Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Threat Intelligence

6/7/2019
08:00 AM
Connect Directly
Twitter
LinkedIn
Google+
RSS
E-Mail

The Minefield of Corporate Email

Email security challenges CISOs as cybercriminals target corporate inboxes with malware, phishing attempts, and various forms of fraud.



Employee email accounts are prime targets for fraudsters, phishing attacks, and malware delivery as hackers assume someone will click, download, or respond to fall into their traps.

The threats causing concern are far from new — in fact, they're among the oldest. As Cisco researchers point out in a new report, "Email: Click with Caution," spam is 40 years old and phishing is over 30. Over time they've grown in prevalence and sophistication, joined by malware and fraud as criminals find new ways to cause problems for security practitioners.

"It seems never-ending sometimes, the kinds of threats that arrive through email," says Ben Munroe, director at Cisco Security, who also says "the fact that it's still a problem for us … is incredible. Things are not getting better and in fact, things are getting worse."

Incredible, yes, but as researchers note in the report, email's structure is "an almost ideal format" for scammers. Employees are forced to read every message, make judgment calls about what they receive, and decide what to open, click, download, and respond to. The right amount of social engineering can manipulate recipients into accidentally letting attackers in.

More than half (56%) of CISOs say defending against user behavior is "very" or "extremely" challenging, Munroe says, citing Cisco's 2019 CISO Benchmark Study. Only 51% think they're doing an "excellent" job managing employee security. Users often get a bad reputation, but it's tough when cybercriminals have an advantage and their targets don't know what's coming.

"It's not fair for everyone to criticize users for doing what users have to do," he says. Employees have to answer emails, even if an email from their "boss" came from a hacker. "It isn't fair to always say users are not sophisticated — attackers are extremely sophisticated," Munroe adds.

Here, we take a closer look at the emailed threats arriving in their inboxes.

To Click or Not to Click?
Wendy Nather, head of Advisory CISOs at Duo Security, now part of Cisco, says attackers' efforts are going in two directions: one is technological; trying to exploit new methods and plant new payloads. The other is psychological, encompassing social engineering efforts. "You have to defend both on the technical side and the social engineering side," she emphasizes.

Credential theft is one of the most common email-based scams, Cisco researchers found. Cybercriminals send emails from fake addresses ([email protected], for example) and users who click a link are redirected to a fake webpage where they're prompted to enter credentials. Those go to the attacker, who may use them to log in to other Microsoft services.

Cisco cites an Agari report that says 27% of advanced email attacks are launched from compromised accounts — up from 20% in the last quarter of 2018. Microsoft accounts aside, attackers also target popular cloud-based email services like Gmail and G Suite.

Business email compromise (BEC), which caused $1.2 billion in losses in 2018, is another threat to watch. Researchers note attackers don't typically use compromised accounts for these; instead, two-thirds of BEC scams still use free webmail attacks and 28% use registered domains. BEC messages are often personalized; one in every five includes the name of the recipient.

Digital extortion, in which attackers try to convince their victims they have footage of them accessing an adult film site or other content, is another lucrative move for attackers. Munroe notes how advancements in technology have changed the game in extortion: "the improvement in hardware, allowing all of us to have a camera; the improvement in bandwidth, allowing us to stream video" have also driven techniques for malicious activity. Researchers do point out profits from extortion have fluctuated along with the value of Bitcoin over time.

Malware Delivery
Email is still a reliable vector to deliver malware, though attackers have been forced to change their tactics as their victims learned the risk of clicking .exe files. Now, malware is more likely to be served indirectly via documents with less suspicious file types or malicious URLs in messages.

Between January and April 2019, binary files only made up 2% of all malicious attachments. Attackers now gravitate toward .zip files, which make up one-third of attachments. JavaScript files make up 14.1% and, researchers note, and attackers are more frequently using them. It's now the third most-common malicious extension, following .doc (41.8%) and .zip (26.3%).

"Throw PDF documents into the mix, and more than half of all malicious attachments are regularly used document types, ubiquitous within the modern workplace," according to the report.

Malware itself has also evolved, Munroe points out. "I'd say in terms of what they're distributing — the idea of malware or what you could call modular malware — having landed on a host or an endpoint, it's able to detect a number of different parameters about where it is or what to do." Is it in a low-cost environment? Valuable environment? Is there high bandwidth?

"That idea is certainly quite worrisome and given email is a prevalent attack vector, it's certainly concerning for CISOs," he adds.

What's a CISO to Do?
The challenge of email security lies in its commonality. "It's the mundane nature of email, especially trying to trick people into clicking things they spend all day clicking," says Nather.

Some CISOs recognize different users have different risk profiles, she continues, and they adjust their security practices accordingly. Human resources employees, who have to open attachments all day, or financial analysts, who are prime BEC targets, are some examples. "They're putting more security controls around them, isolating them more, hardening their systems more," Nather explains. Some employees have different external email addresses.

