Phishing gets a Bit Easier

Monday, November 10, 2014 @ 08:11 AM gHale

A new technique is coming into play by attackers which allow them to fool even more users into believing they are entering their information in a legitimate web form.

Instead of replicating a legitimate website like an e-commerce site, the attackers need only to set up a phishing page with a proxy program which will act as a relay to the legitimate site, and create a few fake pages for when users need to enter their personal and financial information, said researchers at Trend Micro.

Malware Targets iOS, Mac OS X
Trojan Attack Rate Growing
Android Malware Tough to Remove
Images can Attack in Android Apps

“So long as the would-be-victim is just browsing around the site, they see the same content as they would on the original site. It is only when any payment information is entered that modified pages are displayed to the user,” said Trend Micro Senior Threat Researcher Noriaki Hayashi said in a blog post.

“It does not matter what device (PC/laptop/smartphone/tablet) or browser is used, as the attacker proxies all parts of the victim’s HTTP request and all parts of the legitimate server’s response,” Hayashi said.

In the spotted attack, users end up directed to the malicious site by clicking on a search result they got by entering a product’s name. The attackers used a number of blackhat SEO techniques to make the URL appear in the results. But spam emails and messages also work to lure potential victims to the malicious site.

The actual attack begins when the user clicks on the “Add to Basket” button on the legitimate site. That is where the attacker has re-written the function so the user ends up redirected to a spoofed e-cart page that leads to more fake pages simulating the checkout process.

The first page asks the victims to enter their personal information (name, address, phone number) as well as their email address and password. The second one requests the entry of credit card information (including the card’s security code). The third one asks for additional information sometimes required to authorize a transaction.

Once the victims submitted all this information, they will receive a fake confirmation email for the purchase to the email address submitted. With all that, the attacker completes the task.

“So far, we have only identified this attack targeting one specific online store in Japan. However, if this attack becomes more prominent, it could become a very worrying development: This makes phishing harder to detect by end users, as the phishing sites will be nearly identical to the original sites,” Hayashi said.

This approach makes phishing websites easier to set up, and very difficult for the owners of the legitimate websites to detect.

Leave a Reply

You must be logged in to post a comment.