Hi everybody welcome back to salted hash, my name is Steve Reagan senior staff writer at CSO online
I'm joined by rusev sit on the VP of email security services at Barracuda and today
We're gonna talk about some phishing attacks that spoof office 365 DocuSign and other formats. We'll be right back
We'll be back loose if how are you? Thank you for joining me?
Great, how are you? I'm good. This is an interesting report. You've put out and it's near and dear to my heart
we're talking scammers trying to pretend to be office and
DocuSign and
Basically just scamming their way to the heart of the enterprise. I was it's a very good report
You may or may not know, this is a topic that's near and dear to my heart. We've been seeing a lot of upticks in
just
Baseline phishing and actually attempted B
Ec all across the board for about the past seven months here at IDG
And I have made it like a personal hobby
to break these email that emails down and see how they work and track it back to where they go and
Build out a larger awareness piece, and you should join our team
It might be fun
it's it's been enlightening to see how the criminals adapt to emerging technologies and
Filtering mechanisms, and new rule sets and things like this now
I know that in this report that was something that interested you as well, so let's talk about that
How are the criminals able to get past email defenses and pretend to be Outlook or DocuSign and what-have-you to get to the end user
sure, so
So you know what's there's really been an evolution in these types of you know kind of phishing and targeted phishing attacks, so
You know what you know and initially right what?
Attackers tried to do would be to send a link
sometimes to a website that had some kind of a virus or
It would download you know malware to the computer of the the user and pretty quickly security companies
Figured out you know that there's two main ways to stop these types of attacks
so one is if you can just see that you know it's a link if one bad link has been sent to one customer and
We were able to identify you know that customer reported to us that it was bad obviously we can block it for a lot of
Other customers or they reported as spam a second way to stop these things is basically
You know if it's trying to see you know if this is a website
That's trying to download something when a on the page
You know that's or and of course if that thing looks kind of like a virus. It's pretty easy to detect
So that's why you know if you look at kind of the evolution of phishing there was basically
I think there was a lot of fishing
And then there were some kind of a plateau right where you know a lot of these attacks got stopped, but insecurity you know
It's always a Kenan Mouse game exactly you were saying and so what the attackers are figured out is
You know they can easily actually bypass these defenses by one
Personalizing the links so making sure that they don't say in the send the same link is not same
Sense across attacks so basically every time they launch a new campaign, and you attack they use a unique link
So that's one way they figure it out the second one is the websites themselves
They actually understood that you know it's actually if the website doesn't appear malicious
to the security system
Then it won't stop you know then there's nothing stopping it right and so what the attackers have understood is the best way to gather
Credentials is not necessarily through infecting a computer with
Malware or something like that all you need to do is just present a nice sign-in page right we all are compelled to sign in
So that this kind of combination of you know
Evasion and using unique links with social engineering really is what makes these attacks so successful
So I've noticed a lot in the patterns here over the last couple of months that the the way the kits are constructed is
pretty basic and generic, but it's not
Really horrible. It's it's just kind of a way to
Fit itself into your normal workflow
so what they're counting on is it is natural for the the target or the victim in this case to see a
Link requesting someone open an office or Google Docs account or to look at DocuSign and they follow through and they're they're hoping that
Because that's a part of your workflow. You're not going to notice that the templates not exactly the same when you go log in
Office 365 is it's a great example of this a lot of companies personalize their company's login portals
so when you type in your corporate user name and user name it automatically directs you to a a
unique login background screen or something like this well for these scams
it's never like that because it's impossible to
Try and predict how this that stuff's gonna look so they keep it really basic engineering
And they use the templates that are easily adaptable have you noticed any
Change in that in that that workflow are the criminals actually starting to mirror customers login portals, are they still keeping it basic
You know so I think there's just a lot of variance so not not all hackers are created equal, okay
And also not all targets are created equal right so you know what we've seen with our customer set which is quite diverse actually
It's anywhere from like really small businesses to kind of you know big famous corporations is
You know it depends right so most of the attacks. I'd say are still you know they're not that
personalized right they wouldn't go through the effort of actually for example personalizing the way the link looks and
Even the text of the email, maybe they would typically use
So they have some kind of a template
Let's say a DocuSign email, and they just would change the name of the recipients in the email
But they wouldn't really customize it beyond that
But on the it you know
But the on the other hand of the end of the spectrum
We do see some attacks that are extremely customized and extremely well done
So I'll give you the it's not not exactly the DocuSign example
But it give you an example from a from a BBC domain
So we've seen for example attacks where the attackers try to go after real estate firms
And they kind of monitor their internal communications and wait until a specific deal
You know someone's gonna specifically go and buy a house
And then you know right before that person is about to send their down payments you get an email you know hey
you know
This is the bank account that you need to send your down payment to for this specific
You know address
Etc so you know my point is if the payoff is is big enough you know if it's hundreds of thousands of dollars or more
They definitely look they can customize an HTML page. You don't need to be you know
don't adjust
Rocket, I just customized an HTML page so and also you know what one uh?
