[Music]
uh my name is Drew yel uh I'm currently
I'm a director of information security
for a healthcare startup but in the past
I've you know worked in Consulting I've
done a lot of ir engagement I used to be
at the point with business email
compromise where I do like I don't know
two of these things a week so uh once
you once you've done one you probably
they're they're pretty they're they're
they're very uh they're very repetitive
but so for the purposes of kind of note
taking and um you know I don't mind if
to take pictures here but there's
actually a short link I put up there uh
I didn't want to do a QR code because
people get kind of screamish QR codes
what do they call it now quing do people
do people use that term pushing
unironically I don't know but any event
so home.is for SL mail fraud I've got
slides and notes for everything uh up
there right uh on this on the there so
uh like I mentioned we're going to be
talking about business email compromise
business email compromise is when uh an
account is taken over and then uh
Financial crimes are committed um or
there's other you could do other aspects
of it like U stealing
information um using that access to gain
access to other systems by way of you
know sending an email uh as a as a
trusted partner or a vendor to uh
another party but uh to be honest like
with business email compromise it really
doesn't get a whole lot of attention I I
had a picture of the the the the guy
Bruno from Encanto I don't if you're
familiar with that movie we don't talk
about the EC just like they don't talk
about Bruno and the reason is kind of in
my opinion threefold so number one like
ransomware gets the news dos taxs get
the news and the reason why ransomware
gets the news is because it's a very uh
visceral crime it's got very real world
impact if you get hit with ransomware
your company's down for a week or two
weeks until you can restore from backups
or pay some guy from some unnamed
country who we won't call Russia uh a
lot of money to get your data back right
so ransomware is a very visible crime I
mean just like what was it um the
colonial pipeline when that got hit with
ransomware the the company itself
apparently uh the pipeline itself did
not get affected by the rans but was
because the accounting systems couldn't
count how much oil and petroleum are
going through the pipeline uh as a
result everybody was building trash bags
with gasoline whatever right but again
there's very real world effects
ransomware but comparatively business
Emil compromise it's just money I mean
we don't want to like if uh you get
scammed out of a couple hundred grand
you don't want to publicize it and it's
really not going to affect uh many
people outside of you know the the
finance department for the most part for
a lot of companies although I'll get to
it in a second it can be very costly
trime and thirdly um in the information
security space we like to talk about
what's sexy and what's hot and what's
cool in terms of exploits and uh D
hijack and this other thing business
compromise is a by by comparison it's a
very low Tech and low complexity crime
that does some social engineering but
really doesn't even need that much
Social Engineering and it's got a low
barrier to entry it's just you know not
very cyber security cool it's not like
it's not really like the hooded guy
sitting in the dark room being super
sneaky and stuff like that it's just
stealing money so it's not it doesn't
get the same sort of headlines because
of these factors that being said uh
there's numbers here and I apologize
that you can't really see the the words
and stuff like that but uh business
email compromise is the most well it
used to be the most costly computer
crime these are according to the FBI
internet uh crime complaint center ic3
um that number is actually 2022 at the
top I forgot to change the title there
sorry but um up until until up until
this year up until this year business
email compromise was the uh was the
cyber crime that had the highest
reported total losses to the FBI uh it
was actually surpassed this year by uh
investment scams uh cryptocurrency uh
primarily cryptocurrency was the the
scam that uh drove that over the top
there but nevertheless so um you're
looking at the numbers there so way down
by the bottom like almost a rounding
error uh the Blue Line uh is the second
line up from the bottom that's
ransomware uh that's about like about 50
$40 million whereas uh business email
compromise is between the TVs there and
it's about 2.5 $2.7 billion uh so that's
the reported numbers for business email
compromise if you're comparing the two
and then um investment fraud
cryptocurrency uh went over $3 billion
in reported uh losses uh last year that
being said the averages are still off
the charts like uh the average business
emo compromise was about 12 25,000 uh
per incident that was reported the FBI
so it's it's serious money that's being
lost in all these
things and you know there's some you
know like I said we there's not a whole
lot of news articles about it because a
lot of companies don't want to say to
the news that we got we got stole our
money stolen from us right um but you
look at some of these these are some
public information from some uh
