Improve your Defenses Against Email-Borne Threats in 2017

2016 was a particularly bad year for data breaches. A large number of huge data breaches from years gone by were also discovered in 2016.

The largest breach of 2016 – by some distance – affected Yahoo. The credentials of more than 1 billion users were obtained by the gang behind the attack. A massive cyberattack on MySpace was discovered, with the attackers reportedly obtaining 427 million passwords. 171 million vk.com account details were stolen, including usernames, email addresses, and plaintext passwords. 2016 also saw the discovery of a massive cyberattack on the professional networking platform LinkedIn.  The credentials of more than 117 million users were stolen in the attack. Then there was the 51-million iMesh account hack, and 43 million Last.fm accounts were stolen….to name but a few.

The data stolen in these attacks are now being sold on darknet marketplaces to cybercriminals and are being used to commit a multitude of fraud.

One of the biggest threats for businesses comes from business email compromise (BEC) scams. BEC scams involve an attacker impersonating a company executive or vendor and requesting payment of a missed invoice. The attacker sends an email to a member of the accounts team and requests payment of an invoice by wire transfer, usually for several thousand dollars. All too often, even larger transfers are made. Some companies have lost tens of millions of dollars to BEC fraudsters.

Since the email appears to have been sent from a trusted email account, transfer requests are often not questioned. Cybercriminals also spend a considerable amount of time researching their targets. If access to corporate email accounts is gained, the attackers are able to look at previous emails sent by the targets and copy their writing style.

They learn about how transfer requests are usually emailed, the terms used by each company and executive, how emails are addressed, and the amounts of the transfers that have been made. With this information an attacker can craft convincing emails that are unlikely to arouse suspicion.

The scale of the problem was highlighted earlier this year when the FBI released figures as part of a public awareness campaign in June. The FBI reported that $3.1 billion had been lost as a result of BEC scams. Just four months earlier, the losses were $2.3 billion, clearly showing that the threat was becoming more severe.

This year also saw a huge increase in W-2 scams in the United States. W-2 data is requested from HR departments in a similar manner to the BEC scams. Rather than trying to fool email recipients into making fraudulent transfers, the attackers request W-2 data on employees in order to allow them to file fraudulent tax returns in their names. The IRS issued a warning earlier this following a huge increase in W2 attacks on organizations in the United States.

Companies large and small were targeted, with major attacks conducted on Seagate, Snapchat, Central Concrete Supply Co. Inc, and Mainline Health. Between January and March 2016, 55 major – and successful – W-2 scams were reported to the IRS.

Attackers do not even need email account passwords to conduct these attacks. Email addresses of CEOs and executives can easily be spoofed to make them appear that they have been sent internally. The sheer number of stolen email addresses – and in many cases also passwords – makes the threat of BEC and W-2 attacks even greater. Security experts predict next year will be even tougher for businesses with even more cyberattacks than in 2016.

Improve Your Defenses Against Email-Borne Threats in 2017

Reducing the risk of these attacks requires multi-layered defenses. It is essential that all employees authorized to make corporate bank transfers receive training on email security and are alerted to the risk of BEC scams. Policies should be introduced that require bank transfer requests to be authorized by a supervisor and/or authenticated by phone prior to the transfer being made.

All employees should be instructed to use strong passwords and never to share work passwords anywhere else online. Many employees still use the same password for work as for personal accounts. However, if one online platform is breached, it can give the attackers access to all other platforms where the same password has been used – including corporate email accounts.

Organizations should also implement controls to block phishing and spear phishing attacks. Blocking phishing emails reduces reliance on the effectiveness of anti-phishing training for employees.

SpamTitan is a highly effective tool for blocking malicious spam emails, including phishing and spear phishing emails. SpamTitan uses a range of techniques to identify spam and scam emails including Bayesian analyses, greylisting and blacklists. SpamTitan incorporates robust anti-malware and anti-phishing protection, as well as outbound email scanning to block spam and scams from corporate email accounts. SpamTitan is regularly tested by independent experts and is shown to block 99.97% of spam email with a low false positive rate of just 0.03%.

