Hey Tyler.
So thanks for explaining the way this attack works.
I think it's really important that all of us really
understand the differentiation between, not only complexity,
but maybe even goals,
as well as the different phases of what business email compromise,
especially at enterprise level, looks like,
how targeted it is,
the things that we have to be concerned about with
like the CEO and that kind of stuff.
And really,
we got into talking about the organizational processes and being able
to hack that and like understand how organization does business and
use that and exploit how they do business to be able to basically
make money in a criminal way.
And so, we talked about that.
One of the things that's interesting to me about business email compromise,
in general,
is that there's like the whole organizational process
hack part of it is interesting, it's all technical as well once we get into like,
especially when we start talking about detection response,
like how we do that,
like we get into really technical kind of cloud areas that's not
all incident responders are comfortable moving into as well so
there'll be some really good nuggets there.
But the part about it that's like really,
it's banks moving money around too, and you mentioned recouping money.
So as we're talking about prevention is obviously having a plan ahead of
time like any good response and strategy make sense.
What does it look like to try to recoup this money if you can pretty quickly
realize that it's been stolen or sent to the wrong place?
‑Typically, when that happens,
when an organization gets attacked and they find out
about it and money has been transferred,
there is a limited window upon which they can go to their
bank and try to pull that money back.
And the big thing is, companies need to have,
like you just said,
some type of process so that they know what to do if this happens because,
again, everybody is being targeted for this.
There is no specific industry or vertical that's going to be targeted,
it's everybody.
And so,
knowing how to go back to your bank and request this
is something that needs to happen.
You don't want to be trying to figure this out on a Saturday morning
in the middle of November because you've never,
you have done this before.
And another thing that can be done is going to law enforcement.
Law enforcement is obviously seeing a lot of this,
and because of that,
they have special resources that they can use in order to help you try to
pull back that money or reverse those transactions.
In my experience,
sometimes they are successful or sometimes the organization's are successful.
Most of the time they're able to recoup some money,
but oftentimes they're not able to recoup all the money
that was sent out to the attackers, unfortunately.
‑Yeah,
and I can see and I kind of wrote down a note of law
enforcement because sometimes this trepidation about very
quickly going to law enforcement,
I know we have our like 3‑day reporting period thing,
but, like do we expose ourselves to this event?
We've all seen what happened with Uber and all of that on
whether the embarrassment of reporting it,
or the concern about reporting it and people's jobs,
and all that stuff, but in this case,
I think it's a little bit different than your breach,
like you didn't have 400 million customer's credit card information
stolen and that's going to be all over the headlines.
When you go to law enforcement for this purpose because it's so
targeted and something they're really comfortable with,
it seems like there should be less concern about go ahead and
engaging them as a partner to help get rid of that.
Is that is that accurate?
‑Yeah, I believe so, especially with business email compromises.
This is definitely one of those types of attacks where I would recommend
going to law enforcement as soon as possible because,
again,
there is a very short window of time that you can pull
back money after it gets transferred.
Once that time period has been exceeded it becomes less and less likely that
you're going to be able to recoup any money from this.
And so, going to law enforcement right away is going to assist in that process.
‑Got you.
And when I looked at some of the information,
it seems like the time period is really based on how
long it stays in that other account.
Is that is that accurate?
Because these kind of organizations have basically money mules,
this is where it goes very like criminal,
other organization, kind of standard, typical stuff you think of,
right?
Like they're money laundering, they're moving money around,
people are moving money into different accounts.
So when you're talking about a time period,
is that the time period that we're talking about,
or is there some,
are there other limitations on what that time period would
be to be able to get your money back?
‑So I think the time period is more along the lines of what the
banks have imposed or what the wire transfer systems have imposed
on once you make that transaction,
you have some time in order to reverse it and that's that time
period that that we're talking about here.
And, but you're absolutely right.
An attacker could receive that money and immediately
transfer it to another account, and then transfer that to another account,
and so on and bounce those, bounce that money all over the place very quickly.
So at that point,
I have to imagine it's almost impossible to recover those funds.
