Year: 2023

How to detect and protect from a fake job offer online

Bangaly Koita 2 years ago

Many threat actors used the technique I called a fakejobposting attack. In this attack, the threat actors post or send a fake job offer to many users in order to trick them to perform an action that could be used to compromised their system or account.

The attack usually happens over websites sites used by job seekers such as LinkedIn, Monster, indeed and many others.

Usually, the threat actors used the victims as an attack vector to compromise different organization.

This technique is used by many threat actors such as the North Korean group Lazarus, Golden Chicken and others.

If the attack succeeds, it could lead to further damage such as data leaked, reputation damage, financial lost. Therefore, such activity should be taken into account and a security measure such as security awareness and training to detect and prevent such attack.

The attack usually happens by sending a malicious link, file with the fake job offer or posting a fake job to attract the users. Once, the user interacts with it, the user system can be compromised or the user can lose his or her account. It is very crucial to know how we can differentiate the real job offer and a fake one.

In the upcoming lines, we will give some details about it.

  • Detection and preventing of fakejobposting attack:

 When you receive a link or file, check the link sent to you via OSINT tools such as virus total VirusTotal - Home, Interactive Online Malware Analysis Sandbox - ANY.RUN

NB: You can take the file hash and check it via the tools mentioned above or others to detect if the file is a malware.

Example:  How to get the file hash: open PowerShell command – type - Get-fileHash “file name” – enter – get the hash of the file

  1. Check if the domain is newly created domain or updated domain Whois Lookup, Domain Availability & IP Search - DomainTools, often the threat actors use the new domain to target the users.
  2. Check the details about the company online, example: Google search. Some threat actors mimic known companies, in this case, check others platform if the job offer is present or the company website for job listing.
  3. When the link sent to you require the login, don’t never use the password you use to connect to your company portal or other platforms for personal used such as social medias.
  4. When you receive the message from a social media such as LinkedIn, check the date of creation of the sender’s profile and the picture on the profile (they are many AI tools now used to generate a fake picture, always check the picture on the profile), some threat actors used a fake profile or newly created profile.

NB: The picture on the profile can be taken from another social media that belongs to someone else, it is a good practice to use Google image search or Microsoft Bling images or Yandex imagine to check the if the image is not taken from another platform.

  1. When there is an application to install for the interview such as TeamViewer,3CX, Microsoft teams and others compare the hash to the hash available from the provider or take the hash of the software and check it via online tools like we explained in the section 1.

If you are still not sure then it would be better to set up a Virtual machine to interact with the link or file to avoid any issues.

You can use any Virtual machine of your choice, make sure that after interacting with the link or file or software that you used to the snapshot mode to back to the safe state.

How to report a scam attack

Bangaly Koita 2 years ago

The phishing and scam attacks are types of social engineering attack where the threat actor tries to manipulate the user to behave in such a way that he can achieve one or more of the following objectives (compromise the host, stealing data such as PII, PHI, Financial data, confidential data etc.)

There are many types of social engineering attacks:

Phishing

Spam over Internet messaging

Spear phishing

Dumpster diving

Shoulder surfing

Smishing

Vishing

Spam

Tailgating

Whaling

Prepending

Identity theft

Invoice scams

Hoax

Typosquatting

The attack is the most and easiest technique used nowadays by the threat actors to target the victims.

If you have been browsing over the internet or you have been using an email address to send and receive messages, then you probably at least one time face with this type of attacks.

The attack can be very impactful, many organizations or individuals who are victim of this type of attacks can lose quantitatively (money) and qualitatively (reputation), so it is crucial to know how to be protected from the attack and also how to report it.

Example of quantitative loss:

Example of qualitative loss:

  • Sextortion abuse. Example: Using a social engineering attack to gain access to someone mobile phone or notebook in order to blackmail the person.

Considering that the attack is the most efficient way to target the victim, most of users who are impacted by this attack do not report it, which causes more victims.

By reporting the attack, we can protect yourself and other. They are many ways to report the attack, below we will describe and share with you the details about each.

