An Investigation on Vulnerability Analysis of Phishing Attacks and Countermeasures

Faulty authentication is when a platform or program online has flaws or vulnerabilities that allow hackers to log in without being detected and access all the user’s capabilities. The different sorts of these inbuilt flaws are weak session management and weak credential management.

Session management flaws can only be understood after familiarising how browsing and online authentication typically operate. Each user interaction with a network on social networking websites or online betting portals is logged and added to a web session that the web application may track. The web application provides the user with a session identity for each visit. This identity is necessary for the application to interact with the user and answer requests. Stealing or using unauthorized users’ credentials to access the program is also possible. As a result, managing credentials is crucial for cybersecurity. A web application must ensure that passwords like 1234 or password are not permitted. If such passwords are permitted to be used, credential management is weakened. It is a sort of failed authentication if the online application cannot defend users against hackers who force their way in using stolen or compromised credentials.

Hackers might target one by combining information from many sources. With the information they’ve discovered, they may design unique phishing techniques. They have successfully developed harmful malware targeting phishing apps [1]. Hackers phish to trick users into disclosing their login credentials by giving them URLs to websites that seem just like online applications. Phishing begins with an email or another kind of contact intended to help target the victim [2]. The message appears as though it has come from a reliable source. Victims are tricked by their personal information to spam websites. Malware may also possibly be transferred into the target’s machine. Phishing attacks are matched by 482 CVE records (the year 2004 to the present 2022).

According to a recent report, targeted phishing attacks affected over 90% of firms in 2019. Of these, 88 percent reported spear-phishing assaults, 83 percent voice phishing (also known as “Vishing”), 86 percent social media attacks, 84 percent SMS/text phishing (also known as “Smishing”), and 81 percent malicious USB drops. Phishing assaults increased from 76 percent in 2017 to 83 percent in 2018, according to the 2018 Proofpoint1 annual study, with all phishing attacks occurring more frequently than in 2017. The second quarter of 2019 saw a significant increase in phishing attacks reported compared to the first three quarters. According to a study from the anti-phishing working group, this figure was greater in the first quarter of 2020 than in the prior year, concluding that phishing attacks are rising [3].

The attacker makes their false websites, for instance, a fake Facebook website with a phishing.php file that would gather all kinds of information and an index.html page. Without logging in, the attacker visits the Instagram page. The attacker searches for word action to locate a connection as follows.

Action= Login attempt=1 at https://www.instagram.com/login.php

The attacker next registers for a free hosting account on a site like http://www.get-new-followers.com. The phishing website was then constructed when the attacker submitted a PHP file and an HTML page bearing his name. Now the attacker may begin phishing.

3.1 PyPhisher

Python’s PyPhisher is the best phishing tool available. It is a Python-based tool used for creating phishing pages. The tool includes several well-known websites, including Facebook, Twitter, Instagram, GitHub, Gmail, and many others. The PyPhisher phishing tool has 65 templates. The credentials retrieved after the attack are recorded in the usernames.txt file, and Ip addresses are stored in ip.txt.

3.2 Zphisher

Zphisher is an effective open-source phishing tool. This tool allows you to engage in phishing (in a wide area network). This tool can obtain credentials like a user id and password. It provides phishing templates of web pages for 18 well-known websites, including Facebook, Instagram, Google, Snapchat, Microsoft, and others. The Zphisher phishing tool has a total of 34 templates of web applications that look mostly the same as the original platforms. When the victim falls for the fake templates and gives their credentials, those are directly stored in the usernames.txt file. Zphisher also supports multiple phishing attacks, including tab nabbing, credential harvesting, and phishing over social media.

3.3 CamPhish

CamPhish is a camera phishing toolkit and a method for photographing the target’s front-facing phone camera or computer webcam. To create a URL one provides to the target, CamPhish hosts a false website on an internal PHP server. If the target agrees, the website requests their camera access, and this tool then takes screenshots of the target’s gadget. The CamPhish phishing tool has two port forwarding options, Ngrok and Serveo.net. It generates a direct link the user sends to the victim to access the victim’s webcam and get cam shots. These pictures that are retrieved are stored in the CamPhish folder directly.

