Latest / Parsing the Truth: One Byte at a Time / Business Email Compromise

Transcript

Business Email Compromise · Parsing the Truth: One Byte at a Time

0:01
Join former FBI Senior Forensic Examiner's Becky Passmore and
0:05
Stacey Eldridge as they dig into the world of digital forensics
0:08
one bite at a time. Now leading their own consulting
0:11
firms and educating the next generation of cyber sleuths,
0:14
these badass babes of digital forensics bring sharp insight,
0:18
real world case experience, and a dose of humor to the bits and
0:21
bites that build today's investigations.
0:23
From deep dives into business e-mail compromise and ransomware
0:26
attacks, Becky's specialty to cracking the complexities of
0:29
iPhone forensics, Stacy's obsession, this podcast delivers
0:33
insider knowledge for professionals, students, and
0:36
true crime techies alike. If you've ever wondered what
0:39
really happens when the digital trail is all that's left, TuneIn
0:42
and start parsing the truth. Welcome back to Parsing the
0:53
Truth One Bite at a Time, where we cut through digital noise to
0:56
reveal how investigations really unfold.
1:00
I'm your host Stacy and as always I'm joined by my Co host
1:03
Becky. Thanks, Stacy.
1:05
We're excited. And for today's episode, one
1:08
that hits organizations of every size is about to.
1:11
We're about to tell you all about it.
1:13
Absolutely. And today, we're tackling one of
1:16
the most costly and misunderstood cyber crimes
1:19
around business e-mail compromise, otherwise known as
1:24
BEC. We'll explore how attackers
1:27
manipulate inboxes, how investigators follow the trail
1:31
in the cloud, and what organizations can do to prevent
1:34
these crimes before money leaves the account.
1:37
Absolutely. And to help us break this down,
1:39
we brought in a special guest we have, Jamie Memro.
1:42
Jamie, why don't you introduce yourself to our listeners and
1:45
let them know what you do. And we're very thankful to have
1:48
you here tonight. Thank you, Becky.
1:50
Hi, everybody. It's nice to to meet you all.
1:52
First and foremost, I wanted to thank Becky and Stacy for having
1:56
me on the podcast today. Seeing two women come together
1:59
and just share the knowledge and expertise is truly phenomenal
2:04
and I'm honored to be a part of it.
2:05
So a little bit about me. So I am a digital forensic
2:09
examiner at Cyber Reason. They opened up their DFIR
2:13
consulting services in January of this year.
2:16
So we're coming up on the nine month mark where we provide a
2:20
variety of digital forensic investigations that ranges from
2:24
ransomware, insider threats. We also do tabletop exercises as
2:29
well as what I specialize in obviously and why I'm here
2:31
today, business e-mail compromises.
2:34
So that includes obviously the most popular Microsoft 365, also
2:39
known as M365, Google Workspace, also known as G Suites, as well
2:44
as Exchange. Prior to Cyber Reason, I was at
2:47
Coral Cyber for 6 1/2 years where I completed the same types
2:51
of forensic investigations. That's also where I crossed
2:55
paths with Becky. She was the Exchange Proxy Shell
2:58
Pro there. I remember the first time
3:00
hearing her talk. I was like, Oh my gosh, I got to
3:02
get ahold of this girl. You know, she has got to show me
3:05
how she just did that. So, you know, she was quick to
3:07
jump on a call with me and show me everything, and then I was
3:11
able to help out when she was swamped with proxy shell with
3:13
the M365 and G Suite cases. So, you know, I truly love those
3:18
days and I'm happy to be here today talking about what I'm
3:22
seeing on the front lines and PCs.
3:24
Awesome. And Jamie, so excited you're
3:27
here to bring so much knowledge with you to this episode.
3:31
And our listeners are just going to be fascinated by everything
3:34
you say. I just know it.
3:36
But some people might not be familiar.
3:38
So let's start with the basics. EEC attacks aren't always
3:42
malware driven, they're human driven.
3:44
And I would say it's probably human driven more often than
3:47
not. But Jamie, you tell me if I'm
3:49
wrong from what you've seen, so walk us through what that really
3:52
means. Right.
3:53
So these schemes are where attackers are trying to
3:57
compromise or impersonate an e-mail.
4:00
I'm so they're trying to trick employees into wiring money,
4:03
changing payment instructions or handing over sensitive
4:07
documents. So these kind of bypass the
4:09
technical defenses and you know, they play and rely on deception,
4:13
trust and urgency. So they need that human user to
4:17
fall for that phishing e-mail, or that human to change the bank
4:21
information or to make the appropriate changes.
4:24
Yeah. And again, going back to Jamie's
4:26
introduction when she talked about us crossing paths and
4:29
crawl and working together, we were great teammates.
4:31
She also taught me everything I know about BECS and how I'm able
4:35
to help companies now with my consulting firm if they call
4:40
about out a small BEC. So thanks for that, Jamie.
4:43
So Jamie, what are the most common entry points you actually
4:47
see? So definitely fishing, right?
4:50
Fishing is still the number one. I've also seen a lot of like
4:53
vendor supply chains, right? So the vendor gets compromised,
4:57
the TA sends invoices from the real vendor accounts and they
5:00
just swap the bank information details.
5:02
So, you know, a lot of people aren't really asking a lot of
5:05
questions about that. It's coming from a legitimate
5:08
vendor account. You know, I don't really think
5:11
much of that. I do see a lot of MFA fatigue,
5:14
right? The attackers see that MFA is
5:16
enabled. They just start spamming the
5:18
users with MFA prompts hoping, right, eventually they're going
5:22
to get sick of this. They're going to say, Oh my
5:23
gosh, you know, yes, you know, just stop the prompts.
