All posts tagged Email Security

By on August 4, 2011

The Eerie Quiet of your Junk Folder

Spam volumes on the Internet are down on this time last year. Great news, we can all relax and stop worrying about our Junk or Quarantine folders or that missing million dollar order that might he hiding therein.

Brian Krebs wrote a great piece on the take down of the most prolific botnets, which is thought to be the main cause of drought in spam. It’s certainly true to say that since the likes of Spammit, Rustock, Coreflood, Pushdo and Bredolab have been knobbled the output of spam has been noticeably less.

Less spam is great news, but I’m worried. I suspect this eerie quiet in our spam and junk folders is a false sense of security, and one that is waiting to draw us into a more evil and harmful place.

Think about it this way. You’re a spammer…

Imagine you’ve been spamming people since 1997, persuading them to buy penny stocks, herbal enhancements and more recently fake AV products. You’ve been getting frustrated at the shrinking rate of return on your efforts, for the billions of spam messages you send you’re only seeing a 0.002% return or even less; mind you, at $30 for a bottle of those fake-little-blue-pills that’s still a few million dollars.

Why the decline? Well because we the vendors, are doing a better job of detecting and dealing with spam. Giving customers a 98% anti-spam SLA means we’re confident we can keep that junk and rubbish out of their inboxes. The same is true for personal or webmail accounts, providers are simply getting better at protecting users.

Then just when you thought things couldn’t get much worse someone shuts down your botnet, or the FBI takes away you hosting provider. Bad day at the office?

This is why I am worried…

Given the business challenges the spammers face today it’s no surprise we’re seeing a decline in the volume of spam. But are we? The figures we’re looking at here are related to spam volumes delivered over SMTP based email, and those have been on the wane for some time. The recent precipitous drop makes me feel uneasy about the spammers new business models. You might be surprised I’m using the word ‘business’ in relation to spammers – don’t be; this is their business, they have offices, employees, health-care plans, support lines and staff retreats just like everyone else.

These business models embrace all the latest social media trends. Spammers are simply jumping on the new mechanisms we’re using to communicate, social media gives them everything they need and in many cases an even more targeted audience who are trained to ‘like’ the same things their peers do.

The deeper impact of this switch to less well evolved communication channels, is that the classic AV and AS protections deployed at the corporate gateway are fast being made redundant. Their rules unenforced, their quarantines empty. The threats they protect against are getting onto the network via other means that in many cases are far less well protected. The point is that the spam isn’t going away, it’s just changing and adapting to the marketplace; the users might be breathing a sigh of relief when they look at their inboxes, but I can guarantee you they’re not doing the same elsewhere – Try tweeting the word mortgage or loan and see what happens.

The old money was SMTP email based spam, but just like everything else in corporate IT consumerization is taking over; spammers & scammers are simply keeping up with the trends.

 

 

 

 

Add your comment (0)

CISSP, CCSK
Mimecast, North America.

Article Tags

, ,

By on December 1, 2010

A Little DLP can Protect from the Enemy Within – oh, and WikiLeaks

The headlines couldn’t be more relevant as I read through Dawhinderpal Sahota’s blog post about the 2010 KPMG Data Loss Barometer report.

Sahota’s writing picked out a few key gems from the KPMG report, the thrust of which made the claim;

A fifth of all reported data loss incidents in the first half of 2010 were a result of malicious attacks from inside the organization.

The headlines I am referring to are of course screaming about the latest WikiLeaks release; which like the last is bound to have come from an insider with “authorized access” to the system storing the data.

But as someone who has spent most of their career in IT Security this is not really news to me. We’ve known for a long time that the ‘people’ are always the weakest link in any security solution or policy – as humans we have a  natural ability to want to help people and trust them, assuming they are up to no good is hard for us.

Sahota’s blog points out that, as organizations (read, the IT team) get wise to hackers, the criminals are tempting the staff to pass on valuable information. Which is very true, but I think there is a stronger motivation at play here too, as the Wikileaks data shows. The motivation of the “Do-gooder” or the idealist who believes the public should be made aware of the ‘secret’ data they are looking at, presents a significantly greater threat. We need to rethink how we solve this problem with these two types of motivation in mind.

