The Good, the Bad and the Ugly in Cybersecurity – Week 41

/0 Comments/in /by

The Good

Former Canadian government employee, Sebastian Vachon-Desjardins, pleaded guilty this week to ransomware crimes that had earned him $21 million in Bitcoin and $500,000 in seized cash. For over 10 months, Vachon-Desjardins operated as an affiliate for Netwalker, a Russian-speaking ransomware gang that targeted organizations in more than 30 countries during the height of the COVID-19 pandemic.

Vachon-Desjardins has been sentenced to a 20-year prison term in the United States after admitting to four charges including conspiracy to commit wire fraud, conspiracy to commit computer fraud, intentional damage to a protected computer system, and sending a demand in relation to damaging a protected computer.

Netwalker affiliate

Vachon-Desjardins was one of Netwalker’s most prolific affiliates according to U.S. court filings. Netwalker’s targets included schools, hospitals, emergency services, law enforcement agencies, and businesses, all of which were on the receiving end of ransom demands in exchange for the return of their encrypted data. With as many as 400 entities affected and a collected total of $40 million in ransom payments, Vachon-Desjardins himself was found to have received a third of the proceeds.

The DOJ’s press release noted that Netwalker’s attacks specifically took advantage of the global pandemic crisis to extort victims. The U.S. District Judge who doled out the sentence went above the 12 to 15-year prison term suggested by federal guidelines with the intention of deterring cybercriminals on the whole. The Assistant Attorney General of the Justice Department explained, “Today’s sentence demonstrates that ransomware actors will face significant consequences for their crimes and exemplifies the Department’s steadfast commitment to pursuing actors who participate in ransomware schemes.”

The Bad

This week, the FBI warned of a rise in ‘pig butchering’, a scam focused on stealing increasing amounts of crypto from user accounts over an extended period of time. The FBI’s public service announcement aims to raise awareness amongst investors as more incidents are reported.

‘Pig butchering’ is still a relatively new scam but uses age-old social engineering tactics. The ‘pigs’ in this case are unsuspecting investors who are contacted by fraudsters through social media. Fraudsters then work to establish long-term relationships with these individuals either through fake friendships, the promise of romantic connections, or even going as far as impersonating a real acquaintance.

The victims are eventually convinced to invest in cryptocurrency on counterfeit platforms which are designed to show huge returns on funds. Spurred on, they’re encouraged to make more investments, thus ‘fattening up’ the size of the target. Only upon withdrawal do the investors realize they have been scammed as the fraudster ceases communication and shuts down the fake crypto exchange platform. The consequences of these scams are usually significant with the victim’s losses ranging from thousands to millions of dollars.

pig butchering

The FBI is warning investors to verify the validity of any unsolicited investment opportunity and to check that domain names in links point to legitimate financial institutions. Threat actors typically use a technique called typosquatting that relies on misspelled URLs with a slight deviation from a legitimate website address to trick victims into visiting malicious sites. Cyber criminals running ‘Get rich quick’ investment scams also commonly try to persuade victims to download malicious apps on the pretext of offering some tool needed for investing.

Caution is the first line of defense, here, and as the old adage has it, if an opportunity sounds too good to be true, it most probably is.

The Ugly

Reports have emerged this week that men eligible for enlistment in Russia began leveraging cybercrime services soon after President Vladimir Putin called for a partial mobilization of troops to fight in Ukraine. Resorting to illegal online marketplaces, many men who have not fled are soliciting falsified exemptions while those who have are reportedly turning to identity-masking tools to protect themselves from discovery.

Since the invasion in February, opportunistic scammers have taken advantage of the sociopolitical climate to exploit people who are trying to survive the war. So far, some scammers have claimed to sell forged documents on the dark web that would allow Russian men to evade the draft while others have pledged to mask their buyers’ records in enlistment office databases – all in exchange for a fee as well as the buyer’s passport. After payment is made, the scammers stop communication and likely use the stolen money and identities to perpetuate their schemes.

Cyber intelligence firm, KELA, also reported on a number of cybercrime forums claiming to provide fake documents and medical reports, as well as connecting buyers to job opportunities that would result in a postponed draft.

The call for partial mobilization has created an environment where Russian citizens are seeking illegal means to avoid the order. Underground markets and darknets are prospering as new scams surge. Cybercrime has long played off of human emotions such as fear, uncertainty, and desperation and, as the conflict in Ukraine continues, it seems cybercrime forums will continue to exploit desperate individuals living in wartime.

Report: Big U.S. Banks Are Stiffing Account Takeover Victims

/0 Comments/in /by

When U.S. consumers have their online bank accounts hijacked and plundered by hackers, U.S. financial institutions are legally obligated to reverse any unauthorized transactions as long as the victim reports the fraud in a timely manner. But new data released this week suggests that for some of the nation’s largest banks, reimbursing account takeover victims has become more the exception than the rule.

The findings came in a report released by Sen. Elizabeth Warren (D-Mass.), who in April 2022 opened an investigation into fraud tied to Zelle, the “peer-to-peer” digital payment service used by many financial institutions that allows customers to quickly send cash to friends and family.

Zelle is run by Early Warning Services LLC (EWS), a private financial services company which is jointly owned by Bank of America, Capital One, JPMorgan Chase, PNC Bank, Truist, U.S. Bank, and Wells Fargo. Zelle is enabled by default for customers at over 1,000 different financial institutions, even if a great many customers still don’t know it’s there.

Sen. Warren said several of the EWS owner banks — including Capital One, JPMorgan and Wells Fargo — failed to provide all of the requested data. But Warren did get the requested information from PNC, Truist and U.S. Bank.

“Overall, the three banks that provided complete data sets reported 35,848 cases of scams, involving over $25.9 million of payments in 2021 and the first half of 2022,” the report summarized. “In the vast majority of these cases, the banks did not repay the customers that reported being scammed. Overall these three banks reported repaying customers in only 3,473 cases (representing nearly 10% of scam claims) and repaid only $2.9 million.”

Importantly, the report distinguishes between cases that involve straight up bank account takeovers and unauthorized transfers (fraud), and those losses that stem from “fraudulently induced payments,” where the victim is tricked into authorizing the transfer of funds to scammers (scams).

A common example of the latter is the Zelle Fraud Scam, which uses an ever-shifting set of come-ons to trick people into transferring money to fraudsters. The Zelle Fraud Scam often employs text messages and phone calls spoofed to look like they came from your bank, and the scam usually relates to fooling the customer into thinking they’re sending money to themselves when they’re really sending it to the crooks.

Here’s the rub: When a customer issues a payment order to their bank, the bank is obligated to honor that order so long as it passes a two-stage test. The first question asks, Did the request actually come from an authorized owner or signer on the account? In the case of Zelle scams, the answer is yes.