municipalities um and states and um so
like Portland Oregon for instance
they've had two big ones for the past 5
years years uh this $1.4 million one uh
it was it was it was meant this $1.4
million was meant to go to um this $1.4
million was meant to go to uh housing
construction for uh for uh lower cost
housing and somebody got into the email
system of Portland Oregon and then as a
result uh they lost you know $1.4
million and you know these uh you know I
mentioned earlier that ranmore has a
very visceral effect to companies and
stuff like that but the the loss of
money can in fact have real world
impacts to real real people uh where you
see schools and cities and other
organizations uh losing quite a bit of
money there so how does business email
compromise happen well there's really
going to be you know four ways that a
bad guy can get access to to email and
we're going to talk through some of
those and we're going to do a little
demo hopefully later uh but the four
main ways that I kind of classify it is
uh credential theft uh session theft uh
which is also can be facilitated by
malware and then the fourth thing would
be application consent grants and we'll
talk about these a little bit so
credential theft um you know cred they
you know credential stuffing where
you're you're stealing you're stealing
credentials and you're logging into
systems with stolen usernames and
passwords uh the dark web um and like uh
there's also out there like with with
ransomware and other um other uh
Services you know there's actually a
whole crime ecosystem now whole crime
business ecosystem that can like that uh
you've got initial access brokers who
will steal usernames and passwords and
sell those um and then they will then
then you can buy those on the dark web
and then you'll be able to um use those
to get into whatever systems and
services uh those would have off uh
access to and you know there's a lot of
really uh novel attacks that you can do
for uh against organizations to uh gain
access to session tokens and malware uh
but most if not like I would say
probably 80 to 90% of the business email
compromises that I've worked have been
simple username and password uh getting
into the email um and so uh and then
also too there's also different ways to
talk about uh uh authentication and weak
access control like for instance uh with
Office 365 well they they they since
have disabled it but um it used to be
that with uh older email protocols like
IMAP or pop 3 uh those would use what's
called basic authentication and they
would not enforce multifactor so as soon
as you had a username password you could
use Thunderbird to pop into somebody's
Office 365 account you could download
all their email and it wouldn't and you
wouldn't even be prompted for MFA even
if they had MFA on since then uh
Microsoft has uh supposedly made it so
that they turned off basic
authentication by default but I've I've
had mixed experience that out in the
while so the next thing that we talk
about would be session St and I don't
know if you're familiar with this guy in
the back there but his name is lonus
he's got a YouTube channel and uh there
was a really uh there was a really
poignant video that he posted about a
week ago where uh there was a fishing
attack against his organization and that
fishing attack led to somebody getting a
session token and that session token was
then used to access their Gmail account
and their Google account and start
deleting videos out so um there's a
there's a lot of different different uh
ways to do such the uh there's I call
it's called machine the middle now they
used to call it man the middle which
kind of makes no sense because it's
computer computers are not men so
machine the middle attack is what they
call it now you can also call it cookie
token theft you can steal it out of
different applications um I've also seen
malware and malicious payloads being
used to steal to steal sessions so this
this this tool in particular evil Jinx
it's it's a malicious proxy uh there's a
b there's a bunch of different tools
like this out there evil Jinx is a a
very it's an open source and easy to use
I mean if I'm able to like type in a
couple things and cut change a couple
settings on a on a on a go Application
like evil Jinx it's pretty simple to use
uh but you know like I mentioned earlier
there's a whole um you know so like
there's a lot of companies nowadays are
doing like SAS ABS right software as a
service well there's also fishing as a
service vendors and they've got U
different Services called like evil
proxy and caffeine where on the dark way
web uh they can they will sell you
access to fishing kits that are
maintained and managed by uh more or
less a criminal Crow a criminal cloud
service so um uh these malicious proxies
are what a lot of times are being used
to inline steal uh session session
tokens and
cookies but then there's also not just
session session stealing in the browser
but there's also malware there's a
couple different variants that you can
use to to steal session tokens out of
the brow out of the browser but side
note does anybody know what that logo is
on the screen
there
anybody it's that's called electron uh
electron is a an application framework
