Good evening ladies and gentlemen my name is Joseph Cicero. I'll be presenting
spitting the hook, examining fishing bait for enterprise protection. The, the
speaker for this room was unable to make it on time so Mike asked if I could fill
in. So I have this presentation in the can, as it were. I've never given it, I'm
not going to say it's going to be polished. I hope you take away something
from it. I told him it's presentable. If you deal with fishing it at all, I hope
you get something out of it. If you don't deal with fishing very much or a little
bit, hopefully parts of the presentation will, will help you out with that.
All right, Who am I? I'm Joe Cicero. I'm currently a senior security engineer. In
the past, I've been a defense forensic expert, so along the lines of forensics
for this CypherCon, it's a good talk. I've been an instructor, speaker, lecturer,
security researcher, programmer, columnist, Network administer, I've held all
the jobs so. I love what I do though now, as the senior security engineer l love it.
So why didn't I tell you where I work? How many of you are familiar with this?
You've been scraped breach? Hands in the air if you can, if you're familiar with
that. All right so, I'm being recorded right now. I don't want to become a
target for my employer. So I don't publish that. If you go out, you link with
me on LinkedIn, you will find that I work for undisclosed. And it's always funny
when I get somebody communicating to me, "hey I'd like to talk
to you about your work at undisclosed". I know that, well that's somebody's
fishing me there. Okay so a quick schedule of what I want to do tonight.
I'm gonna do a quick survey. I'm gonna, a lot of this presentation is for, is
designed around your ability to go back to your organization and know what can I
do to teach my employees. What can I do to teach my, my service desk or my, my
help desk from a triage perspective on phishing emails. What can I do
or my analysts do and then how do I react after that? So when we're
talking about all of the detailed structure, what can you do once you have
all the information. All right. So quick survey. Hand in the air if you can
identify phishing email. Just put your hand in the air if you can identify
phishing email. And then look at the screen. That's for a different screen,
that's, let's go ahead put your hand in the aiir. That's for something else. Put you
down, now I got everybody. Go ahead, put your hand in the air. That's, that, that,
okay fine. Nothing, whatever, go ahead. All right so, I asked you that you put your
hand up, the screen said don't do it. This is exactly what happens with a phish with
your employee. They got an email, it looks legit to them, they don't know
the indicators to look at, they're clicking links, they're replying right?
That's what's going on. So, one of the things I like to cover with the
employees is the red flag concept, all right? Phishing tactics work because
the phisher's do things that in phishing emails that you'll see in legitimate
emails. You get an invoice in a legitimate email, you get an invoice in a
phish. You click links and emails, you click links in phish. So the, the phish
that we're seeing on a large-scale basis are very much what you would see in real
life. They're, there for each indicator, every time you say well look for this,
look for this, look for this, you have to tell them it's a red flag. Look at the
email address, does the email address make sense? If it doesn't, that's a red
flag. Look at the subject. Does the subject make sense? If it doesn't, that's
a red flag. And the idea here is that numerous red flags, you go to your
employees, say look, if you have five or six red flags, that's when you sit back
and you say all right something's wrong with this, I need to send this to
somebody else to analyze before I go clicking on a link. So that's the red
flag concept. All right, some statistics. I love dealing with statistics. So 91% of
phishing attacks are displayed or display name spoofs. So you have three
parts of an email address. You've got the display name,
you got the email name and you have the domain name. And 91% of the emails out
there are display name spoofs. Because the bad guys know when they send you an
email and you look at it, the chances are you're not gonna look at the email and
you're not gonna look at the domain name. If it came from the CEO's name. Oh the
CEOs communicating with me, I need to reply. So knowing that, one of the things
that you absolutely want to communicate to your employees is, we start by looking
at the display name. How many of you work for an organization that gets a flag
right. A message banner that says this is an external email. And how many of you
have had people fail with the flag that says this is an external email? Guy right,
right. Because they become immune to it. If it's got the flag, the next step you
look at is, what's the, what's the display name? If the display name makes sense, we
go to the email name, if the email name looks, make sense you go to the domain
name. And 91 percent of your problems stop if your employees do that. All right,
display name spoofing. Here, here's a display name spoof right? Dan Macmillan
in red. We got Dan Macmillan, but it came from Ralph Jones at mailiinaator.com,
that's the display name. Anyone typically can change the display name, and I have
that typically in star, we'll talk about that later. But if, if you have a gmail
account, I believe Gmail allows you to change the display name every six months?
