Hey humans.
My name's Aaron Rosenmund,
and welcome to this course on Pluralsight about Business Email Compromise.
I'm here with Tyler Hudak to talk about what you can do about it,
how you can prevent it, and if you do find it,
what we do to respond to it.
Hey, Tyler,
do you want to talk about your experience with this a little bit
and really we can start to dive into what it is?
‑Absolutely, and thank you for having me on so we can talk about this.
Business email compromises are a huge issue right now,
and so getting the information out there about how you can find them and
what you do when you do find them is really important.
So,
there are a lot of different variations of different
types of business email compromises.
Everybody has seen some aspect of this.
These are the emails that you get supposedly from your CEO asking
you to buy a whole bunch of iTunes gift cards,
or the emails asking you to transfer money into a bank account.
But the attackers have kind of graduated from trying to hit
home users to where the real money is, and that's on the corporate side.
‑So,
how does this really differentiate from ‑‑‑ and I know we're
not talking about malware here specifically,
but it might as well be,
it's the same tactics of stealing information or being able to steal money.
The end result ends up being the same.
But, how do we differentiate from, say,
the prince from some obscure country wanting to give you money in your
Gmail and this event that we're trying to talk about,
what's the real difference there?
‑So, there are a couple of differences.
First off, when you're talking about kind of the Nigerian 409 type scams,
those are typically focused on one person.
With a business email compromise,
especially the variation that we're going to talk about that
corporations are most often going to see,
there are really two victims in this attack.
There's the company that gets compromised there.
We'll talk about how their email gets compromised and how
there could be information lost through that.
But there's also the victims who send money to the attackers,
and because of those two victims that are in there,
it makes this a little bit of a more unique attack.
‑Okay, so maybe even a little bit more advanced too,
like this is probably over a longer period of time
that these people are doing research,
these criminal organizations are doing research on an organization
and maybe there's some dwell time to it too.
‑Absolutely, absolutely,
And I think that's a great way to start talking about there are a
number of different types of phases that the attacker goes
through in a business email compromise.
‑You shared a nifty slide with me.
Why don't I bring that up and we can chat through it.
Okay, so here's the slide you shared with me.
This is probably a pretty common slide when we talk about phases,
but really just kind of a useful device for us to walk through,
one, how this is kind of a more complex attack than,
like we said, the Nigerian prince attack,
but also how there's different points, just like any attack chain,
and that's, again,
I'm a big let's move away from the attack chain to
more of MITRE ATT&CK technique stuff,
but mainly because there's so many different types of attack chain.
And when we talked about this before,
I realized this is kind of a pretty different attack chain as well.
So, this is a good way to look at that, and maybe where there's some points,
we can point out later when we get into detections that here's the
points where we can detect different things.
So, walk me through these phases real quick, please.
‑Yeah, exactly.
So the attackers are going to go through
essentially about four different phases.
Like most attacks, like most cybersecurity attacks,
the first thing they're going to do is recon on the company.
They're going to look at the target.
So, let's say you are part of an organization.
They are going to do analysis on you,
they're going to do analysis on the organization,
and, most importantly, they're going to try to figure out who's paying the bills,
who's sending out the invoices,
and things like that because those are the people that they want to target.
‑I see.
So they're actually going to gain compromise first,
and then after that's targeted,
do some research to identify are you a company that sends money,
how do you do it, what do your templates look like,
who can I spoof that's going to be able to get the authorization to do so?
‑Right.
They want to figure out all that information beforehand
because they're going to target those people to try to get
access to their email accounts.
That's their first goal.
That that moves us into the second phase,
which is the attacker gaining a foothold into the organization.
And the way they typically do that with business email compromises is they will
send phishing emails to the individuals within that company,
and normally these phishing emails will contain a link out to a
website that looks like an Office 365 login page.
Most business email compromises that I've investigated involve Office 365,
so we're going to really focus on that, but the thing to make clear,
though, is it's not an Office 365 problem,
it's an everyone problem.
If you have your email system with Gmail,
if you have it on‑premises through Exchange or
Lotus Notes or anything like that, you could still be subject to this attack.
‑Yeah, absolutely.
And Office 365 is fairly ubiquitous.
I mean, that makes a lot of sense.
And like we talked about, we set up an environment based on Office 365.
And again, don't get your hopes up, everybody,
it's really just super basic to use as an example,
but it seemed pretty effective.
That being said, what we're talking about in this phase is really just phishing.
Like this is common phishing to begin this phase.
It's something we all know really well, but it's really just the beginning.
So,
we're suddenly attacked and we think maybe business email
compromise could have a connotation of, oh,
not to bring it up one more time,
but that prince from obscure location want to give you money,
that's nearly the beginning and end of the attack.
