1 00:00:00,000 --> 00:00:04,380 speakers are, I want to say this right, Yaza Rubio and Felix 2 00:00:04,380 --> 00:00:13,280 Bretho. All right. Yaza is an intelligence analyst with a 3 00:00:13,280 --> 00:00:15,980 background in information sciences, defense industry and 4 00:00:15,980 --> 00:00:19,240 cyber security. Felix is a computer engineer with a Ph.D. 5 00:00:19,240 --> 00:00:22,020 in computer science and telecommunications. They're well 6 00:00:22,020 --> 00:00:25,200 known as trainers of several law enforcement agencies in Europe 7 00:00:25,840 --> 00:00:29,360 regarding OSINT and also cryptocurrency research. Let's 8 00:00:29,360 --> 00:00:31,380 give them our attention. Their theme is heavy diving for 9 00:00:31,380 --> 00:00:38,100 credentials towards the perfect phishing. So thank you for the 10 00:00:38,100 --> 00:00:42,740 presentation. For us it's like great being here in Vegas just 11 00:00:42,740 --> 00:00:47,780 trying to show you one of the latest research that we have 12 00:00:47,780 --> 00:00:52,680 performed in 11 paths regarding phishing, phishing techniques and 13 00:00:52,680 --> 00:00:56,180 phishing methodologies just to try to make a phishing attack 14 00:00:56,180 --> 00:00:59,300 more anonymous and just to try to protect the identity of 15 00:00:59,300 --> 00:01:02,860 the phisher in this case, in this case of the attacker. So we 16 00:01:02,860 --> 00:01:08,100 know that it is the last talk of the day and we know that it's 17 00:01:08,100 --> 00:01:12,380 going to be just about 30 minutes. So it's going to be great 18 00:01:12,380 --> 00:01:17,000 and we're trying to make some exercises with you, with some 19 00:01:17,000 --> 00:01:21,820 bonus tracks. Now we ask for your collaboration because we 20 00:01:21,820 --> 00:01:27,780 have prepared some exercise for you. And there is a price of $25 21 00:01:29,420 --> 00:01:34,140 in bitcoins. In bitcoins. So maybe if you're lucky and the 22 00:01:34,140 --> 00:01:38,840 bitcoin price is rising in this moment, it's not $25 but maybe $30 23 00:01:38,840 --> 00:01:43,100 or $35. I think that it's increasing since yesterday quite a lot. 24 00:01:43,420 --> 00:01:47,140 First of all, we need to know which infrastructure will need a 25 00:01:47,140 --> 00:01:55,940 phisher. So the typical phishing attack is always compounded by an 26 00:01:55,940 --> 00:01:59,000 infrastructure which has been rented, hacked. 27 00:01:59,300 --> 00:02:05,380 Or somewhat hired by the attacker. The attacker will clone the website 28 00:02:05,380 --> 00:02:13,700 just to try to imitate the real website. Okay? The phishers usually try to 29 00:02:14,500 --> 00:02:19,500 register a domain that is similar to the original one just to, as a trick, to 30 00:02:20,660 --> 00:02:29,120 try to trick again the victim. These links are also being shared using social media 31 00:02:29,300 --> 00:02:36,740 platforms and emails. From the point of view of the victim, well the victim will get connected to 32 00:02:36,740 --> 00:02:42,980 that fake website and well the phisher will get the credential and then the phisher will be able to 33 00:02:42,980 --> 00:02:52,980 connect, to get connected to the legit domain. The registration of the domains is a key point for 34 00:02:52,980 --> 00:02:59,160 the researchers because the registrant will have the information about who has paid and the 35 00:02:59,160 --> 00:02:59,340 east side, so basically the phisher will have the information about who is the person that will have 36 00:02:59,340 --> 00:03:02,220 attack and it could be in different directions depending on the spread and method use. His 37 00:03:02,220 --> 00:03:08,080 identity, the attacker, could be exposed when he sign up in several platforms. So from the point of 38 00:03:08,080 --> 00:03:14,900 view of the attacker, there are some problems that he has to face. First of all, the infrastructure 39 00:03:14,900 --> 00:03:24,280 that he has, he has, he he's been using, it can say a lot of things of who he is and this is 40 00:03:24,280 --> 00:03:29,140 something that he has to protect. He has to hide any kind of footprints that this phisher will have. 41 00:03:29,140 --> 00:03:33,040 process, in this process there, there may be. So this is an 42 00:03:33,040 --> 00:03:36,680 important issue that we are going to face in this, this, in 43 00:03:36,680 --> 00:03:41,620 this sort of talk. Now we have another problem related to 44 00:03:41,620 --> 00:03:45,020 creative and credible. Each attacker will need to be as 45 00:03:45,020 --> 00:03:49,800 creative, as, as, and credible as possible. So the point is 46 00:03:49,800 --> 00:03:53,680 that when spreading the, the, the malicious links and the, 47 00:03:54,760 --> 00:03:58,140 well, you will have to find well-known platforms that will 48 00:03:58,140 --> 00:04:03,220 maximize the number of victims that, that you want to, to get if 49 00:04:03,220 --> 00:04:05,720 it is a massive phishing attack, or if it is a spear phishing 50 00:04:05,720 --> 00:04:08,820 attack, you want to make it as realistic as, as possible. So 51 00:04:08,820 --> 00:04:11,720 the, the, these issues are the ones that we are going to, to, 52 00:04:11,780 --> 00:04:16,840 to try to solve, to try to solve for a phisher in the following, 53 00:04:16,980 --> 00:04:19,640 the following minutes. The attacker's identity will need 54 00:04:19,640 --> 00:04:24,560 to be anonymous, and thus we are going to, to run a hidden 55 00:04:24,560 --> 00:04:28,120 services in Tor. We are going to show you an example of 56 00:04:28,120 --> 00:04:34,640 an example, but it is very easy. In fact, it's really easy. 57 00:04:34,800 --> 00:04:39,920 Have any of you deployed a hidden service once? It's, it's really 58 00:04:39,920 --> 00:04:43,740 easy once you have Tor installed. First, first of all, we have to 59 00:04:43,740 --> 00:04:48,540 Tor install, and then we have to, to deploy Tor as a service. 