Trace Fooshee, a strategic advisor in the anti money laundering practice at Aite-Novarica, said the second stage requires banks to give the customer’s transfer order a kind of “sniff test” using “commercially reasonable” fraud controls that generally are not designed to detect patterns involving social engineering.

Fooshee said the legal phrase “commercially reasonable” is the primary reason why no bank has much — if anything — in the way of controlling for scam detection.

“In order for them to deploy something that would detect a good chunk of fraud on something so hard to detect they would generate egregiously high rates of false positives which would also make consumers (and, then, regulators) very unhappy,” Fooshee said. “This would tank the business case for the service as a whole rendering it something that the bank can claim to NOT be commercially reasonable.”

Sen. Warren’s report makes clear that banks generally do not pay consumers back if they are fraudulently induced into making Zelle payments.

“In simple terms, Zelle indicated that it would provide redress for users in cases of unauthorized transfers in which a user’s account is accessed by a bad actor and used to transfer a payment,” the report continued. “However, EWS’ response also indicated that neither Zelle nor its parent bank owners would reimburse users fraudulently induced by a bad actor into making a payment on the platform.”

Still, the data suggest banks did repay at least some of the funds stolen from scam victims about 10 percent of the time. Fooshee said he’s surprised that number is so high.

“That banks are paying victims of authorized payment fraud scams anything at all is noteworthy,” he said. “That’s money that they’re paying for out of pocket almost entirely for goodwill. You could argue that repaying all victims is a sound strategy especially in the climate we’re in but to say that it should be what all banks do remains an opinion until Congress changes the law.”

UNAUTHORIZED FRAUD

However, when it comes to reimbursing victims of fraud and account takeovers, the report suggests banks are stiffing their customers whenever they can get away with it. “Overall, the four banks that provided complete data sets indicated that they reimbursed only 47% of the dollar amount of fraud claims they received,” the report notes.

How did the banks behave individually? From the report:

-In 2021 and the first six months of 2022, PNC Bank indicated that its customers reported 10,683 cases of unauthorized payments totaling over $10.6 million, of which only 1,495 cases totaling $1.46 were refunded to consumers. PNC Bank left 86% of its customers that reported cases of fraud without recourse for fraudulent activity that occurred on Zelle.

-Over this same time period, U.S. Bank customers reported a total of 28,642 cases of unauthorized transactions totaling over $16.2 million, while only refunding 8,242 cases totaling less than $4.7 million.

-In the period between January 2021 and September 2022, Bank of America customers reported 81,797 cases of unauthorized transactions, totaling $125 million. Bank of America refunded only $56.1 million in fraud claims – less than 45% of the overall dollar value of claims made in that time.

–Truist indicated that the bank had a much better record of reimbursing defrauded customers over this same time period. During 2021 and the first half of 2022, Truist customers filed 24,752 unauthorized transaction claims amounting to $24.4 million. Truist reimbursed 20,349 of those claims, totaling $20.8 million – 82% of Truist claims were reimbursed over this period. Overall, however, the four banks that provided complete data sets indicated that they reimbursed only 47% of the dollar amount of fraud claims they received.

Fooshee said there has long been a great deal of inconsistency in how banks reimburse unauthorized fraud claims — even after the Consumer Financial Protection Bureau (CPFB) came out with guidance on what qualifies as an unauthorized fraud claim.

“Many banks reported that they were still not living up to those standards,” he said. “As a result, I imagine that the CFPB will come down hard on those with fines and we’ll see a correction.”

Fooshee said many banks have recently adjusted their reimbursement policies to bring them more into line with the CFPB’s guidance from last year.

“So this is heading in the right direction but not with sufficient vigor and speed to satisfy critics,” he said.

Seth Ruden is a payments fraud expert who serves as director of global advisory for digital identity company BioCatch. Ruden said Zelle has recently made “significant changes to its fraud program oversight because of consumer influence.”

“It is clear to me that despite sensational headlines, progress has been made to improve outcomes,” Ruden said. “Presently, losses in the network on a volume-adjusted basis are lower than those typical of credit cards.”

But he said any failure to reimburse victims of fraud and account takeovers only adds to pressure on Congress to do more to help victims of those scammed into authorizing Zelle payments.

“The bottom line is that regulations have not kept up with the speed of payment technology in the United States, and we’re not alone,” Ruden said. “For the first time in the UK, authorized payment scam losses have outpaced credit card losses and a regulatory response is now on the table. Banks have the choice right now to take action and increase controls or await regulators to impose a new regulatory environment.”

Sen. Warren’s report is available here (PDF).

There are, of course, some versions of the Zelle fraud scam that may be confusing financial institutions as to what constitutes “authorized” payment instructions. For example, the variant I wrote about earlier this year began with a text message that spoofed the target’s bank and warned of a pending suspicious transfer.

Those who responded at all received a call from a number spoofed to make it look like the victim’s bank calling, and were asked to validate their identities by reading back a one-time password sent via SMS. In reality, the thieves had simply asked the bank’s website to reset the victim’s password, and that one-time code sent via text by the bank’s site was the only thing the crooks needed to reset the target’s password and drain the account using Zelle.

None of the above discussion involves the risks affecting businesses that bank online. Businesses in the United States do not enjoy the same fraud liability protection afforded to consumers, and if a banking trojan or clever phishing site results in a business account getting drained, most banks will not reimburse that loss.

This is why I have always and will continue to urge small business owners to conduct their online banking affairs only from a dedicated, access restricted and security-hardened device — and preferably a non-Windows machine.

For consumers, the same old advice remains the best: Watch your bank statements like a hawk, and immediately report and contest any charges that appear fraudulent or unauthorized.

Building Blocks For Your XDR Journey, Part 1 | Extending Beyond the Endpoint

/0 Comments/in /by

A Guest Post by Mark Harris, former Senior Director Analyst at Gartner

In the cyber security industry, there is a never-ending cat-and-mouse game between adversaries who create new exploits and defenders who devise ways to stop them. As soon as a defender finds a way to stop one type of cyber attack, the adversaries create a new type of attack. As a result, cyber security is a never-ending cat-and-mouse game, with defenders always playing catch-up. New products and solutions are constantly emerging to address rising threats, while existing products adapt or merge with other solutions. The goal is to stay one step ahead of the attackers, but it’s an ongoing battle that is unlikely to ever be won definitively without an effective cybersecurity strategy.

This multi-part blog series provides an overview and guidance on how to develop a successful cybersecurity strategy for your organization. In Part 1, we focus on why organizations need to extend protection beyond the endpoint to stay ahead of adversaries.

The XDR Advantage

Endpoint Detection and Response (EDR) has quickly become an integral part of endpoint protection (EPP), but as attackers have got more sophisticated, detection and response has needed to evolve beyond just the endpoint; extended Detection and Response (XDR)  provides three key capabilities.

