Perimeter

10/12/2017
10:30 AM
Marc Wilczek
Marc Wilczek
Commentary
Connect Directly
Twitter
LinkedIn
Google+
RSS
E-Mail vvv
100%
0%

Ransomware Grabs Headlines but BEC May Be a Bigger Threat

With social media, gathering information has never been easier, making Business Email Compromise the land of milk and honey for cybercriminals.

Recently, ransomware like WannaCry or Petya has generated dramatic headlines around the globe. The pernicious online threats have become a shooting star among malware vectors, gaining notoriety and troubling millions of businesses and individuals alike. However, another cyberthreat lurking beneath the surface and causing even greater damage is business email compromise (BEC).

Unlike most other cybercrime activity, BEC entirely depends upon social engineering. It involves a faked email from a co-worker or corporate executive that short-cuts internal processes and asks the finance department to make a payment. A ploy that appears to be fairly simple-minded turns out to be both surprisingly effective and lucrative.

Perpetrators typically begin their campaign with reconnaissance. This includes scouting the company’s hierarchy, corporate executives, and employees. While life for the bad guys was much more difficult — perhaps next to impossible — in the good old days, the advent of social media has turned things upside down. With introductions to the leadership team on the target’s website, along with their profiles published on Facebook, Google+, LinkedIn, and so on, perpetrators can hardly believe their luck. Gathering information has never been easier. BEC has literally become the land of milk and honey for cybercriminals.

Emails Bypass Most Security Tools
What then usually follows is a faked email, supposedly sent from the CEO or another corporate official, urgently requesting that the recipient pay a business partner or supplier. The beneficiary's back account is often abroad and held by cybercriminals or their intermediaries. Laundering techniques and "money mules" worldwide drain the funds into other accounts that are difficult to trace.

These BEC campaigns primarily target large organizations, and many of them have fallen victim including Facebook and Google, as reported by Fortune Magazine. Despite all the corporate policies and safeguarding the firms have put in place, the success rate of the fake messages is astonishing — a 1,300% increase since Jan 2015, representing damages surpassing those of ransomware, according to the FBI in a press release. Since these emails don’t contain malware or suspicious links, they can often bypass security tools and permeate an organization.

Damages on the Rise
The Internet Crime Complaint Center (IC3) — an alliance between the FBI, the U.S. Department of Justice, and the National White Collar Crime Center — reports that $5.3 billion was stolen due to BEC-related fraud between October 2013 and December 2016, as highlighted in Cisco’s 2017 Midyear Cybersecurity Report (registration required). This corresponds to an average of $1.7 billion per year, the report notes. By way of comparison, ransomware exploits pocketed about $1 billion in 2016, according to the report.

"The ability of these criminal groups to compromise legitimate business email accounts is staggering — they are experts at deception," Special Agent Martin Licciardo, a veteran organized-crime investigator at the FBI’s Washington field office, noted in the press release. "The FBI takes the BEC threat very seriously, and we are working with our international partners to identify these perpetrators and dismantle their organizations."

Combating BEC fraud has little to do with technology. It all boils down to process improvements and policy enforcement, awareness, and education. For example, payments shouldn’t be made outside the official approval process and without applying the "four-eye principle," a requirement that two individuals approve some action before it can be taken. Never rely on e-mail alone. An out-of-the-ordinary request for an out-of-country transfer should immediately sound alarm bells.

To effectively combat BEC, the FBI issued a one-pager that recommends organizations use  corporate email accounts only, and avoid free web-based accounts; that companies carefully consider what’s posted to their social media and corporate websites; that employees be suspicious of requests for secrecy or pressure to take action quickly; the separation of computer devices from Internet of Things (IoT) devices; and disabling of the Universal Plug and Play protocol (UPnP) on corporate routers.

Related Content:

Join Dark Reading LIVE for two days of practical cyber defense discussions. Learn from the industry’s most knowledgeable IT security experts. Check out the INsecurity agenda here.

Marc Wilczek is a columnist and recognized thought leader, geared toward helping organizations drive their digital agenda and achieve higher levels of innovation and productivity through technology. Over the past 20 years, he has held various senior leadership roles across ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
lucysup
50%
50%
lucysup,
User Rank: Apprentice
12/2/2017 | 4:55:26 AM
Double confirm before paying
I believe it really is kind of simple to battle this message threat , simply make a telephone contact to the person who responsible to dual confirm the case before issuing any specific payments .
lucysup
50%
50%
lucysup,
User Rank: Apprentice
12/2/2017 | 4:55:21 AM
Double confirm before paying
I believe it really is kind of simple to battle this message threat , simply make a telephone contact to the person who responsible to dual confirm the case before issuing any specific payments .
Marc Wilczek
100%
0%
Marc Wilczek,
User Rank: Author
10/16/2017 | 11:42:02 AM
Re: Double confirm before paying
You're absolutely right, mitigating the risk is suppose to be easy. However, fact of the matter is, it just doesn't happen. With billions of dollars pocketed in no time, the success rate of these scams is surprisingly high.
Mr Phen375
100%
0%
Mr Phen375,
User Rank: Apprentice
10/16/2017 | 11:33:12 AM
Double confirm before paying
I think it is kind of easy to battle this email threat, just make a phone call to whoever responsible to double confirm the case before issuing any payments.
Higher Education: 15 Books to Help Cybersecurity Pros Be Better
Curtis Franklin Jr., Senior Editor at Dark Reading,  12/12/2018
Worst Password Blunders of 2018 Hit Organizations East and West
Curtis Franklin Jr., Senior Editor at Dark Reading,  12/12/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
10 Best Practices That Could Reshape Your IT Security Department
This Dark Reading Tech Digest, explores ten best practices that could reshape IT security departments.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-20161
PUBLISHED: 2018-12-15
A design flaw in the BlinkForHome (aka Blink For Home) Sync Module 2.10.4 and earlier allows attackers to disable cameras via Wi-Fi, because incident clips (triggered by the motion sensor) are not saved if the attacker's traffic (such as Dot11Deauth) successfully disconnects the Sync Module from the...
CVE-2018-20159
PUBLISHED: 2018-12-15
i-doit open 1.11.2 allows Remote Code Execution because ZIP archives are mishandled. It has an upload feature that allows an authenticated user with the administrator role to upload arbitrary files to the main website directory. Exploitation involves uploading a ".php" file within a "...
CVE-2018-20157
PUBLISHED: 2018-12-15
The data import functionality in OpenRefine through 3.1 allows an XML External Entity (XXE) attack through a crafted (zip) file, allowing attackers to read arbitrary files.
CVE-2018-20154
PUBLISHED: 2018-12-14
The WP Maintenance Mode plugin before 2.0.7 for WordPress allows remote authenticated users to discover all subscriber e-mail addresses.
CVE-2018-20155
PUBLISHED: 2018-12-14
The WP Maintenance Mode plugin before 2.0.7 for WordPress allows remote authenticated subscriber users to bypass intended access restrictions on changes to plugin settings.