60 00:04:48,880 --> 00:04:53,120 Yeah, the next thing that we will need to do is just to verify 61 00:04:53,120 --> 00:04:57,520 that we are connected to, through Tor, so we can get our public IP 62 00:04:58,120 --> 00:05:01,440 address without being connected through Tor, and we can verify 63 00:05:01,440 --> 00:05:07,000 then the, the, the connection, the, we are running just the same 64 00:05:07,000 --> 00:05:10,040 command, but we've verified, verified command before, just to 65 00:05:10,040 --> 00:05:14,280 enroute, to, to, to send this, this connection through the Tor 66 00:05:14,280 --> 00:05:19,040 network. Really easy. Two commands to, to, to, to do it. 67 00:05:19,480 --> 00:05:25,460 Then we have to, to modify several lines, and we have to, to 68 00:05:25,460 --> 00:05:28,080 uncomment two lines in, in Tor. 69 00:05:28,120 --> 00:05:36,160 Tor RC file. Specifically, we have to uncomment these lines, 70 00:05:36,280 --> 00:05:39,580 hidden service deal and hidden service port. Two lines, two lines, 71 00:05:39,720 --> 00:05:45,200 two commands, so it's, it's really easy. And then we'll have to, 72 00:05:45,200 --> 00:05:50,060 to restart Tor as a service again. Yeah, because if not, the new 73 00:05:50,060 --> 00:05:53,380 configuration wouldn't have been, have been loaded. So, so this is, 74 00:05:53,420 --> 00:05:56,960 this is not a problem. What we are doing right now is, is starting 75 00:05:56,960 --> 00:05:58,100 an, an Apache server. Yeah, and then we have to, and then we have to 76 00:05:58,120 --> 00:06:03,680 add two server, which is the one that is, is being mapped in port 80, 77 00:06:03,920 --> 00:06:09,460 as we have seen in the configuration file. So, it's, it's, it's quite a 78 00:06:09,460 --> 00:06:13,360 straightforward right now. Then if we want to, to know which hidden 79 00:06:13,360 --> 00:06:18,660 services we, we have, we, we have to go to a hidden service path, and 80 00:06:19,020 --> 00:06:24,900 here we can find two, two files, and the file of, this file, hostname, 81 00:06:25,620 --> 00:06:28,100 we can find this, this, our hostname. So, we can find this, this, our 82 00:06:30,100 --> 00:06:35,420 .onion. So, if we want to launch a petition to .onion domain, if we 83 00:06:35,420 --> 00:06:41,740 did it with and the domain, we will, we will not be able to resolve that. 84 00:06:41,920 --> 00:06:46,840 But if we do it with , like, like in the example, we'll, we will be able 85 00:06:46,840 --> 00:06:51,540 to grab and to collect all the information from, from the, from that 86 00:06:51,540 --> 00:06:57,680 hidden service. But we have this approach, we have a problem, because, 87 00:06:58,120 --> 00:07:01,800 most users are normal users, and that do not use Tor. 88 00:07:02,240 --> 00:07:06,660 Yeah, so, and this is a point because, although Tor users have increased 89 00:07:06,660 --> 00:07:11,640 quite a lot, there are several studies that say that even in the countries 90 00:07:11,640 --> 00:07:17,200 with more penetration, like Moldova and Iceland, Tor users only 91 00:07:17,200 --> 00:07:23,580 represents the 300 users per 100,000 online common internet users. 92 00:07:23,740 --> 00:07:27,680 So, the, the, the, the figure, it's, unfortunately, quite, quite, 93 00:07:27,680 --> 00:07:27,820 quite. 94 00:07:28,120 --> 00:07:31,180 It's slow. So, we will have to find something different to try to make 95 00:07:31,180 --> 00:07:37,820 these hidden services available for a wider and a, a, a, a wider number of, 96 00:07:37,820 --> 00:07:40,800 of users, okay? To, to solve this problem, we are going 97 00:07:40,800 --> 00:07:45,780 to use Tor gateways. When we spread the malicious links through social 98 00:07:45,780 --> 00:07:50,080 network, we can use a gateway to redirect the victims to our hidden service. 99 00:07:50,440 --> 00:07:53,840 The point is that we are very lazy sometimes, and if we don't want to have 100 00:07:53,840 --> 00:07:57,720 Tor installed in our system to access to a, to a hidden service, we can 101 00:07:58,120 --> 00:08:08,320 use .onion.to, .onion.link, .onion.plus, .plus, which are Tor gateways that will let 102 00:08:08,320 --> 00:08:12,500 you access these domains, even if you don't have Tor browser bundled out or a Tor 103 00:08:12,500 --> 00:08:17,040 connection configured in your system. The point is that, if we found out when, 104 00:08:17,160 --> 00:08:23,060 during, during the, when we were doing this, this research, that some Tor 105 00:08:23,060 --> 00:08:27,900 gateways were providing additional information that we were not expecting, and we 106 00:08:27,900 --> 00:08:28,100 are, we are, we are, we are, we are, we are, we are, we are, we are, we are, we are, 107 00:08:28,100 --> 00:08:31,100 using it for, for fun, for profit, maybe. 