Now, at that point,
organizations will be talking about going to a cyber insurance,
should they have that,
and things like that to kind of recoup funds that way as well.
‑Yeah,
my in‑depth understanding of that industry from Jack
Ryan is basically that's how it works.
So once it gets moved around very quickly, it's hard to follow.
‑Absolutely.
‑ That's good to know.
I'm trying to wrap my head around.
We're talking about prevention.
I always want to try to make this relatable to a framework,
not just for me, but just for others if you're comfortable with a framework,
maybe it kind of helps you understand.
So we're talking about attack chain.
We see what that looks like kind of from initial compromise
all the way through action objective,
but we're also looking at techniques to identify,
that let me know maybe what to expect next,
right?
‑Right.
‑That's really something I'm always looking for as,
especially for your continuous monitoring or in like a SOC,
I'm like I solve this, I need to go look in these other places.
And so, here is a little more difficult,
though, right, because of the less technical nature,
especially of initial compromise, of course,
phishing stuff that we really well understand,
so look for phishing kinds of things, and there is other detections we can do.
Ahead of time before the attacker gets to you,
I mean really, they're doing targeting, which is a preattack like category,
right, and they're doing organizational information gathering.
And that's everything that they do up until,
like you said, it was two weeks from the time that they registered the domain.
All that was done well before that, is there anything you're seeing done?
I mean,
like obviously dumpster diving is like one of the things that can be found,
but I imagine it to be a pretty mature organization that sees people
stealing papers from the dumpster and then like oh,
we better go check for business email compromise,
that'd be a hard link to make.
‑Yeah,
a lot of the things that typically happen on the recon side of the
business email compromise is not going to be done physically,
it's still within the virtual world,
it's still within the online world so that you really
have to more focus along those sides.
But, you do have to look at it that there, again, there are two victims here.
There are the victims that get compromised and there are
the victims that send the money out.
So both of those victims,
they have to have the different prevention pieces in place in
order to make sure that this doesn't happen.
For example, for the victims who send the money out,
really,
the best way to do that is having processes in place so that
if you do get a request to change accounts,
that you actually talk to a human with this.
The attackers, if you email them back, they're going to respond to you,
they're going to try to talk you into doing it,
they're going to pretend to be the person that you think they are,
and I've actually seen them get very, very aggressive on the email say,
well,
we're going to close your account if you don't do this or we're going to
sue you or something like that to try to get that,
again, it goes back to that urgency.
But this is definitely one of those cases where companies need to have that
procedure in place where if they get this email that says,
please change the account number,
they pick up the phone and they call that person.
You know, you want to speak to a human.
You don't want to rely upon email for this.
‑Yeah, that that's a really great answer,
and I feel like as we talk about this, this is going towards user,
end user training, right?
And I know that that seems really generic,
and so, before we even say those words,
I want to kind of get ahead of it a little bit and say yes,
it's user training,
but very specific to the things that are relevant to
prevention for business email compromise.
So one of the things you mentioned is have a process in place,
and I don't think I've ever seen this in user security awareness training,
have a process in place for how you verify when money is sent,
regardless of who asked you to send it, right?
Call somebody on the phone.
Maybe there is a two‑step like that's two‑factor
authentication for do I send this money or not?
Like I want audio and I want text as well.
One thing I wanted to point out and we had talked about,
and we'll probably see this in a second,
is you were talking about an attacker who is logging into,
I'm going to say, from the perspective of the US,
right, I'm talking about a foreign attacker who is logging in through phishing,
gaining email addresses,
getting into an environment that's all mainly English based.
And so, when you look at that,
I think what the user normally expects is that there is going
to be this very broken English responses,
it's not going to be very professional sounding,
words are going to be messed up.
But we're talking about level of proficiency and organization
where they can read through all of your documents,
identify invoices, understand your business processes,
all from reading every, all your things that are in English.
So I imagine there is a higher level of English
proficiency in the communication as well.
‑Yes, there absolutely is.
I've read through a lot of these business email compromised emails,
and it can actually be pretty difficult to tell just by looking at the body of
the email when you're dealing with the attacker versus when you're dealing
with the real person that they're Impersonating.
