Software Development

How cyber criminals have latched on to online business tools

Phishing and Business Email Compromise attacks were some of the most prevalent cyber crimes of the last year. "Criminals are adept at combining legitimate web services with subtle social engineering techniques that are more likely to slip by email defenses," writes Lior Kohavi, chief strategy officer & EVP of Advanced Solutions at McLean, Virginia-based Cyren.

Expand your cybersecurity vocabulary. (Information security concept by Ensuper via Shutterstock)

Email has been the favorite tool of threat actors since the dawn of cybercrime. Cheap, accessible, and easy to use, email provides instant access to the inbox of millions of potential victims. The latest IC3 report from the FBI found phishing, along with variants like smishing and vishing, to be easily the most common type of cyber attack in 2020. More sophisticated, targeted Business Email Compromise (BEC) attacks were found to be the costliest, with reported incidents costing $1,866,642,107 globally over the last year.

Most phishing attacks use the same set of simple tricks that have been successfully deceiving consumers and workers for years, such as spoofing techniques that mask the sender address to appear as a trusted contact, and phishing sites disguised as genuine login portals. However, fraudsters have been able to increase both the volume and sophistication of their attacks in recent years thanks to the same cloud-based digital tools that have been supporting legitimate business.

Parasites on the digital boom

Even before the events of 2020 made a web presence mandatory for staying operational, digitalization has been increasingly essential for staying relevant and competitive. Advancing technology means that even the smallest firms can create functional and attractive websites with services like Wix and Weebly. Registering and designing a site can be achieved in a matter of hours.

Unfortunately, the same goes for cyber criminals. Website builders have proven to be ideal for crafting fake versions of real trusted websites, which can be used as part of phishing emails to harvest credentials. Domains like wix.com are also widely recognized, with a high level of traffic and engagement. This means most email security solutions will be unlikely to recognize links to these sites as threats.

How legitimate web services are exploited

In one example we came across, the criminal used Wix to create a fake Microsoft Outlook login page, and then sent out phishing emails warning the targets that they needed to authenticate their account to access emails that were waiting for them. The aim is that busy workers won’t stop to scrutinize the inconsistencies about this message and will quickly click the link and enter their details – neatly handing them over to the attacker.

Website builders have proven to be ideal for crafting fake versions of real trusted websites, which can be used as part of phishing emails to harvest credentials.

Other common approaches include using the website builder to simulate file sharing services like SharePoint and Google Docs, again with an urgent message about a waiting file to bait the target into clicking.

Criminals may also exploit vulnerabilities to hijack existing sites. WordPress, for example, recently suffered from an issue in the third party ProfilePress plugin which allowed threat actors to escalate their privileges and achieve administrator access. With that level of access to a system, an attacker could enact any number of malicious activities, such as redirecting visitors away to a duplicate phishing site or triggering malware downloads. Compromised sites are very effective when used in conjunction with email attacks as the link will appear legitimate to both automated defenses and human users.

Can raising user awareness combat the threat?

Criminals are adept at combining legitimate web services with subtle social engineering techniques that are more likely to slip by email defenses. This means businesses need to be prepared for the fact that malicious emails will certainly be reaching the inbox of their workforce. As such, it is important to prepare employees for these threats. One of the most common approaches is to use Security Awareness Training (SAT), which focuses on improving user knowledge. The aim is to educate staff about common attack tactics such as sender name changes, and the social engineering tricks used in dangerous BEC attacks. These sessions are commonly combined with phishing tests that send simulated malicious emails to staff to test awareness and response levels.

However, while increased user awareness is a good thing, SAT is not a solution by itself. It’s common to find training is provided in an infrequent, ad-hoc manner, which makes it unlikely the knowledge will sink in and influence daily habits. Similarly, phishing tests tend to only provide a point-in-time check that contributes little to improving ongoing defenses. There is also a tendency for SAT to be implemented in a way that frames the workforce as the problem, not the victims. Unless employees are properly engaged, they will be bored at best and insulted at worst.

So how can organizations get their workforces onboard for the fight against phishing?

Engaging personnel with crowdsourcing

With the right tools, workers can become an active and effective part of the company’s defenses against email threats. This means ensuring that all individuals have the capability to scan their own inboxes for threats whenever they need to. Rather than wasting time squinting at a potentially suspicious message while thinking back on some half-remembered training, they can quickly verify their concerns with the click of a button. Emails that contain traits consistent with a malicious message can be immediately forwarded to the IT security team for full investigation.

While increased user awareness is a good thing, Security Awareness Training is not a solution by itself.

The workforce is thus transformed from being a potential weak point blamed for email breaches, to an effective resource for threat data. This crowdsourcing approach makes employees feel like a part of the solution, not the problem. Reported emails can also be used to identify other attacks targeting the company, and the data helps to train machine learning tools to better spot the latest tactics and tools being used by attackers.

As web tools become even more accessible and easy to use, cyber criminals will continue to exploit them for deceptive email attacks. Making employees a part of a crowdsourced approach to email threat detection and analysis will establish a new line of defense that can help to keep pace with these rapidly evolving attacks.

This is a guest post by Lior Kohavi, chief strategy officer and EVP of advanced solutions at McLean, Virginia-based cybersecurity company Cyren.

Before you go...

Please consider supporting Technical.ly to keep our independent journalism strong. Unlike most business-focused media outlets, we don’t have a paywall. Instead, we count on your personal and organizational support.

3 ways to support our work:
  • Contribute to the Journalism Fund. Charitable giving ensures our information remains free and accessible for residents to discover workforce programs and entrepreneurship pathways. This includes philanthropic grants and individual tax-deductible donations from readers like you.
  • Use our Preferred Partners. Our directory of vetted providers offers high-quality recommendations for services our readers need, and each referral supports our journalism.
  • Use our services. If you need entrepreneurs and tech leaders to buy your services, are seeking technologists to hire or want more professionals to know about your ecosystem, Technical.ly has the biggest and most engaged audience in the mid-Atlantic. We help companies tell their stories and answer big questions to meet and serve our community.
The journalism fund Preferred partners Our services
Engagement

Join our growing Slack community

Join 5,000 tech professionals and entrepreneurs in our community Slack today!

Trending

The person charged in the UnitedHealthcare CEO shooting had a ton of tech connections

From rejection to innovation: How I built a tool to beat AI hiring algorithms at their own game

Where are the country’s most vibrant tech and startup communities?

The looming TikTok ban doesn’t strike financial fear into the hearts of creators — it’s community they’re worried about

Technically Media