Attack on credit card and Other info in Netflix

Credit Card Data and Other Information Targeted in Netflix Phishing Campaign

Introduction

Through FireEye's Email Threat Prevention (ETP) arrangement, FireEye Labs found a phishing effort in the wild focusing on the charge card information and other individual data of Netflix clients fundamentally situated in the United States.

This battle is intriguing a result of the avoidance procedures that were utilized by the aggressors:

• ·         The phishing pages were facilitated on genuine, yet bargained web servers.
• ·         Customer side HTML code was jumbled with AES encryption to dodge content based               discovery.
•              Phishing pages were not showed to clients from certain IP addresses if its DNS set out to            organizations, for example, Google or PhishTank.

At the season of posting, the phishing sites we watched were never again dynamic.

Attack Flow

The assault appears to begin with an email notice – sent by the assailants – that requests that the client refresh their Netflix participation points of interest. The phishing join inside the email body guides beneficiaries to a page that endeavors to imitate a Netflix login page, as found in Figure 1

Figure 1 : Fake login page mimicking the Netflix website

After presenting their qualifications, casualties are then coordinated to website pages asking for extra participation subtle elements (Figure 2) and installment data (Figure 3). These sites additionally endeavor to copy valid Netflix site pages and seem authentic. Once the client has entered their data, they are taken to the true blue Netflix landing page.

Figure 2: Fake webpage asking users to update their personal details

Figure 3: Netflix phishing webpage used to steal credit card information

Technical Details

The phishing unit utilizes procedures to dodge phishing channels. One strategy is the utilization of AES encryption to encode the substance exhibited at the customer's side, as found in Figure 4. The motivation behind utilizing this system is code muddling, which dodges content based recognition. By muddling the site page, assailants endeavor to cheat content based classifiers and keep them from reviewing site page content. This procedure utilizes two documents, a PHP and a JavaScript record that have capacities to encode and decode input strings. The PHP document is utilized to scramble the pages at the server side, as found in Figure 5. At the customer side, the scrambled substance is decoded utilizing a characterized work in the JavaScript document, as found in Figure 6. At last, the website page is rendered utilizing the 'document.write' work.

Figure 4: Client-side code obfuscation using AES encryption

Figure 5: PHP code used at server side for encryption