AiTM: Lessons Learned
Rik van Duijn and Wesley Neelen
"AiTM: Lessons Learned" dives into the evolving threat of AiTM attacks. Our presentation highlights the transition from basic phishing tactics to sophisticated methods that compromise organizational security. The presentation outlines the journey from oldschool phishing attacks, to phishing framework like UADMIN, and the introduction of tools like Evilginx. And now the SaaS providers allowing anyone to buy access to an AiTM platform.
We give an insight into a popular AiTM SaaS platform and the revenue stream hosting such software creates. The session ends by outlining common techniques to prevent these types of attacks. Most organizations use M365 and experience attacks using AITM to bypass MFA. At the same time SaaS providers are building AITM services that allow targeteted attacks allowing for supply chain attacks (AITM targeted against admin sites for: pypi, npmjs and rubygems). At the same time used for very specific scams for example against booking.com. Attackers use the booking.com hotel login to extract creditcard information for upcomming hotel guests.
There's been an uprising in the amount of AITM based attacks. BEC fraud operators use it as MFA is more and more common. But the apearance of SaaS providers in the AITM space make these attacks easier to perform and therefore making them more common. Booking.com has been a popular target allowing attackers to use the hotel operator login to phish creditcards by sending upcomming guests reminders to pay. The fact that these reminders are sent via the booking.com app makes them super trustworthy. At the same time environments such as M365/EntraID are popular targets for other operators. This past year we've been trying to prevent and detect these types of attacks. The goal of the presentation is make attendees aware of the risks, the different operators and types of attacks happening today.
outline:
1) What is AiTM/BITB
1.1) Phishing history
1.2) Old school phish
1.3) Introduction of commong framework (UADMIN, opwelk, haiku)
1.4) Evilginx
1.5) AiTM SaaS providers
2) How to detect phishes
2.1) The concept
2.2) What we have built - didsomeoneclone.me
2.3) Then came the Microsoft idea
2.4) Gaining insight into the amount of phishes
3) Fingerprint tool
3.1) The goal
3.2) How does it work?
3.3) Adding certificate transparency to preempt attacks
3.4) Outcome and statistics
4) What we see
4.1) How often does it actually occur?
4.2) Different actors. Example.com. Evilginx Rick Roll, MSPHP
4.3) Microsoft sandbox also visits the URLs and they come in
4.4) How quickly is Evilginx taken down
5) actors
5.1) various offers
5.2) actor revenue
6) Future work
6.1) automatically finding victims in our EDR tooling
6.2) Attempts at improvement - CSS exfil.
6.3) Roadmap
Licensed to the public under http://creativecommons.org/licenses/by/4.0