Spear Social Engineering - Part 2

Spear Social Engineering - Part 2

• Spear phishing is a targeted attack, not just sending spam emails.
• Spear phishing aims to compromise a target's computer and obtain their credentials to access important applications like banking portals, not just emails.
• Attackers use various methods beyond email, such as snail mail, phone calls, text messaging (e.g., Twitter, Facebook), instant messaging, watering hole websites, malicious websites, CB radio, walkie-talkies, and even carrier pigeons.
• While these methods might seem unusual, some companies use them for internal communication, making them appear trustworthy and vulnerable to attack.
• Social engineering tactics involve building trust with the target.

Spear Phishing Methods

• Email, snail mail, phone calls, text messaging, and instant messaging (Twitter, Facebook) are employed.
• Attackers may use watering hole websites, malicious websites, CB radio, walkie-talkies, Post-it notes, or even carrier pigeons.
• Email spear phishing is an effective tactic but not the only one.

Spear Phishing Goal

• The goal is to compromise the target computer and obtain credentials for important applications.
• Main exploitation methods include phishing websites to obtain credentials, client-side exploits, and custom Trojan backdoors.

Technical Spear Phishing Tactics

• Tactics apply to various exploitation methods, but attackers should avoid targeting too many people at once, as this could raise suspicion.

• They aim to have more interaction to build trust by interacting with the target under a false guise.

• This interaction builds on reconnaissance (gathering information about the target).

• Collecting as much technical and non-technical information about the target is vital.

Building the Story

• Craft a believable story to establish a rapport with the target.
• Ignore conventions; think outside the box when crafting stories.
• Determine the most impactful and accurate story for each target.

Examples of Effective Stories

• A partner, sister company, or parent company offering trial software
• An internal salesperson providing a free trial
• Inviting interest in a common hobby or interest group
• A product feedback request (e.g., software trial) for their industry.

Phishing Website Tactics

• The traditional method involves copying a legitimate website and directing the target to the fraudulent site.
• The fraudulent site should mimic the legitimate one, including triggers (e.g., legitimate look, feel, and functionality).
• Tools like the Social Engineering Toolkit (SET) Site Cloner automatically copy existing websites.
• Configuring the tool to harvest credentials is essential.
• Missing dependent files (like CSS or JavaScript) require checking and inclusion for a complete phishing website.
• Thorough testing (visual and functional) is critical.

Website Look and Feel

• The website must convincingly mimic the authentic website to avoid suspicion.
• Maintain familiar visual elements, down to the font, for maximum effect.
• Understand the target's expectations to create a believable and successful phishing operation.

Website: Domain Name Options

• Choose a domain name that won't raise immediate suspicion from the target.
• Create a new company or subtly alter an existing one's domain name (e.g., using a misspelling or adding extra characters).

Website: Domain Name Example

• If a target's domain is weaktarget.com, consider registering portal-weaktarget.com, benefit-weaktarget.com, login-weaktarget.com, or www-weaktarget.com.
• Register a domain name that is similar to the legitimate one (e.g., Softwarex0.com).

Phishing Website: Back-End Functionality

• Implement the proper features on the backend (e.g., user login forms).
• Select a suitable back-end language (e.g., PHP).
• Set up for user login (username and password fields; file storage for data).
• Credentials need storage in a file (e.g., .txt).
• Capture not just usernames and passwords but also IP addresses.
• Give users options after they log in.

Phishing Website: Back-End Functionality Alternatives

• Redirect users to a legitimate or "static" page on the attacker's website.
• Redirect users to a malware deployment page.
• Act as a proxy between the target and the genuine website, while logging all activity.

Phishing Website: Watering Holes

• Watering holes are common sites visited by a target user.
• Focus on building a site that targets the specific user's industry.
• The site gives users the illusion of a public or private forum to join.

Client-Side Exploit

• Attacks target vulnerabilities in endpoint software (like workstations).
• Popular software targets include office productivity suites, email clients, and multimedia software (e.g., Microsoft Word, Excel, Adobe Acrobat, browsers).

Custom Trojan Backdoor

• Custom Trojan backdoors are very efficient for deployment.
• The backdoor software can be bundled with pirated or trial software from legitimate vendors.
• Direct delivery to the target can be accomplished via websites, public file-sharing sites, or physical media (like CDs, USB drives).