An adversary targets mobile phone users with a phishing attack for the purpose of soliciting account passwords or sensitive information from the user. Mobile Phishing is a variation of the Phishing social engineering technique where the attack is initiated via a text or SMS message, rather than email. The user is enticed to provide information or visit a compromised web site via this message. Apart from the manner in which the attack is initiated, the attack proceeds as a standard Phishing attack.

How does a Mobile Phishing attack work?

It typically unfolds over 4 phases. It begins with: [Obtain domain name and certificate to spoof legitimate site] This optional step can be used to help the adversary impersonate the legitimate site more convincingly. The adversary can use homograph or similar attacks to convince users that they are using the legitimate website. Note that this step is not required for phishing attacks, and many phishing attacks simply supply URLs containing an IP address and no SSL certificate.

How do you prevent CAPEC-164?

Do not follow any links that you receive within text messages and do not input any login credentials on the page that they take you too. Instead, call your Bank, PayPal, eBay, etc., and inquire about the problem. Safe practices also include leveraging the entity's mobile application or directly typing the entity's URL in the browser and only then logging in. Never reply to any text messages that ask you to provide sensitive information of any kind.

What weaknesses does CAPEC-164 target?

CAPEC-164 exploits 1 CWE weakness, including CWE-451 (User Interface (UI) Misrepresentation of Critical Information).

How severe is CAPEC-164?

MITRE rates CAPEC-164 as High severity with high likelihood of attack.

CAPEC-164: Mobile Phishing (Smishing)

How the attack works

The phases an attacker typically follows to carry out this attack.

Step 1
Explore
[Obtain domain name and certificate to spoof legitimate site] This optional step can be used to help the adversary impersonate the legitimate site more convincingly. The adversary can use homograph or similar attacks to convince users that they are using the legitimate website. Note that this step is not required for phishing attacks, and many phishing attacks simply supply URLs containing an IP address and no SSL certificate.
- Optionally obtain a domain name that visually looks similar to the legitimate site's domain name. An example is www.paypaI.com vs. www.paypal.com (the first one contains a capital i, instead of a lower case L)
- Optionally obtain a legitimate SSL certificate for the new domain name.
Step 2
Explore
[Explore legitimate website and create duplicate] An adversary creates a website (optionally at a URL that looks similar to the original URL) that closely resembles the website that they are trying to impersonate. That website will typically have a login form for the victim to put in their authentication credentials. There can be different variations on a theme here.
- Use spidering software to get copy of web pages on legitimate site.
- Manually save copies of required web pages from legitimate site.
- Create new web pages that have the legitimate site's look and feel, but contain completely new content.
Step 3
Exploit
[Convince user to enter sensitive information on adversary's site.] An adversary sends a text message to the victim that has a call-to-action, in order to persuade the user into clicking the included link (which then takes the victim to the adversary's website) and logging in. The key is to get the victim to believe that the text message originates from a legitimate entity with which the victim does business and that the website pointed to by the URL in the text message is the legitimate website. A call-to-action will usually need to sound legitimate and urgent enough to prompt action from the user.
- Send the user a message from a spoofed legitimate-looking mobile number that asks the user to click on the included link.
Step 4
Exploit
[Use stolen credentials to log into legitimate site] Once the adversary captures some sensitive information through phishing (login credentials, credit card information, etc.) the adversary can leverage this information. For instance, the adversary can use the victim's login credentials to log into their bank account and transfer money to an account of their choice.
- Log in to the legitimate site using another user's supplied credentials

CAPEC-164: Mobile Phishing

Overview

How the attack works

What the attacker needs

Prerequisites

Skills required

Resources required

Consequences

How to mitigate it

How to detect it

Examples

Terminology & mappings

Alternate terms

Frequently asked questions

References

Defend against CAPEC-164

Overview

How the attack works

What the attacker needs

Prerequisites

Skills required

Resources required

Consequences

How to mitigate it

How to detect it

Examples

Related weaknesses

Related attack patterns

Parent

Terminology & mappings

Alternate terms

Frequently asked questions

References

Defend against CAPEC-164