Phishing A practical case study. What is phishing? Phishing involves fraudulently acquiring...

PhishingA practical case study

What is phishing?

• Phishing involves fraudulently acquiring sensitive information (e.g. passwords, credit card details etc) by masquerading as a trusted entity.

The sites

• www.noodlebank.com (i.e NOODLEBANK.com)

• www.nood1ebank.com (i.e NOOD1EBANK.com)

The real site

The spoofed email

The spoofing

• The link appears as

www.noodlebank.com (i.e NOODLEBANK.com)

• But actually it links to

www.nood1ebank.com (i.e NOOD1EBANK.com)

The fake site

The “steal”

• When Debasis entered his username-password at the spoofed website, the username-password was sent across to the criminal carrying out the phishing attack.

• In this case study the username-password is sent across to a spamavert email address so that it can be seen by everyone trying out this case study.

More examples…

• In this case study, the user was enticed with a misleading URL. Such urls can be created easily using simple html code such as:

<a href=http://www.nood1ebank.com>http://www.noodlebank.com</a>

• This link displays the correct url but on clicking takes the user to the spoofed url.

Using a url with an ip address

http://www.NOODLEBANK.com@67.19.217.53

• This url does not lead to noodlebank.com, it leads to the website on the IP address 67.19.217.53

Using a split domain name

http://www.NOODLEBANK.com.securitycheck.secure-login.nood1ebank.com/login.asp

• This url does not lead to noodlebank.com, it leads to the spoofed website.

Using an obfuscated url

http://www.NOODLEBANK.com%00@%36%37%2e%31%39%2e%32%31%37%2e%35%33

• This url does not lead to noodlebank.com, it leads to the website on the IP address 67.19.217.53

Hex to ASCII converter

http://www.dolcevie.com/js/converter.html

Useful urls

• To try out the genuine website:http://www.noodlebank.com

• To try out the spoofed website:http://www.nood1ebank.com

• To see the usernames-passwords being “stolen”http://spamavert.com/mail.php?alias=noodlebank_com

Questions?

Phishing A practical case study. What is phishing? Phishing involves fraudulently acquiring...

Documents

Transcript of Phishing A practical case study. What is phishing? Phishing involves fraudulently acquiring...

Maria fraudulently collect child support

1/28/2010 Network Plus Security Review Identify and Describe Security Risks People –Phishing –Passwords Transmissions –Man in middle –Packet sniffing.

AN E MULTILEVEL AUTHENTICATION SCHEME ......An enhanced multilevel authentication scheme using graphical passwords focuses on solving the problem of phishing using Visual Cryptography.

Passwords, Passwords and more Passwords

Detecting a Phishing Attack with Phishing Intelligence ... · Detecting a Phishing Attack with Phishing Intelligence Engine (PIE) 1 Phishing Statistics: What Every Business Needs

Cyber Incident Response · Phishing is the act of attempting to acquire information such as usernames, passwords and credit card details by masquerading as a trustworthy entity in

Universal Second Factor authentication or why 2FA today is … · 2018. 2. 22. · Why not just passwords? Weak Reuse Phishing pwned Typical passwords life cycle SOLUTION! Two Factor

Judgments Fraudulently Obtained: The Forgotten · PDF fileJudgments Fraudulently Obtained: The Forgotten Equity ... from using the advantage he has there gained.6 Equity's jurisdiction

PHISHING By, Himanshu Mishra Parrag Mehta. OUTLINE What is Phishing ? Phishing Techniques Message Delivery Effects of Phishing Anti-Phishing Techniques.

FRAUD FORCE SUMMIT Portland, 2016...Research IP & Operations Designs Financials METHOD POS > Install Malware SQL Injection MIM Elevated Privelege Passwords & Honeypots Spear Phishing

CS 378 - Network Security and Privacy - Welcome to SCONCEsconce.ics.uci.edu/203-W17/phishing-8.pdf · 2017-02-07 · attempt to acquire sensitive information such as usernames, passwords,

Exhibit g. HERBERT M. RITKE's Address Fraudulently Used in ...

Phishing & Spear Phishing - info.vadesecure.com Marketing Website... · Phishing Spear Phishing Understanding an Emerging Threat to Healthcare Organizations 5 vadesecure.com How Phishing

enjoy safer technologystatic1.esetstatic.com/fileadmin/Images/US/Docs/Home/...Anti-Phishing Protects you from attempts to acquire sensitive information such as usernames, passwords

PHISHING PREVENTION TRAINING White Papers...phishing. Phishing emails are used by attackers to deliver viruses, steal passwords, install ransomware and impersonate corporate officers

Cyberspace and Cybersecurity Policy, Risks & Strategies · Don’t fallfor phishing (and other) scams Keep systems updated Change passwords on home systems Organizational Risk based

How to Spot Phishing Attacks - MicroAge · How to Spot Phishing Attacks What is Spear Phishing? Like phishing ploys, spear phishing scams are designed to obtain sensitive information

Passwords, phishing, und private Daten

Multi-Factor Authentication: Security or Snake Oil? · Phishing & Identity Theft • Historically most online banking done with passwords (single-factor authentication) • Password

TABLE OF CONTENTS...In particular, be aware of phishing scams, in which fraudulent sites or email lure people into submitting confidential information (e.g., passwords). Refer to the