that you use to build applications uh
that interact with the web think um if
you can build a a fat client on your
computer that then accesses a website
and um unlike say Google Chrome chromium
browsers uh electron apps are not very
well hardened at all and so uh does
anybody know of any electron apps off
the top of their
head yeah slack teams Discord all these
applications uh are electron apps and
just like you can steal tokens out of
the browser you can also steal tokens
out of slack out of teams out of Discord
any number of these electron apps on
your desktop you can steal tokens out of
those too and how would they get this
malare on there well for instance uh
with the liance tech tips uh somebody
uses simple fion a fishing campaign with
a a malicious payload a malicious PDF
That Was Then open to uh get on there
but then there's also two like um ad
poisoning uh in Google and other search
engines that nobody uses I don't think
but in Google specifically you can buy
ads and you can put your malare at the
top uh I've worked a couple of inst in
instances where you'd have like Redline
stealer and somebody uh would download a
cracked version of a software well they
got the cracked software but they also
got smoke loader on the computer and
then you can go through and you can
actually see where they they staged all
the where the where the tool
automatically staged all the session
tokens out of those browsers and then
uploaded them to usually Discord if not
telegram so um there's all sorts of
examples out there uh people also call
these all the time two banking Trojans
but that's a misnomer they're not just
for banking anymore they're for session
stealing they're for persistent access
they use them to resell to other folks
that they can then do ransomware there's
a whole bunch of different types of
malware that are used to steal access
but that's kind of the gist of malware
attacks and session tokens and and
business email compromise and then the
last way that um the last way that uh I
would see uh business Emil compromise
happening would be what's called
application consent Grant so um every
like you know on on the internet now
everything's like an application like so
for instance if you log in on your phone
uh using the default mail app on iOS or
Android uh what actually happened if
you're like logging into Office 365 it
actually creates an application consent
Grant in in Office 365 for iOS accounts
you can you can and so cuz your the
application on the phone is acting on
your behalf within the organiz within
Office 365 so what with uh everything
acting as an application you've got
application connection protocols like OA
that allow for consent grants between
them to allow one application to act on
your behalf and as we can see here with
this uh
with with this this fake app here uh
you're giving this application
permissions to act on your behalf in
office stre 65 to read and write files
read your calendar sign you in read your
profile uh and you know these can you
know be masked uh in various ways they
can make them look like a real
application and so it would kind of go
through the same process of a of fishing
email coming in and then once the
fishing email comes in then you would uh
click on this application and would say
hey can I access
can I access your office Street 65 or
Google application or slack or whatever
else can I access that on your paal and
sometimes with these application consent
grants they become extremely persistent
so for instance if you uh if you suspect
that a user's account is compromised
with that has a malicious application
installed and you just reset their
password and force them to sign out that
act of changing their password and
forcing them to sign out does not
actually remove the application consent
in in a lot of cases in which case
they're still going to be in there and
you're still going to have a
problem so when a business email
compromise happens and I I apologize I
didn't realize that these were so small
and also the Box all sorry but so when
when a business compromise happens uh
bad guys they're going to do a number of
different things to steal information
and then maintain persistence so for
instance mailbox RS uh if they are in
your mailbox and they're trying to uh
facilitate payment fraud by changing a
uh changing invoices or changing payment
instructions they're going to create
mailbox rules to hide the original
emails and then to manipulate manipulate
uh who can see the emails they might put
it in a a hidden folder they might
delete it um they might also forward
emails so they might gain access to a
compromise account and they might start
forwarding individual emails again using
mailbox rules to forward from your
address to an external address that they
control then they the as they're in the
account uh they might use that access to
start searching for senstive data so W2
information Social Security numbers
invoices all sorts of sensitive
information that they could then dump
out and monetize um and another thing
that they might do is payment
redirection so again if they have access
to invoices they might try to change
some of these invoices and make them so
instead of going to uh Wells Fargo Bank
