Researchers at Avanan warn that attackers are using reCAPTCHAs on their phishing sites to avoid detection by security scanners.
“One of the main tasks of reCAPTCHA challenges–those annoying image games you have to play before proceeding to a site– is to make content inaccessible to crawlers and scanners that do not pass the verification process; therefore, the malicious nature of the target websites will not be apparent until the CAPTCHA challenge is solved,” the researchers write. “Further, because the content of this attachment is a seemingly harmless reCAPTCHA, and the mail client will not be able to solve the CAPTCHA, the email client will have no way of determining the safety of the actual attachment’s content. Adding to the challenge for scanners is that the email is being sent from a legitimate domain, in this case, a compromised university site.”
Avanan explains that reCAPTCHAs also add legitimacy to the sites from a user’s point of view, since many legitimate sites use this feature.
“To the end-user, this doesn’t seem like phishing but more like a nuisance,” the researchers write. “Given how often the average user fills out a CAPTCHA challenge, it’s not out of the ordinary. Neither are password-protected PDF documents. Plus, the PDF is hosted on a convincingly-spoofed OneDrive page, adding another veneer of legitimacy. By providing end-users with innocent enough content, and scanners with enough to be fooled, this is an effective attack for hackers to pull off.”
The phishing links are distributed in emails that purport to contain a faxed document. Avanan offers the following advice for organizations to defend against these attacks:
- “Encourage end-users to check URLs before filling out CAPTCHA forms
- “Ask recipients if the PDF should have been password protected
- “With a faxed document, ask the sender if they were in the office or working from home. If working from home, odds are that they did not fax it.
New-school security awareness training can enable your employees to follow security best practices so they can avoid falling for social engineering attacks.
Here's how it works:
