Top

Phish Detection Agency

Difficulty:

Description:

Fitzy Shortstack on Film Noir Island needs help battling dastardly phishers. Help sort the good from the bad!

---

Solution

Solution

When you launch the Phishing Detection Agency applicaion in the Blacklight District on Film Noir Island, it loads an inbox that contains 34 emails.

These emails can have a status of "Safe" or "Phishing". If you change an email's status the Phishing Detection Agency app will check to see if you are correct.

When the phishing agency app loads it also populates the inbox using javascript from a file called seed.js
https://hhc23-phishdetect-dot-holidayhack2023.ue.r.appspot.com/static/seed.js

I offloaded the 34 emails into a json for further analysis offline:
emails.json

After reading up on the hints provided in my badge, I learned that I needed to check for things like the "from" email address not matching the "Return-Path" address, or the DKIM signature is missing or invalid. Since I had the emails in a structured format, I could ask OpenAI which emails are likely fishing based on the aboved criteria.

I included the json array of emails in my prompt and asked it to find phishing emails based on the following criteria:

• Mismatched From Address and Return-Path Address
• Missing DKIM Signature
• DMARC Failure

My new Phishing Expert AI assistant replied with a list of 10 emails and its reasoning for suspecting them of being phishing.

I tested the theory by marking the following 10 emails as phishing in the Phishing Detection Agency App:

quincy.adams@geeseislands.com
steven.gray@geeseislands.com
laura.green@geeseislands.com
oliver.thomas@geeseislands.com
rachel.brown@geeseislands.com
xavier.jones@geeseislands.com
michael.roberts@geeseislands.com
victor.davis@geeseislands.com
nancy@geeseislands.com
ursula.morris@geeseislands.com

Once I marked those I got a success response and the objective marked complete in my Badge!