Maybe it's every three months, every quarter? So anybody can do this. You can
make the display name whatever you want and this leads to CEO fraud emails.
Because they get an email address, they make it you know, CEO at mailinator.com
and they say alright, I'm gonna go after your organization, so I'm gonna
make that Dan Macmillan. All of a sudden you have that. Employees that are in a
hurry will overlook this. How many of you deal with BYOD? BYOD or small devices
right? Here's a problem. Because if you allow an iPhone and you allow Android
and you're using outlook inside or some other client
inside your, your organization, you have to teach this three different ways. You
have to provide your employees three different ways to look at it and say
okay, on an iPhone you won't ever see the email name or the domain name. But if it
didn't come from your organization, it'll be colored in red. In Android, it
will show you the display name and the email name and the domain name. And then
depending upon how you have your your-your-your client software
configured, it might display that. Hackers can reuse email accounts and
numerous attacks, there's no cost or little time and little effort.
So, as I massage this presentation and get it better and better and better, one
of the things I absolutely want to talk about is making it expensive for the bad
guy. As a whole, the security industry is not making it expensive for the bad guy.
If you make it expensive. If you get something from a gmail account and you
say I'm blocking that gmail account, and now my organization is taken care of. You
haven't communicated to Gmail that this account is being used in CEO fraud or
some type of phishing attack. And now gmail is not taking that account away.
When it gets harder and harder and harder for the bad guy or gal, to be able
to do this, you're gonna make it more expensive, they're gonna go after
somebody else. So I want to enlist you into moving forward with a lot of those
tactics as you go forward, all right. Phisher Tactics. So here's the Phisher
tactic right? We've got hacker tactic place fake, reply information within the
body of the email. So I ran into a phish that came in. The account had been
compromise,d they stole somebody's email account. I see this all the time with
them, with not free emails, but like your AT&T account or your Comcast account.
Right, your home account. Somebody has taken somebody else's home account away
and they're going after your organization with it, because that
accounts not going to be flagged. The tactic was to place fake information in
the subject. Now if you look, I don't know if I have the zoomed or not. Yeah here we
go. All right, it's coming from Larry, but they pasted into the body of
the email from Dan McMillan. So where does your eyes go as the user that
receive this email? Oh this coming from Dan my boss. Not! It's coming from Larry.
So this is a tactic that you have to be aware of and you have to communicate to
people, right? Didn't come from Larry your actual Larry. It came from Larry, not
actually from the boss, so this is a tactic you want to be training your
employees and your service desk, help desk, whatever to be looking for. All right.
Email name spoofing. This might get a little harder right? If you're dealing
with a free online account, that's not, it's not hard. Providing that name exists.
