CyberheistNews Vol 10 #03
[Heads-Up] New Office 365 Phishing Attack Targets OAuth Apps Instead of Credentials 
Trying to steal your username and password is so “yesterday.” The 2020 Hacker is now leveraging Office 365 OAuth APIs to gain control over user mailboxes with phishing tactics.
The usefulness of a captured Office 365 user logon to an attacker is only valuable until the logon's owner realizes they’ve been compromised, and their password is changed. And so, like any good attack, cybercriminals want to establish persistence – the ability for their target to remain accessible to them.
A new phishing attack spotted by security researchers at PhishLabs uses a malicious Office 365 App rather than the traditional spoofed logon page to gain access to a user’s mailbox.
Using traditional phishing tactics, victims are lured into clicking on a malicious link that appears to be hosted in SharePoint Online or in OneDrive. The malicious payload is a URL link that requests access to a user’s Office 365 mailbox.
By pressing ‘Accept’, the bad guys are granted full access to the user’s mailbox and contacts, as well as any OneDrive files the user can access.
Here Is Where the Evil Genius Comes In
Because the result of this attack is an app has been connected and granted access to an Office 365 account, resetting the user’s password has no effect. To eliminate the malicious access, the app must be disconnected – a completely separate process!
The good news is that your users still need to fall for the initial phishing email asking them to click the malicious link. Organizations that put users through continual security awareness training know their users have been taught to easily spot attempted attacks like this and not fall for them.
At the end of the day, this is just another phishing attack; there’s nothing particularly impressive about the phish. So, keep your users vigilant – as long as they can spot the phish, there’s nothing to worry about.
This is an interesting one for your friends. Send them a link to this blog post which has a screenshot:
https://blog.knowbe4.com/new-office-365-phishing-attack-targets-oauth-apps-instead-of-credentials
Trying to steal your username and password is so “yesterday.” The 2020 Hacker is now leveraging Office 365 OAuth APIs to gain control over user mailboxes with phishing tactics.
The usefulness of a captured Office 365 user logon to an attacker is only valuable until the logon's owner realizes they’ve been compromised, and their password is changed. And so, like any good attack, cybercriminals want to establish persistence – the ability for their target to remain accessible to them.
A new phishing attack spotted by security researchers at PhishLabs uses a malicious Office 365 App rather than the traditional spoofed logon page to gain access to a user’s mailbox.
Using traditional phishing tactics, victims are lured into clicking on a malicious link that appears to be hosted in SharePoint Online or in OneDrive. The malicious payload is a URL link that requests access to a user’s Office 365 mailbox.
By pressing ‘Accept’, the bad guys are granted full access to the user’s mailbox and contacts, as well as any OneDrive files the user can access.
Here Is Where the Evil Genius Comes In
Because the result of this attack is an app has been connected and granted access to an Office 365 account, resetting the user’s password has no effect. To eliminate the malicious access, the app must be disconnected – a completely separate process!
The good news is that your users still need to fall for the initial phishing email asking them to click the malicious link. Organizations that put users through continual security awareness training know their users have been taught to easily spot attempted attacks like this and not fall for them.
At the end of the day, this is just another phishing attack; there’s nothing particularly impressive about the phish. So, keep your users vigilant – as long as they can spot the phish, there’s nothing to worry about.
This is an interesting one for your friends. Send them a link to this blog post which has a screenshot:
https://blog.knowbe4.com/new-office-365-phishing-attack-targets-oauth-apps-instead-of-credentials
[Live Demo] Identify and Respond to Email Threats Faster With PhishER
Your users are likely already reporting potentially dangerous emails in some fashion within your organization. The increase of this email traffic can present a new problem!
With only approximately 1 in 10 user-reported emails being verified as actually malicious, how do you handle the real phishing attacks and email threats —and just as importantly— effectively manage the other 90% of user-reported messages accurately and efficiently?
Now you can with PhishER, a product which allows your Incident Response team to quickly identify and respond to email threats faster. This will save them so much time!
See how you can best manage your user-reported messages.