The KPMG report, and Sahota’s post, goes on to single out the Healthcare sector as suffering a large proportion of the leaks, mostly due to the working practices of its users. Sharing of passwords, portable media and accidental leaks all present a wide channel for data to leak out of the organization, but almost all Sectors share these same issues, and most try to combat them with awareness and education for their employees.

I think a better solution is to look towards technology. For example, password sharing can be mitigated by the use of Biometric two factor authentication. Portable media problems can be eliminated with the use of Centralized Endpoint Device Control Systems and of course all external channels can be protected once efficient DLP (Data Leak Prevention) tools have been deployed.

Each type of motivation for the attack or leak is going to need different a consideration. Education, awareness, technology and a good dose of luck are just the start of protecting your data from the baddies or publicity like WikiLeaks.

Add your comment (0)

CISSP, CCSK
Mimecast, North America.

Article Tags

, ,

By on September 13, 2010

Here You Have – the worm, virus, trojan combo

Not since Nimda and Code Red has there been so much excitement over a virus propagated around the Internet; the news channels are rolling out all sorts of experts for their doom and gloom opinions, and the dollar amount of lost business is already being totted up by those affected. The list of companies hit so far includes some household names like Comcast, Coca-Cola, ABC and NASA.

The similarities of the ‘Here you have’ worm and the likes of the ILOVEYOU and AnnaKournikova worms have not gone unnoticed – for example HYH uses the same subject line as AnnaKournikova!

Today I expect many of those affected by the HYH worm will be asking how it managed to propagate so well using mechanisms that have been in such wide use of the past 15 years. You have to give it to the writers of HYH, that’s a real retro-worm right there.

HYH has done alarmingly well since it was first spotted in the wild. It’s Worm like characteristics of using email as a distribution mechanism are not new, but the fact that HYH dodged so many security systems is a big surprise. Could this be because too many organizations have not yet protected their users from web borne threats by implementing URL scanning technology in both email and web browsing sessions? The Trojan like qualities of its socially engineered download link have duped many into clicking on the malicious link, surely we should know better? HYH will also email itself to your Outlook contacts as well as copy itself through network shares and drives. All in all HYH is a multifaceted nightmare that on the face of it appeared to look like many of the other worms out there today – yet HYH has been hugely successful. This is perhaps a factor of distribution via email and infection via URL where simply not enough zero day exploit protection was afforded to users.

All of this has left many administrators with only one option, and this isn’t something they have considered for a long time – unplug the network, take everything offline until you can get on-top of the problem. A sysadmin or network admins nightmare. Of those affected some may be able to rely on external continuity systems that offer both security and continuity, but the unlucky ones are probably looking at a long weekend of cleaning and patching.

So whilst others pick apart HYH and its impact on networks and the Internet, I can’t help but notice that this whole saga forces us to once more worry about issues we thought were dealt with. The spam and virus threat isn’t something that’s going to go away, and if anything HYH shows us that it is still possible for chaos to erupt at a moment’s notice. Chaos that can clearly come from the most unexpected direction.

Now is the time to review your setup, email security isn’t a done deal it’s a dynamic system that needs attention. If you haven’t already considered the HYH chaos as a source of downtime, and add that scenario to your continuity plan. And, last but not least, go back to the users and re-educate them on the threats that are clearly still out there.

Add your comment (0)

CISSP, CCSK
Mimecast, North America.

Article Tags

, , ,

By on August 31, 2010

Getting behind the botnet, a solution?

Our friends at MessageLabs released their monthly Intelligence Report this week. A number of other outlets and blogs have already reported on the prevalence of the Rustock Botnet, accounting for up-to 41% of spam. The MessageLabs report also goes onto highlight the current spam rate  at an alarmingly high 92.2%, up from 88% in July.

