The Rising Threat of Email Based Attacks, and How To ... · Fraud Legitimate Email URL Attachment...

The Rising Threat of Email Based Attacks, and How To Counter It

October 9, 2017

Markus Jakobsson

The last fifteen years in one minute

Email Identity Deception, circa 2004

Look for misspellingsLook for poor grammar

Is it not addressed to you?Does it look unprofessional?

Email Identity Deception, 2016

Hi John

CHANGE PASSWORD

Slick logos

Hi John

CHANGE PASSWORD

Slick logos

Look for misspellingsLook for poor grammar

Is it not addressed to you?Does it look unprofessional?

Cyrillic o

Spoofed partially

protected subdomain

The amount of emailin one minute

Wanted email: ~60 million

Wanted email: ~60 millionScattershot attacks: ~3000

Targeted enterprise attacks: ~55

2370% increase 2015-2016 (FBI/IC3)

Trend: increasing sophistication

greedimproved psychologybetter design competenceand a confluence of attack tools

greedmore targetingimproved psychologybetter design competenceand a confluence of attack tools

“Social Phishing”, Jagatic et al.

Yield of generic attack

“Social Phishing”, Jagatic et al.

Yield of targeted attack

greedmore targetingimproved psychology

Incoming eFax: Elections Outcome Could Be revised [Facts of Elections Fraud]

Taylor Fax <securefaxsolutions@gmail.com>

PIN CODE: 3209

PhishMe 2016 Enterprise Phishing Susceptibility and Resiliency Report

greedmore targetingimproved psychologybetter design competenceand a confluence of capabilities

Things can (and will)

get worse

Why do people look in their spam folders?

1 3 1 4

your spam filter is not tuned correctly

look for a message sent by Google

If the message is in your spam folder

Make sure to review the alert first

From: spam.notification@googlemail.com

Spam folder (quarantine)

trust transfer trick(For more details, look for my upcoming paper with

Hossein Siadati, Toan Nguyen, Nasir Memon)

How attackers can turn services into opportunity

There’s no account associated with this email.

You may need to check your Junk or Spam folder.

Compromise@paypal.alert1822.com

Att_Update <att-services.2072668872@emailff-att-mail.com>

Click here

just anothertrust transfer trick

use yourknowledgeagainst you

Another way attackers can

Did you know this?

bank checks can bounce

Did you know this?

wirescan not

bounce

Attacker does: Victim thinks:

Ask victim for wire information

Drop fake checkin night deposit

I will receive money

Money was wired

Attacker does: Victim thinks:

Ask victim for wire information

Drop fake checkin night deposit

I will receive money

Money was wired

To sum it up:You may think you were paid. Maybe you were not.

Account Take Over on the rise

corrupt

monetize

corrupt

collect + launch

monetize

Understandthensolve

Impostor Authentic

Spoof Look-alike Domain Display Name Deception Account OwnerCompromiseSender

Source Internal External

Classification

Fraud Legitimate Email

URL Attachment

Social Engineering

Unsolicited Email

Grey Mail

TargetedScattershot

Destination Internal External

StrangerTrusted partyEmployee webmail

Objective Monetary Data/Credential Theft Denial of Service

First understand the problem – then solve it

Impostor

Spoof Look-alike Domain Display Name Deception CompromiseSender

First understand the problem – then solve it

10% 84%puny

exploding

Addressing deceptive display names

1.List of trusted parties.“Bo Bigboss <bb@yourcompany.com>”

2.Incoming email “Bo BigBoss <joe123@aol.com>”

3.High risk? Warn-and-deliver!“Stranger Danger! <joe123@aol.com>”74

2.Incoming email. “Bo BigBoss <joe123@aol.com>”

Impostor Authentic

Spoof Look-alike Domain Display Name Deception Account OwnerCompromiseSender

Addressing compromised accounts

OriginCompromised device Compromised credentials Compromised API access

Local scriptOAuth

Easiest for the attackersEasiest for the defenders

SMS to associated phone number

Proprietary

but filteringis not everything

Our view Attacker’s view

Filtering?keeps us safe

Filtering? press pedal harder!

Malicious emails sentrisk: loss/threat

Malicious emails sentopportunity: money

Our view Attacker’s view

Filtering?keeps us safe

Filtering? press pedal harder!

Malicious emails sentrisk: loss/threat

Malicious emails sentopportunity: moneyrisk: loss/threat opportunity: intelligence

(Look out for upcoming papers, one of which is with Hossein Siadati and Yifan Tian)

Want to talk?

mjakobsson@agari.com

The Rising Threat of Email Based Attacks, and How To ... · Fraud Legitimate Email URL Attachment...

Documents

Transcript of The Rising Threat of Email Based Attacks, and How To ... · Fraud Legitimate Email URL Attachment...

Email Marketing - olliasheville.com · • SPAM is unsolicited email • CAN-SPAM Act of 2004 makes it a crime. • Term applies to commercial email, not transactional. • One Word

Unsolicited Proposal Program Guide

Higher Education Brochure - Windstream Enterprise€¦ · Device (BYOD), unsolicited email, botnets, malware and information ... Smart, customized communications solutions designed

Preventing Identity Theft · Spamming, spoofing, and phishing — oh my! Spamming —Sending unsolicited email indiscriminately to multiple mailing lists, individuals, or newsgroups.

GUIDELINES FOR ASSESSMENT OF UNSOLICITED PROPOSALS …assets.yoursay.sa.gov.au/...21_46_390_Unsolicited_Proposals_Policy.pdf · Process for Consideration of Unsolicited Proposals

Email Security Deployment Guide - cisco.com · An email solution will become unusable if spam—unsolicited and unwanted emails—is not filtered properly. The sheer volume of spam

ATTENTION BUDGET BILLED MEMBERS · is not edible. It’s electronic. SPAM is defined as an unsolicited email. It’s an email you weren’t expecting. It’s an email that is unwelcome

Alberta Unsolicited Proposal Framework and Guideline€¦ · 10 Chapter Three | Unsolicited Proposal Management Framework 3.0 - Unsolicited Proposal Management Framework 3.1 Framework

Teaching / Consulting for IT Securitydownload.microsoft.com/download/0/A/A/0AADDF80-6B44-48D4... · 2018-10-13 · Xeduco Spam Email Irrelevant, unwanted, and unsolicited email to

CHSRA Unsolicited Proposal Process

Moodys Unsolicited Ratings

PROCEDURES€¦ · 4.2.4 Unsolicited Email ... 4.6.1 Indemnification 4.6.2 Product Claims ... 4.19 International Marketing 4.20 Excess Inventory and Bonus Buying 4.21 Adherence to

Sample Unsolicited Proposal Submission

Unsolicited Redesign Visual Inventory

Unsolicited Redesign-Visual Inventory

Unsolicited Ideas Policy- RC

TREATING WITH UNSOLICITED PROPOSALS

Unsolicited Alarm and Information Messages

Unsolicited applications workshop show

Unsolicited Proposal From CEI