108 00:08:33,340 --> 00:08:39,300 Now we are going to, to use, and which information is exposed by gateways? 109 00:08:39,580 --> 00:08:44,820 Okay. We are, we are going to see it in an example that we have released, the, the, 110 00:08:44,820 --> 00:08:52,180 the search code, we have released it in GitHub, so you will be able to, to see, to, 111 00:08:52,300 --> 00:08:56,560 to download it and perform your own, your own test. Okay, so maximize. 112 00:08:57,860 --> 00:09:04,080 First of all, we are, we are going to, first of all, we are going to download the hidden 113 00:09:04,080 --> 00:09:12,980 service that we have prepared for this demo, and, and it's created with, with Tor and, 114 00:09:13,620 --> 00:09:20,840 with Python and, and Sten. Sten is a, is a library to interact with, with Tor from, 115 00:09:20,940 --> 00:09:26,420 from Python. What, what we are doing right now is the 116 00:09:26,420 --> 00:09:30,440 deploying a, a very simple, but very simple, very simple hidden service that the only things 117 00:09:30,440 --> 00:09:38,060 that do is just showing the headers that each and every request, each and every request 118 00:09:38,060 --> 00:09:43,880 to this hidden service is being sending. Why? We, we are going to see, to, to see it why. 119 00:09:44,520 --> 00:09:51,740 So it's very easy. You, you get cloned and you install the requirements and then you 120 00:09:51,740 --> 00:09:56,220 Python, you, you press Python and, and start the, the, the, the application. 121 00:09:56,420 --> 00:09:57,460 It's really simple. Don't go off plate. 122 00:09:57,460 --> 00:10:00,980 Then we're going to see which is the IP address of the victim. 123 00:10:01,800 --> 00:10:08,520 Is this, and then we are going to notify, the connection, and, with, 124 00:10:08,660 --> 00:10:12,300 with aim to, to see the headers of this so that. 125 00:10:12,320 --> 00:10:14,120 We stop there. Stop there. 126 00:10:14,500 --> 00:10:21,360 You can see there that the headers sent by a , are, are almost five? 127 00:10:21,460 --> 00:10:24,000 Five or four headers? 128 00:10:24,160 --> 00:10:26,400 Okay. Almost no information regarding the, the, the kind of thing. 129 00:10:26,400 --> 00:10:31,020 the user that got connected to this domain using Torrify Core, okay? 130 00:10:31,200 --> 00:10:36,800 But what happens when we do this using, stop there, okay? 131 00:10:36,960 --> 00:10:41,240 When we do this using Onion.link platform? 132 00:10:41,600 --> 00:10:45,900 Well, we can find something really interesting because amongst the headers, 133 00:10:46,120 --> 00:10:50,040 one of the headers that was being sent, it's X real IP. 134 00:10:50,380 --> 00:10:56,040 So Onion.link was sending to the hidden service the real IP address of the guy 135 00:10:56,040 --> 00:10:57,800 that wanted to get connected to it. 136 00:10:57,940 --> 00:11:01,720 So you can think about how this information can be used. 137 00:11:01,840 --> 00:11:07,820 If there is a user that is getting connected to, for instance, a pornographic website, 138 00:11:08,160 --> 00:11:14,680 the administrator of the pornographic website will know which is the real IP address of the guy. 139 00:11:14,860 --> 00:11:17,600 Torr was not intended to be used in that way, 140 00:11:17,740 --> 00:11:22,660 but if you use Torr Gateway, maybe your information can be exposed. 141 00:11:22,820 --> 00:11:25,840 So please avoid using them and download and install. 142 00:11:26,040 --> 00:11:28,920 Download the Torr browser bundle or configure your own Torr connection 143 00:11:28,920 --> 00:11:33,700 because you don't know what kind of information can be sent, okay? 144 00:11:33,880 --> 00:11:38,340 This first problem, we have addressed it, but we have... 145 00:11:38,340 --> 00:11:39,720 Because we have a hidden service. 146 00:11:39,880 --> 00:11:50,620 We have a server that is exposed as a hidden service and with a Torr Gateway for the surface users. 147 00:11:50,640 --> 00:11:55,420 Now we have deployed an anonymous phishing. 148 00:11:56,140 --> 00:11:58,380 But now we have another problem. 149 00:11:58,860 --> 00:12:04,140 Now we have another problem related to creative and credible of the attacks. 150 00:12:05,200 --> 00:12:09,580 So the problem is that Onion.links are too long. 151 00:12:09,820 --> 00:12:15,220 So it's very easy to see if you are being directed to an Onion website. 152 00:12:15,620 --> 00:12:24,060 Well, there are some tricks that we are going to use just to try to make the deception better, okay? 153 00:12:25,060 --> 00:12:26,020 First of all... 154 00:12:26,040 --> 00:12:27,820 First of all, we ask you to go to Kahoot. 155 00:12:27,940 --> 00:12:31,080 Does anyone know Kahoot.it? 156 00:12:31,260 --> 00:12:35,160 Kahoot.it is a platform that we are going to use to give you $25. 