Transcript
A (0:00)
Foreign. This is Katalin Campano and this is a Risky Business sponsor interview with Bobby Filer, head of machine learning at Sublime Security. Welcome, Bobby.
B (0:14)
Hey, thanks for having me, Bobby.
A (0:15)
Let's start first with the basics. Sublime Security is an email security company whose products revolve around the novel concept of a scripting and detection engine that's sit right in your inbox rather than sit on a wire or on an email gateway. Emails come in, Sublime scans them and then warns customers of various threats based on some pre built detection rules. It obviously gives companies much more deeper access in securing email systems than your classic email software because of this interaction component, because of the scripting engine, and because it also sits in your inbox closer to the user.
B (0:55)
Yeah.
A (0:56)
Now in this, in this interview, Bobby, you're going to talk about a new feature that Sublime is working on right now. It's a feature for detecting email bombs or spam bombs. Now let me explain this first. So an email spam bomb, since I kind of was on the end of two of these in the past, is when you have a threat actor who uses some sort of script and subscribes your email to a bunch of newsletters and then you start receiving spam, not stop for days, months, weeks, years until you unsubscribe from all of those. But there's another type of email spam bomb which has caught on with some threat actors I think at the end of last year I know of reports of the BLKBASTA ransomware using it and I think as recently the 3am ransomware gang are using it also where they select an employee inside a company and then they send that employee loads of emails, usually with a secure team, like someone's trying to compromise your account, they flood him with emails and then they call him, pretending to be a support desk, employing hey look, we are a secure account. Please run this tool on your system and you basically compromise yourself. They have an initial access in your company. So that too is also classified as a email spam bomb, even if it's a little different. It's more like a social engineering version of the older classic spam bomb. So Bobby, tell me, how exactly does this new feature work with Sublime?
B (2:28)
I think you've touched upon a couple of things that's pretty interesting. And yeah, the impetus behind building this feature is exactly what you said, right? You log in first thing in the morning one day and you're dreading seeing two or three emails in your inbox and there are suddenly thousands and that constant number rising of your inbox Unread count going up and you know, it's enough to soften the target enough where they're more ripe for a social engineering attack. So we've seen situations where, as you said, an operator or attacker makes a phone call to the person who's under duress and attempts to coerce them to give them remote access. We've also seen like teams invites leverage, where you contact them through a non email communication vector like Microsoft Teams. You initiate a phone call, you think you're talking to it, and really the attack kind of starts there. For Sublime and I think a lot of email security products, this is an interesting use case because it's not necessarily malicious or phishing emails hitting your inbox, right? They're all inherently benign, grayish, maybe a little spammy. But most of these tools, Sublime included, is looking at messages one at a time for the most part, and attempting to pick up on anomalous or malicious indicators. And so when we started hearing from potential customers about email bombs kind of hitting their environment, we started thinking about, well, how can we solve this in a way that still provides kind of the core Sublime experience, that sort of granular control that you mentioned in the opening. And what we did is we sat down with our detection team, our ML team, and our engineering team and said, all right, what sort of tools do we have at our disposal to tackle this? And engineering came back and said, we have a lot of historical data for a given organization down to the individual mailbox level. What can we do with that? One of our ML researchers, Anna Bertiger, was like, well, you know, what we should be doing is not just identifying the spike of messages, right? We need to identify what is normal for a user. So in the world of machine learning, and particularly in security and catalyn, you've been doing this for a long time. For the most part, machine learning models come out and they're a global representation of good and bad, anomalous and normal. And so what we decided to do is kind of flip that problem on its head and really tackle it at the individual level and build individual models kind of on the fly. So we go back 30 days to establish, all right, what is normal from a volume velocity and diversity of messages hitting inbox A, knowing that inbox B and C are going to be a little bit different. And by using this with some statistical anomaly detection methods, we were able to more confidently deliver a verdict of, hey, we believe an email bomb is occurring. Identifying that initial spike. At that point, we can kind of follow the bomb over the period of minutes or whatever temporal cadence you're kind of interested in. And we can start to identify when the email bomb starts to taper off. And for a lot of these you mentioned, like email bombs could take months to do. The full unsubscribe, you know, we're interested in is identifying that initial spike and sustained period of messaging so we can pull those messages kind of out of the inbox and analyze them. And the analysis part, I think is where Sublime really shines. It kind of gives you that ability to handle the messages in your own way, in a way that makes sense for your organization. So what do we mean by that? It's more about if the messages are gray mail or newsletters as you mentioned being hit by. We have machine learning models to identify topics or mass mailing infrastructure to determine whether or not these are things that you've signed up for in the past, if they previously been observed in your environment, and know whether or not to allow those back into your inbox. Maybe they are something important that you signed up for or need or, or fully remove them. Quarantine, delete, move to spam, what have you. And that's really the core kind of email bomb capability that we are delivering here is identification of the spike, moving it aside, alerting the security organization. The security organization at that point can allow our platform to help remediate while they contact the end user and let them know that hey, a bomb was detected. Please be aware that you may be contacted by parties outside of this organization. Don't accept any random team invites, anything like that. And that's how we can kind of detect and stop these threats in real time.