Phishing

Learn what phishing is and why it is important to red team engagement.

Intro to Phishing

Social engineering is the psychological manipulation of people into performing or divulging information by exploiting weaknesses in human nature. Phishing is a form of social engineering delivered via email to trick someone into revealing personal information, credentials or executing malicious code on their computer.

The type of phishing a red team would participate in is "spear-phishing". This is when an individual, business or organisation is specifically targeted, rather than targeting anyone as mass. Other common methods of phishing include smishing (SMS phishing) or vishing (phone call phishing).

Writing Convincing Phishing Emails

When sending a phishing email, you will have 3 things to work with:

The Senders Address: ideally, this should come from a domain name which spoofs a significant brand, known contact, or coworker. To find out which brands people interact with, you can use OSINT techniques such as:

• Observing a social media account for brands/friends they communicate with

• Searching Google for the victims name and a rough location for any reviews they may have left on local businesses or brands

• Checking the business website to find suppliers

• Looking at LinkedIn to find coworkers of the victim

The Subject: the subject line should be something rather urgent, or should pique the victims curiosity to get them to act quickly:

• Your Account has been Compromised!

• Your Package has been Dispatched!

• Staff Payroll Info (Do Not Forward!)

• Your Photos Have Been Published!

The Content: if impersonating a brand or supplier, it would be good to research their standard email template or branding to make your content appear the same as theirs. If impersonating a coworker or colleague, you could contact them first to see if they have branding or a particular email signature you could copy.

If a spoof site is being used, then it should be disguised with anchor text which reads "Click here!" or similar.

Phishing Infrastructure

For a successful attack, a certain amount of infrastructure will need to be in place:

• Domain Name: register an authentic looking domain name or one which mimics the identity of another.

• SSL/TLS Certificates: creating these adds authenticity to the attack.

• Email Server/Account: an email server will need to be setup or registered with a SMTP provider.

• DNS Records: setting up DNS records like SPF, DKIM or DMARC will improve deliverability of emails and ensure they avoid the spam folder.

• Web Server: webservers will need to be set up or web hosting purchased to host the websites. Adding SSL/TLS to websites will add authenticity.

• Analytics: keeping track of analytics is important. Something will be required to track emails sent, emails opened or emails clicked. This will need to be combined with info on which users entered personal info into the website or downloaded software from it.

Droppers

Droppers are typically non-malicious software that a user is tricked into downloading and running on their system. They normally advertise themselves as something useful or legitimate. Once a dropper is installed, it will unpack or download malware from a server to install.

Choosing a Phishing Domain

Some methods for choosing a domain to give you an edge are:

• Expired Domains: buying a domain with history behind it may lead to better scoring when it comes to spam filtering. Spam filters tend to distrust brand new domains.

• Typosquatting: this is when a registered domain is very similar to a target domain e.g. goggle[.]com or googles[.]com.

• TLD Alternatives: a TLD is the .com or .net part of a domain, there are hundreds of TLDs available, for example, you could try to use example[.]co[.]uk instead of example[.]com.

• IDN Homograph Attack: internationalised domain name allows domains to support specific languages or script like Arabic, Chinese, Cyrillic etc. However, this creates issues, for example, the Unicode character U+0430 (Cyrillic small 'a') is identical to U+0061 (Latin small 'a'), and so you could register a domain practically identical to another.

MS Office in Phishing

Often, a MS Office document will be included as an attachment. Office documents can contain macros, which have a legitimate use but can also be used to run commands which can cause malware to be installed on the victims computer.

Browser Exploits

Browser exploits are when there is a vulnerability against a browser itself, allowing an attacker to run remote commands on a victims computer. This is not a common path to follow unless there is prior knowledge of old technology being used on-site.