I've even seen it where attackers have basically just copied and
pasted from other emails a person has sent,
changed a couple of words, and have sent it out that way.
So you're right, you're not going to get those misspellings,
you're not going to get that broken English that I think a lot of
people have been used to for some of these scams.
‑That makes a lot of sense and it's important for people who are like oh,
well, user awareness training is one of the prevention measures for this,
right?
It's like, not necessarily,
your standard users awareness training is not going to cover the
level of which these are current because you'll see,
oh, if you see misspellings,
if you see this like that's part of awareness training I've seen in the past,
that's great, it's not going to stop this from happening,
right?
‑Right.
I mean, and you're right.
User awareness training is not the end all be all for something like this.
We still need to do it,
we still need to educate everybody about how to
recognize these types of attacks.
but you do also need to kind of put those procedures in place,
verify those procedures are being worked.
and then there are technical things that you can put into place or at least
proactive monitoring to help prevent something like this.
‑Yeah, absolutely and you talked about the audio confirmation as well,
or even I saw one case when I was doing some research on it where basically,
the organizations will target when the CEO is on vacation and not reachable
because they have access to their schedule through office 365,
and then it's like you couldn't call them if you wanted to.
And so that's another kind of another level to be aware of is they're
monitoring who is coming and going and they're monitoring schedules
because they also have access to that information,
so it's important to know.
‑Yeah, and and they use that to their advantage as well.
If they know the CEO is out,
they're going to send an email that looks like it's
coming from the CEO to accounting and say,
hey, I just got this, I can't do this myself.
Please send this out as soon as possible.
Again, it's coming from your CEO, I mean are you going to tell your CEO no?
Probably not.
So that's, again, one of the tactics the attackers use.
‑Yeah, it kind of freaks me out a little bit because I'm like,
oh, this is a bit smarter than my average bad guy I go up against,
right?
Yeah, a little bit more in‑depth capability there.
So when we talk about prevention then,
obviously training awareness we talked about,
we talked about making sure you have processes in
place for when money is transferred, that totally makes sense.
You know, maybe just a personal thing for me,
but let's get away from like sending paper invoices for stuff,
but that's another, that's a whole another discussion,
right, about how we do virtual banking.
But what are some other things we can do to help prevent this from happening?
‑Yeah, So I will say probably the number one thing that a company can do,
especially if they're using a cloud‑based email system like Office 365,
is put in multifactor authentication.
Yes, you can bypass that, we will talk about that,
but multifactor authentication is absolutely key because users are
going to use the same password in other places,
they can be brute forced.
And so,
having that multifactor authentication makes it just that
little bit more difficult for the attacker.
I can tell you,
in 90% of the investigations that I work that
involve business email compromises, when I asked the victim,
do you have multifactor in place,
the answer is either no or we're in the middle of implementing it.
So that is definitely key there.
So So get that in place, get that working.
I know it's a pain,
users hate multifactor authentication because there is one more step,
but it's going to save you a a lot of heartache in the long run.
In addition to that, these start with phishing attacks.
So have that phishing detection and protection in place,
whether that's going through your current email system,
Office 365, again, we're kind of focusing on that,
but they've got a lot of phishing,
anti‑phishing detection and prevention you can turn on,
there are external services you can bring in to do that,
and, again educating your users.
I know you've look into this with some of the things that
organizations can do in order to help identify external
emails and things like that, right?
‑Yeah, absolutely.
Some of the neat solutions that I found,
again,
we're looking at this as it's a hacking humans
hacking organizational processes and, you know,
go figure some of the answers for provision are
actually just changing processes, and again,
kind of changing the way that humans look at the information they're
given so that they can identify stuff more easily.
So one of the neat things I found was actually color coding virtual emails where
the correspondence is from from the external organizations.
I really like that one and wanted to point it out because like that's a
neat technical solution that makes it easier for humans to identify when
they need to pay extra attention to something.
Another thing that you already brought up was just
verifying the payment location, right?