they're going to Bank of America or they
might send it to some uh other uh
country or they might they they'll
change fire instructions if they can uh
another thing that they could do is
downloading the entire mailbox as I
mentioned earlier with uh for instance
older versions of Office 365 that did
not block basic authentication if they
had access if they if they want to they
could just use an IMAP account and log
into your Office 365 with Thunderbird or
some similar mail app and download a
copy of your whole mailbox then they
could use that for uh preex fishing
against some of your business partners
things like that um and then a big a big
one is account impersonation and
delegation abuse so what happens in this
case and this is like the me the
messiest types of business email
compromise is say for instance you have
an administrator and the administrator
account gets compromised then they're
going to go through your they're going
to try to maybe get into your exchange
exchange servers or your exchange admin
Center they're going to start delegating
permissions to other people's accounts
that's where it gets fun and that's
where it gets interesting because they
could they could be having conversations
with themselves in the mailboxes and
then they've got a whole paper trail
inside your email system saying uh that
Joe approved a transaction and Cheryl
and Cheryl was made aware of it well it
was all in their emails but it's all
kind of hidden from other people because
they're using mailbox rules to hide all
their transactions um and as a result um
people are none the wiser because it all
looks like it's coming from inside the
organization the calls are coming from
inside the house if you watched uh Mer's
talk yesterday about authentication
proxies and another thing that they
might do too to keep persistence is add
additional MFA methods so um for
instance in uh like a like OCTA breach
and other other breaches uh they would
add additional factors of multifactor
because um if you get if if they have
the password but they don't have the MFA
method they want they might want to come
back later so they might want to use
their MFA they might want to use their
uh Google Authenticator instead of your
Google Authenticator so what better way
to do that
then to then by adding MFA
so that's the initial part of here I'm
going to let's try to do a demo here
real quick so um yeah so this is uh this
is this this is our user uh his name's
Alex um he works for a company called
the business group and um he's got an
invoice here this is a legitimate
invoice and he's also got an email chain
with accounting person named Joanie here
and but he's got this uh this uh this
fishing email here that's just recently
come in uh from another vendor called
cooking computers and I'm going to see
if this will work here um unfortunately
I was having some troubles with my um
with my fishing earlier but hopefully
this will work but um so this right here
is actually going through our evil Jinx
server that uh that we talk about here
so as we can see up at the top we've got
login Microsoft online plasma funco and
so it's going to redirect us here so uh
Alex he saw this email come in and they
said oh well we've got new pricing
information on our SharePoint site why
don't you go ahead and check it out so
Alex is going to log into our SharePoint
site and then he's going to you know
enter the
password and the business group they're
super secure they've got MFA enabled so
they're like really secure right now so
let's log in with our MFA token
here got to wait here
for
reset okay um and then he's logged in
here and like I mentioned Alex got this
email from a vendor and he thinks uh
there's going to be some payment
information or new updates that's weird
there's nothing here he just logged into
office that's whatever Alex is done Alex
is done for a bit he's going to he's
going to go get some coffee so but in
the meantime we're going to go take a
look here and here's our attacker
computer and this is the console output
from Evil Jakes so let's look at our
sessions out so as we can see here we
got a new visitor coming in and they
landed um we've even got our password
Here um so we got what are sessions so
our sessions right now uh just to scroll
up so as I mentioned this is evil Jinx
um it's just running here on this server
and um sessions here's session
26 and as you can see on this on the
screen here this is the full
authentication token that you would use
to log in Office
365 and um what can we do with that
that's a great question like I said
we've got Alex's username name his
password his user agent so let's just
check this out so let's take a look at
our token here and this again this is
our attack computer this is not Alex's
computer let's go
to so we're going to office
here we're going to have our our
attacker log in office he's going to be
logging in with Alex here um but we
don't we want to use his token because
we want to act like Alex so let's go
ahead and uh Delete all of our cookies
here our Sesame Street would our Sesame
Street Monster Cookie Monster would be
absolutely Furious right now CU we just
lead a whole bunch of cookies uh but we
can import new ones that's
[Music]
okay so we deported our cookie that we
