Ethical use will require some combination of consistent reporting, regulation, corporate responsibility, and adversarial technology.

Debunking the myths surrounding the implementation of proactive cyber controls in operational technology.

One cybersecurity failure can result in a successful ransomware attack or data breach that could cause tremendous damage. There's no need to panic, but neither is there time to ignore the issue.

The IoT industry remains fragmented with a lot of players, big and small, churning out a lot of products.

Cybersecurity was a challenge before COVID-19 sent millions of employees home to work from their own devices and networks. Now what?

The US counterintelligence lead joins a former Europol cyber chief to discuss modern election threats and the benefits of public-private collaboration.

Here's how CISOs and IT security operations teams can best address key challenges to network monitoring that could increase malware dwell time.

The October 2020 Patch Tuesday fixed 87 vulnerabilities, including 21 remote code execution flaws, in Microsoft products and services.

While the US is known to be a prime target for BEC attacks, just how many perpetrators are based there came as a surprise to researchers. A new analysis of business email compromise (BEC) attacks reveals the global footprint of BEC activity: Twenty-five percent of perpetrators behind these threats are located in the United States. Of these attackers, nearly half are based in five states: California, Georgia, Florida, Texas, and New York. The Agari Cyber Intelligence Division (ACID) today published the results of a study to better understand the operations of BEC attacks – in particular, the location of attackers and the money mules responsible for laundering their proceeds. While Nigeria has been a hot spot for social engineering scams, researchers found only half of attacks came from the West African country. Their report contains information from more than 9,000 defense engagements between May 2019 and July 2020. In more than 2,200 of these, researchers could identify the attackers' likely locations. These do not include incidents in which attackers were likely using a proxy or other technique to anonymize their locations. Based on these engagements, researchers identified BEC attackers in more than 50 different countries. Sixty percent of the attackers were based in 11 African countries; of these, 83% were based in Nigeria. South Africa was home to 14% of Africa-based attackers and the third-largest base for BEC groups worldwide. This was the only country in the study to see a decline in BEC attackers during the study. Eleven percent of global BEC actors were in South Africa during the last eight months of 2019, but this number dropped to 6% in the first seven months of this year. Nearly 30% of global attackers were based in the Americas. Of these, 89% call the US home. While the US is known to be a prime target for BEC attacks, researchers were surprised to learn many perpetrators are based there. They also noticed clusters of attackers around a few metro areas including Atlanta, New York, Los Angeles, Houston, and Miami. "The part about the US took us by surprise," says Crane Hassold, senior director of threat research at Agari. After removing instances in which attackers were using proxies and other anonymization sources, researchers assumed the percentage of US-based attacks would drop. A closer look at the top US metro areas for BEC activity reveals a correlation with major arrests that have happened over the past couple of years, Hassold continues. One of these was Operation reWired, a law enforcement operation targeting BEC that led to the arrest of 281 people worldwide, including 74 in the US, 167 in Nigeria, 18 in Turkey, and 15 in Ghana. "Geolocation is one of the many data points that defense is taking on when they're thinking of where threats come from," he explains. "One of the big things to keep in mind here is that location data may not be as helpful in some cases." If security teams are only watching for attacks that originate in Nigeria, for example, they'll only see half of all BEC attacks that occur. Tracking Illicit Funds: A Look at BEC Money MulesMoney mules were spotted all around the world: Over the course of the 15-month study, the team collected 2,900 mule accounts in 39 countries. Through these accounts, scammers intended to receive more than $64 million in stolen funds from BEC victims, researchers report. Learning where money mules are located, and whether they're witting or unwitting in BEC operations, was a significant part of the research, Hassold says. "The money mules are essentially the piece of the machine that makes this entire attack go, and without the mules, the entire ecosystem would fall apart," he explains. "Really understanding where they are, especially in the US, I found very fascinating because they're essentially the first stop for the money when it comes down to the business." BEC attackers typically use a mule in the country where the target is based. This is unsurprising – Hassold says most mules were based in the US to start with – but may be partly due to restrictions that prohibit large international transfers. If an attacker sends a $30,000 payment to someone in the same country, it may not raise as many red flags as an international transfer. International transfers are typically disguised as corporate account payments, he notes.  Researchers identified more than 900 US-based money mules used in BEC scams between May 2019 and July 2020. At least one mule was spotted in every state, as well as the District of Columbia. Many of these are people who fall for romance scams or work-from-home scams, in which victims apply for and accept a job that could include receiving and reshipping goods, receiving "payments" from clients, or printing and sending checks – all part of a BEC operation. While most mule accounts were at US-based banks, payments requested for those accounts were much lower than in other countries. For example, the average payment requested by BEC scammers for US-based accounts was $39,500. Payments requested for Hong Kong-based mule accounts averaged $257,300. Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio Recommended Reading: More Insights

Many services advertise E2EE, but not all of them actually offer it. Question: What is end-to-end encryption (E2EE)? Hudson Bloom, Senior Consultant, Application Security, Optiv: End-to-end encryption is a style of encrypted connection in which secrecy of the message contents is maintained from the sender all the way to the recipient. This is in contrast to encryption schemes where a third party, like an application server, has access to the unencrypted data. (image by tampatra, via Adobe Stock) Consider the case of sending a direct message over a social media website. If both you and the recipient are connected to that site via HTTPS, then you are certainly using encryption, and an attacker monitoring you or your recipient's Internet traffic would have to defeat transport layer security (TLS) to be able to decrypt the data. However, an attacker with internal access to the social media website itself would be able to monitor your messages easily because the website will have negotiated TLS encryption with each party separately, and must decrypt and re-encrypt your message before sending it to the recipient. We might also describe this arrangement in terms of there being two separate encrypted channels: one from sender to server, and one from server to recipient. However, suppose you and your recipient were using a technique like Pretty Good Privacy (PGP) to encrypt these messages before sending them via the website. Attackers watching you or the recipient's Internet traffic would still have to defeat TLS to read what was sent, but even if they did, or even if they had internal access to the social media website, they'd only be able to read the PGP-encrypted message. We could thus describe the PGP encryption as forming an encrypted channel between the sender and the recipient. Third parties relaying the data between those endpoints are unable to read the unencrypted text – it is encrypted, end to end. (PGP is mentioned here as a relatively common example of end-to-end encryption, but it isn't a turn-key solution.) Many Internet communication services advertise end-to-end encryption, but not all of them actually offer it. Knowing for sure whether the encryption offered is really end-to-end is difficult without expert review of the source code. The above example of using PGP over a less-secure service is not strictly academic; users desiring a higher level of secrecy have employed PGP over less-secure services, like e-mail, for many years. As with all modern digital encryption technologies and techniques, it's important to consider who your potential threat actor is and how much you trust the software you're using, as well as the people who made it. Hudson Bloom is a senior security consultant in Optiv's Threat Management Team, under the Application Security practice. He spent nearly a decade working as a software developer in the aerospace and medical technology industries before coming to Optiv to focus on security. Hudson specializes in mobile and thick-client reverse engineering, especially against old or esoteric technologies. The Edge is Dark Reading's home for features, threat data and in-depth perspectives on cybersecurity. View Full Bio Recommended Reading: More Insights