  • How to report scam using Gmail

When you receive a suspicious message, you can report from your Gmail account by doing:

  • Click on the email you received
  • Click on the ellipsis sign (the tree dot in the right corner)
  • Select report Spam or the second ellipsis – select block user

By doing that, the IT department from Google will review and block the message if it is used for social engineering attack.

  • How to report scam using Outlook

- Click on the email you received

-Click on the ellipsis sign (the tree dot in the right corner)

- Select report Junk report or block user or phishing, the email will be removed from your inbox and send to the IT department of Microsoft for further analyses.

NB: The same option is available on other email service such as Yahoo, Hotmail and others.

Reporting phishing abuse over social media

  • Facebook

 You can always report strange emails to phish@fb.com.

  • Instagram

           You can always report strange emails to phish@instagram.com.

  • LinkedIn

If you receive a phishing message on LinkedIn, you can report it, by clicking on the message you received, on the right corner click on More …icon and selecting one of the below options:

- It's spam or a scam

-It's a scam, phishing, or malware

  • Twitter

If you want to report a post with a link used for phishing attack, on the right corner click on More …icon and selecting report Tweet, click on next – start report – choose the option for example” myself” – next – Spammed.

You can also report social engineering abuse by reporting the domain or URL to a third-party service provider.

Examples:

  • PhishTank List of potential phishing sites: PhishTank

When you receive a phishing email, you can report via the website. You can use the website also to check if the domain you received is a phishing domain.

The following page is used by Google to report phishing abuse.

The website belongs to APWG which is an anti-phishing working group, you can report the phishing email to reportphishing@apwg.org  for further analysis.

The website belongs to ESET group to report phishing abuse.

 The website belongs to the USA government for reporting different types of phishing abuse.

The website is used to report internet crime such as phishing, ransomware, corporate data breaches and others.

The website is used to report different types of scams or fraud such as Jobs and Making Money, Travel and Vacations, Lottery, Sweepstakes, or Prize Scams, Online Shopping/Internet Services/Computer Equipment and others.

Phishing Initiative helps fight against phishing attacks.

When you report the address of a suspected phishing website, the emails will be analyzed it and blocked if the address is malicious one.

By reporting the URL or domain, they will analyze  and it takedown if it is malicious.

In conclusion, the social engineering attack is easy to perform but the impact can be very devastating. Reporting the attack will save many people. So, it is crucial to report the attack as soon as possible to lessen the impact and stop it.

What is a Typosquatting attack?

Bangaly Koita 2 years ago

A typosquatting attack is a type of attack where the threat actor mimics a legitimate domain to target the victims. In this type of attack, the threat actor looks for the target domain that he and she want to target and alter the domain. The attack is one of the most successful attacks technics used by the threat actors. The attack is very difficult to detect as most of the users will consider it as a legitimate domain. However, the attack can be detected by implementing some countermeasures.

One of the most used tool to generate a typosquattitng domain is dnstwister | The anti-phishing domain name search engine and DNS monitoring service, the tool can help you  generate domains or find the domains that can be used to mimic your domain.

Types of typosquatting:

Combosquatting

The attacker adds a word to the legitimate domain to trick the users to click on it. Example:

The legitimate domain facebook.com will be altered to helps-facebook.com.

Bitsquatting

The attacker changes one or more bits of the legitimate domain to trick the user. Example:

Facebook.com will become fasebook.com

Soundsquatting

The attacker uses the technic calls “Homophones” to trick the user. Example”

Fare.com will become faire.com

Levelsquatting

The attacker uses the legitimate domain, follow by the phishing domain. Example:

Facebook.com will become facebook.com.ghdhwhj.com

Homographing

The attacker uses the technic calls homoglyph by changing one character from the legitimate domain. For example:

Faceboo.com will become fäcebook.com (the “a” changed to ä)

You can use the homoglyph generator to alter any domain you wish (Homoglyph Attack Generator and Punycode Converter (irongeek.com))

Typosquatting detection and protection:

In conclusion, the typosquatting is a type of attack that alter the legitimate domain to target the users. The attack is very difficult to detect but by combining different methods and technics, the users can be protected.

