Cloaking: a disturbing new phishing trend
Cybercriminals are hiding their phishing sites to maximise profits
Cybercriminals are becoming more and more inventive with their phishing tactics. In recent years, the methods used to detect phishing sites have improved considerably – pushing scammers to adopt combinations of avoidance tricks. They'll make sites visible only from certain locations, for example, or only from mobile devices, so that the authorities and hosting service providers can't easily see them. Known as 'cloaking', such techniques represent a challenge to global efforts to clamp down on phishing.
What is cloaking?
Cloaking is a general term that covers all the methods used to hide malicious content from everyone except the targets or intended victims. Its purpose is to maximise the length of time that a phishing site remains online. In that context, just a few extra hours can be important, because most phishing sites are nowadays taken down within a day. So delaying detection even briefly can significantly increase the number of people scammed and therefore the economic viability of the fraud.
Forms of cloaking
There are various forms of cloaking. The main 4 are:
1. User-agent cloaking
The tools used to detect online phishing are often recognisable. Scammers can therefore adapt their phishing sites so that they don't show malicious content to tools that scan their URLs.
2. Geolocated cloaking
Phishing content is shown only to visitors whose IP addresses are in certain geographical regions of the world. A detection tool operating elsewhere will therefore be unable to see the fraudulent content.
3. Timed cloaking
Making a phishing site visible only at certain times. For example, a scammer first mails a business, including a link to some legitimate content in the message. Because the material is harmless, the recipient's firewall allows delivery of the message. Then, on Monday morning, the scammer switches the content at the linked URL. So, when the recipient clicks the link, they see a phishing site.
4. Mobile-only cloaking
Many scams are aimed exclusively at mobile users. If a PC is used to visit the phishing site, only legitimate content is visible. So, because anti-abuse personnel are typically using PCs, they don't see the malicious content when checking out the site.
What can be done about cloaking?
The use of cloaking by scammers means that anti-abuse teams and the authorities will have to upgrade their detection methods. For example, they'll need tools that perform additional checks, such as scans of both the desktop and mobile versions of a site, in case mobile-only cloaking is active. To address the problem of geolocated cloaking, sites will have to be scanned from multiple IPs, maybe using a VPN.
While such adaptations are feasible, they imply a substantial increase in the number of tests performed. When purchasing spam filters, firewalls and domain name monitoring tools, it's therefore a good idea to look at a product's or service's ability to cope with the various forms of cloaking and to process test data efficiently.