157 00:12:35,520 --> 00:12:41,080 So we are going to encourage you to go to Kahoot.it. 158 00:12:41,580 --> 00:12:49,440 And the only thing that you will need is to insert the code that Jaitha is going to show you. 159 00:12:49,780 --> 00:12:55,600 Because here we will ask you some questions regarding these facts. 160 00:12:56,040 --> 00:13:04,540 If you want to win the BitQuest, you will have to go to this platform. 161 00:13:05,200 --> 00:13:05,280 Okay. 162 00:13:05,660 --> 00:13:08,440 Kahoot.it. 163 00:13:08,820 --> 00:13:09,280 Okay. 164 00:13:09,420 --> 00:13:10,700 Go to my Kahoot. 165 00:13:11,120 --> 00:13:14,380 Wait there because we will need to show you the... 166 00:13:14,380 --> 00:13:15,140 Okay. 167 00:13:16,980 --> 00:13:21,140 So you will need to insert the following PIN code that... 168 00:13:22,480 --> 00:13:24,280 The following PIN code... 169 00:13:24,860 --> 00:13:26,020 That is going to... 170 00:13:26,040 --> 00:13:26,860 That is going to be shown in the screen. 171 00:13:27,300 --> 00:13:28,880 And we are going to put you... 172 00:13:28,880 --> 00:13:31,480 I think that they are very easy challenges. 173 00:13:31,840 --> 00:13:36,540 But, well, just the fastest one will be awarded with a $25 prize. 174 00:13:38,340 --> 00:13:38,820 Okay. 175 00:13:39,480 --> 00:13:40,860 So, hold on a second. 176 00:13:41,060 --> 00:13:41,880 We are deploying it. 177 00:13:42,880 --> 00:13:46,560 If you are in Kahoot.it, it is requested for a PIN. 178 00:13:46,620 --> 00:13:48,480 Insert the one that is there. 179 00:13:48,960 --> 00:13:50,940 We have here the PIN. 180 00:13:51,800 --> 00:13:52,760 Four, five... 181 00:13:52,760 --> 00:13:53,420 Kahoot.it. 182 00:13:53,760 --> 00:13:54,200 Okay. 183 00:13:54,240 --> 00:13:55,260 Kahoot.it. 184 00:13:56,040 --> 00:13:59,920 And we have to introduce four, five, eight, seven. 185 00:14:00,620 --> 00:14:01,600 So, very simple PIN. 186 00:14:01,640 --> 00:14:03,060 Four, five, eight, seven. 187 00:14:03,280 --> 00:14:03,720 Okay. 188 00:14:03,780 --> 00:14:05,900 And insert the nickname, whatever you want. 189 00:14:06,060 --> 00:14:08,800 The point is that it will be shown in the screen. 190 00:14:08,920 --> 00:14:13,120 So, please do not use any kind of things strange. 191 00:14:13,680 --> 00:14:14,120 Okay. 192 00:14:14,120 --> 00:14:14,420 So... 193 00:14:15,020 --> 00:14:15,660 Wait, wait. 194 00:14:16,440 --> 00:14:16,880 Okay. 195 00:14:17,300 --> 00:14:18,340 We have three users. 196 00:14:20,320 --> 00:14:21,360 We have three users. 197 00:14:21,720 --> 00:14:24,240 Now we are going to do a test. 198 00:14:24,420 --> 00:14:24,460 Yes. 199 00:14:24,740 --> 00:14:26,480 Have we understood the game? 200 00:14:26,920 --> 00:14:27,440 Okay. 201 00:14:27,480 --> 00:14:30,340 If you have understood the game, press yes. 202 00:14:30,460 --> 00:14:33,880 And we don't have to understand the game, press no. 203 00:14:34,640 --> 00:14:35,160 Okay. 204 00:14:35,740 --> 00:14:36,640 Four answers. 205 00:14:36,920 --> 00:14:37,800 Till the moment. 206 00:14:38,020 --> 00:14:38,820 Any more answers? 207 00:14:40,200 --> 00:14:40,720 Okay. 208 00:14:40,780 --> 00:14:41,340 Just four. 209 00:14:41,420 --> 00:14:41,760 Six. 210 00:14:43,200 --> 00:14:43,720 Six. 211 00:14:43,820 --> 00:14:44,020 Okay. 212 00:14:44,240 --> 00:14:45,020 Time's running out. 213 00:14:45,120 --> 00:14:45,980 Well, six answers. 214 00:14:46,240 --> 00:14:47,820 So, most people... 215 00:14:47,820 --> 00:14:48,900 We have no trolls here. 216 00:14:49,100 --> 00:14:50,440 Most people have understood the game. 217 00:14:50,580 --> 00:14:50,940 Okay. 218 00:14:51,000 --> 00:14:53,420 So, we are going to put some challenges here. 219 00:14:53,560 --> 00:14:54,260 You have to... 220 00:14:54,260 --> 00:14:58,580 You have to pay attention to what we are going to see here, 221 00:14:58,800 --> 00:15:01,560 because the skills that we are going to show 222 00:15:01,560 --> 00:15:03,220 are the ones that a phisher, 223 00:15:03,340 --> 00:15:05,000 that we are going to implement in the phishing attacks 224 00:15:05,000 --> 00:15:07,480 that we are using later technically. 225 00:15:07,760 --> 00:15:07,920 Okay? 226 00:15:08,680 --> 00:15:11,200 The next challenge is related to attention. 227 00:15:11,540 --> 00:15:16,500 In which quadrant is located the only W in this image? 228 00:15:16,820 --> 00:15:17,220 Okay. 229 00:15:17,280 --> 00:15:17,920 Upper left. 230 00:15:17,960 --> 00:15:18,640 Upper left. 231 00:15:18,700 --> 00:15:19,600 Upper right. 232 00:15:19,820 --> 00:15:20,920 Lower left. 233 00:15:21,140 --> 00:15:22,020 Lower right. 234 00:15:22,080 --> 00:15:23,860 Where is the only W? 235 00:15:24,260 --> 00:15:25,200 In this image. 236 00:15:25,540 --> 00:15:26,700 It's difficult, right? 237 00:15:28,260 --> 00:15:29,520 It's really difficult. 238 00:15:33,560 --> 00:15:35,200 Do you know why it's difficult? 239 00:15:35,480 --> 00:15:37,420 It's difficult because letters are very similar. 240 00:15:37,860 --> 00:15:41,780 So, this is a technique that most phishers tend to use 241 00:15:41,780 --> 00:15:45,080 when cyber-squatting, when performing cyber-squatting attacks, 242 00:15:45,360 --> 00:15:52,140 just in trying to emulate the original domains of common trademarks. 