Catching Transparent Phish:Analyzing and Detecting MITM ...

1 Catching Transparent Phish:Analyzing and Detecting MITM Phishing ToolkitsBrian KondrackiStony Brook Amin AzadStony Brook StarovPalo Alto NikiforakisStony Brook over a decade, phishing toolkits have been helping attackersautomate and streamline their phishing campaigns. Man-in-the-Middle (MITM) phishing toolkits are the latest evolution in thisspace, where toolkits act as malicious reverse proxy servers ofonline services, mirroring live content to users while extracting cre-dentials and session cookies in transit. These tools further reducethe work required by attackers, automate the harvesting of 2FA-authenticated sessions, and substantially increase the believabilityof phishing web this paper, we present the first analysis of MITM phishingtoolkits used in the wild.

2 By analyzing and experimenting withthese toolkits, we identify intrinsic network -level properties thatcan be used to identify them. Based on these properties, we developa machine learning classifier that identifies the presence of suchtoolkits in online communications with conduct a large-scale longitudinal study of MITM phishingtoolkits by creating a data-collection framework that monitors andcrawls suspicious URLs from public sources. Using this infrastruc-ture, we capture data on 1,220 MITM phishing websites over thecourse of a year. We discover that MITM phishing toolkits occupya blind spot in phishing blocklists, with only of domainsand of IP addresses associated with MITM phishing toolkitspresent on blocklists, leaving unsuspecting users vulnerable to theseattacks.

3 Our results show that our detection scheme is resilient tothe cloaking mechanisms incorporated by these tools, and is ableto detect previously hidden phishing content. Finally, we proposemethods that online services can utilize to fingerprint requests origi-nating from these toolkits and stop phishing attempts as they CONCEPTS Security and privacy ; web security; social engineeringPermission to make digital or hard copies of all or part of this work for personal orclassroom use is granted without fee provided that copies are not made or distributedfor profit or commercial advantage and that copies bear this notice and the full citationon the first page. Copyrights for components of this work owned by others than ACMmust be honored. Abstracting with credit is permitted.

4 To copy otherwise, or republish,to post on servers or to redistribute to lists, requires prior specific permission and/ora fee. Request permissions from 21, November 15 19, 2021, Virtual Event, Republic of Korea. 2021 Association for Computing ISBN 978-1-4503-8454-4/21/11.. $ Reference Format:Brian Kondracki, Babak Amin Azad, Oleksii Starov, and Nick Catching Transparent Phish: Analyzing and Detecting MITM Phish-ing Toolkits. InProceedings of the 2021 ACM SIGSAC Conference on Com-puter and Communications Security (CCS 21), November 15 19, 2021, Vir-tual Event, Republic of , New York, NY, USA, 17 pages. INTRODUCTIONThe combination of a username and password is the default gate-keeper to nearly all online services that users interact with, on adaily basis.

5 It is therefore no surprise that this sensitive informa-tion is in high demand among malicious actors who go to greatlengths to obtain it, in order to access sensitive information andact on behalf of victims. One of the most commonly used methodsof acquiring this information is through social engineering, in theform ofphishing. Phishers impersonate trustworthy entities in anattempt to lure victims into disclosing private information, such asaccount credentials and banking , phishing websites were hosted entirely on attacker-owned and compromised web servers where attackers would hostrealistic-looking copies of their target websites in hope of convinc-ing users to disclose their credentials. These credentials were storedeither on the original server or communicated to the attacker ( an email) for later abuse [57].

6 These rudimentary phishing se-tups required substantial effort on behalf of attackers to clone targetwebsites, make the necessary content-modification to make thesesites operational, and repeat this entire process to match updatesto the UI of the target reduce the effort required by attackers to create and servephishing content, all-in-onephishing toolkitsbegan to overtaketraditional setups. These toolkits revolutionized how phishing web-sites are created by automatically fetching static copies of webpages from targeted websites, serving them to victims, and prevent-ing detection through cloaking mechanisms all while requiringminimal effort by attackers [50]. However, the increasing adoptionof two-factor-authentication (2FA) mechanisms by online services,and the rapid evolution of web content has increased the needfor phishing toolkits to adopt real-time mechanisms in place ofantiquated static limitations fueled the proliferation of a new generationofMan-in-the-Middle (MITM)phishing toolkits [8,14,15].

7 Thesenext-generation phishing toolkits act as malicious reverse proxyservers, forwarding requests and responses between the victimand the target web server, while extracting credentials and sessioncookies in transit. This eliminates the need to create and maintainrealistic phishing web pages (the phishing page is now a perfect copy of the victim website) as well as manually communicatingwith the target website to send the user credentials and 2FA codesto obtain the authenticated session cookie. Moreover, because ofthe continuous proxying of requests and responses, these toolsgreatly increase the believability of the attack by allowing users tocontinue browsing the phishing siteafterthey authenticate, as ifthey are truly interacting with the target this work, we present the first analysis of this new generationof phishing toolkits.

8 We study 13 versions of popular MITM phish-ing toolkits and present a methodology to fingerprint them in thewild, both from the perspective of a user interacting with a phishingwebsite, as well as the target website receiving login attempts from atoolkit impersonating a regular user. We produce a globally-diversedataset of laboratory MITM phishing toolkit deployments, detailingtheir network -level characteristics. Using this dataset, we developa machine learning classifier that leverages the network timing dis-crepancies inherent to reverse proxy servers to detect the presenceof MITM phishing toolkits with accuracy. We show that ourclassifier is robust to changes made by attackers to thwart finger-printing attempts, and we demonstrate the ability of our classifierto detect unseen phishing toolkits.

9 By proposing fingerprintingmethods that uniquely identify MITM phishing toolkits, we en-hance the ability of web-service providers to pinpoint maliciouslogin requests and flag them before authentication is automate the discovery and analysis of MITM phishing toolk-its on the web, we create a fingerprinting tool which we be directly integrated into current web infrastructuresuch as phishing blocklist services to expand their coverage onMITM phishing toolkits, as well as popular websites to detect ma-licious requests originating from MITM phishing , we study the usage trends of these tools in thewild over the course of a year, discovering 1,220 websites utiliz-ing MITM phishing toolkits targeting popular services includingGoogle, Yahoo, Twitter, and Facebook. We observe that, due to theirhighly-targeted nature and cloaking mechanisms, MITM phishingtoolkits occupy a blind spot in current phishing blocklists, as of domains and of IP addresses associated with theMITM phishing toolkits we discovered appear on popular block-lists.

10 Additionally, through our collaboration with Palo Alto Net-works, we find that enterprise users are targeted by MITM phishingtoolkits, with 260 of our discovered phishing sites receiving 6,403customer requests over a six-month summary, the contributions of this paper are as follows: We present the first, in-depth study of MITM phishing toolkits. We propose a machine learning classifier that utilizes network -level features to classify phishing websites hosted by suchtoolkits with accuracy. We develop a MITM phishing toolkit fingerprinting frame-work, calledPHOCA, that can collect data on and classifyMITM phishing toolkits on the web. We usePHOCAto explore the use of MITM phishing toolkitsin the wild and find that current phishing blocklists do noteffectively report these malicious websites.