Anybody can go out, believe it or not AOL is still around. You can go out to AOL.com,
you get yourself an AOL email address and you can have anything you
want, because nobody uses AOL. So here we have a dome a display name spoofed and
an email address spoofed but the domain name is still wrong your employee gets
this its CEO fraud dan McMillan's your CEO all of a sudden they're checking one
they're checking two they check three the domain name is is bad and 91% of
this you take care of your problem here but they have to be able to get that
address so anyone can create an email on free sites additional check that
employees should be taking hackers can reuse an email account in numerous
attacks or they can't so this is the important thing about setting up the bad
guy setting up an email account that has the email name they can only use it
against you now how many of you keep track of indicator of compromises or
threat intelligence any threat Intel people in the art so very important
great job one of the things that I want to do is keep track of this because this
show shows a little more sophistication on the bad guy shot job so when I'm
keeping track of my threat Intel one of the things I'm marking off is did it
display that did it didn't change the display name because that's cheap and
they can reuse that account but did they spoof the email
now if the email name is spooked that took a little bit more they can't reuse
that account that account is only going to be used against my organization so
I've increased it they can't reuse that account there's still probably no cost
there's a little bit more time and there's a little bit more effort so this
is costing them more and you want you want the you want them a higher cost so
I went out and I wanted to find all right that is does Dan Macmillan can I
get that email sure I can get that at group mail comm so very easy I can go
get that free email Fisher tactic so here's a tactic that I see being used
regularly it's where they did not change the email address name notice that this
email address name is CEO mail so Dan McMillan's my C's not my CEO but if he
were my CEO here's my CEO Dan McHale and I can spoof that I can change that a
hundred times a day if I want but I can't change that email name so here's
somebody who didn't use a whole lot of effort to go after the organization all
right domain name spoofing now we're talking about something that's going to
be a little bit more expensive so here we have Dan Macmillan they've spoofed
the display name they've spoofed the email name and
instead of Sam Mart we have Sam and na rt.com so now they're trying to dis
they're trying to spoof the domain name anybody can purchase a domain name right
now I'm seeing a lot of dot infos dot clubs why anybody it's
it's a new top-level domain but why are they using info and club that's true
what somebody said it yeah there are dollar ninety-nine all right so once
again you have somebody who's buying a domain that's gonna go into my threat
Intel okay they didn't bother with a calm which might have cost them $7.99
they bought an info or a club I still want to shut that down because shutting
it down cost them two bucks now they got to go buy it again additional checks
that employees should make once again we're checking the display name we're
checking the domain or the the email name and we're checking the domain name
hackers can't reuse a domain name they can't use it numerous attacks Sam n na
RT is only gonna work against Sam Mart and unless it's generic in nature like
Verizon dot uk' it's more cost it's more time and it's more effort so more things
that I want to put into my threat Intel so I wanted to go out and see what type
of examples I could get here I could get Sam Mart - mail.com this is something
I'm seeing a lot more of and it's it's it's it ends up being a lot of false
positives how many of you have seen subdomains or domains with CDN in them
CDN content delivery network so all of a sudden I have a domain that I'm blocking
because it's not on a whitelist that's being blocked I'm looking at it it's got
CDN in it and I have to go verify that this domain is actually owned by the
same organization that has the regular domain a couple of weeks ago I had one
where I contacted the organization said I'm seeing this domain I think it ended
in dot stream so another dumbest thing in the world
they ever did was come up with all these new top-level domains
it was the domain dot stream puts me on high alert
what is this contact the VP of Marketing of the organization do you own this
domain what was her answer that's exactly right
I don't know I'll have to get back to you
they got back to me yes they own that yes that's where they're putting their
streaming content yay I can allow that all right
but that's the type of problem you're gonna end up from a security engineer
perspective with false positives all right subject trigger words again we
haven't even moved to the Service Desk or they or the high-end analysis we're
still talking about things that I would tell your employees to have to do
subject can take contain trigger words lots of times effective because
marketing emails and legitimate emails do this also hurry your account might be
suspended I see that as many times in a legitimate email as I do in a phishing
email it invokes a sense of urgency curiosity examples invoice Bo you know
if you get an email with invoice in the subject