Join us, Tuesday, January 21 @ 2:00 pm (ET) for a live 30-minute demonstration of the PhishER platform. With PhishER you can:
Date/Time: Tuesday, January 21 @ 2:00 pm (ET)
Save My Spot:
https://event.on24.com/wcc/r/2165375/1AB3377D6B7498CB06A81945579E91A5??partnerref=CHN1
Your users are likely already reporting potentially dangerous emails in some fashion within your organization. The increase of this email traffic can present a new problem!
With only approximately 1 in 10 user-reported emails being verified as actually malicious, how do you handle the real phishing attacks and email threats —and just as importantly— effectively manage the other 90% of user-reported messages accurately and efficiently?
Now you can with PhishER, a product which allows your Incident Response team to quickly identify and respond to email threats faster. This will save them so much time!
See how you can best manage your user-reported messages.
Join us, Tuesday, January 21 @ 2:00 pm (ET) for a live 30-minute demonstration of the PhishER platform. With PhishER you can:
- Cut through your Incident Response inbox noise and respond to the most dangerous threats more quickly
- Automate message prioritization by rules you set into one of three categories: Clean, Spam or Threat
- Augment your analysis and prioritization of user-reported messages with PhishML, PhishER’s new machine-learning module
- See clusters of messages to identify a potential phishing attack against your organization
- Meet critical SLAs within your organization to process and prioritize threats and legitimate emails
- Easy integration with KnowBe4’s Phish Alert email add-in button, or forwarding to a mailbox works too...
Date/Time: Tuesday, January 21 @ 2:00 pm (ET)
Save My Spot:
https://event.on24.com/wcc/r/2165375/1AB3377D6B7498CB06A81945579E91A5??partnerref=CHN1
[Scam of the Week] Don't Fall for This Trick: “Start your 2020 with a gift from us”
Paul Ducklin at Naked Security warned us about a scam that is going around and promises a gift by courier from overseas where the other person hasn’t told you what they’re sending, and the courier company doesn’t deliver the item directly.
Sometimes you get an email saying that the item is delayed because customs want to inspect it; or there’s import duty; or there’s an extra fee if you can’t collect it from the depot yourself. And to help you get through the paperwork easily, there’s often a tracking code and a clickable link in the email.
You can see where this is going, because cybercrooks love to copy real life on the grounds that it’s easier to lull you into a false sense of security when you’re following a process that feels familiar.
Scams like this aren’t so far away from real life, because emails from courier companies that document unexpected import and delivery charges are not that unusual and neither are gifts during the holiday season. Moreover, being gifts, they’re often a surprise that you don’t find about until either you or customs officials open the package. Well, don't fall for this kind of seasonal trick.
I suggest you send the following to your employees, friends and family. Feel free to copy/paste/edit:
ALERT: Bad guys are sending phishing emails that claim there is a free New Year's gift from overseas waiting for you. It's a scam. Here are four reminders about phishing emails like this:
https://blog.knowbe4.com/scam-of-the-week-dont-fall-for-this-tricky-start-your-2020-with-a-gift-from-us?
Paul Ducklin at Naked Security warned us about a scam that is going around and promises a gift by courier from overseas where the other person hasn’t told you what they’re sending, and the courier company doesn’t deliver the item directly.
Sometimes you get an email saying that the item is delayed because customs want to inspect it; or there’s import duty; or there’s an extra fee if you can’t collect it from the depot yourself. And to help you get through the paperwork easily, there’s often a tracking code and a clickable link in the email.
You can see where this is going, because cybercrooks love to copy real life on the grounds that it’s easier to lull you into a false sense of security when you’re following a process that feels familiar.
Scams like this aren’t so far away from real life, because emails from courier companies that document unexpected import and delivery charges are not that unusual and neither are gifts during the holiday season. Moreover, being gifts, they’re often a surprise that you don’t find about until either you or customs officials open the package. Well, don't fall for this kind of seasonal trick.
I suggest you send the following to your employees, friends and family. Feel free to copy/paste/edit:
ALERT: Bad guys are sending phishing emails that claim there is a free New Year's gift from overseas waiting for you. It's a scam. Here are four reminders about phishing emails like this:
- Beware free gifts. Seriously, there is no such things as a free lunch. Don’t give out personal data to organizations or people you’ve never heard of.
- Beware courier emails. When sending or receiving items by courier, get in contact with the recipient or sender by phone – to let them knows about the courier company you’re using and to provide a tracking number you can both trust.
