Connect with us

Cyber Security

Google Collection Phishing

Published

on

Written by Jeremy Fuchs, Cybersecurity Researcher/Analyst at Check Point Software Company

Google Collection is a cool tool that allows you to save links, images and videos and share them with others. In keeping with the spirit of the BEC 3.0 attacks, we’re going to highlight how hackers are using this tool to spread phishing. By leveraging the legitimacy of Google, hackers are able to hide malicious links within legitimate sites.

This BEC 3.0 attack is yet another way hackers are tricking users into giving up sensitive information. In this attack brief, Harmony Email researchers will discuss how hackers are using Google Collection to share phishing links.

In this attack, hackers are utilizing Google pages to send links to fake cryptocurrency sites.

  • Vector: Email
  • Type: Credential Harvesting
  • Techniques: Social Engineering, BEC 3.0
  • Target: Any end-user

The first email comes in a typical fashion, via a notification directly from Google. This is because the hacker shared the collection with the end user. The email comes from a no-reply@google.com address. That address is legitimate and would be recognized as such by hackers and end-users alike. Clicking on the link is also okay–hovering over the URL will show a legitimate Googe link. Going to the page below is also, you guessed it, a legitimate Google page.

Google collections work like above, with a number of different card-like figures. You can link to images, webpages, etc within that collection. Clicking on the card leads to the below page:

This is the link that they eventually want you to get to, which is a Google form. This will redirect to a fake cryptocurrency site, which will eventually steal money.

The bottom of the Google page tells an important distinction: “This content is neither created nor endorsed by Google.” What we’re saying here is critical: This isn’t to say that Google is now illegitimate or dangerous. Quite the contrary. But Google, like many sites, allows you to put any content on their page. Hackers are abusing this privilege by placing illegitimate, malicious sites.

To better ensure that their payloads get to their target, they are nesting it. It’s not in the first link in the email. It’s not in the second link that you click. It’s hidden in the third link. So yes, end-users have to get through all these links and layers, and that’s certainly not a guarantee.

But when they see Google link after Google link, the hesitancy might start to drop. And when the guard drops, users might be more free-wheeling with their mouse clicks. That’s the hope of BEC 3.0. It’s not trickery, but rather using what the user knows against them. Because it seems so standard–because it is so standard–users might be more willing to cooperate.

That, in turn, could lead to some real damage.  Check Point informed Google of this research on July 5th.

To guard against these attacks, security professionals can do the following:

  • Implement security that uses AI to look at multiple indicators of phishing
  • Implement full-suite security that can also scan documents and file
  • Implement robust URL protection that scans and emulates web pages

Cyber Security

CrowdStrike to Acquire Adaptive Shield

Published

on

CrowdStrike has announced it has agreed to acquire Adaptive Shield, a leading provider of SaaS security solutions. With this acquisition, CrowdStrike will be able to provide unified, end-to-end protection against identity-based attacks across the entire modern cloud ecosystem – from on-premises Active Directory to cloud-based identity providers and SaaS applications – delivered from a single, unified platform. Announced at Fal.Con Europe, CrowdStrike’s inaugural premier user conference in the region, this acquisition will position CrowdStrike as the leading provider of comprehensive protection across complex hybrid environments.

“CrowdStrike was built to tackle the toughest cybersecurity challenges, and we drive relentless innovation based on what our customers need to stay ahead of modern threats,” said George Kurtz, CEO and founder, CrowdStrike. “As SaaS and AI adoption grows, every new application brings additional complexity and the risk of misconfigurations across human and non-human accounts that create openings for sophisticated attacks. With the acquisition of Adaptive Shield, CrowdStrike will continue to set the standard for identity-based protection in the cloud, delivering best-in-class SaaS protection from the Falcon platform.”

Cloud exploitation cases grew by 110% last year, while identity-based attacks continue to rise – 75% of attacks to gain initial access are now malware-free. ‘Cross-domain’ adversaries, targeting identity and cloud, have numerous attack paths, from on-premises Active Directory to cloud-based identity providers and the growing landscape of SaaS applications. The complexity of modern hybrid cloud environments and disconnected security tools create protection gaps, making it difficult to prevent identity-based threats.

SaaS is projected to be the largest category of cloud computing in 2024, capturing more than 40% of all public cloud spending. Under the SaaS shared responsibility model, SaaS vendors provide security controls, while organizations manage configurations. In today’s complex environments, where hundreds of SaaS applications each come with unique access controls and identity configurations, security teams face significant challenges in maintaining visibility into who has access, what sensitive data is exposed, and active threats – even with purpose-built SaaS protection.

