Rock Phish: Difference between revisions
Content deleted Content added
No edit summary Tags: references removed Visual edit |
|||
| Line 3: | Line 3: | ||
==Rock Phish gang and techniques== |
==Rock Phish gang and techniques== |
||
At one time the Rock Phish group was stated to be behind "one-half of the phishing attacks being carried out.<ref name="infoworld"/> [[VeriSign]] reports them as a group of Romanian origin,<ref name="compliance"/> but others have claimed that the group is Russian.<ref>{{cite web |last1=Dignan |first1=Larry |title=RSA finds new malware enhanced phishing technique |url=https://www.zdnet.com/article/rsa-finds-new-malware-enhanced-phishing-technique/ |publisher=ZDNet |accessdate=8 September 2018}}</ref> They were first identified in 2004.<ref |
At one time the Rock Phish group was stated to be behind "one-half of the phishing attacks being carried out.<ref name="infoworld"/> [[VeriSign]] reports them as a group of Romanian origin,<ref name="compliance"/> but others have claimed that the group is Russian.<ref>{{cite web |last1=Dignan |first1=Larry |title=RSA finds new malware enhanced phishing technique |url=https://www.zdnet.com/article/rsa-finds-new-malware-enhanced-phishing-technique/ |publisher=ZDNet |accessdate=8 September 2018}}</ref> They were first identified in 2004.<ref>{{Cite book|url=https://books.google.com/books?id=BZLLBQAAQBAJ&pg=PA264&dq=Rock+Phish+gang&hl=en&sa=X&ved=0ahUKEwifm6mX3vvkAhWOA3IKHfI1C1AQ6AEILTAB#v=onepage&q=Rock%20Phish%20gang&f=false|title=Cyber Fraud: Tactics, Techniques and Procedures|last=Howard|first=Rick|date=2009-04-23|publisher=CRC Press|isbn=9781420091281|language=en}}</ref> |
||
Their techniques were sophisticated and distinctive, as outlined in a presentation at APWG eCrime '07.<ref>{{cite web |
Their techniques were sophisticated and distinctive, as outlined in a presentation at APWG eCrime '07.<ref>{{cite web |
||
| Line 14: | Line 14: | ||
== History == |
== History == |
||
In 2004 the first rock phishing attacks contained the folder path “/rock”, which led to the name of the attack, and group. |
In 2004 the first rock phishing attacks contained the folder path “/rock”, which led to the name of the attack, and group.<ref>{{Cite web|url=https://www.phishprotection.com/resources/phishing-prevention-best-practices/|title=Phishing Prevention – Best Practices for Protecting Small or Medium Size Business|last=|first=|date=2019-01-28|website=PhishProtection.com|language=en-US|url-status=live|archive-url=|archive-date=|access-date=2019-10-01}}</ref> |
||
Attackers employed wild card DNS (domain name server) entries to create addresses that included the target’s actual address as a sub-domain. For example, in the case of a site appearing as <nowiki>www.thebank.com.1.cn/thebank.html</nowiki>, ”<nowiki>thebank.com</nowiki>” portion of the domain name is the “wild card”, meaning its presence is purely superficial – it is not required in order for the phishing page to be displayed. “<nowiki>1.cn</nowiki>” is the registered domain name, “/thebank.html” is the phishing page, and the combination of “<nowiki>1.cn/thebank</nowiki>” will display the phishing page. This allows the perpetrators to make the wild card portion the legitimate domain name, so that it appears at first glance to be a valid folder path.<ref>{{cite web |last1=Goodin |first1=Dan |title=FBI logs its millionth zombie address |url=https://www.theregister.co.uk/2007/06/13/millionth_botnet_address/ |publisher=The Register |accessdate=8 September 2018}} |
Attackers employed wild card DNS (domain name server) entries to create addresses that included the target’s actual address as a sub-domain. For example, in the case of a site appearing as <nowiki>www.thebank.com.1.cn/thebank.html</nowiki>, ”<nowiki>thebank.com</nowiki>” portion of the domain name is the “wild card”, meaning its presence is purely superficial – it is not required in order for the phishing page to be displayed. “<nowiki>1.cn</nowiki>” is the registered domain name, “/thebank.html” is the phishing page, and the combination of “<nowiki>1.cn/thebank</nowiki>” will display the phishing page. This allows the perpetrators to make the wild card portion the legitimate domain name, so that it appears at first glance to be a valid folder path.<ref>{{cite web |last1=Goodin |first1=Dan |title=FBI logs its millionth zombie address |url=https://www.theregister.co.uk/2007/06/13/millionth_botnet_address/ |publisher=The Register |accessdate=8 September 2018}}</ref> |
||
==References== |
==References== |
||
Revision as of 18:56, 1 October 2019
Rock Phish refers to both a phishing toolkit/technique and the group behind it.[1][2]
Rock Phish gang and techniques
At one time the Rock Phish group was stated to be behind "one-half of the phishing attacks being carried out.[2] VeriSign reports them as a group of Romanian origin,[1] but others have claimed that the group is Russian.[3] They were first identified in 2004.[4]
Their techniques were sophisticated and distinctive, as outlined in a presentation at APWG eCrime '07.[5]
History
In 2004 the first rock phishing attacks contained the folder path “/rock”, which led to the name of the attack, and group.[6]
Attackers employed wild card DNS (domain name server) entries to create addresses that included the target’s actual address as a sub-domain. For example, in the case of a site appearing as www.thebank.com.1.cn/thebank.html, ”thebank.com” portion of the domain name is the “wild card”, meaning its presence is purely superficial – it is not required in order for the phishing page to be displayed. “1.cn” is the registered domain name, “/thebank.html” is the phishing page, and the combination of “1.cn/thebank” will display the phishing page. This allows the perpetrators to make the wild card portion the legitimate domain name, so that it appears at first glance to be a valid folder path.[7]
References
- ^ a b Compliance and Privacy (2006-12-15). "What is Rock Phish? And why is it important to know?". Compliance and Privacy. Retrieved 2006-12-15.
Rock Phish is an individual or group of actors likely working out of Romania and nearby countries in the region. This group has been in operation since 2004 and is responsible for innovation in both spam and phishing attacks to date, such as pioneering image-spam (Ken Dunham, VeriSign)
{{cite web}}:|author=has generic name (help); Cite has empty unknown parameters:|month=and|coauthors=(help) - ^ a b Robert McMillan (2006-12-12). "'Rock Phish' blamed for surge in phishing". InfoWorld. p. 2. Archived from the original on 2007-01-08. Retrieved 2006-12-13.
The first thing you need to know about Rock Phish is that nobody knows exactly who, or what, they are.
- ^ Dignan, Larry. "RSA finds new malware enhanced phishing technique". ZDNet. Retrieved 8 September 2018.
- ^ Howard, Rick (2009-04-23). Cyber Fraud: Tactics, Techniques and Procedures. CRC Press. ISBN 9781420091281.
- ^ Tyler Moore and Richard Clayton. "Examining the Impact of Website Take-down on Phishing" (PDF). APWG eCrime Researcher's Summit, ACM Press, pp. 1-13. Retrieved October 28, 2007.
- ^ "Phishing Prevention – Best Practices for Protecting Small or Medium Size Business". PhishProtection.com. 2019-01-28. Retrieved 2019-10-01.
{{cite web}}: CS1 maint: url-status (link) - ^ Goodin, Dan. "FBI logs its millionth zombie address". The Register. Retrieved 8 September 2018.