Hello everybody and welcome back to salted hash. I'm your host Steve Reagan today
I'm joined by
Barracudas who sips it on and we're gonna be talking about some fishing some email scams and a couple of trends that you might want
To know about stay with us and we'll be right back
Welcome back Joseph. How are you friend of the show?
Thank you. Good. How are you? I'm doing good, man
It's good to have you back on thanks for coming to hang out with us
So, uh, I I don't want to like be the spoiler, but y'all have been busy lately. Um,
quite a bit busy, so
Tell me about this this stat. I'm reading here from
From one of your communications people. It says on May 1st. You've blocked over 3.2 million phishing emails
What's what's going on with that? What are you doing?
Yeah, well, yeah, so I mean one of the interesting things about fishing
It's you know, it's kind of like the weather, right?
So you can have you know, sometimes it's all nice and sunny and you know
Just a little bit of kind of background noise
And then sometimes you just get, you know, really have significant Peaks and activity, you know
Sometimes those Peaks are related to certain events, maybe holidays or or something like that
But in other times, I mean, it's it's just you know, an attack probably like a hacker group
That suddenly, you know decided to send out a certain campaign
And so yeah, we've seen generally been very busy in the last couple of months
We've just been seeing a pretty big uptick in phishing attacks both in terms of the number just the raw numbers
That we're seeing we're seeing didn't mass campaign. So in the last two months, I mean, I think we've seen you know, we're three million
Different attacks and that's you know within that that's a, you know thousands of different unique phishing attack attempts
So, you know, the fishing world is kind of separated. There's the kind of mass fishing
And you know whether the same template is used many many times and they're trying just to get a lot of folks to fall for
It and then there's the more targeted stuff where they're typically after more
You know a more higher profile kind of targets so lately here with with. Oh, no, it makes perfect sense
Here with my own research lately. I've been noticing an uptick in in kits that are based on
services and not just
Well-known brands like I found a zoom
Fishing kit the other day that I thought was really interesting that zooms now on their radar to where they want to get
credentials for that
But you came across a Wells Fargo
Netflix Citibank, you've seen an uptick in those recently tell me about that
Yes, so, you know one thing that's really important to remember is that you know attackers, you know
People reuse passwords, right? So, you know
So a lot of people use the same password that they do for enough Lakes they do for their corporate email system
Or maybe their payroll system, right and so attackers really don't care, right?
like, you know
Once they have a password of someone they can wreak havoc even if the system doesn't necessarily seem
weird that that dangerous or that sensitive so, you know, they're basically trying to get in any way they can
Yeah, I mean it's pretty interesting like we've seen in the court, you know, most of our customers are obviously kind of corporate
You know corporate organizations, right? They're not consumers
But we've seen a really big uptick for example with a lot of these consumer services light enough like Netflix
Where they're trying to grab the Netflix password and then reuse it to get into the corporate network
So yeah, that was really interesting one. We've also seen like a lot of these
You know international leaks like I think one of the examples we sent your way was was Netflix
But it's actually in Spanish and you see Spanish
I think yeah, so the attackers are pretty savvy right there cuz I think tracking the expansion some of these services internationally, you know
So I you know, perhaps Netflix was introduced to a few new countries and and you know with the enthusiasm about it, you know
They're they're kind of following it and trying to harvest credentials. Yep
So it wasn't the the kit that you guys sent me over but there was another Netflix kid
I came across that was geo-located
this one was French and what I thought was really interesting was a I'm not entirely certain if
the Netflix had like a
dominant like French presence
But what was interesting was when you looked at the back end of the code?
If your IP or your location didn't match France
It would direct you to a fake 404 or a 302 to redirect you over to Google
You wouldn't even get to see the kit there. They're literally just wanting you know one locale
It's it's interesting to see how they're developing their security mechanisms
The are you seeing any like tricks similar to that or are you seeing anything?
Yeah stands out is really cool in your mind. I mean, what are you saying?
yeah, no, so I mean
Yeah, so we've definitely seen that and I you know
The thing that they're trying to do there, right is they know that most or not most with many?
like for example email security vendors or let's say office 365 and Gmail obviously sit in the US and
and you know some of the techniques that you know companies have developed are based on actually going in kind of
At actually looking at the site itself and trying to analyze it
So if they you know, if they can put a 404 page, you know a lot of these filters
Won't catch the email so and they're you know
And they know that someone who's not French will probably not click on a French email
So yeah, I mean it's it's not you know something honestly, it's not like rocket science, right?
