speakers are, I want to say this right, Yaza Rubio and Felix
Bretho. All right. Yaza is an intelligence analyst with a
background in information sciences, defense industry and
cyber security. Felix is a computer engineer with a Ph.D.
in computer science and telecommunications. They're well
known as trainers of several law enforcement agencies in Europe
regarding OSINT and also cryptocurrency research. Let's
give them our attention. Their theme is heavy diving for
credentials towards the perfect phishing. So thank you for the
presentation. For us it's like great being here in Vegas just
trying to show you one of the latest research that we have
performed in 11 paths regarding phishing, phishing techniques and
phishing methodologies just to try to make a phishing attack
more anonymous and just to try to protect the identity of
the phisher in this case, in this case of the attacker. So we
know that it is the last talk of the day and we know that it's
going to be just about 30 minutes. So it's going to be great
and we're trying to make some exercises with you, with some
bonus tracks. Now we ask for your collaboration because we
have prepared some exercise for you. And there is a price of $25
in bitcoins. In bitcoins. So maybe if you're lucky and the
bitcoin price is rising in this moment, it's not $25 but maybe $30
or $35. I think that it's increasing since yesterday quite a lot.
First of all, we need to know which infrastructure will need a
phisher. So the typical phishing attack is always compounded by an
infrastructure which has been rented, hacked.
Or somewhat hired by the attacker. The attacker will clone the website
just to try to imitate the real website. Okay? The phishers usually try to
register a domain that is similar to the original one just to, as a trick, to
try to trick again the victim. These links are also being shared using social media
platforms and emails. From the point of view of the victim, well the victim will get connected to
that fake website and well the phisher will get the credential and then the phisher will be able to
connect, to get connected to the legit domain. The registration of the domains is a key point for
the researchers because the registrant will have the information about who has paid and the
east side, so basically the phisher will have the information about who is the person that will have
attack and it could be in different directions depending on the spread and method use. His
identity, the attacker, could be exposed when he sign up in several platforms. So from the point of
view of the attacker, there are some problems that he has to face. First of all, the infrastructure
that he has, he has, he he's been using, it can say a lot of things of who he is and this is
something that he has to protect. He has to hide any kind of footprints that this phisher will have.
process, in this process there, there may be. So this is an
important issue that we are going to face in this, this, in
this sort of talk. Now we have another problem related to
creative and credible. Each attacker will need to be as
creative, as, as, and credible as possible. So the point is
that when spreading the, the, the malicious links and the,
well, you will have to find well-known platforms that will
maximize the number of victims that, that you want to, to get if
it is a massive phishing attack, or if it is a spear phishing
attack, you want to make it as realistic as, as possible. So
the, the, these issues are the ones that we are going to, to,
to try to solve, to try to solve for a phisher in the following,
the following minutes. The attacker's identity will need
to be anonymous, and thus we are going to, to run a hidden
services in Tor. We are going to show you an example of
an example, but it is very easy. In fact, it's really easy.
Have any of you deployed a hidden service once? It's, it's really
easy once you have Tor installed. First, first of all, we have to
Tor install, and then we have to, to deploy Tor as a service.
Yeah, the next thing that we will need to do is just to verify
that we are connected to, through Tor, so we can get our public IP
address without being connected through Tor, and we can verify
then the, the, the connection, the, we are running just the same
command, but we've verified, verified command before, just to
enroute, to, to, to send this, this connection through the Tor
network. Really easy. Two commands to, to, to, to do it.
Then we have to, to modify several lines, and we have to, to
uncomment two lines in, in Tor.
Tor RC file. Specifically, we have to uncomment these lines,
hidden service deal and hidden service port. Two lines, two lines,
two commands, so it's, it's really easy. And then we'll have to,
to restart Tor as a service again. Yeah, because if not, the new
configuration wouldn't have been, have been loaded. So, so this is,
this is not a problem. What we are doing right now is, is starting
an, an Apache server. Yeah, and then we have to, and then we have to
add two server, which is the one that is, is being mapped in port 80,
as we have seen in the configuration file. So, it's, it's, it's quite a
straightforward right now. Then if we want to, to know which hidden
services we, we have, we, we have to go to a hidden service path, and
here we can find two, two files, and the file of, this file, hostname,
we can find this, this, our hostname. So, we can find this, this, our
.onion. So, if we want to launch a petition to .onion domain, if we
did it with and the domain, we will, we will not be able to resolve that.