5:26
So we have seen that, right? They just overwhelm them with
5:29
push requests and it surprisingly is successful.
5:32
MFA bypassing, though, kind of plays the same part, right?
5:35
Phishing is kind of tied now with MFA bypassing,
5:39
unfortunately. Right before it was, you know,
5:41
just enable MFA. It'll be, you know, that's your
5:43
second line of defense. You know, now that's not so much
5:46
the case. MFA really isn't a silver
5:49
bullet. You know, we recently did at TTP
5:51
briefing where we took all of the data from our IR matters and
5:55
we found that only 36% had MFA fully enforced across the board.
6:01
And of those, the attackers bypassed it in over half of the
6:05
cases. So you know, even when they had
6:08
it enabled, it was still getting bypassed regularly.
6:11
OK, so I have a question here. So when you're saying, you know,
6:15
they're doing all the MFA pushes, is that why I'm starting
6:19
to hear and even see more about, you know, it used to be you
6:23
would have so many things where the MFA was push enabled.
6:26
So you get the little pop up on your phone and you just be like,
6:29
yes, yes. But now so many more of those
6:32
have gone to well, now I got to go and look at the code and
6:35
whatever. Or is that just that that is
6:37
why? Yes Yep that actually up this
6:40
right that it's called MFA fatigue right they're just
6:43
sending tons of MFA prompts where before you know it's kind
6:47
of standard. It was like approve deny yes, no
6:49
questions for MFA, so so nice yes yes very convenient for the
6:54
users, but also a lot of factors were noticing right that people
6:57
are approving it even when they're not logging in people
6:59
are busy throughout the day they're like oh, maybe you know
7:02
my computer was trying to re authenticate.
7:03
I didn't want to lose access. You know, I'm on the computer,
7:06
but I was working on another file and then like when we walk
7:09
it back, so like, you know, I do remember approving something and
7:12
they didn't really tie the two together of like, oh, wait,
7:15
somebody actually has my username, my password, you know,
7:18
and they were getting that push request now.
7:21
So, you know, it's actually a much bigger issue.
7:23
Yeah, well, and depending on some of your phone settings, you
7:25
could hit approve without being logged in or, you know, without
7:30
unlocking your phone and stuff. And some people don't really pay
7:32
attention. I, I would tell you when I used
7:34
to work for a power company, if my CEO was on his phone the day
7:40
the fish went out, he clicked on it every single time because
7:44
he's just like I'm, I'm doing a million things here at once and
7:48
he started to realize that and we kind.
7:50
Of, you know, work. Through some of that stuff to
7:53
help him, you know, just be more conscious of taking a moment
7:57
when he's on his phone before he's just like, yes, yes, yes,
8:00
yes, yes. Yes, Yep, people are quick to
8:03
click, that's for sure. Quick, I love it.
8:06
Yeah, I know we, some of the other ones we see too is like,
8:09
oh, off abuse. So instead of them stealing your
8:12
password, you know, the attacker just tricks the user into
8:15
approving A malicious app. So, you know, all they have to
8:17
do is click accept on the screen and now that app has access to
8:22
the mailbox and right, they didn't even need your MFA code.
8:24
They don't need your password. They simply just need you to
8:27
click accept and grant that app access to your e-mail.
8:30
So we've also seen a handful of those as well.
8:32
Gotcha. And there's, I'm sure, like a
8:35
lot of red flags along the way. Or or aren't there?
8:39
Are there some quick tells that can help us spot that e-mail is
8:43
not what it might be? Absolutely.
8:46
So there is always going to be that sense of urgency, right?
8:49
They are going to want to make sudden changes to payment
8:52
details. You might see some forwarding
8:54
rules set up to outside domains or folders you don't commonly
8:58
use. You can see logins from 2
9:01
locations at the same time where that's, you know, impossible
9:04
travel. Yes you can.
9:06
Are no. Transporters yet?
9:08
Yes. No, right.
9:09
You're not logging in from Nigeria in New York within 3
9:13
minutes. There's no way, you know, a
9:15
typical travel, just, you know, abnormal login, right?
9:18
If you're usually login from an iPhone and all of a sudden
9:21
you're logging in from a different type of device, you
9:23
know, there's certain flags that you can set up for that.
9:26
And a lot of times thread actors still mark these emails with
9:29
high importance. So you might see that little red
9:32
exclamation point for some reason they still love to add
9:35
that. So anytime you get an e-mail
9:37
marked with high importance, with a sense of urgency, you
9:41
know, something that's kind of leading you to bypass your
9:44
normal procedures, I would, you know, raise a flag to that and
9:48
think, you know, what's going on with this.
9:50
Yeah, all very interesting. So let's say a company realizes
9:54
they're right in the middle of a BEC that they have been
9:57
attacked. Someone has clicked it and so
10:00
let's just walk through the 1st 24 hours of what absolutely has
10:04
to happen. 1st So timing is everything right?
10:07
First you need to contain the account.
10:09
That means a password reset. You also have to revoke all
10:13
active sessions. I can't tell you how many times
10:15
we get in and they haven't done this yet, right?
10:17
They reset the password and kind of carried on with their day and
10:20
thought everything was great. The problem is those active
10:23
sessions can still remain even if you change that password.
10:26
And that depends on your session length, right?
10:29
And I have seen so many set to never expire.
10:33
So that is extremely risky and not a great idea, right?
10:37
We need to make sure we're monitoring what our session
10:40
lengths are, right? Asking user to reauthenticate
10:43
every couple hours isn't reasonable.
10:45
I think that a lot of IT kind of are like, oh, you know, we don't
10:47
want to make it more difficult for the end user, so we don't
10:50
want them to have to keep re authenticating.
10:53
But definitely, you know, making sure we close out all active
10:57
sessions. You're also going to want to
10:59
check the registered MFA devices.