I mean, it's not that hard to do something like that
but there's they know, you know, so another, you know, another really interesting one we've seen which is you know, slightly related is
You know all you know text your text manipulation has been around for a very long time in the world of you know
spam and phishing
So now we're seeing people entering, you know, the attackers kind of entering, you know, zero font text an email
That's something that we're seeing or you know, they're playing around with very southla bets
So, you know the same word will have different different, you know will have the R and Cyrillic
Yeah, so that's another another place that they're really focused on another by the way another
Similar type of deception is just instead of sending like spam emails or phishing emails with text
They'll have it in images again since most you know filters rely on
Analyzing the actual technique and actually go and do OCR or something like that on the image. They'll also fail
So yeah, so there's a lot. Yes. It's all all of these in my opinion fall in the category of like social engineering they're not
You know, these are not techniques that are like about creating a very, you know
It's like a super complex zero-day exploit in Windows that you know or something like that
It's more about kind of fooling the filters and fooling the humans looking at the at the email nice
All right. Stop right there your video froze for a second
So we're just gonna let no we're gonna let no no, we got everything. You just said was recorded. We're fine. They're okay
We're gonna wait for the the video. Yeah
All right. Well, Chris says keep going so we're gonna keep going so
Going back to
An interesting thing I saw in one of the kids
I'm curious when it comes to the htaccess files a lot of these kits include for security reasons like if your
IP falls within a certain range, you know block it and everything like that
Where are they getting these?
Address ranges are they logging their own stuff? Are they just coming against it on the fly? Like there's a unknown pool of addresses
They're blocking
Yeah
That's a good question. You know, I I
Suspect so first of all, like some of this information is available online like the attackers actually do share information
Also, don't forget. I mean these guys
Have you know they run? So we
suspect
For example, like in spans and syndicates, right?
The the same organization is going to run multiple campaigns and is almost gonna build a kind of a platform for distributing
So we know you know, we the same thing is true with with phishing, right?
So they've worked with a major vendors that do security with a major email service providers, you know
They they understand how these systems work
Understands what ip's they ain't used to look up, you know links
And then sometimes they might distribute that information amongst themselves. So these are fairly experienced and seasoned
Attackers right like a lot of these attacks are clearly
Crafted with the understanding of how email security systems work
And to be honest with you, you know
I'm the first also criticized my brethren in the
Security industry a lot of the techniques that people use are still very naive. They're very they're they're based on IP reputation
They are based on very simple reg X's and text analysis and blacklist, right? So so it's no wonder that these techniques work
Yeah, that makes sense. Like it makes sense. So
Touch base just one last thing before we have to go
There's been an interesting
police case here lately
I understand you're familiar with it Department of Justice just nabbed scores of scammers involved in fraud millions of dollars worth of stuff
Give me a breakdown on that. What are you what's your take on that that whole arrest situation over at DOJ?
Yes. Oh, look. I mean I've I've actually personally been working on BC. That's gonna yeah
Something that, you know couldn't we've really dedicated a lot of efforts into so yeah, so I mean I think
What happens right is the end goal of most of these bc campaigns is a wire transfer ed. Yeah, sometimes they try to steal
sensitive information, you know like social security numbers or
Medical information but generally when analysis we did 99% of BC attacks, the end goal is a wire transfer
And so when you there is a wire transfer, you know
At some point right the security. We as a security company kind of cuñado, you know kind of our
Responsibility ends, and it kind of DOJ and the bank's kind of begins
So so I know that you know a lot of our customers, you know
A lot of folks that came to us because of BC problems had in the past reported these problems to DOJ and DOD
did launch investigations I know that a lot of these cases have been very tricky because you know
Especially if the end if they account at the end is like sitting in China or Russia or kind of a quote-unquote
Non-cooperative country it's it's very hard to retrieve the money
But in this case, you know, it seems like it was there was a presence in Nigeria
But there was also a presence in the US
And so perhaps that's kind of the way they were able to catch the string
I will say, you know, I looked at you know the numbers that were
Published right. So I think they were able to ring was responsible for several millions of dollars it 2.4
Yeah, 2.4 million was seized and they disrupted or recovered 14 million in fraudulent. We're transferring
yeah, so I mean
That's great
And that is a lot of money, but that is actually I mean that is a drop in the bucket, right?