 

efile.com compromised by threat actor to embed malicious files

Bangaly Koita 2 years ago

The efile[.]com a team of tax professionals and tax software vendors that provide an online platform to efile federal income taxes and state taxes online website has been compromised. The website is redirecting to a malicious domain  that is used to download a malicious payload on a victim machine.

Details:

Some malicious files were embedded in the efile.com website redirecting to a maldomain with a malicious payload attach to it used to compromised the victim system.

The threat actors used different types of files and attachments to achieve their goal. 

  1. propper.js

https://urlscan.io/responses/63899f4dc894bdf8323e7ec65d608a640d7915b7eea7dd985dd876da0298a4b6/

The popper.js file contains a base64 encoding

popper.js after being decoded

The output is showing the redirecting domain which is infoamanewonliag[.]online

The URL www.infoamanewonliag[.]online/update/index.php is redirecting the final URL

VirusTotal - URL - 85f0f90c55dae3f6e4f50791470491eccebf7529a98f230f33dac32e805291de

Final URL

https://winwin[.]co[.]th/intro/

The final URL contains some malicious exe files that will be used to compromise the victim host machine:

https://urlscan.io/search/#winwin.co.th

https://winwin[.]co[.]th/intro/update.exe

https://www.virustotal.com/gui/url/85f0f90c55dae3f6e4f50791470491eccebf7529a98f230f33dac32e805291de/details

Hash from URLSCAN 882d95bdbca75ab9d13486e477ab76b3978e14d6fca30c11ec368f7e5fa1d0cb

https://www.virustotal.com/gui/file/882d95bdbca75ab9d13486e477ab76b3978e14d6fca30c11ec368f7e5fa1d0cb

  1. index.php and update.js
  • The index.php file is redirecting to the URL with the attachment update.js 

https://urlscan.io/responses/4ffeae430c05f641cb88d2d18131e3f4a3ecdcbc55c159af8998623e5769532a/

  • The js file contains two URLs with an exe file attached to each and base64 encoding:

https://urlscan.io/responses/ca051090a1105e8ea53a04206c8ddcee4b0d33d4566d2f28549fbf0bbdd34bc8/

  • As we mentioned in the “popper.js”,

The others URLs with the exe files are redirecting to final URL

https://winwin[.]co[.]th/intro/

The domain winwin[.]co contains some malicious exe files that will be used to compromise the victim host machine:

At the end, we may conclude that the intention of the threat actor is to compromise the infected system by redirecting the victim to different domains in order to download a malfile.

Once the user is redirected to the winwin[.]co website, the malicious exe will be downloaded and compromised the system.

The malicious files are already detectable by many anti-viruses.

If you were in touch with the efile.com during the last few days and was redirecting to any of the files mentioned above, better scan your laptop by using tool like Malwarebytes or others.

Click on the link (VirusTotal - File - 882d95bdbca75ab9d13486e477ab76b3978e14d6fca30c11ec368f7e5fa1d0cb) for further details about the exe files.

How to use URLSCAN (book to download)

Bangaly Koita 2 years ago

URLSCAN is used to perform different types of web scans and to analyze different IOCs such as IP address, domains, Hashes, filenames, and others.

URLSCAN is a tool used by different security teams such as Security Analyst, Cyber Threat Intelligence, Threat Hunting, Incident response team, and others.

Below, you can download the pdf document that will show you how to use the tool.

How to use URLSCAN

You can also find the articles related to the topic

How to use URLSCAN part1 – osintafrica

Three attacks frameworks that Cyber Security members should know

Bangaly Koita 2 years ago

Almost every day, you may hear from the news that a company was hacked and the data was leaked.

Most of the attacks happened in passive mode, which means that the companies are not aware of the attack. One of the most efficient ways to detect and respond to any Cyber Threats is to implement some detection and responsive measures.

The three frameworks that are going to be described below, will help you to detect and respond to any threat against your organization.