Cybercriminals often use the tools stated above for illegal activities, which can result in serious data loss. These tools are created to carry out phishing attacks. It’s crucial to stay alert and take precautions to protect your online accounts and confidential information.

Even though there are many prevention strategies, the first main measure and approach are to improve awareness of phishing. Hackers can easily fool people and make them victims of this attack at ease. Therefore, all individual users and workers must know about dealing with and identifying these suspicious emails and report them immediately to their specific authorities. Thousands of people log into their social media handles every day. Phishing in this sector has become very popular and proved to be one of the favourite mediums to trap its victims. Whatever it may be, some countermeasures are mentioned as follows.

• Installing anti-virus or anti-spam software can help detect and prevent any unauthorized access. We need to keep it up to date for it to function properly.
• Usage of a unique password for each account must be introduced.
• Social media must never be trusted because our credentials and personal information are sometimes asked for through forms. Sharing all this sensitive information must always be avoided.

5.1 countermeasures – An investigation

The technical measures by various authors are investigated as follows.

1. Procedures to distinguish the assault after it has been sent off. For example, by checking the web to track down illegal websites. For instance, content-based phishing identification approaches are intensely sent on the web. The highlights from the site components like the picture, URL, and text content are dissected by Rule-based approaches and AI/ML that analyze the presence of exceptional characters (@), Domain IP addresses, and much more [27]. Fuzzy Logic has additionally been utilized as an enemy of the phishing model to assist with grouping sites into authentic or ‘phishy’ as this model takes care of intervals rather than explicit numeric qualities/values [28] The major benefit of fuzzy logic techniques is the ability to relate the likelihood of phishing emails and websites by using linguistic variables to reflect important phishing characteristics or signs. This model was created and put into use utilizing the incircle fuzzy rule interpolation technique.
2. Ways to prevent the attack from going towards a user’s system. Phishing counteraction is a significant stage to safeguard against phishing by obstructing a client from seeing and managing the assault. In email phishing, against spam, programming devices can obstruct dubious messages. Phishers typically send a veritable clone email that hoodwinks the client to open or snap on a connection. Some of these messages pass the spam channel since phishers use incorrectly spelt words. Hence, methods that identify fake messages by checking the spelling and language structure revision are progressively utilized, so it can keep the email from arriving at the client’s post box. According to the study [29], a new classification algorithm is based on random forest. The developed method id was PILFER (Phishing Identification by Learning on Features of Email Received). It can identify phishing emails depending on many features like IP-based URLs, number of domains, dots, unmatched URLs. According to a study, PILFER detected 96 percent of phishing emails correctly, with a false-positive rate of 0.1 percent. This intends to achieve an overall accuracy of 99.5 percent.
3. Remedial strategies that can bring down the compromised site, by mentioning the site’s Web access Supplier (ISP) to close the fake site to keep additional clients from falling casualties to phishing [30]. ISPs are liable for bringing down counterfeit sites. Eliminating the split between the difference and unlawful sites is a perplexing cycle; numerous substances are engaged in this interaction, from privately owned businesses, self-administrative bodies, government offices, volunteer associations, policing, and specialist organizations. As indicated by the PHISHLABS report and a study, bringing down phishing locales is useful, yet it isn’t compelling as these destinations can, in any case, be alive for a long time, ISPs can reduce the number of phishing emails that reach users by up to 90 percent.

5.2 Recent threat of Phishing attacks

Phishing attacks are common these days and are becoming worse over the years rather than completely disappearing. Even though some security applications offer the slightest defences against these small phishing attacks, the tools provided over here are not 100%, and there is a broad chance that many unwanted websites or fraud messages pave their way through. The real-life examples of phishing attacks are as follows.

