Smashing Smishing by Quashing Quishing

Smashing Smishing by Quashing Quishing

Speakers: Andrew Brandt, Principal Threat Researcher, Netcraft

Conference: SAINTCON

YouTube: https://www.youtube.com/watch?v=R2lMcIKgwIM

Overview

In his compelling SAINTCON talk, "Smashing Smishing by Quashing Quishing," Andrew Brandt, Principal Threat Researcher at Netcraft, sheds light on the escalating threat landscape dominated by sophisticated phishing attacks leveraging QR codes (quishing) and SMS messages (smishing). Brandt, a seasoned expert with a background spanning industry giants like Symantec, Webroot, Blue Coat, and Sophos, dissects the evolution of these mobile-centric attacks, illustrating how they've become increasingly targeted, evasive, and effective at bypassing traditional security measures and even multi-factor authentication (MFA).

The talk underscores a critical vulnerability in modern cybersecurity: the smartphone. While enterprises invest heavily in securing desktops and servers, personal mobile devices often remain a weak link, exploited by threat actors who register thousands of malicious domains and employ advanced phishing kits. Brandt not only details the anatomy of these pervasive threats but also presents a "modest proposal" for a collaborative, industry-wide solution. This involves creating a universal, user-controlled reputation checking API for mobile operating systems, emphasizing the urgent need for phone manufacturers, OS developers, and security companies to set aside competitive interests and collectively safeguard users from a rapidly professionalizing cybercrime ecosystem. His call for justice, extending beyond the network perimeter, frames the talk as a powerful plea for collective action against pervasive digital injustice.

Background

▶ Watch: Speaker Introduction and background (0:00)

The landscape of cyber threats is in constant flux, with attackers continually adapting their methodologies to exploit new technologies and user behaviors. While phishing, the fraudulent attempt to obtain sensitive information by disguising oneself as a trustworthy entity, has been a persistent menace for decades, its evolution into smishing (phishing via SMS) and quishing (phishing via QR codes) represents a significant shift towards mobile platforms.

QR codes, or Quick Response codes, have a surprisingly long history, originating in 1994 in Japan for automotive manufacturing processes. Initially designed to track vehicle parts with high-speed readability, their open-source adoption transformed them into a ubiquitous tool for quick information access, from restaurant menus to payment systems. This widespread integration, however, inadvertently opened a new avenue for exploitation.

The organized practice of quishing began to gain significant traction around 2021-2022, becoming increasingly prevalent and sophisticated throughout 2023. Initially observed in targeted spear-phishing campaigns, these attacks quickly evolved, becoming almost commonplace in both digital (email) and physical environments. This rise coincided with a similar surge in smishing, particularly evident in widespread campaigns targeting mobile users with fake road toll notifications and tax refund scams. The underlying problem, as Brandt highlights, is a fundamental gap in mobile device security, making smartphones the "weak link" in an otherwise increasingly hardened enterprise security posture.

Key Findings

▶ Watch: Powerful WWII Japanese internment camp land acknowledgement (3:20)

Andrew Brandt's research reveals several critical findings regarding the sophistication and pervasiveness of modern smishing and quishing attacks:

Firstly, quishing campaigns are highly targeted and meticulously crafted. Brandt detailed an incident where an employee at his former employer received an email masquerading as an automatically generated document scanner report. This email contained specific references to the company, the employee by name, and even their department, lending it an air of legitimacy. Crucially, the email included a benign PDF attachment that, instead of containing malicious scripts or direct links, simply displayed a high-quality image of a QR code. This subtle approach evades many traditional email security filters that scan for active malicious content.

Secondly, the user interface (UI) of mobile devices actively aids attackers. Brandt noted the inherent difficulty of inspecting a QR code's destination URL on a smartphone without accidentally triggering the link. Mobile camera apps and browsers are designed for ease of access, prioritizing immediate navigation over security inspection, making it dangerously simple for users to inadvertently visit malicious sites.

Thirdly, these attacks frequently employ Adversary-in-the-Middle (AiTM) techniques to bypass multi-factor authentication (MFA). Upon scanning the malicious QR code, victims are often redirected through a series of pages. This typically includes a fake Cloudflare CAPTCHA page to give a sense of legitimacy, followed by a legitimate Office 365 login dialogue framed within another attacker-controlled page. This AiTM (MITRE ATT&CK T1557) setup acts as a proxy, passing the victim's real credentials and MFA tokens directly to Microsoft's servers, validating them in real-time. This means attackers gain immediate, authenticated access to the victim's account, rendering MFA largely ineffective against this specific attack vector.