243 00:15:52,300 --> 00:15:53,300 Some people change. 244 00:15:54,260 --> 00:15:58,840 The M for an R and an N. 245 00:15:58,960 --> 00:16:02,000 So, it looks like the same in most browsers. 246 00:16:02,500 --> 00:16:08,080 So, this is something that we may be using, 247 00:16:08,260 --> 00:16:12,000 would be useful for us to ship an appropriate phishing. 248 00:16:12,160 --> 00:16:14,020 Please don't close the app. 249 00:16:14,260 --> 00:16:14,940 Don't close the app. 250 00:16:14,980 --> 00:16:15,400 Don't close the app. 251 00:16:15,460 --> 00:16:17,240 We are coming back in a couple of minutes. 252 00:16:17,720 --> 00:16:18,240 Okay? 253 00:16:18,580 --> 00:16:18,880 Okay. 254 00:16:18,960 --> 00:16:19,380 Okay. 255 00:16:19,600 --> 00:16:23,700 These type of practice exercises are needed when conducting a phishing attack. 256 00:16:24,380 --> 00:16:29,620 But we have to improve the image of the .onion domain 257 00:16:29,620 --> 00:16:32,280 because it's so long. 258 00:16:33,760 --> 00:16:36,040 We have two approaches here. 259 00:16:36,160 --> 00:16:36,640 Two approaches. 260 00:16:36,780 --> 00:16:39,760 The typical approach is using a vanity domain. 261 00:16:40,040 --> 00:16:43,560 Do you know vanity Bitcoin addresses that tend to use? 262 00:16:43,680 --> 00:16:51,580 Well, users tend to create a Bitcoin address that starts with a given word. 263 00:16:51,700 --> 00:16:53,700 We can do the same with .onion. 264 00:16:54,260 --> 00:16:55,100 .onion domains. 265 00:16:55,400 --> 00:16:59,260 We can use tools like Shallot that are available in GitHub 266 00:16:59,260 --> 00:17:03,520 and just saying to Shallot, 267 00:17:03,600 --> 00:17:09,440 okay, I want my domain to start with Twitter or Facebook or whatever. 268 00:17:09,780 --> 00:17:16,020 And we can let the tool try to generate as many .onion domains as he can 269 00:17:16,020 --> 00:17:21,840 until he finds a domain that matches with this approach. 270 00:17:22,180 --> 00:17:22,900 So, this is one. 271 00:17:23,220 --> 00:17:24,140 Generating vanity. 272 00:17:24,140 --> 00:17:25,020 Generating the domains, okay? 273 00:17:25,460 --> 00:17:27,180 It may take a lot of time. 274 00:17:27,380 --> 00:17:29,220 In fact, we tried to do it with Twitter, 275 00:17:29,340 --> 00:17:32,120 which is Twitter, which is six letters. 276 00:17:32,360 --> 00:17:35,420 And we were waiting for eight hours 277 00:17:35,420 --> 00:17:38,500 and we couldn't generate it in our computer. 278 00:17:38,660 --> 00:17:40,440 So, it's a difficult task. 279 00:17:40,780 --> 00:17:45,360 However, there is also another trick to simple works 280 00:17:45,360 --> 00:17:47,260 using a cool subdomain. 281 00:17:47,560 --> 00:17:50,400 Before the blah, blah, blah, blah, blah, .onion. 282 00:17:50,500 --> 00:17:53,760 Now, we are going to see one. 283 00:17:54,140 --> 00:17:56,300 One example with DuckDuckGo. 284 00:17:56,700 --> 00:18:01,060 DuckDuckGo is a search engine that many of you know, DuckDuckGo. 285 00:18:01,420 --> 00:18:05,960 DuckDuckGo, the point is that it also has a hidden service, 286 00:18:06,200 --> 00:18:12,100 a .onion version of the browser that can be reached only using Tor. 287 00:18:12,280 --> 00:18:18,780 Okay, we can see this is the domain of DuckDuckGo. 288 00:18:20,080 --> 00:18:23,420 And we are going to do a very simple trick 289 00:18:23,420 --> 00:18:25,520 that many people don't know about onion domains, 290 00:18:25,780 --> 00:18:29,240 but that can be useful for us when we want to conduct a phishing attack, okay? 291 00:18:29,460 --> 00:18:36,940 We only have to put before, for example, twitter.com.blahblah.onion 292 00:18:36,940 --> 00:18:47,380 or another example, for example, facebook.com.has.blahblahblahblah.onion. 293 00:18:47,900 --> 00:18:51,480 And you may be asking, this is happening only in DuckDuckGo? 294 00:18:51,580 --> 00:18:51,840 No. 295 00:18:52,100 --> 00:18:52,780 No, because... 296 00:18:53,700 --> 00:18:58,800 The point is that for discovering where a hidden service is inside the Tor network, 297 00:18:59,100 --> 00:19:03,820 the only part important is the domain, not the subdomain, okay? 298 00:19:03,960 --> 00:19:06,820 So, we can put whatever we want in the subdomain part. 299 00:19:07,060 --> 00:19:13,180 So, in our cases, we would like to put some things that look like the original website, 300 00:19:13,400 --> 00:19:15,180 just to trick the user. 301 00:19:15,440 --> 00:19:19,680 So, for instance, if we want to emulate a twitter domain, 302 00:19:20,400 --> 00:19:23,400 we can put twitter.com.blahblahblah.onion. 303 00:19:23,420 --> 00:19:28,220 So, this is a very simple trick that simply works. 304 00:19:28,500 --> 00:19:32,860 And it is something that happens because of how Tor is structured, 305 00:19:33,100 --> 00:19:34,640 and how Tor was conceived. 306 00:19:35,100 --> 00:19:40,240 So, two approaches, vanity domains and this small trick with subdomains. 307 00:19:40,600 --> 00:19:42,580 This problem we have addressed, 308 00:19:42,680 --> 00:19:48,080 but we have another problem related to spreeing the attacks. 309 00:19:48,480 --> 00:19:52,220 So, we are going back to the Kahoot. 