Let's do a little quick review.
We have seen firsthand how powerful a spear fishing campaign can be when you send it out to targeted
people that, you know, use a certain social network that you believe use a certain bank that maybe
users of your email system within your organization or people who just log in to Gmail, Gmail, thank
goodness, will at least ask you your username on one screen and your password on another.
That makes it much safer than having the username and password login and password all on a single screen.
But there are lots of systems out there.
Most banks, most social media sites still give you the username and password in a single page, and
it makes it susceptible to this type of email credential harvesting that we just saw.
So quick recap.
Phishing is the number one attack vector when it comes to social engineering, online pretexting, pretending
to have that email come from Facebook baiting.
And we could put something in that email that says, Bryson, there are embarrassing pictures of you
up at Facebook or it looks like your account has been hacked from an address.
It looks like it's coming from China and put an odd address in there, whatever it may be, that will
bait the user's quid pro quo.
One recent scam that's been going out as a phishing email is the ability to set up a verified social
user account like the real Donald Trump at Twitter.
Right.
A verified social media account sounds like a really good thing to have.
So I could have the real Bryson pain on Twitter.
But when you click through, you have to be really careful, go directly to the website.
And that's a better way to avoid being taken by these click through links.
We didn't use tailgating in this particular instance and we didn't make use of phishing or smooshing.
We didn't send a voicemail or make a phone call.
We didn't send a text message with the link.
But it's just as easy to take this link, turn it into a text message and send it to someone on an Android
device, the same way we just saw how to do it on a Linux device.
And finally we learned the power of spear fishing.
That's when we take a targeted approach at getting someone in our social network, in our organization.
So someone might send an email to your CEO, to your finance officer, to your chief business officer,
to your H.R. director.
And once you get one of those sets of username and password combinations, you can do some really bad
things over the Internet.
You can log in as the boss and send an email to all employees that they're fired or send an employee
to the chief business officer or to the treasurer of the organization and say that you need some money
transferred to a certain account to keep one of your customers there.
All kinds of bad things that can happen to your organization if your employees fall for spearfishing.
There are lots of bad things that can happen to your family.
If one of your older parents or if you have young children going online, predators, con artists,
scammers are all out there on the Internet using techniques like these.
It costs nothing to send thousands of emails and all it takes is one person clicking through.
But unfortunately, we see that even in the best trained organizations, as many as five percent of
people will click through and provide their credentials.
In an organization with no training, that number is significantly higher, about five times higher,
23 percent on average, according to one Verizon study.
So spearfishing, again, was just a focused email attack.
And we saw how to craft one of those by using the social engineers toolkit to create a Web server that
looks just like Facebook or Twitter or your bank or your email login at work.
We set up a server running locally that was a credential harvester site that looks exactly like the
Facebook dotcom login site, but it's running on our local call address.
Mine was ten point nine four and we saw using the IP address converter that we could change that ten
point nine to four to one hundred sixty seven, seven seventy four for sixty eight address.
And then we could craft a U.
RL that looked exactly like http colon slash slash w ww that Facebook dot com at one sixty seven 774
for sixty eight.
And that Assim will remember, converted that first part into a username.
And if I copy that.
And pasted over into my Firefox browser, it will pop up a warning, I copy that and pasted over into
any of my Web browsers as that longer address it'll resolve to our ten point nine to four address.
But most people don't look up in the address bar as often as we should.
So this number, that one sixty seven 774 468 resolves to that ten point nine for address and takes
people unwittingly to our internal phishing server.
And you will only be able to do this attack from a local area network that allows people to surf to
that ten, nine, four address so you can do it safely from your computer, from one IP address or one
virtual machine to the other, like from your Windows box or Android box to this call Linux server.
But you won't be able to send somebody on the public Internet, somebody on a different network, at
a different school, at a different organization, because thank goodness we're blocked by our Internet
service provider from doing that.
To do that.
Well, attackers will set up a full server running someplace on an IP address or get a dynamic IP address
and then send out phishing emails like this in targeted attacks.
But we are not bad attackers.
We are ethical hackers.
We will not send this outside our network anyway.
And you only want to use this to do training inside your own network or to show your friends and family
how easy it is to fall for an IP address.
That looks correct, but take them to a phishing server.
And the way we got people to click through to that phishing server was just by crafting an email using
a real email from a social network and changing all of those you URLs to our HDTV.
Cohen's language about face dotcom at and then our IP address of our Cauli Linux box at as a decimal
integer.
And we just had to do that for every single one of the links in this email so that it looked convincing.
But it is devastating how powerful the spear spearfishing attacks are in an organization to family,
to friends.
If you've got an older family member who's susceptible to scams, you need to show them that this is
possible and tell them never to click through this link.
They always need to type out WDW that Facebook dotcom directly in their browser window to make sure
that they get the right address.
Don't click through any suspicious link ever in an email.
We'll talk a little bit more about how to avoid how to spot and stop phishing in.
The next lesson is a little bonus.