Fourthly, the rapid professionalization of cybercrime is evident in the widespread use of sophisticated phishing-as-a-service (PhaaS) kits. Brandt specifically mentioned kits like Onyx, Tycoon 2FA, and Rockstar 2FA, all designed to facilitate AiTM attacks and efficiently capture credentials and MFA. These kits enable threat actors, even those with limited technical expertise, to launch large-scale, effective campaigns. The attackers also demonstrate a high level of operational security and scale, registering custom domains often just a day before launching attacks, and leveraging them for short periods before moving on.

Finally, Brandt highlighted the alarming trend of physical quishing attacks. In a striking example from Bath, UK, during the annual Jane Austen Days, threat actors placed high-quality, cut-vinyl QR code stickers on public parking meters. These stickers redirected users to fake payment portals, aiming to harvest financial information. This demonstrates attackers' willingness to blend digital and physical attack vectors, exploiting common infrastructure and public events for maximum impact. The widespread nature of smishing was also underscored, with campaigns targeting 37-38 US states and five countries with highly localized and graphically designed fake toll and tax refund messages.

Technical Deep Dive

▶ Watch: Defining fishing, smishing, and quishing terminology (4:50)

The technical sophistication of modern quishing and smishing campaigns, as detailed by Andrew Brandt, represents a significant leap from traditional phishing, primarily due to the effective deployment of Adversary-in-the-Middle (AiTM) techniques and the use of specialized phishing kits. This section delves into the mechanisms that make these attacks so potent.

At the heart of many sophisticated quishing attacks is the AiTM strategy, mapped to MITRE ATT&CK technique T1557. This technique allows attackers to intercept and manipulate communication between a victim and a legitimate service, often to steal credentials and bypass multi-factor authentication (MFA). In the observed quishing campaigns, the process unfolds as follows:

1. Initial Lure and Redirection: A victim scans a malicious QR code embedded in an email (often a benign PDF) or encounters a physical sticker. The QR code's URL points to an attacker-controlled server.
2. Deceptive Front-End: The victim's browser is first directed to a page designed to mimic legitimate security checks, such as a Cloudflare CAPTCHA. This step serves to add a layer of credibility and potentially deter automated analysis or security bots, making the user believe they are navigating a standard, secure process.
3. Credential Harvesting and MFA Bypass: After passing the fake CAPTCHA, the victim is presented with what appears to be a genuine login page for a service like Microsoft 365. However, this page is not directly hosted by Microsoft. Instead, it is a legitimate Microsoft login dialogue that has been framed (e.g., using an <iframe> or similar technique) within an attacker-controlled web page.

• When the victim enters their username and password, these credentials are first captured by the attacker's server.
• The attacker's server then immediately forwards these credentials to the actual Microsoft login service.
• If the credentials are valid, Microsoft prompts for MFA. This MFA request is also proxied through the attacker's server, which then displays the MFA challenge to the victim.
• When the victim provides their MFA token (e.g., a one-time code or approval via an authenticator app), this token is also intercepted by the attacker and immediately forwarded to Microsoft.
• Because the attacker is acting as a real-time proxy, they effectively "sit in the middle" of the authentication process. They receive the valid credentials and MFA token, use them to authenticate with the legitimate service, and then often gain immediate access to the victim's account on a separate machine controlled by the attacker. This real-time validation means that if a user enters incorrect credentials or MFA, the system will bounce back with an error, further convincing the victim of the page's legitimacy.

This AiTM capability is not built from scratch for each attack but is commonly provided by Phishing-as-a-Service (PhaaS) kits. Brandt highlighted several prominent examples:

• Onyx: Known for its comprehensive capabilities, including MFA capture and rapid login, allowing attackers to exploit compromised accounts almost instantaneously.
• Tycoon 2FA: Another kit specifically designed to facilitate 2FA bypass by framing legitimate login pages.
• Rockstar 2FA: Similar to Tycoon 2FA, focusing on intercepting and utilizing 2FA tokens.

These kits significantly lower the barrier to entry for cybercriminals, enabling them to deploy highly effective AiTM campaigns at scale.

The scale of these operations is staggering. Brandt mentioned an incident where a few dozen initial malicious domains led to the discovery of 6,000 domains registered over a five-month period by a single threat actor group specifically for phishing. This immense infrastructure demonstrates the dedication and resources cybercriminals allocate to these campaigns.

Attackers also employ sophisticated domain registration tactics. Domains are often registered just hours or days before an attack is launched, making it challenging for reputation services to flag them in time. They leverage various domain registrars and hosting providers, often distributing their infrastructure to enhance resilience against takedown efforts.