You either send them the wire transfer through some conversation,
or don't, whereas this is really just the beginning of this attack here.
‑Correct.
Yeah, with this attack, once they send the phishing email,
that's the beginning of the attack.
They're not even close to being done.
And the thing to keep in mind, too,
is that the phishing attacks with the links in the email to the phishing
sites that they're trying to get people to click on,
those phishing sites, they are putting time and effort into this.
They look exactly like the Office 365 logon pages,
plus, attackers are getting smart.
They're not just throwing a web server on some IP
address somewhere on the internet,
they're going to do something like registering a web page on SharePoint.com,
Microsoft's public SharePoint.com that anybody can go and get a web page on,
they're going to throw it on there,
and the reason they're doing that is because that makes it look more
legitimate and a lot of web filters will only look at the domain,
SharePoint.com, and think, oh, well, it's Microsoft,
it's valid, I'm going to let that through.
‑Yeah, you know, when you bring that up,
it actually makes me think of a response I did earlier
this year to a LinkedIn compromise,
and they sent out a link that went to a OneDrive that had a
PDF of I'm sharing like a folder with you,
and when you clicked that, it went to a pre‑compromised legitimate server,
like in Germany or something, but it was a legitimate website that,
you know,
a WordPress plugin that was probably out of date and got compromised
and they were hosting an Office 365 portal there.
I didn't connect that this may be what the next steps were after
that because it was extremely targeted through the CEO of a
company from on the LinkedIn DMs as well,
and it was from the initial compromise for that,
but I can see now that this may have been kind of the,
that may have been like the lead‑in to the next steps being we're
now going to fall through the rest of this chain.
‑Yeah, absolutely.
And again, the attackers and business email compromisers,
they're being smart about all of this.
They're focusing, they're doing targeted phishing attacks,
it's not going to be a widespread phishing attack to everybody in the
company because they don't want everybody in the company.
Somebody who works in IT or who works in human resources
is not going to have the information that they need in
order to move to the next phase.
Now, the one thing I do want to bring up too is,
you know, a lot of people will think, well,
I've turned on multi‑factor authentication in Office 365,
I don't need to worry about that.
That's not entirely true.
The attackers, again, are smart.
They figured out ways to get around multi‑factor authentication.
One of the ways that they do that is on this phishing site,
they will have the users log in or pretend to log in,
and so they get the user's credentials,
but they will also load a malicious app into Office 365,
and basically by going to the website, the phishing site,
the user is prompted with a request to allow this
application full access to their email, essentially.
And I believe we're going to talk about this a
little bit more in depth later on, but if they do that,
if the attacker is able to get the victim to allow that access
into their email account through that app,
then the attacker doesn't need to bypass MFA or credentials.
They are already in the system.
It's like they have a back door within Office 365 in that user's account.
‑Yeah, that's really interesting, and it sparks some other questions,
but I want to save them for later when we get into it a little bit further,
but I'll take some notes on that now.
But, so either way, it doesn't matter whether you have MFA,
or I don't want to say it doesn't matter,
but like obviously that helps, but there's also ways around that,
it's not foolproof.
‑Exactly.
We'll talk about defense in depth, what you need to look at as you move forward.
So, the attacker, they've done their research,
they've sent out the phishing email, now they've got in.
Let's presume that they got into the right person's email account.
‑Sure, phishing always work, so they definitely got somebody's email.
‑Exactly.
So once they get in there, they're going to go through this analysis phase,
essentially, and they're going to start looking through the emails,
they're going to be looking through that victim's contacts and looking
for anything that is related to statements of work,
billing requests, invoices, who they're sending them to,
when they send them, what their signatures look like,
they're gathering all of this information because what they're
going to do is they are going to take that and they're going to
basically modify just the small pieces that they need in order
to move to the next phase,
which is sending the emails out to the victim
companies to try to get them to pay.
Now, we always need to talk about dwell time,
how long are the attackers doing this or are they constantly
logging in to the email system in order to do this,
and that's not always the case.
We'll show some examples of where that does happen,
but attackers,
so they don't have to sit in somebody's email inbox the
entire time or constantly download emails,
they'll do something like they'll put an inbox forwarding rule in place so
that if an email comes in that has specific keywords,
like wire or invoice or bill or something like that,
it gets forwarded out to an external email address.
So all they have to do is wait for those emails to come in,
and then they can start their attack going.
‑I see.
So this doesn't have to be an active log on over a period of a month and they
keep logging in as that user over and over trying to check the user's emails
the same way they would check their own emails.
Instead,
they can set up the forwarders and kind of allow the recon to come to them,
so to speak.