  1. Combine alerts from multiple security tools into a single incident to improve the efficiency and effectiveness of security teams. Reducing the gap in visibility and the time taken to investigate and triage incidents meaning incidents are contained more quickly.
  2. Correlate “weak” signals (low priority alerts) from multiple security sources to create new detections that may not be identified when those signals are in a silo or viewed in isolation.
  3. Automatically respond to threats detected across multiple products.

For example, a user trying to log in to a machine and failing may mean they’ve forgotten their password. But if multiple users try and fail, that could be an attacker. If a user then successfully logs in and starts running administration tools to download files or change configuration, then it’s a much stronger indication that an attacker is in the network.

Those multi-events and the subsequent detection should be presented as a single incident that needs investigation. The response also needs to be automatic and  could be to isolate the affected machine and force the user to re-authenticate.

Moving Beyond SIEM and SOAR

For many years the main tool for the security operations center (SOC) was Security Information Event Management (SIEM), but these tools were often more focused on log collection than correlation and relied on the SOC team expertise to manage and process the large volume of data and alerts. Any response would often need to be handled through a separate security orchestration, automation, and response (SOAR) tool.

These tools required dedicated, highly skilled teams to sift through the vast amount of information to try and identify incidents. More often than not, SIEM and SOAR are used post-incident to understand and remediate what happened rather than a detection and response capability.

EDR addressed a lot of the overhead of managing endpoint focused threats; collecting events and data in a central cloud-based infrastructure gave security teams the ability to hunt for threats across an entire organization, giving them visibility to reduce the time to detect a threat significantly. SentinelOne’s automation and remediation means threats can be quickly identified and resolved often with minimal effort allowing security teams more time to carry out these investigations.

In the case of managed service providers or SentinelOne’s own Vigilance service, that visibility is across all customers using the service.  Storyline™ not only provides security teams with curated automated correlation but also the ability to quickly and easily add new rules specific to their organization.

Protecting the Organization, Not Just the Device

Today, threat actors are not just targeting individual, single machines; they are targeting an organization as a whole. The first machine to be compromised is just the starting point. From that initial entry, the attacker can carry out further surveillance and move through the network to identify valuable data before stealing it. Whilst EDR tools are very effective, there only needs to be one weak link for the attacker to exploit.

Ensuring that endpoint protection and EDR are deployed on every single machine is one of the biggest challenges for IT operations teams. Although achieving that 100% deployment is rarely achievable for all but the smallest of organizations, tools like SentinelOne Ranger provide the visibility into the network to find any unmanaged or unauthorized devices.

XDR goes beyond just the endpoint and provides the integration and correlation of events and alerts across a wide range of security tools to improve visibility, reduce the time to detect even further and then respond quickly. The IBM data breach report estimates that deploying XDR can reduce the time to detect by a month.

What Do Vendors Mean By “XDR”?

While the need for XDR is clear, vendors don’t all agree on what the term means or how XDR solutions should be delivered. The term ‘XDR’ is perhaps one of the most overused terms in cybersecurity today.

There are a number of interpretations of how to deliver XDR.

  1. Single Vendor XDR – All the security tools are provided by a single vendor. There is limited integration with other tools, usually limited to just ingesting logs and alerts. Choosing a single vendor XDR solution is a complex, risky and expensive approach. Migrating security tools takes time, and existing licenses will have to be paid whilst the migration is done. There is also no guarantee that the solutions from a single vendor will meet an organization’s needs.
  2. SIEM XDR – Several of the SIEM vendors are combining traditional SIEM functionality with SOAR and claiming XDR, but these solutions don’t have automated threat detection capabilities.
  3. Managed XDR – Managed service providers can provide the capabilities of XDR by integrating multiple tools into their services. Although it may deliver on the outcomes, the service relies on the MSP SOC team and functionality.
  4. Open XDR Platform – Provides a platform that can integrate multiple products from different vendors and correlate those events. To be effective, the integration needs to be both ways, receiving alerts from a product but also being able to automatically send response actions. One of the key advantages of an OpenXDR platform is that rather than replacing existing solutions, they can be integrated into the platform, and the benefits of XDR are realized much sooner.

SentinelOne has built an open XDR  platform that provides a flexible and scalable solution. Singularity™ XDR integrates with both the broad range of SentinelOne products and services as well as with leading third party security providers such as Mimecast for Email security. It includes the automation, AI and ML capabilities to quickly get the benefits of XDR and provide a scalable, extensible platform to build upon.

Conclusion

XDR is the natural progression of EDR, moving beyond the endpoint to the rest of the security infrastructure, including identity and cloud security. XDR is a journey, and as threats evolve the XDR platform needs to be able to grow and adapt. XDR isn’t necessarily just selecting a solution, it’s choosing a strategy and a strategic partner. SentinelOne provides that vision and strategy to help organizations deliver on the promise of XDR and protect the whole organization.

If you would like to learn more about SentinelOne Singularity XDR platform, contact us for more information or request a free demo.

SentinelOne Singularity XDR
Supercharge. Fortify. Automate. Extend protection with unfettered visibility, proven protection, and unparalleled response. Discover the power of autonomous with Singularity XDR.

Learn More

About the Author

Mark Harris is a Cybersecurity advisor and former Senior Director Analyst at Gartner with over 25 years of experience. At Gartner Harris was the author of a variety of market shaping research for Endpoint Protection and EDR including the EPP Magic Quadrant and Critical Capabilities as well as Market Guides and research on ransomware and other threats.

Glut of Fake LinkedIn Profiles Pits HR Against the Bots

/0 Comments/in /by

A recent proliferation of phony executive profiles on LinkedIn is creating something of an identity crisis for the business networking site, and for companies that rely on it to hire and screen prospective employees. The fabricated LinkedIn identities — which pair AI-generated profile photos with text lifted from legitimate accounts — are creating major headaches for corporate HR departments and for those managing invite-only LinkedIn groups.

Some of the fake profiles flagged by the co-administrator of a popular sustainability group on LinkedIn.

Last week, KrebsOnSecurity examined a flood of inauthentic LinkedIn profiles all claiming Chief Information Security Officer (CISO) roles at various Fortune 500 companies, including Biogen, Chevron, ExxonMobil, and Hewlett Packard.

Since then, the response from LinkedIn users and readers has made clear that these phony profiles are showing up en masse for virtually all executive roles — but particularly for jobs and industries that are adjacent to recent global events and news trends.

Hamish Taylor runs the Sustainability Professionals group on LinkedIn, which has more than 300,000 members. Together with the group’s co-owner, Taylor said they’ve blocked more than 12,700 suspected fake profiles so far this year, including dozens of recent accounts that Taylor describes as “cynical attempts to exploit Humanitarian Relief and Crisis Relief experts.”

