Dealing with phishers

[fanf]

There's been a raft of phishing attacks against Universities over the last few months. We received a couple of thousand of these last night:

Subject:  CONFIRM YOUR EMAIL ADDRESS
Date:     Tue, 6 May 2008 16:08:53 -0400
From:     CAM SUPPORT TEAM 
Reply-To: 

Dear Cam Subscriber,

To complete your (CAM) account, you must reply to this email
immediately and enter your password here (*********)

Failure to do this will immediately render your email address
deactivated from our database.

You can also confirm your email address by logging into your
CAM account at www.webmail.cam.ac.uk/

Thank you for using CAM.AC.UK!
FROM THE CAM SUPPORT TEAM

We did the usual announcement dance, including a notice on the webmail login page, but this did not prevent some users (including webmail users!) from replying to the phish.

captain_aj suggests scanning email to reject it if it contains the user's password. I wonder how long it would take to crypt() every word of every message... :-)

Comments

[burkesworks.livejournal.com]

Had a run of these at work last month, about the same time that the University of Manchester was being hit by them. Crude garden-variety phishing, which appeared to originate from servers in Romania IIRC.

[tikibar]

These phishing attacks can stop any day now. Thankfully our Proofpoint appliances have a phishing score we can check against, so anything that score 99-100 gets the Reply-to: replaced with our helpdesk address. Unfortunately, there's a big grey area where phish and phishy looking legitimate email lives and, well, users will be users. *sigh*

[filecoreinuse.livejournal.com]

[troll] Well the obvious answer is to store a plaintext version of people's password and use grep! The effort of duplicating passwords is more than outweighed by the added security. [/troll]

[cartesiandaemon.livejournal.com]

I was thinking:

1. Send everyone an email containing the word [password1] and inviting them to reply to look at [enticing pics]
2. Send everyone an email not containing the word [password1] and inviting them to reply to look at [different enticing pics]
3. Assume everyone who replies to the second only has the password "password1"
4. Profit.

I'm sure that doesn't work, but something in that plan gives me the heebiejeebies even if it's possible. (Though admittedly it may be better than letting people tell people their passwords.)

[ex-robhu.livejournal.com]

Doesn't this scheme require people to reply, and for you to know the correct "password1" ?

I mean you can guess the password, but that only gives you one attempt (because anyone receiving a few thousand such emails would be tipped off) per user. Wouldn't it be easier to just try to brute force logging in?

[cartesiandaemon.livejournal.com]

I mean, suppose 1% of 10000 students have the password "password1" and 1% of people respond to a plausible looking email, then you'd expect to find out one password, which might be enough. In fact, that's almost certainly stupid and doesn't work at all, which is why I said "I'm sure that doesn't work", but the point is, anything that produces public behaviour based on a private password makes me nervous, just in case there's some other subtle scam I didn't think of. There probably isn't, I don't have a security mindset, it was just my first thought.

Wouldn't it be easier to just try to brute force logging in?

Well, maybe, but I guessed there would be something to stop someone trying n00 logins.

[ex-robhu.livejournal.com]

It looks to me like there is something (i.e. someone) watching to stop someone trying to send such emails too ^_^

[bens_dad]

Wouldn't it be easier to just try to brute force logging in?
Someone is doing that. Our firewall has blocked about 180 hosts in 24 hours, for trying to make too many ssh connections.
The coincidence of the timing is *interesting*, though the logs suggest the ssh attacks are targetting root.

[nunfetishist.livejournal.com]

We had something similar at MMU: they even put the IT department's phone number on it. Still, loads of people replied - fortunately we told Exim to forward the mails to us rather than sending them off to Yahoo.

[senji.livejournal.com]

Apparently my employer's been targeted by a similar one, so I guess it's not just Universities.

[gerald_duck]

Exim already rejects e-mail that contains the user's password. If you don't believe me, just try sending an e-mail containing your password to cn-fanf.livejournal.com-88033@ql.gs.

(Surely nobody reading this journal will fall for that old chestnut?)

[ewx.livejournal.com]

echo "I promise my password is znqrlbhybbx" | mail cn-fanf.livejournal.com-88033@ql.gs

[fanf]

It seems I can test about 2000 words per second to see if they might be a password, which implies that the software going the checking would have to make a reasonably good choice about which words to test.

I'm wondering if this idea is inspired or stupid.

[crazyscot.livejournal.com]

Problematic if people use passwords which might otherwise legitimately crop up in the mail body. Of course, you might consider that a feature.

[fanf]

Yes, I think it is a feature :-) The false positive rate should be negligible since it would only check email from Hermes users, and it would only check a message against the sender's own password.

[mobbsy.livejournal.com]

Does Hermes impose any namespace restrictions on passwords? (e.g. Must contain a capital, must contain a digit, must be at least 6 characters). That could significantly reduce the search space.

[fanf]

Must contain at least one letter and at least one non-letter, must be at least 6 characters. Not sure what the useful maximum length is...

I'm thinking of skipping the message header and checking the first few hundred words that pass these basic tests.

[techiebloke.livejournal.com]

I think leaking any information about users passwords is worrying and needs loads of very careful thought before implementation.

[ingulf.livejournal.com]

Well, you now know which users are dumb enough to do this, so you only need to check *their* mails :-)

You could get a crypto processor. This is our one: http://www.broadcom.com/products/Small-Medium-Business/Security-Processor-Solutions/BCM5862

It can do 2Gbps ipSEC. It's not immediately clear to me how many crypt operations this means it could do.