printer friendly version

Are you a whale?

When it comes to finances it is easy to get people’s attention, as no person or business wants to see anything happen that will have a big financial impact. Unfortunately, finances are just as important to cybercriminals as they are to individuals and businesses.

Doros Hadjizenonos, country manager, Check Point South Africa.

What we need to remember is that cybercriminals are professional scammers who specialise in tricking users into helping them achieve their malicious goals. Attackers use many different tactics, including spam, phishing emails, and fake ads. In each case, the unsuspecting user plays an active role in his own victimisation when he clicks a link or opens an attachment. Even if organisations try to stay one step ahead of cyber criminals, they find new ways of exploiting people. Every time new security measures come along, cybercriminals somehow manage to find a way to overcome them.

The hunt for high profile business targets

We are currently seeing a new form of phishing attack known as ‘whaling’ attacks, also called Business Email Compromise (BEC). A form of elaborate spear phishing, whaling usually targets C-level executives, i.e. the ‘big fish’. Usually, perpetrators send emails to a company’s CFO masquerading as legitimate correspondence from the CEO. Typically, the messages request that the CFO transfer money to a specific bank account. When the scheme is finally uncovered, the money is long gone.

Whaling attacks evolved from online banking frauds, which are a far simpler type of cybercrime. In banking frauds, the attacker steals a victim’s banking credentials and uses them to transfer small amounts of money. Their modus operandi was to systematically target as many private users as possible and steal a small amount from each one, knowing that banks wouldn’t authorise large funds transfers from private customers.

This was a very successful operation at first. Over time, both banks and users gradually became more aware of the threat and implemented stricter security measures, such as multi-factor authentication and IP monitoring to mitigate, but not eliminate, these attacks.

Attackers realised that the effort needed to overcome these complex security measures was not worthwhile, as the return on investment was relatively low. As a result, phishing attack methods became more sophisticated and targeted, leading to the development of whaling attacks.

Given their highly targeted nature, whaling attacks require a relatively long and extensive reconnaissance phase, because so much information about the target company is needed. However, when they are successful, they yield far greater profits, as these ‘big fish’ regularly make money transfers worth millions of dollars.

A growing and imminent threat

According to an FBI report, whaling attacks between October 2013 and February 2016 reached an astonishing cost of more than $2.3 billion, with 17 642 victims. These are almost unbelievable numbers, which emphasises the seriousness of these attacks. As a comparison, an FBI report covering the time period from October 1, 2013 to December 1, 2014 stated a total loss of more than $200 million and 2126 victims. While also a significant amount of money, it is clear there has been enormous growth both in the number of victims and in the damage caused in recent years.

How can businesses deal with this threat?

As scary as these attacks sound, there are several security measures that can help you avoid them.

• White and black listing. Security vendors create blacklists of fake domains, C&C servers, and any other unique identifier for known attacks. Once an email from a fake domain reaches you, a security warning will appear. Whitelists are created using similar, though reversed, concepts. They contain only trusted domains that will be permitted.

• More comprehensive authentication solutions. Multi-factor authentication is the best and makes it much harder for perpetrators to steal certifications or impersonate legitimate users to infiltrate your systems.

• Behavioural detection. This method is based on machine learning patterns of behaviour in an organisation and detects anomalies in the pattern, which may be caused by phishing.

• Reduce the information flow. Try to minimise the information you publish regarding your employees and planned future transactions. Attackers can easily use such information to make their phishing attempts appear authentic.

• More rigorous policies. Implement strict and clear policy measures that state exactly who is allowed to order transactions and what kind of authentication is needed for such an order. By putting these procedures in place and effectively communicating them to all employees (only), you can minimise the possibility of an outsider successfully infiltrating your company’s accounts.

Share this article:

Further reading: