Over the last year, Google has teamed up with University of California, Berkley and the International Computer Science Institute. They’ve been collecting, analyzing, and reporting data on the contemporary landscape of black-hat email credential theft. In a period between March 2016-2017, Google anonymously inserted themselves into private forums and credential trading markets. They’ve been learning how the bad guys steal your login, password information and are operating and evolving in the modern era. Kurt Thomas has said that Google’s newest study is a great next step in assessing digital risks. Thomas said that it “presents the first longitudinal measurement study of the underground ecosystem fueling credential theft and assesses the risk it poses to millions of users.” So, what’s that all mean for you? Let’s break down the numbers and outline 3 major take-away’s from Google’s study.
This study analyzed databases of purportedly stolen email credential information throughout 2016. Of these datasets, roughly 788,000 instances were the result of keyloggers, 12.4 million were sourced from phishing kits, and 1.9 billion credentials stolen in larger data breaches.
1. The Bad Guys Are Staying Up-To-Date. Are You?
If you’ve considered beefing up your security infrastructure but it’s safe to lag a year or two, you’re being outclassed. Black-hat forums distribute pre-built phishing kits and keyloggers. These are built with thousands of variants and iterations to ensure that they stay on the cutting-edge of cybercrime. Google’s study identified over 4,000 different strains of phishing kits available in 2016, and that’s only the variants they DID find.
The bad guys aren’t making off with only information from old, unused, or abandoned accounts. 7% to 25% of recovered credentials matched the current login credentials of the accounts they were stolen from. (Don’t worry, Google made sure to reset any compromised accounts they identified!) Phishing kits in particular showed troubling results in this area: a whopping 25% of the stolen data that Google reviewed matched current, usable login credentials. The study concluded that victims of phishing kits are 400 times more likely to be successfully hijacked than an average user.
2. Corporate Phishing is a Cyber Gold Rush
That old prospector was right when he warned us all about the dangers of social engineering in the age of communication. During their research period, Google detected 234,887 instances of potentially valid credentials being transmitted to an exfiltration point per week. Read that statement again. Not 234,887 attempts. 234,887 successful transmissions of potentially valid credentials per week. The estimated success rate for a phishing kit is 9%.
- Phishing kits were largely aimed at victims located in the United States, with just shy of 50% of identified victims’ geolocations based in the U.S.
- 83% of phishing kits collect geolocation data in addition to login credentials
- 40% collect financial information such as credit card data
- 18% collect phone numbers
- 16% collect User-Agent data such as the browser, device, and platform in use at the time of the attack
- 9% collect social security numbers
3. “Stronger Passwords” Can Only Do So Much
Increasingly, organizations are coming to terms with the fact that a simple login/password combination is the bare bones when it comes to email security. Even hashed passwords based on salt values are proving flimsy under scrutiny. Google’s report estimating that almost 15% of the stolen credentials in their study were hashed. They were hashed by using MD5 and 10% with SHA-1 cryptographic hash functions.
To make matters worse, it can hardly be said that victims are learning from their mistakes. Research indicated that of victims that had their credentials stolen, only 3% later chose to switch to a two-factor authentication process.
What Can I Do About It?
These numbers may be grim, but so long as organizations are as dedicated to email security as the bad guys are to stealing data, there is hope. Increasing usage of two-factor authentication means that the business world’s approach to cybersecurity is begrudgingly moving past the bare minimum. An even more secure future can be found in various email security subscriptions, encryption services, and anti-virus/anti-spam clients. Here are a couple recommendations for products that can prevent your login credentials from winding up on a black-market spreadsheet.
Email Encryption
Email encryption is the process of encrypting the content of outbound messages in order to prevent 3rd party entities from intercepting and reading that data. In many cases, this means that the readable plain text has been scrambled into a cipher text which can only be unjumbled by a private key. The private key is held by a recipient that matches the public key attached to the encrypted data. Email encryption services are usually subscription services that entail additional features and services in addition to message encryption.
- Record ID Matching: Scans outbound content for sensitive information before delivery
- Attachment Scanning: Probes potentially harmful attachments to ensure safety before opening
- Predefined Compliance Policies: Built-in policies designed to be easily deployable for common problems and compliance issues such as HIPPA or PCI
- Approval Boxes: Allows you to preview unverified emails before they are opened onto your network
LEARN MORE ABOUT EMAIL ENCRYPTION
TotalSecure Email
SonicWall TotalSecure Email provides complete protection for both inbound and outbound e-mail by providing award-winning anti-spam, anti-virus, anti-phishing, and policy and compliance management in one easy-to-use solution. For larger organizations there is simply no easier way to get complete email security. TotalSecure is a comprehensive package that holistically protects your inbox’s attack surfaces from every conceivable angle of attack by bundling several useful subscriptions together into a single strategy.
- McAfee Anti-Virus: To keep the bugs at bay
- SonicWall Time Zero: Protection from zero-day threats, focusing on the time frame between initial detection and receiving signature-based solutions
- Corporate Phishing Protection: Uniquely identifies phishing attempts and enables admin to handle them independently from spam
- Email Policy Management: Allows admin to quickly create and enforce corporate compliance policies
- End-User Spam Management: Delegates spam management to end-users, reducing false positives and easing the load on your IT guys
LEARN MORE ABOUT TOTALSECURE EMAIL FROM SONICWALL
Want to see Google’s research for yourself? Download the PDF.