But if we do it with , like, like in the example, we'll, we will be able
to grab and to collect all the information from, from the, from that
hidden service. But we have this approach, we have a problem, because,
most users are normal users, and that do not use Tor.
Yeah, so, and this is a point because, although Tor users have increased
quite a lot, there are several studies that say that even in the countries
with more penetration, like Moldova and Iceland, Tor users only
represents the 300 users per 100,000 online common internet users.
So, the, the, the, the figure, it's, unfortunately, quite, quite,
quite.
It's slow. So, we will have to find something different to try to make
these hidden services available for a wider and a, a, a, a wider number of,
of users, okay? To, to solve this problem, we are going
to use Tor gateways. When we spread the malicious links through social
network, we can use a gateway to redirect the victims to our hidden service.
The point is that we are very lazy sometimes, and if we don't want to have
Tor installed in our system to access to a, to a hidden service, we can
use .onion.to, .onion.link, .onion.plus, .plus, which are Tor gateways that will let
you access these domains, even if you don't have Tor browser bundled out or a Tor
connection configured in your system. The point is that, if we found out when,
during, during the, when we were doing this, this research, that some Tor
gateways were providing additional information that we were not expecting, and we
are, we are, we are, we are, we are, we are, we are, we are, we are, we are, we are,
using it for, for fun, for profit, maybe.
Now we are going to, to use, and which information is exposed by gateways?
Okay. We are, we are going to see it in an example that we have released, the, the,
the search code, we have released it in GitHub, so you will be able to, to see, to,
to download it and perform your own, your own test. Okay, so maximize.
First of all, we are, we are going to, first of all, we are going to download the hidden
service that we have prepared for this demo, and, and it's created with, with Tor and,
with Python and, and Sten. Sten is a, is a library to interact with, with Tor from,
from Python. What, what we are doing right now is the
deploying a, a very simple, but very simple, very simple hidden service that the only things
that do is just showing the headers that each and every request, each and every request
to this hidden service is being sending. Why? We, we are going to see, to, to see it why.
So it's very easy. You, you get cloned and you install the requirements and then you
Python, you, you press Python and, and start the, the, the, the application.
It's really simple. Don't go off plate.
Then we're going to see which is the IP address of the victim.
Is this, and then we are going to notify, the connection, and, with,
with aim to, to see the headers of this so that.
We stop there. Stop there.
You can see there that the headers sent by a , are, are almost five?
Five or four headers?
Okay. Almost no information regarding the, the, the kind of thing.
the user that got connected to this domain using Torrify Core, okay?
But what happens when we do this using, stop there, okay?
When we do this using Onion.link platform?
Well, we can find something really interesting because amongst the headers,
one of the headers that was being sent, it's X real IP.
So Onion.link was sending to the hidden service the real IP address of the guy
that wanted to get connected to it.
So you can think about how this information can be used.
If there is a user that is getting connected to, for instance, a pornographic website,
the administrator of the pornographic website will know which is the real IP address of the guy.
Torr was not intended to be used in that way,
but if you use Torr Gateway, maybe your information can be exposed.
So please avoid using them and download and install.
Download the Torr browser bundle or configure your own Torr connection
because you don't know what kind of information can be sent, okay?
This first problem, we have addressed it, but we have...
Because we have a hidden service.
We have a server that is exposed as a hidden service and with a Torr Gateway for the surface users.
Now we have deployed an anonymous phishing.
But now we have another problem.
Now we have another problem related to creative and credible of the attacks.
So the problem is that Onion.links are too long.
So it's very easy to see if you are being directed to an Onion website.
Well, there are some tricks that we are going to use just to try to make the deception better, okay?