Really, when we're looking at a normal kind of malware attack chain,
this is all post‑exploitation.
So, phishing attempt, they logged into Office 365,
we're now post‑exploitation,
but not in the sense that they're like on your box or on‑premises
somewhere or have access to your back end of Azure instead,
which they might with that login, but not necessarily.
It may just be a standard permissioned Office 365 environment.
Instead, they're now post‑exploitation inside your,
I guess perimeter of emails and documents,
which is interesting.
‑Exactly.
And like I said, what they're doing is they're gathering more information.
They want to see how you send out your invoices because what they're
going to do when they move into the next phase,
which is the actual attack, I guess,
or the final phase of the attack to be more specific,
they are going to take those documents that you send out,
they're going to modify them,
they're going to put their own account numbers in there,
and then they're going to create, typically they create a typosquatted domain.
So, for example, so let's say Pluralsight.com as an example.
If a business email compromise happened against Pluralsight.com,
which it hasn't, but we're just using that as an example, they might create a
domain that's Pluralsght.com instead of Pluralsight.com.
And they'll actually do this about a month ahead of time, so
this kind of tells you how long it takes them to kind of
prepare for something like this.
They will create this typosquatted domain,
and then they will start sending emails to the victims that they've gathered,
your clients, through this this fake domain asking for the victims to change
the account numbers for the payments and, oh,
hey, you have a payment due, and so on. ‑I see, yeah,
and there's that times a million different things you could do
for like a subscription model and be like,
oh,
your subscription has changed, your card is bad or
something, you need to change it to this.
I mean, yeah, that's really kind of prolific.
And I was going to say, if you changed that in Pluralsight, like I
type it that way half the time and don't notice,
I certainly wouldn't notice it 100% of the time being sent to me. ‑Right.
But, the thing to remember here, we're just using Pluralsight as an example.
Imagine if this is a financial company that's being targeted and they do
financial transactions in the millions of dollars.
Imagine what an attacker can do by sending an email out to one
of their clients or partners and saying,
hey, this bill is due or this bill is past due, please remit payment.
Our banking information has changed as per the attached document.
And when they open the attached document,
it looks exactly like every other document that they've been sent
because the attackers have taken that, they have modified it just to
include their own baking account number,
and, surprisingly, this works more often than you would think.
It really surprises me how many times a company will transmit
millions of dollars, or potentially up to millions of dollars, just
because they received an email which says,
hey, please change the banking account number.
There's no verification done, or if there is verification
done, or supposed to be done, it's not.
But we will absolutely get into talking about how you can
prevent these types of attacks later on.
‑So we're talking about financial institutions that make
transactions, you said billions of dollars, millions, I mean,
billions may be a little excessive, but millions of dollars at least,
right?
Billions, right.
But that would be the jackpot. I'd have to change careers
for that if that was a common thing.
If you're about to tell me that you can make
billions of dollars in like an email, I don't want to say it out loud,
but I might be making some changes to my retirement plan.
‑No, I totally get where you're going with this,
and it's really surprising how effective this is.
In 2019,
the FBI came out with some stats that business email compromises
accounted for more than $1.7 billion in losses.
So, you can just imagine how effective this is if it's
raking in that much money over a single year.
‑That's collectively, right? That's like all these
organizations over time, over this year maybe, or is that
is that multiple years you think?
‑I think that's over one year. I could be wrong, but you have to understand,
too,
that that's not just a company has lost $1.7 billion from business email
compromises, it's everything that goes into the incident.
So remember that, you know, it's not just the money you're losing.
When that happens,
you need to do the incident response, you need to do the
protections, you probably need to upgrade your systems,
implement MFA, all these different things,
and that adds to your loss as well.
You know,
the attackers may have gotten $100,000, but it's going to
cost you another $100,000 or $200,000 to remediate everything
and get all the answers you need.
And that's before there may be regulatory penalties that could be applied.
‑Right. So, let me let me back up one second.
So they got in through phishing, they have access to all the
emails and/or OneDrive and documents, or anything really
connected to Office 365 enterprise account,
right, and once they have that, they're now able to hang around for a while,
maybe send some information to themselves that matches the word invoice for
this kind of stuff, but I guess maybe it's my ignorance, like we're talking
about an invoice kind of version of paper document like obviously it's not
mailed in the snail mail anymore, but it's emailed over to someone,
and then they're sending this money.
Just, no questions asked to a bank account.
Is that something that really happens? I feel like I'm having
a hard time wrapping my mind about like,
hey,
you owe me $1.7 million, if you would just kindly send this to this bank account
that's never the bank account that you normally send it to.