“We receive over 500 fake profile requests to join on a weekly basis,” Taylor said. “It’s hit like hell since about January of this year. Prior to that we did not get the swarms of fakes that we now experience.”

The opening slide for a plea by Taylor’s group to LinkedIn.

Taylor recently posted an entry on LinkedIn titled, “The Fake ID Crisis on LinkedIn,” which lampooned the “60 Least Wanted ‘Crisis Relief Experts’ — fake profiles that claimed to be experts in disaster recovery efforts in the wake of recent hurricanes. The images above and below show just one such swarm of profiles the group flagged as inauthentic. Virtually all of these profiles were removed from LinkedIn after KrebsOnSecurity tweeted about them last week.

Another “swarm” of LinkedIn bot accounts flagged by Taylor’s group.

Mark Miller is the owner of the DevOps group on LinkedIn, and says he deals with fake profiles on a daily basis — often hundreds per day. What Taylor called “swarms” of fake accounts Miller described instead as “waves” of incoming requests from phony accounts.

“When a bot tries to infiltrate the group, it does so in waves,” Miller said. “We’ll see 20-30 requests come in with the same type of information in the profiles.”

After screenshotting the waves of suspected fake profile requests, Miller started sending the images to LinkedIn’s abuse teams, which told him they would review his request but that he may never be notified of any action taken.

Some of the bot profiles identified by Mark Miller that were seeking access to his DevOps LinkedIn group. Miller said these profiles are all listed in the order they appeared.

Miller said that after months of complaining and sharing fake profile information with LinkedIn, the social media network appeared to do something which caused the volume of group membership requests from phony accounts to drop precipitously.

“I wrote our LinkedIn rep and said we were considering closing the group down the bots were so bad,” Miller said. “I said, ‘You guys should be doing something on the backend to block this.”

Jason Lathrop is vice president of technology and operations at ISOutsource, a Seattle-based consulting firm with roughly 100 employees. Like Miller, Lathrop’s experience in fighting bot profiles on LinkedIn suggests the social networking giant will eventually respond to complaints about inauthentic accounts. That is, if affected users complain loudly enough (posting about it publicly on LinkedIn seems to help).

Lathrop said that about two months ago his employer noticed waves of new followers, and identified more than 3,000 followers that all shared various elements, such as profile photos or text descriptions.

“Then I noticed that they all claim to work for us at some random title within the organization,” Lathrop said in an interview with KrebsOnSecurity. “When we complained to LinkedIn, they’d tell us these profiles didn’t violate their community guidelines. But like heck they don’t! These people don’t exist, and they’re claiming they work for us!”

Lathrop said that after his company’s third complaint, a LinkedIn representative responded by asking ISOutsource to send a spreadsheet listing every legitimate employee in the company, and their corresponding profile links.

Not long after that, the phony profiles that were not on the company’s list were deleted from LinkedIn. Lathrop said he’s still not sure how they’re going to handle getting new employees allowed into their company on LinkedIn going forward.

It remains unclear why LinkedIn has been flooded with so many fake profiles lately, or how the phony profile photos are sourced. Random testing of the profile photos shows they resemble but do not match other photos posted online. Several readers pointed out one likely source — the website thispersondoesnotexist.com, which makes using artificial intelligence to create unique headshots a point-and-click exercise.

Cybersecurity firm Mandiant (recently acquired by Google) told Bloomberg that hackers working for the North Korean government have been copying resumes and profiles from leading job listing platforms LinkedIn and Indeed, as part of an elaborate scheme to land jobs at cryptocurrency firms.

Fake profiles also may be tied to so-called “pig butchering” scams, wherein people are lured by flirtatious strangers online into investing in cryptocurrency trading platforms that eventually seize any funds when victims try to cash out.

In addition, identity thieves have been known to masquerade on LinkedIn as job recruiters, collecting personal and financial information from people who fall for employment scams.

But the Sustainability Group administrator Taylor said the bots he’s tracked strangely don’t respond to messages, nor do they appear to try to post content.

“Clearly they are not monitored,” Taylor assessed. “Or they’re just created and then left to fester.”

This experience was shared by the DevOp group admin Miller, who said he’s also tried baiting the phony profiles with messages referencing their fakeness. Miller says he’s worried someone is creating a massive social network of bots for some future attack in which the automated accounts may be used to amplify false information online, or at least muddle the truth.

“It’s almost like someone is setting up a huge bot network so that when there’s a big message that needs to go out they can just mass post with all these fake profiles,” Miller said.

In last week’s story on this topic, I suggested LinkedIn could take one simple step that would make it far easier for people to make informed decisions about whether to trust a given profile: Add a “created on” date for every profile. Twitter does this, and it’s enormously helpful for filtering out a great deal of noise and unwanted communications.

Many of our readers on Twitter said LinkedIn needs to give employers more tools — perhaps some kind of application programming interface (API) — that would allow them to quickly remove profiles that falsely claim to be employed at their organizations.

Another reader suggested LinkedIn also could experiment with offering something akin to Twitter’s verified mark to users who chose to validate that they can respond to email at the domain associated with their stated current employer.

In response to questions from KrebsOnSecurity, LinkedIn said it was considering the domain verification idea.

“This is an ongoing challenge and we’re constantly improving our systems to stop fakes before they come online,” LinkedIn said in a written statement. “We do stop the vast majority of fraudulent activity we detect in our community – around 96% of fake accounts and around 99.1% of spam and scams. We’re also exploring new ways to protect our members such as expanding email domain verification. Our community is all about authentic people having meaningful conversations and to always increase the legitimacy and quality of our community.”

In a story published Wednesday, Bloomberg noted that LinkedIn has largely so far avoided the scandals about bots that have plagued networks like Facebook and Twitter. But that shine is starting to come off, as more users are forced to waste more of their time fighting off inauthentic accounts.

“What’s clear is that LinkedIn’s cachet as being the social network for serious professionals makes it the perfect platform for lulling members into a false sense of security,” Bloomberg’s Tim Cuplan wrote. “Exacerbating the security risk is the vast amount of data that LinkedIn collates and publishes, and which underpins its whole business model but which lacks any robust verification mechanisms.”

Top 8 Defenses MSPs Can Take Against Cyberattacks

/0 Comments/in /by

From small to medium businesses to critical infrastructure entities, more organizations are relying on MSPs to monitor, manage, and safeguard their data. In May, the Five Eyes intelligence alliance published a joint cybersecurity advisory warning MSPs about their role in growing supply chain attacks. Cybersecurity authorities and law enforcement agencies from across the United States, United Kingdom, Canada, Australia, and New Zealand reported MSPs being the targets of increased cyber threats including supply chain attacks, ransomware, and nation-state cyber espionage campaigns.

