Google recently chose to use abc.xyz as its registered domain name for its new holding company, ‘Alphabet’. Apparently it did so due to the limited choice of traditional domain names, with abc.netand abc.com already off limits, with one registered by the eponymous American broadcaster, the other by a domain registrar looking to make a tidy return on an early registration.

For over a decade, we survived with just a dozen gTLDs (global top level domain names) e.g. .com / .net / .org. Then in mid-2012, ICANN proposed an initial list of 1930 new gTLDs that it planned to create. A number were dropped along the way, but to date over 700 new and occasionally wacky gTLDs have been born, including .pizza, .porn and .sucks to name but a choice few.

ICANN’s rationale behind the new tack was that it needed to offer companies increased flexibility and control over their online presence to align with their corporate image. Whilst there seems to be endless content and no boundaries to the Internet, it is fair to say that companies have started to face problems with the availability of both IPv4 address space and catchy ‘dot coms’.

However, whilst the use of the abc.xyz domain drew positive reviews from the marketing fraternity, and had some IT news hacks predicting the end of traditional domain suffices, it also provoked consternation from IT security professionals. Since the birth of these new gTLDs, a pattern has emerged of abusive domain name registration and email phishing / spam attacks from gTLDs such as .xyz, and .link, this is due in part to their lower registration cost and readily disposable nature compared to traditional domains.

According to the APWG report for H2 2014, in the six months to December 2014, a fifth of all new gTLD domains were used for phishing. However, of those, two-thirds were in the .xyz domain space, where significantly, 82% of all domains registered were used for malicious traffic. This trend has continued in 2015 with service providers reporting increasing levels of spam and phishing attacks* sourced from .xyz domains.

In the battle to protect clients on our platform, the security team at Options reviewed our mail relay platform statistics and decided it was a straightforward choice to blacklist inbound email from .xyz domains.

Google’s decision to operate in this space may trigger the need to whitelist specific domains, but will we reverse our decision? Unlikely.

John Bryant, Options CTO

*For those interested, we recently covered phishing and the increasingly problematic spear phishing in greater detail here.

For more posts from the Options security team, scroll down and follow the Options on Cybersecurity collection.

Options on LinkedIn and Twitter.

The term phishing is well known in most security-conscious businesses and users have generally become more discerning of clumsily-formatted mails notifying them that the Amazon order they didn’t place is awaiting collection. What they might not question however, is a brief one-line email, seemingly from their boss or trusted colleague, asking them to review an attached document or link.

Spear phishing is the cybercriminals’ answer to our growing caution. It is more sophisticated and targeted in its nature. In keeping with the metaphor; if phishing is an approach of casting a line and seeing what bites, spear phishing is putting all your effort into catching that one prize fish. Generally, the approach involves an attacker researching a target on a public platform (LinkedIn, company website etc.) and gleaning any available information on their role, business function and position within a company’s organizational structure. One common approach is to select a victim and pose as an authoritative or trusted colleague, sometimes ‘spoofing’ their account or mimicking their email address with a similarly named domain (i.e [at] options-it.com might become [at] optiions-it.com). From this point, they might be blatant enough to immediately request a transfer of funds to an offshore account somewhere, but typically there is a longer and more complex strategy in play.

According to enterprise security experts Trend Micro, spear phishing is the cyber criminal’s preferred attack vector for initiating advanced persistent threats — a class of network attack which focuses on a well-planned and well-executed breach over a prolonged duration where the key objective is data theft. This 2014 phishing and spam report also offers some fascinating insights. Such attacks are not ‘snatch-and-grab’ robberies of a liquor store; they are a more coordinated and methodical Ocean’s Eleven-style heist.

While spear-phishing itself often stays out of the mainstream news, its fallout does not. The 2011 RSA security breach began with a spear phishing email sent to a number of handpicked individuals. The payload delivered was malware posing as an RSA 2011 recruitment plan spreadsheet which in turn, gave the attackers a backdoor into RSA’s network. The December 2013 Target breach, which affected an estimated 70 million customers, was also initiated with a spear phishing mail sent to a HVAC vendor of Targets that had access to Target’s network.

So what are Options doing about spear phishing?

• In the last 3 months, Options has partnered with a leading cybersecurity solutions provider to augment our increasingly security-aware platform. Among other related initiatives, we have successfully replaced our platform mail gateways allowing us more and more features to assist us in policing the mail entering (and exiting) our network. One of the many features involves a more robust means of analyzing file attachments and embedded links within email.
• With the formation of Options’ dedicated security team at the start of this year, we became more proactive in optimizing our platform security posture. For example, a recent review of incoming mail by top-level domain showed certain domains were being used almost exclusively for spam (.xyz, .link, .porn, etc). With stricter controls at this high level, it reduces the amount of malicious mail entering the platform.
• At Options, we recognize that technology is only a part of a security initiative — awareness is another important tool. We’ve been working with our clients to encourage security awareness throughout their own user base. One tool we’ve suggested to clients is PhishMe. PhishMe allows administrators to send innocuous and specifically tailored pseudo-phishing mails to their user base. The tool then provides full visibility into who opens it, who responds to it and who forwards it. From the deployments I’ve been involved with, this type of initiative has been very well received in both investor due diligence and regulatory cybersecurity questionnaires.

