The Eight Ways Phishing Attacks Bypass Sandbox Technology

Jane Wasson |@Area1Security| Area 1 Security

Sandbox technology is a favorite tool for security researchers, enabling them to analyze files and detect malware. But is it effective at actually stopping phishing attacks without slowing down business productivity?

Phishing attacks, the cause of 95 percent of data breaches, often start with an email file attachment that’s hiding malware or a malicious link that downloads malware. The unsuspecting victim opens the file attachment or clicks the malicious link, and unknowingly downloads that malicious code directly into their system. The consequences are often severe, providing hackers the entry they need to crash systems, steal data, or infect an organization’s network infrastructure, backend systems, or data and carry out their malicious intent.

How Sandboxing Works

To defeat phish, security teams frequently deploy sandbox technology or web isolation technology with embedded malware sandboxing features, either as an on-premises appliance or as a cloud service, to detect malware hidden in email attachments or web downloads. With these technologies, files execute in a sandbox environment, and the behavior is analyzed to judge whether it’s malicious.

If a file is judged to be malicious, robust solutions generate a report detailing the malicious behavior, and the security team is alerted. The report includes information such as how the malware interacts with the sandbox host system and how it attempts to communicate with other devices or websites.

Neutralizing and Removing the Phish

Using the reported information, the security team is armed to track down and remove the malicious file if it was delivered, clean affected systems and update other security infrastructures such as firewalls, web gateways and secure email gateways with newly discovered threat intelligence and rules to protect the organization from follow-on attacks.

This sounds great: the phishing attack is detected, and the security team notified. They’re now armed to respond, clean up the damage, and prevent follow-on attacks.

But Not So Fast — Threats Evade Sandbox Technology

However, hackers are aware that many organizations fortify their security infrastructure with sandbox technology. Cyber attackers continuously evolve their malware and phishing techniques to evade sandbox defense. For example:

• Sandbox Detection and Evasion: Hackers are designing their malware to detect whether the file is in a sandbox or in the target host environment before it executes its malicious behavior. If the malware senses that it’s in a sandbox environment, it quickly terminates. More sophisticated malware even runs phony benign operations to fool the sandbox, which then fails to detect malicious behavior, judges the file harmless — and delivers it right to the target victim!
• Delayed Malware Execution: Hackers recognize that businesses are time-sensitive. That means sandboxes have limited time to analyze files and render a verdict before delivering a file to its recipient. But hackers can intentionally design their malware to delay execution of malicious behavior; or trigger execution only after an event such as a system reboot. In that case, the sandbox analysis environment may not detect or identify the code as malicious. Again, the sandbox technology judges the file to be benign and delivers it to the end user.
• Hiding Malicious Code in Password-Protected Attachments: In some cases, hackers hide malicious code in password-protected file attachments. They then send a password in the body of an email, out of reach of the automated sandbox. In this case, most automated sandbox technologies can’t open the file for analysis. Once more, the sandbox can’t judge the file to be malicious and may deliver it to the desk of the intended recipient.
• Hiding Malicious Code in Obscure File Types, Large Files, or Targeting Malware for Mobile Environments: Sandbox technologies and cloud sandbox services often have limitations on supported file types, file sizes, operating system environments, and even number of files analyzed per hour. These limitations provide opportunities for hackers to craft files with hidden malware that sandboxes won’t detect.
• Sending Malicious Files in Encrypted Traffic: More than 50 percent of Internet traffic travels encrypted. But most organizations don’t decrypt incoming traffic. That means files transmitted in encrypted traffic are invisible to the security infrastructure. Therefore, these files can bypass inspection by sandbox technology.
• File Analysis Delays Delivery: Sandbox file analysis can take from 30 seconds to 10-plus minutes. If sandbox technology holds files for delivery until it determines a judgment, that delays both harmless and malicious files. This delay causes loss of end-user productivity, and frequently results in executive and employee dissatisfaction. So in some cases, to protect from productivity loss, the sandbox technology doesn’t delay file delivery until it has finished analyzing a copy of the file. Instead, it delivers and downloads the file to the recipient’s target system before the judgment is available. If the file turns out to be malicious, the damage is done. The time and expense of remediation can balloon enormously.
• Credential Harvesting Attacks: Not all phishing emails involve malicious file attachments. For example, credential harvesting attacks often start with targeted phishing emails that pretend to be from a trusted organization such as a bank, and request the victim to click on a link and log into their account or change their password. In this case, the link directs the user to a spoofed site. The attacker then harvests the credentials that the victim enters and uses those credentials to log into the victim’s actual account. With credential harvesting attacks, there’s no malicious file to analyze so a sandbox solution won’t detect the phishing attack.
• Business Email Compromise (BEC) Threats: BEC threats are targeted phishing campaigns that rely on impersonation to trick victims into providing confidential information or transferring funds to the hacker. With BEC, cybercriminals use various spoofing techniques to disguise an email, making it appear as if it came from an organization executive. Again in this case, there’s no file download, so a sandbox cannot detect the threat.

A Better Way to Defeat Phishing Attacks

So if sandbox technology isn’t effective, how can organizations better defend from phishing attacks?

We can take a lesson from history.

