Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Phishing as a service

cuttlephish.com

Post reply on HN
Print view View original

61–70 of 70 posts

Re: Show HN: Phishing as a service

#61

Post by hrbrtglm »

bladecatcher wrote: post #53
jedberg wrote: post #46

Earlier quoted context omitted.

Most people won't think twice about the link in the email. They'll usually stop at the login screen because it doesn't look right, has a wrong URL, etc. Having done a lot of work in this area I can tell you that I'm definitely not in the minority. Clicking the link from a secure VM sure puts me in the minority, but just clicking the link? Lots of people do that and then get suspicious. That's why you need two steps t…

I'd received an email on my corporate email address from some courier service claiming that they weren't able to deliver a package to me. The email also contained a link which upon clicking took me to a page which displayed the message "congratulations! You've fallen prey to a phishing attack". Later we realized that this was a test conducted by the firm (a large investment bank) that I work for!

The courier service vector is an effective way to trick people.

You can ring an intercom in any big apartments block and ask to be opened the door to deliver whatever, most of the time you'll find a resident to open. No reason for it to not work in emails :)

Re: Show HN: Phishing as a service

#63

Post by tomjen3 »

bladecatcher wrote: post #53
jedberg wrote: post #46

Earlier quoted context omitted.

Most people won't think twice about the link in the email. They'll usually stop at the login screen because it doesn't look right, has a wrong URL, etc. Having done a lot of work in this area I can tell you that I'm definitely not in the minority. Clicking the link from a secure VM sure puts me in the minority, but just clicking the link? Lots of people do that and then get suspicious. That's why you need two steps t…

I'd received an email on my corporate email address from some courier service claiming that they weren't able to deliver a package to me. The email also contained a link which upon clicking took me to a page which displayed the message "congratulations! You've fallen prey to a phishing attack". Later we realized that this was a test conducted by the firm (a large investment bank) that I work for!

That one is a classic, although the text is incorrect as you didn't fall prey to the attack by simply clicking the link (if you work computer is vulnerable that is ITs problem, if it is a zero-day then nobody is safe).

Re: Show HN: Phishing as a service

#64

Post by Intermernet »

ninjakeyboard wrote: post #23
zensavona wrote: post #9

the FAQ page is 10/10 https://cuttlephish.com/faq

I noticed a serious issue with the documentation. I'm not able to go any farther until this is corrected... The documentation's FAQ page asks: "How much phish could a cuttlephish phish if a cuttlephish could phish phish?" This is not accurate based on my own testing. This should actually read: " "How much phish could a cuttlephish phish if a cuttlephish could phish phish phish?" If you can correct this error, I would…

Also:

>Are cuttlephish phish?

>No. The term "phish" is deeply offensive to cuttlephish, who are proud cephalopods.

s/cephalopods/cefalopods

Re: Show HN: Phishing as a service

#65

Post by bladecatcher »

tomjen3 wrote: post #63
bladecatcher wrote: post #53

Earlier quoted context omitted.

I'd received an email on my corporate email address from some courier service claiming that they weren't able to deliver a package to me. The email also contained a link which upon clicking took me to a page which displayed the message "congratulations! You've fallen prey to a phishing attack". Later we realized that this was a test conducted by the firm (a large investment bank) that I work for!

That one is a classic, although the text is incorrect as you didn't fall prey to the attack by simply clicking the link (if you work computer is vulnerable that is ITs problem, if it is a zero-day then nobody is safe).

Agreed. I guess, this way it's easier to train people to avoid clicking on links they don't recognize.

Re: Show HN: Phishing as a service

#66

Post by Intermernet »

TeMPOraL wrote: post #39
randomflavor wrote: post #17

You should send the emails, and charge me to view the report.

That is an excellent idea! In fact, we've just implemented the billing service, so please go to http://cuttIeph1sh.com/account/billing , log in to your account and provide your payment information to continue receiving our phishing reports!

