‘A little bit of hype’: David Shipley, head of Canadian-based security awareness training firm Beauceron Security, said “there’s a little bit of hype” in giving the tactic a fancy name for what is in fact spear phishing, although, he admitted, it’s “rapid-fire spear phishing.”The reason, he said, is that “spray-and-pray” mass phishing campaigns today are being detected by email gateways. This is why threat actors have increasingly turned to spear phishing and what he calls “trolling” campaigns, where the goal is to measure who will report a phishing attempt, who will click, and where on the message the target will click. “They’re trying to figure things out ahead of doing something clever,” he said.The report is a reminder to infosec pros that, despite improved defenses, phishing is still a prime tactic of threat actors, Shipley said. “You can have a false sense of security if you’re running a large enterprise and say, ‘We stopped 950,000 phishing emails this month.’ But the 500 that got through could really sink the battleship.”The lesson for CISOs, he added, is to emphasize to employees the importance of reporting suspected phishing emails instead of just deleting them.
‘Hard to defend against’: “This is very difficult to defend against,” said Johannes Ullrich, dean of research at the SANS Institute. “The first step is to restrict JavaScript access. Next, mail servers need to rate limit requests to restrict how often a particular source may use its API. But it is very difficult to find the ‘right’ rate limit.””The only real solution,” he said, “is to move away from traditional credentials to phishing-safe authentication methods like Passkeys. The goal should be to protect from leaked credentials, not block user account verification.”Attackers verifying e-mail addresses as deliverable, or being associated with specific individuals, is nothing fundamentally new, he added. Initially, attackers used the mail server’s “VRFY” command to verify if an address was deliverable. This still works in a few cases. Next, attackers relied on “non-deliverable receipts,” the bounce messages you may receive if an email address does not exist, to figure out if an email address existed. Both techniques work pretty well to determine if an email address is deliverable, but they do not distinguish whether the address is connected to a human, or if its messages are read. The next step, Ullrich said, was sending obvious spam, but including an “unsubscribe” link. If a user clicks on the “unsubscribe” link, it confirms that the email was opened and read. So current advice is to not use the unsubscribe link unless you know the organization sending the email, he said.With web mail systems, it is often possible for a threat actor to figure out if a particular account exists by just attempting to log in, he noted. The attacker may get a different response if the account doesn’t exist, versus ‘incorrect password’ for an existing account. For public systems like Gmail or Hotmail, an attacker may also attempt to create a new account, and the system will warn them if a particular username is already taken.”It looks like this campaign added the ability to verify if an email address exists in real time,” he said. “Most webmail systems are built around APIs accessible from JavaScript, and an attacker can use these APIs or create a database of valid email addresses or some middleware to proxy the requests to the email services API in case they restrict JavaScript access.”
First seen on csoonline.com
Jump to article: www.csoonline.com/article/3958633/precision-validated-phishing-the-rise-of-sophisticated-credential-theft.html
