" bec Archives - LuxSci

Posts Tagged ‘bec’

AI Threats to Email Security

Tuesday, October 17th, 2023

Artificial intelligence is a buzzy topic in the tech industry right now. Many experts are looking to AI to help solve some of the complex challenges of our times. However, besides this technology’s helpful and practical applications, there are some concerns that AI can be used for malicious purposes. In this article, we review some of the top threats to email security posed by AI and what you can do to prevent them.

person using ai tool

AI Threats to Email Security

In general, the biggest threat artificial intelligence poses to email is the ability to easily scale and increase the effectiveness of existing threats. The power of AI can be used to craft more effective phishing and business email compromise attacks and potentially cost businesses billions of dollars. Let’s review how artificial intelligence can increase the success of these types of cyberattacks.

AI and Phishing Attacks

In today’s world, phishing emails are often easy to identify. They are typically launched by criminals outside of the United States and use poor grammar, contain misspellings, or are poorly formatted in other ways. As a result, they are straightforward for the average email user to avoid. Artificial intelligence can help correct some of these common errors and make it easier for cybercriminals to create more convincing emails. As a result, we could see more phishing attacks succeed, wreaking havoc on our online security.

Let’s look at an example. Say a hacker from Russia wants to launch a ransomware attack on an American hospital. To do so, they need an email recipient to click on a link in the email that will install malware on their computer, enabling the hacker to gain access to restricted systems. The hacker does not speak English but has been able to launch attacks on other systems using an email drafted to resemble a password reset. Previously, he may have taken this email, ran it through an online translator, and then hit send on the email, unaware of any typos or strange translations that made it into the text. With AI, he can craft a much stronger email that will fool a busy hospital administrator into clicking on the link.

Some AI text generators have taken steps to prevent people from entering prompts that directly ask for prewritten phishing emails. However, artificial intelligence makes it incredibly easy to translate text from other languages in a grammatically correct manner. Scammers can create unique messages at scale that are more likely to fool email recipients.

AI and Business Email Compromise

Business email compromise attacks are one of the most effective email security threats. Still, because of the time and research they take to deploy, they don’t garner as much attention as phishing and ransomware. Artificial intelligence can help speed up essential research about a target to craft business email compromise attacks.

Let’s take another example. Say an individual wants to steal from a major corporation. The attacker decides to impersonate a company vendor and fool them into routing payments to the attacker instead of the legitimate contact. Artificial intelligence can reduce the time it takes to identify potential targets and possible attack vectors. Cybercriminals can use AI prompts to identify profitable companies, locate lists of vendors, and even research individuals in the roles that are likely to interact with the target.

AI can also use prompts like “generate an email asking for payment on a business invoice” to create legitimate seeming business emails. Using these technologies lowers the barriers to executing a successful business email compromise attack, meaning that more cybercriminals will likely attempt them more frequently.

How to Prevent AI Email Attacks

The good news is that the introduction of AI technology has not changed how we fend off these attacks. The first place to start is with policy and training. Business email compromise thefts are easily thwarted by having policies and procedures in place to prevent unusual cash transfers to unauthorized individuals. Ensuring your staff knows the types of threats and raising awareness of the risks can help protect your business.

Secondly, you can implement email filtering technology to help protect your inboxes from emails sent from suspicious sources. Although scammers can craft persuasive messages, they can’t hide their origin. Organizations can use email filtering software to quarantine or stop suspicious messages from reaching employee inboxes. This technology can prevent email domains without SPF or DKIM records from passing through your inboxes, alleviating a common spam tactic.

Conclusion

The threats to email security posed by artificial intelligence are quite serious. Nevertheless, organizations can take steps to protect themselves by implementing the proper defenses. Contact LuxSci today to learn more about our advanced email filtering solutions.

