Business Email Compromise (BEC)

What is it, how does it work and how can we stop it?

What is Business Email Compromise?

Business Email Compromise (BEC) attacks, which are attacks that take over a victim’s email account and provide access to all of their emails, address books and often much more, usually involve social engineering techniques, such as the use of a previously-stolen email account of someone else the victim has previously communicated with (another victim in their own right; they seldom realize it has even happened until someone tells them) or a spoofed email address from an organization that the recipient might trust, like a well known bank or e-commerce website, with examples like Wells Fargo and Amazon being the two most common.

The attacker’s goal is to trick an employee into bypassing the regular procedures of the organization to either steal money directly or to gain access to other valuable assets, such as administrative permissions to internal systems. The cybercriminal may then steal funds by misdirecting electronic payments or steal sensitive data such as tax or payroll information for later resale on the Dark Web. They may also convince the employee to open a malicious link or attachment, provide a password for further infiltration into the organization or approve access elsewhere.

Almost every successful attack will incorporate data exfiltration, such as a copy being made of the compromised user’s mailbox and everything in it, for later mining of other privileged information that can be used for future spearphishing attacks or other system compromises. System and account logins saved in email are solid gold in these situations.

With this grounding in what BEC is, let’s talk about the common attack paths first.

Phase One: The Subterfuge that leads to Initial Access

  • Cybercriminals may use a phishing email that looks like it came from a trusted address, like a well-known company or perhaps even someone the victim does business with already, such as a vendor or customer.

    These phishing emails may come from an entirely unrelated domain than what the email address looks like it is from, such as a domain that is insecure from lacking protections like SPF, DKIM and DMARC, or it could be from the email account of someone who was actually compromised by an attacker.

  • A cybercriminal will create a fake website or email domain to impersonate a trusted business or person.

    These domains are designed to look legitimate at first glance, with only very subtle differences from the domain of the impersonated organization.

    Lookalike domains like “micr0soft.com” instead of “microsoft.com”, using a zero or accented characters to try and look just like a common domain users see every day, are exceedingly common - and dangerously effective.

    Having the intended victim try and log into this fake website using their email credentials is when the compromise occurs. Note that several forms of MultiFactor Authentication can be breached this way also; it’s not 100% bulletproof.

Phase Two: Surveillance of the Victim’s Communications

  • With the now-compromised user account, the attacker is free to begin reading through their old emails for additional credentials that may give them additional avenues of attack.

    Items like the address book will be harvested at this point to help design a framework or organization chart to then begin the next steps of their assault.

  • With regular access to the user’s mailbox, the cybercriminal can start monitoring ongoing communications, particularly ones around invoices, payments or payroll.

  • The cybercriminal will almost always take additional steps to obfuscate their activities, such as setting up mail forwarding rules so that the compromised user account never sees certain conversations in their Inbox.

    Often, the rules will redirect messages to other folders within the mailbox, like the frequently unused RSS Feeds folder.

Phase Three: Executing the Fraud

  • Masquerading as the compromised user, the cybercriminal now uses the inherent trust of their assumed persona and role to bypass the normal procedures at the organization, both operational and security, to get what they came for: the money.

    This can take form in multiple different ways; read on for some common examples.

  • CEOs or other high level officers are exceedingly common targets due to their power at the company.

    In these situations where a CEO-level account gets compromised, the cybercriminal will instruct an employee (usually in Accounting, but they can be elsewhere) to make an immediate payment to an account controlled by the attacker, often in service of some confidential business or service the ‘CEO’ needs.

    In other variations, the cybercriminal will request an employee to purchase gift cards and send them the codes.

  • The compromised account of a vendor or supplier to the organization can be used by a cybercriminal to instruct an Accounts Payable employee to change the payment instructions for an electronic payment, so that it routes to an account controlled by the cybercriminal.

    Money can be lost by your organization due to a vendor who had insufficient security for their own employees, making even trusted suppliers potential risks.

  • In keeping with supply chain attacks like a vendor being compromised, the cybercriminal may send fraudulent invoices that misdirect payments to accounts that the attacker controls.

  • For compromised lower-level employees, the cybercriminal may instruct an employee in Human Resources to change their Direct Deposit account information for the employee’s pay.