Key to protecting Britain from enemy aircraft bombs in World War II was the use of radar. Radar deployed along the coast of England allowed the Royal Air Force(RAF) to detect enemy aircraft during the earliest phases of an attack, while enemy planes were flying over France. This early insight gave RAF commanders time to deploy defenses effectively to intercept bombing raids. Radar gave the RAF the early visibility necessary to defeat their enemy.

At Area 1 Security, we believe that effective cybersecurity also starts with early visibility. Our technology crawls the web, continuously and proactively discovering phishing campaigns and infrastructure before attacks launch. On average, Area 1 Security detects malicious sites and payloads a full 25 days before other industry defenses.

The Area 1 Horizon™ anti-phishing service is locked and loaded with preemptive threat insight that allows us to detect and stop email, web, and network phishing attacks effectively that other security technologies, including sandboxes, miss so that your business is protected.

To learn more about how phishing attacks bypass sandbox technology and how Area 1 Horizon anti-phishing service stops them, watch our webinar.

The Eight Ways Phishing Attacks Bypass Sandbox Technology was originally published in The Azimuth on Medium, where people are continuing the conversation by highlighting and responding to this story.

Why Email Authentication Can’t Stop Phish

Jane Wasson |@Area1Security| Area 1 Security

The headlines are full of bad news about data breaches and financial losses that start with phishing emails. For example, a recent phishing attack at MacEwan University in Canada involved a series of fraudulent emails that convinced staff to change electronic banking information for one of the institution’s vendors. This fraud resulted in the transfer of $9.5 million into an account that staff believed belonged to the vendor.

In another case last year, Google and Facebook fell for a targeted phishing attack that collected $100M over a two-year period. This particular campaign involved forged email addresses, invoices, and corporate stamps. The scam tricked employees into believing that they were receiving payment requests from a supplier — when in reality, the payment requests were from a cyber attacker.

The common thread here is fake email. A hacker sends a phishing email that the victim believes to be from a trusted party but in reality came from the criminal.

The unfortunate truth is that email technology was not initially designed to be secure. Hackers use many techniques to send imposter email and trick end users. In response, email security technology has evolved over the years to add sender authentication features meant to protect recipients from fake email. While this helps, it’s clear from the headlines that fake email continues to bypass email authentication defenses and in fact, the entire security infrastructure.

How does this happen, and what can be done to better protect organizations and individuals from phishing attacks that start with fake email?

Fake Email: Techniques Hackers Use

Hackers use several techniques to craft fake email phishing attacks.

• Display name spoofs: Hackers can easily spoof the display name or “From” email field to make it appear that an email comes from an executive or other trusted party.
• Domain spoofs: Hackers can also easily spoof a sender email domain to make it appear that a trusted organization or partner sent an email.
• Look-alike domains: In some cases, hackers establish a domain with a name similar to a trusted organization or a trusted partner’s domain name. This fools recipients into believing that an email comes from a trusted source.

Although the industry is aware of these techniques to deceive recipients, traditional email security technologies still aren’t effective at detecting fake email phish and preventing them from landing in end-user inboxes.

Can Email Authentication Stop Spoofing?

Email security technologies rely on sender authentication techniques to validate an email sender and ensure that sender is who they claim to be. Key authentication techniques include:

• Sender policy framework (SPF): SPF helps identify spoofed email. SPF records indicate which server IP addresses are authorized to send email on a domain’s behalf. When a recipient email server receives an email, it can check the SPF record for the sending domain. This is to verify that the received message sender’s IP address (listed in the message header on most email) is authorized to send email on behalf of the sending domain. The SPF check passes if the domain’s SPF record indicates that the message’s sender IP address is authorized; if not, the check fails.
• DomainKeys Identified Mail (DKIM): DKIM is another email authentication technique that helps prevent spoofing. With DKIM enabled, the sending email server adds a digital signature to outbound message headers. The recipient email server uses the signature and the domain’s public DKIM key to validate the sending domain.
• Domain-based Message Authentication, Reporting, and Conformance (DMARC): DMARC is another email authentication technique that helps prevent spoofing. The sending domain’s DMARC policy is used by receiving email servers, along with SPF and DKIM check results, to decide if an email should be quarantined, blocked or allowed. By implementing DMARC for your domain, receiving email servers can authenticate email from your domain. They can also recognize and block imposter email pretending to be from your domain. Implementing only SPF or DKIM for a domain is less effective for sender authentication. Without a DMARC policy, if an SPF or DKIM check of an incoming email message fails, it can indicate either that the email: 1) was sent by an imposter; 2) that the sender’s domain record isn’t effectively configured for SPF or DKIM; or 3) that the sender hasn’t kept the configurations up-to-date. In the latter cases, the email may be valid, even though the checks fail. Without a DMARC policy, the receiving server can’t reliably determine from SPF or DKIM checks whether the email is fake or not.

