from Hacker News

Show HN: Phishing as a service

by naftaliharris on 6/27/15, 10:14 PM with 69 comments

• by chrissnell on 6/28/15, 5:10 AM

  I wrote some Perl years back to take the fight to phishers. You would provide my script with the field names and POST URL of the HTML form within the phishing email, along with some generic types for each form field. There were types for firstnames, lastnames, email, addresses, usernames, passwords, social security numbers, and credit card numbers. The script would generate fake but real-looking values for each of these things--the credit card numbers would even pass a checksum test--and then post to the URL. It would do this as fast as the remote end would accept them with the aim of filling out their database (typically a text file on some compromised server) with bullshit data, making it hard to pick out the legit data from victims.

  It worked wonderfully. I used it through proxies when I could and watched the phishers try to block me or even attack me back.

• by pspace on 6/28/15, 5:45 AM

  I work in security at a large Fortune 500 company. I know at first it sounds like phishing your employees will give you good insight, but you realize quickly that the data you get is not very useful. Here are the roadblocks I've hit with these kinds of simulation phishing services:

  1. They rely on e-mail while phishing attacks come from multiple sources like Facebook and LinkedIn. Sadly, using those services to simulate phishing attacks violates their ToS.

  2. Simulation phishing only provides pass or fail data meaning you cannot determine your weakest links in the organization. At best you get an "average" snapshot.

  3. The data isn't very accurate or precise because there are too many confounding variables involved. Time of day, subject matter, type of phishing (attachment, social engineering, etc). Normally we ran our campaigns once a month but this wasn't enough to produce stable results.

  4. Clicking doesn't mean they fell victim to the attack -- lot's of people click to investigate then report the links. Ideally, I'd like to specifically know WHY the employee clicked the link and HOW MUCH was actually at stake.

  4. It pisses people off. There is enough animosity against us security folks that tricking your employees really hurts that relationship. People feel taken advantage of.

  5. It doesn't actually improve security in any meaningful way. I found that it didn't actually improve people's ability to spot and report phishing attempts. They either became paranoid to the point where they were no longer productive in legitimate emails, or they had no improvements over time.

  6. There's a growing body of knowledge that dismisses the effectiveness of this kind of phishing training (http://www.govinfosecurity.com/interviews/training-doesnt-mi...) .

  With that being said, our company has tried about a dozen of these kinds of services and the best one so far has been one called Apozy that is rather new. It's a different approach but the data and insight you get back is actually very useful.

• by jedberg on 6/28/15, 1:37 AM

  There are many sites like this and I love what they are doing for raising awareness. As one of the first people to ever fight phishing (I worked at eBay and PayPal fighting phishing before there was a word for it), I'm keenly aware that awareness is the only way to really stop it.

  That being said, I don't like these reports, because any time I get a phishing email I immediately load it up in a protected VM to see what it does, so it would count me as a victim. Since the page you go to isn't a real looking login page, you can't differentiate between those who fall for it and those who just clicked to see what it was.

  You need to actually set up the fake page and see who puts in valid credentials to get a true report.

• by zensavona on 6/27/15, 11:32 PM

  the FAQ page is 10/10

  https://cuttlephish.com/faq

• by x0ry on 6/27/15, 10:43 PM

  Love it! My recommendation would be to offer an option for allowing the target to be tricked through the whole process. (Even if credentials are discarded completely.) The idea here is nothing is left to the imagination. What you have is great, but it requires them to read and be observant, which is not the type of person who falls for phishing emails. Clicking the link is "No-No" #1, don't exclude "No-No" #2 from your process.

• by randomflavor on 6/28/15, 12:13 AM

  You should send the emails, and charge me to view the report.

• by watmough on 6/27/15, 10:41 PM

  Neat, but doesn't seem very IT/corporate, which would surely be the intended audience.

  My company uses these guys: http://www.knowbe4.com/

• by Buge on 6/28/15, 12:39 AM

  I often intentionally click links to phishing sites, and sometimes enter in fake usernames and passwords. (I even wrote several bots to auto enter thousands of random usernames and passwords.)

  I don't like the click link = you lose idea.

• by runn1ng on 6/28/15, 1:14 AM

  Hm. I often click on obviously phishing links to see what's there. Would this tool classify me as a victim?

• by jwcrux on 6/27/15, 11:29 PM

  Neat! I really like the easy pricing model.

  Quick question - are you concerned about trademarks (Amazon and such) being included as the phishing templates? Reason I ask is that I'm working on a hosted project [1] similar to this and have considered including default templates. I've held off for this exact reason.

  Edit - another question, your screenshot in the intro page shows an email (in the Gmail client) coming from "support@github.com". Github has spf records setup so I would be interested to know how you manage to spoof the actual email address itself without getting flagged as spam.

  [1] http://github.com/jordan-wright/gophish

• by reagency on 6/28/15, 12:13 AM

  Consider changing pricing to $/click (pay per victim), so that companies are paying for the value you provide (detection security holes), and the CTO can "bet" the CEO that employees need better training/protection.

  Much more upside for you.

• by gitaarik on 6/28/15, 1:17 AM

  What if this site occasionally sends out real phishing mails? If a lot of sites are using it, they would have interesting stats one could use to target the right audience.

  Not saying they would, but they could get hacked of course...

• by gnyman on 6/28/15, 11:58 AM

  Another service which does a similar thing that's been around some time, I used them but the spam filter ate all my fake mail, as it should :-) https://phish5.com/

• by hrbrtglm on 6/27/15, 11:42 PM

  How do you send your emails ?

  If your customer is using google domains, microsoft 365 or what else, and the employees do not fall in your phishing attempt and report your mail as spam, you may be heading for some trouble with delivery afterward.

• by noobermin on 6/28/15, 12:47 AM

  In case anyone one was curious, the "phishing" urls in the phishing emails lead to this page:

  https://cuttlephish.com/cuttlephished

• by ahmetmsft on 6/28/15, 1:20 AM

  I was doing exactly the same project probably 8 years ago when I was still a high school student. I used to have a lot of websites, too but I never launched as I thought phishing is probably illegal and unethical.

• by fokz on 6/28/15, 12:45 AM

  This is a useful service. But I imagine there will be some nontrivial issues regarding spam filtering, server reputation, legal, etc.

  How do you do email authentication? What are the headers that you put on your email?

• by mikeknoop on 6/27/15, 11:24 PM

  Love the brand and name (reminds me of https://www.youtube.com/watch?v=GDwOi7HpHtQ).

• by it_learnses on 6/27/15, 11:51 PM

  Are you hiring?

• by reagency on 6/28/15, 12:14 AM

  Would a company want to give you a list of corporate email addresses?

• by talles on 6/27/15, 11:40 PM

  That's a refreshing idea for a change. Well done!

• by jmatthew3 on 6/27/15, 10:39 PM

  It's a living.