11:01
A lot of times they love to get in and add their own device
11:04
right. That way just in case they're
11:05
they get closed out, they have another way in also checking
11:09
your inbox rules. But actors love to get in and
11:12
they like to create inbox rules and move things to folders that
11:16
you know every day. You're not checking the RSS
11:19
feeds folder, the conversation history folder, I would say are
11:22
there 2 favorites? They move emails with anything
11:25
they're trying to hide. It might be payment details,
11:28
invoices, but I also see them going in a lot and adding the
11:32
user, you know, the account they used to originally fish them,
11:35
They hide any emails from them, right?
11:38
That way, if that user becomes aware that they sent outbound
11:40
spam and they send an alert, hey, if you click this e-mail,
11:43
reset your password, it wasn't me, my account was hacked.
11:47
You know, they don't see those types of things.
11:50
Gotcha. Now I did want to ask you about
11:52
revoking the active sessions. Is that something a user can
11:58
easily do or this is something where it really has to get on
12:04
the ball and that's something they need to do?
12:06
Yeah, it's unfortunately that is something a global admin or an
12:09
admin is going to have to do. They need access to the Azure
12:12
portal which you would need to be an admin.
12:14
Gotcha. So I mean, I think sometimes
12:16
that's maybe a weak link, right? Getting in touch with the like
12:21
how many people have that access at the company and then making
12:24
sure that they can do it in a timely manner.
12:27
That's a great point. Yes.
12:28
The other thing too that I always kind of put in the first
12:31
bucket for folks is checking the enterprise applications.
12:35
Red actors love to add enterprise applications and this
12:38
is another way they can grab data or maintain access to the
12:41
account. So that's kind of what I put
12:44
into the first bucket of the second bucket, I would say is
12:47
starting to preserve your evidence in the logs, right?
12:50
You want to make sure that you have a copy of those logs saved,
12:53
the emails, the headers before anything rolls off.
12:57
And then also you know, if you are dealing with a payment
12:59
misdirection, ensuring that you call the bank and to try to
13:02
recall the fraud wire. The earlier you act on this, the
13:06
better, the better and the highly the higher chances you
13:09
have of getting that money back. Gotcha.
13:11
Some of the. Other question I, another
13:14
question I could ask you is, I mean, you mentioned the wire
13:17
details, but so many scams you hear about is like the CEO or
13:23
somebody, some high executive emailing you and saying, I'm,
13:28
I'm in a meeting, but I need these high tune gift cards.
13:32
Could you, you know, buy some and then send me pictures of
13:37
them and scratch up all the codes And I'm in this important
13:40
meeting, but but I really need these right now, so I'm not
13:43
going to answer my phone. Would you throw that into kind
13:46
of the business e-mail compromise category or that's
13:50
more of just sort of your phishing scamming?
13:54
Or do you ever see that escalate from, OK, first I got you to
13:57
send me some Apple gift cards or some other gift card, and now
14:01
I'm going to escalate to something else a little bit
14:03
later. What crazy things have you seen?
14:05
Yeah, so definitely seeing the gift card scheme, right.
14:08
Hey, when you just send the gift cards or you know, I can't order
14:11
this right now or can you send me?
14:13
I don't have the card on me and I need to use it.
14:15
Can you send me a picture of the company Amex card?
14:19
You know I'm going to. That's a great one.
14:21
Yeah, I'm going to need, I need the details.
14:23
So if you just send me a picture sure of the front and the back,
14:25
that way I can order this, you know, I'm in with a highly
14:27
classified client, you know, and we really need this information
14:31
as quickly as possible. And, you know, sometimes, like
14:33
the urgency, you know, start not thinking clearly, right?
14:36
They think, Oh my goodness, he needs this right away.
14:38
I don't want him to be upset with me.
14:39
Let me just send that over. So most of the time, right, it
14:42
does stop there, right? They want to get to the gift
14:44
card or get that card information, they move on.
14:47
But I think if they do see a window there, right, they might
14:50
try other things, right? And say, oh, OK, well, if they
14:52
gave us those gift cards, you know what?
14:54
Can we try? Well, they could certainly
14:56
escalate from the gift card then to the credit card.
14:59
That would make sense, yes. So how do we put all of these
15:04
pieces together? So for putting the pieces
15:07
together, I would say is, you know, you start to build your
15:11
timeline. So everything that we do here is
15:14
about telling the story. So we want to tell the users,
15:18
you know, and I usually build my timeline and then when I'm
15:21
trying to go through that, I try to explain it from like a on
15:24
technical points and make sure that I'm able to, you know,
15:27
explain to them so they understand exactly what
15:30
happened. So I start to build out my
15:32
timeline. I nailed down when the first
15:35
login started or when the anomaly started in the logs and
15:38
followed by, you know, inbox rule creations.
15:41
If I see any fraudulent messages being sent from the user, right,
15:45
I'm looking at message trace reports, seeing what emails were
15:48
sent, what emails the user received.
15:51
If I do find emails where they're trying to change
15:53
payments or wire instructions, including those, another key
15:58
part is the search terms. And I feel like that's kind of
16:00
an underrated one, right? Most people overlook that.
16:03
And in Microsoft 365, if the user pulls the search terms,
16:07
they have a date and time stamp associated, which is huge,
16:10
right? If I don't have logs, that could
16:13
give me a really good starting point, right?
16:15
A lot of times they get in their searching terms like payment,
16:18
wire, chapter, invoice. So if you do have limited logs,
16:22
you know, make sure you look to your search terms.
16:25
The one thing I will point out is those search terms are pulled
16:28
in local times. Whatever system pulled them,
16:31
right? If Jane pulled them from her
16:32
system and she's Eastern Time zone, those are Eastern Time
16:36
zone. So if you're building your
16:37
timeline in UTC, just make sure you convert that right because
16:40
it can really throw off your timeline.
