University:
Boston University
Course:
MET CS 201 | Introduction to Programming
Academic year:

2021
Views:

462

Pages:

14
Author:

Ireland Peters

MITM Phishing Toolkit Classiﬁer • Trained random forest classiﬁer on data from real websites and MITM phishing toolkits • Achieved 99.9% accuracy and ﬁve-fold cross validation score of 99.9% PHOCA Demo MITM Phishing Toolkits on the Web • Data collection period from March 25th, 2020 to March 25th, 2021 • 841,711 web pages analyzed • 1,220 MITM phishing toolkits identiﬁed MITM Phishing Website Targets MITM Phishing Domain Types MITM Phishing Website Lifecycle MITM Phishing Website Lifecycle MITM phishing use freshly registered domains MITM Phishing Website Lifecycle MITM phishing websites are weaponized immediately after TLS certiﬁcate creation MITM Phishing Website Lifecycle 20% of MITM phishing websites remain active for longer than 10 days MITM Phishing Website Lifecycle 43.7% of domains and 18.9% of IP addresses appear on blocklists Case Study: Palo Alto Networks • 56.7% of MITM phishing domains labeled as malicious by PAN in-line scanners • 15.1% received label at least one week after our initial discovery • 6,403 customer requests directed towards 260 phishing websites over six months • Originating from 368 distinct ﬁrewall devices Server-side TLS Fingerprinting • MITM phishing toolkits do not utilize common web client TLS stacks • Forwarded HTTP User-Agent strings do not match TLS ﬁngerprints • JA3 TLS ﬁngerprinting1 utilized to identify unique TLS implementations • Purchased 13,000 advertising impressions from a popular advertising service • Collected 163 unique TLS ﬁngerprints from 4,311 distinct HTTP User-Agents • TLS ﬁngerprints of MITM phishing toolkits unique in this dataset Countermeasures • Users: • Analyze the primary domain of any suspicious URL encountered • Use U2F to secure online accounts • Online Services/Anti-phishing Entities: • Look for discrepancies in client TLS ﬁngerprints • Utilize network-level detection techniques when searching for phishing websites Conclusion • MITM phishing toolkits allow attackers to launch highly eﬀective phishing attacks • Unique architecture allows for ﬁngerprinting at the network layer • We found 1,220 MITM phishing toolkits operating in the wild, targeting real users • Anti-phishing ecosystem does not eﬀectively capture MITM phishing toolkits