<p><div><div><div><div data-show-faces="false" data-height="21" data-width="100" data-layout="button_count" data-send="true" data-href="https://www.r-bloggers.com/certifiably-gone-phishing/"></div></div><div></div></div><div></div></div>
<div>
(This article was first published on <strong><a href="https://rud.is/b/2018/12/23/certifiably-gone-phishing/"> R – rud.is</a></strong>, and kindly contributed to <a rel="nofollow" href="https://www.r-bloggers.com/">R-bloggers)</a> </div>
<p>Phishing is [still] the primary way attackers either commit a primary criminal act (i.e. phish a target to, say, install ransomware) or is the initial vehicle used to gain a foothold in an organization so they can perform other criminal operations to achieve some goal. As such, security teams, vendors and active members of the cybersecurity community work diligently to neutralize phishing campaigns as quickly as possible.</p>
<p>One popular community tool/resource in this pursuit is <a rel="nofollow" href="https://www.phishtank.com/" target="_blank">PhishTank</a> which <em>is a collaborative clearing house for data and information about phishing on the Internet. Also, PhishTank provides an open API for developers and researchers to integrate anti-phishing data into their applications at no charge.</em></p>
<p>While the PhishTank API is useful for real-time anti-phishing operations the data is also useful for security researchers as we work to understand the ebb, flow and evolution of these attacks. One avenue of research is to track the various features associated with phishing campaigns which include (amongst many other elements) network (internet) location of the phishing site, industry being targeted, domain names being used, what type of sites are being cloned/copied and a feature we’ll be looking at in this post: what percentage of new phishing sites use SSL encryption and — of these — which type of SSL certificates are “en vogue”.</p>
<p>Phishing sites are increasingly using and relying on SSL certificates because we in the information security industry spent a decade instructing the general internet surfing population to trust sites with the green lock icon near the location bar. Initially, phishers worked to compromise existing, encryption-enabled web properties to install phishing sites/pages since they could leech off of the “trusted” status of the associated SSL certificates. However, the advent of services like <a rel="nofollow" href="https://letsencrypt.org/" target="_blank">Let’s Encrypt</a> have made it possible for attacker to setup their own phishing domains that look legitimate to current-generation internet browsers and prey upon the decade’s old “trust the lock icon” mantra that most internet users still believe. We’ll table that path of discussion (since it’s fraught with peril if you don’t support the internet-do-gooder-consequences-be-darned cabal’s personal agendas) and just focus on how to work with PhishTank data in R and take a look at the most prevalent SSL certs used in the past week (you can extend the provided example to go back as far as you like provided the phishing sites are still online).</p>
<h3>Accessing PhishTank From R</h3>
<p>You can use the <code>aquarium</code> package [<a rel="nofollow" href="https://gitlab.com/hrbrmstr/aquarium" target="_blank">GL</a>|<a rel="nofollow" href="https://gihub.com/hrbrmstr/aquarium" target="_blank">GH</a>] to gain access to the data provided by PhishTank’s API (you need to sign up for access and put you API key into the <code>PHISHTANK_API_KEY</code> environment variable which is best done via your <code>~/.Renviron</code> file).</p>
<p>Let’s setup all the packages we’ll need and cache a current copy of the PhishTank data. The package forces you to utilize your own caching strategy since it doesn’t make sense for it to decide that for you. I’d suggest either using the time-stamped approach below or using some type of database system (or, say, Apache Drill) to actually manage the data.</p>
<p>Here are the packages we’ll need:</p>
<pre><code>library(psl) # git[la|hu]b/hrbrmstr/psl
library(curlparse) # git[la|hu]b/hrbrmstr/curlparse
library(aquarium) # git[la|hu]b/hrbrmstr/aquarium
library(gt) # github/rstudio/gt
library(furrr)
library(stringi)
library(openssl)
library(tidyverse)
</code></pre>
<p>NOTE: The <code>psl</code> and <code>curlparse</code> packages are optional. Windows users will find it difficult to get them working and it may be easier to review the functions provided by the <code>urlparse</code> package and substitute equivalents for the <code>domain()</code> and <code>apex_domain()</code> functions used below. Now, we get a copy of the current PhishTank dataset &amp; cache it:</p>
<pre><code>if (!file.exists(&quot;~/Data/2018-12-23-fishtank.rds&quot;)) {
  xdf &lt;- pt_read_db()
  saveRDS(xdf, &quot;~/Data/2018-12-23-fishtank.rds&quot;)
} else {
  xdf &lt;- readRDS(&quot;~/Data/2018-12-23-fishtank.rds&quot;)
}
</code></pre>
<p>Let’s take a look:</p>
<pre><code>glimpse(xdf)
## Observations: 16,446
## Variables: 9
## $ phish_id          </code></pre>