Access member only content, take part in discussions with comments on blogs, news and reviews and receive all the latest security industry news directly to your inbox. Join now for free.
A confirmation email has been sent to your email address - SUPPLIED EMAIL HERE. Please click on the link in the email to verify your email address. You need to verify your email before you can start posting.
If you do not receive your confirmation email within the next few minutes, it may be because the email has been captured by a junk mail filter. Please ensure you add the domain @scmagazine.com.au to your white-listed senders.
Imperva has discovered a phishing kit that is hosted separately from the phishing websites.Imperva said that, unlike previously available phishing kits, this new approach lives in the cloud, relies on hackers exploiting other hackers, and never goes away. The company's director of security strategy Rob Rachwald, explained that in traditional schemes when you take down a server, you take down not only the web page, but the back-end data collection capability comes offline.“In this cloud version, data collection is hosted separately from the phishing web sites which means hackers only need to repost the web front-end in a new location to be back in business. Also, and perhaps what's more interesting, this attack highlights that there's no honour among thieves. Two master hackers wrote and then posted a phishing kit into hacker forums,” he said.“The irony is that anyone using this kit becomes an unknowing member of the master hacker's army. When hackers use this kit and deploy a successful phishing campaign, all the stolen credentials and information goes straight back to the master hacker without the proxy hacker's knowledge. It's very clever. The master hacker never needs to conduct a campaign to see financial gain.”The kit was developed in Algeria with Arabic tutorials, while the kit itself is in English. Once logged on via ‘Login Spoofer' you select which pages you want to spoof from a selection of pages including webmail, PayPal and Facebook messages.The user then has a dashboard which shows the victims. Imperva detected that the proxy hackers will see some success with dozens to hundreds of credentials potentially stolen before their fake sites are shut down. After this, the ‘master hacker' leverages a back door in the kit to harvest all the credentials the proxy hackers managed to obtain.“Since new people create new phishing sites every day, with new campaigns the master hacker's numbers just grow and grow and grow,” said Rachwald.See original article on scmagazineus.com
To begin commenting right away, you can log in below or register an account if you don't yet have one. Please read our guidelines on commenting. Offending posts will be removed and your access may be suspended. Abusive or obscene language will not be tolerated. The comments below do not necessarily reflect the views or opinions of SC Magazine, Haymarket Media or its employees.