WEBVTT 00:00.480 --> 00:09.920 Fishing as a type of attack that typically attempts to trick the victim into clicking on a link or executing 00:09.920 --> 00:18.170 malware in some way it can be an attempt to compromise a device to steal sensitive information passwords 00:18.170 --> 00:25.610 usernames pins credit card numbers as well as try to gain access to online accounts pretty much all 00:25.610 --> 00:32.060 of the things you don't want to happen can happen through phishing attacks and phishing is one of the 00:32.060 --> 00:39.830 most successful and common types of attacks because it is easy to perform cheat to set up and it yields 00:39.980 --> 00:42.300 good returns for the attackers. 00:42.320 --> 00:50.210 So you really have to watch for it and working for big corporations even with repeated security trained 00:50.210 --> 00:52.310 to wind people up no matter what. 00:52.310 --> 01:00.200 The company I've consulted to about 30 percent or so of people continue to be fooled and click on things 01:00.200 --> 01:01.110 that they shouldn't. 01:01.340 --> 01:09.180 And funnily enough some countries are worse clickers and some are better clickers on a consistent basis. 01:09.260 --> 01:15.980 But no matter what people just seem to not be able to be trained out of not clicking on the things that 01:15.980 --> 01:17.660 they shouldn't click on. 01:17.930 --> 01:26.900 Phishing is typically carried out by sending fake e-mails or instant messages as well that direct the 01:26.900 --> 01:33.610 victim to a fake site that often resembles the legitimate site. 01:33.620 --> 01:36.030 It is a form of social engineering. 01:36.170 --> 01:44.810 Or in other words it's an attack against human weaknesses and it relies also on the lack of defenses 01:44.810 --> 01:50.060 that web technologies inherently have in order to do the attack. 01:50.060 --> 01:56.990 So for example e-mail does not authenticate or digitally sign the sender. 01:57.080 --> 02:04.070 So there's no guarantee of who it's come from if there was then this problem would be reduced because 02:04.070 --> 02:08.720 e-mails can be easily spoofed or they've come from a legitimate source. 02:08.810 --> 02:16.280 Phishing attacks take advantage of that trust that you believe it's come from that person or at least 02:16.280 --> 02:17.700 it can do. 02:17.900 --> 02:21.170 Generally phishing attacks are done on mass. 02:21.170 --> 02:29.750 They send out thousands or millions of e-mails and those e-mail addresses have been harvested from the 02:29.750 --> 02:37.400 internet or sometimes they've been harvested through hacking Web sites sometimes from the fact that 02:37.430 --> 02:41.720 people publicly disclose them on forums or other things like that. 02:41.990 --> 02:45.590 And even from guessing at what the address is. 02:45.770 --> 02:52.280 So if you for example had you know John at a domain name and don't John Hotmail or something or this 02:52.280 --> 02:58.280 would be an usable account because of the amount of spam and phishing emails that it would get because 02:58.280 --> 03:05.930 spammers target common names in combination with domain names you do also get mass e-mail attacks on 03:05.930 --> 03:07.790 certain businesses as well. 03:08.090 --> 03:17.100 But if it is a specific and targeted attack we call that spearfishing if you're targeted individually. 03:17.240 --> 03:23.810 Let's look at some techniques used to perform phishing attacks in order to try and convince people to 03:23.930 --> 03:25.260 click on them. 03:25.280 --> 03:30.100 So the big war that they use is what's called Link manipulation. 03:30.110 --> 03:36.550 This is a simple phishing e-mail that you can see here in front of you that put together. 03:36.740 --> 03:43.130 I've sent it to a ghost mail account to illustrate the technique that used the ghost mail service is 03:43.130 --> 03:49.910 no longer available actually but that's not important as it's serving here as an example only the examples 03:49.910 --> 03:57.790 our show can apply at all email services here I'm faking links to Google and to Microsoft. 03:57.830 --> 04:04.690 So if we just zoom in here so the first thing that they use is subdomains and misspelt the mains. 04:04.970 --> 04:10.760 And if you look at these three examples here so you can see here that this 04:13.340 --> 04:14.560 is the real domain. 04:14.630 --> 04:21.350 And this is the domain it's trying to convince you that it's actually from a slightly different technique 04:21.350 --> 04:22.950 being used here. 04:22.970 --> 04:30.190 So that is obviously the real domain and then this is used in some directories. 04:31.360 --> 04:35.650 In order to look like Google this one's using a subdomain. 04:35.650 --> 04:37.590 This one's use in subdirectories. 04:37.990 --> 04:41.650 And this one Microsoft can you notice what's wrong with that one. 04:41.680 --> 04:50.990 You probably can because we're zoomed in which is here you've got an all in and instead of an M let's 04:50.990 --> 04:53.110 have a look at some other examples. 04:53.390 --> 04:55.260 So these are live fishing links. 