AWS from major companies hosting their work on the service, to individuals using it to create and host webpages, it is a force. If you’re using a site on the Internet, there’s a good chance that AWS is involved in some fashion.
One way that folks use AWS is to build and host web pages. The service allows you to host a WordPress site or something fully created with custom code. With a little bit of coding knowledge, you can create a free website that’s hosted on AWS.
Hackers, who know a little about coding, are taking advantage of this by building phishing pages on AWS. Sending a link to this page via email is a way to bypass scanners and get users to hand over credentials. This is something to be concerned about given that according to Check Point’s Threat Intelligence Report for India, over 70% of the malicious files in India were delivered via email in the last 30 days.
In this attack brief via our team from Avanan, a Check Point Company, we will highlight how threat actors are creating phishing pages on AWS using the site’s legitimacy to steal credentials.
Attack
In this attack, hackers are creating phishing websites using AWS Apps.
- Vector: Email
- Type: Credential Harvesting
- Techniques: Static Expressway
- Target: Any end-user
Email Example #1
The user is presented with what looks like a standard password expiration email.
Email Example #2
When looking at the email under the hood, a few things stand out. One, there’s a fake nickname with the sender address, however, you can see that the domain is a legitimate AWS domain. The text is not related to the attack. The email in question is in Spanish, but here’s a rough translation of part of it:
Hello Oscar,
Finally, we did not manage to talk yesterday, but I take the opportunity to write you this e-mail with the details of the quote that we require. The date for submitting the quote would be Thursday, June 16, 2022, at 11:59 p.m.
As I told you on WhatsApp, we must quote the start-up of an earthquake monitoring system in the dam and the dam of the Tominé reservoir. The system must have wireless monitoring at all times and must be viewable on a platform.
This, obviously, has nothing to do with a password reset.
Finally, when clicking on the link, the user is redirected to a log-in page. The domain of the victim’s company is there; so is the email pre-populated and the company logo. All the user has to do is fill in their password and their credentials are stolen.
Techniques
To get into the inbox, hackers will do whatever they can. This compromises a myriad of techniques. Recently, we’ve seen a significant uptick in attacks using legitimate services as a piggyback to land in the inbox. We call this The Static Expressway. Email services that use static Allow or Bock Lists to determine if email content is safe or not are not immune to these attacks. Essentially, these services will determine whether a website is safe or not. Amazon Web Services will always be marked as safe. It’s too big and too prevalent to block. We’ve seen this example with Google, QuickBooks, PayPal and much more.
This particular example uses AWS to send and host a phishing email. A static solution will not block something from AWS; further, the email comes from a legitimate domain and the email content is all over the place, done to confuse scanners.
When a user clicks on the password reset page, they will see the company domain filled in at the URL bar; their company logo will be present and their email is pre-populated. For a victory for the hacker, they just need the user to enter their password.
With an easy way into the inbox, plus a low lift from end-users, this type of attack can be quite successful for hackers.
Avanan notified AWS of these findings and will update with any additional information.
Best Practices: Guidance and Recommendations
To guard against these attacks, security professionals can do the following:
- Always hover over any link to see the destination URL before clicking on it
- Encourage end-users to ask IT if the email is legitimate or not
- Always look at the content of the email before proceeding