First of all...
First of all, we ask you to go to Kahoot.
Does anyone know Kahoot.it?
Kahoot.it is a platform that we are going to use to give you $25.
So we are going to encourage you to go to Kahoot.it.
And the only thing that you will need is to insert the code that Jaitha is going to show you.
Because here we will ask you some questions regarding these facts.
If you want to win the BitQuest, you will have to go to this platform.
Okay.
Kahoot.it.
Okay.
Go to my Kahoot.
Wait there because we will need to show you the...
Okay.
So you will need to insert the following PIN code that...
The following PIN code...
That is going to...
That is going to be shown in the screen.
And we are going to put you...
I think that they are very easy challenges.
But, well, just the fastest one will be awarded with a $25 prize.
Okay.
So, hold on a second.
We are deploying it.
If you are in Kahoot.it, it is requested for a PIN.
Insert the one that is there.
We have here the PIN.
Four, five...
Kahoot.it.
Okay.
Kahoot.it.
And we have to introduce four, five, eight, seven.
So, very simple PIN.
Four, five, eight, seven.
Okay.
And insert the nickname, whatever you want.
The point is that it will be shown in the screen.
So, please do not use any kind of things strange.
Okay.
So...
Wait, wait.
Okay.
We have three users.
We have three users.
Now we are going to do a test.
Yes.
Have we understood the game?
Okay.
If you have understood the game, press yes.
And we don't have to understand the game, press no.
Okay.
Four answers.
Till the moment.
Any more answers?
Okay.
Just four.
Six.
Six.
Okay.
Time's running out.
Well, six answers.
So, most people...
We have no trolls here.
Most people have understood the game.
Okay.
So, we are going to put some challenges here.
You have to...
You have to pay attention to what we are going to see here,
because the skills that we are going to show
are the ones that a phisher,
that we are going to implement in the phishing attacks
that we are using later technically.
Okay?
The next challenge is related to attention.
In which quadrant is located the only W in this image?
Okay.
Upper left.
Upper left.
Upper right.
Lower left.
Lower right.
Where is the only W?
In this image.
It's difficult, right?
It's really difficult.
Do you know why it's difficult?
It's difficult because letters are very similar.
So, this is a technique that most phishers tend to use
when cyber-squatting, when performing cyber-squatting attacks,
just in trying to emulate the original domains of common trademarks.
Some people change.
The M for an R and an N.
So, it looks like the same in most browsers.
So, this is something that we may be using,
would be useful for us to ship an appropriate phishing.
Please don't close the app.
Don't close the app.
Don't close the app.
We are coming back in a couple of minutes.
Okay?
Okay.
Okay.
These type of practice exercises are needed when conducting a phishing attack.
But we have to improve the image of the .onion domain
because it's so long.
We have two approaches here.
Two approaches.
The typical approach is using a vanity domain.
Do you know vanity Bitcoin addresses that tend to use?
Well, users tend to create a Bitcoin address that starts with a given word.
We can do the same with .onion.
.onion domains.
We can use tools like Shallot that are available in GitHub
and just saying to Shallot,
okay, I want my domain to start with Twitter or Facebook or whatever.
And we can let the tool try to generate as many .onion domains as he can
until he finds a domain that matches with this approach.
So, this is one.
Generating vanity.
Generating the domains, okay?
It may take a lot of time.
In fact, we tried to do it with Twitter,
which is Twitter, which is six letters.
And we were waiting for eight hours
and we couldn't generate it in our computer.
So, it's a difficult task.
However, there is also another trick to simple works
using a cool subdomain.
Before the blah, blah, blah, blah, blah, .onion.
Now, we are going to see one.
One example with DuckDuckGo.
DuckDuckGo is a search engine that many of you know, DuckDuckGo.
DuckDuckGo, the point is that it also has a hidden service,
a .onion version of the browser that can be reached only using Tor.
Okay, we can see this is the domain of DuckDuckGo.
And we are going to do a very simple trick
that many people don't know about onion domains,
but that can be useful for us when we want to conduct a phishing attack, okay?