MSP organizations make up a significant portion of the collective cyber defense industry. In this post, we outline key actions that MSPs should be taking to shore up their defenses to ensure they are keeping themselves, and by extension, their customers safe from increasingly advanced cyberattacks.

MSPs | A Springboard for Malicious Cyber Threats

Managed Service Providers (MSPs) got their start during the dot-com era of the late 1990s. What began as internet service providers (ISPs) offering their clients firewall appliances and the operative services to go along with them later kickstarted the concept of managed security services. With time, MSPs evolved to full security service providers supporting organizations globally. Small to medium sized organizations needing support to build up their cybersecurity posture have turned to MSPs for affordable, scalable solutions and expert protection.

Now, cybersecurity has become a necessity for businesses operating in today’s ever-changing landscape. Legacy solutions such as anti-virus and anti-malware can no longer stave off advanced threat actors who do not discriminate based on the size of a target. For many organizations, the task of building a strong cybersecurity defense with limited resources can be daunting. This is where MSPs have come in to support.

So what makes MSPs such an attractive target for modern threat actors? Advanced Persistent Threat (APT) groups have set their sights on MSPs’ provider-customer network access. Customers of MSPs depend on their providers to store their data, manage communication platforms, and support their IT infrastructure. Due to the access MSPs have to all of their customer’s networks, threat actors see MSP businesses as a single entry point to a variety of targets – not stopping their attack on the MSP’s customers, but oftentimes, attacking their customer’s customers, too.

The Inherent Risks of MSP’s Service Pillars

In general, MSPs provide continuous security monitoring and management services to the customers they serve. Most MSPs offer subscription-based service models allowing them to tailor the support to the specific needs of each customer. Many businesses choose to work with MSPs to augment the abilities of their own in-house IT teams, others seek support achieving 24/7/365 coverage, and many rely on access to cybersecurity experts to help them maintain and manage all aspects of a cyber ecosystem.

MSPs, at the core, provide the following cybersecurity-focused services:

  • Continuous Intrusion Detection & Response
  • Identity & Privilege Access Management
  • Firewall Management & Monitoring
  • Patch & Vulnerability Management
  • Virtual Private Network (VPN) Management
  • Risk Evaluation & Compliance Management
  • Cybersecurity Expertise & Education

To provide these services, MSPs require their customers to provide them with privileged access to networks and trusted connectivity. With this in mind, threat actors capitalize on vulnerable MSPs rather than trying to target each of an MSP’s customers directly. After a successful breach, threat actors may also conduct cyber espionage on the MSP and its customers to prepare for future activities such as ransomware attacks and double extortion.

The Nature of Supply Chain Attacks

Cybercriminals are often opportunistic and always looking for ways to reach lucrative targets using the path of least resistance. Attacks against MSP businesses are emerging as cybercriminals leverage MSP’s intimate level of access to customer networks as an initial access vector. When one vulnerable service provider is successfully breached, suddenly all their downstream customers are at immediate risk of attack. The cascading effect on multiple victim networks is the defining risk of a supply chain attack. With the promise of greater rewards for less work, supply chain attacks will continue to be popular with cybercriminals.

Supply chain attacks have become more prevalent and made headlines by targeting critical infrastructure sectors globally in the last few years. As an extension to President Biden’s Executive Order on improving U.S. cybersecurity, the White House recently issued guidance on strengthening cybersecurity protections specifically combating supply chain attacks. The Executive Order was followed by a directive released by the National Institute of Standards and Technology (NIST) which outlines major security controls and practices for MSP adoption.

Key Defenses to Expect from MSP Businesses

With supply chain risks expected to continue, businesses turning to MSPs must ensure their providers put strategic safeguards in place to reduce these risks. MSPs are contractually obligated to ensure that their security architecture, governance, and capabilities are up to industry standards and need to regularly re-evaluate their cybersecurity strategy and processes to make sure they can meet recommended cybersecurity measures and controls.

1. Preventing Initial Compromise & Targeted Attacks

An MSP’s first step to preventing compromise is to harden vulnerable devices and remote access tools such as VPNs (virtual private networks). Vulnerability scanning is integral to this prevention as it helps MSPs protect their data as they continue to use their day-to-day software and web-facing applications. Targeted attacks such as password spraying, brute force attacks, and phishing campaigns can also be mitigated when MSPs shore up their internet-facing remote desktop (RDP) services.

2. Promoting Holistic Cyber Hygiene

MSPs should operate on cyber hygiene best practices to ensure the longevity of their operations. This means keeping internal tools and software up to date. Patching should be completed in a timely manner especially for firewall and VPN appliances.

MSPs should also establish app-based MFA for all devices and remote monitoring and management (RMM) tools and monitor often for failed login attempts – a typical sign of malicious activity.

Additionally, both the MSP and their customers should practice strict password management to ward off any malicious attempts at credential stuffing. Password management may include requirements for complexity, rotation, and expiration cycles.

3. Implementing a Zero Trust Model

The purpose of the zero trust model is to minimize the exposure of a network’s most sensitive data to unnecessary access. Each user is only given the level of access they require to perform their tasks. First, zero trust architecture requires all users and machines to authenticate before need-to-know permissions can be granted. Second, zero trust involves segmenting a network to isolate each part from the rest, making the entire network secure against threat actors attempting to spread laterally across systems.

4. Executing Proper Offboarding Procedures

IT offboarding entails the removal of obsolete accounts, instances, and tools should they no longer be required by a business. Accounts with shared passwords must be deleted, and in the case of employee transition, their user accounts will also need to be revoked. Port scanning tools and automated system inventories can help with the offboarding process as businesses perform regular audits on their network infrastructure.

5. Managing Regular Backups

Both MSPs and their customers should make sure they have redundant backup copies of all essential data and infrastructure such that the system or any part of it can be restored in the event of failure, loss or compromise. Backups should be stored remotely, either in the cloud or on a dedicated physical server. Best practices recommend both.

It is vital that backups are on separate systems, are encrypted, and frequently reviewed for anomalous access and data integrity. It’s also important to ensure that the backup policy is documented and that backups are made on a regular schedule.

As ransomware attacks evolve, many threat actors are exfiltrating their victim’s sensitive data in addition to encrypting it, ensuring they have additional leverage to collect the ransom demanded. This type of ransomware attack tactic is called double extortion and leaves the targeted MSP or client with the risk of having the stolen data published.

Triple extortion ransomware adds another element to the frenzy with the attackers directly approaching a victim’s clients or suppliers and demanding ransom from them as well. Their threat? Publication of their sensitive information and, increasingly, the launch of a Distributed-Denial-of-Service (DDoS) attack.