16:42
When I've done training before, I've looked at it and I'm like,
16:45
that's really odd, right? The first search term is like 4
16:48
hours before the login. How would that work out?
16:52
So just making sure, right, we're all in the same time zone
16:55
when you're building it helps. And then, you know, you can look
16:57
for in the mailbox for the original phishing e-mail and
17:01
then just start to build that timeline to tell the story.
17:03
And is there some things that we should make sure people know not
17:08
to do right away? Yes.
17:10
So when it comes to remediation, definitely I do not go in and
17:15
delete the account. I've seen IT go in and just
17:18
fully hard delete the account, they delete it, then they go to
17:21
the deleted bin and fully delete it.
17:24
So, so sometimes you can delete it, it'll remain there for 30
17:26
days, you can recover it. But I've seen people just go
17:29
blow the account totally away. So definitely don't go do that,
17:32
right? And also don't remove licenses
17:35
or make licensing changes. I've seen them go in like strip
17:38
licenses from the accounts, which can impact some of the
17:41
logging. Also, for some reason, I've seen
17:43
people go in and change the e-mail address or the username,
17:46
right? They add, you know, something
17:48
else, old account or new account, and that actually
17:51
changes the state and the identifier.
17:54
So when you're trying to pair up your logs now, it's going to be
17:57
a little bit of a nightmare to tear those up.
17:59
I've had a couple of those cases where I'm like, why did this
18:02
change all of the sudden? That doesn't really make much
18:04
sense. You know, they were always
18:05
coming in as this identifier. Now I'm seeing this one.
18:09
And then when you go to run it right, you're like, OK, where'd
18:11
this one come from? It doesn't show up in Azure
18:13
because they deleted the account.
18:15
So now you're having to sift through old raw data to try to
18:18
pair that up with the username. So it just makes a little bit of
18:21
a mess of the logs and it's just really unnecessary.
18:24
Sorry, right. If you reset the password, you
18:27
revoke the sessions. Check MFA rules, applications
18:31
you know menu can start to preserve and review the data
18:35
without making those type of drastic changes.
18:38
Gotcha. Now what about law enforcement?
18:42
Should they be contacted? When should they get involved?
18:46
What are your thoughts on that or?
18:47
What have you seen? Yeah.
18:48
So you know, especially with cross-border wires, FBI or local
18:51
agencies can sometimes help freeze funds before they
18:55
disappear. They obviously have a much
18:57
better grasp on those types of things, how they work.
19:00
I will say that, you know, they do say, right, the quicker you
19:04
respond the better and alert them.
19:06
So I will say that, you know, time is of the essence with that
19:09
as well. But I think still call your bank
19:12
yourself trying to stop that wire first.
19:14
Absolutely. Now we're starting to get into
19:17
maybe some more technical things as we dive deeper into this.
19:21
Now, Becky's told me that you often say BEC doesn't just live
19:26
in the inboxes, it's also living in the cloud.
19:30
Tell us more about that. Absolutely.
19:32
So the evidence lives in the cloud platforms themselves.
19:35
So in Microsoft 365, we're pulling the unified audit log,
19:39
the mailbox rules, the sign insurance, Google Workspace, you
19:43
know, you're pulling admin audit logs, the Gmail reporting rules
19:46
in 3rd party app access. You know, it's also another
19:50
piece of this is today's threat actors know that once you get
19:54
access to an e-mail account, you know, it's not always limited to
19:56
e-mail. Right now they have access to
19:59
SharePoint in OneDrive files in Google, right?
20:02
Google Drive, Google Docs, Google Sheets.
20:05
We have seen them consistently get in and access SharePoint,
20:09
OneDrive files, you know where some of these, you know, finance
20:14
employees are keeping banking. Information, right, answers to
20:17
security questions, passwords even and we've seen whole card
20:22
numbers in there. So, you know, people keep some
20:25
highly sensitive data in SharePoint and OneDrive.
20:28
That's also a piece that ties into the BE CS that a lot of
20:32
times I don't really see admins kind of correlating that, you
20:35
know, when we ask on the initial scoping calls, hey, did you
20:38
check SharePoint OneDrive? They're like, no, this is like
20:40
a, this is a business e-mail compromise for like, OK, but you
20:44
know, those things are connected, right?
20:45
If you go, so when you click up there, you get that whole suite
20:48
right there. You know, do you guys use
20:50
SharePoint and OneDrive? And then, you know, all of those
20:53
operations are logged in the unified audit log, which is
20:56
fantastic. You know, you can get a file,
20:59
access a file previewed file downloaded.
21:02
So you have good visibility into that?
21:06
So when we're when you're putting it all together, are you
21:08
building a timeline so that you can see how it has developed
21:13
from an actual someone clicking a fish to, you know, you know,
21:20
the threat actors interacting with the e-mail?
21:23
Yes, Yep, absolutely. I try to build the timeline
21:26
right as thoroughly as possible. And I like to start at the
21:30
initial start of the compromise. And like I said, a lot of times
21:33
that starts with a phishing e-mail.
21:35
So, you know, I try to go in and find that original fish.
21:38
Even if the fish gets deleted, they'll write.
21:40
You can see in your unified audit log, some soft delete,
21:44
some hard deletes, move to deleted items.
21:47
Threat actors try to cover their tracks pretty well.
21:50
So that can give you a hint at, you know, what are they
21:53
deleting, right? A lot of times they try to go in
21:55
and delete that original fish or they set up an inbox rule to
21:59
hide communications from that person.
22:02
And if they did delete it and hard delete it and you can't get
22:04
it, you always have your message trace report, right?