Most email services and security technologies support these email authentication techniques, and security experts strongly recommend implementing DMARC. For sending domains, implementing DMARC is a best practice for organizations that want to protect their brand and ensure that destination email servers trust messages sent from their domain. However, sender authentication alone is not sufficient to protect from inbound fake email phish. These fake email phish still frequently bypass authentication checks. For example:

• Look-alike domains: With look-alike domains, hackers establish a domain with a name similar to a trusted organization’s or trusted partner’s domain. The hacker sets up the domain with SPF, DKIM, and DMARC configured, so that emails sent from the hacker’s domain will pass authentication checks and land in end users’ inboxes undetected. This fools recipients into believing the email is from a trusted source. Hackers often launch and shut down these domains quickly, before reputation databases mark them as malicious.
• Spoofed accounts: Another hacker trick is to establish spoofed accounts with free email services such as Gmail or Yahoo, using a name similar to that of a trusted party. Because many free email service providers implement DMARC, SPF, and DKIM, these spoofed accounts will pass email authentication checks and can land in end-user inboxes and cause harm.
• DMARC adoption: Although DMARC email authentication has been available for several years, adoption is limited. Industry leaders estimate that DMARC policies are implemented in only five percent of domains and only 30 percent of email traffic. Therefore, for 70 percent of inbound email traffic, using DMARC to validate senders and detect fake email phish isn’t possible. This situation leaves a significant security gap.

Email authentication alone, including DMARC, is not sufficient to detect and protect against incoming fake email phish. Not all techniques hackers use to send imposter email, as noted above, are detectable by email authentication technologies. More protection is necessary to defend organizations and users from fake email phish. Specifically, the need is for security technology that is aware of hackers campaigns and infrastructure before a phishing attack launches. With early visibility of compromised or malicious websites and servers, fake email phish originating from hackers can be detected and blocked before they hit user inboxes and impact organizations.

How to Stop Phishing Attacks

Area 1 Security is a pioneer in hunting for, and disabling phishing campaigns before they go live. The Area 1 Horizon™ anti-phishing service stops phishing attacks that other security technologies miss. This service is cloud-based, adds a layer of security that deploys in minutes, and, with our $10 pay-per-phish program, charges no upfront cost. You pay only if we catch malicious phish. Customers confirm that the Area 1 Horizon service protects them from phishing attacks that traditional defenses miss. In the first couple of months after deployment, a Fortune 500 consumer products company found that Area 1 Horizon stopped over 150,000 phishing attempts missed by its traditional security defenses.

Learn more about email authentication and how to effectively shut down fake email phish, including:

• Techniques Hackers Use to Spoof Email
• The Role of Email Authentication
• How to Fortify Your Security Infrastructure to Stop Phish
• How customers in case studies stopped fake emails

Watch the webinar “Why Email Authentication Can’t Stop Phish.”

Why Email Authentication Can’t Stop Phish was originally published in The Azimuth on Medium, where people are continuing the conversation by highlighting and responding to this story.

The 3rd Annual March Hackness Phishing Bracket

Brands Most Likely to be Phishing Lures

Shalabh Mohan | Area 1 Security | @area1security

March Madness is upon us again, which can mean only two things: lots of cinderella surprises on the basketball courts; and the release of Area 1 Security’s March Hackness Phishing Bracket that reports the brands most used by hackers as phishing lures.

This past weekend was full of upsets (I should know; I had Virginia teed up to the eventual winner) in the first rounds of the March Madness college basketball tournament. It has been an especially wild few days for the tournament. ESPN is reporting that out of 17 million brackets, zero predicted the correct result for the sweet sixteen.

While predicting college basketball winners is a tough job, predicting cyber threats doesn’t have to be. We know this because hackers remain predictable in how they breach organizations and in the methods they use to get past defenses.

Their consistent ally in this? People like you and I. And core to their methods is the notion of trust.

Who can you trust and who do you trust?

Inquiring hackers want to know — and they do know. It’s the brands we trust that hackers predictably use as phishing lures to get us to open a message, click on a link or download a file, so that they can compromise our systems, networks, and data to achieve their malicious objectives. That’s why it’s phishing attacks that cause over 95 percent of cybersecurity-related data loss and financial damage.

The Top 64 Brands That Hackers Spoof

While college basketball’s elite 64 take to the courts for the annual March Madness competition to see who’s best, here at Area 1 Security, we’ve analyzed recent phishing attacks to identify the top 64 brands hackers are using to attack unsuspecting victims.

The results are in. We’ve seen some trends continue from past years, and the addition of some new players to the field.

• Admittedly skewed towards our sample set — but even so, U.S. brands continue to be a favorite for hackers, with 63 percent of phishing incidents involving spoofing of U.S. brands, up from 48 percent last year.
• Financial services, previously the preferred industry for hackers to spoof, is still strong but declined from 50 percent of incidents to 44 percent. Cloud services made up a significant portion of the rest.
• Within the sweet 16 brands spoofed by hackers, there are eight new brands, indicating a trend towards diversity in lures.
• Most Improved Players (trusted brands to spoof) include Linkedin, Stripe, Airbnb and Craigslist, all new to the sweet sixteen.
• Up and coming players, trusted brands new to the Sweet 16 and the Top 64, include Squarespace and Dropbox.
• Returning Most Valuable Players include Apple, Facebook, Wells Fargo, and rounding out the top four, Yahoo.
• After losing the number one spot to Paypal last year, this year, Apple returns to the top spot for the second time.

Stop Phishing: Take Away the Element of Surprise…

The March Madness tournament is full of surprises. But our cybersecurity defenses don’t have to be. While our goal for the phishing bracket is to raise awareness and to illustrate the repetitive and predictable nature of phishing attacks, we hope that in the future this exercise will become obsolete.