do you sell invoices that means do you pay invoices do you take care of
invoices if you don't that's a conversation you have with your
employees about it maybe we don't need to be dealing with this email that
that's a red flag right away alert warning attention etc all right so
phishing emails that invoke fear urgency get the most clicks all right same thing
in the body though we've now we've told them you get an email I want to check in
the display name I want you checking the email name I want to check in the domain
name i watch check in the subject for all these red flags now let's take a
look at the body in 2018 less is more increase in minimal verbage emails hand
in the air if you have seen blank emails coming to your organization nothing in
them great hand in the air if you have short little emails like are you
available there say everybody I always say these don't and our employees are
falling for them all right so the new it used to be that they would have the
Bible in there right it was all and it was all broken English and you could you
could tell in an instant but the new tactic is we send you nothing or we send
you very little and we it's hard to make a determination no hey are you available
yeah I'm available you get that on your iPhone and you have very little
photo way to tell that that's a bad email and your users are clicking it and
replying yet they're busy our users are busy all right
generic versus specific salutation this really depends so this is more things
that go into your indicators of compromise or your or your threat
intelligence spreadsheet did they use a generic hey are you available or did
they say hey sue are you available because now you've had somebody who's
taken the time to research you're the individual that they sent this email and
they have an internal name they know who they're sending this to that's more
information you're dealing with a more sophisticated attacker so you want to
make sure that you get that in your threat in town may contain the same
trigger words in the subject so we have our users looking for that we have them
looking for spelling errors good story an intern that worked for me sent me a
fish he received said look at this one too spelling errors in it I laughed so I
took that I like analyzing things i when I go home and I analyze things so I took
that and I analyzed that sorry I'm gonna I'm gonna click the link I'm gonna go to
it while I went to it and it was his college sending him a phishing email
that was a test and he had and so I just failed the test for because I visited
the link at the end of the link was okay a code and if I changed the code I
failed for other students so uh so I failed for three or four other people
and then I sent him an email said by the way enough other people fail this too
okay but when you see these emails come in now what you're seeing with the short
small amount that's inside the email is not a lot of spelling errors not a lot
of problems with that so we can't use that as a trigger any more may contain
shortened URLs like bitly google and many others right I'm trying to the uto
is probably the shortest one I've seen may contain URL to hacked sites we're
going to cover that a little bit URLs that us to sites that do metal
Durex so this is a new tactic I've seen where they send you to a site and that
site makes a determination about who you are where you're coming from what
browser you're using so they can send you to a different site that may have a
vulnerability for that specific browser or operating system may contain fake
attachments and may look perfect so once again all the previous checks I
discussed plus these things it would be what I am communicating to my employees
these are the checks I want you to make these are things that they can tell all
right so here's a nice little short one do you have a minute hey are you a
fellow I need so I need you to take care of something for me ASAP oh you gotta
have that ASAP in there right did that come from Dan McMillan no it came from a
display name spoof Dan McMillan at CEO mail at group mail com didn't come from
my organization no one should have replied to that zoom in for okay Fisher
tactic blank email for those of you who have received a blank email there were a
few hands in the air how did you analyze it what did you say about it did you
block the user is it a mistake or does it have a 1 pixel image in it that just
went back and told whoever sent that email the operating system the browser
the client email this all exists for free you can go out onto the internet
you can get yourself a one pixel image that you can put into an email that you
can send to somebody and you'll get all that information back I wish I had the
screenshots of it when I first ran the test I looked at it and it said somebody
in Chris Google in Cupertino yeah somebody
alright so wasn't that it was Google where's Google I have some what's that
okay yeah somewhere in California so it showed my email being opened up in
California and then at my house and when I looked at that I went you know that's
one of those oh my god moments and then I realized
that was using Google and Google reai new Google was this is all a test
account I know Google's reading my email but I've never seen it done so if you
ever go out there and create one of those one pixel images google it you'll
find somebody that will do message tracking versus via an image and you
