Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Threat Intelligence

6/7/2019
08:00 AM
Connect Directly
Twitter
LinkedIn
Google+
RSS
E-Mail
100%
0%

The Minefield of Corporate Email

Email security challenges CISOs as cybercriminals target corporate inboxes with malware, phishing attempts, and various forms of fraud.

Employee email accounts are prime targets for fraudsters, phishing attacks, and malware delivery as hackers assume someone will click, download, or respond to fall into their traps.

The threats causing concern are far from new — in fact, they're among the oldest. As Cisco researchers point out in a new report, "Email: Click with Caution," spam is 40 years old and phishing is over 30. Over time they've grown in prevalence and sophistication, joined by malware and fraud as criminals find new ways to cause problems for security practitioners.

"It seems never-ending sometimes, the kinds of threats that arrive through email," says Ben Munroe, director at Cisco Security, who also says "the fact that it's still a problem for us … is incredible. Things are not getting better and in fact, things are getting worse."

Incredible, yes, but as researchers note in the report, email's structure is "an almost ideal format" for scammers. Employees are forced to read every message, make judgment calls about what they receive, and decide what to open, click, download, and respond to. The right amount of social engineering can manipulate recipients into accidentally letting attackers in.

More than half (56%) of CISOs say defending against user behavior is "very" or "extremely" challenging, Munroe says, citing Cisco's 2019 CISO Benchmark Study. Only 51% think they're doing an "excellent" job managing employee security. Users often get a bad reputation, but it's tough when cybercriminals have an advantage and their targets don't know what's coming.

"It's not fair for everyone to criticize users for doing what users have to do," he says. Employees have to answer emails, even if an email from their "boss" came from a hacker. "It isn't fair to always say users are not sophisticated — attackers are extremely sophisticated," Munroe adds.

Here, we take a closer look at the emailed threats arriving in their inboxes.

To Click or Not to Click?
Wendy Nather, head of Advisory CISOs at Duo Security, now part of Cisco, says attackers' efforts are going in two directions: one is technological; trying to exploit new methods and plant new payloads. The other is psychological, encompassing social engineering efforts. "You have to defend both on the technical side and the social engineering side," she emphasizes.

Credential theft is one of the most common email-based scams, Cisco researchers found. Cybercriminals send emails from fake addresses ([email protected], for example) and users who click a link are redirected to a fake webpage where they're prompted to enter credentials. Those go to the attacker, who may use them to log in to other Microsoft services.

Cisco cites an Agari report that says 27% of advanced email attacks are launched from compromised accounts — up from 20% in the last quarter of 2018. Microsoft accounts aside, attackers also target popular cloud-based email services like Gmail and G Suite.

Business email compromise (BEC), which caused $1.2 billion in losses in 2018, is another threat to watch. Researchers note attackers don't typically use compromised accounts for these; instead, two-thirds of BEC scams still use free webmail attacks and 28% use registered domains. BEC messages are often personalized; one in every five includes the name of the recipient.

Digital extortion, in which attackers try to convince their victims they have footage of them accessing an adult film site or other content, is another lucrative move for attackers. Munroe notes how advancements in technology have changed the game in extortion: "the improvement in hardware, allowing all of us to have a camera; the improvement in bandwidth, allowing us to stream video" have also driven techniques for malicious activity. Researchers do point out profits from extortion have fluctuated along with the value of Bitcoin over time.

Malware Delivery
Email is still a reliable vector to deliver malware, though attackers have been forced to change their tactics as their victims learned the risk of clicking .exe files. Now, malware is more likely to be served indirectly via documents with less suspicious file types or malicious URLs in messages.

Between January and April 2019, binary files only made up 2% of all malicious attachments. Attackers now gravitate toward .zip files, which make up one-third of attachments. JavaScript files make up 14.1% and, researchers note, and attackers are more frequently using them. It's now the third most-common malicious extension, following .doc (41.8%) and .zip (26.3%).

"Throw PDF documents into the mix, and more than half of all malicious attachments are regularly used document types, ubiquitous within the modern workplace," according to the report.

Malware itself has also evolved, Munroe points out. "I'd say in terms of what they're distributing — the idea of malware or what you could call modular malware — having landed on a host or an endpoint, it's able to detect a number of different parameters about where it is or what to do." Is it in a low-cost environment? Valuable environment? Is there high bandwidth?

"That idea is certainly quite worrisome and given email is a prevalent attack vector, it's certainly concerning for CISOs," he adds.