Just a few months ago, in their 2018 Global Risks Landscape, the World Economic Forum ranked cyberattacks along with extreme weather events and global nuclear warfare as the biggest risks to our society. Being reactive to a clear and present risk is exactly what the attackers hope we do.

It’s time to go on the offensive with hackers and consider a new approach that effectively stops these attacks. Phishing attacks, due to their targeted nature, easily bypass existing security defenses. However, the repetitive, predictable methods attackers use to execute phishing campaigns and breach user trust remain consistent. Phishing campaigns have to begin somewhere, and they mostly rely on a trusted hook or a lure to get the user to participate. By understanding attacker methods and the infrastructure of their campaigns, it is possible to take a preemptive and an accountable approach to prevent phishing instead of continuing with today’s failing reactive approach.

Which is more than can be said for the actual tournament, where even the best teams can be surprised at times. And the coming weeks will likely throw up more cinderella surprises until the eventual winner is crowned (at this point, its Michigan all the way).

To learn more about how Area 1 Security comprehensively stops phishing before it causes damage and how we’re bringing accountability to the industry, visit our website.

The 3rd Annual March Hackness Phishing Bracket was originally published in The Azimuth on Medium, where people are continuing the conversation by highlighting and responding to this story.

Why Secure Email Gateways Miss Phishing Emails

Jane Wasson |@Area1Security| Area 1 Security

Phishing continues to be the number one threat vector for data and financial breaches — and the most effective tool in a hacker’s toolbox. In fact, 95 percent of cyberattacks start with phishing.

Businesses invest heavily in secure email gateways (SEGs) to protect them from email threats.

Although SEGs have long reported 99.99 percent effectiveness against spam, phishing attacks keep evading detection. In a recent survey, 76 percent of infosec professionals indicate their organizations experienced phishing attacks in 2017.

Why? SEGs optimize for spam detection, but spam is a different beast than phishing.

With spam, attackers target many victims and send out large volumes of similar, nuisance messages, creating a productivity sink. Even if very few of these emails get through to victims, the attacker can still succeed. To protect from attacks, spam filters rely on collection and analysis of large volumes of threat samples from active campaigns. Data extracted from the samples identifies malicious domains, IPs, and malware and is then used to create signatures and threat intelligence optimized for large-scale bulk email detection.

Phishing Attacks Are Different

With phishing campaigns, however, attackers use social engineering to personalize emails and lure victims to click a link or download a file. Another popular phishing technique is business email compromise (BEC). In this case, the victim is urged to respond to a request for information, or to take an action such as transferring funds, leading to data and financial loss.

These phishing attacks are typically low in volume; campaigns often launch and then shut down within hours. Because spam filter defense strategies rely on threat data from analysis of active attacks and large quantities of threat samples, SEGs fail to detect phishing.

To close the phishing gap, spam filters have added advanced threat protection features: sandboxing of suspicious files and time-of-click link analysis are intended to help detect threats missed by reputation- and signature-based defenses. Nevertheless, phishing attacks continue to evade detection. For example, the Financial Services Information Sharing and Analysis Center (FS-ISAC), an industry forum for sharing data about critical cybersecurity threats facing the banking and finance industries, recently reported that a successful phishing attack on one of its employees was used to launch additional phishing attacks against FS-ISAC members. In this case, the FS-ISAC’s Microsoft Office 365 and Proofpoint email threat defenses missed the phish email and the attack succeeded.

Early Detection of Phishing Campaigns

Organizations urgently need a new approach to detect phishing campaigns. Waiting until after a campaign launches to start collecting and analyzing threat data is too late to defend against phishing campaigns. Protecting an organization from attacks calls for earlier insight into phishing sites and campaigns.

Fortunately, advances in computer processing, artificial intelligence, and machine learning now make possible proactive new methods of hunting and identifying malicious phishing sites and infrastructure before campaigns launch.

Area 1 Security pioneered early detection of phishing campaigns. Using high-speed web crawlers and network sensors, the Area 1 Horizon™ anti-phishing service gathers in-depth threat actor information and critical attack data across 150+ parameters. The technology collects, tracks, monitors, and parses live data from email, web, and network streams. Detailed, real-time visibility reveals crucial information, such as who the actors are, and how and when they deliver their attacks. This exposes early, accurate threat information, enabling Area 1 Security to defeat the attack.

Adding Area 1 Security anti-phishing service to your security infrastructure reduces risk by closing the phishing security gap that other technologies miss.

Learn more about effectively shutting down phishing:

• How phishing attacks evade secure email gateways
• The breakthroughs that fortify defenses and stop phishing attacks
• How to augment existing spam filters to stop phish
• How early insight into phishing campaigns effectively protects a Fortune 500 business from attacks

Watch the webinar “Why Secure Email Gateways Miss Phishing Emails.”

Why Secure Email Gateways Miss Phishing Emails was originally published in The Azimuth on Medium, where people are continuing the conversation by highlighting and responding to this story.

Oren J. Falkowitz — Area 1 Security — Co-Founder and CEO

The World Economic Forum’s Global Risks Report 2018 ranks cyberattacks alongside extreme weather events and natural disasters as the most likely risks threatening the stability of society.

