Phishers’ techniques and behaviours, and what to do if you’ve been phished

Once a user has been phished, how long does it takes for the phishers to misuse the stolen credentials?

To discover the answer to that question and many others, Imperva researchers went undercover by creating 90 personal online accounts, including email and file sharing accounts with Google and Dropbox. Once the so-called honey pot accounts were active, the researchers deployed techniques to lure in the criminals and tracked them over the span of nine months.

The research report reveals details of hacker techniques and behaviors, including how long it takes from takeover to exploitation, what the attacker looks for in the hacked account, which decoys attract their attention, and what security practices they use to cover their tracks.

Among the most interesting findings are:

• Business data is highly sought. 25 percent of the phishers looked at email subject lines related to business such as those that included the words financial data, customer database or supplier details.
• Attackers aren’t quick to act. More than 50 percent of the accounts were accessed 24-hours or more after the credential takeover. The result is a brief window where if the attack is suspected, a quick password change results in a 56 percent chance of preventing an account takeover.
• Attackers access content manually not through automated tools. 74 percent of the first alerts were triggered within three minutes of account penetration. This timing indicates that the attacker accessed bait documents while exploring the inbox.
• Less than half of the leaked credentials were exploited by attackers. One explanation for this could be that attackers have access to so much data they don’t have enough time to explore it all.
• Beside attempts to obtain sensitive information (mostly passwords and credit card numbers) from the hacked accounts, the attackers also used them for a variety of other things:

  

Attacker behavior

The report revealed common behaviors of cybercriminals by delving into how attackers cover their tracks.

For example, to remain anonymous, attackers should destroy evidence of their presence in accounts by erasing contaminated logins and messages. Yet it was surprising that 83 percent of the attackers did little to cover their tracks. Of those who did cover their tracks, 15 percent erased new sign-in alerts from the email inbox, but usually forgot to delete them from the email trash container.

The research also demonstrated phishers are no more careful than their victims. The researchers planted various traps within the accounts and most attackers did not hesitate to click the links and open documents – blithely doing so without taking precautionary measures such as using a sandbox or anonymity service. This also means that with a bit of detective work the cybercriminals can be tracked.

“As we began this research, our prediction had been that most accesses would be anonymized through Tor or anonymous proxy services,” the researchers also noted.

But, as it turned out, only 39% of the phishers accessed the hacked accounts through Tor, anonymous proxies, or hosting services. According to the IP addresses from which the other 61% accessed the accounts, more than half of the attackers are located in Nigeria:

“By studying cyberattackers, we’ve learned many things including that most attackers don’t bother to cover their tracks, which means they leave evidence behind,” said Itsik Mantin, head of data research at Imperva.

“Furthermore, if we can quickly detect an attack, we then know that swift remediation including a simple password change significantly reduces the odds of a successful attack.”

How to spot if you’re account has been compromised?

Firstly and most importantly, if you have been phished and you realized it pretty quickly, you can minimize the damage by accessing your account (if still possible) and making sure to boot the attacker out of it.

Change the password and check to see if the attacker has changed some of your settings in order to keep having access to the account (e.g. a new secondary email address to help with account recovery, email forwarding, etc.)

If you’re not sure whether an attacker did ultimately access your account, you can check for three signs he or she did:

• “New sign-in alert” emails in the “Trash” folder. “Only 2% of the attackers deleted a new sign-in alert permanently,” the researchers noted.
• If your email provider offers an activity log, check it to see if there have been repeated actions to make messages as “Unread”.
• Check out the “Sent” folder for unusual sent messages, and the “Trash” folder for delivery failure notification messages. During this research, only 13% of the attackers bothered to permanently delete this type of messages.