Feeds

New class of industrial-scale super-phishing emails threatens biz

Bulk messages are highly targeted and able to slip past defences

Internet Security Threat Report 2014

Security watchers are warning of a surge of highly convincing spear-phishing emails sent in bulk.

More than one in 10 recipients of these so-called longlining* messages click on links to compromised websites because the phishing email look utterly plausible, according to cloud-based security services firm Proofpoint.

The combination of tailored emails and mass volume means that cyber-criminals can cost-effectively send 10,000 or even 100,000 individual spear-phishing messages, all potentially capable of bypassing traditional security defences. This approach greatly improves odds of success and the ability to exploit zero-day security vulnerabilities in victims' PCs, Proofpoint warns.

Unlike conventional mass-mailing phishing lures, the 'hooks' (email messages) are highly variable rather than all identical. The body content also includes multiple mutations of an embedded URL, which points to an innocuous website to begin with but is then booby-trapped some time after the email is sent. Attackers can distribute thousands of email-borne malicious URL 'hooks' in a matter of hours, according to Proofpoint.

The company said that it has observed, documented and countered dozens of longlining attacks globally over the last six months. Victims are lured into visiting "drive-by downloads" websites that typically exploit browser, PDF and Java security vulnerabilities to install "rootkits" on vulnerable PCs.

No user action is required beyond clicking on the emailed URL and visiting a malicious website. In many cases system compromises were triggered when employees accessed corporate email accounts from home or on the road and sometimes using mobile devices.

One wave originating from Russia last October included 135,000 emails sent to more than 80 companies in a three-hour period. To avoid detection, the attacker used approximately 28,000 different IP addresses for its sending agents, 35,000 different 'sender' aliases, and more than twenty legitimate websites compromised to host drive-by downloads and zero-day-exploiting malware.

Because of the different agents, sender aliases, URLs, subject lines and body content, no single targeted organisation saw more than three emails with the same characteristics. All these characteristics meant the attack would fail to register as anything more than background noise and stood an excellent chance of making it past traditional signature and reputation-based anti-spam defences and secure gateway appliances as a result.

In another attack, approximately 28,800 messages were sent in multiple one-hour bursts to more than 200 enterprises. The campaign consisted of 813 unique compromised URLs sent from 2,181 different sending IPs. Again, each organization saw no more than three messages with identical content.

By using a distributed cloud of previously compromised machines and process automation to create high variance, attackers have been able to combine the stealth techniques and malicious payloads of spear-phishing with massively parallel delivery.

"With longlining, cyber-criminals are combining the stealth and effectiveness of spear phishing with the speed and scale of traditional phishing and virus attacks," said David Knight, executive vice president of product management for Proofpoint.

Proofpoint has published a whitepaper on longline phishing attacks which can be found here (registration required). ®

Bootnote

* Longlining is named after the industrial fishing practice of deploying miles-long fishing lines with thousands of individual hooks.

Beginner's guide to SSL certificates

More from The Register

next story
'Regin': The 'New Stuxnet' spook-grade SOFTWARE WEAPON described
'A degree of technical competence rarely seen'
You really need to do some tech support for Aunty Agnes
Free anti-virus software, expires, stops updating and p0wns the world
You stupid BRICK! PCs running Avast AV can't handle Windows fixes
Fix issued, fingers pointed, forums in flames
Regin: The super-spyware the security industry has been silent about
NSA fingered as likely source of complex malware family
Privacy bods offer GOV SPY VICTIMS a FREE SPYWARE SNIFFER
Looks for gov malware that evades most antivirus
Patch NOW! Microsoft slings emergency bug fix at Windows admins
Vulnerability promotes lusers to domain overlords ... oops
HACKERS can DELETE SURVEILLANCE DVRS remotely – report
Hikvision devices wide open to hacking, claim securobods
prev story

Whitepapers

Why and how to choose the right cloud vendor
The benefits of cloud-based storage in your processes. Eliminate onsite, disk-based backup and archiving in favor of cloud-based data protection.
Getting started with customer-focused identity management
Learn why identity is a fundamental requirement to digital growth, and how without it there is no way to identify and engage customers in a meaningful way.
How to determine if cloud backup is right for your servers
Two key factors, technical feasibility and TCO economics, that backup and IT operations managers should consider when assessing cloud backup.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Internet Security Threat Report 2014
An overview and analysis of the year in global threat activity: identify, analyze, and provide commentary on emerging trends in the dynamic threat landscape.