310 00:19:52,340 --> 00:19:52,620 Yes. 311 00:19:53,420 --> 00:19:56,840 The ones that have taken part until now. 312 00:19:58,040 --> 00:19:59,600 Go back to Kahoot, okay? 313 00:19:59,700 --> 00:20:04,680 We can see that Jmaxx is in the lead with 826 points. 314 00:20:04,880 --> 00:20:09,980 And we are going to put two more challenges regarding misdirecting the attention of the victim, 315 00:20:10,500 --> 00:20:11,920 as usual, misdirecting. 316 00:20:11,980 --> 00:20:14,360 And the other one is regarding movement. 317 00:20:14,740 --> 00:20:21,200 So, it is just a matter of answering the question that is appearing at the end of the video 318 00:20:21,200 --> 00:20:22,840 that you are going to see right now. 319 00:20:23,840 --> 00:20:24,280 Okay? 320 00:20:24,480 --> 00:20:26,940 Have anybody of you been in London before? 321 00:20:27,560 --> 00:20:29,160 Have anybody of you been in London? 322 00:20:29,380 --> 00:20:31,180 I have been in London, but only once. 323 00:20:31,860 --> 00:20:32,140 Okay. 324 00:20:32,200 --> 00:20:32,740 I'm sorry. 325 00:20:32,860 --> 00:20:33,300 I'm sorry. 326 00:20:33,360 --> 00:20:36,180 I was just tricking you, just trying to misdirect attention. 327 00:20:36,280 --> 00:20:44,560 Because the question that we are putting there is what time was in the big bell tower that was shown in the photo. 328 00:20:44,740 --> 00:20:45,120 Okay? 329 00:20:45,200 --> 00:20:51,000 So, the trick is just a matter of misdirecting the attention, as we are going to do in the efficient. 330 00:20:51,260 --> 00:20:52,320 The answers are six. 331 00:20:52,620 --> 00:20:53,220 Are six? 332 00:20:53,420 --> 00:20:57,420 6 p.m., 7 p.m., 8 p.m., or 9 p.m.? 333 00:20:57,420 --> 00:21:03,520 If you have noticed, if you have remembered which was the hour in the clock, 334 00:21:03,820 --> 00:21:11,020 well, you should guess which is the core cancer, which was 8 p.m. 335 00:21:11,020 --> 00:21:11,200 Okay. 336 00:21:11,280 --> 00:21:12,540 Sorry for the trick. 337 00:21:12,980 --> 00:21:20,160 But misdirecting the attention is one important, a very important issue when you want to conduct also a phishing attack. 338 00:21:20,320 --> 00:21:23,020 And we are going to go through a technique. 339 00:21:23,420 --> 00:21:28,100 That works very well with this. 340 00:21:28,340 --> 00:21:32,060 The second, the third challenge is the movement challenge. 341 00:21:32,860 --> 00:21:48,340 Because the human mind and the human eye works in a way that makes slow changes be almost, or be very difficult to be noticed by the eye. 342 00:21:48,620 --> 00:21:52,700 The question is, how many elements are slowly changing in the photo? 343 00:21:53,420 --> 00:21:56,100 To start changing right now. 344 00:21:56,380 --> 00:21:57,940 Keep an eye on the photo. 345 00:21:58,060 --> 00:21:58,860 Keep an eye on the photo. 346 00:21:59,340 --> 00:21:59,780 Okay. 347 00:21:59,860 --> 00:22:03,240 Keep an eye on the photo and try to find the elements that are being changing. 348 00:22:04,420 --> 00:22:04,860 Okay. 349 00:22:04,900 --> 00:22:05,280 Keep an eye. 350 00:22:05,400 --> 00:22:06,220 Have you seen them? 351 00:22:06,700 --> 00:22:07,900 Have you seen any of them? 352 00:22:08,760 --> 00:22:10,940 Have you seen any changes in the photo? 353 00:22:11,800 --> 00:22:13,340 No changes in the photo? 354 00:22:13,600 --> 00:22:14,840 Well, at least... 355 00:22:14,840 --> 00:22:16,040 From zero to three? 356 00:22:17,320 --> 00:22:17,760 Okay. 357 00:22:18,080 --> 00:22:18,520 Okay. 358 00:22:18,600 --> 00:22:19,820 They're having some changes. 359 00:22:20,100 --> 00:22:21,200 The plane has been removed. 360 00:22:21,440 --> 00:22:22,700 The factory was removed. 361 00:22:22,900 --> 00:22:23,320 The... 362 00:22:23,420 --> 00:22:28,580 The colors of the houses were changed. 363 00:22:28,920 --> 00:22:31,840 There were some windows that were changing, too. 364 00:22:31,980 --> 00:22:34,580 The point is that the changes were taking place slowly. 365 00:22:34,980 --> 00:22:40,760 So, they were taking place slowly, and it was really difficult for us to see the difference. 366 00:22:40,980 --> 00:22:43,920 If something happens very quickly, it's very easy to notice. 367 00:22:44,620 --> 00:22:46,040 So, these two... 368 00:22:46,040 --> 00:22:48,720 So, by the way, J-Max, which is J-Max? 369 00:22:49,240 --> 00:22:50,400 Okay, J-Max, congratulations. 370 00:22:50,660 --> 00:22:51,760 We will... 371 00:22:51,760 --> 00:22:52,740 We will... 372 00:22:52,740 --> 00:22:53,400 We will... 373 00:22:53,400 --> 00:22:57,520 You have been awarded with $25, about $25 in BitFace. 374 00:22:58,180 --> 00:23:02,280 Lately, we will pay for them at the end of the talk. 375 00:23:02,520 --> 00:23:07,400 But the point is that these two ideas, movement and misdirection, 376 00:23:07,500 --> 00:23:11,040 are really important for conducting an appropriate phasing. 377 00:23:11,180 --> 00:23:15,540 And there is a technique that can help us, like reverse tab nabbing. 378 00:23:15,840 --> 00:23:17,960 But what is reverse tab nabbing? 379 00:23:18,040 --> 00:23:23,280 It consists of modifying the content of the browser tab that stays in the... 380 00:23:24,040 --> 00:23:30,220 That's when the user goes back to the tab, he will be in another website, controlled by the attacker. 