While backups are no longer enough to thwart ransomware attacks that exfiltrate and threaten to leak data, having regular backups means that businesses that have been hit by such attacks can still access data, carry out emergency communication processes, and implement their incident response plan, including resuming affected services.

6. Improving Internet of Things (IoT) Security

While the IoT industry has boomed in the past decade with internet and cloud-connected devices, the integration of smart devices to the workplace, and even smart vehicles and buildings, represents another risk factor. IoT devices suffer from a number of security issues, including known default passwords, outdated or vulnerable firmware, and public internet-facing ports. Further, IoT devices are often left unprotected as their restricted hardware resources are unsuitable for running endpoint security solutions. These extensions of a network could each become a potential access point for a threat actor to exploit. MSPs and their customers should ensure they implement network asset discovery to gain visibility into connected IoT devices and block those that are unauthorized.

7. Planning for Incident Response & Recovery

Having a clear, actionable plan in place in the case of a security event can determine how effectively a business responds to and recovers from cyber attack. Incident responses (IR) plans are crucial for building up cyber resilience and can help businesses identify the people, processes, and technologies that need to be bolstered. Plans should be practiced on a scheduled basis and updated often to ensure it is up to speed with current business requirements and newly-identified cyber attack trends.

8. Establishing 24/7 Autonomous Detection & Response

As threat actors continue to evolve and upgrade their methods of attack, MSPs need to establish an effective response strategy. In case of a security event, having a fast response time could mean the difference between breach and business continuity. MSPs often augment their in-house team with a robust detection and response solution to ensure the most efficient response time possible to protect their customers.

Conclusion

With the cyber threat landscape always in a state of flux and threat actors using increasingly sophisticated methods of attack, MSPs offer affordable and scalable protection to fit the needs of their customers. MSPs that base their security services on robust solutions such as XDR are able to prevent, detect, and respond to advanced persistent threats across their customer’s entire attack surface.

To effectively serve all its customers, MSPs globally have turned to SentinelOne’s Singularity™ Platform, allowing them to proactively resolve modern threats at machine speed. Learn how SentinelOne works with best-in-class security service providers to more effectively manage risk across user identities, endpoints, cloud workloads, IoT, and more.

SentinelOne Singularity XDR
Supercharge. Fortify. Automate. Extend protection with unfettered visibility, proven protection, and unparalleled response. Discover the power of autonomous with Singularity XDR.

Learn More

S Ventures Invests in Noetic Cyber for Complete Visibility and Control of Your Security Posture 

/0 Comments/in /by

The complexity of enterprise infrastructure continues to evolve as digital transformation and hybrid work introduces new types of assets and data across cloud and ephemeral resources, traditional on-premises infrastructure, and IoT. This growing technology sprawl increases the attack surface security teams need to manage, while making it more challenging to achieve the visibility to do so.

Making it achievable for organizations to manage and reduce the growing attack surface is at the heart of our mission at SentinelOne; through Singularity XDR, we created an open architecture to unify detection and response across the enterprise through a single data ingestion and analytics platform.

That is why S Ventures is excited about our investment in Noetic Cyber, a leading Continuous Cyber Asset Management & Controls Platform and the latest addition to our growing portfolio of security and data innovators. Led by a strong team of operators and repeat entrepreneurs, Noetic shares our philosophy of solving for visibility and the growing attack surface. Noetic empowers security teams with a proactive, continuous assessment and improvement of their cyber posture.

Noetic Cyber CEO & Co-founder Paul Ayers has previously said of the S Ventures investment:

“Together with S Ventures and Singularity XDR, we’re empowering security teams with critical insights and asset intelligence to help them better manage their attack surface and reduce cyber risk.”

Operating in the emerging Cyber Asset Attack Surface Management (CAASM) space, the Noetic platform provides customers with an end-to-end platform to manage cyber risk.

“Noetic Cyber offers a novel approach to the cyber posture problem, enabling customers to truly understand their IT and Cloud estate and control for drifts.”  -Mike Petronacci, VP Product Platform, SentinelOne

The Noetic Cyber platform discovers and correlates assets across cloud and on-prem, understands the relationship and context of assets, delivers insight into the security risk that they represent, and provides an easy way to identify and close coverage gaps in the cyber posture of an enterprise. As investors, we were impressed with Noetic’s strong platform capabilities and coverage for the modern tech stack.

“Noetic Cyber is differentiated across its graph-based map of cloud and on-prem assets and entities, extensible query interface, and robust orchestration layer.”  -Matan Mates, Innovation Lead, SentinelOne

S Ventures is on a mission to invest in category-defining security and data companies, and we believe Noetic Cyber is doing just that for CAASM, the Cyber Asset Attack Surface Management market. This new approach to asset visibility and security posture is an important part of SentinelOne’s vision for a more secure future.

We undertook an in-depth analysis of the CAASM market before choosing to invest, and Noetic Cyber emerged as the ideal partner. We announced our integration with Noetic earlier in the year, through which our combined offerings provide customers with attack surface visibility, detection, and response from Singularity XDR with the automated asset management capabilities of Noetic Cyber (you can read more about the integration here).

With the S Ventures investment and Singularity XDR partnership with Noetic Cyber, we can provide security teams around the world with complete security visibility across XDR and CAASM.

The Good, the Bad and the Ugly in Cybersecurity – Week 40

/0 Comments/in /by

The Good

Good news this week from Meta (aka Facebook). The social media giant has taken down some 1600 accounts and disrupted a Russian disinformation campaign spread across 60 fraudulent news websites. The campaign, Meta says, spread fake stories and Russian propaganda regarding the war on Ukraine. The Facebook accounts were removed for what the company calls “coordinated inauthentic behavior”.

Meta says the operation began in May and centered around impersonating legitimate websites of news organizations including Der Spiegel, The Guardian and Bild. The fake sites used a technique known as “typosquatting” to mimic legitimate domain names such as theGuardian.com with fakes like Guardian[.]co[.]com. The fake news sites posted articles criticizing Ukraine and arguing that Western sanctions on Russia would backfire. The articles and related memes were then shared on the now-removed Facebook and Instagram accounts, as well as on Telegram and Twitter.

Russian disinformation campaign

Notably, as known domains were taken down or blocked, the actors behind the campaign attempted to set up replacement websites, “suggesting persistence and continuous investment in this activity across the internet”, the report says. In some cases, the disinformation content was amplified through the Facebook Pages of a number of Russian embassies.

Mass online disinformation campaigns have now become a regular tool of nation-state actors, and it’s unlikely we’ll see a reversal of that trend anytime soon. Of the few remedies we have to protect civil society and informed discourse aside from public awareness is active countermeasures as we’ve seen Meta take this week. Well done to them.