  1. Cyber Kill Chain

The following framework helps the organization to identify the steps used by the attackers to perform an attack.

The framework was developed by Lockheed Martin, the framework is part of the Intelligence Driven Defense model for identification and prevention of cyber intrusions activity.

Cyber Kill Chain® | Lockheed Martin

The framework is divided in 7 steps:

  • Reconnaissance: Finding any weakness that can be used to target the organization (Vulnerabilities, looking for details about the target over the network or gathering information about the target)
  • Weaponization: After gathering information about the target and finding a weakness, the threat actor tries to leverage it by create a malicious file or programs that will be sent to the target.
  • Delivery: Sending the malicious file or program to the target (phishing, drive by download)
  • Exploitation: At this stage the threat actor, exploits the vulnerability.
  • Installation: The threat actor tris to install a malicious software in order to gain high level privilege.
  • Command & Control: Establishing a communication with the target’s system
  • Actions on objectives: The threat actor meets his objective (data exfiltration) by exfiltrating
  1. MITRE ATT&CK

MITRE ATT&CK is the knowledge base that help different actors to find out the tactics and techniques used by the adversaries to compromise a system.  The framework can be used by anyone without any charge. The framework contains information about mitigation steps to detect any anomaly and protect the infrastructure and any system that might be infected (Enterprise, Mobile, ICT).

MITRE ATT&CK

MITRE ATT&CK is divided in 14 phases to find the tactics and techniques used by the threat actor.

  • Reconnaissance
  • Resource Development
  • Initial Access
  • Execution
  • Persistence
  • Privilege Escalation
  • Defense Evasion
  • Credential Access
  • Discovery
  • Lateral Movement
  • Collection
  • Command and Control
  • Exfiltration
  • Impact
  1. The Diamond Model of Intrusion Analysis

The model consists of 4 models that help you to identify how the intrusion can occur in the infrastructure.

The model helps to find the “who,” “what,” “when,” “where,” “why,” and “how.” Of the attacks in order to detect and mitigate the threat before.

The models:

  • Adversary: The attacker or threat actor behind the attack.
  • Capabilities: Are the set of skills and tools in the possession of the threat actor
  • Victim: The infrastructure, system, individuals targeted by the threat actor
  • Infrastructure: Are the software and hardware used by the threat actor to target the victim.
  • Social-political – The reason of the attack (financial, espionage, hacktivism)
  • Technology – How the threat actor can operate and what technologies the adversary used to operate and communicate.

 In conclusion, the three frameworks described here are very useful to detect and respond to different threat. Without referring to one of the frameworks, it will be very difficult almost not possible to mitigate the threat within your environment. Using them will be a step forward to being resilient against any attack.

Phishing message on Facebook mimicking Meta to target many businesses in Austria

Bangaly Koita 2 years ago

On the 1 March 2023, i connected on my Facebook page and found a strange notification from the page "Socail Network Registry 1011999162" . I clicked on the notification and found out the message below.

https://www.facebook.com/Socail-Network-Registry-1011999162-117752521246073/

As a Cyber Security and OSINT lover, i was wondering why Meta will publish such message on a third party. 

I checked the page creation date and found out that the page is created on the 01.03.2012,the same date that the message was sent, which was alarming for me.

As you read above, the message is tricking users to click on a link to reactivate their account because the page was reported for identify theft.

The message contains an URL on which you should click to reactivate your account.

I took the user and verify from Browserling - Live interactive cross-browser testing

 

 

The image above, shows a fake Facebook page logo and registration to trick people to enter their credential. The intention is probably stealing the credential and ask money later to recover the account.

The actor behind the page sends the same notification to many third parties located in Austria including my page as well.

I checked the URL on Virus Total and got the following information:

https://www.virustotal.com/gui/url/1d43e62c0c1d4ed58919330306f534648b04650adc7f87047d204b55cbf0068e

The domain was submitted 2 hours ago. The final URL is available, so I checked the final URL and I got another useful information:

Whois Lookup Captcha (domaintools.com)

The domain was created on the 2023-03-01.

