Before you continue reading, you should check to see if your email address is one of the millions that has already been compromised: HaveIBeenPwned.com. An attacker could have your account password without sending you a single piece of malware or phishing email.
As an email security platform, learning about hacker behavior is a significant part of what we do. When we deploy in a new customer’s environment, we go back in time to analyze months worth of event behavior that might include previous attacks and currently compromised accounts. What we have found is that the initial phish is often only the beginning, and the real attack takes place over a much longer period of time.
Our last blog post, Post-Breach Protection: What to Do When You're Already Compromised, gives an overview of some of this behavior and how to recognize it, but we think it is vital we provide a much deeper explanation of some of these methods. This the first in a series of blogs about each of the post-breach behaviors that we use to identify a compromised account. Because we assume that we may not see the actual compromise event (a user loses their password in a third-party breach, for example), we identify insider threats by both anomalous behavior and common attack behaviors.
Most attackers seek to take over a user’s email account in order to perform reconnaissance and compromise additional users, sending and receiving emails from the victim’s account in a way that avoids detection. One method is the “Alternate Inbox”.
The “Alternate Inbox” method describes the tactic of using an email folder, usually the trash folder, within a compromised email account in order to send and receive emails in way that is invisible to the owner.
Once the hacker has gained access to an email account, they create inbox routing rules to move or delete emails with specific terms. A term might be the subject of an email they send to coworkers:
If subject = “Can you do me a favor?,”: move to trash
When the hacker sends emails with the subject “Can you do me a favor?” the original email will be deleted along with replies. The hacker can carry on a complete conversation from within the trash folder.
But what if one of the recipients of those emails gets suspicious? They may try and warn the user of the compromised account that they sent a phishy email. That is why the hacker often creates other rules of the form:
If email contains “hack”, “phish”, “account”: move to Deleted Items
Now the hacker can use the email account at their own leisure, as long as they keep their activities to the trash folder. Meanwhile, completely oblivious to anything being wrong, the owner of the compromised account is also using the same email account as the hacker but will likely be unaware of anything occurring outside the inbox and sent folder.
They may even create rules to forward attachments out of the company or text themselves, should they be discovered.
This is done as a way to cover the tracks of the hacker as they attempt to move through an organization. Often the first account they compromise is not their end-goal, as it may not have administrative rights or have access to proprietary files. For this reason they will use internal email addresses to phish increasingly more important accounts until they can acquire what they are after. Sometimes this can take months.
We use hundreds of metrics to look for compromised accounts, but these are some of the clues you can use to identify an insider threat.
If a single account has been breached, you must assume that more than one account could be involved. We will go into more detail in a later article, but the response should be immediate.
The damage that can be done is proportional to the administrative access of the compromised account, but the access rights of a single employee are typically enough to embed and spread throughout the organization, exfiltrating a tremendous amount of data along the way.