have a gmail account you will see Google open and read your email and then send
it to you I have if you if you LinkedIn with me you have an article out on
LinkedIn that shows it okay so that one of the other tactics that I was talking
about is the shortened URLs so I don't know if you're aware of it but there are
websites that you can put a shortened URL in and it tells you where you can go
so when we get to the as a as an examiner as an analyst how would you
handle this knowing where it goes there are websites that will do that this
happens to be a Proofpoint rewriting a URL the URL it's rewriting is a bitly
and the reason the hacker the bad guy did this was so that the actual URL they
were using would not be captured by Proofpoint right unless you're blocking
bitly which would be a very difficult thing in this day and age to do this
link is going to get clicked it's going to your proof point or whatever you're
using for for analysis if it's not actually visiting the link and finding
out where that link ends up you're you're vulnerable all right this is a
great one so I don't know how many of you are familiar with one our site fixed
comm by the way I'm not uh I'm not recommending you go to any of these
sites so when I went to this site I was on my system it was a secured system I
was doing some testing this particular site I have not analyzed so I can't tell
you this is safe but I went out there I did search and I found that this all
harf un com slash King HTML had malicious redirects into Faceman all
right so the important part of this screen is 2018 11 19 at 2244 so let's
just remember 11 19 what is that November 19th so then I
went out to how many of you are familiar with virustotal calm I would hope ever
all is alright virustotal is a website think it's owned by Google
it's safe that you can upload an executable or any any file you can
upload a file to it or you can tell it tell me what you know about this URL and
it will scan it with 69 different AV products and it will tell you whether or
not it's bad and so you'll see over here zero of 69 found that are all harf young
comm / king - tml was bad 69 AV products are saying have at it go to that site
you got no problem however if you look at the last analysis date on this you'll
see it's at 12:23 so this is how many days after the other site said this is
an infected site that google is there yeah a virus total is telling you you
got no problem that should tell you thank you that you just started who that
should tell you how weak AV is all right AV is not your friend you cannot trust
it it should also tell you those of you
that are doing threat intelligence and using this and I you I use it I use
virustotal all the time because a virus total comes back and tells me 15 sites
say it's malicious I'm done but if it tells me zero out of 69 that's nothing
anybody can beat this so I have to move forward alright so those of you familiar
with thumb Webroot bright cloud so after that I
went out to web Rubright cloud I said what's the reputation of them all are
few calm and you'll see is 96 out of 100 oh that sounds like a great site so part
of the threat Intel that I'm going to be documenting is all this information how
am I going to use that I'm gonna go to my management and I'm going to say 69 80
vendors didn't catch this what a bright bright top said this was safe yet my
analysis shows it's not that's that means we have
to have these different vectors protected in some way shape or form Oh
Fisher tactic when you open the attachment it's actually a PDF file made
to appear like an error message anybody seen this one so your user gets an email
with an attachment they open up the attachment the attachment says well hi
there they click that and it contains instructions for opening the document
Excel but it's actually a link to a website unless you're doing some type of
advanced analysis sandboxing is what we would call it of your emails coming in
your users going to end up getting to this they're going to that site and
depending upon one on that what's on that site you may be maybe getting
infected another example of these PDF documents put on pretense that you need
to sign in to an online storage provider Dropbox to access your document Dropbox
I freaking hate it how many of us could do business without it right so Dropbox
is one of those things that organizations just say yeah we use
Dropbox we use Dropbox well that's why the bad guys are using them clicking the
link takes you to Dropbox login page which gives you options to sign in using
your Google outlook Yahoo AOL office 365 or other email right so if you ever see
this you capture a screenshot of it and you show it to your employees and say if
you ever see this it's bad no site is ever going to say by the way you can log
in and get your document using any credential you want to give me that's
just ain't gonna happen all right so new Fisher tactic as I
talked about earlier is fake attachments so you'll see in this particular email
that the attachment that's right underneath the email a name there that's
a real attachment but if it's under the the verbage if it's under the text I
actually this one's reversed you got to know what you're using so in this
particular one a fake attachment is on top and a real
it is down at the bottom this must be Google client or something so depending
upon how your client email program handles attachments you may see the