04:55.260 --> 05:01.170 That's all right now attempting to convince people to click on them so you can see here this is. 05:01.330 --> 05:09.440 This is actually an Australian bank and it's attempting to convince people that you know this is the 05:09.440 --> 05:17.480 domain when in actual fact we can see here that this is the real domain. 05:17.660 --> 05:20.410 Let's see if there's any other clever ones or. 05:20.750 --> 05:22.130 Well I'm not really that clever. 05:22.130 --> 05:24.620 But let's see if we can find any other examples. 05:24.860 --> 05:28.890 So you can see here here's another Pay-Pal the code. 05:28.970 --> 05:30.000 OK. 05:30.290 --> 05:35.340 So the real domain real of mine is this. 05:35.440 --> 05:40.360 So it may be tricky to understand as I've gone through this with which are the real domains. 05:40.360 --> 05:47.950 Depending on on your experience so the real domain is the one that is to the left of the high level 05:47.950 --> 05:56.590 domain that's the high level domain and has no sloshed to the left of it. 05:56.670 --> 06:02.700 High level domains are you know things like dot com dot net org. 06:03.020 --> 06:11.580 But in my example here that isn't the Gitmo because it has a slash to the left of it which means it 06:11.580 --> 06:17.500 is a directory real domain is the one to the left of the high level domain. 06:18.880 --> 06:26.910 And has no slash to the left so that has a slash to the left so it must be this in the next sort of 06:26.920 --> 06:34.030 technique of link manipulation is what's called the N home a graphic attack idea and it's the internationalized 06:34.300 --> 06:36.250 domain name standard. 06:36.250 --> 06:40.110 They can see a couple of obvious ones but again they're not always obvious. 06:40.150 --> 06:44.140 You can see here we've got some zeros instead of O's. 06:44.290 --> 06:46.790 We've gone L instead of a one. 06:47.050 --> 06:54.040 But let me tell you if the font is different these can be almost impossible to see the difference. 06:54.040 --> 07:00.910 Obviously this can be used in combination with subdomains and misspelling in order to create further 07:00.910 --> 07:01.830 confusion. 07:01.980 --> 07:04.650 And another one is hidden you Charles. 07:04.750 --> 07:12.550 So using Hastey IMAO tags to hide the real you RL So you can see hey we've got click here so you don't 07:12.550 --> 07:17.920 know what's behind it but if you look down there at the bottom you can see that it's going to Google 07:17.920 --> 07:25.990 dot com dot Station X dot net and this one we can see is actually going to Google dot com dot Station 07:25.990 --> 07:31.660 X dot net so not at all going to where alleges to go to click. 07:31.750 --> 07:35.780 You see don't go to Google at all. 07:35.800 --> 07:39.180 Obviously I could this could have been you know an attack site. 07:39.380 --> 07:44.050 So the way these were these hidden your rails is essentially it's just hatched him out. 07:44.080 --> 07:46.850 It's really really not complicated at all. 07:47.160 --> 07:55.210 And so you can see here these this is the rule haste here now here and that has created these links. 07:55.200 --> 07:56.300 I sent an e-mail. 07:56.310 --> 08:00.940 E-mail is a made up of hasty mail nowadays anyway. 08:00.960 --> 08:07.780 This is text in and hasty email and the email client rende the hasty e-mail just like browsers render 08:07.790 --> 08:08.700 hastier mail. 08:08.860 --> 08:18.290 So you can see here what I have is I've represented Google dot com as what you can see in the e-mail. 08:18.460 --> 08:22.470 But actually the real link is here. 08:22.720 --> 08:29.590 And of course if we you know use all of these in combination you know this is why people click on the 08:29.590 --> 08:32.210 links because they can be fooled. 08:32.210 --> 08:35.980 It's it's easy to see why people get fooled. 08:35.980 --> 08:41.650 I mean there's all sorts of nonsense in here that you're a lay person is just not going to understand 08:41.650 --> 08:45.480 them they are going to click on them and go back to the e-mail. 08:45.610 --> 08:52.220 If we hover over the mail we can right click and copy link location. 08:52.400 --> 09:00.730 Depending on your browser that may reveal the correct you R-AL but not always. 09:00.860 --> 09:08.690 Javascript could hide the link pending on your email client and also as I showed here you can hover 09:08.690 --> 09:16.140 over and you can see in the bottom left the real domain that isn't always going to be the case either. 09:16.190 --> 09:21.410 Depending on your email client and javascript that may also be faked as well. 09:21.470 --> 09:23.730 So it is pretty tricky. 09:23.780 --> 09:27.770 You can look at the hastier mail like here. 09:27.840 --> 09:33.070 So my email client will like to see the law hastier e-mail and then you can go through and see what's 09:33.070 --> 09:33.510 there. 