One other thing about these attacks right is they do give them access to the corporate kind of network and corporate communication
Which which that also?
Helps them it gives them a lot more clues on how what is normal?
Normally kind of what is the normal communication patterns in the company what templates do they use etc so?
So that really helps, and we definitely have seen attackers do a lot of reconnaissance in this area
And there's a huge difference between the attacks you've observed in the last couple of months between the the general kit based
Let's flood the market and see who bites at first is the Attar gated attacks like
To give you an example on my end the targeted attacks actually used my name
And they were the the emails themselves were written specifically for me. You can tell the only thing was is they?
they
Without getting too deep into why their attack failed?
let's just say that they they really didn't do their homework as deep as they needed to so the domains and the
The way they were talking it was wrong, but if they had done their homework. It's very easily
I could have probably have fallen for that scam
I could I could I'm not infallible, so I'm willing to admit that you know as a journalist
I'm just as much of a target as anybody else
And I'm just as easy of a target as anybody else it only takes one simple slip to get caught on this
So let's look at going back to your report. You've seen an uptick. What kind of volumes have you seen lately?
I mean so again
So it depends right on the on the company, and and you know and sometimes by the way
Uh, I'll just say one of the weird
Things about our job. Is it's not always clear
Why certain companies get attacked and why aren't the not or not as much I mean it's not
Just you know it's somewhat random sometimes like companies
You would not expect just get a talk talked a lot and vice-versa, but generally speaking
You know we see for for some of our customers. You know dozens and hundreds of these attacks every day sometimes
Especially when there's a campaign that specific targeting a company so for example
We had several customers that got hit with like docu massive DocuSign campaigns
That were going after everybody in the company that had anything to do with customers
You know support sales
Purchasing
And so and you could see clearly the attackers were a lot
You know really trying to infiltrate that specific company's email system for example
In order to launch the sequent attack, so you know I so point is there's there's variance
But it can be you know tens and hundreds of attacks a day for some customers have you figured out the source of the?
The contact the initial contact like where are they getting the email accounts and the information to know who to target?
Yeah, you know part of the problem are the difficulty we face in general with email is email is generally anonymous right it's not
It's kind of similar to Twitter and all the posts
we have Twitter right you know anybody can anybody can log in and open an email account for example on Gmail or
Comcast net, and if someone uses like a webmail client. It's really hard to actually
Understand where the person is actually coming from so you know generally speaking
You know we definitely see a lot of emails coming from company. You know countries outside the US
a
lot from European countries or
East Asia for example, but there's also a lot coming from just you know American providers
There's also a lot of attacks coming from domains that were registered in the US
For example when folks register domain that's really similar to the company's name
So so you know, there's no
Unfortunately, I can't tell you that there's a very clear pattern
You know so it's it's it's it's all over the place
I mean we anecdotally I mean I know that some of these BC incidents have actually originated from the US as well
So it's not something that is just coming out of you know certain foreign countries
Yeah
One thing you know it kind of just another corollary to that we also track what's called domain spoofing
Where basically these are attacks where people are trying to kind of use the domain of the company and impersonating it?