• Crelan Bank: In this bank, the attacker sent mail to one of the employees acting as CEO, asking the employee to transfer the funds into the account the attacker controls. Thinking that the CEO had sent the mail, the employee transferred huge funds to the attacker’s account. This attack happened because of faulty authentication on the domain server side. It led to a huge loss of over 75.6 million dollars. This attack consists of a simple spear-phishing email sent to a senior executive of the company, a member of the financial team, or even a random employee. There have also been occasions where the sender attempted to pass themselves off as a business associate or even a representative of the organization, requesting money be transferred to a certain account to complete a pressing business transaction. To trick upset employees into transferring the money without first double-checking with someone from within the company, the hacker utilized real graphics and a fake domain name.
• Facebook and Google: Between 2013 and 2015, they used Quanta, the Taiwan-based company, as their vendor. The attacker sent a series of fake invoices to both companies imitating Quanta, and both companies paid (100 million dollars) as per the invoice. But later, the scam was identified, and companies acted against the attacker.

Another recent incident that impacted a lot is the massive breach suffered by Uber. The popular ride-hailing company Uber has faced an enormous data breach in which the company fell victim to a general Phishing scam where the attacker fantasized about being someone associated with the company. They then persuaded an employee with many login credentials to get access to the company’s internal systems. The company then lost their respect and reputation across the whole world. Thus, one phishing attack can cause great loss. This issue happened on 15 September 2022 and became a massive phishing attack. On 15 September 2022, Uber’s internal systems were completely compromised. The attacker figured out how to hack the organization’s hacker one account, then accessed a Leeway account which gave access to the AWS web administrations and even the GCP accounts. Hence, Uber is still investigating the incident; most internal systems were temporarily disabled due to the hack/ phishing attack. On 15 September 2022, an 18-year-old learned to hack Uber through phishing. He (the hacker) had a small blueprint of the organization’s inward frameworks and initiated some social strategies to compromise a worker’s account. After earning the account credentials, he gained access to the company’s internal databases and obtained full control over the company’s Amazon Web Services and even the Google Cloud Accounts. An official tweet circulated during the incident is shown in Figure 2.

2.png

Figure 2. An official tweet

3.png

Figure 3. Process flow diagram

4.png

Figure 4. Possible prevention for the UBER attack flow diagram

Firstly, the hacker might have done a brief information search on the victim, which means that he underwent the foot-printing phase and purchased highly sensitive information like username, address and phone number from an online source named DARK WEB, as shown in Figure 3. Almost all sensitive information of many organizations and people is available for a certain amount of money. This being a crucial step, the whole process completely depends upon this. If that information is proven wrong, the hacker fails to proceed further. He then immediately imposed a social engineering assault on his victim. Eventually, the victim’s trust was gained and gave him a positive result as the victim finally fell into his trap. All other information related to the company was spilt out, and the hacker finally gained access to the company’s database, restricted portals, and internal networks by scanning. NMAP, Nexpose, and Wireshark might have been used to detect input-output packets, open ports, private and restricted ports, Ip addresses and much more. Login credentials of the Uber admin were given out, parallelly giving access to its Thycotic PAM, where the company stores all its passwords in an encrypted form and helps manage their privileges. Thycotic PAM is like a key for hackers to access the whole company. As he had the admin’s credentials, he could break into it easily. Finally, he got access to all other services like Slack, AWS and much more.

Whenever the hacker sends a phishing email/message to anyone, there is a high probability that they fall into the hands of the hacker. The possible prevention for the UBER attack flow diagram is shown in Figure 4. Similarly, the admin first sent this and spammed it with many messages to gain trust. There are many ways to prevent this from occurring. Some of the effective methods include as follows.

