Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

Financial Phishing Grows in Volume and Sophistication in First Half of 2019

Criminals are using the tools intended to protect consumers to attack them through techniques that are becoming more successful with each passing month.

Phishing — especially phishing involving websites claiming to be from financial institutions — is growing, and criminals are getting better at their craft. A new report shows how attackers are using messages that closely mimic legitimate bank promotions to entice users to open email messages and click on links, then using those clicks and opens as the first step in campaigns that steal credentials, embezzle funds, and plant ransomware or other malware across systems.

The report, "The State of Financial Phishing" for the first half of 2019, demonstrates that one of the principal tools in fighting online fraud — the green "lock" icon that shows the website is protected by encryption — has now been co-opted by criminals to create a false sense of security in their malicious Web traps.

Criminals have found that the same free certificate authorities (CAs) making it easy for legitimate small businesses to protect their websites enhance the look and feel of bogus, criminal sites. Bob Maley, chief security officer at report sponsor Normshield, says that free CAs like LetsEncrypt have helped small organizations but with significant unintended consequences: "The shift to using domains with certificates changes the game," he says.

According to the report, the first six months of the year saw a 14% increase in domains potentially used in phishing campaigns and double the number of phishing domains that were certified by registrars. That works out to more than 1,900 potential phishing domains that were registered in the first half of 2019.

Maley says the rate of phishing domain registration is increasing, and he expects more than 3,500 new criminal domains will be registered by the end of the year. Many of those, he says, won't be used quickly; attackers will let them "age" so that protection algorithms designed to protect users from "quick hit" campaigns won't be triggered.

Those criminal domains are using techniques like TLS or SSL certificates to look more legitimate. The researchers say the 8.5% of phishing domains that used a valid encryption certificate in 2018 will increase to 15% of sites with a legitimate green lock icon in 2019.

"My take on this is that cybersecurity professionals really need to understand that there's a strategic process being followed by both sides," Maley says. "OODA — observe, orient, decide, and act — is a war-fighting concept that everyone uses. Some just do it quicker."

The great danger is that criminals are going through the OODA loop faster than the defenders, Maley says. And he points out that security professionals could take concrete steps to get ahead of their adversaries.

He recommends searching for URLs likely to be used in legitimate business transactions and being vigilant about several critical points. First, avoid clicking on two- or three-letter domain names because they're so easily spoofed. The same, he says, is true of highly generic site names. Block these in internal Web filter software and, Maley argues, make life a little easier for your peers.

"Identify phishing domains that are applied to your company and take those down" with DMCA and other legal takedown demands, he says.

Related Content:

Curtis Franklin Jr. is Senior Editor at Dark Reading. In this role he focuses on product and technology coverage for the publication. In addition he works on audio and video programming for Dark Reading and contributes to activities at Interop ITX, Black Hat, INsecurity, and ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
greg.jensen
50%
50%
greg.jensen,
User Rank: Apprentice
11/22/2019 | 12:50:34 PM
Phishing and the business risk
This once "consumer oriented" attack vector has rapidly matured to target the business-critical services DIRECTLY using targeted attacks, phishing campaigns and forged web sites.   Case in point is the business manager who gets an email from his cloud ERP provider saying "Verify your time zone" and it comes in the form of an email template that looks to be his vendor's.  Clicking the URL takes them to a forged ERP cloud service page with a log-in.  Entering the userID and password does two things.  One it captures the credentials for the attacker, and second, the attacker automaticly passes thru the user to the legitimate cloud ERP site.  User has no awareness what happened.  The attacker goes into ERP and makes an account change for payment of suppliers to auto deposite into the attackers account vs various supplier accounts.  This could take up to 90 days to identify the problem!  So phishing has become a mainstream problem today that organizations must take serious to protect business-critical data.  @GregJensen10
SOC 2s & Third-Party Assessments: How to Prevent Them from Being Used in a Data Breach Lawsuit
Beth Burgin Waller, Chair, Cybersecurity & Data Privacy Practice , Woods Rogers PLC,  12/5/2019
Navigating Security in the Cloud
Diya Jolly, Chief Product Officer, Okta,  12/4/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: "This is the last time we hire Game of Thrones Security"
Current Issue
Navigating the Deluge of Security Data
In this Tech Digest, Dark Reading shares the experiences of some top security practitioners as they navigate volumes of security data. We examine some examples of how enterprises can cull this data to find the clues they need.
Flash Poll
Rethinking Enterprise Data Defense
Rethinking Enterprise Data Defense
Frustrated with recurring intrusions and breaches, cybersecurity professionals are questioning some of the industrys conventional wisdom. Heres a look at what theyre thinking about.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-4428
PUBLISHED: 2019-12-09
IBM Watson Assistant for IBM Cloud Pak for Data 1.0.0 through 1.3.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session....
CVE-2019-4611
PUBLISHED: 2019-12-09
IBM Planning Analytics 2.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 168519.
CVE-2019-4612
PUBLISHED: 2019-12-09
IBM Planning Analytics 2.0 is vulnerable to malicious file upload in the My Account Portal. Attackers can make use of this weakness and upload malicious executable files into the system and it can be sent to victim for performing further attacks. IBM X-Force ID: 168523.
CVE-2019-4621
PUBLISHED: 2019-12-09
IBM DataPower Gateway 7.6.0.0-7 throug 6.0.14 and 2018.4.1.0 through 2018.4.1.5 have a default administrator account that is enabled if the IPMI LAN channel is enabled. A remote attacker could use this account to gain unauthorised access to the BMC. IBM X-Force ID: 168883.
CVE-2019-19230
PUBLISHED: 2019-12-09
An unsafe deserialization vulnerability exists in CA Release Automation (Nolio) 6.6 with the DataManagement component that can allow a remote attacker to execute arbitrary code.