Adaptive Shield delivers the industry’s most complete security posture management and threat protection across SaaS identities, misconfigurations and data, stopping SaaS breaches. As an integrated component of the CrowdStrike Falcon cybersecurity platform, Adaptive Shield will equip CrowdStrike with the most advanced capabilities to stop identity-based attacks across all aspects of modern hybrid cloud environments. Customer benefits will include:

  1. Comprehensive SaaS Security Posture Management (SSPM): Organizations gain full visibility and governance over misconfigurations, the entitlements and activity levels of both human and non-human identities, and exposed data across 150+ SaaS applications. This new end-to-end visibility of identities across hybrid cloud environments gives operators a unique context for rapid cloud detection and response (CDR).
  2. GenAI Application Security Control: By continuously monitoring GenAI SaaS applications, Adaptive Shield empowers organizations to enforce consistent security standards by detecting configuration shifts, controlling AI settings to prevent data leakage, and identifying shadow AI applications to revoke access based on their risk profile. This approach ensures that AI-integrated applications remain aligned with security policies to protect sensitive data.
  3. Unified Hybrid Identity and Cloud Security: The powerful combination of Adaptive Shield and CrowdStrike Falcon Identity Protection will provide customers with comprehensive identity protection across SaaS, on-premises Active Directory and cloud-based environments (Okta and Microsoft Entra ID). CrowdStrike Falcon Cloud Security customers will also gain unified visibility and protection across the entire modern cloud estate – infrastructure, custom applications, data, AI models and SaaS applications – all from the same unified console and workflow.
  4. Existing Integration Accelerates Detection and Response: Adaptive Shield’s existing integration with CrowdStrike Falcon Next-Gen SIEM provides rapid first-party detection and response across multiple security domains – endpoints, identities, workloads and applications – automatically correlating detections inline with the latest threat intelligence and Falcon Fusion SOAR delivering near real-time response.

“Widespread adoption of SaaS applications has rapidly expanded the enterprise attack surface, as shared responsibility models and fragmented security controls make SaaS environments a prime target,” said Maor Bin, CEO and co-founder, Adaptive Shield. “Our mission perfectly complements CrowdStrike, stopping SaaS breaches while further accelerating consolidation on cybersecurity’s most comprehensive platform. I’m incredibly proud of our team for building the most advanced SaaS security solution, defining the market.”

Continue Reading

Cyber Security

Email Security Breach Rampant with 80% of Organisations Affected

Published

on

OPSWAT has released the 2024 Report: Email Security Threats Against Critical Infrastructure Organizations. This research was conducted with Osterman Research, known for its in-depth analysis and insights into emerging trends and technologies in IT security and data management. The study surveyed IT and security leaders working within critical infrastructure industries and revealed that 80% of organizations experienced an email-related security breach over the past year and 63.3% of respondents acknowledge that their email security approach needs to be improved.

Email is a necessary tool for communication and productivity across all sectors, but it is also the primary attack vector for cyber threats with attackers exploiting vulnerabilities through phishing attempts, malicious links, and harmful attachments. Once infiltrated, these threats can cascade through networks, jeopardizing both IT and operational technology (OT) environments. Alarmingly, more than half of respondents believed email messages and attachments to be benign by default, failing to realize inherent email risks.

Key takeaways from the research include:

  1. Up to 80% of organizations in critical infrastructure sectors have been the victim of an email security breach in the past 12 months: Per 1,000 employees, the organizations in this research experienced 5.7 successful phishing incidents per year, 5.6 account compromises, and 4.4 incidents of data leakage, among other types of email security breaches. Organizations in critical infrastructure sectors are highly attractive to cyber threat actors and are under constant attack.
  2. Email is the primary cybersecurity attack vector in critical infrastructure sectors: A median of 75% of cybersecurity threats against organizations in critical infrastructure sectors arrive via email. For two out of three organizations, the share of cybersecurity threats arriving by email ranges from 61% to 100%.
  3. Success metrics for email security are low: 48% of the critical infrastructure organizations in this research are not confident that their current email security protections are sufficient against email-borne attacks. Only 34.4% are fully compliant with the email-related regulations that apply to them, e.g., GDPR and other privacy regulations. And 63.6% are not confident that their approach to email security is best in class.
  4. Threat levels for all types of cybersecurity attacks are expected to increase, with phishing, data exfiltration, and zero-day malware attacks leading the way: Over 80% of organizations expect threat levels of all email attack types to increase or stay the same over the next 12 months.
  5. Most organisations do not approach email as malicious by default: More than half of the critical infrastructure organizations in this research operate from the assumption that messages and files are benign by default or attempt to operate from the flawed assumption that they are both benign by default and malicious by default. Many more firms need to embrace zero-trust approaches for email security.
  6. Organisations aspire to be dramatically better—and rapidly, too: While current email security efficacy metrics are low, aspirations run high for a dramatic and rapid shift. While only 52.0% of organizations are confident in their current email security protections, 74.8% aspire to reach this level within 12 months. In a similar vein, 84.8% of the organizations aspire to be at a place where their approach to email security protects them from emerging and as-yet-unknown email threats over the next 12 months.