- These days most cybercriminals are using "HTTPS" websites because everyone expects a padlock in the address bar. But the padlock doesn’t mean you are on a legit site, just that you are on a site with an HTTPS certificate.
- Do not click on links in emails. Ever. Go to your browser and type in the address of the site.
https://blog.knowbe4.com/scam-of-the-week-dont-fall-for-this-tricky-start-your-2020-with-a-gift-from-us?
[NEW WEBINAR] Now That Ransomware Has Gone Nuclear, How You Can Avoid Becoming the Next Victim?
There is a reason more than half of today’s ransomware victims end up paying the ransom. Cyber-criminals have become thoughtful; taking time to maximize your organization’s potential damage and their payoff. After achieving root access, the bad guys explore your network reading email, finding data troves and once they know you, they craft a plan to cause the most panic, pain, and operational disruption. Ransomware has gone nuclear.
Join us, Thursday, January 30 @ 2:00 pm (ET), for this webinar where, Roger Grimes, KnowBe4’s Data-Driven Defense Evangelist, will dive into:
Save My Spot!
https://event.on24.com/wcc/r/2167034/5A8EF121985F381E388D990EB12BF86F?partnerref=CHN1
There is a reason more than half of today’s ransomware victims end up paying the ransom. Cyber-criminals have become thoughtful; taking time to maximize your organization’s potential damage and their payoff. After achieving root access, the bad guys explore your network reading email, finding data troves and once they know you, they craft a plan to cause the most panic, pain, and operational disruption. Ransomware has gone nuclear.
Join us, Thursday, January 30 @ 2:00 pm (ET), for this webinar where, Roger Grimes, KnowBe4’s Data-Driven Defense Evangelist, will dive into:
- Why data backups (even offline backups) won’t save you
- Evolved threats from data-theft, credential leaks, and corporate impersonation
- Why ransomware isn’t your real problem
- How your end users can become your best, last line of defense
Save My Spot!
https://event.on24.com/wcc/r/2167034/5A8EF121985F381E388D990EB12BF86F?partnerref=CHN1
[FUN DEPT] So, How Do You Say Congrats in a *Really* Big Way? Check -THIS- out!:
I was scratching my head. How do you say Congrats to your team when they have done a truly AWESOME job in 2019, and totally knocked it out of the park in the last quarter?
We are known to do fun and crazy things in KnowBe4, but how do you top what you did last time?
So I asked my Chief of Staff Tiffany Mortimer if she had any ideas. Lo and behold, she came up with something really creative—she gets full credit for this one—and then she got the whole thing executed in just a few days when this normally takes a month.
So how does it look when you have a banner year (lame pun intended) and wrap a building with a huge... banner? Check out how -that- looks!:
https://blog.knowbe4.com/fun-dept-so-how-do-you-say-congrats-in-a-really-big-way
I was scratching my head. How do you say Congrats to your team when they have done a truly AWESOME job in 2019, and totally knocked it out of the park in the last quarter?
We are known to do fun and crazy things in KnowBe4, but how do you top what you did last time?
So I asked my Chief of Staff Tiffany Mortimer if she had any ideas. Lo and behold, she came up with something really creative—she gets full credit for this one—and then she got the whole thing executed in just a few days when this normally takes a month.
So how does it look when you have a banner year (lame pun intended) and wrap a building with a huge... banner? Check out how -that- looks!:
https://blog.knowbe4.com/fun-dept-so-how-do-you-say-congrats-in-a-really-big-way
[On-Demand Webinar] 12 Ways to Defeat Multi-Factor Authentication
Everyone knows that multi-factor authentication (MFA) is more secure than a simple login name and password, but too many people think that MFA is a perfect, unhackable solution. It isn't!
Join Roger A. Grimes, KnowBe4's Data-Driven Defense Evangelist, and security expert with over 30-years experience, for this on-demand webinar where he will explore 12 ways hackers can and do get around your favorite MFA solution.
The webinar includes a hacking demo by KnowBe4's Chief Hacking Officer, Kevin Mitnick, and real-life successful examples of every attack type. Roger will share ideas about how to better defend your MFA solution so that you get maximum benefit and security.