2016 may have been a particularly bad year for data breaches and the outlook doesn’t look good for 2017, but by taking affirmative action and implementing better defenses against email-borne attacks, you could ensure that your company is not added to the 2017 list of data breach and scam statistics.

How Do Spam Filters Block Spam Email?

How do spam filters block spam email? Spammers are constantly adapting their strategies to bypass spam filters and deliver more malicious messages to corporate users’ inboxes, so how do antispam solutions keep pace and block these annoying and often malicious messages?

Many anti-spam services rely on blacklists to identify spammers’ email addresses and IP addresses. Once a spammer’s IP address has been identified, it is added to a global spam blacklist.

Antispam solutions check incoming messages against these blacklists. As soon as an IP address is blacklisted, any email sent from that IP address is automatically marked as spam and will be deleted or quarantined.

Spammers are aware that the lifespan of an email address for spamming is short. As anti-spam solutions have improved, the time delay between an email address being used for spamming and it being added to a global spam blacklist has reduced considerably. Whereas spammers used to be able to use an email address for weeks before it was identified by anti-spam solutions and blacklisted, now the lag has been reduced to days or even hours.

Spammers therefore have a very small window of opportunity to use email addresses and mail servers for spamming before they are detected and blacklisted.

Snowshoe and Hailstorm Spam Tactics to Get Messages to Inboxes

Spammers have attempted to increase the timespan for using email addresses using a number of methods, the most common being conducting snowshoe campaigns. This tactic involves sending out very low numbers of spam email messages from each IP address. If spam email volume is kept low, there is less chance of the IP address being recognized as used for spamming. To ensure sufficient numbers of messages are sent, spammers use millions of IP addresses. Even using this tactic will not allow the spammers to conduct their activities undetected for very long. Spammers therefore need to constantly add new IP addresses to their spamming networks to enable them to continue conducting their campaigns.

Snowshoe tactics are now widely used and the technique is highly effective, although a new tactic has recently been uncovered that is referred to as hailstorm spamming. Hailstorm spam campaigns similarly involve extremely large numbers of IP addresses, yet they are used very briefly and intensely. Rather than trying to stay under the radar, the spammers use those IP addresses to send huge volumes of messages very quickly.

Researchers at Cisco Talos recently analyzed both tactics and determined that the DNS query volume from a typical snowshoe campaign involved around 35 queries an hour. A hailstorm spam campaign involved around 75,000 queries an hour. The snowshoe campaign would continue at that rate for many hours, whereas the hailstorm spam campaign spiked and then fell to next to nothing. Hailstorm campaigns can therefore be used to deliver huge volumes of emails before the IP addresses are added to blacklists.

How do Spam Filters Block Spam Email?

How do spam filters block spam email when these tactics are used? Snowshoe and hailstorm spam campaigns are effective against antispam solutions that rely on blacklists to identify spammers. Only when an IP address is added to a blacklist will the spam email messages be blocked.  Advanced spam solutions offer far greater protection. Blacklist are still used, although a number of other methods of spam detection are employed.

Conducting a Bayesian analysis on all incoming spam email messages greatly reduces the volume of spam email messages that are delivered to end users. A Bayesian analysis involves reading the contents of a message and assessing the words, phrases, headers, message paths, and CSS or HTML contained in the message. While scoring, messages based on content can be effective, Bayesian spam filters also learn as they go. They constantly compare spam emails to legitimate emails and build up the range of spam characteristics that are checked. As spammers change tactics, this is picked up by a Bayesian spam filter and spam messages continue to be filtered.

The use of greylisting is also important in a spam filter. There will be some messages that pass all of the checks and some that monumentally fail. Categorizing these messages as genuine or spam is therefore simple. However, there is a sizeable grey area – messages that could potentially be spam.

If all of these messages are blocked, many genuine emails would not be delivered. If they are all allowed, many spam messages would get through. This would result in poor catch rates or extremely high false positive rates. Greylisting helps in this regard. Suspect messages are returned to the sender’s mail server and a request is made for the message to be resent. Since spammers mail servers are typically constantly busy, these requests are either ignored or they are not dealt with promptly. The time it takes for the message to be resent is therefore a good indicator of whether the message is genuine.

