Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

7/26/2017
09:00 PM
Connect Directly
Twitter
LinkedIn
Google+
RSS
E-Mail
50%
50%

How Attackers Use Machine Learning to Predict BEC Success

Researchers show how scammers defeat other machines, increase their success rate, and get more money from their targets.

BLACK HAT USA - Las Vegas - Researchers from Symantec demonstrated how threat actors can employ machine learning models to drive the success rate of business email compromise (BEC) attacks.

BEC scams are targeted attacks on high-level executives. Attackers rely on social engineering to craft emails and convince execs to perform financial transactions, such as wire transfers, on short notice. The more a victim trusts a fraudulent email, the more likely an attack will succeed.

These scams have targeted more than 400 organizations and caused more than $3 billion in losses, said security response lead Vijay Thaware during the presentation. Attackers exploit three "defects" in human psychology: fear, curiosity, and insecurity.

BEC doesn't require a lot of funding, and most of the information attackers need is available for free online. Twitter, LinkedIn, and Facebook give a well-rounded picture of targets' lives. Company websites reveal corporate hierarchies, names of C-suite execs, and the amount of time each has been with the organization, all information that could be useful to attackers.

"It's all about how you present yourself over the Internet," said Thaware. "This data can reveal many things about us."

To illustrate his point, he presented a screenshot of a basic Google search: "chief financial officer" + "email." It was an easy and effective way to get execs' contact information, and in some cases their email addresses were available directly from the results page.

Ankit Singh, threat analyst engineer, explained how this reconnaissance and profiling prepares threat actors to launch BEC attacks. They can use machine learning to increase the success rate of access and get more money from their targets.

"Machine learning can help the attacker to bypass signature-based detection systems," he explained. "It can be used to predict various outcomes of new data based on patterns of old data." These models can also defeat other machines and anti-spam telemetry, he added.

Singh said this project involved supervised machine learning. In his demonstration, he showed how emails sent to BEC targets were marked as a "success" if the attack worked and "failure" if it didn't. The demo included targets' personal information like age, sex, number of LinkedIn connections, and number of followers and posts on Twitter.

All of this personal information was fueled into the training model, which could make predictions about whether an attack would be successful. If the attack worked, its information would be fed back into the model and improve the accuracy for future attacks.

"We feed data back into the model so the machine can learn what kind of profile is not attackable," said Singh.

He emphasized the importance of timing during a BEC attack; threat actors can use targets' schedules to plan their attacks on organizations. When they know who is doing something at a specific time, they can better plan when he would send an email and what he might say.

Singh demonstrated this idea, for example, an executive traveling to an event, and showed how the Twitter timeline, keynote plan, and travel plan could be used to indicate when he might be in transit or working.

To make their fraudulent email more believable, attackers can register domain names similar to those of the companies they are trying to imitate. This can be done for little money and effectively trick individuals and organizations, he explained.

Singh advised his Black Hat audience to be "very, very suspicious" when replying to emails. More than enough of their personal data is available publically and can be used for social engineering. As attackers start to label successful and unsuccessful attacks, their model can better determine when their actions will work.

Related Content:

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
claireoliversmq
50%
50%
claireoliversmq,
User Rank: Apprentice
4/22/2020 | 8:29:43 AM
education
Thank you for publishing this article, a very interesting topic on which there are few good sources, I also read a similar one on this https://phdessay.com/free-essays-on/constitution/ site. If you are also interested in a topic like me, I advise you to pay attention to it.
RetiredUser
50%
50%
RetiredUser,
User Rank: Ninja
7/31/2017 | 1:36:18 PM
Email is a Dinosaur
Actually, the entire infrastructure upon which BEC is built is antique and lacks evolutionary potential.  Any communication that is not either encrypted or verified through some sort of multi-factor handshake and identification should be suspect.  But the tech industry isn't ready to protect consumers AND make that level of protection easy to use.  This is why we are still riding these dinosaurs like electronic mail and web domains.  The trillions of trillions of consumer dollars lost to phishing and all related digital crimes will simply continue to multiply until technology can make some giant leap into a new way of thinking about, of designing platforms for and securing data. 
COVID-19: Latest Security News & Commentary
Dark Reading Staff 6/4/2020
Abandoned Apps May Pose Security Risk to Mobile Devices
Robert Lemos, Contributing Writer,  5/29/2020
How AI and Automation Can Help Bridge the Cybersecurity Talent Gap
Peter Barker, Chief Product Officer at ForgeRock,  6/1/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: What? IT said I needed virus protection!
Current Issue
How Cybersecurity Incident Response Programs Work (and Why Some Don't)
This Tech Digest takes a look at the vital role cybersecurity incident response (IR) plays in managing cyber-risk within organizations. Download the Tech Digest today to find out how well-planned IR programs can detect intrusions, contain breaches, and help an organization restore normal operations.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-13768
PUBLISHED: 2020-06-04
In MiniShare before 1.4.2, there is a stack-based buffer overflow via an HTTP PUT request, which allows an attacker to achieve arbitrary code execution, a similar issue to CVE-2018-19861, CVE-2018-19862, and CVE-2019-17601. NOTE: this product is discontinued.
CVE-2020-13849
PUBLISHED: 2020-06-04
The MQTT protocol 3.1.1 requires a server to set a timeout value of 1.5 times the Keep-Alive value specified by a client, which allows remote attackers to cause a denial of service (loss of the ability to establish new connections), as demonstrated by SlowITe.
CVE-2020-13848
PUBLISHED: 2020-06-04
Portable UPnP SDK (aka libupnp) 1.12.1 and earlier allows remote attackers to cause a denial of service (crash) via a crafted SSDP message due to a NULL pointer dereference in the functions FindServiceControlURLPath and FindServiceEventURLPath in genlib/service_table/service_table.c.
CVE-2020-11682
PUBLISHED: 2020-06-04
Castel NextGen DVR v1.0.0 is vulnerable to CSRF in all state-changing request. A __RequestVerificationToken is set by the web interface, and included in requests sent by web interface. However, this token is not verified by the application: the token can be removed from all requests and the request ...
CVE-2020-12847
PUBLISHED: 2020-06-04
Pydio Cells 2.0.4 web application offers an administrative console named “Cells Console� that is available to users with an administrator role. This console provides an administrator user with the possibility of changing several settings, including the applicat...