381 00:23:30,800 --> 00:23:36,880 So, the idea can be implemented really easily with just, and it's true, a couple of lines of JavaScript code. 382 00:23:37,160 --> 00:23:39,040 You can copy that JavaScript code. 383 00:23:39,140 --> 00:23:46,500 We have some POCs that we are going to see in a few seconds. 384 00:23:47,180 --> 00:23:48,360 And it's really easy. 385 00:23:48,440 --> 00:23:51,380 What we are doing here is just exploiting the way in which... 386 00:23:52,080 --> 00:23:52,340 New... 387 00:23:53,280 --> 00:23:57,020 New links are being opened in new tabs. 388 00:23:57,540 --> 00:24:07,100 Some websites, like Google+, are not properly configured to prevent a newly opened tab 389 00:24:07,100 --> 00:24:11,300 to modify the original tab in which it was clicked. 390 00:24:11,560 --> 00:24:12,940 We are going to see it with an example later. 391 00:24:12,940 --> 00:24:15,460 Now we are going to see how it works in Google+. 392 00:24:15,460 --> 00:24:19,400 First of all, we have published... 393 00:24:19,920 --> 00:24:21,600 In our own website, a POC. 394 00:24:21,640 --> 00:24:22,900 This POC. 395 00:24:23,540 --> 00:24:31,620 When the user presses on it, he will redirect to DEFCON.org, for example. 396 00:24:31,820 --> 00:24:36,040 But the previous tab has been changed. 397 00:24:36,440 --> 00:24:41,740 So, this is an issue because any link that is opened into a new tab in Google+, this does not work. 398 00:24:41,820 --> 00:24:45,040 For example, in Twitter, because they are protected. 399 00:24:45,220 --> 00:24:46,340 In Instagram, because they are protected. 400 00:24:46,600 --> 00:24:52,020 In the Facebook original website, it doesn't work either. 401 00:24:52,180 --> 00:24:52,820 But it works. 402 00:24:53,280 --> 00:24:55,400 In the mobile version of Facebook. 403 00:24:55,660 --> 00:24:58,280 It works in the Outlook light web app version. 404 00:24:58,740 --> 00:25:03,280 It works in Mail.ru light application. 405 00:25:03,820 --> 00:25:11,740 And it used to work even in LinkedIn until we reported all these small bugs to them. 406 00:25:11,880 --> 00:25:14,700 LinkedIn thought that it was not a security issue. 407 00:25:15,020 --> 00:25:19,520 The point is that many platforms, many other platforms, have already modified it. 408 00:25:19,640 --> 00:25:23,160 And they answered us that, okay, this is something that cannot be... 409 00:25:23,280 --> 00:25:24,160 Cannot be prevented. 410 00:25:24,360 --> 00:25:26,220 In two weeks' time, they modified it. 411 00:25:26,320 --> 00:25:27,420 And they said nothing to us. 412 00:25:27,460 --> 00:25:28,920 So, please say hello or something. 413 00:25:29,320 --> 00:25:35,760 Now, we are going to put all the pieces together with the problem we have seen before. 414 00:25:36,600 --> 00:25:38,980 Now, we are going to see the POC. 415 00:25:39,120 --> 00:25:42,800 The final POC with all of these parts. 416 00:25:42,880 --> 00:25:44,920 The parts of the demo are three. 417 00:25:45,360 --> 00:25:51,140 First of all, we have to create a malicious website with a malicious link. 418 00:25:51,680 --> 00:25:53,180 In a hidden search. 419 00:25:53,280 --> 00:25:55,420 So, if we have a hidden service, it's okay. 420 00:25:55,520 --> 00:25:58,600 But we would only be targeting Tor users. 421 00:25:58,980 --> 00:26:01,680 No, but we don't want that. 422 00:26:02,140 --> 00:26:07,680 We want common users, normal users, to be vulnerable to this issue. 423 00:26:07,820 --> 00:26:08,500 So, what can we do? 424 00:26:08,620 --> 00:26:09,300 We have seen it. 425 00:26:09,420 --> 00:26:14,700 Using a Tor gateway, like onion.link, onion.to, onion.plus, or whatever. 426 00:26:15,020 --> 00:26:17,160 And we are sending the... 427 00:26:19,020 --> 00:26:21,900 We are sharing the URL into... 428 00:26:23,280 --> 00:26:25,660 From a platform, like in this case, it is Google+. 429 00:26:25,660 --> 00:26:26,120 Google+. 430 00:26:26,120 --> 00:26:32,560 The publication in Google+, will have to be relevant for the user, 431 00:26:32,740 --> 00:26:36,620 with the aim to spend some time there. 432 00:26:36,880 --> 00:26:40,220 And then, he will redirect to... 433 00:26:40,220 --> 00:26:46,400 While he reads all the news and all the articles, what happens in the background? 434 00:26:46,600 --> 00:26:51,320 In this case, he will redirect to Telegraph. 435 00:26:51,380 --> 00:26:52,260 To Telegraph. 436 00:26:52,540 --> 00:26:53,140 And... 437 00:26:53,280 --> 00:26:59,760 The previous tab will have been changed with the phishing domain. 438 00:27:00,020 --> 00:27:05,400 With the phishing that will be hosted in a hidden service, using onion.link, onion.whatever. 439 00:27:05,680 --> 00:27:10,480 So, we are going to see it, and we are going to analyze the consequences of this approach. 440 00:27:13,240 --> 00:27:13,780 Okay. 441 00:27:13,820 --> 00:27:22,180 So, in the example, we have a URL that we are sharing a URL with something that we find that can be clicked by... 442 00:27:22,180 --> 00:27:23,260 By lots of... 443 00:27:23,260 --> 00:27:23,380 By lots of people. 