SpamTitan – Keep Your Inboxes Spam Free

SpamTitan uses a range of methods to identify spam emails including blacklists, Bayesian analyses, and greylisting. These checks ensure that more spam emails are identified and blocked, even if IP addresses have yet to be added to spam blacklists. This makes SpamTitan highly effective, even when spammers use snowshoe and hailstorm spamming tactics. By using a range of methods to identify spam emails, spam detection rates are improved and false positives are reduced.

SpamTitan is independently tested every month to determine its effectiveness. SpamTItan is consistently verified as capable of blocking more than 99.97% of spam emails, with a false positive rate below 0.03%.

If you want to find out the difference that SpamTitan makes to the volume of spam messages that are delivered to your employees’ inboxes, why not take advantage of our free, no-obligation 30-day trial. You can implement the solution quickly, evaluate its effectiveness, and you will receive full customer and technical support for the duration of the trial.

Why Should Businesses Perform Outbound Email Scanning?

All antispam solutions and spam filters check inbound messages for common spam signatures; however, it is also important to choose a solution that performs outbound email scanning. Outbound email scanning ensures spam emails, or emails containing malware, are not sent from an organization’s email accounts or domains.

Your employees would be unlikely to knowingly use their corporate email accounts to send spam emails, but malware infections can allow cybercriminals to gain access to email accounts and use them to send high volumes of spam email messages. Cybercriminals could also compromise email accounts and use an organization’s domain to send malware and ransomware to clients and customers.

Should this happen, it can have a seriously detrimental effect on an organization’s reputation and may result in corporate email accounts or an entire domain being blacklisted.

Blacklists are maintained by a number of organizations – spamhaus.org for example. Internet Service Providers (ISPs), web servers, and antispam solutions check these blacklists before allowing emails to be delivered to end users. If a particular IP address, email account, or domain is listed in one of the blacklist databases, emails sent from the domain, IP address or email account will not be delivered.

Blacklists are updated in real-time and contain many millions of blocked domains and email addresses that have been reported as having been used for unwanted activity such as the sending of spam emails. If emails are sent from a blacklisted account, domain, or IP address those emails will either be directed to a quarantine folder, deleted, or will simply be rejected.

If a business has its domain added to a spam blacklist important emails to clients and customers will not get through. This can prove costly, as real estate firm Keller Williams has recently discovered.

Blacklisted Domains and Email Accounts Can Prove Costly for Businesses

Over the past few days, email messages sent from the kw.com domain used by Keller Williams have been rejected by AOL. Yahoo has been blocking emails from the kw.com account for some time. The problem appears to be the addition of the kw.com domain to spam blacklists.

If a Keller Williams real estate agent needs to send an email to a customer who has an AOL or Yahoo account, it will not be delivered. Agents have therefore been forced to get customers to open Google email accounts in order to send online paperwork or documents requiring e-signatures.

The issue also affects online paperwork sent via the transaction management software program Ziplogix, with one Keller Williams agent also claiming Dotloop is also affected. Some agents at Keller Williams have reportedly had to send important paperwork for listings and sales via personal email accounts to ensure emails are delivered.

The AOL website explains that when domains have been flagged as being abusive, the server will be temporarily blocked until the spamming stops. Until a domain is removed from its blacklist, AOL account holders will be prevented from receiving emails from the blocked domain. Removing the domain from the blacklist can take up to a week.

Removing a domain from the 80+ commonly used spam blacklists can be a time-consuming task; furthermore, if spam emails are sent from the account again, the domain will simply be added to the blacklists once more.

Outbound Email Scanning Prevents the Blacklisting of an Organization’s Domain

Unlike many third-party antispam solutions, SpamTitan checks incoming email messages for spam signatures as well as performing outbound email scanning. If an email account has been compromised and is being used to send spam emails, if malware is sending spam, those messages will be blocked and will not be sent. Outbound email scanning is an important protection that will prevent an organization’s domain or email accounts from being used to send spam or malware.