We only have to put before, for example, twitter.com.blahblah.onion
or another example, for example, facebook.com.has.blahblahblahblah.onion.
And you may be asking, this is happening only in DuckDuckGo?
No.
No, because...
The point is that for discovering where a hidden service is inside the Tor network,
the only part important is the domain, not the subdomain, okay?
So, we can put whatever we want in the subdomain part.
So, in our cases, we would like to put some things that look like the original website,
just to trick the user.
So, for instance, if we want to emulate a twitter domain,
we can put twitter.com.blahblahblah.onion.
So, this is a very simple trick that simply works.
And it is something that happens because of how Tor is structured,
and how Tor was conceived.
So, two approaches, vanity domains and this small trick with subdomains.
This problem we have addressed,
but we have another problem related to spreeing the attacks.
So, we are going back to the Kahoot.
Yes.
The ones that have taken part until now.
Go back to Kahoot, okay?
We can see that Jmaxx is in the lead with 826 points.
And we are going to put two more challenges regarding misdirecting the attention of the victim,
as usual, misdirecting.
And the other one is regarding movement.
So, it is just a matter of answering the question that is appearing at the end of the video
that you are going to see right now.
Okay?
Have anybody of you been in London before?
Have anybody of you been in London?
I have been in London, but only once.
Okay.
I'm sorry.
I'm sorry.
I was just tricking you, just trying to misdirect attention.
Because the question that we are putting there is what time was in the big bell tower that was shown in the photo.
Okay?
So, the trick is just a matter of misdirecting the attention, as we are going to do in the efficient.
The answers are six.
Are six?
6 p.m., 7 p.m., 8 p.m., or 9 p.m.?
If you have noticed, if you have remembered which was the hour in the clock,
well, you should guess which is the core cancer, which was 8 p.m.
Okay.
Sorry for the trick.
But misdirecting the attention is one important, a very important issue when you want to conduct also a phishing attack.
And we are going to go through a technique.
That works very well with this.
The second, the third challenge is the movement challenge.
Because the human mind and the human eye works in a way that makes slow changes be almost, or be very difficult to be noticed by the eye.
The question is, how many elements are slowly changing in the photo?
To start changing right now.
Keep an eye on the photo.
Keep an eye on the photo.
Okay.
Keep an eye on the photo and try to find the elements that are being changing.
Okay.
Keep an eye.
Have you seen them?
Have you seen any of them?
Have you seen any changes in the photo?
No changes in the photo?
Well, at least...
From zero to three?
Okay.
Okay.
They're having some changes.
The plane has been removed.
The factory was removed.
The...
The colors of the houses were changed.
There were some windows that were changing, too.
The point is that the changes were taking place slowly.
So, they were taking place slowly, and it was really difficult for us to see the difference.
If something happens very quickly, it's very easy to notice.
So, these two...
So, by the way, J-Max, which is J-Max?
Okay, J-Max, congratulations.
We will...
We will...
We will...
You have been awarded with $25, about $25 in BitFace.
Lately, we will pay for them at the end of the talk.
But the point is that these two ideas, movement and misdirection,
are really important for conducting an appropriate phasing.
And there is a technique that can help us, like reverse tab nabbing.
But what is reverse tab nabbing?
It consists of modifying the content of the browser tab that stays in the...
That's when the user goes back to the tab, he will be in another website, controlled by the attacker.
So, the idea can be implemented really easily with just, and it's true, a couple of lines of JavaScript code.
You can copy that JavaScript code.
We have some POCs that we are going to see in a few seconds.
And it's really easy.
What we are doing here is just exploiting the way in which...
New...
New links are being opened in new tabs.
Some websites, like Google+, are not properly configured to prevent a newly opened tab
to modify the original tab in which it was clicked.
We are going to see it with an example later.
Now we are going to see how it works in Google+.
First of all, we have published...
In our own website, a POC.
This POC.
When the user presses on it, he will redirect to DEFCON.org, for example.
But the previous tab has been changed.
