5、安全厂商发现针对Netflix用户网络钓鱼活动
标题：CREDIT CARD DATA AND OTHER INFORMATION TARGETED IN NETFLIX PHISHING CAMPAIGN
作者信息：January 09, 2017 By Mohammed Mohsin Dalla
//BEGIN
Introduction
Through FireEye’s Email Threat Prevention (ETP) solution, FireEye Labs discovered a phishing campaign in the wild targeting the credit card data and other personal information of Netflix users primarily based in the United States.
This campaign is interesting because of the evasion techniques that were used by the attackers:
The phishing pages were hosted on legitimate, but compromised web servers.
Client-side HTML code was obfuscated with AES encryption to evade text-based detection.
Phishing pages were not displayed to users from certain IP addresses if its DNS resolved to companies such as Google or PhishTank.
At the time of posting, the phishing websites we observed were no longer active.
Attack Flow
The attack seems to start with an email notification – sent by the attackers – that asks the user to update their Netflix membership details. The phishing link inside the email body directs recipients to a page that attempts to mimic a Netflix login page, as seen in Figure 1.
Upon submitting their credentials, victims are then directed to webpages requesting additional membership details (Figure 2) and payment information (Figure 3). These websites also attempt to mimic authentic Netflix webpages and appear legitimate. Once the user has entered their information, they are taken to the legitimate Netflix homepage.
黑客这回盯上了Netflix视频租赁分享网站的会员。采取的方式是首先黑掉一些正规的网站，然后将木马上传到这些网站上。在受害者的视角上看，他们首先会收到一个貌似正规的官方邮件，要求用户升级其会员资格：输入其登录账号和密码；然后输入其支付账号和密码等等。这一切完成了以后，才会给用户转到真正的官方网站。
客户侧看到的HTML网页是被加密的，通过普通的方式难以发现黑客们的真实目的同时也规避了简单的通过字符串进行过滤的安全机制。
//END
Technical Details
The phishing kit uses techniques to evade phishing filters. One technique is the use of AES encryption to encode the content presented at the client’s side, as seen in Figure 4. The purpose of using this technique is code obfuscation, which helps to evade text-based detection. By obfuscating the webpage, attackers try to deceive text-based classifiers and prevent them from inspecting webpage content. This technique employs two files, a PHP and a JavaScript file that have functions to encrypt and decrypt input strings. The PHP file is used to encrypt the webpages at the server side, as seen in Figure 5. At the client side, the encrypted content is decoded using a defined function in the JavaScript file, as seen in Figure 6. Finally, the webpage is rendered using the ‘document.write’ function.
Another technique is the host-based evasion, as seen in Figure 7. The host name of organizations such as ‘phishtank’ and ‘google’ are blacklisted. The host name of the client is compared against a list of blacklisted host names. If there is a match against the blacklist, a “404 Not Found” error page is presented.
As with the majority of phishing attacks, this campaign uses PHP mail utility to send the attacker the stolen credentials. The advantage of using this technique is that the attacker can host their phishing kits on a number of websites and still get the stolen credentials and other information from a single email account. This enables attackers to extend their reach.
Tips to Secure your Netflix Account
To learn more about securing your Netflix account, Netflix provides additional information on how to keep your account safe from phishing scams and other fraudulent activity at https://www.netflix.com/security.
钓鱼组件采用了2种技术手段来规避监测：第一采用加密手段。能加密网页的内容，这样采用普通的检测方法就不能发现。同时在主机端和服务器端进行，采用的语言有PHP和JavaScript等。
第二采用的是主机名的黑名单技术。一旦遇到在黑名单中的主机，就不会显示此钓鱼页面。这些所谓黑名单的主机，很可能就是有能力发现其破坏行为的。
点评：钓鱼行动还是很有针对性！ |
发表于 2017-1-11 20:19
提升卡
置顶卡
沉默卡
喧嚣卡
变色卡
显身卡
发表于 2017-1-12 21:27
