CS Mar-Apr 2020

Coronavirus scam
interfere with the functioning of a
computer. There are also laws against fraud
and the GDPR, which protects data, and this
would come into play because of the data
the hackers obtained illegally. The problem
is that these hackers are difficult to locate,
as they often use technological measures
to ensure that they are not traceable.
WHAT ELSE CAN WE DO ABOUT IT?
This example was located and prevented
through Libraesva's email security software
and management. It was observed that
the spoofed sender of the email was on
a compromise protection list, known
in the industry as 'BEC - Business Email
Compromise', so additional checks were
undertaken.
The email was sent using an email address
of another university, after that person
was successfully hacked. Using Libraesva's
Adaptive Trust Engine's relationship
monitoring, we saw that the trust between
these two universities was quite high. But
the trust between the two individual users
was low; we didn't let the organisational
trust get in the way of understanding the
true nature of the email.
The third indicator was that the email
came externally to the Milan University
users, which doesn't make any sense, as all
emails from the director will 99% of the
time come via the internal route, meaning
this is obviously fake.
The coronavirus is an opportunity for
hackers to take advantage of the fear to
scam people, business and universities. It is
important to be aware of these risks and
take the necessary precautionary action.
Using the above indicators, Libraesva has
built a dedicated technology to halt these
kinds of attacks and make sure your IT team
employ some Email Security, as this is the
main way that threats and malicious activity
can get into your organisation.
Growth of the virus in China and
other countries (graph courtesy of
the World Health Organisation)
EMAIL LANDSCAPE AND THE CORONA VIRUS
Since 17 February, Libraesva have been carefully monitoring the situation with the
Coronavirus and the effect it is having on email, looking into the change of the
email content, the behaviour of users and even the changing threat landscape.
In the top graph, right, supplied by the World Health Organisation, can be seen
the growth of the virus in China and other countries. By paying close attention to
the ‘Other Countries’ graph, it is possible to compare the infection rate to the
second graph, showing the amount of legitimate communication around the virus
in a similar timeframe. When comparing the two data sets, it can be seen that the
curve is almost identical, with the more legitimate communication growing at the
same rate as the infections are. This clearly indicates that the concern and
communication between organisations is effectively rising at the same rate as the
infections are growing.
After looking at the clean email, in comparison to the infections, it's possible to
see how the malicious email and threat attempts are changing, too. The graphic,
bottom right, demonstrates how the malicious attempts on Libraesva users have
increased at the same rate, meaning not only are the threat actors using the
virus to their advantage, but also that end users are discussing the issue more.
One of the key aspects of a successful attack is the degree to which such incidents
are talked about and the anxiety they generate amongst other users - and this is
the perfect example of that happening.
Shown here is the growing communication
taking place, by email, about the Coronavirus.
Rising number of malicious attempts on
Libraesva users, as threat actors seek to
use the virus to their advantage.
www.computingsecurity.co.uk @CSMagAndAwards Mar/Apr 2020 computing security
25