Business Email Compromise (BEC) attacks strike at the intersection between people and technology, leveraging social engineering tactics rather than technical exploits. By taking advantage of people’s trust and lack of understanding in technology they are able to exploit businesses. Organisations may think their emails are secure, but this new threat uses weaknesses in psychology to undermine their efforts. By their nature, BEC attacks have no payloads, malicious attachments or URLs, that can be detected and blocked, which allows them to evade most existing security technology. Organisations are left vulnerable to attacks and their existing defences rendered useless.
Email is more than ever a challenging entry point to protect as cyber attackers are developing new techniques to evade defences. In recent times organisations have deployed secure email gateways and security training to fight email-born attacks. However, highly focused BEC attacks bypass this security by convincing even secure email gateways that they are from a trusted source. The sending IPs are not on any blacklist and only a few emails will be sent so they don’t trigger alarms like bigger phishing scams might.
Understanding how email gateways work can help organisations grasp how they are unsuccessful at stopping BEC attacks. Email gateways are in simple terms products used to prevent emails with malicious intent from reaching their destination. The gateways can quarantine or block emails that contain specific content. Email gateways are effective at stopping phishing emails, spam and other content which contains malicious URLs. These URLs are either blacklisted or correspond to fraudulent web pages. Similarly, emails with malware can be stopped as gateways pick up attachments or links to malicious content. Malicious content is based on matching a signature or exhibiting unwanted behaviour. The gateways stop many email attacks from reaching their intended recipients and have been extremely effective at their job.
However, BEC attacks often contain none of the malicious content consistent with email blasts with malware. As such, BEC attacks can’t be detected in the normal way by email gateways. Security technologies typically detect BEC attacks because they come from untrusted sources while looking like they come from trusted sources. Warning signs are increasingly undetectable, and attackers are upping their game to ensure they remain as such.
Although some attacks will use malware and therefore might be detected many rely almost entirely on social engineering. They are rarely interrupted by antivirus, spam filters or mailing list permissions. And, what’s more, hackers are persistent. They will continue to contact people within an organisation until they hit a point of weakness. They are also constantly changing their tactics. As we’ve already touched on, they might ask for wire transfers, employee information or intellectual property information. They also choose their targets wisely with a shift away from CEOs to more junior staff making the chances of detection even less likely.
Although Email Gateway vendors have made great strides in attempting to solve this problem, a multi-layered approach to securing the email ecosystem is required for organisations to fully protect themselves. In our next installment of our BEC blog series we will be discussing the emerging technologies that are being developed to fight these types of attacks.
If you would like to find out how Infotrust can help your organisation solve this problem contact us here.
See our previous post here, which explains the techniques attackers use to execute these BEC attacks.
