Feeds

New class of industrial-scale super-phishing emails threatens biz

Bulk messages are highly targeted and able to slip past defences

5 things you didn’t know about cloud backup

Security watchers are warning of a surge of highly convincing spear-phishing emails sent in bulk.

More than one in 10 recipients of these so-called longlining* messages click on links to compromised websites because the phishing email look utterly plausible, according to cloud-based security services firm Proofpoint.

The combination of tailored emails and mass volume means that cyber-criminals can cost-effectively send 10,000 or even 100,000 individual spear-phishing messages, all potentially capable of bypassing traditional security defences. This approach greatly improves odds of success and the ability to exploit zero-day security vulnerabilities in victims' PCs, Proofpoint warns.

Unlike conventional mass-mailing phishing lures, the 'hooks' (email messages) are highly variable rather than all identical. The body content also includes multiple mutations of an embedded URL, which points to an innocuous website to begin with but is then booby-trapped some time after the email is sent. Attackers can distribute thousands of email-borne malicious URL 'hooks' in a matter of hours, according to Proofpoint.

The company said that it has observed, documented and countered dozens of longlining attacks globally over the last six months. Victims are lured into visiting "drive-by downloads" websites that typically exploit browser, PDF and Java security vulnerabilities to install "rootkits" on vulnerable PCs.

No user action is required beyond clicking on the emailed URL and visiting a malicious website. In many cases system compromises were triggered when employees accessed corporate email accounts from home or on the road and sometimes using mobile devices.

One wave originating from Russia last October included 135,000 emails sent to more than 80 companies in a three-hour period. To avoid detection, the attacker used approximately 28,000 different IP addresses for its sending agents, 35,000 different 'sender' aliases, and more than twenty legitimate websites compromised to host drive-by downloads and zero-day-exploiting malware.

Because of the different agents, sender aliases, URLs, subject lines and body content, no single targeted organisation saw more than three emails with the same characteristics. All these characteristics meant the attack would fail to register as anything more than background noise and stood an excellent chance of making it past traditional signature and reputation-based anti-spam defences and secure gateway appliances as a result.

In another attack, approximately 28,800 messages were sent in multiple one-hour bursts to more than 200 enterprises. The campaign consisted of 813 unique compromised URLs sent from 2,181 different sending IPs. Again, each organization saw no more than three messages with identical content.

By using a distributed cloud of previously compromised machines and process automation to create high variance, attackers have been able to combine the stealth techniques and malicious payloads of spear-phishing with massively parallel delivery.

"With longlining, cyber-criminals are combining the stealth and effectiveness of spear phishing with the speed and scale of traditional phishing and virus attacks," said David Knight, executive vice president of product management for Proofpoint.

Proofpoint has published a whitepaper on longline phishing attacks which can be found here (registration required). ®

Bootnote

* Longlining is named after the industrial fishing practice of deploying miles-long fishing lines with thousands of individual hooks.

Secure remote control for conventional and virtual desktops

More from The Register

next story
One HUNDRED FAMOUS LADIES exposed NUDE online
Celebrity women victimised as Apple iCloud accounts reportedly popped
Rubbish WPS config sees WiFi router keys popped in seconds
Another day, another way in to your home router
Goog says patch⁵⁰ your Chrome
64-bit browser loads cat vids FIFTEEN PERCENT faster!
NZ Justice Minister scalped as hacker leaks emails
Grab your popcorn: Subterfuge and slur disrupts election run up
NIST to sysadmins: clean up your SSH mess
Too many keys, too badly managed
Scratched PC-dispatch patch patched, hatched in batch rematch
Windows security update fixed after triggering blue screens (and screams) of death
Researchers camouflage haxxor traps with fake application traffic
Honeypots sweetened to resemble actual workloads, complete with 'secure' logins
Attack flogged through shiny-clicky social media buttons
66,000 users popped by malicious Flash fudging add-on
New Snowden leak: How NSA shared 850-billion-plus metadata records
'Federated search' spaffed info all over Five Eyes chums
prev story

Whitepapers

Endpoint data privacy in the cloud is easier than you think
Innovations in encryption and storage resolve issues of data privacy and key requirements for companies to look for in a solution.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Advanced data protection for your virtualized environments
Find a natural fit for optimizing protection for the often resource-constrained data protection process found in virtual environments.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.
Next gen security for virtualised datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.