10:30 AM
Marc Wilczek
Marc Wilczek
Connect Directly
E-Mail vvv

Ransomware Grabs Headlines but BEC May Be a Bigger Threat

With social media, gathering information has never been easier, making Business Email Compromise the land of milk and honey for cybercriminals.

Recently, ransomware like WannaCry or Petya has generated dramatic headlines around the globe. The pernicious online threats have become a shooting star among malware vectors, gaining notoriety and troubling millions of businesses and individuals alike. However, another cyberthreat lurking beneath the surface and causing even greater damage is business email compromise (BEC).

Unlike most other cybercrime activity, BEC entirely depends upon social engineering. It involves a faked email from a co-worker or corporate executive that short-cuts internal processes and asks the finance department to make a payment. A ploy that appears to be fairly simple-minded turns out to be both surprisingly effective and lucrative.

Perpetrators typically begin their campaign with reconnaissance. This includes scouting the company’s hierarchy, corporate executives, and employees. While life for the bad guys was much more difficult — perhaps next to impossible — in the good old days, the advent of social media has turned things upside down. With introductions to the leadership team on the target’s website, along with their profiles published on Facebook, Google+, LinkedIn, and so on, perpetrators can hardly believe their luck. Gathering information has never been easier. BEC has literally become the land of milk and honey for cybercriminals.

Emails Bypass Most Security Tools
What then usually follows is a faked email, supposedly sent from the CEO or another corporate official, urgently requesting that the recipient pay a business partner or supplier. The beneficiary's back account is often abroad and held by cybercriminals or their intermediaries. Laundering techniques and "money mules" worldwide drain the funds into other accounts that are difficult to trace.

These BEC campaigns primarily target large organizations, and many of them have fallen victim including Facebook and Google, as reported by Fortune Magazine. Despite all the corporate policies and safeguarding the firms have put in place, the success rate of the fake messages is astonishing — a 1,300% increase since Jan 2015, representing damages surpassing those of ransomware, according to the FBI in a press release. Since these emails don’t contain malware or suspicious links, they can often bypass security tools and permeate an organization.

Damages on the Rise
The Internet Crime Complaint Center (IC3) — an alliance between the FBI, the U.S. Department of Justice, and the National White Collar Crime Center — reports that $5.3 billion was stolen due to BEC-related fraud between October 2013 and December 2016, as highlighted in Cisco’s 2017 Midyear Cybersecurity Report (registration required). This corresponds to an average of $1.7 billion per year, the report notes. By way of comparison, ransomware exploits pocketed about $1 billion in 2016, according to the report.

"The ability of these criminal groups to compromise legitimate business email accounts is staggering — they are experts at deception," Special Agent Martin Licciardo, a veteran organized-crime investigator at the FBI’s Washington field office, noted in the press release. "The FBI takes the BEC threat very seriously, and we are working with our international partners to identify these perpetrators and dismantle their organizations."

Combating BEC fraud has little to do with technology. It all boils down to process improvements and policy enforcement, awareness, and education. For example, payments shouldn’t be made outside the official approval process and without applying the "four-eye principle," a requirement that two individuals approve some action before it can be taken. Never rely on e-mail alone. An out-of-the-ordinary request for an out-of-country transfer should immediately sound alarm bells.

To effectively combat BEC, the FBI issued a one-pager that recommends organizations use  corporate email accounts only, and avoid free web-based accounts; that companies carefully consider what’s posted to their social media and corporate websites; that employees be suspicious of requests for secrecy or pressure to take action quickly; the separation of computer devices from Internet of Things (IoT) devices; and disabling of the Universal Plug and Play protocol (UPnP) on corporate routers.

Related Content:

Join Dark Reading LIVE for two days of practical cyber defense discussions. Learn from the industry’s most knowledgeable IT security experts. Check out the INsecurity agenda here.

Marc Wilczek is a columnist and recognized thought leader, geared toward helping organizations drive their digital agenda and achieve higher levels of innovation and productivity through technology. Over the past 20 years, he has held various senior leadership roles across ... View Full Bio
Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
User Rank: Apprentice
12/2/2017 | 4:55:26 AM
Double confirm before paying
I believe it really is kind of simple to battle this message threat , simply make a telephone contact to the person who responsible to dual confirm the case before issuing any specific payments .
User Rank: Apprentice
12/2/2017 | 4:55:21 AM
Double confirm before paying
I believe it really is kind of simple to battle this message threat , simply make a telephone contact to the person who responsible to dual confirm the case before issuing any specific payments .
Marc Wilczek
Marc Wilczek,
User Rank: Author
10/16/2017 | 11:42:02 AM
Re: Double confirm before paying
You're absolutely right, mitigating the risk is suppose to be easy. However, fact of the matter is, it just doesn't happen. With billions of dollars pocketed in no time, the success rate of these scams is surprisingly high.
Mr Phen375
Mr Phen375,
User Rank: Apprentice
10/16/2017 | 11:33:12 AM
Double confirm before paying
I think it is kind of easy to battle this email threat, just make a phone call to whoever responsible to double confirm the case before issuing any payments.
8 Ways Hackers Monetize Stolen Data
Steve Zurier, Freelance Writer,  4/17/2018
The Role of KPIs in Incident Response
John Moran, Senior Product Manager, DFLabs,  4/18/2018
Register for Dark Reading Newsletters
White Papers
Current Issue
How to Cope with the IT Security Skills Shortage
Most enterprises don't have all the in-house skills they need to meet the rising threat from online attackers. Here are some tips on ways to beat the shortage.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
Published: 2017-05-09
NScript in mpengine in Microsoft Malware Protection Engine with Engine Version before 1.1.13704.0, as used in Windows Defender and other products, allows remote attackers to execute arbitrary code or cause a denial of service (type confusion and application crash) via crafted JavaScript code within ...

Published: 2017-05-08
unixsocket.c in lxterminal through 0.3.0 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (preventing terminal launch), or possibly have other impact (bypassing terminal access control).

Published: 2017-05-08
A privilege escalation vulnerability in Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) releases earlier than v7.4.1d and v8.0.1b could allow an authenticated attacker to elevate the privileges of user accounts accessing the system via command line interface. With affected version...

Published: 2017-05-08
Improper checks for unusual or exceptional conditions in Brocade NetIron 05.8.00 and later releases up to and including 06.1.00, when the Management Module is continuously scanned on port 22, may allow attackers to cause a denial of service (crash and reload) of the management module.

Published: 2017-05-08
Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste malicious content into the search dialogue.