How did we get here? How have we managed to put up with this nonsense for so long? The rise of Botnets like Rustock, Grum, Lethic and Storm have made the problem more significant, and things are only going to get worse. We seem no closer to a solution to the spam problem than ever?

There has been much lambasting of Bill Gates since 2004 when he famously said that by 2006 “… spam will soon be a thing of the past.” Gates predicted that spam would be killed through the electronic equivalent of a stamp, and at the time various vendors were dabbling in similar standards-driven methods for authenticating genuine email and its sender. If only we understood then how important the botnet would become in the global spam problem.

The FUSSP

There is a concept in the anti-spam world called the FUSSP, an acronym for the Final Ultimate Solution to the Spam Problem; when you think have the FUSSP you may submit it to fussp.org and IETF, but there is a long list of criteria your FUSSP must fulfil – for example if your idea requires all SMTP gateways in the world to be the same or a replacement for SMTP, you have already failed.

Asking the world for the FUSSP is a great demonstration of crowd-sourcing a solution to a problem – but I can’t help but think that we’re missing an opportunity here.

A Coalition?

What if, we the collective email security vendors of the world unite to form an alliance against spam, viruses and phishing. We already have the knowledge, research and technology to do this but we choose to use it competitively rather than collaboratively. In a sense we would collectively BE the FUSSP.

This is a big problem that requires a big-thinking solution, bigger than each of us can imagine individually – if we could form this coalition we might be able to win this battle once and for all.

Then again, would a coalition be as agile as the dark forces driving the dark SMTP traffic business?
Or would it simply get so bogged down by bureaucratic red tape that it never managed to realise its goals?

As per usual the greater good comes in second place and the users of email systems suffer…

please comment and lets see what you think, I would like to see if anyone thinks this could work!

Add your comment (0)

CISSP, CCSK
Mimecast, North America.

Article Tags

, ,

By on August 2, 2010

Email Security: keep on running!

There is a race being run right now, a race that never ends, where the participants can’t stop for a breather, one of those races you keenly enter, but halfway through ask yourself why am I doing this again?

It’s the sort of race that appears to chase a point that is constantly moving with the horizon.

Running into the sunset

Enough of the race & horizon metaphor…

What I’m talking about is the constant cat and mouse game that we all play with the spammers, phishers, virus writer and general internet nasties. Almost every user who is exposed to the Internet understands the sort of problems that exist. Email administrators in particular have the tricky job of protecting their users and are best placed to understand the problem. But, keeping up with the ever changing threat landscape is a constant balance and battle, and takes dedication if you’re prepared to fight that fight yourself.

Research tells us that senders of malicious email, (by which I mean spam, virus, phishing and all the other junk out there) are trying to get each individual piece of malicious email into your inbox within 11 minutes of the time they release it to the wild. If it takes longer, they move on. Why is this? Because within those 11 minutes the security vendors of the world have detected the new threat and have started to issue updates to protect their client base against it.

As with most things the early bird does indeed get the worm, or in this case your inbox gets the worm (or spam, or phishing attack).

Many on-site security appliances and software solutions have these updates pushed down to them by their respective vendors, which is a great idea but strikes me as a little too slow. If this is all about speed, we really need to be thinking about the fastest and most efficient way of keeping up.

If I were a spammer…

…or virus writer, I would be depending on, and even taking advantage of, the slow reaction of you or your security vendor, I would be hoping that someone somewhere isn’t as alert as perhaps they should be.

Of course in my new dark world of spamming, phishing and viruses, the nature of my business is speed and money. The faster I am the more money I make. I will be praying on people who don’t think like this, people who are slower than I am.

Add your comment (0)

CISSP, CCSK
Mimecast, North America.

Article Tags

, , ,

By on June 23, 2010

Meet Dave- he manages email [VIDEO]

Dave is a busy email administrator, yet suddenly he seems to have a lot more time on his hands. Why? He no longer needs to worry about email archiving, email continuity and email security.

Add your comment (0)


Article Tags

, , , , , ,