Tags: ai, artificial intelligence, bec, business email compromise, cybercrime, cybersecurity, email filtering, email security, phishing
Posted in LuxSci Library: Security and Privacy
Comments Off on AI Threats to Email Security

Pretexting: The Latest Threat to Email Security

Monday, June 12th, 2023

Verizon recently released its 2023 Data Breach Investigations Report- a comprehensive review of breaches and security incidents occurring over the last year. One surprising finding was a sharp rise in pretexting attacks. To properly respond to these threats, security professionals must understand the risks and prepare for exploitation attempts.

email breach frustration

What is a Pretexting Attack?

A pretexting attack is a type of social engineering scam where the attacker tries to convince the victim to give up valuable information or access to a service or system by creating a story or pretext.

These types of scams are a form of phishing. However, pretexting requires more effort than regular phishing attacks that aim to reach as many potential victims as possible and fool one of them into clicking on a malicious link.

To successfully execute a pretexting scam, attackers spend time learning about the target and use the information to manipulate human behavior to achieve a desired outcome. The threat actor may spend more time performing reconnaissance and engaging with the victim. This time investment means that pretexting is often used in attacks with a higher anticipated payout.

In the 2023 Data Breach Investigations Report, analysts found that 50% of all social engineering attacks are pretexting incidents. This represented a 2x increase from the 2022 report. With these types of attacks on the rise, organizations must understand the threat and how to protect themselves from these breaches.

What’s an Example of a Pretexting Attack?

In a business context, pretexting falls under the category of business email compromise scams. Every pretexting scam includes two main elements- a plausible situation and a character. First, by creating the right situation to present to the victim, it is possible to fool the target into believing it is legitimate. Secondly, selecting the right person or organization to impersonate is equally essential.

If the attacker fails to pick a plausible scenario or chooses the wrong entity to impersonate, it drastically reduces the likelihood of success. That’s why these schemes require surveillance and research to achieve their aims.

Some common pretexts or scenarios that you should watch out for include the following:

  • A CEO or manager asking for an urgent transfer of funds to an unusual account
  • A vendor or supplier asking for payment of an unpaid invoice
  • A coworker asking for a password to an account they should already have access to

If the attacker has adequately researched the target, they can be quite convincing in impersonating a legitimate source and convincing them to hand over valuable information or assets.

How to Protect Against Pretexting Attacks

Instilling a healthy dose of skepticism in employees is always recommended. Proper training and reminders can help employees remain suspicious of requests for information and funds they do not expect. In addition, implementing the right policies and technologies can help reduce the risk of falling for a pretexting scam. Some additional steps to take to secure your email accounts include:

  • Deploying SPF, DKIM, and DMARC to prevent spoofing.
  • Using email filtering tools to flag suspicious email activity.
  • Installing anti-malware software on all devices can help mitigate the effects if a malicious link is clicked.
  • Deploying multi-factor authentication to guard against the risk of password theft and stolen credentials.
  • Updating business processes to ensure financial payments are appropriately vetted and signed off on.

Do you need help securing your email accounts? Contact LuxSci today to learn how we can help your business avoid falling victim to pretexting scams.

Tags: bec, business email compromise, cybersecurity, email filtering, mfa, multifactor authentication, phishing, pretexting, social engineering
Posted in LuxSci Library: Security and Privacy
Comments Off on Pretexting: The Latest Threat to Email Security

How to Avoid Business Email Compromise Attacks

Tuesday, July 5th, 2022

Business email compromise (BEC) attacks are on the rise and are poised to eclipse ransomware as the biggest threat to cybersecurity. Since 2016, $43 billion has been stolen through BEC. Even more concerning, there has been a 65% increase in BEC from 2019 to 2021. This article explores what business email compromise scams are and what steps organizations can take to avoid them.

business email compromise

What are Business Email Compromise Attacks?

In business email compromise scams, attackers infiltrate or impersonate a legitimate corporate email account. They then send phony invoices or initiate contract payments that trick unsuspecting businesses into wiring money to criminals.

