Feeds

New class of industrial-scale super-phishing emails threatens biz

Bulk messages are highly targeted and able to slip past defences

Internet Security Threat Report 2014

Security watchers are warning of a surge of highly convincing spear-phishing emails sent in bulk.

More than one in 10 recipients of these so-called longlining* messages click on links to compromised websites because the phishing email look utterly plausible, according to cloud-based security services firm Proofpoint.

The combination of tailored emails and mass volume means that cyber-criminals can cost-effectively send 10,000 or even 100,000 individual spear-phishing messages, all potentially capable of bypassing traditional security defences. This approach greatly improves odds of success and the ability to exploit zero-day security vulnerabilities in victims' PCs, Proofpoint warns.

Unlike conventional mass-mailing phishing lures, the 'hooks' (email messages) are highly variable rather than all identical. The body content also includes multiple mutations of an embedded URL, which points to an innocuous website to begin with but is then booby-trapped some time after the email is sent. Attackers can distribute thousands of email-borne malicious URL 'hooks' in a matter of hours, according to Proofpoint.

The company said that it has observed, documented and countered dozens of longlining attacks globally over the last six months. Victims are lured into visiting "drive-by downloads" websites that typically exploit browser, PDF and Java security vulnerabilities to install "rootkits" on vulnerable PCs.

No user action is required beyond clicking on the emailed URL and visiting a malicious website. In many cases system compromises were triggered when employees accessed corporate email accounts from home or on the road and sometimes using mobile devices.

One wave originating from Russia last October included 135,000 emails sent to more than 80 companies in a three-hour period. To avoid detection, the attacker used approximately 28,000 different IP addresses for its sending agents, 35,000 different 'sender' aliases, and more than twenty legitimate websites compromised to host drive-by downloads and zero-day-exploiting malware.

Because of the different agents, sender aliases, URLs, subject lines and body content, no single targeted organisation saw more than three emails with the same characteristics. All these characteristics meant the attack would fail to register as anything more than background noise and stood an excellent chance of making it past traditional signature and reputation-based anti-spam defences and secure gateway appliances as a result.

In another attack, approximately 28,800 messages were sent in multiple one-hour bursts to more than 200 enterprises. The campaign consisted of 813 unique compromised URLs sent from 2,181 different sending IPs. Again, each organization saw no more than three messages with identical content.

By using a distributed cloud of previously compromised machines and process automation to create high variance, attackers have been able to combine the stealth techniques and malicious payloads of spear-phishing with massively parallel delivery.

"With longlining, cyber-criminals are combining the stealth and effectiveness of spear phishing with the speed and scale of traditional phishing and virus attacks," said David Knight, executive vice president of product management for Proofpoint.

Proofpoint has published a whitepaper on longline phishing attacks which can be found here (registration required). ®

Bootnote

* Longlining is named after the industrial fishing practice of deploying miles-long fishing lines with thousands of individual hooks.

Top 5 reasons to deploy VMware with Tegile

More from The Register

next story
UK smart meters arrive in 2020. Hackers have ALREADY found a flaw
Energy summit bods warned of free energy bonanza
DRUPAL-OPCALYPSE! Devs say best assume your CMS is owned
SQLi hole was hit hard, fast, and before most admins knew it needed patching
Knock Knock tool makes a joke of Mac AV
Yes, we know Macs 'don't get viruses', but when they do this code'll spot 'em
Feds seek potential 'second Snowden' gov doc leaker – report
Hang on, Ed wasn't here when we compiled THIS document
Mozilla releases geolocating WiFi sniffer for Android
As if the civilians who never change access point passwords will ever opt out of this one
Why weasel words might not work for Whisper
CEO suspends editor but privacy questions remain
prev story

Whitepapers

Why cloud backup?
Combining the latest advancements in disk-based backup with secure, integrated, cloud technologies offer organizations fast and assured recovery of their critical enterprise data.
Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
New hybrid storage solutions
Tackling data challenges through emerging hybrid storage solutions that enable optimum database performance whilst managing costs and increasingly large data stores.
Reducing the cost and complexity of web vulnerability management
How using vulnerability assessments to identify exploitable weaknesses and take corrective action can reduce the risk of hackers finding your site and attacking it.