{"id":42794,"date":"2022-02-22T15:18:22","date_gmt":"2022-02-22T15:18:22","guid":{"rendered":"http:\/\/icloud.pe\/blog\/?guid=9c1402231eb2988dfe189e23f98862e6"},"modified":"2022-02-22T15:18:22","modified_gmt":"2022-02-22T15:18:22","slug":"novel-phishing-method-deceives-users-with-ubiquitous-it-support-tool","status":"publish","type":"post","link":"https:\/\/icloud.pe\/blog\/novel-phishing-method-deceives-users-with-ubiquitous-it-support-tool\/","title":{"rendered":"Novel phishing method deceives users with ubiquitous IT support tool"},"content":{"rendered":"


\n Connor Jones<\/a><\/span>
\n <\/span><\/p>\n

\n
\n
22 Feb, 2022<\/span><\/div>\n<\/p><\/div>\n<\/div>\n

\n<\/a><\/p>\n

\n

A cyber security researcher has documented<\/a> a novel phishing technique that involves cyber criminals harnessing virtual network computing<\/a> (VNC) technology on a private server to launch a variety of attacks.<\/p>\n

Using the open source<\/a> noVNC client, the phishing technique allows successful attackers to launch malicious code into a victim\u2019s browser, plant a keylogger, and passively observe all user activity.<\/p>\n

\u200b<\/span><\/p>\n

The researcher, who goes by the name\u00a0mr.d0x. claims the method of attack bypasses\u00a0two-factor authentication<\/a> (2FA), including Google\u2019s 2FA protocol used for the likes of Gmail and Google accounts, and facilitates the stealing of credentials.\u00a0<\/p>\n

The phishing method effectively acts as a VNC client for the attacker to remotely monitor and access a user\u2019s environment, creating a man-in-the-middle (MITM) attack.<\/p>\n

The technology is common in modern businesses, with employees being familiar with IT support teams accessing their computers remotely<\/a> to resolve technical issues.\u00a0<\/p>\n

The initial deception is achieved in a typical phishing<\/a> format – a strategically crafted email provides a link the user needs to click on. Once clicked, the user is taken to a direct server run by the attacker, rather than a malicious web page.<\/p>\n

The attack can be launched against individuals using any browser, theoretically including ones on mobile devices, though the researcher said they had difficulty in executing the attack on smartphones<\/a>.\u00a0<\/p>\n

There are some shortcomings with the method, the researcher said, including the issue whereby the attacker has to provide control of their machine to the victim in order for the attack to work.<\/p>\n

It\u2019s also possible that given the nature of VNC software, there may be some noticeable input lag for the victim, offering an indication that the website is not legitimate.<\/p>\n

<\/drupal-entity><\/p>\n
\n
\n
YouTube<\/div>\n
https:\/\/www.youtube.com\/watch?v=EiyiaUoQvOU<\/a><\/div>\n<\/div>\n<\/div>\n

<\/span><\/p>\n<\/div>\n

This is currently a proof of concept style of phishing attack with no known actively exploited cases in the wild, though remote access to businesses is reportedly on the rise in a string of burgeoning dark web operations<\/a>.<\/p>\n

\u201cBrowsers are more powerful than ever and the usage of browsers as clients for remote access provides new ways for attackers to steal credentials, bypass 2FA, and more,\u201d said<\/a> the researcher. \u201cI strongly believe that what I\u2019ve demonstrated in this article is only a small portion of what this technique can be used for.\u201d<\/p>\n

noVNC attack breakdown<\/h2>\n

The attacker first needs to deploy a Linux machine via a cloud service provider<\/a>; any provider or Linux distro<\/a> is fine. Firefox is good for this, the researcher said, but any browser with a kiosk mode will also work.<\/p>\n

<\/drupal-entity><\/p>\n
\n
\n
\n
Featured Related Content<\/div>\n
The best defence against ransomware<\/a><\/div>\n<\/div>\n<\/div>\n<\/div>\n

<\/span><\/p>\n<\/div>\n

Once the Linux instance is up and running, the attacker then needs to install VNC software such as TightVNC or TigerVNC before running some custom commands to ensure the environment is correctly configured for the attack. The noVNC javascript library and application can then be downloaded from GitHub<\/a> and installed too.<\/p>\n

A web browser needs to be running in the deployment and displaying the authentication page from which the attacker wants to steal credentials, such as Google\u2019s login page. The attacker can use any browser, Firefox is good here, but it must be running in kiosk mode.\u00a0<\/p>\n

This technique is effective in spear phishing campaigns<\/a> but will encounter issues if sent to multiple targets since they will be sharing the same VNC session.\u00a0<\/p>\n

However, the technique can be modified and automated so different users access different VNC sessions by assigning users to different ports.<\/p>\n

\u200b<\/span> <\/p>\n<\/p><\/div>\n","protected":false},"excerpt":{"rendered":"

Connor Jones<\/p>\n

22 Feb, 2022 <\/p>\n

A cyber security researcher has documented a novel phishing technique that involves cyber criminals harnessing virtual network computing (VNC) technology on a private server to launch a variety …<\/p>\n","protected":false},"author":507,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[],"tags":[],"class_list":["post-42794","post","type-post","status-publish","format-standard","hentry"],"_links":{"self":[{"href":"https:\/\/icloud.pe\/blog\/wp-json\/wp\/v2\/posts\/42794","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/icloud.pe\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/icloud.pe\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/icloud.pe\/blog\/wp-json\/wp\/v2\/users\/507"}],"replies":[{"embeddable":true,"href":"https:\/\/icloud.pe\/blog\/wp-json\/wp\/v2\/comments?post=42794"}],"version-history":[{"count":2,"href":"https:\/\/icloud.pe\/blog\/wp-json\/wp\/v2\/posts\/42794\/revisions"}],"predecessor-version":[{"id":42796,"href":"https:\/\/icloud.pe\/blog\/wp-json\/wp\/v2\/posts\/42794\/revisions\/42796"}],"wp:attachment":[{"href":"https:\/\/icloud.pe\/blog\/wp-json\/wp\/v2\/media?parent=42794"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/icloud.pe\/blog\/wp-json\/wp\/v2\/categories?post=42794"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/icloud.pe\/blog\/wp-json\/wp\/v2\/tags?post=42794"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}