What's a CISO to Do?
The challenge of email security lies in its commonality. "It's the mundane nature of email, especially trying to trick people into clicking things they spend all day clicking," says Nather.

Some CISOs recognize different users have different risk profiles, she continues, and they adjust their security practices accordingly. Human resources employees, who have to open attachments all day, or financial analysts, who are prime BEC targets, are some examples. "They're putting more security controls around them, isolating them more, hardening their systems more," Nather explains. Some employees have different external email addresses.

In the report, researchers explain how to spot a phishing attempt. A few telltale signs:

  • Sense of urgency: if it demands immediate action, act with caution and confirm with the sender
  • Illegitimate-looking URL: Phishing URLs often look unusual. If it's hidden within text, hover over the link for a closer look. Hesitant? Don't click.
  • Unusual file types: most business emails rely on the same few file types. If you don't recognize it, don't open it.
  • Spelling mistakes and blurred logos: Emails that seem careless may be signs of a phish.

Related Content:

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
REISEN1955
50%
50%
REISEN1955,
User Rank: Ninja
6/13/2019 | 9:46:48 AM
Re: Needs awareness
i feel your pain as this is NOT rocket science material.  True age does begin to show up sometimes and being TOLD to do something to the right mindset is always an order so they follow along like true lemmings over a cliff.  Still the basic basics would have helped here.  
UdyRegan
50%
50%
UdyRegan,
User Rank: Apprentice
6/13/2019 | 4:34:15 AM
Needs awareness
At the previous company which I worked for, there was a cyber attack and the loophole was detected to an employee's computer. She was an old lady with not much background on computer knowledge. She said she received an email asking her to click a link to enter her new credentials as her old set had been tempered with. I wouldn't say she was too naive or gullible but it was a lack of knowledge or awareness from the company that caused the mishap to happen.
REISEN1955
50%
50%
REISEN1955,
User Rank: Ninja
6/7/2019 | 9:42:23 AM
First mistake
Never assume - that users have learned to be careful on clicking on email.  True many more may be saavy but I doubt the number of dumb bunnies has really been reduced.  That small subset of the user population still exists and so whatever controls we have in place can still be worthless if dear Greta clicks on an invoice she should know better about.   She may even KNOW better but just .... well, kinda curious.   Never EVER assume that people have gotten smarter by any yardstick. 
7 Truths About BEC Scams
Ericka Chickowski, Contributing Writer,  6/13/2019
DNS Firewalls Could Prevent Billions in Losses to Cybercrime
Curtis Franklin Jr., Senior Editor at Dark Reading,  6/13/2019
Can Your Patching Strategy Keep Up with the Demands of Open Source?
Tim Mackey, Principal Security Strategist, CyRC, at Synopsys,  6/18/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Building and Managing an IT Security Operations Program
As cyber threats grow, many organizations are building security operations centers (SOCs) to improve their defenses. In this Tech Digest you will learn tips on how to get the most out of a SOC in your organization - and what to do if you can't afford to build one.
Flash Poll
The State of IT Operations and Cybersecurity Operations
The State of IT Operations and Cybersecurity Operations
Your enterprise's cyber risk may depend upon the relationship between the IT team and the security team. Heres some insight on what's working and what isn't in the data center.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-2729
PUBLISHED: 2019-06-19
Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware (subcomponent: Web Services). Supported versions that are affected are 10.3.6.0.0, 12.1.3.0.0 and 12.2.1.3.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise ...
CVE-2019-3737
PUBLISHED: 2019-06-19
Dell EMC Avamar ADMe Web Interface 1.0.50 and 1.0.51 are affected by an LFI vulnerability which may allow a malicious user to download arbitrary files from the affected system by sending a specially crafted request to the Web Interface application.
CVE-2019-3787
PUBLISHED: 2019-06-19
Cloud Foundry UAA, versions prior to 73.0.0, falls back to appending ?unknown.org? to a user's email address when one is not provided and the user name does not contain an @ character. This domain is held by a private company, which leads to attack vectors including password recovery emails sent to ...
CVE-2019-12900
PUBLISHED: 2019-06-19
BZ2_decompress in decompress.c in bzip2 through 1.0.6 has an out-of-bounds write when there are many selectors.
CVE-2019-12893
PUBLISHED: 2019-06-19
Alternate Pic View 2.600 has a User Mode Write AV starting at PicViewer!PerfgrapFinalize+0x00000000000a8868.