Jason Schultz (11:36)

Foreign.

Dave Bittner (11:42)

Hey everybody, Dave here. I've talked about Delete Me before and I'm still using it because it still works. It's been a few months now, and I'm just as impressed today as I was when I signed up. DeleteMe keeps finding and removing my personal information from data broker sites, and they keep me updated with detailed reports so I know exactly what's been taken down. I'm genuinely relieved knowing my privacy isn't something I have to worry about every day. The Deleteme team handles everything. It's the set it and forget it peace of mind. And it's not just for individuals. DeleteMe also offers solutions for businesses, helping companies protect their employees personal information and reduce exposure to social engineering and phishing threats. And right now, our listeners get a special deal 20% off your delete me plan. Just go to JoinDeleteMe.com N2K and use promo code N2K at checkout. That's JoinDeleteMe.com N2k code N2K Jason Schultz is technical leader for Cisco Talos Security Intelligence and Resources Research Group. I recently caught up with him to discuss their work on the security of PDF files.

Jason Schultz (13:10)

Well, I think there's a couple of reasons why PDFs are being exploited in the way that they are. One is, as you noted, it's a pretty ubiquitous file format, so you're going to find PDF readers on almost any computing device that people use today. Another reason why I believe that these things are being exploited is because even though the PDF is attached to the email, there are tricks that the email senders can use to display the PDF sort of in line in the email itself, so they don't necessarily need the victim to click on the attachment in order to view the PDF content.

Dave Bittner (13:56)

That's interesting. Does the contents of a PDF typically get scanned by a security package most people have in their emails?

Jason Schultz (14:06)

Absolutely. And if you look back historically, there's been a lot of incidents with malicious PDF files, but the PDF file format itself sort of provides a lot of flexibility for where content is included. I believe in the blog we noted a couple of URLs that were included as annotations in the PDF document. So there's a lot of different places for malicious actors to be able to hide some of this link information or even logos and things of that nature inside of the PDF file format itself. Which is one of the reasons why I think they're moving towards using a lot of QR codes. And the telephone oriented attack delivery or callback phishing is because, you know, when the email is scanned and when the PDF attachment is scanned, the PDF is actually not malicious. But of course if you end up calling that phone number or scanning that QR code, it's going to take you somewhere else where, you know, you're either going to, you know, speak with the attacker over the telephone or you're going to, you know, scan the QR code with your phone. And that's going to take you using a different device, using your cell phone or something like this to an attacker controlled website where they may be able to try to break into your phone or capture credentials that way. And of course cellular networks are not monitored and using all the same tools that an organization might have for their regular corporate network.

Dave Bittner (15:49)

Well, let's walk through this step by step. Let's say I'm sitting here at my desk at work and I'm minding my own business. This malicious email comes in, I'm browsing through my email and I open this one. What am I going to see?

Jason Schultz (16:08)

Most of the ones that I see pretty regularly are impersonating services like Microsoft or PayPal. The Microsoft ones tend to be more traditional phishing where they're after the user's account username and password. But then some of the others, your, your PayPal and LifeLock and things like this tend to be more financially motivated where they're, they're trying to actually, you know, they send you something along the lines of an invoice and you know, here's the phone number to call if, if you, if you think this might have been an error. And of course once they get you on the phone, then they use a lot of social engineering techniques to try to convince you that they are the legitimate organization, which of course they are not. So you get one of these in your inbox and typically there's a sense of urgency or it's a topic that you would be interested in. I think we gave the example in the blog of payroll type notifications, but of course invoices and things like this. And you know, a lot of people, they get an invoice that says, hey, we just charged your card for, you know, $600 and call this number. If that's an error, you know, a lot of people are going to see that and be like, hey, wait a second, I never authorized, you know, a charge for this. What they should be doing is of course looking at their credit card statement or actually going to the site without clicking on a link or scanning a QR code or calling a number just to see if that is actually the case. Which of course, if they were to do that, they would note right away that there was actually no charge made to their card.

Dave Bittner (18:01)

The other technique that you highlight in the research here is telephone oriented attack delivery. You all call it a toad. What goes into that?