Roll that phrase around in your mind for a minute: One of the most likely and dangerous risks threatening the stability of society in 2018 includes cybersecurity. That means “attackers could trigger a breakdown in the systems that keep societies functioning.” In other words, we’ve moved far beyond tic-tac-toe, website defacement, stealing passwords and credit card numbers.

This is even more astonishing when you consider that, of all the global risks, cybersecurity is one of the few we have control over. If you run an ice cream shop, or a hospital, or a large multinational corporation, there isn’t much you’re going to be able to do about the next Category 5 hurricane or the Arctic melting. You’re also not in a position to do much about the increasingly likely prospect of a nuclear conflagration. But cybersecurity? You can do something about that. And that’s an important distinction.

Now, in all fairness, we haven’t been given very good tools to do that, and the cybersecurity industry as a whole has much to answer for, having sold billions of dollars of “solutions” that don’t seem to work very well. But it’s time for cybersecurity companies to be accountable to you, their customers, for the efficacy of their solutions. That’s the way the marketplace is supposed to work, and cybersecurity is a product or a service that needs to be responsive to the equilibrium of the market — the same way every other company has to be accountable for the performance of their products when they’ve been found lacking.

The resulting damage from ineffective cybersecurity is significant, with large-scale attacks becoming more commonplace as well as more damaging. Consider these statistics:

• Companies revealed breaches of more than 4 billion data records in 2016.

• The estimated annual cost of responding to cyberattacks is now $11.7 million per company, and there has been an average annual increase of 27.4% in the number of security breaches.

• More than 10% of the $3.7 billion raised in initial coin offerings (ICOs) has been stolen via phishing.

• Cybercrime carried out against businesses will cost them $8 trillion from now until 2022.

It’s clear we’re moving in a trajectory from data theft to data and network ransom. And if we don’t begin to change the economics of being a bad guy on the internet, which is a really good business today, it’s not going to get any better. But that involves demanding accountability from cybersecurity providers and focusing resources on the root cause of the problem –phishing.

You can start by not buying into the conventional wisdom that 1) these attacks are unprecedented, 2) hackers are too smart, and finally, 3) there’s nothing that could have been done. This is simply the most egregious example of “cargo cult science,” where erroneous conclusions are arrived at by misinterpreting the causality of results. So don’t be fooled by this line of so-called reasoning. We routinely send astronauts into space to live for months at a time. We can protect ourselves while we’re using the internet. Just because something cannot be done by certain methods does not mean it cannot be done at all.

We’ve already spent millions trying to solve this problem to little avail. It’s time to stop that. As an organization that spends a portion of that on your cybersecurity, you have economic power that you need to start using. Demand solutions you can depend on so that those of us in the cybersecurity industry can be held accountable for what we sell.

What if, from now on, we were to only offer our cybersecurity solutions on a pay-for-performance basis. As in, if it doesn’t perform, customers don’t have to pay for it. I believe it’s important that we make the cybersecurity industry accountable for the performance of our products.

Hurricanes, Earthquakes And…Phishing? was originally published in The Azimuth on Medium, where people are continuing the conversation by highlighting and responding to this story.

Vivek Bhandari |@Area1Security| Area 1 Security

Is your security infrastructure able to block targeted phishing attacks? According to a recent research report, most organizations can’t. Specifically, 76% of infosec professionals surveyed indicate their organizations experienced phishing attacks in 2017. And the annual cost of detecting and remediating attacks is on the rise, averaging $11.7M in 2017. Why are phishing attacks still succeeding despite continued investment in security solutions? Email, web, and other traditional security technologies typically use signature- and behavior-based threat information derived from analyzing current cyberattacks to detect and block threats. Only after a cyberattack is launched and active, and early victims impacted, is threat data finally collected and analyzed, and information extracted that traditional security infrastructure needs to protect against the latest attack. And by that time, it’s too late.

Early detection of phishing campaigns

To improve the effectiveness of your security infrastructure, you must get ahead of phishing attacks. Your security infrastructure needs information about malicious phishing sites before their attacks go live. Proactively hunting for phishing sites as they’re set up, plus uncovering new campaigns before attacks launch enable data harvesting early in the attack lifecycle. That early threat data coupled with decisive actions provides the critical missing ingredient necessary to protect you from targeted phishing attacks.

HIgh-speed indexing helps uncover phishing sites

To make possible the early detection of phishing sites and infrastructure, Area 1 Security uses several automated systems that execute a variety of techniques, including high-speed phish indexing to discover new sites. Behind every phishing campaign, attackers typically set up infrastructure to host their credential harvesters to breach the front door; or exploit kits that install malware on target machines to breach the back door. Area 1 Security web crawlers proactively and continuously search the Internet to find new phishing infrastructure as it’s set up. They track usage of exploit kits, identify compromised sites, and discover exploit kit gates that serve malware. Browser emulation, simulating different endpoints, OSs, and browsers, uncovers compromised sites serving suspicious content, which is then preemptively sandboxed and analyzed to uncover hidden malware. These techniques provide early insight into new phishing infrastructure and campaigns, plus the early, accurate threat information that powers Area 1 Security’s Horizon™ anti-phishing service.