The Bad

The APT group variously known as TA410, Witchetty and LookingFrog has been up to some new tricks involving steganography and malware hidden in an image of the old Windows flag logo.

According to researchers, a bitmap image of the Windows flag logo was hosted on Github and laced with code for a backdoor. Hosting the image on a trusted public service avoids suspicious traffic to an attacker’s C2 (Command & Control) server, and hiding the malware in an iconic image helps the payload to remain hidden from casual inspection.

windows flag logo used to hide malware
Windows flag logo used to hide malware (Source)

The payload hidden in the image is decrypted with an XOR key and delivers a full-featured backdoor with the ability to move and delete files, start and stop processes, exfiltrate data and manipulate Windows Registry keys.

Researchers say the threat actors have been attacking targets in the Middle East, including at least one government agency, since February 2022. Initial compromise exploits the ProxyShell (CVE-2021-34473, CVE-2021-34523, and CVE-2021-31207) and ProxyLogon (CVE-2021-26855 and CVE-2021-27065) vulnerabilities to install web shells on public-facing servers. The actors steal credentials by dumping the contents of LSASS from memory, and then pivot via lateral movement to install further malware on computers across the network.

Unfortunately, it remains the case that many organizations have still failed to patch against ProxyShell and ProxyLogon vulnerabilities, and until they do, they and their customers remain at high risk of compromise from both APT and cybercrime threat actors.

The Ugly

Speaking of ProxyShell and ProxyLogon, this week news broke of two new MS Exchange zero days that one researcher has dubbed ProxyNotShell. Microsoft confirmed the vulnerabilities shortly after as CVE-2022–41040 and CVE-2022–41082.

ProxyNotShell uses the same path and Server-Side Request Forgery (SSRF)/Remote Code Execution (RCE) pair as the earlier ProxyShell. However, in this case the attacker needs to be authenticated to exploit the vulnerabilities – any valid non-admin email credentials will suffice. CVE-2022-41040 enables the authenticated attacker to remotely trigger CVE-2022-41082, which allows remote code execution when PowerShell is accessible.

Researchers spotted the vulnerability being exploited in the wild in August 2022 against critical infrastructure and other targets, although attribution at this time remains unknown.

The vulnerabilities impact organizations running on-prem Microsoft Exchange Server 2013, 2016, and 2019 and a public-facing Outlook Web App. It is estimated that worldwide there could be up to 250,000 Exchange servers vulnerable to ProxyNotShell. Microsoft says it is “working on an accelerated timeline to release a fix”. In the meantime, impacted organizations should follow the mitigation advice here.

Fake CISO Profiles on LinkedIn Target Fortune 500s

/0 Comments/in /by

Someone has recently created a large number of fake LinkedIn profiles for Chief Information Security Officer (CISO) roles at some of the world’s largest corporations. It’s not clear who’s behind this network of fake CISOs or what their intentions may be. But the fabricated LinkedIn identities are confusing search engine results for CISO roles at major companies, and they are being indexed as gospel by various downstream data-scraping sources.

If one searches LinkedIn for the CISO of the energy giant Chevron, one might find the profile for a Victor Sites, who says he’s from Westerville, Ohio and is a graduate of Texas A&M University.

The LinkedIn profile for Victor Sites, who is most certainly NOT the CISO of Chevron.

Of course, Sites is not the real CISO of Chevron. That role is currently occupied by Christopher Lukas of Danville, Calif. If you were confused at this point, you might ask Google who it thinks is the current Chief Information Security Officer of Chevron. When KrebsOnSecurity did that earlier this morning, the fake CISO profile was the very first search result returned (followed by the LinkedIn profile for the real Chevron CISO).

Helpfully, LinkedIn seems to be able to detect something in common about all these fake CISO profiles, because it suggested I view a number of them in the “People Also Viewed” column seen in the image above. There are two fake CISO profiles suggested there, including one for a Maryann Robles, who claims to be the CISO of another energy giant — ExxonMobil.

Maryann’s profile says she’s from Tupelo, Miss., and includes this detail about how she became a self-described “old-school geek.”

“Since playing Tradewars on my Tandy 1000 with a 300 baud modem in the early ’90s, I’ve had a lifelong passion for technology, which I’ve carried with me as Deputy CISO of the world’s largest health plan,” her profile reads.

However, this description appears to have been lifted from the profile for the real CISO at the Centers for Medicare & Medicaid Services in Baltimore, Md.

Interestingly, Maryann’s LinkedIn profile was accepted as truth by Cybercrime Magazine’s CISO 500 listing, which claims to maintain a list of the current CISOs at America’s largest companies:

The fake CISO for ExxOnMobil was indexed in Cybercrime Magazine’s CISO 500.

Rich Mason, the former CISO at Fortune 500 firm Honeywell, began warning his colleagues on LinkedIn about the phony profiles earlier this week.

“It’s interesting the downstream sources that repeat LinkedIn bogus content as truth,” Mason said. “This is dangerous, Apollo.io, Signalhire, and Cybersecurity Ventures.”

Google wasn’t fooled by the phony LinkedIn profile for Jennie Biller, who claims to be CISO at biotechnology giant Biogen (the real Biogen CISO is Russell Koste). But Biller’s profile is worth mentioning because it shows how some of these phony profiles appear to be quite hastily assembled. Case in point: Biller’s name and profile photo suggest she is female, however the “About” description of her accomplishments uses male pronouns. Also, it might help that Jennie only has 18 connections on LinkedIn.

Again, we don’t know much about who or what is behind these profiles, but in August the security firm Mandiant (recently acquired by Google) told Bloomberg that hackers working for the North Korean government have been copying resumes and profiles from leading job listing platforms LinkedIn and Indeed, as part of an elaborate scheme to land jobs at cryptocurrency firms.

None of the profiles listed here responded to requests for comment (or to become a connection).

In a statement provided to KrebsOnSecurity, LinkedIn said its teams were actively working to take these fake accounts down.

“We do have strong human and automated systems in place, and we’re continually improving, as fake account activity becomes more sophisticated,” the statement reads. “In our transparency report we share how our teams plus automated systems are stopping the vast majority of fraudulent activity we detect in our community – around 96% of fake accounts and around 99.1% of spam and scam.”

LinkedIn could take one simple step that would make it far easier for people to make informed decisions about whether to trust a given profile: Add a “created on” date for every profile. Twitter does this, and it’s enormously helpful for filtering out a great deal of noise and unwanted communications.

The former CISO Mason said LinkedIn also could experiment with offering something akin to Twitter’s verified mark to users who chose to validate that they can respond to email at the domain associated with their stated current employer.

“If I saw that a LinkedIn profile had been domain-validated, then my confidence in that profile would go way up,” Mason said, noting that many of the fake profiles had hundreds of followers, including dozens of real CISOs. Maryann’s profile grew by a hundred connections in just the past few days, he said.