These scams rely on humans making the wrong choices. Some examples of business email compromise scams include:

  • A criminal impersonates a vendor and sends a fake invoice to the accounting department.
  • Someone who appears to be the company CEO asks an assistant to make a wire transfer to an unknown account.

Some of the tactics used include:

  • Domain name spoofing: Domain name spoofing involves changing the sender’s “From” address to match the recipient’s domain in the message envelope. Criminals can also use a legitimate domain as the “From” address and a spoofed “Reply-To” domain in the message header.
  • Display name spoofing: The attacker registers a free email account to impersonate a vendor or employee. The attacker would configure the display name to match the employee’s name and then send phishing messages from this account. This technique is effective because recipients often only look at the display name, not the email address. In fact, many email clients will only show the display name when viewing the message, making it easier to hide the sender’s real identity.
  • Lookalike domain spoofing: The attacker may register fake domain names that contain characters that look similar to those in the actual domain name. For example, replacing the lowercase “l” in luxsci.com with an uppercase “I.” The criminal will send phishing emails from this domain to trick the recipient into thinking the message is legitimate.
  • Email Account Compromise: Another common tactic is taking over legitimate email accounts that have been compromised through malware or social engineering to steal data or funds.

How to Prevent Business Email Compromise Attacks

One of the reasons that business email compromise attacks are increasing is because they are often successful. Email filters and content scanning can do little to stop sophisticated social engineering attacks. Nevertheless, there are steps that organizations can take to stop BEC scams.

SPF, DKIM, and DMARC

Implementing technical controls can help prevent BEC scams from succeeding. As discussed above, many attacks use display or domain name spoofing to impersonate company accounts or individuals.

Sender Policy Framework (SPF), DomainKeys Identified Mail (DKIM), and Domain-based Message Authentication, Reporting & Conformance (DMARC) are anti-spoofing email authentication techniques that use DNS records to validate the sender of an email. Ensure the organization’s domain has valid SPF, DKIM, and DMARC records. Make sure the email provider analyzes all inbound email traffic using these tools.

Viewing the headers of a suspicious message is also an excellent way to detect fraudulent domains. See Gmail, Outlook, Apple Mail, and More: How to View Headers in Email to learn how to see these in the most popular email clients. This can help reveal the actual sender of someone using a spoofed domain or display name.

In addition, implementing email filtering and scanning tools can help flag suspicious links and protect against phishing attacks.

Employee Training

Helping employees recognize business email compromise scams is essential to avoiding them. All employees, not just those with access to sensitive data or financial information, should understand the tactics used by cybercriminals in BEC scams.

Employees should be aware that attackers can use the information they share online via social media against them. Birthdates, pets’ names, nicknames, and information about time off can be used to impersonate others and trick individuals.

Ensure employees are implementing strong passwords and using multifactor authentication to prevent account compromise and stop them from changing account credentials.

Policy and Procedures

Creating clear policies and procedures can help alleviate confusion and prevent individuals from taking action without thinking. For example, organizations should have clearly defined procedures for how and when vendors will send invoices and be paid. That way, when an unexpected email comes in from a “vendor,” employees will know what to do. It’s also essential to keep up-to-date contact information for vendors and employees. Many BEC schemes ask recipients to call a phone number with account credentials or payment information. If the number differs from the contact information on file, it’s wise to pause and call the contact through established channels to confirm the message’s accuracy before proceeding.

By creating clearly defined and enforced policies and procedures, it will be very obvious when deviations occur. Empowering employees with the tools they need to identify business email compromise scams will help protect your company and keep financial information secure.

Tags: bec, business email compromise, cyberattack, cybercrime, cybersecurity, dkim, DMARC, email fraud, email headers, email scams, phishing, spear phishing, spf
Posted in Email, LuxSci Library: Security and Privacy
Comments Off on How to Avoid Business Email Compromise Attacks