SMishing - New Technique on Phishing

What is SMishing?

Text message send by cyber criminal to get personal information, bank/credit card details or login credential.

Below are the examples for fraud or scam text messages.

Scotiabank SMishing

Rogers SMishing

For more details:

[1] https://www.howtogeek.com/526115/what-is-smishing-and-how-do-you-protect-yourself/

[2] https://chandraktrivedi.blogspot.com/2018/06/phishing-main-source-for-cyber-attack.html

How to Mitigate SMishing technique?

Procedures

Step I: Do not click on the link if you are not expecting such text messages. 

For example: If you don't have account with Scotiabank or Rogers so this messages should be ignored. 

Step II: If you clicked the link, please verify few important details on the web page before entering personal or banking information.

• Dangerous - Means someone has already flagged this website as phishing or used for bad purposes. Additionally, verify the web page has "Lock" or "Secure" sign beside the website name. 
• Confirm that website name matches legitimate company website such as *.scotiabank.com.
• Identify the page as suspicious since only "Login Information" is displayed. 

Phishing Site

Step III: If you determine that SMS received is fraud or scam, please "Report Scam" to text message. Additionally, block the number so that you do not received more messages.  

Step IV: It would be very much appreciate if you took an additional step to protect more individuals to report the website to Google, Microsoft or more.

Phishing can be submitted using following links:

Google: https://safebrowsing.google.com/safebrowsing/report_general/

Microsoft: https://www.microsoft.com/en-us/wdsi/support/report-unsafe-site-guest 

Once, this website are submitted there is an additional layer provided from provider which displays "Dangerous or Risk".

Additional Layer

**Following step are relevant to Security Analyst

***Analyst has to complete all above steps as well. 

Step V: Analysis the new Domain/IP address/website on multiple threat intelligence sources. 

Few examples:

VirusTotal: https://www.virustotal.com/gui/url/9fc2695d7932cb3b32adde689804fd8573c680b7d911cc453590b7a011f33c22/detection

PhishTank: https://www.phishtank.com/phish_detail.php?phish_id=6368708

URLScan: https://urlscan.io/result/b9d6a21e-b932-4579-ba0d-fa314902c2ee/

*Please comment if you have more*

After submission, most of the tools will flag as phishing which will help in mitigating the risk. 

Step VI: (Optional) Inform the company via Social Media 

Conclusion

Sooner the phishing websites are detected, more victims are SECURE and SAFE. 

Phishing - Main Source for Cyber Attack

What is Phishing?

Phishing is similar to fishing, cyber criminals hooks a malware and wait until someone is caught. Cyber criminals hooks individual in the form of Emails, SMS, Calls, Replica of know websites and many more methods. In the case of a computer, once caught then the attacker is the owner of the computer or your important accounts credentials. In the case of SMS and Calls, scaring to get the personal information or credit card details and websites, login credentials. 

Sometimes its hard to recognized that you are really being hooked or phished. 

How this Phishing works? 

I am using Email phishing example since its the most common and people are still getting hooked on emails. 

Email was sent to me which went to SPAM but its not always the case. 

Looking at the Email below is very obvious to be curious to know what invoice this email is talking about.  

Once clicked on the link you are hooked but still can manage to get out of the danger.

When you open the download file is when you are completely hooked and caught perfectly (danger zone). 

As you can see there is no content on the file but just the marcos which is the malicious code to impact the computer. 

At this point, you might just ignore the file but you are phished and on background few process are running and trying to connect to malicious servers to submit data, also called as C&C (Command-and-control).

Following is the background analysis on the file downloaded.

My system configuration: 

***THIS ANALYSIS IS PERFORMED IN VIRTUAL ENVIRONMENT***

***PLEASE DON'T USE THE LINK ON YOUR ACTUAL COMPUTER FOR ANALYSIS***

This is the traffic of the impacted computer started to contact to GET more files to compromised the system entirely.   

Above process show how an email phishing works and compromise the system.

How to detect a phishing method?

The most important to detect phishing emails is from where is came from, Name is not important email id is the most important part to see. 

Below screenshot points out important things to watch before clicking or downloading a file. 

• Email ID (@"domain-name") 
• Wrong details
• Unknown link (Suspicious link)
• Grammar
• File Name (once downloaded)

This are few important points which confirms that its a phishing email which can be deleted or reported. 

Similarly, things to check on phishing websites: 

• Domain Name (URL)
• Grammar
• Copyrights
• Website certificate (https://)

How to verify if file is malicious or not? 

VirusTotal ( https://www.virustotal.com ) is one of the best open source analyzer for files, website and domain names. It gives a good idea about a file is malicious or out according to the Anti virus companies scan or signatures. 

This is the link for the malicious file downloaded. 

https://www.virustotal.com/#/file/ec7ff91b6c08d72e3cd683b40b62446a4453a8ed064341f7f6901cb19454d1be/detection 

For more details analysis, 

Hybrid Analysis ( https://www.hybrid-analysis.com/ ) is a good tool for detail analysis more suitable for IT professionals. 

https://www.hybrid-analysis.com/sample/ec7ff91b6c08d72e3cd683b40b62446a4453a8ed064341f7f6901cb19454d1be/5acfa0097ca3e16a1b04fd95

##Take Away##

PERSONAL DATA or INFORMATION is an important part for an individual/organisations which is directly proportional to MONEY and REPUTATION. 

Don't be to busy which cause you to get hooked and compromised. Be safe and careful in this Cyber World.