What can your firm do about this?

• One advantage you have over the attacker is your familiarity of your colleagues’ mannerisms. Does your boss stick to informal one-liners? Is there a colleague that consistently writes ‘thx’ instead of ‘thanks’ and signs off with his initials only? Would you notice if they didn’t? Learn to take note of your colleagues’ style and mannerisms.
• Ensure people in your company are prepared to question something they find suspicious. If you work in accounting and get a mail asking for an urgent transfer to an unrecognized party, take 30 seconds to pick up the phone and verify.
• Remember the HVAC company that opened the backdoor for attacker into Target’s network? Do your due diligence on all third-parties you associate with regularly, especially those you let on your network.
• Ensure your IT provider is dedicated to constantly improving security. Not only in terms of technology, solutions and appliances, but in procedure and awareness also.
• Finally, firms should follow the phishing mitigation alerts and recommendations from US-CERT (US Computer Emergency Readiness Team). Here’s a recent alert on email phishing.

For more information on Options cybersecurity offering visit here, or to read what our CTO, John Bryant, had to say in a recent cybersecurity Q&A with HFMWeek visit here.

Thanks,

Ben Boyle — Technical Account Manager, Options

For more posts from the Options security team, scroll down and follow the Options on Cybersecurity collection.

Options on LinkedIn and Twitter.

During my time at university in the 90s, the Internet and its use in academia was something of a novelty, if not a luxury. GUI “PCs” with 256mb hard drives, 3.5” floppies together with the formative applications were considered the latest thing. Few students were required to use computers as part of their studies. Indeed, the university library may well have considered itself groundbreaking to have digitised its book database. IT barely registered in most people’s day-to-day lives.

Roll forward a few years, upon entering the world of business, Internet connected IT infrastructure was still in its infancy. Desktop PCs ran Windows 95, staff had access to email to communicate with other staff, but not all had external email addresses. Psion handheld organisers were the domain of the tech-savvy executive. Operating systems, right through to Windows NT4.0, were still built by painstakingly loading a dozen floppy disks in sequence, praying that none would suffer terminal read failure.

The Internet was only just becoming a business enabler. Firewalls were a thing of the future and proxy servers were simply there to cache Internet traffic so as to reduce the contention on dial-up or ISDN Internet bandwidth. Security vulnerabilities came in the form of email attachments with the potential to corrupt a Microsoft Office document, and consequently desktop virus scanners were equally primitive. As long as you had a backup of the data, viruses threatened little downtime or corporate risk.

I would assert that little changed for another 10–15 years — the fundamental recipe for security success was to routinely scan for viruses, restrict unwanted inbound access at your network perimeter, deploy web facing servers in sandboxed DMZ as well as patching Windows desktop and server security vulnerabilities. Other operating systems were largely left untouched by hackers and IT departments alike, notably Novell NetWare servers whose owners actively bragged about their server uptime stats.

Today, in this hyper-connected era, we all have 4g Internet-enabled mobile phones and tablets, and want immediate access to both consumer and business IT platforms at the click of a button. Schools insist kids carry an iPad to class (other tablet brands are available!) and do all their homework online. Overnight ferry journeys, transatlantic flights, underground tube travel — none of these threaten to break our ever-present connection to the web.

Unfortunately, whilst the development of web accessible content has progressed at a giddy rate, it has come at a price. We have witnessed an explosion in the number, variety, approach and ferocity of security vulnerabilities over the last few years. If we consider the latest security vulnerabilities (Poodle, Heartbleed, Beast et al), within days or hours of the security exploit being acknowledged by the affected vendor(s), the first exploits have been published online and attacks launched in the wild. Indeed, Poodle and Beast triggered the need for an overnight rework of web server security, PC browsers, mobile apps, IT systems and corporate network security having rendered SSL extinct.

My late grandfather once said, ‘every acquisition is a liability’. We must recognise that every IT device connected to the Internet presents its own security liability. Whilst we as an IT service provider continue to invest heavily in security infrastructure, training, tools and people, security has become one of most significant overheads. In order to keep a lid on the threat, we have put together an extensive security programme including twice weekly security board meetings, quarterly penetration tests carried out by accredited third parties, weekly PC reboots, Nessus vulnerability scans, a new 10-point action plan to baseline each client’s security posture, timely reviews of all newly published threats and ongoing communication to clients as to the counter-measures required.

Given the effort involved and with the stakes so high, how long can the average business expect their internal IT department to weather the storm? If they do, it won’t be without huge investment, and if they don’t, and decide to outsource the risk, they’ll need to choose their managed service provider wisely.

Thanks,

John Bryant — CTO, Options

To download Options’ most recent cybersecurity whitepaper click here.

For more posts from the Options security team, scroll down and follow the Options On Cybersecurity collection.

Options on LinkedIn and Twitter.