July 2024 Newsletter
Push Security
A browser-native identity security platform that hardens your identity attack surface and prevents account takeover.
In the wake of Snowflake, we’re back to a more normal news month. Well, except for CrowdStrike making attackers everywhere very jealous with the biggest IT outage in history. But don’t worry, this is a CrowdStrike-free news zone (even if it makes everything else feel just a tad less important)...
Threats under the microscope
How modern phishing toolkits evade detection
We’ve written previously about the rise in AitM and BitM toolkits, which give attackers MFA-bypassing phishing capabilities. Attackers running these toolkits on websites that they have a) created themselves or b) infected with malware are proving to be quite successful at hiding from security teams and threat intelligence vendors.
But, how do these tools evade defenses, and why are they so hard to detect?
How it works:
Attackers and defenders are constantly searching the internet to identify either vulnerable or malicious websites respectively. Just like defenders want to keep attackers out, attackers want to ensure that only the intended users (i.e. human victims) can access their phishing sites, while appearing ordinary and non-threatening to any other visitor.
To this end, attackers are using techniques such as:
And many more, which we’ve explored in a recent blog post.
Why it matters:
Even though they are far from sophisticated (with evidence of obviously suspicious domains and sloppy coding) the tricks that attackers are using to hide the malicious intent of their phishing sites from prying eyes are pretty effective.
For example, at the time of writing this particular Worker, running the NakedPages phishing kit, had been up for at least two days and was currently only triggering 1 detection on VirusTotal.
Push's perspective:
It’s pretty much impossible to stay on top of all the phishing servers on the internet. Even the untargeted mass campaigns will initially be missed by TI feeds, let alone more sophisticated ones.
When we focus on variables that are easy to change or obfuscate (like IP/domain signatures) we make it easy for attackers to get around these checks.
But there are some constants that must always happen as part of the phishing attack chain for the attacker to succeed – like the victim entering their credentials into a login field on a page. If you can stop the act of entering your credentials into any page that they don’t belong to, then you don’t have to worry about confirming whether the page is malicious – the fact that the action is probably malicious in this context is enough to justify blocking it.
Focusing on the actual TTP for phishing – tricking someone into putting their valid credentials into the wrong site – can be a lot simpler and more effective than playing the cat-and-mouse detection → detection-evasion game.
If you want to learn more about this topic and ride along with us as we pick apart a phishing toolkit, check out our recent blog post – hot off the press!
In the news
Snowflake victims go public as attackers double-down
What happened:
AT&T are the latest public Snowflake victim after announcing that the call logs of 109 million customers were exposed as a result of the recent Snowflake attacks. The attack on Neiman Marcus also exposed more than 31 million customer email addresses, despite having previously suggested that the number of impacted customers was limited to 64,472. Finally, hackers are redoubling their extortion attempts on Ticketmaster by leaking physical barcode tickets (and the ability to print your own) for popular events.
Recommended by LinkedIn
Push’s perspective:
We’re still very much at the beginning of the process for Snowflake-related breaches, unfortunately. We won’t be too surprised to see more victims come forward, though in some cases we only know because of the requirement to submit a Form-8K with the SEC, particularly if a ransom is paid and the attacker agrees to make it all quietly go away.
However, the biggest losers are the customers whose data has been shoved into the ether, and are now at increased risk of identity theft and/or extortion, targeted phishing attacks, and account takeover attempts.
Customer data leaked via API attacks
What happened:
ShinyHunters, the same group behind the initial wave of attacks on Snowflake customers, has leaked 33 million phone numbers associated with Twilio’s two-factor authentication app, Authy, potentially making them vulnerable to SMS phishing and SIM swapping attacks. The threat actors compiled the list of phone numbers by abusing an insecure API endpoint. In a similar attack, the email addresses of 15 million Trello users were leaked following an issue that was originally reported in January.
Push’s perspective:
We’re seeing a notable increase in the frequency and scale of data leaks to the point that attackers have, frankly, a huge amount of data to play with right now. Yes, there is a lot of repetition in that data (just look at RockYou2024, which is bad, but looks a lot worse than it is when you consider the proportion of ‘old’ data). But, stolen creds really are the lowest hanging fruit for attackers to pick at.
When considering the high levels of credential reuse that we see, as well as the impact of things like ghost logins on creating MFA gaps, it’s easy to see another Snowflake on the horizon. And, if attackers find a way to target SaaS accounts automatically at scale in the way they used to perform on-premise credential stuffing… then dial the threat up to 11.
What we've been up to
Our co-founder and CEO Adam Bateman was on the Google Cloud Security Podcast, where he had a really thought-provoking discussion around the topic of identity threat detection and response (ITDR) and whether it deserves to be recognized as an independent product category.
We’ve provided the link to the podcast below, but here’s a teaser clip – did Adam win them over? Have a listen and let us know what you think!
We’ve got a load of exciting events coming up that we’ll be either exhibiting or speaking at (or both) – we'd love to see you at:
If you're heading to Black Hat or DEF CON, we're hosting a Happy Hour (well, three hours) at KUMI (in Mandalay Bay), from 6-9pm on August 8th.
📬 Thanks for sharing your week with us. Please invite your friends to sign up.