Gilbert Chickli is an international cyberattacker specialized in this kind of scam. He has a huge team and he was able to steal millions of euros. His method is still in use today.
There is movie about his life: Je Compte sur Vous
- BEC attackers rely heavily on social engineering tactics: attackers carefully research and closely monitor their potential target victims and their organizations
- Often, they impersonate CEO or any executive authorized to do wire transfers
- Some of the sample email messages have subjects containing words such as request, payment, transfer, and urgent, among others
Question: this only work in a very precise moment: near the end of the service, when billing is about to be exchanged and trust is already built between the two parties. How does the attacker now about the perfect moment?
- Infiltration
- Luck
- Assistance from an insider
- Patience
If the attacker infiltrates the infrastructure, most probably, all real emails between the two parties are going to "disappear". Check for automatic mail rules!. Beware: the compromised infrastructure maybe the victim's infrastructure or the other end of the communication!
Impersonation example: man-in-the-middle
The attacker sends an email to both ends with similar addresses but not quite the same. The text is "send further communications to..." or the "reply-to address is changed. i.e
Corporate or publicly available email accounts of employees related to finance are either spoofed or compromised
Objective: get an "email thread" where the other party is not involved
Beware: The attacker may impersonate several people: several accounts in CC, from several people...
Most communications are transparently passed from one channel to the other: you won't find anything strange in the communication apart from the fake address
The attacker intervenes when billing information is exchanged: in this moment, he/she presents her/his bank account
This is another type of this fraud. In this case, all mails are fake. There is no need to compromise the infrastructure. Acting skills are required.
backpground: https://www.pexels.com/photo/question-marks-on-paper-crafts-5428832/ Leeloo the first, free to use
When an attacker access an account, he forwards emails to his own account. He is not interested only in past emails, also in future emails: when a deal is going to be closed, is there any additional email thread I must be aware...
Most of the times, they even hide this emails. His objective is that the victim won't receive any email from the other side, he is going to control all emails.
Notice: you MUST check digital signatures, is not not enough to see them: they can be a drawing!
BlueLiv is a company from Barcelona specialized in Threat Intelligence. If I'm not mistaken, they have open positions for students
This is an example of mailvelope, a commertial solution for Gmail
Ideally, we should be able to protect emails from one side to the other. Since PGP is not well implemented out of companies, the current solution is protecting an email when they travel between servers, and trust in the authentication methods used by the servers to protect the final link to the users
Process to send an email:
1. a user sends the email to the mail server controlled by his company
2. the sender email sender sends the email to the receiver server. Here, it is possible to have several "jumps" between different servers due to aliases, groups or forwards.
3. The receiver server sends the email to the final recipients
Three tecnologies protect the communications between servers: SPF, DKIM and DMARC
Image source: > https://statics.esputnik.com/photos/shares/Blog/images/AMP/image4.png
Tool in the screen: mxtoolbox
Command line: dig universidadviu.com TXT
"b" is the digital signature
Warning: since emails without SPF/DKIM are going to be classified as spam or suspicious, the sender could request whitelisting them in your email system
Do not whitelist emails "from mycompany.com" if mycompany.com has not configured SPF!!. No SPF means anyone can send emails "from mycompany.com" and you cannot distinguish good from bad emails
- Los malos pueden configurar también sus servidores
- estos mecanismos no te protegerán contra direcciones "parecidas"
- SPF y DKIM solo autentican desde el servidor. ¿Quién estaba realmente escribiendo el mensaje?
- Si el atacante ha conseguido crear cuentas: b0ss@company.com también pasará el DKIM de company.com
- Si el atacante ha conseguido las credenciales de boss@company.com pasará el DKIM de company.com