just that we stole out in the proxy we
refresh the
page and we're now Alex we are on a
completely different system and we are
now Alex so let's go see as our attacker
what Alex has in his
mailbox so again uh this is Tabby larasa
here as the attacker we don't know we
saw previously on Alex's screen that
he's got uh these conversations here so
our attacker he's logged in he sees oh
uh well there's a conversation uh with
Joanie here and he says Hey Jo and it's
out out of order here but hey Joanie
I've got some invoices this is actually
Alex talking to Joanie here and she says
hey Joanie I have a few questions about
some invoices uh should I just sent them
to you and she says yeah sure no problem
I can help him get those paid so uh he's
got kind of the internal structure of
how payments work in uh our attacker now
has instructions and information about
how internal payment structures work
with inside the business group here and
so then we see that Alex has this
morning received an invoice from a
vendor called the pla of fakey company
here so um and for the sake of brevity
here uh I see here that we've got uh you
know the invoice and uh I already
downloaded the I simulated downloaded
here so we've got um the real in so
here's our our real invoice here um and
as you can see we've got Plaza fund to
Alex wber at the business group uh quite
a bit of money here right
$240,000 and we've got uh wire
instructions for uh the business group
to wire money to the plaza fund at Wells
Fargo bank here so we've got Wells Fargo
Bank number here and our attacker he's
going to just uh go ahead and change
this invoice and so instead of going to
uh Well Fargo Bank uh now we're going to
go ahead and go to Bank of America to an
account that I control because I want
$240,000 that the business group is
going to send me here so let's go ahead
and we're going to first of all we're
going to check our our our other email
here and we're going to copy out what
they send here and then we're going to
create a
rule here cuz we don't want we don't
want Alex to
uh there so we're going to create a rule
cuz we don't want Alex to see this email
so we're going to we're just going to
say uh send all the emails from
accounting at plasm fund to the archive
folder CU we don't want Alex to see this
email here
then Emil's
gone and then in our our our private
email here we're going to send a new
email to
[Music]
Alex and then we're going to put our new
we're going to put our corrected invoice
in here because we want the money right
so let going to go
there and then we go back over to our
other while
they it's waiting here some junk huh
that's weird that's okay we got we can
we we don't think this is junk because
it's it's from us the attacker we trust
this email it's okay it's not
junk
[Music]
so now we got our new invoice here and
again because we know what our payment
instructions are for the organization
here we can reply back to Joanie and
say
[Music]
um
[Music]
got to attach our
invoice
so invoice
corrected obviously you know you
probably want to be a little less have a
little less brevity a little more
politeness but um invoice has made it
and then let's see
here I got Joanie she's got an email
[Music]
here and Joanie just uh confirmed that
this will be paid so uh our attacker is
just getting going to be receiving
$240,000 in their Bank of America
account so and that's that's business
email compromising nutshell that happen
uh for two $2.7 billion per year tens of
thousands of those incidents happen
every year it's it's a big deal and it's
like I said it's very very simple how
that
happens so you know we you know talked a
littleit about what the problem is we
talked about showing you how it works um
how do you protect against it well
normally with information security stuff
I don't like to say training is the
answer because a lot of these things
could be figured out with Technical
Solutions in fact you know side note I
was really nervous today because
Microsoft burned my domain but Lu I
could switch to Chrome worked just fine
so uh little little Pro tip there
Microsoft will try to burn your domains
if they're using the incorrect domain so
nevertheless one of the big things that
folks need to be start start talking
about cyber security is how how payment
transactions are happening how are we
maintaining
how to uh in particular dual authentic
dual authorization for changes to
financial TR transactions if you're not
if you're not asking about it your cyber
insurance carriers will be asking about
it I guarantee you also talk about uh
user awareness training again I don't
like to beat that horse but what you can
do is you can have you can teach users
how do you look in different platforms
like Google a wordp space Microsoft 365
you can look for your sign in history
and you can see like oh well
uh this uh this IP address or this
location is not where I'm supposed to be
that's kind of weird uh maybe I should
take a look that talk to cyber security
uh and also learn what suspicious URLs
look like again that's kind of a a mixed
bag uh because for instance you know
looking at like a Microsoft 365 login
URL that thing is long and confusing I
don't like them but uh like in this case
here it was going to like login.
