Feeds

New class of industrial-scale super-phishing emails threatens biz

Bulk messages are highly targeted and able to slip past defences

Securing Web Applications Made Simple and Scalable

Security watchers are warning of a surge of highly convincing spear-phishing emails sent in bulk.

More than one in 10 recipients of these so-called longlining* messages click on links to compromised websites because the phishing email look utterly plausible, according to cloud-based security services firm Proofpoint.

The combination of tailored emails and mass volume means that cyber-criminals can cost-effectively send 10,000 or even 100,000 individual spear-phishing messages, all potentially capable of bypassing traditional security defences. This approach greatly improves odds of success and the ability to exploit zero-day security vulnerabilities in victims' PCs, Proofpoint warns.

Unlike conventional mass-mailing phishing lures, the 'hooks' (email messages) are highly variable rather than all identical. The body content also includes multiple mutations of an embedded URL, which points to an innocuous website to begin with but is then booby-trapped some time after the email is sent. Attackers can distribute thousands of email-borne malicious URL 'hooks' in a matter of hours, according to Proofpoint.

The company said that it has observed, documented and countered dozens of longlining attacks globally over the last six months. Victims are lured into visiting "drive-by downloads" websites that typically exploit browser, PDF and Java security vulnerabilities to install "rootkits" on vulnerable PCs.

No user action is required beyond clicking on the emailed URL and visiting a malicious website. In many cases system compromises were triggered when employees accessed corporate email accounts from home or on the road and sometimes using mobile devices.

One wave originating from Russia last October included 135,000 emails sent to more than 80 companies in a three-hour period. To avoid detection, the attacker used approximately 28,000 different IP addresses for its sending agents, 35,000 different 'sender' aliases, and more than twenty legitimate websites compromised to host drive-by downloads and zero-day-exploiting malware.

Because of the different agents, sender aliases, URLs, subject lines and body content, no single targeted organisation saw more than three emails with the same characteristics. All these characteristics meant the attack would fail to register as anything more than background noise and stood an excellent chance of making it past traditional signature and reputation-based anti-spam defences and secure gateway appliances as a result.

In another attack, approximately 28,800 messages were sent in multiple one-hour bursts to more than 200 enterprises. The campaign consisted of 813 unique compromised URLs sent from 2,181 different sending IPs. Again, each organization saw no more than three messages with identical content.

By using a distributed cloud of previously compromised machines and process automation to create high variance, attackers have been able to combine the stealth techniques and malicious payloads of spear-phishing with massively parallel delivery.

"With longlining, cyber-criminals are combining the stealth and effectiveness of spear phishing with the speed and scale of traditional phishing and virus attacks," said David Knight, executive vice president of product management for Proofpoint.

Proofpoint has published a whitepaper on longline phishing attacks which can be found here (registration required). ®

Bootnote

* Longlining is named after the industrial fishing practice of deploying miles-long fishing lines with thousands of individual hooks.

Mobile application security vulnerability report

More from The Register

next story
NEW, SINISTER web tracking tech fingerprints your computer by making it draw
Have you been on YouPorn lately, perhaps? White House website?
HIDDEN packet sniffer spy tech in MILLIONS of iPhones, iPads – expert
Don't panic though – Apple's backdoor is not wide open to all, guru tells us
LibreSSL RNG bug fix: What's all the forking fuss about, ask devs
Blow to bit-spitter 'tis but a flesh wound, claim team
Black Hat anti-Tor talk smashed by lawyers' wrecking ball
Unmasking hidden users is too hot for Carnegie-Mellon
Manic malware Mayhem spreads through Linux, FreeBSD web servers
And how Google could cripple infection rate in a second
NUDE SNAPS AGENCY: NSA bods love 'showing off your saucy selfies'
Swapping other people's sexts is a fringe benefit, says Snowden
Own a Cisco modem or wireless gateway? It might be owned by someone else, too
Remote code exec in HTTP server hands kit to bad guys
prev story

Whitepapers

Reducing security risks from open source software
Follow a few strategies and your organization can gain the full benefits of open source and the cloud without compromising the security of your applications.
Consolidation: The Foundation for IT Business Transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.
Application security programs and practises
Follow a few strategies and your organization can gain the full benefits of open source and the cloud without compromising the security of your applications.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.
Consolidation: the foundation for IT and business transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.