Phishing for Cloud Providers A New Supply Chain Threat

 

 

Krebs explained that compromising a CRM gave the attackers the ability to imitate United Rentals through a legitimate portal, as well as granting them access to the company’s customer email list. 

 

“Companies that use cloud-based CRMs sometimes will dedicate a domain or subdomain they own specifically for use by their CRM provider, allowing the CRM to send emails that appear to come directly from the client’s own domains,” he wrote. “However, in such setups the content that gets promoted through the client’s domain is actually hosted on the cloud CRM provider’s systems.” 

 

Dan Higgins, United Rentals’ chief information officer, told Krebs that it appears an attacker used a CRM provider account to send malicious emails United Rentals’ customers. “At this point, we believe this to be an email phishing incident in which an unauthorized third party used a third-party system to generate an email campaign to deliver what we believe to be a banking Trojan,” Higgins said.

 

In this case, the CRM appeared to be Pardot, an email marketing platform owned by Salesforce, but a Salesforce spokesman told Krebs that the compromised account belonged to a third-party marketing agency that was using the Pardot platform. This account was not using multi-factor authentication.

 

In order to defend themselves against these types of attacks, organizations need to monitor the third-party services they use, as well as ensure that their own employees are resistant to phishing attacks. Employees of all levels and at all kinds of organizations can benefit from new-school security awareness training.