attachment as an image in the bottom is fake but an attachment a real
attachments up here at the top you have to train your users on that because
they're gonna look at their say oh I expect to get this email here's the
attachment they click it boom they're out to the to the malicious site all
right so that's that's the training that I would do with the employees and that
made you you may have to adjust that some but that there's nothing complex
about that and you may have to do it regularly for them to be able to get a
hold of it what's the analysis that I would having
depending upon the level of your service desk or your security analyst or your
security engineer doing well one of the first things that we're going to want to
do is take a look at the header so those of you don't know that that's a header
header comes in the email how do you see a header and outlook this presentation
by the way was for non techie people so I would expect you guys would be able to
Google how do I look at my header and figure it out
all right file properties that would show you your header and in Outlook
what's in a header that you might want to know about well the first thing would
be the SPF do we have any email administrators if I say it wrong please
let me know I am NOT an email administrator like a lot of this stuff I
know enough to be dangerous sender policy framework the email might come
with an SPF check this is basically and if there was an email administrator they
could tell me I think you get 10 entries in your SPF check so if your marketing
department you're big enough to have a marketing department and the marketing
department wants to use what's that company that they send out emails with
thank you Kasich on that piece of crap no I'm just joking
all right can't they use Constant Contact to send emails on your company's
behalf but the marketing department doesn't go to IT and say I need Constant
Contact to be in the SPF record then every email that Constant Contact sends
out going to get crapped on because it's
gonna fail the SPF check this organization is not authorized to send
email for your organization that's what an SPF check is so if you have SPF setup
and an organization is sending emails on your behalf you get a nice little pass
and a lot of the websites dkim alright so should should be instead considered a
method to verify that the message contents are trustworthy meaning that
they weren't changed from the moment the message left the initial mail server so
we can do a decal you can look in the header and you can see was a dkim check
performed and if it was and the SPF check was performed you could say all
right came from an authorised place and it wasn't modified on the way to me
yeh Demark domain message authentication reporting and conformance policy allows
a sender to indicate that their messages are protected by SPF and DKIM tells the
receiver what to do if neither of those author content ocation methods past such
as junk or reject the message so this is this is in human speak what the d mark
is i get an email from you i check d mark d mark tells me if the SPF fails
ignore the message if the SPF passes allow the message if the SPF fails allow
the message if the DK dkim fails allow the message so it's a way for the
recipient me getting your email to know what to do with your email when these
other things fail everybody kind of get it I want to know that stuff so if I'm
looking in the head alright I'm not going to go through line by line
analyzing header I don't do it so here are some websites that you can use that
would allow you to check those for SPF and DKIM and d mark once again I'm not
I'm not guaranteeing that these aren't malware sites I don't know most of them
MX toolbox is good what is my IP comm and IP to location these are all sites
where you can go and you can paste the header in and it will tell you
information about that header whether or not you have to worry about how am i
doing on time I'm ok all right so online header it so here's
G sweet so this is Google and here Google has told me it's passed the s
it's past the dkim and it's past Demark so what that tells me is it came from an
authorized sender the message contents were not changed and because of that the
demarcus passed typically somebody who is not dealt with a lot of phishing
emails it's legit alright but we're gonna find out how it may not be legit
just like zero out of 69 on virustotal main mean may be meaningless this is now
meaningless to me if however it fails SPF and it fails DKIM and it fails the
mark okay I know I have an issue so we're really
get in the habit of looking at those things alright so here we have Verizon
Communications the email claims to come from Verizon communication but I or
actually it claims to come from Bank of America but it's coming from let's see
maybe it's claiming to come from Verizon comm but it's coming from online no it
must be come from Bank of America that's right it's pretending to come from Bank
of America but it actually came from Verizon somebody using their horizon
account to send me a fish I pretty much know art this is a phishing email and
done with this one from the standpoint of those of you that
are documenting the indicators are compromised and the threat intelligence
this is more threat Intel that we want to know about because we may be able to
block things based upon you know what we're starting to see different things
