Industry executives and experts share their predictions for 2021. Read them in this 13th annual VMblog.com series exclusive.
Top 3 Threats That Will Push Email Security to its Limits in 2021
By Adrien Gendre is Chief Product & Services Officer at Vade Secure
The growing sophistication of email threats are outpacing the industry’s ability to respond. With new threats emerging every day, it will require not only a new approach to detection but also an increased emphasis on user awareness to protect businesses from the onslaught of threats.
1. Remote-based images will hide malicious content
A remote-based image is embedded in an email but hosted on an outside domain. This technique allows cybercriminals to hide malicious textual content in the image and evade detection from an email filter. In order to analyze a remote-based image, it must be fetched over a network. This can’t be done in real time.
Hackers use a variety of cloaking techniques to evade detection, including hosting the images on high-reputation domains, creating multiple URL redirects, and using unique URLs. Remote-based images can be detected by Computer Vision algorithms, but they are not widely in use in commercial email security solutions because of the costs. In November, Vade Secure detected and analyzed 26.2 million remote-based images. We fully expect these numbers to rise and the technique to grow in use in the coming year.
2. Compromised accounts will spur new attack techniques
An ongoing threat detected by Vade Secure resulted in 300,000 spam emails being directly deposited into mailboxes in a single day in December-without ever passing through transport layers. Hackers likely leveraged a new tool available on the dark web, Email Appender, to connect to compromised accounts via IMAP.
The tool allows hackers to validate account credentials, connect to IMAP, and deposit emails directly in inboxes-avoiding email filtering completely. Currently making the rounds in consumer mailboxes, this new threat is certain to make the leap to corporate mailboxes with more sophisticated threats like phishing and malware. A platform like Microsoft 365, for example, provides a wide pool of potential victims-258 million users.
3. Current events will drive large-scale attacks
Psychological manipulation is at the heart of social engineering. Current events, whether a global pandemic, Black Friday, or elections, are a powerful way for hackers to exploit users’ emotions. With tens and even hundreds of millions of people experiencing the same event at the same time, the opportunity to exploit is simply too good for a hacker to pass up.
COVID-19 themed email attacks emerged almost immediately after the pandemic went global. From phony alerts from health organizations to spoofed internal emails from HR, COVID-19 based attacks were innovative and affected every sector of industry. As the pandemic wore on, the attacks continued and have not abated.
Coinciding with COVID-19 is the 2020 presidential election in the US. Emotions are high, people are paranoid, and workers are on edge due to ongoing economic uncertainty. These are powerful motivators to click on emails without considering the dangers.
While things seem to be looking up due to vaccine availability, in reality it creates yet another opportunity around which to craft malicious emails. Our shared experiences built around current events will spur a range of new threats aimed at manipulating our fears and emotions.
Technology is not enough
Sophisticated threats require equally sophisticated responses. While we are reaching new heights in threat detection thanks to artificial intelligence, hackers are either on our heels or one step ahead. When technology fails, users must step in to form a barrier. Ongoing training is the norm, but we must move to immediate re-training when users make critical errors to correct the behavior and reinforce best practices. Cybercriminals are formidable foes, but untrained employees are equally-if not more-dangerous.
##
About the Author
Adrien Gendre is Chief Product & Services Officer at Vade Secure. His product vision and cybersecurity experience has been instrumental in Vade Secure’s evolution from startup to world leader in predictive email defense. Adrien brings his email security expertise and innovative product approach to the ongoing development and advancement of phishing, spear phishing, and malware protection technologies at Vade Secure.
