Perimeter

10/12/2017
10:30 AM
Marc Wilczek
Marc Wilczek
Commentary
Connect Directly
Twitter
LinkedIn
Google+
RSS
E-Mail vvv
100%
0%

Ransomware Grabs Headlines but BEC May Be a Bigger Threat

With social media, gathering information has never been easier, making Business Email Compromise the land of milk and honey for cybercriminals.

Recently, ransomware like WannaCry or Petya has generated dramatic headlines around the globe. The pernicious online threats have become a shooting star among malware vectors, gaining notoriety and troubling millions of businesses and individuals alike. However, another cyberthreat lurking beneath the surface and causing even greater damage is business email compromise (BEC).

Unlike most other cybercrime activity, BEC entirely depends upon social engineering. It involves a faked email from a co-worker or corporate executive that short-cuts internal processes and asks the finance department to make a payment. A ploy that appears to be fairly simple-minded turns out to be both surprisingly effective and lucrative.

Perpetrators typically begin their campaign with reconnaissance. This includes scouting the company’s hierarchy, corporate executives, and employees. While life for the bad guys was much more difficult — perhaps next to impossible — in the good old days, the advent of social media has turned things upside down. With introductions to the leadership team on the target’s website, along with their profiles published on Facebook, Google+, LinkedIn, and so on, perpetrators can hardly believe their luck. Gathering information has never been easier. BEC has literally become the land of milk and honey for cybercriminals.

Emails Bypass Most Security Tools
What then usually follows is a faked email, supposedly sent from the CEO or another corporate official, urgently requesting that the recipient pay a business partner or supplier. The beneficiary's back account is often abroad and held by cybercriminals or their intermediaries. Laundering techniques and "money mules" worldwide drain the funds into other accounts that are difficult to trace.

These BEC campaigns primarily target large organizations, and many of them have fallen victim including Facebook and Google, as reported by Fortune Magazine. Despite all the corporate policies and safeguarding the firms have put in place, the success rate of the fake messages is astonishing — a 1,300% increase since Jan 2015, representing damages surpassing those of ransomware, according to the FBI in a press release. Since these emails don’t contain malware or suspicious links, they can often bypass security tools and permeate an organization.

Damages on the Rise
The Internet Crime Complaint Center (IC3) — an alliance between the FBI, the U.S. Department of Justice, and the National White Collar Crime Center — reports that $5.3 billion was stolen due to BEC-related fraud between October 2013 and December 2016, as highlighted in Cisco’s 2017 Midyear Cybersecurity Report (registration required). This corresponds to an average of $1.7 billion per year, the report notes. By way of comparison, ransomware exploits pocketed about $1 billion in 2016, according to the report.

"The ability of these criminal groups to compromise legitimate business email accounts is staggering — they are experts at deception," Special Agent Martin Licciardo, a veteran organized-crime investigator at the FBI’s Washington field office, noted in the press release. "The FBI takes the BEC threat very seriously, and we are working with our international partners to identify these perpetrators and dismantle their organizations."

Combating BEC fraud has little to do with technology. It all boils down to process improvements and policy enforcement, awareness, and education. For example, payments shouldn’t be made outside the official approval process and without applying the "four-eye principle," a requirement that two individuals approve some action before it can be taken. Never rely on e-mail alone. An out-of-the-ordinary request for an out-of-country transfer should immediately sound alarm bells.

To effectively combat BEC, the FBI issued a one-pager that recommends organizations use  corporate email accounts only, and avoid free web-based accounts; that companies carefully consider what’s posted to their social media and corporate websites; that employees be suspicious of requests for secrecy or pressure to take action quickly; the separation of computer devices from Internet of Things (IoT) devices; and disabling of the Universal Plug and Play protocol (UPnP) on corporate routers.

Related Content:

Join Dark Reading LIVE for two days of practical cyber defense discussions. Learn from the industry’s most knowledgeable IT security experts. Check out the INsecurity agenda here.

Marc Wilczek is an entrepreneur and senior executive with more than 20 years of leadership experience within the ICT space. He's passionate about all things #digital with emphasis on cloud, big data and IoT services. Before serving as VP portfolio, innovation & ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Marc Wilczek
100%
0%
Marc Wilczek,
User Rank: Author
10/16/2017 | 11:42:02 AM
Re: Double confirm before paying
You're absolutely right, mitigating the risk is suppose to be easy. However, fact of the matter is, it just doesn't happen. With billions of dollars pocketed in no time, the success rate of these scams is surprisingly high.
Mr Phen375
100%
0%
Mr Phen375,
User Rank: Apprentice
10/16/2017 | 11:33:12 AM
Double confirm before paying
I think it is kind of easy to battle this email threat, just make a phone call to whoever responsible to double confirm the case before issuing any payments.
Companies Blindly Believe They've Locked Down Users' Mobile Use
Dawn Kawamoto, Associate Editor, Dark Reading,  11/14/2017
Microsoft Word Vuln Went Unnoticed for 17 Years: Report
Kelly Sheridan, Associate Editor, Dark Reading,  11/14/2017
121 Pieces of Malware Flagged on NSA Employee's Home Computer
Kelly Jackson Higgins, Executive Editor at Dark Reading,  11/16/2017
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Managing Cyber-Risk
An online breach could have a huge impact on your organization. Here are some strategies for measuring and managing that risk.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2017-0290
Published: 2017-05-09
NScript in mpengine in Microsoft Malware Protection Engine with Engine Version before 1.1.13704.0, as used in Windows Defender and other products, allows remote attackers to execute arbitrary code or cause a denial of service (type confusion and application crash) via crafted JavaScript code within ...

CVE-2016-10369
Published: 2017-05-08
unixsocket.c in lxterminal through 0.3.0 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (preventing terminal launch), or possibly have other impact (bypassing terminal access control).

CVE-2016-8202
Published: 2017-05-08
A privilege escalation vulnerability in Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) releases earlier than v7.4.1d and v8.0.1b could allow an authenticated attacker to elevate the privileges of user accounts accessing the system via command line interface. With affected version...

CVE-2016-8209
Published: 2017-05-08
Improper checks for unusual or exceptional conditions in Brocade NetIron 05.8.00 and later releases up to and including 06.1.00, when the Management Module is continuously scanned on port 22, may allow attackers to cause a denial of service (crash and reload) of the management module.

CVE-2017-0890
Published: 2017-05-08
Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste malicious content into the search dialogue.