coming from Verizon comm that are faking being from our domain
okay can headers be spoofed or faked yes but only part of them can be faked for
the email to be delivered some of the information in that our header has to be
real so when you do your analysis it's all suspect except the last hop because
those of you they know cali org run out on the Internet right you can fake a
header for those of you that are documenting threat intelligence when you
have when you start seeing Japan Japan in japan japan comcast in florida right
you start you can start saying to the email administrator you know what i'm
seeing all of this from japan i want to block anything that inator has this
information because didn't actually come from there it's being faked all right
how do i do that job because this is cipher con
so here's mm keys mailer and NM keys mailer you can click on advanced
settings and you can add a header yeah so if I add the center I can I can send
anything I want from anywhere I want now when I would this was a mistake I
probably should have done this when I was learning to use this I thought well
Who am I gonna use Donald Trump at whitehouse.gov like I'll just take that
as a head and the email never got to me and I thought oh I'm on a list now so
when you're playing around with this stuff and sending yourself fake headers
come up with something probably not that oh look here it is it made it to me
alright so here we go Donald Trump Trump D Trump at whitehouse.gov
I want to fake the header so I I faked the email address you'll notice my SPF
and my D mark failed so I'm done right all right I know R it's fake it's this
is no good but I'm not done as the analyst because I'm keeping my
indicators of compromise and my threat intelligence I'm gonna do a complete job
so I have all that data you'll notice it's it it actually came from the last
hop was M key dots easy so this came from the Czech Republic not from
Washington DC this was very interesting to me right so I think what I did is I
faked a Poland header and I sent it an IP to location told me yeah I kicked it
started in Poland and then I went to the Czech Republic and then it came to me
and the reality is it never went through Poland I faked that Poland header so it
actually came from the Czech Republic so then a typical typical person is gonna
say well and Joel all I got to do is look at the last one technically you
would be correct right look at the last hop that's where it came from but if
you're documenting those in caters to compromising that threat
intelligence you want to know every op it made because multiple of those hops
may have been faked time can fish pass SPF DK I'm an IP check can a fish do
that sure if a hacked email account is used everything will pass how many of
you are seeing B C's business email compromised also known as a EC account
email compromised also known as a supply chain attacks right hey so a legitimate
organization that deals with your organization gets hacked probably
through outlook 365 that person's email is now being used to send you an email
everything is going to pass now you're getting a fish that is absolutely legit
except for the contents can they put those contents on a legitimate domain
and then can they put a hyperlink to a legitimate domain that zero out of sixty
nine a these are gonna flag we learned that earlier
absolutely so now things get really really difficult
now you have to have a user who can say this is not normal this is going to
increase your calls to the Service Desk this is going to increase your workload
especially if whether it's a false positive or not you have to analyze it
but it's gonna make you more secure industry is seeing a rise in this tactic
business email compromising email compromised revisit biggest phishing
scams of 2018 since 2019 is now over a hundred and twenty six percent increase
in email account takeover why because a whole lot of email addresses are just
being dropped the only way the bad guy can get into your organization is if
they go after a legitimate email address okay inspecting attachments how are you
going to do this if you're the security analyst you're the investigator you're
the examiner and you now have an attachment how do you examine alright
well who who is it coming from whether the could work to the kind of first
you ask is who is this pretending or who might it be coming from
and what could the contents be I'm in health care I have to be very careful
about any attachment that comes in because if it's a false positive it may
contain pH I I can't upload that to hybrid analysis or virustotal
so I have to five minutes ago I got a move so I have to be very careful about
how I analyze these you may be in the same if those of you that are in the
banking industry those of you that are in education right you may have
something that is protected for you and you can't just go upload it if you look
at it you say there's there's not going to be anything in this particular
document then you might be able to use virustotal hybrid analysis you might
want to open it in a sandbox or a virtual machine I highly recommend the
virtual machine is not on your production network all right so I
segregate this stuff get this stuff segregated if you don't have money for a
sandbox there's a kuku sandbox out there and it's free where you can it'll run on
Ubuntu it will be a pain to get installed and working but once you got