  • Significantly more challenging but with way higher payout opportunities, the cybercriminal may impersonate several employees and take out large loans in their name (especially possible with compromised Payroll and Human Resources employees and the information they hold).

    The losses here can be particularly staggering.

How to Protect against Business Email Compromise Attacks

With that understanding of how BEC events occur and how the damage often plays out, let’s give due time to the defenses that can stop these assaults before they even happen. Cybersecurity is best considered as a defense-in-depth strategy, with multiple layers of protections covering various gaps that other layers cannot always shield against. These have been divided up into three sections below:

  1. Umbrella Defenses, for the first line of outright prevention.

  2. Technology Policy, where good IT-driven hygiene limits potential compromises.

  3. Human Training, where smart internal processes prevent a compromise from causing much harm.

Investment in all three layers is strongly recommended for a well rounded defense that can withstand most attacks, but never forget the old maxim: An ounce of prevention is worth a pound of cure. Stopping the assaults before they can even begin is always the best strategy and easily the most powerful of them all.

Keep in mind that the below is not an exhaustive list of all the defense options possible - these are just some of the low hanging fruit that protect a lot without too much effort or implementation friction with the users or bigwigs.

Umbrella Defenses

  • Enabling phishing mitigator services like Geoblocking, Sandboxing, Dynamic Link Scanning and Graylisting can all make huge differences in how many phishing emails (and spam) make it to your users.

    Email filtering services like UpStream Security can achieve these with ease.

  • Mitigating impersonation attacks, both against your organization and your vendors/clients, goes a long way to building trust and preventing reputational damage.

    Improvements in email delivery come as another primary benefit, giving your emails a much higher chance of reaching their intended destinations.

  • Many older email client protocols, such as WebDAV, IMAP4 and POP3 do not allow for services like MultiFactor Authentication (MFA) to be used, which can leave them highly vulnerable to a common password compromise.

    If the attacker cannot connect as your user, they cannot steal their data.

Technology Policy

  • You’d might be surprised, but many organizations still do not have MultiFactor Authentication (MFA) rolled out to protect their users.

    MFA requires at least two “keys” to provide access, such as a password and a hardware token (something a user knows and something a user has) or an SMS message and a Face Identifier (something a user has access to and something a user is) in order to provide two separate and independent locks.

    That said, not all forms of MFA are equally secure.

    MFA should be configured to protect against social engineering attacks.

    The convenience of one-time passcodes and push-based notifications are not as resistant to these more advanced attacks, but FIDO2 hardware tokens have been dramatically more successful since they require a user to have a physical “key” to obtain access. Obviously, these are VERY difficult for an attacker to get a hold of.

  • Setting an alert for a number of unanswered MFA prompts can help prevent MFA fatigue, which is when an attacker keeps trying a compromised password to send an MFA prompt to the user in hopes they will accidentally press Yes on it.

    Set an access policy to lock after 5 or 10 unanswered attempts.

  • Almost as a matter of course, compromised accounts will have mail rules configured on them to route incoming email into certain folders to prevent visibility by the regular user.

    Configuring alerts in your email system that notify administrators of the creation of these rules can help with early detection and interception of compromises before they can do any damage.

Human Training

  • The types of tactics malicious attackers use to trick your users are evolving daily, but training them on how to identify risky emails, hyperlinks and attachments can go a long way to preventing the final stages of an attack that made it through to them.

    Humans are always the last line of defense, but absolutely should not be the “least” of the defenses: train them regularly with the latest attack types to stay sharp.

    More information on training options can be found with Tangent’s managed services here.

  • Train employees on verification procedures for requests that can be dangerous, like making a payment, changing where payments go to a vendor or transmitting any sort of potentially sensitive data, including an employee’s personal contact information.

    Such requests should be checked using out-of-band verification (such as calling the requester on their official phone number or meeting with them physically): don’t trust the contact information the cybercriminal provided, as this is almost always fake.

  • For organizations who cannot turn to Passwordless authorization methods (which rely on some of the aforementioned MFA techniques, amongst others), equipping the users with a Password Manager, such as KeyPass, LastPass or 1Password can go a long way to adding tougher security.

    A password manager allows for vastly more complex passwords to be used for independent websites and services, but without the end user having to remember them (or in many cases, even having to type them in).

    This way, not only is it harder to crack a user’s password, but if a credential gets compromised, it will only impact that one site.