More InterPlanetary File System Services Use Also Means Phishing Abuse by Cybercriminals

The InterPlanetary File System (IPFS), a distributed file-sharing system that represents an alternative to the more familiar location-based hypermedia server protocols (like HTTPS), is seeing more use in file-storage, web-hosting, and cloud services. As might be expected, more use is accompanied by more abuse via phishing attacks.

Make Use Of explains that, “IPFS replaces the Hypertext Transfer Protocol (HTTP) and Hypertext Transfer Protocol Secure (HTTPS) as a way to distribute the World Wide Web. Unlike its predecessors, which are location-based, IPFS is a distributed file system. Instead of the traditional centralized client-server method, IPFS uses peer-to-peer (P2P) data networks located worldwide without requiring third parties or centralized authorities.”

Criminals have found it easier to host malicious files in IPFS than it has been in its predecessor protocols. It’s easier to distribute them and harder to detect them. It’s also easier for malicious content to persist in IPFS.

Three common techniques are used in IPFS phishing:

1. “Malicious URLs: Attackers use phishing text messages, emails, direct messages (DMs), pop-ups, or other channels to deceive you into clicking links leading to malicious IPFS gateways.
2. “Domain Name System (DNS) spoofing: Alternatively, these malicious actors may create a fake DNS server that will redirect you to a malicious IPFS gateway hosting a fake website.
3. “Secure Sockets Layer (SSL) certificates: Also, they may employ a fake SSL certificate to convince you that you’re visiting a legitimate site.”

The phishing attempts follow a familiar pattern. Direct messages, emails, texts, or in-app messages delivered through productivity tools or games induce the recipient to navigate to a malicious site that spoofs a trusted, legitimate one. Once the victims are there, they’re induced to install malware or give up credentials.

IPFS attacks tend to show one of three signs: unsolicited messages, dodgy urls or SSL certificates, or malicious gateways that represent themselves as being hosted on IPFS. These tells are in general familiar to alert users, and it’s worth noting that they’re now being transposed to a new family of attacks that take advantage of the peer-to-peer sharing system. Alert organizations will benefit from new school security awareness training that can prepare their people to resist this form of social engineering.