Researchers Demonstrate New Way to Detect MitM Phishing Kits in the Wild

guest · Nov 18, 2021

Researchers Demonstrate New Way to Detect MitM Phishing Kits in the Wild
November 16, 2021
https://thehackernews.com/2021/11/researchers-demonstrate-new-way-to.html

No fewer than 1,220 Man-in-the-Middle (MitM) phishing websites have been discovered as targeting popular online services like Instagram, Google, PayPal, Apple, Twitter, and LinkedIn with the goal of hijacking users' credentials and carrying out further follow-on attacks.

The findings come from a new study undertaken by a group of researchers from Stony Brook University and Palo Alto Networks, who have demonstrated a new fingerprinting technique that makes it possible to identify MitM phishing kits in the wild by leveraging their intrinsic network-level properties, effectively automating the discovery and analysis of phishing websites.
Click to expand...

Dubbed "PHOCA" — named after the Latin word for "seals" — the tool not only facilitates the discovery of previously unseen MitM phishing toolkits, but also can be used to detect and isolate malicious requests coming from such servers.

"PHOCA can be directly integrated into current web infrastructure such as phishing blocklist services to expand their coverage on MitM phishing toolkits, as well as popular websites to detect malicious requests originating from MitM phishing toolkits," the researchers said, adding that uniquely identifying MitM phishing toolkits can "enhance the ability of web-service providers to pinpoint malicious login requests and flag them before authentication is completed."
Click to expand...

Catching Transparent Phish: Analyzing and Detecting MITM Phishing Toolkits

The network architecture of MITM phishing toolkits signifigantly decreases the effectiveness of content-based phishing detection techniques. Additionally, as attackers control all application layer content, JavaScript-based defenses can be easily filtered by attackers.

To achieve this, we focus on two categories of network-level features to distinguish MITM phishing toolkits from benign web servers: network timing features, and TLS fingerprinting features. Using these two feature groups, we can reliably detect the presence of MITM phishing toolkits in online communications.
Click to expand...

Paper: "Catching Transparent Phish: Analyzing and Detecting MITM Phishing Toolkits"
(PDF): https://catching-transparent-phish.github.io/catching_transparent_phish.pdf

Rasheed187 · Jan 9, 2022

I must admit, I still don't understand how such an attack would work in real life. I guess you still first need to be lured to such a fake phishing website?

https://therecord.media/more-than-1...ble-of-intercepting-2fa-detected-in-the-wild/

A team of academics said it found more than 1,200 phishing toolkits deployed in the wild that are capable of intercepting and allowing cybercriminals to bypass two-factor authentication (2FA) security codes.

Also known as MitM (Man-in-the-Middle) phishing toolkits, these tools have become extremely popular in the cybercrime underworld in recent years after major tech companies started making 2FA a default security feature for their users.

The direct result was that threat actors who managed to trick a user into entering credentials on a phishing site found that the stolen credentials became useless since they couldn’t bypass the 2FA procedure.
Click to expand...

Rasheed187 · Jan 19, 2022

mood said: ↑

Researchers Demonstrate New Way to Detect MitM Phishing Kits in the Wild
November 16, 2021
https://thehackernews.com/2021/11/researchers-demonstrate-new-way-to.html

Catching Transparent Phish: Analyzing and Detecting MITM Phishing Toolkits

Paper: "Catching Transparent Phish: Analyzing and Detecting MITM Phishing Toolkits"
(PDF): https://catching-transparent-phish.github.io/catching_transparent_phish.pdf
Click to expand...

Mood, do you understand how this attack would work? I still don't understand how they are able to bypass 2FA with this stuff. If you're on a fake page, then you would think they can't intercept the 2FA codes.

Log in or Sign up

Researchers Demonstrate New Way to Detect MitM Phishing Kits in the Wild

guest Guest

Rasheed187 Registered Member

Rasheed187 Registered Member

Log in or Sign up

Researchers Demonstrate New Way to Detect MitM Phishing Kits in the Wild

guest Guest

Rasheed187 Registered Member

Rasheed187 Registered Member

Useful Searches