And we track the IDS of where those emails come from and again. You see it's really distributed across the world
It's not it's not from just one you know specific geography, so so when it comes to the actual targeting itself
when
Someone in sales is getting hit like you said you'd seen that with the DocuSign stuff has anybody had anything to do with the customers
Where are the criminals getting the emails to target these actual individuals, so how do they know the difference between?
mark in sales and mark and supply
How do they know who they're targeting are they just blindly trying every name in the book against a company's domain
so so one thing I can tell you absolutely for sure is they definitely scrape websites and
You know by you know any you know any public company or any company that has executives
You know those are usually still the top targets from what we see just in terms of frequency
But then when you look at employees that are below that you know like a salesperson or sales manager for example
You know it's it's probably you know typically one of two ways
It's either looking at social media
You know something like LinkedIn, or they're literally buying lists very similar to the way you know
Business-to-business a company would buy lists to try to target you know sales
So you know you can buy a list with a lot of?
Contacts from you know I can go buy a list of IDG probably with a lot of different
Roles today from a repository and just you know pay for it
And you know and and it's very possible it's like in the dark web. These lists are kind of circulating so
It's not hard
You know it's it's not hard to get a list with an email and a position of someone in a company these days, right?
And and finally right like a lot of times what the attackers are doing is they're getting in the door. They're infiltrating
doing reconnaissance
And then they learn a lot more about the organization's one
Once they've already infiltrated into an account so that lets them launch subsequent attacks that was actually the case last
last October November for the office stage
6365
They would compromise one person's accountant and look at their address book and that's how they move the scam forward was internally
and and that's something I mean that's kind of what we're seeing that attack just
In vast numbers right now. I mean, it's it's a scourge. We see IT teams you know in security teams literally
You know just hundred I mean we have
Talked to customers like hundreds of accounts a week
It's just a nightmare chasing after you know the compromised accounts for those of you watching at home though to put this in perspective
seeing hundreds a week
It's bad, but if you're a large enterprise seeing hundreds a week is actually kind of normal so it really depends on
The the scale of your operation, and how you're dealing with it
So I think that's an important important note to add to that it's the fact that yeah hundreds is bad
But if you're a really large enterprise hundreds is normal
and
that's the scary part is the fact that you know you'll
you'll see hundreds actually make it to the inbox and hit the inbox and you'll see thousands that get blocked and
It's it's always those those small percentages to get through that you have to worry about because if if just one person
Sees that and they're in a working in a rushed clip, and it just kind of matches their workflow
And they don't even think about it until it's too late that. It's it's that's it game over and
yeah, that moves into the awareness training and the incident response which we can cover in another video so
Before before we wrap up here one other question have you noticed anything stand out in the emails that are unique that
Gets them past all these filters, and and and and works their way into the inbox
I know earlier you were talking and you said that you know the links are a key thing and
From experience you and I both know that they compromise legitimate websites
And they used them to get past a lot of reputation
Filters and things like this so it's that what you're seeing or is it something a little different
Yeah, exactly so the links are oftentimes
Basically a website that you know some small business
You know like an upholstery shop in Kansas for example
That got compromised and the attackers just inserted a sign-in page in there and so oftentimes traditional filters
We'll miss these emails because when you look at the reputation. It's gonna be sterling. It's a
You know legitimate website
Legitimate business has been around for a while, so they really don't don't understand that you know it's not it's malicious
It's it's trying to steal credentials. It looks and also it just looks like a sign-in page
I mean a sign-in page is not stop trying to download a virus or something so yeah
Yeah, awesome. Well. Thanks a lot for taking the time to talk to me
I appreciate it you have a very good afternoon
And if you want to learn more about b ec attacks or fishing in general head over to CSO online.com
My name is steve reagan, and this has been salted. Hash. We'll see you next week