Interview with Nitesh Dhanjani and Billy Rios, Spies in the Phishing Underground
by Mirko Zorz - Monday, 28 January 2008.
Both Nitesh and Billy are well-known security researchers that have recently managed to infiltrate the phishing underground. What started as a simple examination of phishing sites, turned into an extraordinary view of the ecosystem that supports the phishing effort that plagues modern day financial institutions and their customers.

They saw an extraordinary amount of sensitive customer account information, obtained the latest phishing kits, located and examined the tools used by phishers, trolled sites buying and selling identities, and even social engineered a few scammers.

In this interview, they expose the tactics and tools that phishers use, illustrate what happens when your confidential information gets stolen, discuss how phishers communicate and even how they phish each other.

What are phishing kits and how are they distributed?

Dhanjani: A phishing kit is the most important tool in a phisher's arsenal. Think of a popular company that executes financial transactions on the web. All the source code and static content such as images and logos needed to setup a phishing site for the company you just thought of is most likely to be present in a phishing kit. Let us suppose you get hold of such a kit and you want to deploy a phishing site. All you would have to do is the following: 1) Unzip the kit 2) Pick the directory corresponding the company you want to target 3) Edit a single file in the directory to input the email address you want the results emailed to 4) Deploy the directory onto a compromised host on the internet, and voila! - you have yourself a phishing site. If you take a look at the client side code (HTML and JavaScript) presented to your browser on a phishing site that targets a particular company, you will notice that other phishing sites that target the same company have similar characteristics. This is because, more often than not, the sites are deployed using popular phishing kits. The code within the kits is quite simple, mostly consisting of a web form that does the dirty work, along with image files and static content. The kits are often distributed amongst the phisher communities on message boards, and at times sold or traded for money or identities.

Rios: Phishing kits are the tip of the iceberg, they are the piece of the phishing eco system that everyone sees and knows about. The typical phishing kit consists of the HTML that makes up the forged site that the user sees and the backend logic that used to steal the victims information. Most phishing kits are probably created by a small number of individuals and typically sold on phishing forums. Although the various kits have different front ends and HTML content, the back end logic is surprisingly similar for most of the kits we've seen. These kits are used over and over again and most of the phishing sites you've seen are probably a variant of small set of phishing kits. Many think that phishing sites are all custom jobs that a particular phisher has developed and deployed. The reality is pre-made, ready-to-deploy, turnkey sites are already created for practically every major organization that you can think of. All a phisher has to do is purchase the latest kit and deploy, no technical expertise or coding skills are really required. All the phisher typically has to do is place their email address into one line of code and they have a ready to deploy phishing site.


Harnessing artificial intelligence to build an army of virtual analysts

PatternEx, a startup that gathered a team of AI researcher from MIT CSAIL as well as security and distributed systems experts, is poised to shake up things in the user and entity behavior analytics market.

Weekly newsletter

Reading our newsletter every Monday will keep you up-to-date with security news.

Daily digest

Receive a daily digest of the latest security news.

Tue, Feb 9th