it it's golden you're golden you have something that you can analyze other
tactics that I have used to be able to analyze something very quickly was to
open it in a non-standard way if I get a PDF maybe I can convert it to a doc so
if it has malware PDF malware in it and I open it up in in WordPad or something
right now I that malware is not going to run and I can see the contents of email
convert the doc to PDF I love hex editors I open up tons of
things in a hex editor because now it's just like looking at it in a binary I
can open it up in a hex editor I can read the document that I can call the
user and say does any this makes sense to you yeah that makes sense okay then
this is probably a false positive inspecting links caution checking on
public websites again you don't want to just upload to just anywhere you have to
know whether or not the potential of this document containing something that
you can't publish is in there so be careful of that virustotal
Trend Micro com bright cloud using a sandbox now this is a really cool thing
that I started doing a couple of months ago and
it's screenshot guru this one I did inspect so the last time I looked at it
no malware here what you can do is if somebody gets a hyperlink and you don't
know if that's a valid hyperlink or not you can go to screenshot dot guru
put it in there and it will show you a JPEG of the website so if it's a fake
tech support site or malware site you'll get a picture of them our SEM you're
secure so if you need to make if you may need to make a determination quickly
that's one way you might be able to do that other things that I want to know is
whether or not the link redirects if the redirection is based on time or does the
redirection base a change based on browser I'm seeing this a lot the bad
guys are looking at the browser agent and they're saying oh it's Mozilla and
they redirect me to Yahoo or Gmail or Google what's the analysts gonna say
this website's not a problem and you're not gonna block it at your firewall and
you're not going to contact your firewall vendor and say this needs to be
blocked but then you change it to ie right and then Mozilla has a plug-in
user agent switcher so I say you know make it say I'm in IE and all of a
sudden I'm at a fake tech support page so no those tactics are out there know
how you can handle some of those tactics alright Prevention's do I probably have
a few minutes here two minutes prevention steps blocking the email
address or domain so these are the tactics you're taking with your
organization I'm gonna block the email address I'm gonna block the domain may
sound easy may not be possible if it was a business email compromise and you have
to deal with that person try blocking them right you may be able to block them
today but you may be unblocking them very shortly because otherwise you
people don't get credentialed alright understand that those exists remove
additional emails to users right contacting an email administrator run
through get rid of this stuff blocking the link URL identifying users
who have replied clicked or open the attachment right if you can know that
now you may have a system that's infected you want to stop it now we want
to take these 69 day infections and bring them down to hours not months and
days notify your anti-phishing vendor so if you're using something to to anti
fish and something got through want to contact them look this got
through I want you to fix this problem notify the email domain owner so if I
get something from that that's at some website here and there's a pro
incontinence do I want to go alert the website and say I want you to know that
your website is currently being used used for fake tech support or malware
there's a pro and a con to that the pro is I protect everyone and I cost the bad
guy money the con to that is they're just gonna find another one and they're
gonna publish it and that makes me vulnerable again because I may not know
about that one so depending upon whether you're blocking domains that are
currently set up in only 30 days old or right all of those things that you maybe
in the firewall you have to decide on this I'm a proponent of making things
more expensive that does not mean that the organization that I work for is a
proponent of that that is the discussion that you have to have with them
notifying the domain registrar so here's a good one right the sites in Poland or
Czech what are you gonna do you're gonna contact the Czech site so you may be
able to contact the the domain registrar right Nick and let them know and shut
the site down think about how these things work you might be able to do that
notifying your firewall vendor the owning company website if it was a
hacked account letting them know immediately website hosting company
internet Crime Complaint Center with them ic3 yeah that's what I think all
right read intel most valuable threat intelligence originates from your own
environment and stays there you can get threat Intel feeds all you want you can
get threat Intel feeds on your vertical meaning whatever type of organization
you are banking healthcare education the best threat Intel is what you're seeing
now because that's the stuff that you can act upon is fast you can create a
scorecard and then I wanted to talk about phishing tests but I'm out of time
dude do I have time for questions no thank you I appreciate it everybody
goodnight
you