You'll learn about the good and bad of MFA, and become a better computer security defender in the process, including:
https://info.knowbe4.com/webinar-12-ways-to-defeat-mfa
Let's stay safe out there.
https://info.knowbe4.com/overcoming_challenges_managing_third_party_compliance
Everyone knows that multi-factor authentication (MFA) is more secure than a simple login name and password, but too many people think that MFA is a perfect, unhackable solution. It isn't!
Join Roger A. Grimes, KnowBe4's Data-Driven Defense Evangelist, and security expert with over 30-years experience, for this on-demand webinar where he will explore 12 ways hackers can and do get around your favorite MFA solution.
The webinar includes a hacking demo by KnowBe4's Chief Hacking Officer, Kevin Mitnick, and real-life successful examples of every attack type. Roger will share ideas about how to better defend your MFA solution so that you get maximum benefit and security.
You'll learn about the good and bad of MFA, and become a better computer security defender in the process, including:
- 12 ways hackers get around multi-factor authentication
- How to defend your multi-factor authentication solution
- The role humans play in a blended-defense strategy
https://info.knowbe4.com/webinar-12-ways-to-defeat-mfa
Let's stay safe out there.
Warm Regards,
Stu Sjouwerman
Founder and CEO
KnowBe4, Inc
https://info.knowbe4.com/overcoming_challenges_managing_third_party_compliance
Quotes of the Week
"At the center of your being you have the answer; you know who you are and you know what you want." - Lao Tzu - Philosopher (604 - 531 BC)
"There has never been a good war or a bad peace."
- Benjamin Franklin, Founding Father, Diplomat (1706 - 1790)
Thanks for reading CyberheistNews
"There has never been a good war or a bad peace."
- Benjamin Franklin, Founding Father, Diplomat (1706 - 1790)
Thanks for reading CyberheistNews
Security News
Encryption Isn’t Your Only Ransomware Problem - There Are Some Other Nasty Issues
Ransomware has become one of the most dreaded problems in the cyber world and it’s only getting worse. Much worse!
Traditionally, ransomware was a trojan horse malware program which when it found a new host computer simply went off, encrypted all the data it could find, and sent the user an onscreen message to pay a particular ransom amount using an untraceable cryptocurrency. That was bad enough.
These days, ransomware has become much worse and a great backup isn’t going to save you. How has it gotten worse? This blog post is a 7-minute read and very much worth it:
https://blog.knowbe4.com/encryption-isnt-your-only-ransomware-problem-there-are-some-other-nasty-issues
Ransomware has become one of the most dreaded problems in the cyber world and it’s only getting worse. Much worse!
Traditionally, ransomware was a trojan horse malware program which when it found a new host computer simply went off, encrypted all the data it could find, and sent the user an onscreen message to pay a particular ransom amount using an untraceable cryptocurrency. That was bad enough.
These days, ransomware has become much worse and a great backup isn’t going to save you. How has it gotten worse? This blog post is a 7-minute read and very much worth it:
https://blog.knowbe4.com/encryption-isnt-your-only-ransomware-problem-there-are-some-other-nasty-issues
The Top 5 Eyeopener Strategies to Improve Your IT Defenses and Keep Bad Guys out of Your Network
Last year, in 2019 according to CVEdetails, there were 12,174 new, publicly announced vulnerabilities. If that sounds like a high number, it’s a lot less than the previous two years. We had 16,556 in 2018 and 14,714 the year before.
And that’s on top of the several hundreds of millions of unique malware programs and all the conniving human adversaries trying to break into your organization, including nation-states, financial criminals, data and IP thieves, hacktivists, and script kiddies. All-in-all we’ve got a lot to worry about.
Cybersecurity defense is all about decreasing risk from the most likely attacks. The sheer number of new threats definitely complicates the job, but you can significantly improve your defense and it likely won’t cost you much. It’s more of a re-focusing on what should matter the most.
Here are 5 eyeopener strategies to improve your IT defenses and keep the bad guys out of your network.
https://blog.knowbe4.com/the-top-5-eyeopener-strategies-to-improve-your-it-defenses-and-keep-bad-guys-out-of-your-network
Last year, in 2019 according to CVEdetails, there were 12,174 new, publicly announced vulnerabilities. If that sounds like a high number, it’s a lot less than the previous two years. We had 16,556 in 2018 and 14,714 the year before.