At this point, we can be pretty sure that the domain is a phishing domain to trick people to click on the link to enter their credential.

Be always careful before entering your credential and do not forget to use 2FA to secure your account

 

How to use URLSCAN part4

Bangaly Koita 2 years ago

This is the part 4 and the last of (How to use URLSCAN part3 – osintafrica)

  • SEARCH

URLSCAN can help to perform different types of searches to find more information about an indicator such as IP address, domain, file, hash, ASN number and others.

Click on the “Search” button.

It is very important to first read the documentation. Click on the “Help” button to read about how to perform different searches.

Let’s give some examples of queries that we can perform in the Search menu.

  • Search for domain

If you want to find more information about a specific domain such as how the domain looked before and the connection between the domain with others domains or website, you can use the “domain:” query. We will give an example using microsoft.com.

Search - urlscan.io

 

 

In the image above, we can see the search result showing the domain Microsoft.com with different subdomains related to Microsoft.com and others domains or website where Microsoft.com was mentioned following with the time and the location it was scanned.

Click on each link where Microsoft.com is mentioned to see how the domain was at the time it was scanned; this technic can also help you as analyst to find out how the domain looked in the past. Many phishing websites changed the website interface after abusing many people over the internet so this technic can reveal such activity.

As you see, they are some domains or subdomains where Microsoft.com is not mentioned, we need to find out the relation between Microsoft.com and the domain.

Click on fraction.azurewebsites.net, go to HTTP transaction, search for Microsoft.com

AS you can see, Microsoft.com is used as redirect chain. This technic is often used by the threat actor to hide their activities and it can be also used to find the correlation between the domains.

 

  • Search for IPs

Search - urlscan.io

As you see in the image above, we entered the IP address 23.35.192.180 and we got the domains and subdomains behind the IP address. This technic can be used to find phishing related domain behind an IP address.

  • Search for Hashes

The hash can help you to make a correlation between the domains. Usually, the threats actor can use the same file but changed the domain, so this technic is good one to find such activity.

Example:

Click Microsoft.com, go to HTTP transaction, expand one http transaction request where the hash is available.

Hover the mouse on the hash and copy the hash, click on the Search menu and enter the query like you see in the picture below.

Now, we can see others websites that’s used the same hash.

  • Search for Filenames

The same thing as we described in the previous section, the same filename can be used by the threat actor but with different domains name, we can use the same technic like we did to find the domain or website that used the filename. Be aware that the same file name does not mean that the file if the same, you need to compare the hash and also the file content to ensure that the files are the same.

Example:

From HTTP transaction, copy the file you wish to check

Go to search, enter the query like you see in the picture below, all the result from the search will appear.

In order to verify if the file is unique, click on the URL, go to HTTP transaction compare the hash and the file content.

Like I said before, you can perform many types of searches using the search field. As a security guy you should know what you are looking for before making the search. The best way to learn is by practicing on the daily basis.

To conclude what we have explained, URLSCAN is very amazing tool that all security guys should use to make easier their job while analyzing different information like we showed in our examples.

The tool can help you save many times as it contains many types of queries that will help you to find more information during your analysis.

If you never used it, it is the time for you to start using and if you did not know the features we explained, then we suppose that you already know so enjoy.

How to use URLSCAN part3

Bangaly Koita 2 years ago

This is the part 3 of (How to use URLSCAN part2 – osintafrica)

Now, lets go to the “HTTP” menu

  1. HTTP

In this menu, we can see all the HTTP transactions after the URL has been submitted.

The HTTP transactions consist of all the resources (HTLM, Script, AJAX, Images …) used by the website.

 

This section is very useful for the analyst.

Click on one of the options available

  • In our case, we click on the button “Image” to find the image described in the section Image and all the files used by the image.

Click on the “expand” sign to see more details about each file.

We can observe the following details:

Full URL shows the requested image from Host: www.reddit.com.

We can find others information such as the server’s name used, TLS protocol version used, the Hash of the image used, the software used and others …

Click on the Show headers to find the details about the request headers and the response headers from the server side.