Jason Schultz (18:11)

So, you know, typically when you're dealing with malicious email, a lot of times the indicators of compromise that might be included inside of that email would be things like the IP addresses, URLs that are contained in the message, things of this nature. Telephone numbers are not necessarily a common indicator of compromise that are, that are shared among security vendors and security services. I know inside of Telus we have a dedicated rule team that works on anti scam rules and actually maintain a list of phone numbers that we've seen in malicious emails so that we can block other emails that might include the same telephone number. But then of course you also have the variations on that. I'd seen telephone oriented attack delivery emails where they might substitute a capital letter o for the 0 or an I for a 1 in the phone number, trying to play tricks to make it look like it's not actually a phone number. And any sort of rules that are just generically looking for phone numbers might fail to catch something that's displayed in that particular way. So the telephone oriented attack delivery emails have become just a lot more common because while a malicious link might only have a lifetime of say an hour or on the order of hours, a telephone number might not get blocked for several days. And so they're kind of exploiting that sort of gap in the current protection that exists for most anti spam services. Like I said, they're just not really set up to deal in telephone numbers as an additional indicator of compromise. And threat actors have realized this and moved towards that. The other reason I think for the telephone oriented attack delivery is because if you're looking at it from a purely email perspective. And is this a malicious email? Is this a malicious attachment? Well, the only malicious thing that's in there is going to be the phone number that the victim calls. There's actually no sort of malicious links that'll take you to a site that downloads malware. It's sort of out of band, if you will.

Dave Bittner (20:48)

Yeah, it reminds Me of that old, I guess, prohibition of, you know, never let someone take you to a second location. In this case, it's, you know, the phone call is the second location, right?

Jason Schultz (21:01)

It is, it is. Or the QR code. Right. If you get an email through your organization's email and it's got a QR code in there, you scan it with your phone. Now you're using your cellular device, which is on a completely different network, perhaps not even monitored by your organization.

Dave Bittner (21:18)

Right. So what are your recommendations then? How should organizations best protect themselves here?

Jason Schultz (21:25)

So there's really two main ways to defend against these sorts of things. One is going to be, of course, on the technical side. You know, we've got our brand impersonation detection engine that we have developed that's looking for things like, you know, logos or copyright claims in attachments and then looking to see where those messages originate. You know, someone's claiming to be PayPal by some sort of form of PDF attachment or other, but then it's not being sent from the PayPal organization, that's quite suspicious. So there are technical means to be able to identify some of these, but ultimately users tend to be the weakest link in any sort of security system. So education of users, letting people know, these are the brands that are the top brands that are being being used in brand impersonation. And so if you get one of these and it's from one of these brands, maybe you should take a little bit deeper look at it. You know, maybe it should raise your, your suspicion level just a little bit. So I think pairing the, the technical means of stopping this with the educational aspect is really kind of the best way to sort of neutralize these malicious type emails.

Dave Bittner (22:52)

That's Jason Schultz from Cisco Talos. We'll have a link to their research in the show. Notes. Did you know active directory is targeted in 9 out of 10 cyber attacks? Once attackers get in, they can take control of your entire network. That's why Semperis created Purple Knight, the free security assessment tool that scans your active directory for hundreds of vulnerabilities and shows you how to fix them. Join thousands of IT pros using Purple Knight to stay ahead of threats. Download it now at sempris.com purple-knight that's sempris.com purple knight. Bad actors don't break in. They log in. Attackers use stolen credentials in nearly nine out of 10 data breaches. Once inside, they're after one thing. Your data. Varonis AI powered data security platform secures your data at scale across las SaaS and hybrid cloud environments Join thousands of organizations who trust Varonis to keep their data safe. Get a free data risk assessment@veronis.com and finally, it turns out, when you ask data brokers what they know about you, the response is often silence. A new study from UC Irvine reveals that about 40% of California's registered data brokersthose folks profiting off your digital breadcrumbsignored legally mandated requests for data disclosures. Many others responded with a confusing choose your own adventure of forms, phone calls, and hoop jumping. In a wry twist, these privacy hawkers suddenly care about identity verification, but only when you're trying to opt out. Researchers call it an unintended privacy paradox. To protect your privacy, you have to hand over even more personal information. Critics say the law is clear, but enforcement is limp and friction filled. Opt outs seem designed to discourage people from even trying to as one expert put it, it's privacy theater, just without an intermission. And that's the CyberWire. For links to all of today's stories, check out our daily briefing at TheCyberWire.com we'd love to hear from you. We're conducting our annual audience survey to learn more about our listeners. We're collecting your insights through the end of August. There's a link in the show Notes. Please do check it out. N2K's senior producer is Alice Carruth. Our Cyberwire producer is Liz Stokes. We're mixed by Trey Hester with original music by Elliot Peltzman. Our executive producer is Jennifer Iban. Peter Kilpe is our publisher and I'm Dave Bittner. Thanks for listening. We'll see you back here tomorrow.

Jason Schultz (26:48)

Foreign.

Dave Bittner (26:55)

Is AI built for the Enterprise soc, fully private schema, free and capable of running in sensitive air gapped environments. Krogle autonomously investigates thousands of alerts weekly, correlating insights across your tools without data leaving your perimeter. Designed for high availability across geographies, it delivers context aware, auditable decisions aligned to your workflows. Krogle empowers analysts to act faster and focus on critical threats, replacing repetitive triage with intelligent automation to help your SOC operate at scale with precision and control. Learn more@krogle.com that's C-R-O GL.com.