• Using a hardware device as a security key: when the admin/employee gets a phished email or suspicious message from a third person, it’s better not to respond. If he/she decides to access that email or link, they could use a hardware security key, typically a USB. That device could be inserted in the admin’s system; it then uses a random encryption/ security algorithm and makes it safe for the system to be accessed/ hacked; it might also help detect suspicious emails. It restricts the third person from hacking.
• Anti-Phishing Tools: This is one of the most revised and traditional methods of detecting spam, suspicious email, and messages. These tools are embedded into the system to recognize unwanted emails and prevent the user/admin from clicking them.
• Using alert/notification software: an alert system is embedded. It ensures the system receives the message from the company’s network domain. All the users and officials of the company always communicate through a separate network domain. It keeps the admin on the right path. The admin gets an alert of the whole message and judges it based on location.

The success of phishing attacks can be summarized as follows.

• Techniques used in social engineering: Phishing attacks frequently use social engineering techniques to deceive people into disclosing sensitive information. In the case of the UBER attack, the attackers most likely used a convincing email or website that gave the impression it belonged to a respectable organization to fool UBER personnel into providing their login information.
• Lack of multi-factor authentication: A security feature known as multi-factor authentication asks users to provide a second piece of information besides their password, such as a code delivered to their phone. Multi-factor authentication may not have been in use at UBER at the time of the attack, making it simpler for the attackers to access employee accounts.

5.3 Other countermeasures

The other countermeasures are discussed as follows.

1. Like the security key method, there must be a limit to the number of verified devices. Only the devices assigned permission can access the account and its required sensitive information when there is a limit for the number of devices. By this, if a third-party member tries to access it, he/she would be restricted. If they want to access it, they would only do so through the assigned devices, which are highly secured and encrypted. This method may not be optimal in all situations, but it proves secure.
2. The company must ensure that all its employees or admins undergo strict training, so they won’t fall for all the silly tricks the hacker imposes. In contrast to this issue, the company’s admin unknowingly fell into the trap of a teen. They must be given at least four to six months of training before their joining date to prevent these small mistakes.
3. Setting a limit to the number of notifications on every admin’s device is also a major factor. When an employee or admin is targeted under social engineering hack, the hacker continuously troubles and threatens that person. When some emails or notifications are received, the admin (victim) eventually stops getting those threatening notifications for some time. The company can take this issue immediately after that shoot; on the other hand, the admin would also change his mind and thoughts about those notifications.

The company can provide an encrypted device to all its employees/admins, which generates passwords. Of this, the hacker needs to hack repeatedly to get the correct credentials or information.

5.4 Measures and suggestions to avoid and reduce phishing and network security

1. Implement email authentication: Implement email authentication protocols such as DKIM, SPF, and DMARC to prevent email spoofing and increase email security.

DomainKeys Identified Mail (DKIM): DKIM is an email authentication protocol that verifies the authenticity of an email message by attaching a digital signature to the email header. The signature is created using the sender’s private key and is validated by the recipient’s email server using the sender’s public key.

Sender Policy Framework (SPF): SPF is an email authentication protocol that verifies that an email message was sent from an authorized IP address associated with the sender’s domain. SPF records are published in the sender’s DNS records and specify which IP addresses are authorized to send emails on behalf of the domain.

Domain-based Message Authentication, Reporting, and Conformance (DMARC): DMARC is an email authentication protocol that builds on DKIM and SPF to provide additional security measures. DMARC enables email receivers to determine the authenticity of an email message by verifying that it passes both DKIM and SPF checks. DMARC also provides guidelines for handling messages that fail authentication checks, such as quarantining or rejecting them.

2. Web Filtering: Implementing web filtering tools can help to prevent employees from accessing known phishing websites and block malicious content from being downloaded onto the network.
3. Conduct regular security audits: By conducting regular security audits, organizations can identify and address vulnerabilities and weaknesses in their IT infrastructure, policies, and procedures and improve their overall security posture. This can help to reduce the risk of security breaches and other cyber threats and increase confidence in the organization’s ability to protect sensitive data and assets.