The cable TV channel H2 is running a mini-series on the human mind - Your Bleeped Up Brain. The series is truly fascinating. While we think our heads contain a highly precise computer, it turns out that the ball of matter inside our heads is good at navigating life, but not very good at discerning fine details out of a complex environment. For those us of in the cybersecurity world, the last episode - Deception - is particularly interesting. In Deception, the show presents several examples of how the brain takes incomplete or inaccurate information and completes the story to [...]
Eric Fiterman of Rogue Networks/Methodvue demonstrates how to construct a malicious email that effectively impersonates President Obama. Using malware delivered in an attachment, Fiterman takes control of the recipient’s computer. Watch as he steals passwords, searches for files and even takes a picture of his victim using the computer’s camera. What permits Fiterman to infiltrate this computer? The recipient can't distinguish a real email from the President from a fake email from the President. People need to know if an email is really from the President. They need to know if an email is really from a co-worker. SP Guard from Iconix [...]
In a recent article entitled Phishing Is the Internet’s Most Successful Con, the Atlantic observes: Phishing doesn’t attack computers. It attacks the people using computers. The Sting - The Art of the Con Cormac Herley, a principal researcher at Microsoft Research, observes in the article: Many security-professional and media recommendations exhort eternal vigilance, paying attention to every detail. This is terrible advice. I’m a professional with years of experience in this space and I don’t bother to inspect my emails or carefully read all my URLs: I have things to do. As a strategy for the constant level of [...]
Prof. Arun Vishwanath, Iconix's Science Advisor, was recently published by CNN. In his article, Spear phishing has become even more dangerous, Prof. Vishwanath discusses how threat actors take advantage of several weaknesses of procedures on the Internet, and the vulnerabilities are growing worse. He highlights how tricking users is an important element of these evil plots.
Read about How Cyber Awareness Training Helps Threat Actors in an article we contributed to the Small Wars Journal. The authors discuss how threat actors combine their knowledge of cyber awareness training with the abuse of technology to create effective cyber attacks.
The United States Patent and Trademark Office has issued Iconix's ninth patent titled "Rapid Identification of Message Authentication." The abstract for U.S. Patent 10,063,545, dated August 28, 2018, states: "Techniques are presented for uniquely identifying authentication associated with messages. A message is inspected for sender or domain identifying information associated with a sender of the message or a sender's domain. The identifying information is authenticated, and if authentication, then distinctive metadata is associated with the message. The distinctive metadata is presented or played in connection with the message for purposes of readily identifying the authentication.” Prof. Arun Vishwanath, Iconix’s Science [...]
Recent press reports tell us that Google has solved the phishing problem. These stories trace their source back to a posting on KrebsonSecurity dated July 23, 2018, entitled Google: Security Keys Neutralized Employee Phishing. Krebs summarizes the solution: The basic idea behind two-factor authentication is that even if thieves manage to phish or steal your password, they still cannot log in to your account unless they also hack or possess that second factor. This is clearly an important protection against a particular subset of the phishing problem -- use of stolen credentials. But it hardly neutralizes phishing. The day after describing [...]
On July 13, 2018, the Special Counsel indicted 12 Russian GRU agents for interfering in the 2016 U.S. presidential election. The indictment provides a detailed description of how spearphishing works. For example, paragraph 21 of the indictment states, ANTONOV, BADIN, YERMAKOV, LUKASHEV, and their co-conspirators targeted victims using a technique known as spearphishing to steal victims’ passwords or otherwise gain access to their computers. Beginning by at least March 2016, the Conspirators targeted over 300 individuals affiliated with the Clinton Campaign, DCCC, and DNC. Spearphishing attacks systems by attacking the users. SP Guard provides users with defenses against these attacks.
Today our OpEd, DMARC Will Not Make Email Secure, was published in Infosecurity Magazine. We hope you find it interesting.
On May 7, 2018, the FBI published its report of online crimes, 2017 Internet Crime Report. This vis summaries the FBI's findings: The largest losses were attributed to the Business Email Compromise/Email Account Compromise in which the victim is tricked into sending money to criminals. This crime is almost exclusively committed using deceptive emails. Deceptive emails are also used to commit other internet crimes such as data breaches, identity theft, phishing, and ransomware. SP Guard fights email deception by helping users identify suspicious emails.
The FBI warns that cyber criminals are sending phishing emails that impersonate the FBI! Why does this scam work? Because it is easy for cyber criminals to create very convincing emails that appear to come from the FBI. The FBI gives some examples here. How big a problem is fake email? What are the big cyber crime problems? Check in next week when we discuss the FBI's recently released 2017 Internet Crime Annual Report.
Today the House Permanent Select Committee on Intelligence released its Report on Russian Active Measures. This report describes the measures the Russians took to interfere in elections in the United States and Europe. Starting on page 22 and ending on page 28 the Committee explains in detail how the Russians conducted their cyberattacks. With the exception of the introductory and concluding text, the only unredacted materials are this box on page 23: And the caption "Attribution is a Bear" on page 26. A discussion of Guccifer, a Russian hacking persona, follows the redacted discussion of how the Russians conducted their [...]