Area 1 Horizon service provides phishing protection

The Area 1 Horizon anti-phishing service inspects customer email and web traffic, as well as effectively detecting and blocking targeted phishing attacks that other security technologies miss. The service also integrates with select edge infrastructure, such as firewalls and web proxies, to identify and stop targeted phishing attacks, protecting all traffic, including email, web, and network for maximum security effectiveness. Adding Area 1 Security anti-phishing service to your security infrastructure reduces risk by closing the targeted phishing security gap that other technologies miss.

For more information about Area 1 Security detection techniques against targeted phishing attacks, including instant email link analysis, encrypted attachment analysis, and computer-vision imposter detection, watch the webinar “To Catch a Phish: Detection innovations.”

How Innovative Detection Techniques Prevent Phishing was originally published in The Azimuth on Medium, where people are continuing the conversation by highlighting and responding to this story.

Paul East |@Area1Security| Area 1 Security

Being a member of the engineering team at Area 1 Security is an adventure in tracking down the bad guys and eliminating the phishing threat for our customers. That mission means understanding attackers and finding the small, telltale patterns in big data and scaling systems. We have established the following principles: Limit the programming languages in use; test the code individually; as a team, employ a standardized deployment pipeline; and implement a standard set of monitoring and alerting systems.

Java is our primary language for backend micro services and systems. This is where our expertise and foundation have been laid. We use a combination of Python and React.js to deliver our web applications, as well as some purpose-built systems in C / C++. The small number of languages translates to a team familiar with a core set of languages, with the ability to provide meaningful code reviews to each other. Having a standard set of languages across the engineering organization reduces bottlenecks, improves feature velocity, and provides opportunities for engineers to work on different parts of the system. This also avoids the situation where systems are orphaned when the original author can no longer support them.

Three layers of testing are in use, in order to deliver high-quality software consistently. The most basic layer is unit testing, a fundamental engineering practice with proven results. The next layer is automated integration testing, supported by a test automation framework that’s purpose-built to achieve our objectives. These two layers are built into our continuous integration (CI) system, so no code change is merged without all tests passing. The final phase is user interface testing of things our automated testing does not cover. This is minimal, and our goal is to eliminate it with automation. Each of these layers is engineer-supported, with an expectation for delivering features and functionality to the systems.

Leveraging Chef (chef.io) for all instance deployments using a common set of recipes across our systems ensures consistent deployment, with all necessary pieces for user management, monitoring, and alerting (more on that later). Engineers can run local instances leveraging the same recipes that are used in production, which allows for like environments at all phases of development. This process enables all engineers to have a common understanding of how the code is deployed, and they can easily learn another system. We employ Docker in many instances and plan to transition to Kubernetes in the coming year.

Alerting and monitoring have to be done well, and we are very passionate in avoiding alert fatigue. If everybody is ignoring the alerts because they always occur, the really important issues will be missed. This means monitoring critical metrics and alerting on the really important ones. As part of the recipes we deploy, standard monitoring and alerting functionality is provided. Engineers can focus on the metrics they collect and the thresholds for alerts, rather than the mechanics of doing so. Because engineers are responsible for the support of the production systems, they have all the incentives to build high-quality software and to alert themselves when critical issues facing customers occur.

If this is the kind of engineering organization you want to join, grow, and learn with, while solving the toughest engineering problems, check out our openings https://jobs.lever.co/area1security or reach me at paul@area1security.com

Doing it Right: Solid Engineering to Take Down Phish was originally published in The Azimuth on Medium, where people are continuing the conversation by highlighting and responding to this story.

BEC Fraud; Unmasking the Fraudsters

Vivek Bhandari |@Area1Security| Area 1 Security

The worst type of fraud is one that betrays personal trust: that’s Business Email Compromise (BEC), a specific form of phishing; and it’s gaining ground as one of the most dangerous and costly cyber threats on the globe.

Recent studies, including the 2016 FBI report, put metrics to the spread of BEC:

• Losses of $5.3 billion to date through BEC fraud¹
• An increase of 2,370 percent in identified exposed losses since January 2015
• A BEC attack rate of over 80 percent — climbing towards 100 as it spreads to mid-size companies.

Even in this tech-savvy universe, a full 20 percent of targeted users actually fall for a BEC phishing attack, and then go on to do its bidding. Why do vetted users, entrusted with access to sensitive data or funds, keep falling for BEC?

The answer lies in the deviousness of phishing itself. Over 90 percent of BEC attacks begin with a phishing message — over email or social messaging. People are accustomed by now to the clumsy efforts to separate them from their money and personal data. They may be sure they can spot a scam. But that confidence, combined with trust of their own company’s brand and executives, actually sets them up for the biggest scams of all.

Phishing is not only the root cause of BEC — it is the core of the BEC strategy. Criminals may spend weeks or months studying an organization’s vendors and billing systems, the CEO’s email writing style, and even executives’ travel schedules, so they can mimic an executive credibly at just the right moment.

Exploiting human behavior and psychology

BEC phishing is effective because it relies on deeply ingrained social traits, such as eagerness to be helpful in a crisis, as well as the trust and goodwill people hold toward leaders in their organization.

So a BEC phishing email may present itself as a handshake, or, more pertinently, a hand reaching out for help. Messages often arrive when people are at their least vigilant; on a Friday, for example, or the day before a holiday. The hacker takes advantage of a moment when a person’s guard may be down, or they are in a hurry to leave the office. Playing on psychology, they are amazingly ingenious about which treacherous tricks to use.

