You’re not cool enough for some malware
As part of a review of phishing in 2012, RSA has outlined how phishers are now using “whitelists” to narrow down their attacks.
In what the company calls “bouncer list” phishing, RSA writes that attackers are now using “black hat whitelists”. Only those on the target list will see the malware page crafted by the attackers (presuming they’re tricked into following a link): anybody else will get a 404 error.
“Much like many high-profile nighttime hotspots – if your name is not on the list, you’re staying out!” writes RSA’s Cybercrime and Online Fraud Communications Specialist Limor Kessem.
The phishing kit uses a list of intended recipients, generating a unique ID and web page for those on the list. When someone follows the link, their ID is checked on-the-fly, Kessem writes, and the target page is only generated for verified victims.
“After the kit collects victim credentials it sends them to yet another hijacked website (taken over using the exact same method of vulnerability exploit and web-shell), where the password-protected attack page lies in wait to steal user credentials.”
The point of all this is to narrow down the attack to “invited guests” – which, the attackers would hope, also delays the detection of the attack, since many detection systems respond best to large numbers of reported attacks. ®