microsoft. plasma fond.co whereas the
real URL is login microsoftonline.com so
making sure users are kind of familiar
with what they should be logging into is
important also tabletop exercises having
your organization go through routine
tabletop exercises as to how you would
handle a uh business email compromise
event uh is is eye opening for a lot of
folks and then also instant response
planning keeping making sure that you
have uh knowledge of you know how to
contact the FBI so that way then you can
get a secret service report the faster
you can get a report in then the more
that you can claw the money back in
these cases I've seen cases where the
Secret Service was able to successfully
claw back hundreds of thousands of
dollars that were stolen through these
types of transactions so making sure
that your instant response plan includes
how to contact the FBI to get a report
in can save you a lot of money if if
you're to lose in this way there's tons
of technical controls that you can talk
about here um I've got like two or three
slides but uh at the top there's fish
resistant MFA uh UV Keys things like
that um in this this case I mean as I as
I mentioned I was using like a Google
authenticator here for the business
group uh otps uh they're not very fish
resistant because you can you can type
those into any website whereas if you're
using like a uh UB key if you were to go
to uh plasma fund. which is our fishing
site a u key would not recognize that
they would say I'm not going to log you
into there so that would uh that would
prevent you from losing your session
token that way and then you know
implementing application consent Grant
workflows so making so that your
administrators are blocking uh new
applications from being installed in
Office 365 in Google uh workspace and
slack whever you know making sure that
you can block those new applications can
also uh prevent uh applications send uh
applications from stealing your emails
there's uh attachment filtering uh I
mean let's be frank here like the if you
should be just blocking zip files like
there's a there's a there's a there's a
group called iced ID out there uh they
always come come in with encrypted zip
files and there's no reason why you
should have legitimate zip files coming
into your organization spam filtering
again making sure that uh SPF dkim and
dmark are properly configured for your
organization and then starting to block
some of those messages that don't pass
those tests can help you to mitigate and
get rid of a lot of the low hanging
fruit when it comes to fishing
emails additional uh technical controls
conditional access making so that in
order to log into an account
uh you've got tools out there that will
say if this if this is coming from an
untrusted device or an untrusted
location don't allow it in the account
that can help if the session token is
stolen uh monitor for mail mail rule
changes start start creating alerts in
your systems whether it's you know
Office 365 your Sims uh Sentinel spunk
what have you start creating alerts for
if there's people that are changing
mailbox rules it could be noisy but at
the same time a lot of these mailbox
rules that get get uh put out there are
very um they're very noticeable when
when it happens and basically a lot of
times most the most of the malicious
mailbox rules that I saw would be like a
string of random characters or maybe
just like AAA and then it would say if
uh if it has invoice then put it in a
folder well those those sorts of things
should flag an alert and also monitoring
for suspicious logins and
activity um it's kind of difficult
depending on where folks are these days
that sort of maturity but that's another
thing to look at too and then the last
thing I would say about like technical
controls in email systems would be
segmenting your admin accounts um like I
mentioned earlier the messiest U the
messiest business email compromise I've
had to deal with are when the bad guys
got a hold of an admin account because
then they could like basically make
themselves into whoever was in the
organization and have conversations with
themselves untangling that is a mess but
the best way to do best way to handle
that is to segment your admin accounts
so that way then your high privilege
admin accounts don't even really have an
email address that's accessible
addressable from the outside world and
then using that uh and then um using a
daily driver account that does not have
privilege access for daily driver
activities like checking email and uh