444 00:27:23,680 --> 00:27:28,900 So, while the user clicks on it, the Telegraph article is there. 445 00:27:29,160 --> 00:27:30,380 The user is reading that. 446 00:27:30,520 --> 00:27:35,600 And what has happened before in the previous tab, in the tab in which it was the Google+, the publication, 447 00:27:35,980 --> 00:27:39,380 it has been changed onto a hidden service. 448 00:27:39,680 --> 00:27:42,180 So, from our point of view, it's really good. 449 00:27:42,400 --> 00:27:44,280 Because we have deployed a hidden service. 450 00:27:44,500 --> 00:27:51,780 We have deployed a phishing website into a hidden service. 451 00:27:51,980 --> 00:27:53,020 And when the researcher... 452 00:27:53,260 --> 00:27:54,000 Wants to... 453 00:27:54,000 --> 00:27:54,420 Okay. 454 00:27:54,480 --> 00:27:55,540 Who is behind that? 455 00:27:55,680 --> 00:27:56,700 Who is behind this attack? 456 00:27:56,940 --> 00:27:59,840 I want to close down that phishing website. 457 00:28:00,400 --> 00:28:01,140 He can't. 458 00:28:01,180 --> 00:28:05,160 Because he doesn't know where the hidden service is located. 459 00:28:05,520 --> 00:28:05,900 Why? 460 00:28:05,960 --> 00:28:06,700 Because it is in Tor. 461 00:28:07,140 --> 00:28:07,580 Okay? 462 00:28:07,800 --> 00:28:11,400 So, it's a nice approach. 463 00:28:11,520 --> 00:28:13,140 Just combining different techniques. 464 00:28:13,360 --> 00:28:14,620 And reverse tab nabbing. 465 00:28:14,660 --> 00:28:15,440 And Tor gateways. 466 00:28:15,500 --> 00:28:15,860 And Tor. 467 00:28:16,160 --> 00:28:18,100 And this is really, really nice. 468 00:28:18,180 --> 00:28:20,700 Because phishers will be somewhat protected. 469 00:28:21,100 --> 00:28:21,680 But it's true. 470 00:28:21,800 --> 00:28:22,160 It's true. 471 00:28:22,220 --> 00:28:23,220 We have to recognize that. 472 00:28:23,260 --> 00:28:25,140 That this has some limitations. 473 00:28:26,880 --> 00:28:27,880 Still, yeah. 474 00:28:28,120 --> 00:28:32,160 Still, the onion links are too long. 475 00:28:32,260 --> 00:28:35,020 So, we have to fight with that. 476 00:28:35,400 --> 00:28:38,020 Tor gateways are sometimes too slow and unstable. 477 00:28:38,200 --> 00:28:41,300 And may become a too clear indicator of the attack. 478 00:28:41,680 --> 00:28:42,040 Yeah. 479 00:28:42,060 --> 00:28:46,680 So, these websites are not always as fast as we expected. 480 00:28:46,900 --> 00:28:48,920 If you are used to Tor connections, 481 00:28:49,120 --> 00:28:50,460 Tor connections are sometimes slow. 482 00:28:50,680 --> 00:28:52,040 So, we have to... 483 00:28:52,040 --> 00:28:53,240 We have to... 484 00:28:53,240 --> 00:28:57,640 We have to find an article in which the user will spend at least some seconds 485 00:28:57,640 --> 00:29:02,240 until the website, the fake website is being loaded. 486 00:29:04,580 --> 00:29:05,320 And what else? 487 00:29:05,500 --> 00:29:06,120 And the other one? 488 00:29:06,240 --> 00:29:06,400 Okay. 489 00:29:06,620 --> 00:29:12,820 We have published the link into a social network with our own user. 490 00:29:13,000 --> 00:29:14,200 So, this is still a problem. 491 00:29:14,300 --> 00:29:19,320 Because I will need to find a social network and a social profile 492 00:29:20,660 --> 00:29:22,640 that has to be created anonymously. 493 00:29:22,680 --> 00:29:23,220 So, it has to be... 494 00:29:23,220 --> 00:29:24,700 It has to be perfectly anonymous. 495 00:29:24,880 --> 00:29:26,680 So, this is still an issue that has to be dealt. 496 00:29:26,980 --> 00:29:29,160 Although there are a lot of Tor gateways, 497 00:29:29,320 --> 00:29:33,000 like onion.plus or onion.link or onion.to, 498 00:29:34,260 --> 00:29:39,780 the best gateways to do this attack, 499 00:29:40,480 --> 00:29:42,820 in our opinion, 500 00:29:43,100 --> 00:29:46,100 are onion.plus or onion.link 501 00:29:46,100 --> 00:29:49,600 because it permits .onion subdomains 502 00:29:49,600 --> 00:29:52,980 and leak personal information, 503 00:29:53,220 --> 00:29:54,020 about the victim. 504 00:29:54,320 --> 00:29:54,680 Yeah. 505 00:29:54,920 --> 00:29:57,320 Because onion.to, onion.guide and so on, 506 00:29:57,380 --> 00:29:59,640 when you use the subdomain trick, 507 00:29:59,840 --> 00:30:02,580 they raise an SSL error and so on. 508 00:30:02,640 --> 00:30:05,180 So, they are not as good as the other ones. 509 00:30:05,340 --> 00:30:09,320 But, meanwhile, onion.link and onion.plus 510 00:30:09,320 --> 00:30:12,900 are good approaches to perform this phishing. 511 00:30:13,020 --> 00:30:16,400 So, it's everything for our site. 512 00:30:16,520 --> 00:30:19,440 I think that all of us want to go out tonight 513 00:30:19,440 --> 00:30:20,420 and it's so late. 514 00:30:20,520 --> 00:30:21,400 We are hungry. 515 00:30:21,660 --> 00:30:22,480 Even for... 516 00:30:23,700 --> 00:30:25,320 Even for Spanish guys 517 00:30:25,320 --> 00:30:27,340 who tend to have dinner too late. 518 00:30:28,060 --> 00:30:30,480 So, we are waiting for your questions and comments 519 00:30:30,480 --> 00:30:35,060 and, anyway, you can contact us later. 520 00:30:35,360 --> 00:30:37,060 Thank you so much for attending, okay? 521 00:30:37,740 --> 00:30:38,300 Thank you. 522 00:30:38,300 --> 00:30:39,580 Thank you.