Furthermore, these campaigns are increasingly geo-targeted and contextually aware. Smishing messages, for example, are graphically designed to mimic official communications from state-specific toll authorities (e.g., Easy Pass, SunPass) or tax agencies across 37-38 US states and five different countries. Similarly, malicious websites often detect the victim's IP address and serve content in the appropriate language (e.g., English for US IPs, Italian for Italy, Hungarian for Hungary, German for Germany, Spanish for Dominican Republic). This localization enhances the credibility of the scam, making it more likely for victims to fall prey. The exploitation of current events, such as messages about tariffs and duties in shipping confirmations, further demonstrates their adaptive nature.

Demo / Proof of Concept

▶ Watch: History of QR codes and the rise of quishing (6:20)

A compelling illustration of the real-world impact and tactical evolution of quishing attacks was presented through a physical demonstration. Andrew Brandt showcased a physical QR code sticker that had been deployed by threat actors on public parking meters in Bath, UK.

During the city's annual Jane Austen Days event, a period of heightened tourism, criminal gangs systematically placed these stickers on electronic parking devices throughout the city. The stickers were not cheaply made; Brandt described them as "cut vinyl and properly printed," indicating a professional production effort. This level of quality is intended to enhance the legitimacy of the fake QR codes, making them indistinguishable from official signage to an unsuspecting public.

When scanned, these malicious QR codes redirected users to fraudulent payment portals designed to mimic legitimate parking payment services. The objective was to harvest payment card details and other sensitive financial information from individuals attempting to pay for parking.

Brandt's colleagues at Netcraft, recognizing the threat, actively removed these stickers from the parking meters on the very day they were applied. One such sticker was salvaged and given to Brandt, who displayed it affixed to his lunchbox, dubbing it his "weaponized QR code lunchbox." This tangible artifact served as a powerful proof of concept, demonstrating how quishing has transcended digital screens to directly exploit physical infrastructure and public trust. It highlighted the organized nature of these criminal operations, with "gangs all over the UK" engaging in similar tactics to "bomb cities" with fake QR codes. The rapid response by Netcraft also underscored the ongoing battle between threat actors and security professionals in the physical realm.

Defensive Implications

▶ Watch: First example: Targeted spear phishing with QR codes (7:00)

The prevalence and sophistication of smishing and quishing attacks reveal significant gaps in current cybersecurity defenses, particularly concerning mobile devices. Andrew Brandt's talk meticulously outlines these shortcomings and proposes a bold, collaborative solution to mitigate the threat.

Current Mobile Protection Deficiencies:

Brandt emphasizes that smartphones are the primary weak link in the security chain. While enterprise environments typically deploy robust Endpoint Detection and Response (EDR) solutions and firewalls for laptops, desktops, and servers, mobile phones often lack comparable protection. He notes that even Google Safe Browse on Android, while present, is a subset of its desktop counterpart due to storage and processing limitations. This means it's less comprehensive and less up-to-date, offering inadequate protection against rapidly deployed malicious domains. Furthermore, user education on mobile security remains "between really bad and extremely bad," with many users unaware of the dangers of tapping suspicious links or scanning unknown QR codes.

Brandt's Modest Proposal: A Reputation Checking API Layer:

To address these issues, Brandt proposes a fundamental architectural change: implementing a reputation checking API layer directly into mobile operating systems, positioned between the camera/messaging apps and the browser/web view.

