Phishing hacker tactics uncovered

Published: Tuesday, 01 August 2017 09:40

Imperva has published a new research report, ‘Beyond Takeover – Stories from a Hacked Account.’ The report reveals common patterns in phishing attacks and how hackers find and use data in compromised accounts.  

To discover details about compromised credentials, Imperva researchers went undercover by creating several fake user accounts, including email and file sharing accounts with Google and Dropbox. Once the so-called honey pot accounts were active, the researchers deployed techniques to lure in the criminals and tracked them over the span of nine months.

The research report reveals details of hacker techniques and behaviours, including how long it takes from takeover to exploitation, what the attacker looks for in the hacked account, which decoys attract their attention, and what security practices they use to cover their tracks.

Among the most interesting findings are:

Attacker behaviour

The report revealed common behaviours of cybercriminals by delving into how attackers cover their tracks. For example, to remain anonymous, attackers should destroy evidence of their presence in accounts by erasing contaminated logins and messages. Yet it was surprising that 83 percent of the attackers did little to cover their tracks. Of those who did cover their tracks, 15 percent erased new sign-in alerts from the email inbox, but usually forgot to delete them from the email trash container.

The research also demonstrated phishers are no more careful than their victims. The Imperva researchers planted various traps within the accounts and most attackers did not hesitate to click the links and open documents – blithely doing so without taking precautionary measures such as using a sandbox or anonymity service. This also means that with a bit of detective work the cybercriminals can be tracked.

Read the report.