Rethinking Phishing Defense: Targeting the Server Layer for Effective Mitigation
In my recent analysis of phishing techniques, I observed something alarming: the speed at which a cybercriminal can set up a nefarious operation. Once, I timed an attacker. They registered a domain and had it serving a live credential-harvesting page in under 24 minutes. Out of that time, merely 12 minutes were spent awaiting nameserver activation.
This rapid deployment emphasizes a systemic flaw in how we approach phishing defense. Most organizations focus heavily on blocking domains, routing them through gateways, DNS filters, and threat intelligence platforms. They take pride in reporting the number of blocked domains, which seems reassuring to stakeholders. However, it’s essential to understand that the cost of the domain—a mere dollar and twenty minutes of an attacker’s time—is the least significant expense they incur.
Domains, though critical, represent only one layer. The real costs pile up at the server level. Setting up servers is time-consuming and expensive, and the infrastructure persists across various phishing campaigns, making it a crucial element to monitor. Identifying the server often offers a wealth of information, revealing connections to multiple operations. Yet, modern phishing kits are cleverly designed to obscure these servers from detection.
The Challenge of Adversary-in-the-Middle Attacks
The latest wave of phishing tactics involves adversary-in-the-middle (AitM) proxies. Rather than merely presenting a fake login page, these proxies relay the victim's traffic to legitimate sites—like Microsoft's sign-in page—and then capture the credentials and session tokens as they flow through. Victims are none the wiser, believing they are interacting with a genuine service.
This method has become alarmingly common. Microsoft reported a single AitM campaign impacting over 10,000 organizations. Placing these proxies behind content delivery networks allows attackers to mask their servers effectively. During a recent investigation, I found myself facing such a wall. The certificate transparency tools revealed only the CDN's certificate, hiding the origin server's true identity.
Passive DNS queries yielded no results, which misled some analysts into assuming there was nothing to be found. However, this reflects a misconception; a null result doesn’t equate to non-existence but indicates a need to use different approaches in analysis.
Digging Deeper with the Proxy's Identity
When investigating phishing attempts, the real breakthrough often comes from understanding how the AitM proxies function. For instance, these proxies expose their IP address to Microsoft instead of the victim’s. Microsoft sets a cookie based on the observed client IP, which is then relayed back to the victim along with the legitimate responses. Essentially, attackers leave their calling card visible to anyone capable of analyzing the traffic correctly.
In one case, I discovered that the cookie’s address belonged to a small hosting reseller, known for accepting cryptocurrency. This finding was pivotal but also reminded me of the importance of rigorous scrutiny. Rather than settling on initial findings, I worked to debunk my assumption, testing competing theories until corroboration from independent sources confirmed my results. It's a time-consuming process, but it safeguards against false conclusions.
Tracing an Estate of Phishing Domains
Working at the server level provided me with insights that would have been invisible had I merely blocked the low-hanging fruit. The origin server led me to a secondary domain that had sat idle for months. Further investigation linked back to a registrar whose details weren't associated with any other operations. This led to uncovering multiple domains, revealing a network of domains impersonating reputable brands and orchestrating invoice fraud.
None of this would have surfaced through domain blocking alone. The interconnectedness of these operations was laid bare through scrutiny of the server infrastructure.
Reframing Detection Strategies
The critical lesson for organizations is not just about the methods used for detection. When an employee falls victim to an AitM kit, the relay's IP address will be recorded in your logs, indicating a successful sign-in from an unusual location. This presents a rare opportunity to detect phishing activity that conventional monitoring systems might overlook.
Effective detection hinges on monitoring IP ranges associated with virtual servers, as that's where these proxies operate. Additionally, session tokens are persistent, causing the attacker's activities to manifest as refresh events rather than fresh logins. A focus solely on interactive logins may obscure the ongoing threats.
When an attack is uncovered, the response protocol is crucial: revoke any active sessions before resetting credentials. This order prevents attackers from maintaining access and ensures a timely response to incidents.
I've subsequently detailed my comprehensive analysis, complete with indicators and detection rules, in a public repository for others to review. I encourage other analysts to validate my findings through their own testing.
To distill this all into a central takeaway: while blocking domains feels like a tangible achievement, it’s crucial to recognize that we need to focus on the infrastructure that truly poses a threat. The server layer is where adversaries face their real costs, and that’s where our defensive strategies should be concentrated.
