An Evaluation of Traditional Phishing Vs Mobile Vishing Jamie Burkinshaw Ethical Hacking /14

Abstract Aspects of traditional phishing were identified including, HTML generation and website cloning. A phishing was examined and weaknesses were found. These weaknesses were addressed and an was generated with a higher likely success rate. A Website was cloned and compared against the original and was found to be identical. This means that if a cognitive bias could be triggered in the target to make them access the website it is unlikely they would realise it was fake. Aspects of Vishing were also identified including interactive voice response systems and dual-tone multi-frequency signals. Methods of carrying out a vishing attack were also examined such as manually deciphering the tones by ear; creating a piece of computer software to perform the task or creating an application for a mobile device. The latter is the method that was attempted in this investigation. The application created was intended to play recorded messages to a target that had called and record the dual tone multi frequency (DTMF) tones used to respond. The application was a success and DTMF tones were decoded. A conclusion was drawn that even though traditional phishing is easier and quicker, it is so well known that more and more people are becoming aware of how to spot fake s meaning that with enough time to set up the attack, Vishing could be a more effective solution in a penetration testing environment.

Aims The aims of this investigation are as follows: To investigate traditional phishing methods. To investigate vishing methods. To attempt to create an application capable of aiding a vishing attack.

Introduction Social Engineering defined as “the act of manipulating a person to take an action that may or may not be in the “target’s” best interest. This may include obtaining information, gaining access, or getting the target to take certain action.”(Hadnagy, 2011) Triggering cognitive biases in targets by causing them to feel strong positive or negative emotions can allow their credentials to be gained. Social engineering is a big threat to businesses. Over half of companies surveyed by Checkpoint had suffered a social engineering attacks resulting in a loss of between $25,000 and $100,000. Phishing s are the most common source of attack.

Phishing “An fraud method in which the perpetrator sends out legitimate-looking in an attempt to gather personal and financial information from recipients”(Rouse, M. 2007) Traditional: Send the same to many people requesting they respond with their detail. Spear: Targeting a specific individual, more likely to succeed Online tools can be used to generate HTML s to mimic those sent by organisations. SET can be used to generate exact copies of websites. Combining the two can be used to carry out a spear-phishing attack.

Credentials Harvested

Vishing Voice-Phishing “The act of using the telephone in an attempt to scam the user into surrendering private information that will be used for identity theft”(Webopedia, 2014) DTMF Tones: Dual Tone Multi Frequency tones produced each time a button is pushed on a telephone keypad IVR System: Interactive Voice Response system. Used by organisations to manage conversations without using an operator. Manually decode DTMF tones by ear, use PC software or use a specially designed mobile application

App Development 1 Aims for the app: – To intercept an incoming phone call from a target. – To play recorded messages to the target, mimicking and IVR system. – To record the responses to the messages. To prove the app is effective the operator should be able to: – Export recorded sound to a PC – Analyse the sounds of the key presses by the target – Attempt to discern which keys the target entered. App will be developed for Android and tested on a Samsung Galaxy SIII

App Development 2 MediaPlayer class used to play messages through speakerphone: AudioManager audioManager = AudioManager)getSystemService(Context.AUDIO_SERVICE); Context appContext = getApplicationContext(); MediaPlayer player = MediaPlayer.create(appContext, R.raw.welcome); audioManager.setSpeakerphoneOn(true); player.start();

App Development 3 Broadcast receiver used to launch app when a phone call is going to be received. Registered in manifest:.incoming class told what to do when the broadcast is received Intent i = new Intent(context, MainActivity.class); i.addFlags(Intent.FLAG_ACTIVITY_NEW_TASK); context.startActivity(i);

App Development 4 Button created to answer phone on button press Intent a = new Intent(Intent.ACTION_ANSWER); startActivity(a); Permission MODIFY_PHONE_STATE is "Not for use by third- party applications“(Android, 2014) To allow this piece of the application to be fully functional the device used must be using Android version 2.2 or earlier.

App Development 5 Record phonecall audio from microphone: final MediaRecorder audioRecorder = new MediaRecorder(); audioRecorder.setAudioSource(MediaRecorder.AudioSource.MIC); audioRecorder.setOutputFormat(MediaRecorder.OutputFormat.DEFAULT); audioRecorder.setAudioEncoder(MediaRecorder.AudioEncoder.DEFAULT); audioRecorder.setOutputFile("/storage/extSdCard/recording.mp3"); Set input source as phone microphone Set output source and encoding to default Set output file path to SD card Permissions required:

App Testing Willing and informed volunteer acted as caller and entered random numbers when prompted. Caller reported that messages played were perfectly audible. Messages and corresponding DTMF tones were successfully recorded.

Results Attempted to decode first tones by ear: 50% Success rate for 20 minutes work. Attempted to decode second set using DTMF Decoder software: 100% Success rate for 2 minutes work. Number GuessActual Number 1st33 2nd66 3rd85 4th12 Number GuessActual Number 1st55 2 nd 11 3rd77 4th44

Statistics Demopoulos Associates found that of 100 users over half (53%) had heard of phishing Study conducted 9 years ago which means that has likely risen Study conducted during the course of the investigation shown that of 26 participants: – 20 had heard of phishing 14 could define it – 5 had heard of vishing 4 could define it

Conclusion Phishing is now a household term and as shown by the survey results it is becoming increasingly well known. Because of this it may be less likely to succeed as targets will be more vigilant against any suspicious s. Vishing could be a more successful method as it is not as well known. Targets may believe that their information is safe when entered into a phone. Could be especially useful in penetration testing where more time can be taken to set up the attack.