Three Ways Reporter Can Enhance Your Incident Response Process

Most of us have been in an airport and heard the announcement over the loud speaker; “If you see something, say something.”  The airport has security personnel; however, their agents cannot be everywhere at once.  They collectively rely on travelers passing through the airport to be their eyes and ears in places agents cannot be.  In this way, as an airport traveler, you are a “sensor” watching for, detecting, and alerting on suspicious behavior such as unoccupied luggage.

What does this have to do with information security? Just as passengers can help prevent an incident in the airport by reporting suspicious activity, employees can help prevent a data breach by reporting suspicious email. The key to unlocking this valuable source of threat intelligence is to simplify the reporting process for employees, and to measure the results of your program to prioritize reports from savvy users.

[Read more…]

New Whitepaper: “Evolution of a Phish: Phishing Delivery Mechanisms”

Phishing and malware techniques have been evolving since the time they were detected, conceptualized and recognized. Even though the malware payload or a phishing website URL is considered as the most important part from a detection and prevention perspective, we have observed a number of changes within the past few months in the phishing delivery mechanisms.

Our new whitepaper, “The Evolution of a Phish: Phishing Delivery Mechanisms,” covers an example of how obfuscation and file creation changes the detection process, and examines how attackers have gone from using simple malicious file uploads to more advanced techniques such as hiding a malicious file or link in plain sight.

Over the past few months, Ronnie Tokazowski has analyzed various malware campaigns that have used phising as the delivery method. The malware has evolved from attachments to links to 3rd party websites such as Dropbox. He’s also provided in-depth analysis of Dyre, which used a fax-themed phishing email similar to the one discussed in the whitepaper.

The interesting trend, however, is not that both phishing campaigns used similar themes, but the underlying methods of how attackers are trying to evade detection, and how there is no way to test the file until and unless the file gets formed in the browser. As an industry, we must acknowledge the reality of this evolution, and understand that new delivery mechanisms will continue to challenge all defense layers. This reality makes the last line of defense – employees – essential.

Download the Whitepaper

 

Two Attacks… Two Dyres… All Infrastructure

Over the last few days, we have seen two waves of Dyre. The attackers have changed things up a bit and made it harder to analyze. By using memory forensics techniques, we took a peek into their command and control (C2) infrastructure. The #1 rule of memory forensics…everything has to eventually be decoded, and we’re going to use this to our advantage. Here’s a quick look at the waves of emails we received. (Figures 1 and 2)

Figure 1 phishing fax

Figure 1 — First wave of Dyre


[Read more…]

.NET Keylogger: Watching Attackers Watch You

Throughout life, there are several things that make me smile. Warm pumpkin pie, a well-placed nyan nyan cat, and most of all – running malware online – never fail to lift my mood. So imagine my surprise to see, after running a malware sample, that the attackers were watching me. Here’s a screenshot of a phishing email we received, which contained a keylogger written in .NET.

Figure-1-Phishing-Screenshot

Figure 1 — Screenshot of phishing email

[Read more…]

National Cybersecurity Awareness Month 2014

With National Cyber Security Awareness month (NCSAM) upon us, the national spotlight is on best practices to stay safe and protect your data online. Thanks to the support of the National Cyber Security Alliance, Department of Homeland Security, and the White House , the month of October will feature a number of initiatives designed to increase the knowledge base about cyber security issues with the general population and promote DHS’ “Stop. Think. Connect.” program to empower individuals to be safer online. PhishMe is proud to participate by being a 2014 NCSAM champion, and have made a number of resources available to individuals looking to learn more about how to protect themselves from phishing, and to organizations trying to change their users’ behavior with more effective employee security training programs. [Read more…]

Bash Vulnerability CVE-2014-6271 – Worm-able and Possibly Worse Than Heartbleed

Post Updated 9/30/2014

Several months ago, the Internet was put to a halt when the Heartbleed vulnerability was disclosed. Webservers, devices, and essentially anything running SSL were affected; as a result, attackers were able to collect passwords, free of charge.

With Heartbleed, the exploit made a splash and many attackers started to use the vulnerability. One of the more high-profile attacks of Heartbleed was the CHS attack, where the attackers siphoned 4.5 million patient records by attacking a Juniper device, then hopping onto their VPN.

So how can something be bigger than Heartbleed? I’m glad you asked. [Read more…]

2nd Annual Phish Throwdown Contest Results

The results are in… and we have a winner! After much deliberation among our panel, we’re pleased to announce Gareth Stanyon as our 2nd Annual Phish Throwdown winner. Gareth’s email “Corporate Information Security Breach” addressed a recipient who supposedly violated company policy regarding social media use. To respond to the allegations, the email directs the recipient to click on a link. The email is personalized with the recipient’s name, organization, and department.

[Read more…]