09:33.640 --> 09:35.230 But some won't. 09:35.230 --> 09:40.660 I mean this goes for mail for example does not let me look at the wrong e-mail. 09:40.870 --> 09:45.730 So I have to hover over it to see where it is going to take me to. 09:45.790 --> 09:54.730 Good providers and this can be both a good and a bad thing will notice these types of things and will 09:54.730 --> 09:55.930 change them. 09:55.960 --> 10:04.000 So Thunderbird for example and these wouldn't come through like this and it would change them so that 10:04.000 --> 10:06.050 you can actually see where it's going to. 10:06.180 --> 10:10.220 But that defense mechanism could be bypassed as well. 10:10.240 --> 10:18.910 So you know it's not foolproof but go smell and this example was able to receive these and make them 10:19.030 --> 10:26.090 look like this without me going too much effort to try to bypass any phishing protection that it has. 10:26.160 --> 10:29.860 All the new RL manipulation is also covert. 10:29.890 --> 10:36.490 You are redirects that use lunar abilities such as cross-site scripting and cross-site request forgery. 10:36.600 --> 10:40.790 Now they can be using in combination with manipulation. 10:40.900 --> 10:48.290 So it is possible that you might get sent a link to a real site. 10:48.640 --> 10:57.640 And the real site is being manipulated to attack you in some way so that attacker can or possibly has 10:57.640 --> 11:05.800 found a flaw in the real site and is using a technique like open redirect or as I've just mentioned 11:05.800 --> 11:11.880 the cross-site scripting and the cross-site requests forgery vulnerabilities in order to attack you. 11:11.890 --> 11:13.180 So this has happened to pay. 11:13.200 --> 11:14.680 How many are there. 11:14.680 --> 11:22.180 So let me give you an example because this you know obviously won't be clear of a reflected cross-site 11:22.180 --> 11:26.860 scripting ability that could be used in a fishing attack. 11:26.860 --> 11:33.210 So I imagine you've been you know sent a link via whatever means. 11:33.280 --> 11:38.590 Now this was actually a cross-site scripting venerability F.A. for an application so I'm just using 11:38.630 --> 11:44.440 as an example so this is an example of the you are real. 11:44.500 --> 11:47.640 You then click on this you are el. 11:47.850 --> 11:57.810 This takes you to the Web site and then because I've inserted into that you are well a special script. 11:57.990 --> 12:03.680 When you enter your username and password I'm able to steal your username password. 12:03.690 --> 12:10.310 Now if you look here this is the crucial bit of code. 12:10.310 --> 12:16.320 So I've inserted my own little bit of code here. 12:16.370 --> 12:21.900 This is the reflected cross-site scripting vulnerability. 12:21.950 --> 12:32.150 That site should not let me put in my own scripts into Rails and process it because what that means 12:32.150 --> 12:39.880 is that I am then able to act as that Web site under the security context of that Web site. 12:39.890 --> 12:42.820 Which means I then have access to your cookies. 12:43.100 --> 12:49.640 And of course I can manipulate the web page so that you know that it's not the right log in screen and 12:49.640 --> 12:52.640 it's actually a fake log in screen that I've presented. 12:52.940 --> 12:59.720 And that's actually what I did with this particular vulnerability to demonstrate it to the people that 12:59.810 --> 13:02.490 own the application so they could fix it. 13:02.540 --> 13:05.890 So that was the actual You Arel vulnerability. 13:06.170 --> 13:16.170 And if you look here there inserting in a special what's called an eye frame in order to put up a fake 13:16.170 --> 13:21.130 log in screen and able to take the usernames and passwords. 13:21.480 --> 13:27.390 So that gives you an example where if there's vulnerabilities in the Web site these cross-site scripting 13:27.390 --> 13:33.570 vulnerabilities these open redirects then the phishing attacks can be even worse. 13:35.010 --> 13:42.840 And to finish upon phishing is a couple of variants of phishing and that is visioning and smashing. 13:43.160 --> 13:54.700 So wishing is phone or voice phishing and smooshing is SS phishing or sending text messages. 13:54.710 --> 14:01.340 So this is attempting to call or text you in an attempt to compromise your device in the same way as 14:01.460 --> 14:08.210 you do with phishing you know so steal sensitive information passwords usernames credit cards you know 14:08.300 --> 14:09.650 all the bad stuff. 14:09.650 --> 14:11.440 There are many examples. 14:11.460 --> 14:18.640 A common one being pretending to be from Microsoft telling you that you have a virus on your machine. 14:18.740 --> 14:24.440 Can they help please download and install this totally legitimate software which is then you know a 14:24.440 --> 14:26.570 trojan or something like that. 14:26.570 --> 14:34.160 Again my mother has had a couple of these calls from guys from India pretending to be from Microsoft. 14:34.160 --> 14:37.690 These calls do work on and off people. 14:37.700 --> 14:39.890 That's why they continue to do them. 14:39.920 --> 14:46.850 And actually if you look on YouTube you can actually see a lot of people pranking these people when 14:46.850 --> 14:48.590 they're being called by them. 14:48.920 --> 14:50.530 So those are quite funny to watch. 14:50.660 --> 14:57.320 So vision is phone based Condes smashing is text based Cohn's and that's phishing.