Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

Epsilon Fell To Spear-Phishing Attack

Breach apparently lasted for months despite warning of targeted attacks against email service providers.

10 Massive Security Breaches
(click image for larger view)
Slideshow: 10 Massive Security Breaches
The breach of Epsilon, the world's largest email service provider, has put the customers of at least 50 major companies at risk from targeted phishing attacks, aka spear phishing, which use fake yet personalized emails to trick people into disclosing personal information, including passwords and financial details.

In an ironic twist for a company entrusted with sending an estimated 40 billion emails per year, the Epsilon breach apparently stemmed from the company having itself been spear phished.

Furthermore, according to Australia's iTnews, Epsilon failed to heed a November 2010 security alert from the email intelligence group at Return Path, one of its business partners, that attackers had recently been targeting email service providers (ESPs) like Epsilon via spear phishing attacks.

Return Path included a sample message with its alert, noting that it "has been sent numerous times, over several different systems, including using the facility of some ESPs, using online greeting card sites, and by way of a botnet." In addition, it said, "sources confirm the list of addresses is very small (less than 3,000 addresses) and aimed 100% at staff responsible for email operations."

The sample phishing message shared by Return Path included a link, which if a user clicked on it would attempt to download three pieces of malware. They were Win32.BlkIC.IMG, which disables antivirus software and which many antivirus programs -- at least at the time--couldn't detect. The other two malware applications were iStealer, which is a keylogger, and CyberGate, a remote administration tool.

According to iTnews, spear phishing attacks resulting from a breach of Epsilon began appearing in early December, starting with Walgreens. But Epsilon apparently didn't discover that its systems had been breached until it installed software, in February 2011, designed to spot unusual--and potentially malicious--information access patterns. By then, stolen data included information relating to the customers of at least 50 companies, including Best Buy, Citi, Hilton, LL Bean, Marriott, Target, TiVo, and Walgreens.

According to Epsilon, attackers stole only 2% of its customer data. But given that the company provides email marketing services for more than 2,500 companies, and by some estimates stores 250 million emails, that's a sizeable breach.

Furthermore, the number of companies warning that their customers are at risk has been expanding, with the Better Business Bureau warning that customers of any affected companies were at risk.

The Epsilon breach highlights that with the growth of cloud services, one data breach can be a single point of failure for numerous organizations. "Outsourcing and the cloud are buzzwords of the 2010s--their many evangelists will assure you that cloud-sourcing your high-volume Internet services is certain to save you money, improve your up-time, and boost your security," said Paul Ducklin, the Asia-Pacific head of technology for Sophos, in a blog post. "After all, if you leave a job such as direct marketing--or email, or office automation, or authentication -- entirely to the specialists, you're bound to have experts on the job who are at least as switched on about security as you are."

Furthermore, entrusting a single company with data on so many people makes it an attractive target for attackers, which may in fact place customers at greater risk of having their personal information stolen.

Of course, customers also won't be holding just the ESP responsible. "The real lesson to be learned is that companies are still responsible to their customers for incidents like this, even if the fault lies with an outsourcer," security analyst John Pescatore, a vice president at Gartner Inc., said in the SANS Newsbites newsletter.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Aviation Faces Increasing Cybersecurity Scrutiny
Kelly Jackson Higgins, Executive Editor at Dark Reading,  8/22/2019
Microsoft Tops Phishers' Favorite Brands as Facebook Spikes
Kelly Sheridan, Staff Editor, Dark Reading,  8/22/2019
MoviePass Leaves Credit Card Numbers, Personal Data Exposed Online
Kelly Sheridan, Staff Editor, Dark Reading,  8/21/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
The State of IT Operations and Cybersecurity Operations
The State of IT Operations and Cybersecurity Operations
Your enterprise's cyber risk may depend upon the relationship between the IT team and the security team. Heres some insight on what's working and what isn't in the data center.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2016-6154
PUBLISHED: 2019-08-23
The authentication applet in Watchguard Fireware 11.11 Operating System has reflected XSS (this can also cause an open redirect).
CVE-2019-5594
PUBLISHED: 2019-08-23
An Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") in Fortinet FortiNAC 8.3.0 to 8.3.6 and 8.5.0 admin webUI may allow an unauthenticated attacker to perform a reflected XSS attack via the search field in the webUI.
CVE-2019-6695
PUBLISHED: 2019-08-23
Lack of root file system integrity checking in Fortinet FortiManager VM application images of all versions below 6.2.1 may allow an attacker to implant third-party programs by recreating the image through specific methods.
CVE-2019-12400
PUBLISHED: 2019-08-23
In version 2.0.3 Apache Santuario XML Security for Java, a caching mechanism was introduced to speed up creating new XML documents using a static pool of DocumentBuilders. However, if some untrusted code can register a malicious implementation with the thread context class loader first, then this im...
CVE-2019-15092
PUBLISHED: 2019-08-23
The webtoffee "WordPress Users & WooCommerce Customers Import Export" plugin 1.3.0 for WordPress allows CSV injection in the user_url, display_name, first_name, and last_name columns in an exported CSV file created by the WF_CustomerImpExpCsv_Exporter class.