Maybe you have something, some sort of, you know,
system of record that makes sure that like that change of like where you pay
something to and this is from the other victim perspective,
the change of where you pay something to shouldn't be so easy,
right?
Like there needs to be additional verification,
maybe multiple people's verification before you change
the location that you pay something to.
Yeah, that was, those are the other things.
Other than that, you kind of brought up the multifactor authentication thing,
that's most of what I found, but I really liked the color coding one,
that seems like just a nifty good solution.
‑And that's really more effective than I think people give it credit for,
just having that indicator when you receive an email that it came
from outside your organization is really key.
What I would like to see too,
and I have yet to see a service that does this or something implemented,
is the first time you receive an email from a specific domain having a
different color code pop up as well so that if I'm used to getting you know
something from AaronRosenmund@pluralsight.com,
the first time I get it, I see that indicator and the rest,
I don't, but if I get a phish from AaronRosenmund@pluralsgt.com,
I may not notice that domain change,
and so having that color coded indicator would be awesome to have.
‑Oh yeah, that's a really good point.
Like, hey, you've never seen this one before, pay extra attention to it.
Yeah, that's great.
‑Absolutely.
‑Pretty cool.
So that's the type of squatting thing that we talked about.
There is also stuff you can use to detect type of squatting, right?
‑Yeah,
there are a lot of services out there that you can go and do
that analysis in order to see if there are any domains out
there that are very similar to yours.
There are free resources to do it.
I highly recommend having somebody go out and,
even on a weekly or monthly basis,
just run your domain or domains through one of those free
services and look at the domains that pop up,
how old are they?
If somebody registers a domain that's very similar to yours yesterday,
that's kind of interesting.
You want to pay attention to that,
especially if it has a mail MX record associated with that
because that means they can start sending emails and
receive the emails to that domain,
so that is a great indication that somebody could be starting to spoof
your domain or start to send one of these attacks.
‑Yeah, that's awesome and that applies to like,
that's maybe one of the few places where we can get ahead of the attack,
like this is where they're doing that preparation of their attack,
it's where they're doing their organizational information gathering,
set up a domain.
They haven't really touched our stuff yet,
but that's something you can check and identify ahead of time.
That's awesome.
‑Yeah, absolutely.
And you have to kind of remember that usually the attackers,
they set up these domains days to weeks to even up to
a month or so prior to the attack.
So if I had to guess what happens is once the attackers
figure out who they want to target,
they start setting up that infrastructure a little bit
so they can grab those domains and, let's face it,
the longer those domains are out there, the more valid they're going to look.
A domain that's a day old is a lot more suspicious to receive an email
from than a domain that's 2 months old or a month old.
So that's kind of their mindset in it as well.
‑Yeah, absolutely.
And another thing I want to point out before we move too much further is
that when we're looking at type of squatting and phishing,
there are a few different versions of the way this attack goes
that don't necessarily require type of squatting,
and there is another version that doesn't require phishing either.
So if I gain from a breach valid credentials for your Office 365 environment,
I didn't have to phish to anybody to get it,
I just use those credentials that were already out there
in the public that I can pull and use.
So now I'm already in, and then from there,
I can send valid emails from that location to your customers.
So in that situation, probably most dangerous,
there weren't a lot of indicators,
but I do want to make it clear that's an option.
‑Oh, yeah, absolutely,
and we've kind of been focusing on the attacker
setting up this type of squatter domain.
There are cases where absolutely the attacker will just get into
that email and send all the emails from there.
I've even seen cases where they do that and they include the type of
squatted domain cc'd on that to make the emails look a little bit more
legitimate because if I'm sending you an email asking for payment and
I'm the only one sending it,
that may look a little bit less legitimate than email
where I've CC'd two of my colleagues on,
even though those are to another domain or I've also
compromised those email accounts.
So again,
it's just the attacker trying to make this look as
legitimate as possible to convince the victim.
Yes, you need to send the money.
‑Yeah, that's pretty slick and pretty aware of them.
I guess,
I'm sure the criminal organizations have somebody who's also worked
in Enterprise where they check emails all day.
So they have plenty of, we all have plenty of experience on how to do that.