“This survey findings emphasize the need to adopt a zero-trust mindset. The prevalence of email-related breaches poses a significant threat to critical infrastructure organizations, necessitating a shift to a stronger, prevention-based perimeter defence strategy against established communication and data exchange channels,” commented Yiyi Miao, Chief Product Officer at OPSWAT.

The survey responses also unveiled a major gap in advanced email security capabilities that preclude and prevent threats from reaching users’ inboxes. Essential measures such as Content Disarm and Reconstruction (CDR), URL scanning for malicious signals, and anomaly detection within email messages are notably absent in many organisations’ defences. In response to these critical challenges, OPSWAT reaffirms its commitment to equipping critical infrastructure organisations with cutting-edge, prevention-based cybersecurity solutions.

Continue Reading

Cyber Security

Positive Technologies Expands into ME and South Asia

Published

on

At GITEX GLOBAL 2024 Positive Technologies forged partnerships with cybersecurity service and solution providers from Saudi Arabia, the UAE, Egypt, and India. The primary goal of the cooperation is to share expertise in result-driven cybersecurity and promote cutting-edge cybersecurity products.

According to recent studies by Positive Technologies, more than half of all attacks on organizations in the Middle East target the public sector, industry, telecommunications, and IT companies. In the first half of 2024, the number of DDoS attacks in Gulf countries increased by 70% compared to the same period in 2023. Credentials for accessing the IT infrastructure of local companies are sold on dark web platforms, and two-thirds of all available credentials are offered for less than $1,000. Under such circumstances, Positive Technologies recommends building continuous, automated protection against organization-specific non-tolerable events.

“Companies in the region are very enthusiastic about our idea to automate cybersecurity processes with the help of MaxPatrol O2—a solution that automatically identifies cyberattack chains and responds to them,” said Evgeniya Popova, Director of International Business Development at Positive Technologies. “In addition, we receive a lot of interest from partners who specialize in specific areas, such as OT infrastructure security. They appreciate the scale and depth of our offer which includes PT ICS, a comprehensive solution for protecting the industrial IT and OT infrastructure. Our expertise in application security and secure development, incorporated in our product PT Application Inspector, is also in high demand.”

Evgeniya Popova also noted the geographical expansion of the company’s partner network: Positive Technologies is in the process of signing agreements with companies operating in and beyond the Middle East. Salem Baras, CEO of Innovative Solutions (Saudi Arabia), commented, “Positive Technologies has made a long-term commitment to further develop the overall cybersecurity capabilities in the region and enhance the quality of cybersecurity services and solutions. This is a significant advantage for us. As a leading cybersecurity provider in the GCC, we are partnering with Positive Technologies to build our capabilities and help our customers in the region to be protected. The cybersecurity market is evolving and facing numerous challenges, and it needs companies like Positive Technologies to grow and protect our future.”

“For the past two years, Positive Technologies has been our key partner in the UAE. As a leader in the country’s cybersecurity domain, we are keen to continue our partnership, promoting advanced technologies. Our main priorities are SOC operations and vulnerability management,” said Nishad Sukumaran, COO of NX Digital Technology (UAE).

Experts at Positive Technologies also report that the number of cyberattacks in India increased by 15% in 2023 and surged by 46% in Q2 2024. Over two-thirds of all attacks resulted in leakage of confidential information. So it’s no coincidence that it was in India that Positive Technologies launched a series of international meetups for cybersecurity experts on October 11, 2024.

“We are a value-added cybersecurity distribution company, and our mission is to provide the best technologies and services to our partners and clients. Positive Technologies is our like-minded partner on this path, and we are excited to expand our collaboration in the Middle East, Africa, and India,” said Jibu John, Founder and CEO of CyberDisti (India). Last year at GITEX GLOBAL 2023, Positive Technologies signed partnership agreements with several cybersecurity solution providers, including organizations from Bahrain and Singapore.

Continue Reading
Advertisement

Follow Us

Trending

Copyright © 2021 Security Review Magazine. Rysha Media LLC. All Rights Reserved.