1. Functionality: When a user scans a QR code or taps a URL in an SMS, Signal, WhatsApp, Telegram, or Discord message, this API would intercept the request. It would then query a reputation service to determine if the destination URL is safe. If flagged as malicious, access to the page would be blocked, preventing the user from reaching the phishing site.
2. Addressing Redirection Chains: A key challenge is that threat actors often use open redirection vulnerabilities or legitimate services (like google.com) to redirect to malicious sites. A simple check of the initial URL would be insufficient. The proposed API would need to resolve the entire redirection chain, potentially by passing the URL to a Document Object Model (DOM) environment to fully render and identify the ultimate endpoint before making a reputation decision.
3. Overcoming "Walled Gardens": Brandt acknowledges the significant hurdle posed by the competitive "walled garden" ecosystems of mobile OS providers like Apple and Google. These companies typically prioritize proprietary solutions. His proposal demands a paradigm shift: these companies must collaborate, not compete, on core security infrastructure.
4. User Choice and Control: Crucially, Brandt insists that user choice and control must be paramount. Users should not be locked into a single vendor's reputation service. An Apple user should be able to opt for Google's service, and vice versa, or choose a reputable third-party feed (analogous to popular ad-blocking DNS services like Pi-hole). This open standard would foster competition among reputation service providers while ensuring universal access to protection.
5. Feedback Loop: No reputation service is perfect. False positives (blocking legitimate sites) and false negatives (missing malicious sites) are inevitable. Therefore, a robust feedback loop is essential. Users must be able to report issues back to the reputation service providers. This feedback mechanism must be designed with user privacy and safety in mind, guaranteeing that reporting does not lead to marketing exploitation or, worse, expose the reporter's identity to threat actors.
6. Industry Collaboration and Standards: Brandt advocates for leveraging existing models of collaboration within the cybersecurity industry, such as the Cyber Threat Alliance (CTA). These groups demonstrate that security companies can share threat intelligence while still competing on products and features. He suggests that phone makers, OS developers, cellular providers, and security companies must collectively agree on high standards for URL reputation and aggressive takedown procedures.
7. Aggressive Takedowns: Web hosts and service providers must adopt a much faster and more aggressive stance on taking down malicious infrastructure. Brandt notes that while Cloudflare, for example, is working hard, the sheer volume of newly registered malicious domains (e.g., 6,000 domains in five months for one campaign) necessitates an even quicker response.
8. Regulation as a Catalyst: Given the historical reluctance of tech giants to collaborate on non-competitive features, Brandt reluctantly suggests that regulation of the mobile OS market might be necessary to compel these companies to work together on an open standard for mobile security. He believes that without such external pressure, the profit motive and competitive instincts will likely prevent the necessary collective action.

In essence, Brandt's defensive strategy calls for a shift from reactive, perimeter-based security to a proactive, integrated, and collaborative model that empowers users while leveraging the collective intelligence of the cybersecurity community to secure the weakest link: the smartphone.

Key Takeaways

• Sophisticated AiTM Attacks: Quishing and smishing campaigns now frequently employ Adversary-in-the-Middle (AiTM) techniques (MITRE ATT&CK T1557) via sophisticated phishing kits like Onyx, Tycoon 2FA, and Rockstar 2FA, enabling attackers to bypass MFA and gain immediate access to compromised accounts.
• Smartphones as the Weak Link: Mobile devices are disproportionately vulnerable due to inadequate built-in security (e.g., limited Google Safe Browse on Android), poor UI design that facilitates accidental clicks, and insufficient user education, making them prime targets for cybercriminals.
• Physical and Digital Convergence: Quishing extends beyond email, with threat actors deploying high-quality physical QR code stickers on public infrastructure (e.g., parking meters) to harvest credentials and financial information, demonstrating a blend of physical and digital attack vectors.
• Urgent Need for Industry Collaboration: Andrew Brandt proposes a "modest proposal" for a reputation checking API layer within mobile operating systems, requiring unprecedented collaboration between mobile phone manufacturers, OS developers (Apple, Google), cellular providers, and security companies to create an open, universal defense.
• User Control and Feedback are Paramount: Any proposed solution must prioritize user choice over reputation service providers and include a secure feedback loop for reporting false positives/negatives, ensuring user data privacy and preventing exploitation.
• Regulation May Be Necessary: Given the competitive nature of the mobile market, Brandt suggests that regulatory intervention might be required to compel major players to adopt open standards and collaborate on fundamental mobile security infrastructure for the greater good.

About the Speaker(s)

Andrew Brandt is a Principal Threat Researcher at Netcraft, a company known for its comprehensive internet services and cybersecurity solutions. With a distinguished career spanning over a decade in cybersecurity, Brandt has held significant roles at prominent security firms including Symantec, Webroot, Blue Coat Systems, and Sophos. His expertise lies in malware and network forensics analysis, a field where he actively engages in "clicking bad links and double-clicking bad programs" so others don't have to.

Beyond his corporate work, Brandt is deeply committed to community engagement and policy advocacy. He is a volunteer docent at the Media Archaeology Lab at the University of Colorado and a guest lecturer at CU Boulder. He is also a co-founder of Elect More Hackers, an organization dedicated to recruiting and training cybersecurity professionals and "hackery-minded" individuals to run for public office. Furthermore, he is involved with Hackers on the Hill, lobbying Congress on cybersecurity-friendly regulations. Brandt serves on the board of World Cyber Health, a non-profit dedicated to assisting cybercrime victims through investigations and mutual aid. He is also a key figure at the Malware Village community, where he helps aspiring professionals learn about malware analysis. His dedication to justice, as highlighted in his talk's land acknowledgment, extends to advocating for a safer, more secure digital environment for all users.