Cyrillic homographs[1] are your friend here :-)

http://сuttlерhish.com/account/billing

(PunyCode [2]: http://xn--uttlhish-f8g4if.com/account/billing )

Also, it seems that Firefox (v38.0.5 Windows) doesn't convert URL interpuncts (mid-dots) into punycode, so clicking on something like http://www.billing·cuttlephish.com/ doesn't actually rewrite the URL in the address bar. Chrome converts it to http://www.xn--billingcuttlephish-c4a.com/ .

[1]: https://en.wikipedia.org/wiki/IDN_homograph_attack

[2]: https://en.wikipedia.org/wiki/Punycode

Re: Show HN: Phishing as a service

#67

Post by Manishearth »

Intermernet wrote: post #66
TeMPOraL wrote: post #39

Earlier quoted context omitted.

That is an excellent idea! In fact, we've just implemented the billing service, so please go to http://cuttIeph1sh.com/account/billing , log in to your account and provide your payment information to continue receiving our phishing reports!

Cyrillic homographs[1] are your friend here :-) http://сuttlерhish.com/account/billing (PunyCode [2]: http://xn--uttlhish-f8g4if.com/account/billing ) Also, it seems that Firefox (v38.0.5 Windows) doesn't convert URL interpuncts (mid-dots) into punycode, so clicking on something like http://www.billing·cuttlephish.com/ doesn't actually rewrite the URL in the address bar. Chrome converts it to http://www.xn--billingcu…

Filed https://bugzilla.mozilla.org/show_bug.cgi?id=1178095, thanks!

Re: Show HN: Phishing as a service

#68

Post by Buge »

ta92929 wrote: post #31
Buge wrote: post #22

I often intentionally click links to phishing sites, and sometimes enter in fake usernames and passwords. (I even wrote several bots to auto enter thousands of random usernames and passwords.) I don't like the click link = you lose idea.

What if the phishing site also has a 0 day?

If they have a 0 day for my browser, then they likely have an enormous budget with tons of ways of getting it to me besides phishing. I click so many links per day via reddit, HN, and other sites that the security gained by not clicking a phishing like is likely less than the education value of clicking it.

I think the actual danger for me of clicking a phishing link is opening a phishing tab, then moving on to another tab, then a while later coming back to the phishing tab but forgetting it was phishing and entering my password. 95% of the time I remember to check the url before entering my stuff, but everyone makes mistakes.

Re: Show HN: Phishing as a service

#69

Post by badinker »

chrissnell wrote: post #54

I wrote some Perl years back to take the fight to phishers. You would provide my script with the field names and POST URL of the HTML form within the phishing email, along with some generic types for each form field. There were types for firstnames, lastnames, email, addresses, usernames, passwords, social security numbers, and credit card numbers. The script would generate fake but real-looking values for each of th…

Do you still have a copy of that script? Would love to look at it.

Re: Show HN: Phishing as a service

#70

Post by Intermernet »

Manishearth wrote: post #67
Intermernet wrote: post #66

Earlier quoted context omitted.

Cyrillic homographs[1] are your friend here :-) http://сuttlерhish.com/account/billing (PunyCode [2]: http://xn--uttlhish-f8g4if.com/account/billing ) Also, it seems that Firefox (v38.0.5 Windows) doesn't convert URL interpuncts (mid-dots) into punycode, so clicking on something like http://www.billing·cuttlephish.com/ doesn't actually rewrite the URL in the address bar. Chrome converts it to http://www.xn--billingcu…

Filed https://bugzilla.mozilla.org/show_bug.cgi?id=1178095 , thanks!

No problem.

Out of interest, do the Firefox team and the Chromium team compare notes on decisions like this?

Purely in this one area (IDN homograph attacks), it might be an idea to look at the Chromium Unicode vetting rules (Which characters and combos get "punycoded") as they seem to be more conservative from a "Latin" perspective.

I'm not sure if a "blacklist" (mentioned in the bug report) is the best way of handling this. Perhaps only direct-encoding the "exemplar characters" for the language setting, and punycoding everything else? I'm pretty sure it would have eliminated the mid-dot issue, but perhaps this "whitelist" is too prohibitive.

Post reply on HN