Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Perimeter

10/12/2017
10:30 AM
Marc Wilczek
Marc Wilczek
Commentary
Connect Directly
Twitter
LinkedIn
RSS
E-Mail vvv
100%
0%

Ransomware Grabs Headlines but BEC May Be a Bigger Threat

With social media, gathering information has never been easier, making Business Email Compromise the land of milk and honey for cybercriminals.

Recently, ransomware like WannaCry or Petya has generated dramatic headlines around the globe. The pernicious online threats have become a shooting star among malware vectors, gaining notoriety and troubling millions of businesses and individuals alike. However, another cyberthreat lurking beneath the surface and causing even greater damage is business email compromise (BEC).

Unlike most other cybercrime activity, BEC entirely depends upon social engineering. It involves a faked email from a co-worker or corporate executive that short-cuts internal processes and asks the finance department to make a payment. A ploy that appears to be fairly simple-minded turns out to be both surprisingly effective and lucrative.

Perpetrators typically begin their campaign with reconnaissance. This includes scouting the company’s hierarchy, corporate executives, and employees. While life for the bad guys was much more difficult — perhaps next to impossible — in the good old days, the advent of social media has turned things upside down. With introductions to the leadership team on the target’s website, along with their profiles published on Facebook, Google+, LinkedIn, and so on, perpetrators can hardly believe their luck. Gathering information has never been easier. BEC has literally become the land of milk and honey for cybercriminals.

Emails Bypass Most Security Tools
What then usually follows is a faked email, supposedly sent from the CEO or another corporate official, urgently requesting that the recipient pay a business partner or supplier. The beneficiary's back account is often abroad and held by cybercriminals or their intermediaries. Laundering techniques and "money mules" worldwide drain the funds into other accounts that are difficult to trace.

These BEC campaigns primarily target large organizations, and many of them have fallen victim including Facebook and Google, as reported by Fortune Magazine. Despite all the corporate policies and safeguarding the firms have put in place, the success rate of the fake messages is astonishing — a 1,300% increase since Jan 2015, representing damages surpassing those of ransomware, according to the FBI in a press release. Since these emails don’t contain malware or suspicious links, they can often bypass security tools and permeate an organization.

Damages on the Rise
The Internet Crime Complaint Center (IC3) — an alliance between the FBI, the U.S. Department of Justice, and the National White Collar Crime Center — reports that $5.3 billion was stolen due to BEC-related fraud between October 2013 and December 2016, as highlighted in Cisco’s 2017 Midyear Cybersecurity Report (registration required). This corresponds to an average of $1.7 billion per year, the report notes. By way of comparison, ransomware exploits pocketed about $1 billion in 2016, according to the report.

"The ability of these criminal groups to compromise legitimate business email accounts is staggering — they are experts at deception," Special Agent Martin Licciardo, a veteran organized-crime investigator at the FBI’s Washington field office, noted in the press release. "The FBI takes the BEC threat very seriously, and we are working with our international partners to identify these perpetrators and dismantle their organizations."

Combating BEC fraud has little to do with technology. It all boils down to process improvements and policy enforcement, awareness, and education. For example, payments shouldn’t be made outside the official approval process and without applying the "four-eye principle," a requirement that two individuals approve some action before it can be taken. Never rely on e-mail alone. An out-of-the-ordinary request for an out-of-country transfer should immediately sound alarm bells.

To effectively combat BEC, the FBI issued a one-pager that recommends organizations use  corporate email accounts only, and avoid free web-based accounts; that companies carefully consider what’s posted to their social media and corporate websites; that employees be suspicious of requests for secrecy or pressure to take action quickly; the separation of computer devices from Internet of Things (IoT) devices; and disabling of the Universal Plug and Play protocol (UPnP) on corporate routers.

Related Content:

Join Dark Reading LIVE for two days of practical cyber defense discussions. Learn from the industry’s most knowledgeable IT security experts. Check out the INsecurity agenda here.

Marc Wilczek is a columnist and recognized thought leader, geared toward helping organizations drive their digital agenda and achieve higher levels of innovation and productivity through technology. Over the past 20 years, he has held various senior leadership roles across ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Oldest First  |  Newest First  |  Threaded View
Mr Phen375
100%
0%
Mr Phen375,
User Rank: Apprentice
10/16/2017 | 11:33:12 AM
Double confirm before paying
I think it is kind of easy to battle this email threat, just make a phone call to whoever responsible to double confirm the case before issuing any payments.
Marc Wilczek
100%
0%
Marc Wilczek,
User Rank: Author
10/16/2017 | 11:42:02 AM
Re: Double confirm before paying
You're absolutely right, mitigating the risk is suppose to be easy. However, fact of the matter is, it just doesn't happen. With billions of dollars pocketed in no time, the success rate of these scams is surprisingly high.
lucysup
50%
50%
lucysup,
User Rank: Apprentice
12/2/2017 | 4:55:21 AM
Double confirm before paying
I believe it really is kind of simple to battle this message threat , simply make a telephone contact to the person who responsible to dual confirm the case before issuing any specific payments .
lucysup
50%
50%
lucysup,
User Rank: Apprentice
12/2/2017 | 4:55:26 AM
Double confirm before paying
I believe it really is kind of simple to battle this message threat , simply make a telephone contact to the person who responsible to dual confirm the case before issuing any specific payments .
Commentary
Cyberattacks Are Tailored to Employees ... Why Isn't Security Training?
Tim Sadler, CEO and co-founder of Tessian,  6/17/2021
Edge-DRsplash-10-edge-articles
7 Powerful Cybersecurity Skills the Energy Sector Needs Most
Pam Baker, Contributing Writer,  6/22/2021
News
Microsoft Disrupts Large-Scale BEC Campaign Across Web Services
Kelly Sheridan, Staff Editor, Dark Reading,  6/15/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
The State of Cybersecurity Incident Response
In this report learn how enterprises are building their incident response teams and processes, how they research potential compromises, how they respond to new breaches, and what tools and processes they use to remediate problems and improve their cyber defenses for the future.
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-18661
PUBLISHED: 2021-06-24
Cross Site Scripting (XSS) vulnerability in gnuboard5 <=v5.3.2.8 via the url parameter to bbs/login.php.
CVE-2020-21787
PUBLISHED: 2021-06-24
CRMEB 3.1.0+ is vulnerable to File Upload Getshell via /crmeb/crmeb/services/UploadService.php.
CVE-2020-21788
PUBLISHED: 2021-06-24
In CRMEB 3.1.0+ strict domain name filtering leads to SSRF(Server-Side Request Forgery). The vulnerable code is in file /crmeb/app/admin/controller/store/CopyTaobao.php.
CVE-2021-23398
PUBLISHED: 2021-06-24
All versions of package react-bootstrap-table are vulnerable to Cross-site Scripting (XSS) via the dataFormat parameter. The problem is triggered when an invalid React element is returned, leading to dangerouslySetInnerHTML being used, which does not sanitize the output.
CVE-2021-33348
PUBLISHED: 2021-06-24
An issue was discovered in JFinal framework v4.9.10 and below. The "set" method of the "Controller" class of jfinal framework is not strictly filtered, which will lead to XSS vulnerabilities in some cases.