And that’s on top of the several hundreds of millions of unique malware programs and all the conniving human adversaries trying to break into your organization, including nation-states, financial criminals, data and IP thieves, hacktivists, and script kiddies. All-in-all we’ve got a lot to worry about.
Cybersecurity defense is all about decreasing risk from the most likely attacks. The sheer number of new threats definitely complicates the job, but you can significantly improve your defense and it likely won’t cost you much. It’s more of a re-focusing on what should matter the most.
Here are 5 eyeopener strategies to improve your IT defenses and keep the bad guys out of your network.
- Understand Risk Better
- Concentrate on Defeating Phishing
- Better Patch – Focus on the Right Things
- Tested Restore
- Early Detection
https://blog.knowbe4.com/the-top-5-eyeopener-strategies-to-improve-your-it-defenses-and-keep-bad-guys-out-of-your-network
What KnowBe4 Customers Say
"I wanted to reach out to share some positive feedback, and I’m copying our CEO and Executive VP for visibility. We’ve recently worked closely with your MSP teams to close our largest joint opportunity to date. You may know this particular opportunity required a lot of heavy lifting from both our teams in the lead up to closing the deal, as well as after the fact.
I wanted to share that your team was very helpful throughout the lengthy process. There were definitely times where extensive administration limited the light at the end of the tunnel, but thanks to the willingness-to-help of Heather and Kelly, possible frustrations and miscommunications were defused.
We have immense growth potential with this customer – so more heavy lifting might come our way – and I trust we’ll continue to be successful together.
We’ve learned a lot working through this opportunity, and I look forward building a mature MSP program together. We’re really just getting started, and I see a massive opportunity for a well-oiled Security Awareness business together.
I only got to work with Kelly and Heather this year (and Monica, who’s been very supportive on the resale side), and the team has been great to work with. I look forward to a more strategic partnership in 2020. I hope to join you for KB4-CON in April, and discuss this more with you and the team.
- M.J., Director, Strategic Alliances
"I wanted to reach out to share some positive feedback, and I’m copying our CEO and Executive VP for visibility. We’ve recently worked closely with your MSP teams to close our largest joint opportunity to date. You may know this particular opportunity required a lot of heavy lifting from both our teams in the lead up to closing the deal, as well as after the fact.
I wanted to share that your team was very helpful throughout the lengthy process. There were definitely times where extensive administration limited the light at the end of the tunnel, but thanks to the willingness-to-help of Heather and Kelly, possible frustrations and miscommunications were defused.
We have immense growth potential with this customer – so more heavy lifting might come our way – and I trust we’ll continue to be successful together.
We’ve learned a lot working through this opportunity, and I look forward building a mature MSP program together. We’re really just getting started, and I see a massive opportunity for a well-oiled Security Awareness business together.
I only got to work with Kelly and Heather this year (and Monica, who’s been very supportive on the resale side), and the team has been great to work with. I look forward to a more strategic partnership in 2020. I hope to join you for KB4-CON in April, and discuss this more with you and the team.