But do you have an example we can see?
Like I think we'd be remiss if we didn't do the stereotypical example of here's
what this email looks like and things you should look for,
right?
‑Yeah.
So what we see here is, this is a business email compromise email or one that's,
you know, typically seen or something along what a person might see.
We mocked this up,
but it's based off of a number of different ones that I
have seen during my investigations.
What you have here is you have it from a salesperson@corp.com.
We just kind of made that up.
The subject, Action Needed: Invoice Payment Needed,
so you have that sense of urgency there,
and it's going to the clients.
And the email is going to say something like dear client,
per our previous discussion, please remit payment for the attached invoice,
and they would attach a PDF that contains the changed account number.
Failure to do so will result in a late fee and so on.
A couple of things that were not showing here,
but often happens too is, attackers will often hijack existing conversations.
So when they go into your email, they'll,
instead of creating a new email like what we see here,
they will actually just reply to an existing thread.
Or when they reply to the existing thread,
they will take that email and make it look like their replying to it
if they're sending it from a different domain.
What we've also seen done too is here you see that from,
so in theory, if you click reply, it would go back to that,
they may actually have the from address to be the legitimate
person's email address and then add in a reply to feature so
that when you reply to the email, it actually goes to a different place,
which is an account the attacker owns.
‑I see.
And that's another place,
especially in the detection we can start to see because there are
rules you can see set for if replied to is different from the from
address then alert on that and take action,
right?
‑Yes, yes, absolutely.
‑Yeah, that's interesting.
So what we're not seeing here too is they're going to have an
attachment attached to this that is literally one of your PDFs
from your organization that that they stole and attached to it
and then changed the numbers on, so nearly no difference at all,
especially if they hijack an existing conversation.
This is, I mean, it would work on me like very difficult to identify.
I can, in the hustle bustle of the day,
you're definitely going to have this happen.
‑Exactly.
‑Yeah,
I can see why it would be really hard to prevent
anyone across your entire organization, right?
Like we, you and I will be like, yeah, of course, how did you click this?
But the reality is is that across the entire organization,
someone in some situation on their phone while
they're driving and watching Netflix, they're going to click it,
right?
And so when they do that that's not necessarily the end.
That's why the prevention here is in,
the prevention point to stop this from happening is having that
process for not paying to accounts that don't exist or having to
call somebody because just because you opened this and and looked at
it and got tricked in that moment,
there still should be some extra steps required before you start
transferring bulks of money over wire transfers.
‑Yeah, exactly.
I mean, if you think about it,
I have to imagine that companies don't change account numbers very often,
it's pretty rare for somebody to do that or an organization to do that.
So getting those emails should be a rare circumstance to begin with,
and so that should start to trigger some flags as well.
And then, like you said, have that process in place so that if you do get those,
call the person up and make sure you talk to them,
or talk to their supervisor,
or you talk to somebody at that organization to make sure that,
yes, they did actually send this, or no,
they did not send this.
‑What we get from there is now that we have that process in place,
that's great, but we hear, honestly,
I've heard about business email compromise all the time,
lots of it come at us, but that's why we actually wanted to do this.
You came up the idea because because we just saw some pretty
big ones happen and you've seen them so I think it's a good
idea to let's assume compromise.
Let's now move into, prevention is awesome,
here is the stuff you should have in place.
What if I don't and I now need to go Tech?
What if this is happening in my organization right now?
What can I go do to detect some of the indicators that this is going on?
Because there's this dwell time, like we said,
and even if there, have you seen it where like they'll send it,
the money gets sent,
and then like nothing bad happens and they kind of like keep doing it?
They're like, well that worked out, let's do it again.
‑Oh yeah, yeah.
Yeah,
if they do it for one customer or a couple of different
customers and they don't get caught, they'll come back and do it again.
They're just going to keep doing it until they get caught because,
at that point, they just lose access.
There is nothing that's really preventing them from from stopping,
and if it works, they're just going to keep getting that money.
‑That makes sense.
So we need to move into detection so we can figure out if this is
currently happening in someone's environment,
how they can find it, so we'll talk about that next.