In the report, researchers explain how to spot a phishing attempt. A few telltale signs:

  • Sense of urgency: if it demands immediate action, act with caution and confirm with the sender
  • Illegitimate-looking URL: Phishing URLs often look unusual. If it's hidden within text, hover over the link for a closer look. Hesitant? Don't click.
  • Unusual file types: most business emails rely on the same few file types. If you don't recognize it, don't open it.
  • Spelling mistakes and blurred logos: Emails that seem careless may be signs of a phish.

Related Content:

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Threaded  |  Newest First  |  Oldest First
REISEN1955
50%
50%
REISEN1955,
User Rank: Ninja
6/7/2019 | 9:42:23 AM
First mistake
Never assume - that users have learned to be careful on clicking on email.  True many more may be saavy but I doubt the number of dumb bunnies has really been reduced.  That small subset of the user population still exists and so whatever controls we have in place can still be worthless if dear Greta clicks on an invoice she should know better about.   She may even KNOW better but just .... well, kinda curious.   Never EVER assume that people have gotten smarter by any yardstick. 
UdyRegan
50%
50%
UdyRegan,
User Rank: Apprentice
6/13/2019 | 4:34:15 AM
Needs awareness
At the previous company which I worked for, there was a cyber attack and the loophole was detected to an employee's computer. She was an old lady with not much background on computer knowledge. She said she received an email asking her to click a link to enter her new credentials as her old set had been tempered with. I wouldn't say she was too naive or gullible but it was a lack of knowledge or awareness from the company that caused the mishap to happen.
REISEN1955
50%
50%
REISEN1955,
User Rank: Ninja
6/13/2019 | 9:46:48 AM
Re: Needs awareness
i feel your pain as this is NOT rocket science material.  True age does begin to show up sometimes and being TOLD to do something to the right mindset is always an order so they follow along like true lemmings over a cliff.  Still the basic basics would have helped here.  
mroberts1161
50%
50%
mroberts1161,
User Rank: Strategist
6/26/2019 | 10:04:23 AM
The Minefield of Corporate Email, requires continued reminders and awareness training.
Schedule once a month quick simple training reminders to all your email accounts. Internet quick information is a very useful resource training tool, unfortunatly very little of it can be trusted. Not even the best Vendor software can catch everthing. Things from an email like copy and past this URL to your browser, attachments with embeded malicous malware, even training demos, or YouTube sites that have secondary links to malicous sites are all things that should be sent out as reminders. Even experienced technicians get tired or too fasted paced and slip once in awhile. 
richkorzo
50%
50%
richkorzo,
User Rank: Apprentice
6/26/2019 | 12:10:27 PM
Evaluate automated AI based tools to remove phishing emails from inboxes
Employees can never get enough awareness training and the hackers are always steps ahead.

Suggest evaluating and deploying the next generation of API based phishing defense/prevention tools that have APIs into Office 365 and Gsuite and are scanning the inboxes.  These new automated, AI and ML-based tools do improve the detection and prevention of phishing attacks
US Turning Up the Heat on North Korea's Cyber Threat Operations
Jai Vijayan, Contributing Writer,  9/16/2019
Fed Kaspersky Ban Made Permanent by New Rules
Dark Reading Staff 9/11/2019
NetCAT Vulnerability Is Out of the Bag
Dark Reading Staff 9/12/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
The State of IT Operations and Cybersecurity Operations
The State of IT Operations and Cybersecurity Operations
Your enterprise's cyber risk may depend upon the relationship between the IT team and the security team. Heres some insight on what's working and what isn't in the data center.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-16395
PUBLISHED: 2019-09-17
GnuCOBOL 2.2 has a stack-based buffer overflow in the cb_name() function in cobc/tree.c via crafted COBOL source code.
CVE-2019-16396
PUBLISHED: 2019-09-17
GnuCOBOL 2.2 has a use-after-free in the end_scope_of_program_name() function in cobc/parser.y via crafted COBOL source code.
CVE-2019-16199
PUBLISHED: 2019-09-17
eQ-3 Homematic CCU2 before 2.47.18 and CCU3 before 3.47.18 allow Remote Code Execution by unauthenticated attackers with access to the web interface via an HTTP POST request to certain URLs related to the ReGa core process.
CVE-2019-16391
PUBLISHED: 2019-09-17
SPIP before 3.1.11 and 3.2 before 3.2.5 allows authenticated visitors to modify any published content and execute other modifications in the database. This is related to ecrire/inc/meta.php and ecrire/inc/securiser_action.php.
CVE-2019-16392
PUBLISHED: 2019-09-17
SPIP before 3.1.11 and 3.2 before 3.2.5 allows prive/formulaires/login.php XSS via error messages.