And they're like, yeah, sure. ‑Yeah,
it boggles my mind every time I work one of these investigations. And, yes,
that is exactly what happens.
Sometimes companies do have verification procedures, and definitely if
you look back a year ago to what's going on now,
people are a lot smarter about this attack, but it still happened,
and it all comes down to somebody receives an email that says please
pay this invoice, here is a new account number,
and they just go and do it. Now, you know,
sometimes the attackers, they will switch it up a little bit.
It may look like it comes from that person's CEO or CFO, and they always
put that sense of urgency into the request as well,
to kind of get people to think, oh,
I need to do this right now or I'm going to get in trouble. And that,
I'm sure, kind of adds into it as well because,
you know, people just want to do their jobs.
They want to get things done.
And, the attackers are kind of playing off of that.
‑Yeah, so those are common social engineering tactics,
and not just here,
but kind of across anywhere that that's part of your phase of attack.
That makes sense.
‑Yeah, absolutely.
‑I'm curious.
So it seems like this is plenty profitable for the
organizations that are doing it,
but they make money off of having people send them stuff, but they also have
access to all of the company's information at this point,
right?
So are we seeing organizations stealing information
and reselling that or releasing it,
or maybe a ransomware like a cloud version of a ransomware attack? ‑Not yet.
I'm sure some of that does happen, but it's pretty rare at this point.
The attackers they want to get in there and they want this to go undetected for
as long as possible because the longer it goes undetected,
the less likely the victims are going to be able to recoup that
money or reverse those transactions. And so the attackers want
to stay as silent as possible,
which is typically why they get in, they put those inbox forwarding rules,
and then they don't access the inbox again,
and there's a pretty quick turnaround.
I can tell you that in some of the investigations that I've worked,
they will do the recon for a couple weeks because we see those typosquatted
domains registered weeks before the attack, and then they send the phishing
emails and we have actually been able to tie the phishing emails, or when
somebody enters in their credentials to the phishing emails, that once they
do that, I've seen cases where the attacker logs in less than 4 seconds
after that, grabs the email, and then starts doing their thing.
And then usually within a day or two, they're sending out those payment emails.
So it's a very quick turnaround for them because the
faster they can do this, the better.
And, again, they're going to be smart about this.
They're going to send out those payment emails so they get to the victims
Friday afternoon so nobody figures it out until Monday,
and by then it might be too late for for them to try to recoup that money.
‑I see.
I mean,
this is a hack in the sense that they're hacking that environment, but it's also
a hack in the sense that they're hacking the process of the organization. This
is what what everybody always talks about is like,
it's not just the computer.
If you tie all the things we can do on the computer, all the cool
exploits and new CV this and new RC that, you tie all that to just
someone who's really smart about how the organization works, like that
makes it exponentially more effective, I think.
It's interesting.
‑Yeah, absolutely.
And just like what you brought up before,
the victims have to kind of think of, you know,
the attackers, they're not just doing this to get money.
They've got access to all of your emails.
So imagine if you were like a medical institution this happened to. You
probably have something like PHI within those emails. That could lead to a
violation of HIPAA even though the attackers aren't necessarily going
after that. So on the victim's side,
it's not just they're losing money, they could be losing
reputation, they could be fined through regulations because
of privacy issues, and so on.
‑Yeah,
and then like you said, HIPAA is a great example, then same with the
fines from GDPR if this is a European company or has European
customers in that some of that's leaked in some emails that are sent
around, that's also where you can start getting hit with some pretty
big fines as well.
‑Yes. ‑That's really interesting, and we're definitely in an environment now
where like regulations or regulatory requirements are a portion of the, or a
percentage of the assigned costs to any event happening anyway, so not only is
it bad enough that you just sent a whole bunch of money to somebody that
wasn't who they were supposed to be, but now you also have to get hit with
regulatory requirements.
That's kind of a bad day. ‑Right. Yeah,
and as we'll see when we start talking about the response and what
you can go in and look at, a lot of victims,
they want to know what the attackers looked at while they were in the email.
And as we will find out when we talk about some of the
investigation that you can do with this,
depending on your license level, and again we're focusing on
Office 365, depending on your license level,
you may not be able to say that. You may only be able to
say that the attackers had access to this email account
from this date to that date.
And at that point,
you may have to assume that they looked at everything in that email,
which is not a situation that a company wants to be in.
‑Yeah, absolutely.
That makes it even that much worse.
So, that's good.
I think as we move on through this,
maybe we'll start talking about what we can do to prevent it, but
also look at some of those license features that you can do to get
the information to see what they've looked at, if that's
available, and some detections.
‑Yeah, absolutely.
‑I'm ready to move into that if you are.
‑Yeah, let's do it.