So that is you know, if the FBI published numbers up to 2016. It was five billion dollars in
Mistaken warrants for fraudulent wire transfers so I mean that's like less than 1%
Way less than one right?
So, I mean this I think this shows the types, you know
And think about it like this operation this this these guys were able to attract several million dollars
They were they had you know dozens of people working in international syndicate
So just imagine how many other people of that like five billion dollar economy. There's probably hundreds if not thousands of
Criminals around the world working on this so so I think it's great that they did it
But I think we need to I think this is just a kind of an alarm
Statistic shows you how widespread this is. Yeah, so we need to all be very vigilant about
BC can I just say one more thing Steve just a really interesting
Attack that we've seen so, you know the cutting edge now of BC
is
BC plus account takeover, and that's actually the attack that I'm personally most worried about
you know because I think you know, there are you know, there are pretty decent solutions for BC now, but
What we've seen is attackers actually take over
They steal the credentials of an internal employee and then they use the actual
You know account of that employee to send an email like to the CFO so that CFO is getting an email
Haywire transferring money from the actual CEOs email from within the corporate network, right?
yep, and that attack we've started seeing that and and I mean that is extremely
extremely dangerous and hard to catch
We're working on it and we have some some solutions in place to help with ATO
But but I think beyond that I think companies just need to have a really high
Awareness to wire transfers they need to do training
They need to set up safeguards any time a wire transfer comes in, you know request for a wire transfer
Companies need to be really really vigilant
Even if it's coming from you know the phone of the CEO or from the email of the CEO. It's super dangerous
See that's that's the frustrating part about all that when you see these BC stands
You know take off it's because they're actually playing along with the normal workflow of the business
So if you get an email from the CFO
It says hey wire transfer to this account five million dollars and you do it. That's because you'd normally would get an email
Typically during your whist business day. Just transfer money that should never happen when you're dealing with this kind of high value
Sum you should live. It should be a face-to-face meeting. Here's the account
I need you to transfer to we need to get this done today and then you do it
I mean it takes two seconds to pick up the phone or to meet somebody face-to-face confirm this versus do it over email
I mean, this is how they got away with getting all the W to scan and w2 records and everything during tax season
You know, all they would do is email the company and say hey, I need all your tax records. Somebody gave that to them
it's it's just a normal business thing that they're they're just
Inserting themselves into they're not even disrupting it. This is typically how they work. So they just go right in
Going back to here account takeover thing real quick. It sounds like they're advancing on what they were doing last summer
There was a group of Nigeria that was taking over accounts and then it's pushing the the the emails from there
So it's just an advanced version of that or they just more coordinated this time sticking with high-level targets
yeah, no, I think it is advancing right so
We can't take over is also something that we've been really focused on and have researched quite a bit
So, you know, I think in the early days of a county cover, you know, typically they were just harvest credentials
And then use the take accounts that were taken over to launch additional phishing campaigns
So for example, like I take over, you know an account of you know, whatever like University
Okay
And then I use that universities email to send thousands of email of emails to other you know
Higher value targets trying to fish them for example
And and and those emails will get through because the university would have a very high reputation right now
My email would be trusted by for example, Microsoft
Now what we've seen is yeah, they're now doing more sophisticated campaigns, right?
So they're trying within
you know within AI an organization to do
BC to try to infiltrate higher level employees right to get to the senior executives and then steal information off of them
We've had for example an organization I'll keep them unnamed. We're basically the attackers infiltrated
You know
They're the network with ATO and then you use the same
They stole a bunch of passwords from the payroll team
And then they use those passwords to log in to the payroll system and change all of the employees
Bank account numbers and then when payday came in, you know all the checks
check scam routed all that the chicks got routed, right so to the wrong places, so so that's you know,
I think that's really the new frontier is where ATO is kind of how you get in and then you know they do
much more sophisticated things once they're inside because you know
Like most email vendors won't even check internal emails and they have no way to stop
Internal emails and you know in Microsoft typically won't stop it, right?
So it's kind of open its it once once you get into the door, you know
Everything is open to you know
Loose if it's been great talking to you. Thanks for taking the time to join me
Thank you Steve. As always if you'd like to stay up on b ec attacks fishing or any other types of ATO scams schemes
Or money-laundering frauds. Remember keep an eye on us at CSO online.com
I'm Steve Reagan in this offense all too - I'll see you next week. Bye
You