- M.J., Director, Strategic Alliances
KnowBe4 December Content Update
We've got lots of new stuff for you. This update includes new versions of Email Exposure Check Pro and phishing security test tools now in 20+ languages. Check it all out here:
https://blog.knowbe4.com/december-content-update-includes-new-versions-of-email-exposure-check-pro-and-phishing-security-test-tools
We've got lots of new stuff for you. This update includes new versions of Email Exposure Check Pro and phishing security test tools now in 20+ languages. Check it all out here:
https://blog.knowbe4.com/december-content-update-includes-new-versions-of-email-exposure-check-pro-and-phishing-security-test-tools
The 10 11 Interesting News Items This Week
- Encryption Isn’t Your Only Ransomware Problem - There Are Some Other Nasty Issues:
https://blog.knowbe4.com/encryption-isnt-your-only-ransomware-problem-there-are-some-other-nasty-issues - Iran’s Military Response May Be ‘Concluded,’ but Cyberwarfare Threat Grows:
https://www.nytimes.com/2020/01/08/us/politics/iran-attack-cyber.html - CISA INSIGHTS Increased Geopolitical Tensions and Threats Document with 9 Things To Do:
https://www.documentcloud.org/documents/6598719-CISA-Insights-Increased-Geopolitical-Tensions.html - New Standards Set to Reshape Future of Email Security... maybe:
https://www.darkreading.com/application-security/new-standards-set-to-reshape-future-of-email-security/a/d-id/1336683 - New Iranian data wiper malware hits Bapco, Bahrain's national oil company:
https://blog.knowbe4.com/bahrians-national-oil-company-hit-by-iranian-dustman-data-wiper - The Evolution Of Phishing And Five Tips To Avoid Being Caught. By yours truly in Forbes:
https://www.forbes.com/sites/forbestechcouncil/2020/01/08/the-evolution-of-phishing-and-five-tips-to-avoid-being-caught/#a5271045adc1 - Facebook Bans Deepfakes but Permits Some Altered Content:
https://www.wsj.com/articles/facebooks-deepfake-video-ban-permits-some-altered-content-11578384519 - Travelex Outage Blamed on Ransomware Attack & takes Share price down 6%:
https://blog.knowbe4.com/revil-ransomware-pay-us-one-way-or-the-other - SNAKE Ransomware Is the Next Threat Targeting Business Networks:
https://www.bleepingcomputer.com/news/security/snake-ransomware-is-the-next-threat-targeting-business-networks/ - How Iran built an online disinformation machine to rival Russia's:
https://www.telegraph.co.uk/technology/2020/01/08/iran-built-online-disinformation-machine-rival-russias/ - BONUS: Why Phishing Threatens Your Brand’s Integrity:
https://www.cpomagazine.com/cyber-security/why-phishing-threatens-your-brands-integrity/
Cyberheist 'Fave' Links
This Week's Links We Like, Tips, Hints and Fun Stuff
- This week's Virtual Vacation in 3 minutes Istanbul in 4K. Gorgeous:
https://www.flixxy.com/istanbul-city-in-4k.htm?utm_source=4
- And a BONUS Virtual Vacation in Yehliu Geopark, Taiwan in 4K Ultra HD. This place looks alien:
https://www.youtube.com/watch?v=z16fYA5mqVE
- Vacation To The Past: Travel back in time to 1911 and take a trip through New York City - now in color!
https://www.flixxy.com/new-york-city-1911-in-color.htm?utm_source=4
- Mentalist and professional magician Oz Pearlman amazes the judges and audience of America's Got Talent 2020:
https://www.flixxy.com/mentalist-oz-pearlman-americas-got-talent-2020-the-champions.htm?utm_source=4
- There is a brand-new documentary live now: "KnowBe4, The Making Of A Unicorn. A Cybersecurity Story." You can watch these 23 minutes here, watch it at lunch!:
https://www.youtube.com/watch?v=W9UvWQJoRfE&feature=share
- Test riding Manta5: The unholy offspring of a boat, an airplane, and an e-bike. I want one!
https://www.digitaltrends.com/cool-tech/manta5-hydrofoil-ebike-test-ride-ces-2020/
- Scottish Trials Bike legend Danny MacAskill shows us in his new film ‘Gymnasium’ that there are other ways to make your mark in the gym:
https://www.flixxy.com/danny-macaskills-gymnasium-bike-adventure.htm?utm_source=4
- Video made from 400,000 photos of comet Churyumov-Gerasimenko (67p) taken by ESA's Rosetta spacecraft:
https://vimeo.com/347565673
- Bosch uses AI to block out the sun’s glare as you drive. Now -that- looks handy:
https://www.techradar.com/news/bosch-uses-ai-to-block-out-the-suns-glare-as-you-drive
- Antarctica - The Frozen Continent - 4k Drone Video:
https://www.youtube.com/watch?v=TiXOQn7z9Hg
- Crazy, Lucky, And Stupidly Planned But Recovered - Nassau County recovers $710,000 sent in phishing scam:
https://abc7ny.com/5834546/
- For The Kids #1 -The incredible ibex defies gravity and climbs a dam | BBC:
https://www.flixxy.com/incredible-ibex-defies-gravity-and-climbs-a-dam.htm?utm_source=4 - For The Kids #2 - Footage of 'lion' escaping from Japanese zoo goes viral:
https://www.youtube.com/watch?v=BtM281gVWNM&feature=youtu.be
