University:
Boston University
Course:
MET CS 201 | Introduction to Programming
Academic year:

2024
Views:

235

Pages:

19
Author:

verleiden2akd

Catching Transparent Phish: Analyzing and Detecting MITM Phishing Toolkits The Value of Stolen Data Phishing vs. Malware 2 Anatomy of a Traditional Phishing Attack • Attackers manually copy/recreate web content from target website • Phishing content served from attacker-owned web server • Or a compromised web server • Links to phishing webpages dispatched to victims through email or SMS 3 Limitations of Traditional Phishing • Implementation errors can lead to detection • Webpages update at increasing speeds • Detection by anti-phishing scanners leads to immediate blocklisting 4 Man-in-the-Middle (MITM) Phishing Toolkits • Malicious reverse proxy servers • Victims see live content from target website • Credentials stolen in transit • Popular MITM phishing toolkits today: • Evilginx • Muraena • Modlishka 5 MITM Phishing Toolkit Demo 6 MITM Phishing Toolkit Threat Model • Attackers control all application layer content • Cloaking restricts access to phishing content • Detection cannot rely on integrity of application layer content 7 MITM Phishing Toolkit Threat Model • Attackers control all application layer content • Cloaking restricts access to phishing content Fingerprint the server, not the content • Detection cannot rely on integrity of application layer content 8 Network-Level Phishing Detection • Network architecture can be leveraged to discover presence of toolkits • Network timing analysis • TLS ﬁngerprinting • Fingerprinting possible from both ends of the communication channel 9 Network Timing Analysis Direct Connection Connection Through Reverse Proxy Server 10 Network Timing Analysis HTTP HTTPS 11 TLS Fingerprinting • MITM phishing toolkits utilize unusual TLS stacks • TLS versions supported • TLS libraries1 12 MITM Phishing Toolkit Groundtruth • We are the ﬁrst to conduct a comprehensive study on MITM phishing toolkits • No groundtruth dataset on MITM phishing toolkit behavior • Collected network-level data from 30 globally-distributed nodes • Recorded all permutations of client → MITM phishing toolkit → webserver • 146,160 data points in total • Random forest classiﬁer • Achieved 99.9% accuracy and ﬁve-fold cross validation score of 99.9% 13 PHOCA: MITM Phishing Website Detector • Framework to collect network-level data on, and detect MITM phishing websites • Named after the Latin word for seal • Known to use vibrations in water to detect otherwise hidden prey 14 Phishing Website Crawling Infrastructure 15 Phishing Website Crawling Infrastructure 1. Candidate domains sourced from Certiﬁcate Transparency Logs and anti-phishing blocklists 16 Phishing Website Crawling Infrastructure 2. Scheduler module dispatches worker nodes to retrieve classiﬁcation from PHOCA, and screenshot/HTML code using Selenium 17 Phishing Website Crawling Infrastructure 3. Collected data fed into analysis module for further processing 18 Phishing Website Crawling Infrastructure 4. Recrawling module periodically revisits websites of interest 19