22:07
You can go back and see all of the emails that were received
22:10
for the last 90 days. And you know, you can't see the
22:13
contents of the e-mail, but you can see the date and time stamp,
22:16
the sender, the subject, your IP address that sent it, as well
22:21
as, you know, the message ID and all of the information.
22:24
So it's enough information. And a lot of times, right, the
22:27
user writes back and says, hey, Becky, I don't know what you
22:30
just sent me, but I couldn't open this.
22:31
So that's also right. Something to keep an eye out for
22:34
in, you know, the sense mail. If they said, hey, would you
22:37
send me? Couldn't open this.
22:38
And that way it gives you a good starting point.
22:40
That's fantastic. And, you know, I think you're
22:43
the first person I've heard talk about in relation to Office 365
22:48
or Microsoft 3, 65 unified logs, because I'm hearing a lot about
22:53
them because I focus on a lot of iPhone exams and that's been a
22:56
big thing we've really been breaking into.
22:58
So it sounds like it's got a lot of very important details that
23:01
you can grab from Microsoft 365 as well.
23:04
So that's very exciting. Yes, the unified audit log is
23:07
one of the main logs that I review that actually has the
23:11
most data. And Microsoft has come a long
23:13
way, right? Last year, you know, you would
23:15
have needed I've license to get mail items access.
23:19
Now they include that with your Business Standard licensing.
23:22
So you can get every e-mail the thread actor interacted with,
23:26
right? You get the message ID, the
23:28
information, You know, granted those emails have to be pulled
23:31
out with ediscovery services, but still having an idea of the
23:35
emails that the thread actor touched is huge in these
23:39
investigations. So definitely it's come a long
23:42
way with even their standard licensing.
23:44
Well, I think you bring up a great point with the licensing
23:47
because I know when I in a position of like, what do we
23:51
need for security logs so we can try to figure out what happened
23:55
versus how much is it going to cost us to get up to this
23:59
licensure. And I was very lucky at a
24:01
company of 400 employees. We had a very healthy security
24:05
budget, but we certainly had to make some concessions because
24:08
we're like, OK, we're going to have to pay X amount more per
24:13
head just to get this log. We can we live without it.
24:17
And you know, and especially when you start going down
24:20
smaller, what is your revenue? It sounds like they've done some
24:24
great things in terms of adding in some more that security
24:27
information, some of those logs that you need at a lower level
24:30
instead of having to pay an arm and a leg to get that
24:33
information. Absolutely right.
24:34
And they do have options, right. I would say for finance
24:38
employees it might be worth purchasing an E5, right, getting
24:40
that audit retention back a full year and also unified audit
24:44
logging used to be only 90 days. They did up it to 180 days.
24:48
So that gives us a lot more visibility with the standard
24:51
licensing. Gotcha.
24:53
Another question, is there a chain of custody for these types
24:57
of investigations at the corporate level?
24:59
Yeah. So we make sure that all of our
25:01
reports are defensible in court and we do provide, you know,
25:05
expert witness services at Cyber Reason if we're requested to do
25:08
so. And so when we're talking about
25:10
prevention, and I apologize, you can't see me all right now
25:14
because I decided to be a ghost because I clicked on something
25:16
and I can't give a camera to come back.
25:18
So, so when we're talking about prevention, don't click on
25:21
things and then your camera won't go away.
25:24
How do organizations stay ahead, especially with as many of
25:29
phishing attacks are pushed out there every every day?
25:33
Absolutely. So I would say think about this
25:35
in layers, right? Think fishing resistant MFA,
25:39
Fido 2, biometrics, things that can't be passed along, ensuring
25:43
that legacy authentication is disabled.
25:46
You know, your POP, your IMAP, your SMTP, because those are
25:50
legacy, right? So MFA wasn't a thing when those
25:53
were around. So you'll never get an MFA
25:55
prompt. So that's an easy win for threat
25:57
actors. And we still see that being
26:00
bypassed in Exchange cases like to this day.
26:03
Well, I was going to say how much on Prem exchange is left
26:06
out there? You'd be surprised, Stacey.
26:08
I we still get quite a bit of exchange.
26:11
We get quite a bit of exchange cases.
26:13
I still you might be. Surprised.
26:15
I'm like, still, we're still doing this with Exchange.
26:17
OK, Yeah. Well, I think it's kind of the
26:20
thing where like at the power company and critical
26:24
infrastructure, it's like, okay, well something goes down and now
26:29
we don't have access to anything and then we just buy another
26:33
service to back something else up.
26:35
And so, I mean, I'm not, I guess I'm not surprised that not
26:39
everybody has been dragged kicking and screaming to leaving
26:43
the prom. Yeah, no, we still get quite a
26:45
bit of Exchange cases, right? The logs that you get are like
26:49
30 days Max there. So the logging there is a little
26:53
bit brutal to work with. Microsoft spoils us now,
26:56
especially with them updating this right, We can really paint
26:59
that full picture. So if you're going to be
27:01
Exchange on Prem, then you better have a really good SIM
27:05
and be sending all of your logs over there so you can have them
27:09
for more than 30 days. Absolutely.
27:11
Absolutely. And then you going to be able to
27:13
afford the SIM to have your logs there.
27:16
For more than 30 days. That's a lot of math to figure
27:20
this out. Yes, it is.
27:21
It is pricey. It's a pricey business, but it's
27:24
worth it if you need it, right? I feel like a lot of times
27:27
people start to look into that after like, oh, maybe we should
27:30
have been forwarding. Maybe that would have been worth
27:32
it, right? In this instance, right?
27:33
We would have known. Did they get a copy of
27:35
everything? Did they just access it?