Organizations can therefore avoid the embarrassment and reputation damage that results from being suspected as engaging in spamming or malware delivery. They can also rest assured that in addition to blocking 99.97% of inbound email spam, their domains and email accounts will not be added to spam blacklists.

Holiday Season Malware Infections Increase Again

‘Tis the season to be jolly, although ‘tis also the season to be infected with malware. The holiday season is an annual highlight for cybercriminals. Holiday season malware infections are to be expected as cybercriminals increase their efforts and try to infect as many users with malware as possible.

Malware is an ever-present threat, but the increase in online activity in the run up to the holiday season means easy pickings for cybercriminals. Consumers are starting to prepare for the holidays earlier, but not as early as the scammers. As consumers head online in their droves, scammers and other cybercriminals are lying in wait.

The advent of Black Friday and Cyber Monday – days where shoppers are offered amazing deals to prompt early Christmas purchases– see a frenzy of online activity. There are discounts aplenty and great deals to be had.

However, not all of those discounts are genuine. Many are scams that are used to phish for sensitive information or spread malware infections. As is the case every year, the holiday season sees a spike in malware infections, with the biggest spike over Thanksgiving weekend. This year has been no exception. Holiday season malware infections have increased significantly year on year.

Holiday Season Malware Infections Rise 118% Above Normal Levels

This year, over the first official shopping weekend of the holiday season, malware infections increased by 106% according to data compiled by the Enigma Software Group. On Cyber Monday, when even more great deals on online purchases are made available, malware infections were 118% higher than normal.

Those figures are only for Windows users. Add in smartphones and Apple devices and the figures would be higher still. The problem is also getting worse. Last year there was a spike of 84% over normal levels during the Thanksgiving weekend.

There have been a number of suggestions put forward as to why the figures are so high this year. One of the main reasons is simply due to the number of shoppers heading online. Each year sees more individuals choosing to go online shopping over Thanksgiving weekend. More online shoppers mean more opportunities to infect users with malware.

However, there are also more actors involved in online scams, malware-as-a-service and ransomware-as-a-service has also grown in popularity, and many cybercriminals have started up affiliate schemes to get more help spreading their malicious software. Individuals who succeed in infecting computers with ransomware are given a cut of the profits and there is no shortage of people willing to try the affiliate schemes to boost their own earnings.

Cybercriminals are also getting better at developing convincing scams and malicious email messages. The grammatical and spelling mistakes that were common in phishing emails in years gone by are largely gone. Now, almost perfect emails are sent and scammers are using a wide range of social engineering techniques to lure end users into clicking on malicious links or opening infected email attachments. Spoofed retail sites are also now commonplace – and extremely convincing.

The growth of social media has also helped boost cybercriminal activity. Malicious posts are being shared online offering discounts, special offers, and unmissable deals. However, all end users get is a malware download.

Avoiding a Bad Start to Holiday Season

To avoid becoming a victim of a scam or having to deal with a malware or ransomware infection, shoppers must be vigilant and exercise more caution. Offers that sound too good to be true usually are. Unsolicited emails should always be treated as suspicious and extra care should be taken when clicking on any link or visiting a retail site.

Businesses should also take extra precautions. A malware or ransomware infection can prove extremely costly to resolve. While warnings should be sent to end users about the risks of holiday season malware infections, technological solutions should also be in place to prevent malicious file downloads.

Antispam solutions are highly effective at blocking malicious messages such as phishing emails and emails containing malware. SpamTitan blocks 99.97% of spam messages, contains a powerful anti-phishing module, and blocks 100% of known malware.

Malicious links on social media sites and on third-party ad networks (malvertisting) are a very real risk. However, a web filter can be used to control access to social media sites, block malicious third-party adverts, and prevent end users from visiting websites known to contain malware.

If you want to keep your network free from malware this holiday season, if you have not already used these two solutions, now is the time. They will also help to keep your network malware free around the year. And with security experts predicting a massive increase in ransomware and malware attacks in 2017, there is no better time to start improving your defenses.