Conversations with a Phisher

Phishing campaigns display varying levels of sophistication depending on how much time and effort the attackers are willing to invest in a particular target, according to Steven Murdoch, a security researcher and associate professor at University College London (UCL). In an interview with SearchSecurity, Murdoch described a semi-targeted phishing attack sent to his department at UCL.

“I [spotted] a phishing email that I received through my UCL email address,” Murdoch said. “I get a number of phishing emails — as does everyone else at UCL — and even more are blocked by the email security system. But this one was somewhat personalized — the initial email was asking if I was available. I was curious to see what would happen if I responded, and I wanted to know exactly how the criminal would try to get money out of me.”

Murdoch replied to the scammer and began a conversation. Eventually, the scammer tried to convince him to buy gift cards and send pictures of the cards’ codes. The scammer tried to appeal to Murdoch’s emotions by telling him that the money was for someone dying of cancer, and it was urgent. Murdoch played along and tricked the scammer into revealing information about the scheme.

“I thought it would be interesting to know where this person was, so I fit a PDF with an embedded link in it which, when clicked, would bring that person to a website I controlled,” Murdoch said. “This way I could find the IP address. I used the geolocation service to locate them in Nigeria. Finally, I wanted to see what other information I could find. I sent off a gift card that didn't work. I noticed that the error message sent back to me was for a service called Paxful, which enables you to exchange gift cards for Bitcoin. I also reported that person to Paxful.”

The scammer actually emailed everyone in Murdoch’s department posing as the head of the department. He told SearchSecurity that this is a common technique when attackers do some open-source research on their targets, although other attackers take it a step farther.

“Quite often everyone gets contacted — it's easier to send a lot of emails rather than work out who the right target is,” he explained. “Other attackers are a bit more sophisticated: They look at people who are likely in a position to buy things or transfer money. Even more sophisticated criminals will compromise the email system of an organization or its computers and then intersperse phishing emails into existing conversations. In some cases, they will alter emails before they are received. Those communications are the hardest to spot. Criminals know these sorts of techniques require a bit of research to get that far. But this sort of research is not particularly hard to do, especially with social media or online employee directories.”

Murdoch concluded that employee training should focus on teaching people how to seek assistance when they feel suspicious about something. New-school security awareness training can give your employees a healthy sense of skepticism so they can recognize and respond appropriately to social engineering tactics.

SearchSecurity has the story.