going on website and stuff on the end
point uh EDR DNS filtering uh and then
disabling uh opening dangerous file Tes
by double clicks uh Microsoft Windows
has this weird thing where you can
double click a JS file and then it opens
I don't know why you want to do that on
Windows like not everybody's running
nodejs or anything like that so makes no
sense why it's a default so a best a
best practice there would be to uh
disable opening dangerous file types
like isos bhds JS files BBS files
disabling those where you can to prevent
those from being used and then if you're
a consultant or uh other sorts of cyber
security folks again like I mentioned
earlier start talking talking to your
Finance folks about what sort of payment
processes you have in place because
better you can understand how they do
payments the better you can help them
secure those processes so that your way
your organization is not losing money if
you're on a red team are you searching
for payment related information uh in
emails to kind of like put yourself out
there and say I'm looking for invoices
um are you creating any new mailbox
rules can you alert can you get them to
see that you're trying to create new
mailbox rules that could then flag on
and be indicative of becc activity are
you attempting to add MFA tokens and
factors like new OTP devices and things
like that these are the kinds of things
that BC actors are doing and if you can
start causing alerts as a red teamer
that can help your your blue team be
prepared so um yeah that's pretty much
all I've got uh again I got the the
short link there helm. is/ mailpro I'll
probably also put on LinkedIn too if you
want to you know find me on LinkedIn
I'll probably put it there too uh but
thanks everybody does anybody have any
questions or comments
here yeah so how can you help protect
your customers from being C that you're
sending invoices and making sure that
they're paying you and not an
adversary that's a great question so the
question was how can you prevent uh how
can you prevent customers from uh
committing invoice fraud and and
changing invoices well there's there's
there's a lot of good tools out there
here uh I mean so kind of the soft tool
would be again kind of you know just
having out of band Communications with
your customers and saying you know are
you sure that you wanted to make this
change to invoices and you know call
them back using known phone numbers uh
known email addresses you know not using
like maybe not using the phone number
that was in the email that they just
sent you but if you have historical
contact information you know calling
those sorts of numbers calling the main
office number uh for the organization
those are some ways to do it I've also
found that like some online platforms
like I don't know like bill.com those
are pretty good uh not to like you know
not to like talk a particular vendor or
whatever but I I found that when I was
working with customers that used
bill.com uh they had some really robust
kind of like uh know your customer and
know your uh in like invoice U
management tools that help them to
really kind of identify any changes that
might be uh naughty
so
well that's a good question so the the
question is uh how do you do instant
response and how do you know when to
respond to a business email compromise
and yeah I mean the first thing would be
that if you notice that uh money is not
going where it's supposed to be or
you're getting complaints from vendors
or customers that uh money is not going
where where it's supposed to be
definitely that's that's one way to uh
kind of you know when everything's kind
of out there um but then also to and so
to respond to it there's a number
there's a couple different things you
can look at um I I mentioned a couple
times during the talk cyber Insurance
cyber insurance is a big uh a big helper
in that regard because they can help you
help connect you with uh external
forensic firm if you don't have one if
like a lot of small businesses but even
if you're trying to like proactively
understand you know before the barn
before the horse Lees the barn before
the horse bolts the barn like you can
look for any sorts of uh Financial
Financial changes or work with your
Finance team to understand you know how
do they how do they know when there's
Financial changes how do they keep track
of invoices those sorts of
things all right well um thanks
everybody I'll stick around for a few
minutes to answer any uh cybar questions
but thanks you all been great thank
[Applause]
you