Hackers Find BEC Attacks More Profitable than Ransomware

ronjor · Jul 25, 2017

By Jeff Goldman, Posted July 24, 2017

Cisco calls business email compromise 'the most lucrative and profitable method to extract large amounts of money from a business.'
Click to expand...

ronjor · Jul 26, 2017

How Attackers Use Machine Learning to Predict BEC Success

Kelly Sheridan 7/26/2017
Researchers show how scammers defeat other machines, increase their success rate, and get more money from their targets.
Click to expand...

itman · Jul 27, 2017

ronjor said: ↑

How Attackers Use Machine Learning to Predict BEC Success
Click to expand...

Great example of how "the brass" get duped into replying to a spear-phished e-mail.

He emphasized the importance of timing during a BEC attack; threat actors can use targets' schedules to plan their attacks on organizations. When they know who is doing something at a specific time, they can better plan when he would send an email and what he might say.

Singh demonstrated this idea, for example, an executive traveling to an event, and showed how the Twitter timeline, keynote plan, and travel plan could be used to indicate when he might be in transit or working.

To make their fraudulent email more believable, attackers can register domain names similar to those of the companies they are trying to imitate. This can be done for little money and effectively trick individuals and organizations, he explained.
Click to expand...

itman · Jul 27, 2017

A bit more detail in this homographic attack article by Eset:
Homograph attacks: Don’t believe everything you see

Cybercriminals with secure websites

While it is true that most fraudulent web pages use HTTP, whereas original sites requesting credentials (like social networks, bank portals, etc.) do so through HTTPS, this does not mean attackers cannot do the same. In fact, they can easily convert their site into HTTPS, obtaining a completely valid SSL/TLS certificate for it – and free, for that matter.

For this to work, the attacker would need to be capable of registering a domain that looks as similar as possible to the real website that they are looking to fake, and then obtain the certificate for this new domain. One option is to look for domains that are written in a similar way. For example, “twiitter.com” versus the original “twitter.com,” or “rnercadolibre.com” versus the original “mercadolibre.com.”

Remember those experiments where they show you incomplete words or words with almost imperceptible errors, and how when you read them quickly it’s just as though they were complete and correct? Well, the same thing happens to a lot of people with URLs when they are browsing.

At first glance, if you are reading quickly, these examples could trick quite a few people, but you only need to look closely at how the address is written in order to detect the trick. What the attacker needs is to be able to register a site where the address is written differently, but looks the same to the user, and that is why homograph attacks are used.

Let’s look at an example. Can you tell whether this site is fake or not?
Click to expand...

https://www.welivesecurity.com/2017/07/27/homograph-attacks-see-to-believe/

Log in or Sign up

Hackers Find BEC Attacks More Profitable than Ransomware

ronjor Global Moderator

ronjor Global Moderator

itman Registered Member

itman Registered Member

Log in or Sign up

Hackers Find BEC Attacks More Profitable than Ransomware

ronjor Global Moderator

ronjor Global Moderator

itman Registered Member

itman Registered Member

Useful Searches