Unlike customary scams, a BEC phishing email usually carries no attachments, malware, or payloads, and is “clean” of suspicious links or sites. This also inspires trust: after all, what danger could lurk in a simple email with no attachments or links?

Content is the key — to the bank account!

BEC message content is carefully crafted for just the right tone to reassure the target, lull any suspicions, and spur illegal action. The task might be presented as an urgent request by a traveling executive, for example.

BEC attacks leverage and manipulate trust in several ways:

• Domain spoof: An email seems to originate within the target user’s own company or partner domains that the company transacts business with.
• Name spoof: The swindler poses as a known, trusted, and powerful individual, such as the CEO or other similar executive. This not only grabs immediate attention, it commands priority. A name spoof combined with a job title spoof goes to the very front of the queue.
• Domain proximity: The company’s domain address might be registered or hosted on any number of providers, with just one or two letters slightly different. This seemingly minor detail is easily overlooked by a user intent on doing their executive’s bidding; for example, a name may be spelled “buslness.com” rather than “business.com” (note the upper case ‘l’ instead of ‘i’).
• Attributes spoof: The body or email headers are obfuscated, and can feature a copycat logo, logotype, brand name, or other recognizable identifier to win trust and make it appear safe for the target to take action.

BEC: a different sort of “animal”

Anti-spam solutions recognize and capture spam emails, swarming in like locusts. BEC phishing emails, however, are a different sort of “animal.” They are rare, low-volume, and targeted not to a mass audience, but to a single individual. Existing defenses like email gateways, web security solutions and firewalls have their use cases, but are ineffective with phishing attacks. A secure email gateway may do a fantastic job of filtering out 99 percent of spam, but with BEC, their defense tactics, such as collecting volume samples, don’t work. The damage is done the moment the BEC phish lands in an inbox.

Real-time reporting and alerting to catch phish

To defeat BEC fraud, the defense has to get ahead of the enemy. That means they need to detect and identify phishing emails on the hacker’s own doorstep, stopping them before they can land in the user’s inbox. The potential target is warned in real time by detection summaries and message forensics.

While phish are under construction, they are ideally vulnerable to detection and disablement. So Area 1 Security focuses on the earliest stages of phishing campaigns — finding, analyzing, and disabling phish across email, network, and web.

BEC may be today’s most notorious scam, but Area 1 Security’s innovative, preemptive approach shuts down phishing attacks before they reach the users, keeping funds and data secure.

But don’t take our word for it. Find out how it works. Watch the webinar or sign up for a complimentary demo and preview.

Sources:

1. FBI 2016 Internet Crime Report
2. The Security Ledger, September 28, 2017

BEC Fraud; Unmasking the Fraudsters was originally published in The Azimuth on Medium, where people are continuing the conversation by highlighting and responding to this story.

Phishing is the root cause of breaches worldwide

Vivek Bhandari |Area 1 Security | Area 1 Security

It’s an issue that organizations, large and small are struggling with. At the same time, there is an industry wide trend towards embracing the cloud for productivity tools and security services. Two such leaders in the space are Google and Microsoft. As organizations look towards migrating to the cloud for their core productivity use case, there is an opportunity to address the Phishing threat by transparently enabling Area 1’s Horizon service along with those cloud services. Area 1 Horizon looks for specific small patterns of phishing messages which evade volume based filters better suited to detect large scale spam or virus laden messages. You can learn more about how we do that here.

Spare a few minutes, stop Phishing

Activating a new security service doesn’t have to be the scariest word in cybersecurity. With Area 1 Security, activation is a snap; in fact, for most IT departments, the whole process takes less than 10 minutes. For one, we stay with you during the whole process. For another, there’s no hardware to deploy. All that’s required to configure your existing devices are a few keystrokes and mouse clicks.

For us at Area 1, the challenging part of our solution happens behind the scenes, where we take on phishing in all its malicious varieties. At the same time, we work to make it simple and intuitive to protect your organization effectively.

While we have the needed documentation on the “ins-and-outs” of activating the service, this blog post provides a quick overview of what is required to get our service up and running on your cloud email system.

Legacy secure email gateways are about as exciting today as flip phones, when compared to the advanced and robust email security now available. Cloud email platforms from Microsoft and Google provide an operationally efficient way to manage email. They also provide good security by filtering out spam and commodity threats. Now, by layering in advanced phishing protection from Area 1 the ‘upgrade to Smartphone’ experience is complete.

Area 1 with Microsoft Office 365

Office 365 configuration is quick and simple. You need to enable Area 1 specific connectors in Office 365 to allow the messages to flow back between Area 1 and Office 365.

The first of these is the inbound connector, which will handle the emails sent to your company and route them to Area 1. The second connector is a Partner connector, which allows Area 1 to send messages back to Office 365. Once the message has been inspected by Area 1, you can use the content filters in Office 365 to manage the dispositions, or you can use any of our native message modification options to mark up messages for your users.

Area 1 with Google G Suite

Gmail is one of the most popular email services in the world — and it’s also incredibly easy to enable Area 1 Security’s phishing protection.

The first step of the configuration is to add Area 1’s egress IP addresses to the inbound gateways configuration in the Gmail administration console. Since all inbound email connections will be originating from Area 1, this will inform Gmail to allow our IP addresses when they compute their verdicts.

