Phishing Take-Down Webinar: August 2020

### Overview This AusCERT webinar focuses on the organization's phishing takedown service, internal investigation workflows, and the challenges of combating phishing and malicious infrastructure. The presenter outlines how AusCERT works with hosting providers, domain registrars, and global Computer Emergency Response Teams (CERTs) to take down malicious websites, while clarifying the realistic scope and legal boundaries of their operations.

### Key Topics - **Evolution of Phishing**: Tracing social engineering and attacks from early phone "phreakers" in the 1960s–1980s manipulating audio tones to digital email phishing. The speaker emphasizes how phishing expanded from targeting financial institutions to widespread industry targeting, where simple email phishing frequently yields credentials used to pivot into internal enterprise environments. - **Internal Takedown Process**: AusCERT's workflow involves receiving reports via member reporting or internal detection, performing safe analyst analysis, capturing site artifacts, managing the ticket lifecycle, and issuing takedown requests to registrars and hosters. - **Indicator Sharing & Feeds**: The necessity of sharing threat indicators (e.g., via AusCERT's malicious URL feed and MISP instance). The speaker highlights historical community sharing—from mule accounts to URL repositories—and encourages participation in industry groups like the Higher Education/University ISAC and local Joint Cyber Security Centres (JCSCs). - **Boundaries of the Takedown Service**: Differentiating actionable phishing from issues like brand impersonation or intellectual property disputes, which hosters treat as legal matters requiring IP lawyers. The speaker also details the obstacle of bulletproof hosting tied to organized crime.

### Technical Details - **Tooling**: AusCERT uses an internal tool named **Osprey**, developed by analyst Eric using open-source tools to capture phishing artifacts and screenshots immediately before sites alter or go offline. Workflow and communications are orchestrated through a heavily customized instance of the open-source **Request Tracker (RT)** ticketing system. - **Sharing Platforms & Global Networks**: Threat data is distributed via high-confidence, low-volume feeds including a **MISP** instance (collaborating with CIRCL in Luxembourg). AusCERT relies on international coordination channels through **FIRST** (Forum of Incident Response and Security Teams) and **APCERT** (Asia Pacific CERT). - **The Pothole Analogy**: Created by operations manager Geoff, this analogy illustrates that taking down a phishing site is like patching a road pothole; if underlying vulnerabilities in the host are not remediated, sites often reappear quickly.

### Takeaways & Future Roadmap - **Reporting Channels**: AusCERT's primary and preferred reporting method is email for direct ingestion into the ticketing system, though member Slack is also supported. - **Future Capabilities**: AusCERT is planning a member portal to enable real-time tracking of reported phishing cases and potential submission via APIs (such as MISP), while continuing to strengthen ties across APCERT and FIRST.