27:37
You know, we would have had more definitive answers that would be
27:40
defensible in court because right, we can only work with the
27:43
evidence that we have. And that's kind of the front
27:46
lines. Like every scoping call that I
27:48
lead, that's my starting thing, right?
27:50
We can only work with the logs and the data that we have.
27:53
So if we get in and they don't have unified audit logging, you
27:56
know, I'm very honest with them about that.
27:58
Like, that does limit us, right? That limits our visibility.
28:01
First and foremost. Let's get it enabled from here
28:04
forward. We do have logs and stuff.
28:06
We can still make a little bit of magic happen, right, with
28:08
some Azure logs, depending on licensing level.
28:11
But just this week we had one where unified audit logging
28:15
wasn't enabled. And you know, my head was like,
28:17
wow, still, I mean, we're 2025 and we don't have this enabled.
28:21
And the worst part is, right, is Microsoft released a couple
28:23
years ago, you know, we have unified audit logging enabled by
28:26
default now, so no worries. So a lot of these people are
28:29
like, Oh yeah, it's enabled by default, no worries.
28:31
Yeah, and then they change it. Classic Microsoft.
28:35
Well, what they don't say is it's enabled by default for
28:39
newly created tenants. It's not enabled by default for
28:43
previous tenants, right? So they're not enforcing it for
28:46
tenants, right? People that are actively paying
28:48
for, you know, these subscriptions and these
28:51
licenses, right? It's if you create a new tenant.
28:53
So that's one thing I would caution people with is with
28:58
Microsoft, you know, just pay attention, right?
29:00
If they do say, hey, we updated this, this is our new default.
29:04
Make sure you're checking right, because makes you make.
29:07
Go and actually look, yeah, like is there?
29:10
Can you find the things that they say that are enabled?
29:12
Now. Exactly or right is it if you
29:14
create a new tenant that's the default?
29:17
Yeah. So definitely checking those
29:19
things out. One of the big layers though,
29:21
for prevention, I would say that we walk a lot of clients through
29:25
is the conditional access policies.
29:27
You can create some awesome conditional access policies and
29:31
I've where you know, users can only login from registered
29:34
devices. You know, you can block non-us
29:37
logins, you know, restrict logins down to just their IP
29:41
addresses. You know, you can really limit
29:43
things down in there. In Google Workspace, they have
29:46
the same thing. It's just called context aware
29:49
access. So, you know, that includes kind
29:52
of some monitoring for some impossible or a typical travel.
29:55
So really looking at the conditional access and how you
29:59
can kind of, you know, stack that on with MFA that's.
30:03
Great. So Jamie, are there any other
30:05
trends that you're seeing in BECS?
30:08
Yeah, so we see a lot of compromise.
30:10
Global admins, actually, you know, a lot of global admins are
30:15
using these highly privileged accounts every single day to
30:19
login. And, you know, I strongly urge
30:22
admins to have separate admin accounts that they only use for
30:25
admin tasks, right? I don't want a global admin
30:28
using their e-mail everyday, you know, clicking on emails, you
30:31
know, trying to check out an e-mail.
30:33
We had one the other week where they were actually checking out
30:35
an e-mail for somebody who sent it to them with their global
30:39
admin accounts. Yeah.
30:40
So they got the global admin accounts.
30:42
So, you know, that's giving away the keys to the Kingdom, right?
30:45
Then the sky is the limit, right?
30:48
We see them going in and adding access to all the payroll, all
30:51
the finance employees. I mean, they can do anything
30:54
they want with the global admin accounts.
30:56
So definitely seen quite a bit of compromise global admins
31:00
lately. Yeah.
31:00
And I'd like to say that I remember when you and I worked a
31:03
case together back in, back in the day, that it was the first
31:09
time we'd ever seen where the threat actors installed a, a, a,
31:16
a tool to actually export everything from the environment.
31:22
And they were pretty Dang successful.
31:24
Yep, that was the end client case.
31:26
I remember that one. Yep.
31:27
So I remember reviewing the logs and I'm like, wow, client.
31:31
I know that from my ransomware days.
31:33
That's not good. And I remember them, You know,
31:36
even the engagement managers, like no, you know, I don't know,
31:39
like let's look at it. Maybe it was doing something.
31:41
I'm like we got a Nigeria IP doing this.
31:44
I don't think so. So yeah, that was good.
31:47
You know, we saw them adding those enterprise applications
31:49
and a client actually can why I think a lot of them use it right
31:53
is it has the capability and supports multiple languages.
31:56
So they can download a copy of the mailbox and read it in
32:00
multiple different languages on which I didn't know that before.
32:03
So now we see them grabbing data that way.
32:06
That way when admins are looking right, they're like, oh, we have
32:08
web-based logins. You know, there was no, you
32:11
know, and that's kind of where the ball turns right is if they
32:15
actually the acquired data. That's kind of where some of the
32:18
data privacy laws kick in, depending by state I'm, you
32:21
know, with any data acquired. So you know, that's something
32:25
people also have to consider is the enterprise applications with
32:28
the logins. Well, so we we get this question
32:31
a lot. How has AI?
32:34
Because that is the, you know, word of the century.
32:38
How has that impacted BE CS? So the obvious one right there
32:43
is much better social engineering and phishing emails.
32:46
You know, we're seeing phishing emails with perfect grammar,
32:50
language, punctuation. You know, that's kind of
32:53
becoming the new norm. You know, when I was chatting
32:55
with CC earlier, I was like, you know, when I first started, I
32:57
could pick out a phishing e-mail so quickly.
33:00
I mean, it took me like 5 seconds.
33:01
It would be, you know, something wasn't capitalized, something
33:04
was spelled wrong. The spacing was like way off.
33:08
Now that's not the case, right? The grammar, the social
33:10
engineering behind them is fantastic.
33:13
We also have seen some deepfakes becoming more common.
