the spoofed email to a locally configured account. This account is checked by the Email Client as would a normal user. • Look for mistakes. The smallest error can cause the attack not to work.

37. Local Mode

38. PacketFocus.com 2008 - Jperrymon Start the Audit

39. PacketFocus.com 2008 - Jperrymon Just a little patience… • Monitor the web server, db, MTA, and monitor. • Setup MITM scripts to auto • Configure alarms and real-time logic. • Setup login options • Capture • Capture/Login • Capture/Login/Scrape

40. DEMO • Lets have a look at the current working version. • How to bypass Outlook 2007 Phishing filters.

41. PacketFocus.com 2008 - Jperrymon What's Next • MITM- 2nd Factor Authentication • Advanced Payloads • XSS • CRSF • Browser Exploits • Recon to determine user browser, OS, etc. • Reporting  • Forum Support • Template Sharing • Training Modules • User reaction analysis module • Ability to customize the Templates

42. Thank You • Thanks for sitting through this presentation. The main aspect to take away from this is how attacks are moving up the OSI model and targeting the user (layer 8). • It doesn’t take a lot of technical skills to perform these types of attacks. • User Awareness is the only way to mitigate this risk. We can’t rely on technology.