Next, when you set up your email service, you were required to define an “MX record” in your DNS zone. As an existing Gmail user, the MX record for your email domain will be pointing at Google. In order to protect your inboxes from phishing messages, you’ll need to modify your MX records to point at Area 1’s service instead. This will allow all new inbound messages to be inspected by Area 1.

Area 1’s email protection service adds X-headers with verdicts for emails that trigger phishing detections. When configured with Gmail’s content filters, the Area 1 X-headers allows customers to take appropriate action on the emails — from quarantine, block or deliver.

We can, natively, append a label to the subject and add a message body prefix to bring further attention to the message; we can also defang URLs, making them unclickable by your users. You can choose to apply any or all of these options. Additionally, you can specify different behavior for each of the detection verdicts.

For maximum flexibility and control, use Gmail’s content filtering policies to deal with messages, such as quarantining malicious messages, and further marking up suspicious messages.

Once the messages are analyzed, we will deliver them to Gmail.

That’s it, you’re done!

Whether you’re using Gmail or Office 365, you can receive real-time reports and detections through our portal, email, and Slack. Our email protection service is quick and easy to activate and requires no software to be installed on your part.

At Area 1 Security, we stop phishing. In minutes. Period.

Area 1 Security Overview

Phishing is the root cause of breaches worldwide was originally published in The Azimuth on Medium, where people are continuing the conversation by highlighting and responding to this story.

Phishing is the root cause of breaches worldwide

Vivek Bhandari |Area 1 Security | Area 1 Security

It’s an issue that organizations, large and small are struggling with. At the same time, there is an industry wide trend towards embracing the cloud for productivity tools and security services. Two such leaders in the space are Google and Microsoft. As organizations look towards migrating to the cloud for their core productivity use case, there is an opportunity to address the Phishing threat by transparently enabling Area 1’s Horizon service along with those cloud services. Area 1 Horizon looks for specific small patterns of phishing messages which evade volume based filters better suited to detect large scale spam or virus laden messages. You can learn more about how we do that here.

Spare a few minutes, stop Phishing

Activating a new security service doesn’t have to be the scariest word in cybersecurity. With Area 1 Security, activation is a snap; in fact, for most IT departments, the whole process takes less than 10 minutes. For one, we stay with you during the whole process. For another, there’s no hardware to deploy. All that’s required to configure your existing devices are a few keystrokes and mouse clicks.

For us at Area 1, the challenging part of our solution happens behind the scenes, where we take on phishing in all its malicious varieties. At the same time, we work to make it simple and intuitive to protect your organization effectively.

While we have the needed documentation on the “ins-and-outs” of activating the service, this blog post provides a quick overview of what is required to get our service up and running on your cloud email system.

Legacy secure email gateways are about as exciting today as flip phones, when compared to the advanced and robust email security now available. Cloud email platforms from Microsoft and Google provide an operationally efficient way to manage email. They also provide good security by filtering out spam and commodity threats. Now, by layering in advanced phishing protection from Area 1 the ‘upgrade to Smartphone’ experience is complete.

Area 1 with Google G Suite

Gmail is one of the most popular email services in the world — and it’s also incredibly easy to enable Area 1 Security’s phishing protection.

The first step of the configuration is to add Area 1’s egress IP addresses to the inbound gateways configuration in the Gmail administration console. Since all inbound email connections will be originating from Area 1, this will inform Gmail to allow our IP addresses when they compute their verdicts.

Next, when you set up your email service, you were required to define an “MX record” in your DNS zone. As an existing Gmail user, the MX record for your email domain will be pointing at Google. In order to protect your inboxes from phishing messages, you’ll need to modify your MX records to point at Area 1’s service instead. This will allow all new inbound messages to be inspected by Area 1.

Area 1’s email protection service adds X-headers with verdicts for emails that trigger phishing detections. When configured with Gmail’s content filters, the Area 1 X-headers allows customers to take appropriate action on the emails — from quarantine, block or deliver.

We can, natively, append a label to the subject and add a message body prefix to bring further attention to the message; we can also defang URLs, making them unclickable by your users. You can choose to apply any or all of these options. Additionally, you can specify different behavior for each of the detection verdicts.

For maximum flexibility and control, use Gmail’s content filtering policies to deal with messages, such as quarantining malicious messages, and further marking up suspicious messages.

Once the messages are analyzed, we will deliver them to Gmail.

That’s it, you’re done!

Area 1 with Microsoft Office 365

Office 365 configuration is also quick and simple. You need to enable Area 1 specific connectors in Office 365 to allow the messages to flow back between Area 1 and Office 365.

The first of these is the inbound connector, which will handle the emails sent to your company and route them to Area 1. The second connector is a Partner connector, which allows Area 1 to send messages back to Office 365. Once the message has been inspected by Area 1, you can use the content filters in Office 365 to manage the dispositions, or you can use any of our native message modification options to mark up messages for your users.

Whether you’re using Gmail or Office 365, you can receive real-time reports and detections through our portal, email, and Slack. Our email protection service is quick and easy to activate and requires no software to be installed on your part.

At Area 1 Security, we stop phishing. In minutes. Period.

https://email-protection.area1security.com/