Phishing Analysis

Ojectives Phishing Internet Protocol (IP) addresses Domain Name System (DNS) names Analyse “From” addresses Analyse URL’s Trace the

Phishing utilizing social engineering Induces the recipient to reveal desired personal information Bank account SSN Address Etc. Sometimes entices the recipient to go to a malicious web site

IP Addressing Each interface on a network is assigned a 32-bit IP address The address has a prefix and suffix ● Network and host ID

Finding Your IP Address Examples – – – Finding your own address –Open a Command window –Type ipconfig/all on Windows

Opening a Command Prompt

Your IP Address

The Easy Way

Who Owns an IP Address Managed by the Internet Assigned Numbers Authority (IANA)IANA Users are assigned IP addresses by Internet Service Providers (ISPs) ISPs obtain allocations of IP addresses from their appropriate Regional Internet Registry (RIR)

Regional Internet Registries (RIR) APNIC (Asia Pacific Network Information Centre) AfriNIC (African Network Information Center) ARIN (American Registry for Internet Numbers) – North AmericaARIN (American Registry for Internet Numbers) LACNIC (Regional Latin-American and Caribbean IP Address Registry) – Latin America and parts of the CaribbeanLACNIC (Regional Latin-American and Caribbean IP Address Registry) RIPE NCC (Réseaux IP Européens) – Europe, parts of the Middle East and AsiaRIPE NCC (Réseaux IP Européens)

Researching IP Addresses ARIN

At Your Finger Tips

Address Geographic Location

URL’s Uniform Resource Locater The name of a web site First name – Top Level Domain.com.biz.edu.net.gov.org.mil.etc

Family Tree Second name is the organization’s name Third name www is particular web server of Geobytes After the / is the directory and document to be displayed IpLocator.htm Default is index.html

Domain Name System Associates URL Names to IP addresses Examples –ww.sou.edu = ww.sou.edu The Domain Name System (DNS) is a set of servers that together know all the names used on the Internet More about this later…

Schemes/Scams Advertisers Spammers Scammers Phishers Spear Phishers

Structure To: From: C: BC: Subject Body

Basic Header

Header Info Header info can be faked –From –Reply to –Return-path –Subject –Date Don't believe it!

Long Headers NOT EASY Different for each client Sometimes impossible For campus Groupwise Open Click on “Message Source”

AOL 1.Open AOL 2.Open the that you wish to check by double-clicking it 3.Under the To: line, there should be a “Sent from the Internet (Details)” line 4.Single left click the word “Details” to open an Internet Information window 5.This should display the full header information

Gmail 1.Log into the Gmail account 2.Open the message in question 3.To the right of the sender’s message will be a “show details” hyperlink and to the right of that is a “Reply” button (I.e., Reply is the default option at least of 10/15/2007). To the right of the word “Reply” is a pipe mark (I.e. |) and a down arrow. Single left-click the down arrow to display a small window of options. 4.Single left-click the word “show option” 5.The headers, in their entirety, will now be displayed in a new window

Hotmail 1.Log into your Hotmail account single left-click the “View Source” option. 2.Single, right-click the you wish to inspect 3.Single, ;eft-click the “View Source” option 4.The will now be displayed in its native HTML-based format with the header information at the very top.

MS Outlook Open Microsoft Outlook Open the that you wish to check the mail header information by double-clicking it Looking at the Office 2007 horizontal "ribbon" menu, move your cusor to the "Options" square Underneath the three icons for Categorize, Followup, & Mark as Unread, there is the word "Options" and to the right of it is a small three-sided square with a diagonal arrow in it Hovering over this miniature icon produces a popup with the wording "Message Options" Single, left-click the miniature icon A "Message Options" window will display The selected header information will be at the bottom of the window to the left of "Internet headers:"

Yahoo! Login to the Yahoo! account in question Single, left-click the "Options" hyperlink text from the top menu Single, left-click the "General Preferences" hyperlink text Scroll down to the Messages section of the page and place a dot in the second radio button option that reads "Show all headers on incoming messages" Scroll down to the bottom of the page and single, left-click the "Save" button Navigate to and open the message in question The full header information will now be displaye

Reading Long Header Info Check path by looking at “received” list Read it upside down (originator is at the bottom of the list) Uses the passive voice, so can be confusing

Actual

Long Header Example

Real Spam

Long Headers

Real Owner of IP Address

Real Spam

Look for Real Link

Checking whois For URL

Another Example Just have to reply to the But where do you go? Not where you think.

Where you think you are going.

Another look at the

ARIN Whois Result Go to Afrinic

Check out Afrinic

Phishing Again Probably should not reply to Nigeria and give them your bank account number

Summary IANA assigns IP addresses Regional Registries assign addresses for regions Start with ARIN when researching –ARIN will tell you where to go for non- American addresses Turn on long headers in Don't fall for silly stuff in the body of the