Smishing Strategy Dynamics and Evolving Botnet Activities in Japan

Abstract

XLoader and FakeSpy, the two major smishing botnets targeting Japan, change their attack strategies over various timescales. Based on recent observations of the botnets and Twitter data, we present empirical facts about their strategies and activity patterns and applied some of these strategic and activity patterns to malware detection and malicious domain detection. All the proposed methods yielded small false positive and negative rates, and are expected to run on user devices owing to their small computational cost. Recent malware detection methods based on traffic analysis extract TCP/IP traffic features if the upper layers of TCP are encrypted. In this study, Frida's hooking capability was employed to decode the upper layers (WebSocket and JSON-RPC) to create a list of all commands flowing over the botnet channel. The command-level traffic analysis presents decisive attack features because commands are transmitted according to strategies developed by the attackers. The proposed malicious domain detection method, on the other hand, exploited the tendency of the attackers to create domains in batches. Previous researchers focused on how benign and malicious domains were registered and used on the name servers. The proposed method, on the other hand, focuses on the arrival rate of SMS messages with URL links. The error rates become significantly small when users do not receive such messages very often.

Canary in Twitter Mine: Collecting Phishing Reports from Experts and Non-experts

“…In this study, we propose an approach that uses Twitter as a new observation point to immediately collect actual phishing situations encountered by users that have bypassed existing countermeasures and to understand the characteristics of such phishing. Some previous studies have also used Twitter as a source to extract nonphishing cyberattack information (e.g., vulnerability information and malware behavior information) [16,51,54,55] and limited phishing cyberattack information (e.g., search by fixed keywords or monitor only specific users) [52,55,58]. Specifically, these previous studies used Twitter posts of the cyberattack information by security experts, which allowed them to identify vulnerability information and indicator of compromises (IOCs) before they were published on the National Vulnerability Database [42] and Virus-Total [10].…”

Program Models California State University-San Marcos

“…To counter this growing threat, creating new publicly available datasets becomes imperative to develop effective models and strategies. However, there are limited publicly available SMS phishing datasets [9,18]. These datasets also face relevance challenges due to various factors.…”