Every day all over the world, companies fall victim to cybersecurity attacks. It's nearly a constant these days. Many of these attacks are preventable with the right amount of attention to detail in system setup and hardening. The three common themes in postmortem examination of all of these attacks boil down to 1) human error; 2) configuration error; 3) failing to proactively defend. In this series of six posts, we will dive into each attack's anatomy, the attack vector, and the ways companies can attempt to avoid being victim to them. In the last post, guest bloggers from G2 Insurance will walk through how insurance companies react to claims, what to watch out for in your policies, and appropriate coverage levels for cyber insurance based on their experience handling claims.
#1 Email Spoofing and Wire Fraud
This attack is essentially a wire instruction interception/redirection or wholly fake request for a transfer. This is an event that comes up daily or at least weekly in any cybersecurity professional's world. This attack typically plays out with a threat actor masquerading as a legitimate authority within a company, typically someone in the C-suite or Director level. To make it successful, the recipient of the wire transfer request has to believe it's legitimately originating from one of those authoritative people.
One way attackers do this is using actual stolen credentials. Despite the flood of data security breaches and database hacks, people unfortunately still use weak passwords and also re-use passwords. We have seen dozens of instances of successful credential attacks where the attacker used publicly available database leak information to gain unauthorized access to corporate accounts. The approach goes like this: an attacker harvests information regarding corporate leadership from various data sources about companies (LinkedIn, Dunn & Bradstreet, Bloomberg, Google Finance) and chooses a few people to target. They then cross-reference those names to leaked credential databases, often times hosted on Darkweb sites, IRC chat rooms, or other forums dedicated to hacking. If the attacker is able to find other accounts belonging to their targets that have been compromised and have a password, they can try that password, and tens of thousands of variations of it, to attack the corporate account of their victim.
Here is an example: Dejan Stanisaviovich is the CFO of a mature manufacturing company. Unfortunately, his MySpace account, that he forgot he had, was leaked as one of 360 million in 2008. Dejan has used the same password since 2007. The attacker found the myspace.com account belonging to Dejan, and his password, which was "4321drowssaP." The attacker then worked out the format of Dejan's corporate email to be dstan@victimco.com, and then tried the password. Since Dejan hasn't changed his password for any account in 10 years, the attacker got access to Dejan's account. From there, the attacker can use the actual account to make wire transfer requests to other employees, which won't be hard to figure out since the attacker has access to his email. The receiving employee sees the requests, and as long as the attacker is careful about wording, format, and the amount requested, the fraudulent wire transfer may actually happen. It's critical that if your company catches this activity, that it contact the FBI immediately because once the initial wire is made, the attacker will move the money several more times to avoid it being frozen.
Another way attackers carry out these attacks when they can't get actual access to a corporate account is through email spoofing. Spoofing an email involves making an email appear to come from someone else. The image below is an actual spoofed email. The name that's blurred in the "From" field is actually a C-suite employee at a startup. However, note the Gmail account that is after it, which is a telltale sign that it's a spoofed email. When employees receive this, many are not trained to check the actual email account address. They may see the name and just assume it's legitimate. This employee caught this one, mainly because their Office 365 administrator setup a warning to prepend to the email body, which shows: CAUTION: EXTERNAL EMAIL SENDER at the top of the email. That's one great way to raise awareness, as is the prepended "EXTERNAL SENDER" in the subject line. Both are easily set up in Office 365.
To view the full article please click here
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.