Build Phishing Countermeasures to Protect Your Brand

Corporations fight phishing each and every day. Large and recognizable financial institutions, retail companies, internet service providers/telecommunication companies are among those most heavily targeted victims of phishing.

While the aftermath of a phishing attack is costly and yields long-term consequences, it’s quite difficult to keep up with cybercriminals. It’s shockingly easy for cybercriminals to create a phishing site targeted at your brand, so easy that the cybercriminal simply needs to unpack and upload a pre-built “phishing kit” in order to create a new phishing website. Just one phishing kit can produce hundreds of phishing URLs.

With just a few clicks of the mouse, the cybercriminal attacks your brand, sending you scrambling to “take down the site.” One-by-one you take down each individual website, costing your brand time, money and reputation. As you take down, he creates. It’s a never-ending battle. In our data, we’ve found that it is often the case that the same attacker is using this method to attack several institutions or companies within the same industry over a period of several months or years.

While the term “big data” is both ambiguous and overused, it defines the new frontier in the fight against phishing. Data sourced from hundreds of phishing sites targeting hundreds of brands is analyzed to identify trends, which allow us to build more effective strategies to fight cybercrime and prevent future phishing attacks.

Below we’ll discuss how to use phishing intelligence to build more effective countermeasures to protect your brand from attackers:

  1. Isolate a single attacker. Instead of taking down each phishing site one-by-one, what if you could go directly to the source and stop the criminal in his tracks? Analyzing phishing data allows us to gain clues as to how the criminal operates. For example, in a recent analysis of phishing attacks targeting large financial institutions, we found one particular criminal who had created 604 phishing sites with a single phishing kit, 390 of which were hosted on a single IP address. We call this a “clue.” Using this data, we’re able to identify several details about the criminal, often including email addresses and social media profiles. If you could identify an attacker that’s behind multiple attacks against your brand, how would that change the way that you approach phishing in your organization?
  2. Identify the monetization path. Another important component of building effective countermeasures against cyber attackers is to take a close look at the monetization path. It’s critical to understand the motives behind the attack (is the attacker money-motivated in the first place?) and how he has constructed his scheme to put your money in his pocket. Understanding the process is a key step in building future strategies and barriers to stop cybercriminals in their tracks.
  3. Build barriers. Using intelligence and patterns that you’ve identified, build barriers to protect your brand against future cyber attacks in order to identify threats early and stop criminals from leaving a stealing from your customers.

Have you used phishing intelligence to build effective countermeasures against cybercriminals? Share your insight in the comments below.

DMARC Failed to Protect Against Walmart Spam

Think that DMARC is all that you need to prevent your company from email spam? Think again.

Last week, there was a spam campaign that imitated a Walmart.com receipt. An email was sent to Walmart customers falsely confirming the purchase of a large flat screen TV costing approximately $1,000. The cinematic home experience was to be enjoyed by someone else, since the receipt showed the item was being shipped to an address that would be unfamiliar to the customer.

Upon receiving this email, the natural reaction would be to click on the link in email to find out more about the fraudulent transaction. However, doing so would require a visit to a malicious webpage that would download malware. That malware would then share credit card information and banking credentials with the scammers.

We’ve been hearing about DMARC as the solution to exactly this kind of email scam. In this particular spam campaign, the emails didn’t actually come from Walmart’s domain name.

Walmart.com (spelled with one “l”) is the real domain name. The company also owns Wal-mart.com. For either one of those domains, there would be a DMARC record published. If an email had been sent by the real Walmart, there would be a signature in the email that can be checked against Walmart’s registered domains. The email would be cryptographically confirmed as having been sent by Walmart. That’s the whole point of a DMARC record.

DMARC shows the true provenance of an email. If an email is not cryptographically signed, it should be rejected because that shows that it was not sent from an official source – in this case, Walmart. In this case, the domain name used to send the email wasn’t Walmart – it just appeared that way. If you were not careful, it would have been easy to be fooled. The email just came from a domain that looked very similar to that used by Walmart.

In fact, there are over 140 variations of misspellings of the Walmart domain name that are in use, such as “Wallmart.org” and “wallmart.net.” As a customer receiving the email, you might not even have noticed that Walmart was spelled incorrectly. Since none of those domain names are valid and do not belong to Walmart, Walmart did not have a DMARC record published for any of those domains. From the victim’s perspective, he sees “Walmart” spelled correctly in the “From Name,” but the email address (the domain portion of the email address) was not a DMARC protected domain. This, combined with high-resolution graphics and a professional look and feel makes for a convincing email, effectively mimicking an actual online purchase confirmation from Walmart. However, the emails were not being rejected because they didn’t fail the DMARC test. The DMARC test was never actually performed.

We believe that DMARC is a good thing. We’re happy that people are using DMARC. We believe that there will be some spam campaigns that will be blocked because of a failure to comply with DMARC, but in this case, DMARC wouldn’t have helped them at all. That’s why it’s important to use DMARC as one tool in the fight against phishing, as opposed to a single method to stop phishing. It is far from an all-encompassing solution.
Similar instances of phishing attacks are lodged against major brands each day. What are some of the other lessons we can learn? Please feel free to share your comments below.

PhishMe Inc. Honored as Gold Winner in the 8th Annual 2013 Hot Companies and Best Products Award for Best Upgraded IT Software

wsj_logo“It’s an honor to be named a winner of the 8th Annual 2013 Hot Companies and Best Products Awards and be recognized by industry peers for our hard work and dedication to providing cutting edge training solutions to our customers,” said Aaron Higbee, Chief Technology Officer and Co-Founder of PhishMe.

Read More

Do young employees present a phishing risk?

Spring. For some it signals rejuvenation, rebirth, everything blooming…but for security administrators it can mean new security risk. Spring means that the next round of college seniors will be entering the workforce soon, which for phishers means a fresh group of targets. Hopefully their college educations have prepared them for the majority of challenges they will face, but when it comes to phishing that is unlikely. The types of phishing emails students and consumers receive are quite different from what employees receive, and without training, young employees can’t be expected to avoid tactics they haven’t seen.