{"id":78,"date":"2008-01-29T21:24:26","date_gmt":"2008-01-29T16:24:26","guid":{"rendered":"http:\/\/codeinmybug.wordpress.com\/?p=68"},"modified":"2008-07-06T15:49:40","modified_gmt":"2008-07-06T10:19:40","slug":"a-phish-floating-in-google-survey","status":"publish","type":"post","link":"https:\/\/projectbee.org\/blog\/archive\/a-phish-floating-in-google-survey\/","title":{"rendered":"A Phish floating in Google Survey!"},"content":{"rendered":"

Demo<\/a><\/strong><\/span><\/h3>\n

<\/a><\/strong><\/span> 1. Phizy-Phizy-Phizy<\/strong><\/span><\/h3>\n

I have always loved making this phizy-phizy-phizy<\/em> sound purposelessly, which I once heard in a Rob Schneider<\/a> movie (which, if I remember correctly, was a pathetic movie). Anyhoo! I, now, have a set of very strong reasons to move around repeating the same lines.
\nFirst, we received a request to be involved in a discussion for a Risk Assessment Model for a Banking site. This model had to be focussed on Two Factor Authentication and Phishing<\/strong>. This brainstorming gave me a couple of interesting avenues to work on. Hopefully, I’ll be writing more in this pretty soon.
\nSecondly, Peter Thomas<\/a> (one of my amazing Bosses), forwarded me the link about the latest research<\/a> by Nitesh Dhanjani<\/a> & Billy Rios. They virtually infiltrated the Phishers ecosystem and have come up with some very interesting information.
\nThirdly, my friend Swen<\/a> called me up to let me know about a phishing mail, claiming to be a Google survey, that had landed in his mailbox. He was excited for two reasons:
\na) He had received a phishing mail for the first time, and I guess you all remember the excitement the first time you discovered your first phishing mail.
\nb) He is one of the Google fans, and is worried about the safety of the vast majority of user-base Google has. Obviously, his concern isn’t without reasons.
\n\"by-mcbeth<\/p>\n

2. A Phish named GoogleSurvey<\/span><\/h3>\n

As I mentioned Swen informed me about the shiny phish called GoogleSurvey. It presents you a page that looks completely similar to the Google Login page and requests you to login in order to complete the survey. If you login, you are presented with 3 questions on by one. At the end you are thanked for completing the survey.<\/p>\n

3. Anatomy of Google-Survey-Phish gills<\/span><\/h3>\n

The Google Survey Phish isn’t sophisticated y ANY standards. Clearly, it’s done by some n00b, and was probably deployed using a very cheap Phishing Kit. However, it’s really interesting to understand how it works.
\nThe first page the you encounter while analyzing is http:\/\/www.googlesurvey.co.nr\/<\/a>, which I must admit, looks very similar to the Google Mail login page. A look at the source code reveals that this is not the original page. The google mail look-alike page is alike page is actually located at http:\/\/googlesurvey.99k.org\/<\/a>. http:\/\/www.googlesurvey.co.nr\/ only frames the page at with 100% width and 0px border.<\/p>\n

Another interesting point to note is that the phisher used a free hosting service http:\/\/www.zymic.com\/free-web-hosting\/. Thus, theoretically he\/she cannot be traced. Not via the hosting service, at least. \ud83d\ude42<\/p>\n

Now, when you enter your id and password, the data is sent to a php script on the server located at http:\/\/googlesurvey.99k.org\/LoginAuth.php. Quite obviously, this script stores\/mails your credentials for someone who’s not a very pleasing person.<\/p>\n

4. Demo: Farming your own Phishes for fun & profit *cough*<\/a><\/span><\/h3>\n

The world of Phishing is so dark, deep, safe, easy, and seductive that a person with even a slight malign would be tempted to this farm his\/her own phishes and make easy money. I set up my phishing domain for educational purposes<\/a>. It also shows how quickly you can setup your very own phishing portal, sometimes even without a phishing kit. The domain I’ve setup has the following flaws (introduced to prevent me getting screwed by some half-witted law enforcer) :
\n1. The domain points at Yahoo!, while the page displayed is similar to the GMail login page.
\n2. The information entered is NOT stored. You can check it by entering garbage data.<\/p>\n

I have used the same page used by the GoogleSurvey Phish, and also used the same free hosting service.<\/p>\n

5. Conclusion<\/span><\/h3>\n

It’s almost impossible to prevent users from getting Phished. People will continue to click on links they receive in their inbox and <\/sarcasm> proceed to win an ipod <\/sarcasm>. Reducing phishing requires a number of things to be in place -sensible developers, well informed end user, smart browsers with phishing aware features (IE7, Fx2 etc.), a few toolbars like NetCraft to be installed, etc. etc. And even doing all this doesn’t guarantee to save a user ignorant of phshing. I mean how do you save a person who doesn’t even know that such a kind of fraud exists.
\nMoreover, the URI vulnerabilities have added another dimension to the whole phishing scene. \ud83d\ude42<\/p>\n","protected":false},"excerpt":{"rendered":"

Demo 1. Phizy-Phizy-Phizy I have always loved making this phizy-phizy-phizy sound purposelessly, which I once heard in a Rob Schneider movie (which, if I remember correctly, was a pathetic movie). Anyhoo! I, now, have a set of very strong reasons to move around repeating the same lines. First, we received a request to be involved … <\/p>\n

Continue reading “A Phish floating in Google Survey!”<\/span><\/a><\/p>\n","protected":false},"author":6,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":false,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2},"jetpack_post_was_ever_published":false},"categories":[15,18,22,25,32,38,42,47,168,167],"tags":[],"class_list":["post-78","post","type-post","status-publish","format-standard","hentry","category-demo","category-education","category-google","category-hackers","category-life","category-news","category-phishing","category-script","category-security","category-webappsec"],"aioseo_notices":[],"jetpack_publicize_connections":[],"jetpack_featured_media_url":"","jetpack_shortlink":"https:\/\/wp.me\/pf2XR-1g","jetpack_sharing_enabled":true,"jetpack_likes_enabled":true,"_links":{"self":[{"href":"https:\/\/projectbee.org\/blog\/wp-json\/wp\/v2\/posts\/78","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/projectbee.org\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/projectbee.org\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/projectbee.org\/blog\/wp-json\/wp\/v2\/users\/6"}],"replies":[{"embeddable":true,"href":"https:\/\/projectbee.org\/blog\/wp-json\/wp\/v2\/comments?post=78"}],"version-history":[{"count":1,"href":"https:\/\/projectbee.org\/blog\/wp-json\/wp\/v2\/posts\/78\/revisions"}],"predecessor-version":[{"id":150,"href":"https:\/\/projectbee.org\/blog\/wp-json\/wp\/v2\/posts\/78\/revisions\/150"}],"wp:attachment":[{"href":"https:\/\/projectbee.org\/blog\/wp-json\/wp\/v2\/media?parent=78"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/projectbee.org\/blog\/wp-json\/wp\/v2\/categories?post=78"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/projectbee.org\/blog\/wp-json\/wp\/v2\/tags?post=78"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}