“If we have CISOs that are falling for this, what hopes do the masses have?” Mason said.

Mason said LinkedIn also needs a more streamlined process for allowing employers to remove phony employee accounts. He recently tried to get a phony profile removed from LinkedIn for someone who falsely claimed to have worked for his company.

“I shot a note to LinkedIn and said please remove this, and they said, well, we have to contact that person and arbitrate this,” he said. “They gave the guy two weeks and he didn’t respond, so they took it down. But that doesn’t scale, and there needs to be a mechanism where an employer can contact LinkedIn and have these fake profiles taken down in less than two weeks.”

Microsoft: Two New 0-Day Flaws in Exchange Server

/0 Comments/in /by

Microsoft Corp. is investigating reports that attackers are exploiting two previously unknown vulnerabilities in Exchange Server, a technology many organizations rely on to send and receive email. Microsoft says it is expediting work on software patches to plug the security holes. In the meantime, it is urging a subset of Exchange customers to enable a setting that could help mitigate ongoing attacks.

In customer guidance released Thursday, Microsoft said it is investigating two reported zero-day flaws affecting Microsoft Exchange Server 2013, 2016, and 2019. CVE-2022-41040, is a Server-Side Request Forgery (SSRF) vulnerability that can enable an authenticated attacker to remotely trigger the second zero-day vulnerability — CVE-2022-41082 — which allows remote code execution (RCE) when PowerShell is accessible to the attacker.

Microsoft said Exchange Online has detections and mitigation in place to protect customers. Customers using on-premises Microsoft Exchange servers are urged to review the mitigations suggested in the security advisory, which Microsoft says should block the known attack patterns.

Vietnamese security firm GTSC on Thursday published a writeup on the two Exchange zero-day flaws, saying it first observed the attacks in early August being used to drop “webshells.” These web-based backdoors offer attackers an easy-to-use, password-protected hacking tool that can be accessed over the Internet from any browser.

“We detected webshells, mostly obfuscated, being dropped to Exchange servers,” GTSC wrote. “Using the user-agent, we detected that the attacker uses Antsword, an active Chinese-based opensource cross-platform website administration tool that supports webshell management. We suspect that these come from a Chinese attack group because the webshell codepage is 936, which is a Microsoft character encoding for simplified Chinese.”

GTSC’s advisory includes details about post-compromise activity and related malware, as well as steps it took to help customers respond to active compromises of their Exchange Server environment. But the company said it would withhold more technical details of the vulnerabilities for now.

In March 2021, hundreds of thousands of organizations worldwide had their email stolen and multiple backdoor webshells installed, all thanks to four zero-day vulnerabilities in Exchange Server.

Granted, the zero-day flaws that powered that debacle were far more critical than the two detailed this week, and there are no signs yet that exploit code has been publicly released (that will likely change soon). But part of what made last year’s Exchange Server mass hack so pervasive was that vulnerable organizations had little or no advance notice on what to look for before their Exchange Server environments were completely owned by multiple attackers.

Microsoft is quick to point out that these zero-day flaws require an attacker to have a valid username and password for an Exchange user, but this may not be such a tall order for the hackers behind these latest exploits against Exchange Server.

Steven Adair is president of Volexity, the Virginia-based cybersecurity firm that was among the first to sound the alarm about the Exchange zero-days targeted in the 2021 mass hack. Adair said GTSC’s writeup includes an Internet address used by the attackers that Volexity has tied with high confidence to a China-based hacking group that has recently been observed phishing Exchange users for their credentials.

In February 2022, Volexity warned that this same Chinese hacking group was behind the mass exploitation of a zero-day vulnerability in the Zimbra Collaboration Suite, which is a competitor to Microsoft Exchange that many enterprises use to manage email and other forms of messaging.

If your organization runs Exchange Server, please consider reviewing the Microsoft mitigations and the GTSC post-mortem on their investigations.

S Ventures Invests in Armorblox to Combat Email Threats Using Natural Language Understanding and AI

/0 Comments/in /by

Email remains one of the most targeted attack vectors in cybersecurity, and attackers are becoming increasingly sophisticated with their techniques. At the same time, many organizations are well on their way to moving email systems to the cloud. With cloud environments being particularly susceptible to threats such as phishing and credential stuffing, many enterprises are re-thinking their approach to addressing email security with emphasis on their need to analyze massive amounts of data efficiently and at scale.

This is why SentinelOne is excited to invest in Armorblox, a platform helping organizations fight email threats with the power of natural language understanding (NLU) and artificial intelligence (AI). The Armorblox platform connects over API and analyzes thousands of signals to understand the context of day-to-day email communications. The signals stem from user identity, user behavior, and email language; all to help build a fuller security understanding. This type of context-aware detection protects both people and data from compromise, outpacing what legacy email security controls are capable of. Armorblox is led by a strong team of entrepreneurs formerly of Netskope, Duo Security, StackRox, and ThoughtSpot.

Many vendors in the cybersecurity industry claim to be “powered by AI,” but often require keeping a human element in the monitoring and detection process. Armorblox’s approach is fully autonomous. As the pioneers of AI in an endpoint protection, detection, and response application, the SentinelOne Innovation team weighed in on Armorblox’s use of NLU and AI:

“We dove deep with the Armorblox team into their technology and were impressed. Armorblox has strong capabilities in machine learning (ML) and NLU which, when applied to email security, result in high detection rates and low false positives.” – Ido Kotler, Innovation Lead at SentinelOne

Leveraging the power of AI also means that enterprises can tailor fit their solutions to any specific needs of the business. Armorblox’s AI-based infrastructure is capable of using past learnings to create dynamic policies and building custom ML models for each end user to facilitate an iterative improvement process.

The value of Armorblox’s approach and overall platform was validated by our own experience as a customer. SentinelOne has been in production with Armorblox as our sole email protection platform for over a year.

“Armorblox was able to solve a lot of the issues we were facing when we implemented cloud-based email. Armorblox connected over API in 5 minutes and analyzed 6 months of email archives to build a communication baseline, showing quick time-to-value and high effectiveness.” – Sridhar Yelfireddy, Senior IT Infrastructure and Operations Leader at SentinelOne

Now, Armorblox and SentinelOne customers can benefit from our joint integration and partnership as well. SentinelOne’s XDR integration with the email security platform enriches incidents with contextual information about a user and any related email alerts. It also ensures that customers can prevent attacks, investigate hidden threats, and respond across these infrastructures with agility and precision.

Together, SentinelOne and Armorblox empower joint customers to protect their enterprises. Read more about the XDR integration and partnership here.

SentinelOne’s investment in Armorblox solidifies our partnership and showcases the power of AI-driven speed, scale, and accuracy across all facets of cybersecurity.