Phishing Ecosystem Series: Evading Detection

Phishing Ecosystem Series: Evading Detection

One of the main considerations for a threat actor deploying phishing sites, is how long the deployment will remain undetected. The longer a site remains exposed to the internet, the greater the chance of it being crawled, analysed, and flagged as malicious by one of the many automated services which crawl the internet analysing its content. Quick turnover of phishing domains and hosting negatively impacts threat actors, as this both increases the cost of running a campaign, and decreases potential returns as potential victims are warned or blocked from accessing the phishing site.

Threat actors and phishing kit authors have subsequently begun incorporating more advanced methods of evading detection, from simple IP and bot blocking techniques to integrating third party services and APIs to provide more thorough checks on visitors accessing the site.
By performing more vigorous checks on visitors, many bots or scanning services which could identify the site as malicious will simply be blocked, or redirected to legitimate pages.

Standing Intelligence Requirements

For the most up to date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/alpha_team/advisories/14956

Recommendations

• Enable 2-factor authentication for all of your organizational accounts.
• Utilize account permissions best practices such as role-based access control, least privilege, and restricting root/admin permissions.
• Avoid opening unsolicited attachments and never click suspicious links
• Do not share passwords, and do not reuse the same password on different websites and applications.
• If you are alerted or suspect a compromised account, change the password immediately.
• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance.

Evasive Techniques

Many of the solutions employed by threat actors to evade the detection of their phishing sites contain one or more of the following capabilities. Each capability however can vary in sophistication based on exactly which tools, code or services the phishing kit utilises.

IP lookup

As a rudimentary form of protection, many kits utilise a blocklist of IP addresses and IP address ranges known to be used by various online services and organisations which crawl the internet analysing its content.

Figure 1: A blocklist containing ranges of IP addresses known to be used by security vendors (left), PHP code which checks allow/blocklists to determine if the visitor should pass (right).
Source: ZeroFox Threat Research

Additionally, the IP address can be used for further checks based on associated Internet Service Provider (ISP), and geolocation. ISP and location can be determined in several ways, including local lookups to a GeoIP2 database or external API such as ipdb.

Request Headers

When requesting a web page via a browser, the requesting device sends multiple pieces of information to the web server so it may tailor its response. These are known as “Request Headers”. These headers are also interrogated within many phishing kits in order to block unwanted visitors.
A popular request header used for this purpose is the “User Agent” string . This string informs the receiving web server what type of device is requesting it. This is commonly used by phishing kits as a method of filtering out unwanted visitors. For example, many kits targeting financial institutions are designed to replicate online banking mobile or app views, so will only render the phishing page if the requesting device reports itself to be a mobile device.

URL query parameters

Some phishing kits utilise required arguments/parameters as part of a GET request when navigating to the domain. This means that unless you provide a specific query parameter after the domain, which is specified by the kit owner, you will be unable to even reach the phishing page.

Figure 2: PHP code checking for specific query parameters, and redirecting the visitor if they are not present.
Source: ZeroFox Threat Research

Open-source solutions

Rather than reinventing the wheel, many kit authors use existing, legitimate tools and libraries within their code, allowing them to easily add in basic evasion and bot blocking capabilities. Some of the more frequently observed libraries include;

CrawlerDetect

CrawlerDetect is an open source and widely adopted tool written in PHP which aims to identify and stop known bots/crawlers/spiders based on the user agent and http_from request headers.

Proxyblock

16Shop also utilises some PHP code alongside a third-party api hosted by mind-media.com which will check the visitor's IP against a list of known proxy and VPN IP ranges. If there's a match, the visitor is presented with a 403 http response and details are logged.

Apache Htaccess

Apache is an open-source web server software, commonly used by many phishing site deployments. Apache offers the ability to control access to the site via the use of .htaccess files. These files commonly contain definitions for allowing, blocking, or redirecting visitors based on attributes of the request, including; IP address, user agent, referer, and more.

Figure 3: Excerpt from a .htaccess file found within a popular phishing kit, totalling almost ten thousand lines.
Source: ZeroFox Threat Research

Third-party services

Adoption of third-party services to aid in evading detection has continued to increase, as competition keeps pricing attractive enough for threat actors to invest in paying for access to these API’s. This in turn offsets the need to keep updating local htaccess or bot blocking scripts as vendors rotate their publicly attributed IP ranges, or deploy new web crawlers. These services advertise functionality such as blocking bots, looking up IP address geolocation, URL shortening, disposable email accounts, phone number identity lookup and more, as well as 24/7 support.

Figure 4: Home pages of "bot blocking" services commonly utilised in phishing kits.
Source: ZeroFox Threat Research

Many of these services advertise themselves publicly as a tool to block unwanted visitors or “bots” from accessing your website, and while they may have legitimate customers, an increasing number of phishing kit authors are integrating them into their code in order to increase the lifetime of the phishing attack.

Figure 5: An exposed directory on one of the bot blocking services websites contains information on how to directly integrate their services with popular phishing kits.
Source: ZeroFox Threat Research

Typically, these services expose a public API which can be queried along with an IP. If the IP has been associated with a bot or service which crawls the internet for malicious sites it will block the request and present the requester with a 403 (Forbidden) HTTP response, or redirect them to a legitimate site. Additional information can also be returned to further tailor who is able to reach the phishing page including location, allowing threat actors to easily create a “geo-fence” around their phishing site, only allowing visitors from certain countries or regions to reach the phishing page successfully. This is mainly used for phishing attacks targeting localised companies or ensuring victims are only from another country.

Conclusion

As security vendors and researchers continue to develop and improve phishing detection technology and countermeasures, phishing kit authors and developers also continue to improve evasive capabilities within their tools and code. This has resulted in increased adoption of third-party solutions to this problem, distributing under the popular Software-as-a-Service model. Whilst these tools and services have evolved over time, many functionality remains basically the same. ZeroFox assesses with a high likelihood that evasive techniques and tools will continue to be adapted and integrated into phishing attacks, in line with anti-phishing technology developments.