33:17
Deepfake video, you know, isn't far behind.
33:19
We haven't seen a successful one, but I did have a really
33:22
cool one where the user was trying to change bank
33:26
information for one of the trust employees, but the bank had on
33:29
file that they had to have a phone call with the number they
33:33
have registered to change the information.
33:36
And the threat actor wrote back and said, oh you know what, they
33:38
are on vacation this week. But I have a recorded
33:41
conversation of us where they gave me verbal approval.
33:46
So, yeah, and they did send it. And I will tell you, having
33:50
calls with her, I was like, wow, that did sound like you.
33:53
So luckily, though, the bank was like, no, this isn't good
33:56
enough, right? We need a phone call from that
33:58
number giving us permission. So it wasn't successful, but it
34:02
got close, right? They were all the way at the
34:04
final ticket there. And luckily, right, they had
34:08
somebody at the bank following full procedure that day.
34:11
That's so great that they actually followed the procedure
34:15
because that's half the battle. Well, you know knowing that
34:18
there is a procedure and then following said procedure after
34:21
you read it. Exactly.
34:24
Yeah, And of course, right. They have that urgency like this
34:26
has to be done today. They're they're going to be
34:28
using this card tomorrow and they're they're on vacation and
34:31
you know, this is highly important.
34:33
So, you know, they still added the urgency in there.
34:35
Yeah, and, you know, some people might be tempted to be like, oh,
34:39
well, we'll do like a video verification or whatever.
34:42
And your point, Deepfake isn't far behind because I, I don't
34:46
know if you've seen it was like an interview video going around
34:50
and the interviewee, he, he looked kind of like, I don't
34:54
know, he was like he was answering stuff, but he looked
34:57
like a little stone or maybe he was on some ketamine or
35:01
something like that. It just wasn't quite like
35:04
tracking, right. And then so the interviewing
35:06
manager was like, I need you to put your hand in front of your
35:09
face. Well, they could never do it.
35:11
And then eventually they got them to put the hand up next to
35:15
their face, but they couldn't put it in front of their face,
35:17
so I'm not. Sure.
35:19
What's up with that? But I guess just a fun fact for
35:21
everybody, if you think you're on an AI video sort of call,
35:24
maybe you'd be like put your hand in front of your face.
35:27
Oh gosh. Look, people were live I.
35:33
Am behind this black screen over here because I clicked a button.
35:39
Well, maybe you will come back on the upload, Becky.
35:42
We will. We will find out.
35:44
Right now, Becky is just a voice in the dark.
35:47
I am just a voice in the dark. OK.
35:49
So we've gotten a little off track, but that's what we do
35:51
sometimes. So let's see, let's talk about,
35:54
I think scale. What's happening with that?
35:57
I think AAI can probably help you scale faster better.
36:00
Oh yeah, So the scale with AI, right?
36:02
They're big, right? They have a lot of different
36:05
powerful searches, right? They're scraping and they are
36:08
able to craft some heavily customized spear phishing
36:11
messages. You know that you can send a
36:13
thousands of victims at a time. You know, you can throw it right
36:16
in ChatGPT. Hey, can you create me?
36:18
You know, this type of e-mail, I want it to be crafted to the
36:21
specific sender and it can create you that template in
36:24
seconds. So, you know, just people having
36:27
that and actors having that at their fingertips, definitely I
36:30
think will play a role. Interesting.
36:33
And so we've done a lot of talk about fishing.
36:37
I'm going to ask you a question for your opinion on fishing
36:41
exercises, fishing, your own employees, anything you want to
36:46
say about that or what you've seen or what.
36:48
People. What your clients ask.
36:50
Or. Anything related to that?
36:51
Absolutely. So we strongly encourage, right
36:54
phishing testing and training for all of the employees, right?
36:57
And the ones that are struggling with it, obviously, you know, we
37:00
need follow up there. We need to make sure they're
37:03
understanding. And also threat actors are
37:05
always changing the tactics of phishing emails.
37:08
They've changed drastically in the 7-8 years that I've been
37:11
doing this. So you know, it's hard right AT
37:13
sees this stuff every day. They need to kind of come at it
37:16
from a different perspective of like these people don't see this
37:19
every day. You know, they're not aware that
37:22
AI has helped craft much better phishing emails, much more
37:26
believable emails. I've also seen places start to
37:29
incentivize, you know, if a user doesn't fall for any fishes in
37:33
30 days, you know, they get a gift card, they get some type of
37:35
reward and I've seen that actually be highly effective,
37:38
right. People think twice like, whoa,
37:40
hold on, there's a reward evolved.
37:42
I don't, I don't know if I want to click this, I'm to call or
37:44
report this e-mail. So it just makes them kind of
37:46
think twice about that. Also, like tabletop exercises
37:50
are great for that, right? You can come at it from a
37:53
business e-mail compromise standpoint and let people kind
37:56
of run through their current playbooks.
37:58
And I will say that a lot of the ones that we see are very dated,
38:02
right? They're not taking into
38:03
consideration new Microsoft changes or new changes in the
38:07
logs or know when they're asked to go into this portal to pull
38:10
it. They're like, where's George?
38:13
I think George knows how to get to that portal.
38:15
You know, there's, you know, they're relying on one person
38:18
for certain things, you know, so making sure they have those
38:21
updated playbooks and they're testing the employees and really
38:24
just taking the time to educate them on new tactics, new
38:28
tendencies. And I think it's very important
38:31
for them to have an open line of communication, right?
38:34
If they did click it, you know, they should have the confidence
38:37
to come to IT and say, hey, listen, I got a weird e-mail.
38:40
I did click it, but nothing happened.