Click on Check archive.org that will lead you the website https://web.archive.org (You can Google search to find more information about it)

Click on each option (HTLM, Script, AJAX, Images) available to learn more about.

2. Redirect

Here, you will find all the redirect links on the website.

3. Links

The page contains all the links available on the website.

You can click on each of them or scan each of them to more details about.

4. Behaviour

The menu contains the information about the Security Headers, the Cookies, the JavaScript global variables used

5. Indicators

This menu contains all the domains, IP addresses, hashes used by the websites.

6. Similar

You will find some information about the URLS, ASN numbers, IP address, domains scanned on the website.

7. DOM

This menu is very useful as it has the whole map of the website such as the scripts used by the website, the HTML code used by the website and others …

8. Content

the Form (Google search for Form object DOM) used in DOM is available.

9. API

The API used by URLSCAN to get the information from the servers

Part4 (How to use URLSCAN part4 – osintafrica)

 

How to use URLSCAN part2

Bangaly Koita 2 years ago

This is the part 2 of How to use URLSCAN part1 – osintafrica

Now, let’s move further, we can see in blue color, 11 menus available.

Now we will describe the utility of each menu

  1. Summary

Click on the “Summary button” to find more details about the menu.

The menu contains all details about the submitted domain.

When you look at the image above, the following details are visible:

The number of domains and IPs that were contacted by the submitted domain.

The main IP address with location and the domain hosting provider are also available.

The certificate detail used by the website with his validity period.

The website was scanned 3 times

  • Show scan

This submenu will show you the number of times the domain has been already scanned. You can click on each scan to have more details such as how the domain looks at the time it was scanned, the IP address, ASN behind the domain at the time it was scanned.

  • Domain classification

The second part of the Summary menu is the classification of the domain provided by Google Safe Browsing.

The image above shows that Google Safe Browsing classified the domain as “No classification” which means that the domain is cleaned following the rating score available on Google Safe Browsing.

  • Domain and IP information

7 submenus are available at the section.

The menu IP/ASNs contains the information about all the IPs addresses contacted by the domain while being submitted with their ASN (Autonomous System Number).

You can click on each IP address and ASN to find more information.

The submenus “IP Detail” and “Domains” and “Domain Tree” contain some information about the IPs and the domains contacted by the submitted domain. You can click on each section to see the information available.

 

The submenu “LINK” contains all the link redirecting to others domains or URLS.

You can click on each link to get more details about.

The submenu “Certs” contains the list of all certificates used by the submitted domain with the validity period.

You can click on the crt.sh on the right side to get more details about the certificate

 

The submenu “Frames” will show you if the website is using any URL Frames.

  • Image

After describing different submenus from the Summary, from the right side, once the domain has been submitted, the main image from the website will appear in real time.  

We can see how the website behind the domain submitted looks like. This is very important during an investigation, for example when you are analysing a phishing issue, it is necessary to view the website without connecting directly to it.

You can click on “Live screenshots” and “Full Image” to have better visibility of the image.

  • Detected technologies

Here, we can find some technologies used by the domain. Notice that this is very important for you as analyzer. For example, When the website is compromised, the threat actor might embed a malicious code into the website, by checking this, you might find out the malicious code embedded within your website, checking this, can also help you to find some technologies that need to be updated or are not in used anymore.

  • Page Statistics

This section shows you the whole details about the submitted URL such as HTTP request, domains, subdomains, cookies, IP etc …

Part 3 (How to use URLSCAN part3 – osintafrica)

You may have missed

Windows files system you should never whitelist in your environment

Bangaly Koita 3 weeks ago

New update in URLSCAN to detect malicious domains

Bangaly Koita 3 months ago

How to securely open a file

Bangaly Koita 8 months ago

Payoutproject[.]com the biggest scam ever on social media Facebook, twitter, TikTok, Instagram

Bangaly Koita 10 months ago

How to use a proxy server for free over the internet

Bangaly Koita 10 months ago