This week we came across an interesting phishing campaign. Users receive a file named “paymentxxx.pdf.” The file is a recently created PDF v1.5 made with Microsoft Word 2007, which can be opened by any PDF reader—Adobe or any other. The PDF is a single-page document and contains a hyperlink (http://rogerrodd.com/BJ/payment.htm).
The design of the PDF employs trust-generating mechanisms commonly used in phishing schemes, including a bold header stating, “PDF Is Secured,” and an image of a lock and tick mark with “100% SECURE” written across it. The creator also tries to generate trust by providing a benign-looking link to view the “Quotation Order” online, a method considered safe by many of us.
The problem starts when a user clicks the link. The PDF has embedded code to find and open the user’s default browser (on a typical installation of Windows in an enterprise network where installation of third-party software requires IT department/administrator permissions, the default browser is usually Internet Explorer). When the link is clicked, the default browser is launched and the site is opened to a page where the user is asked to confirm his or her identity. The page includes an “Adobe PDF Online” logo, a “stay signed in” check box, and an “Adobe Corporation” copyright notice—all typical phishing campaign strategies where attackers try to give an impression of authenticity.
Our research shows that this page is in fact a harvester for valid Adobe credentials. Note that this website is over HTTP; any form or website which asks for credentials should be over HTTPS (however it is not guaranteed that all websites using HTTPS are legitimate). The webpage also downloads some of its images from other suspicious websites.
When the user clicks the “View Document” button on the webpage, a document from Google Drive is served. Here is another sign of suspicious activity: the webpage requests credentials for Adobe PDF Online, but the document is served from Google Drive. This document is not malicious, but the attackers’ intentions to get your Adobe Online credentials have succeeded. Imagine the loss you might suffer if you use Adobe PDF Online for official purposes—you just handed over all your documents to the attacker.
As soon as this website is accessed, Eastwind Breach Analytics Cloud indicates that it is not benign. As the PDF itself is not malicious, this type of threat will not have been detected or blocked by any AV engines.
The other websites from which the images were downloaded are also flagged. These have a higher threat rating and have already been suspended by the web hosting service.
As we mentioned previously, the PDF document contains code to open the webpage in the user’s default browser. Some browsers, such as Google Chrome or Mozilla Firefox, will show a warning that the page is a phishing website. Others, such as Internet Explorer, do not indicate that the page is a phishing website.
It should also be noted that creation of such documents and even webpages is extremely easy. Each little change in the document or webpage will result in a different hash, thus defeating detection by traditional signature- and heuristics-based detection systems. In real time, Eastwind Breach Analytics Cloud consults Eastwind Labs findings and other leading industry URL reputation engines to get the reputation of each and every URL that was accessed. This makes it extremely easy to catch such threats and alert on them. The above PDF was analyzed by Eastwind Labs and was found to have been created just 3 days before Eastwind Labs saw it.
Eastwind Breach Analytics Cloud sends an email and an alert to your iOS app as soon as any such activity is detected. The threat is analyzed in real time and you will be alerted within minutes. Then you can just change your passwords.
- Block access to this URL (http://rogerrodd.com/BJ/payment.htm).
- Do NOT open attachments from untrusted sources.
- Do NOT click on any links inside documents.
- Get Eastwind Breach Analytics Cloud, the missing piece in your network and data security. Always Watching. Always There.
This network activity was captured by Eastwind Labs and shows the target webpage (http://rogerrodd.com/BJ/payment.htm) fetching additional resources in the form of images and CGI scripts from other websites. Of these, earthmovingattachments.com.au is a blacklisted domain. The following images show the network traffic related to the HTML requests made by the malicious webpage.