So, this is an issue because any link that is opened into a new tab in Google+, this does not work.
For example, in Twitter, because they are protected.
In Instagram, because they are protected.
In the Facebook original website, it doesn't work either.
But it works.
In the mobile version of Facebook.
It works in the Outlook light web app version.
It works in Mail.ru light application.
And it used to work even in LinkedIn until we reported all these small bugs to them.
LinkedIn thought that it was not a security issue.
The point is that many platforms, many other platforms, have already modified it.
And they answered us that, okay, this is something that cannot be...
Cannot be prevented.
In two weeks' time, they modified it.
And they said nothing to us.
So, please say hello or something.
Now, we are going to put all the pieces together with the problem we have seen before.
Now, we are going to see the POC.
The final POC with all of these parts.
The parts of the demo are three.
First of all, we have to create a malicious website with a malicious link.
In a hidden search.
So, if we have a hidden service, it's okay.
But we would only be targeting Tor users.
No, but we don't want that.
We want common users, normal users, to be vulnerable to this issue.
So, what can we do?
We have seen it.
Using a Tor gateway, like onion.link, onion.to, onion.plus, or whatever.
And we are sending the...
We are sharing the URL into...
From a platform, like in this case, it is Google+.
Google+.
The publication in Google+, will have to be relevant for the user,
with the aim to spend some time there.
And then, he will redirect to...
While he reads all the news and all the articles, what happens in the background?
In this case, he will redirect to Telegraph.
To Telegraph.
And...
The previous tab will have been changed with the phishing domain.
With the phishing that will be hosted in a hidden service, using onion.link, onion.whatever.
So, we are going to see it, and we are going to analyze the consequences of this approach.
Okay.
So, in the example, we have a URL that we are sharing a URL with something that we find that can be clicked by...
By lots of...
By lots of people.
So, while the user clicks on it, the Telegraph article is there.
The user is reading that.
And what has happened before in the previous tab, in the tab in which it was the Google+, the publication,
it has been changed onto a hidden service.
So, from our point of view, it's really good.
Because we have deployed a hidden service.
We have deployed a phishing website into a hidden service.
And when the researcher...
Wants to...
Okay.
Who is behind that?
Who is behind this attack?
I want to close down that phishing website.
He can't.
Because he doesn't know where the hidden service is located.
Why?
Because it is in Tor.
Okay?
So, it's a nice approach.
Just combining different techniques.
And reverse tab nabbing.
And Tor gateways.
And Tor.
And this is really, really nice.
Because phishers will be somewhat protected.
But it's true.
It's true.
We have to recognize that.
That this has some limitations.
Still, yeah.
Still, the onion links are too long.
So, we have to fight with that.
Tor gateways are sometimes too slow and unstable.
And may become a too clear indicator of the attack.
Yeah.
So, these websites are not always as fast as we expected.
If you are used to Tor connections,
Tor connections are sometimes slow.
So, we have to...
We have to...
We have to find an article in which the user will spend at least some seconds
until the website, the fake website is being loaded.
And what else?
And the other one?
Okay.
We have published the link into a social network with our own user.
So, this is still a problem.
Because I will need to find a social network and a social profile
that has to be created anonymously.
So, it has to be...
It has to be perfectly anonymous.
So, this is still an issue that has to be dealt.
Although there are a lot of Tor gateways,
like onion.plus or onion.link or onion.to,
the best gateways to do this attack,
in our opinion,
are onion.plus or onion.link
because it permits .onion subdomains
and leak personal information,
about the victim.
Yeah.
Because onion.to, onion.guide and so on,
when you use the subdomain trick,
they raise an SSL error and so on.
So, they are not as good as the other ones.
But, meanwhile, onion.link and onion.plus
are good approaches to perform this phishing.
So, it's everything for our site.
I think that all of us want to go out tonight
and it's so late.
We are hungry.
Even for...
Even for Spanish guys
who tend to have dinner too late.
So, we are waiting for your questions and comments
and, anyway, you can contact us later.
Thank you so much for attending, okay?
Thank you.
Thank you.