38:42
So, you know, I think my account could be compromised and kind of
38:46
self reporting. We've seen quite a bit of those
38:49
cases actually. They're starting to self report
38:51
a little bit more. And I tell you, that really
38:54
contains the spread quickly. If the user reports it and says,
38:58
hey, you know, I did this, but it didn't seem right.
39:00
You know, I reset my password and then it can kind of take the
39:03
reins from there because, right, the threat actors aren't always,
39:07
you know, logging right in with these passwords.
39:09
So sometimes they're able to get in, reset passwords, close
39:12
active sessions before anything even happens, right, Best case
39:15
scenario. So just making sure users have a
39:19
good way to communicate that as well.
39:21
Yeah. And I think with like the
39:22
phishing emails, you know, some organizations do the same
39:26
phishing training like. Every year it's just the what?
39:30
Whatever cheap out-of-the-box, whether it's the videos or
39:34
PowerPoint slides that they have people doing and and that's not
39:39
that's not really adding value and and education.
39:42
I have also seen where people are using no.
39:44
Before for the. Phishing emails and they've and
39:47
everything's coming from. No, before.
39:49
So I'm like, I know that's the phishing test.
39:52
So you know, if you're going to do it, put put some effort into
39:56
it because then I think like when it comes to your cyber
39:59
insurance, you know, one of the questions is, you know, do you
40:02
have like what are the things you're doing for training and
40:04
education and fishing education? And if you're doing it half
40:08
assed, I don't know whether any other way to say it, you know, I
40:12
don't know if they're going to pay out there will be like,
40:13
well, you know. You said you were.
40:15
Training. But I don't think this is
40:17
training. You're not doing what you said
40:19
you're doing. I don't know my two cents on
40:22
that. Absolutely.
40:23
I say that all the time, underwriters them need to really
40:25
make sure that these policies are actually effective in
40:28
working, not just checking a box, you know, making sure that
40:31
these are actually working and the end users, right, are
40:34
getting their training that they need to be able to spot these
40:37
types of things. Well, I've even been on
40:39
conversations with the insurance company.
40:42
I filled out the survey and I guess I'm just a hard ass or
40:45
very conservative, but I'm like, no, we're not doing this.
40:48
No, we're not doing this. No, we're not doing this.
40:50
And they're like, Oh well, you, you do this one thing, We'll
40:52
count that for that. And we'll count this for that.
40:54
And I'm like. Well, that's a stretch, yeah.
40:58
I'm like, I don't think that counts, but you're the one who's
41:01
going to pay UPS. That's right.
41:03
Let me get a recording of you saying that this counts, right?
41:09
So I think we're getting towards the end.
41:11
Jamie, do you have any final thoughts that you want to share
41:14
that we didn't get in yet? I feel like we kind of covered
41:17
like the only thing that I didn't really talk about that I
41:20
think I should probably mention, right, is some of the common
41:23
ways we see actors, you know, bypassing MFA.
41:27
I feel like there is 2 kind of big players that we see.
41:31
You know, adversary in the middle is probably the top one,
41:34
right? That's where you open what looks
41:37
to be a real Microsoft 365 login page.
41:40
But it's a fake site, right? Set up by the threat actor
41:43
that's forwarding everything you type to Microsoft.
41:46
You know, as you're typing your password, your MFA code, you
41:49
know, you're thinking you're safe.
41:50
It looks like Microsoft. But then the attacker is able
41:53
to, you know, catch the keys while it's getting passed along,
41:56
you know, so MFA doesn't stop it because the attacker is kind of
41:58
sitting there in the middle. The other one that I see a lot
42:02
is the session hijacking in cookie theft, which is, you
42:05
know, you log in, the system gives your browser a session to
42:08
token. I like to explain this to
42:10
people. I think of it like your hotel
42:12
key card, right? You go to the hotel, you show
42:15
your ID, you give them your card, you pay for it, right?
42:19
You've done all of the things, you get that key card to access
42:21
your room every time from then on.
42:23
You don't need to keep doing that, right?
42:25
So the attacker steals that token through malware phishing
42:29
the adversary in the middle. And so they don't need to keep
42:32
re authenticating. They can just keep using that
42:34
session until it expires. You know, those are kind of the
42:38
two ways that we see Fed actors really bypassing MFA.
42:43
That is super interesting. And you know, people might not
42:46
realize it's it's happening, but I think it's something good for
42:49
us techie type people to be aware of how they're getting in
42:52
there, how they're staying in there.
42:54
It's awesome. Yeah, for sure, for sure.
42:56
Well to to wrap up, BCBEC, excuse me is a proof that
43:01
attackers don't always need ransomware or 0 days.
43:04
They just need one convincing e-mail and trusted inbox.
43:07
So for investigators, the truth lives in cloud logs, mailbox
43:11
rules and audit trails. For organizations, resilience
43:15
means hardened technical controls, quick response and
43:19
discipline processes. And Jamie, thank you so much for
43:23
being with us today and sharing all of your expertise and
43:26
experiences with us. Of course, thank you both for
43:28
having me, always glad to help raise awareness.
43:30
Absolutely. And Jamie, it's great to see you
43:34
keep up the good work, go after, take care of those companies.
43:38
And thanks to our listeners, if you find today's episode useful,
43:42
share it with your finance team, IT staff or leadership.
43:45
And until next time, stay safe, stay sharp, and as always, keep
43:48
parsing the truth, one bite at a time if you.
43:53
If you enjoyed this episode, make sure to follow us to get
43:56
notified the next time a new episode drops.
43:59
If you can do more, head on over to parsingthetruth.com and
44:03
donate by clicking on the donate button.
44:06
Parsing the Truth is a nonprofit organization and we are raising
44:09
money to send a new digital forensic examiner to I Asus
44:13
training next year in Orlando. Thanks.
44:19
OK, so what's the number for you?