Loading summary
Transcript25 lines
- [00:00]
A
Foreign.
- [00:06]
B
This is Catalyn Campano and this is a risky business. Sponsored Interview with Josh Kamjoo, co founder and CEO of email security company Sublime Security. Welcome, Josh.
- [00:15]
A
Hey, Catalyn. Thanks for having me, Josh.
- [00:18]
B
First thing first, welcome back. You were on our show last fall and we had a super interesting talk about the concept of attack surface reduction for email. A novel concept that basically filters emails with programmable rules to stop attacks before they happen. For this interview I want to talk about the trends Sublime is seeing in recent attacks targeting email inboxes because I have a funny feeling that unlike malware, email usually moves faster than the other sectors of the threat landscape.
- [00:46]
A
Yes, we are seeing the threat landscape move quicker than ever. Email's always been. The email threat landscape has always been shifting relatively rapidly because as you know, it's been the number one initial access vector. It's been such high ROI for adversaries to conduct and achieve objectives.
- [01:07]
B
Do you think this is because of AI or is it just simple raw development on the email attacker side?
- [01:14]
A
I think that it has always been like this, but AI has made it worse. And we have seen on our side, on the detection and prevention side, we've seen what looks to be almost certainly AI generated attacks and we've written about those on our blog and how we detect them. And Google recently put out a report, Google's Threat Intelligence Group just put out a report on how they are seeing adversaries use Gemini to conduct their ops. And they specifically call out North Korean apt and they also call out, I believe it was Russian ABT as well as financial crime using Gemini to, to enhance their spear phishing operations basically do recon and also generate highly targeted email attacks for them. And so we're seeing the threat landscape shift rapidly in terms of just the variation of the attacks that we see as well as the sophistication. We're also seeing the same tried and true techniques that we're used to seeing, you know, over many years, but sometimes with a different twist or some additional evasion techniques baked in. You know, for, for a long time we've been seeing things like living off trusted sites or we've, we've been seeing SVG smuggling or seasonal types of campaigns. We're seeing an increase in sophistication of those. Now we've talked about HTML smuggling in the past too and so we're seeing just like additional layers of evasion with all of these things which from a detection perspective can make it more challenging. But that's what we're seeing in the wild Quite a bit now. And ultimately it's to achieve the same types of objectives that we're used to seeing adversaries try and achieve over email. So things like credential theft, you know, via like an adversary in the middle type, or malware delivery, like ransomware or things like that.
- [03:16]
B
So what would be like, from your point of view, the trend of the year from 2024, like, what did you see last year that basically summarizes the year? Was it attacker in the middle? Was it SVG smuggling, HTML smuggling? Like, what was the thing your company dealt with the most last year?
- [03:32]
A
Oh, last year I think it had to have been QR codes was the big one in terms of a technique that was not as widely used in terms of the adversary usage as a tactic to achieve objectives. That was one of the biggest, biggest ones that we saw. And obviously it leads to things like adversary in the middle type of attacks to steal credentials where it's relaying through. And that's all been commoditized now. Like we've had evil jinx for a while now. There's all kinds of like, you know, tycoon, MFA kits, and there's all kinds of stuff to make that super easy. There's also we've seen quite a bit of living off trusted sites. I would say one of the more interesting ones that we've seen a big uptick in recently is SVG smuggling, which presents some interesting detection challenges at the email layer because you see the way that SVGs are typically used are it's a scalable vector graphics file format which is usually used to like render an image, but like preserve the quality. So there's all kinds of different attributes that are available. It's like an XML file format and it natively supports JavaScript, it natively supports iframes and various HTML attributes like onload and onerror. And we have been seeing an uptick in that recently where in order to deliver credential theft attacks or via like adversary in the middle type stuff or even malware delivery. And the reason it's challenging from a detection perspective is it's like a legitimate file format similar to HTML smuggling. You can't just block all SVGs. And so the way that we look at these types of attacks is a, from a behavioral perspective, whether it's normal or not to come in to receive that file format from that particular sender. But also we can get into, we can send those types of files to our file explosion engine, which can look for recursively the JavaScript or base 64 encoded JavaScript or an iFrame, even if it's embedded multiple layers deep. So we've seen like an EML attachment, and that EML attachment will contain an SVG and that SVG will contain an iframe, and that iframe will contain base 64. And so you kind of have to get all the way down to be able to detect these types of things. But you can also combine that with different signals at the email layer. And so that's what we do and it's really, really effective.
- [06:17]
B
First of all, I didn't know SVGs can load iFrames. That's new.
- [06:21]
A
Oh yeah. Whoever thought that was a good idea? I want to have a conversation with you, crazy person.
- [06:27]
B
Yeah, that's a crazy person. 100%. From what you've described, SVGs have the same features as a HTML file. As you said, wouldn't this make it easier to detect on your site? Like, who even uses SVGs in emails now?
- [06:41]
A
It happens. That's the thing.
- [06:43]
B
Wouldn't that be a clear sign that something's amiss here?
- [06:46]
A
SVGs are actually sent in emails as images. So sometimes people embed the email signature, the bottom of your email signature, sometimes people will embed the logo. So it is a common file format. But if you can get down into the SVG contents and you have these types of analysis and scann the fact that what becomes pretty easy to detect from an attack surface reduction standpoint, we don't even have to get all the way down to the credential theft page or the final payload. All we have to know is that there is a script tag embedded in this SVG or there is an iframe, or there is a window location href that's going to redirect after some. It's going to redirect to that credential theft site. So all we need are a couple of these signals, which are highly unusual in an email context. And we can combine that with other signals that we're seeing within the environment to detect bad with very, very high confidence.
- [07:53]
B
Because of the way Sublime worked. Wouldn't be a good idea to just block those features from like clean out the SVG file, just remove the script tags and the iframes.
- [08:02]
A
We, we don't remove them, we just block the whole message. So if there is something malicious about the attachment, we're just going to block the message. That's what we're going to do.
- [08:13]
B
Do you usually see these kind of developments during specific dates? Like do they. Do attackers sit on novel Techniques just to wait for holiday seasons like Thanksgiving and Black Friday or the tax season that's soon upon us.
- [08:28]
A
We, we definitely see there's definitely 100% a seasonality to the email threat landscape and the context or the pretext that's used to deliver these types of attacks will be very timely. So what we're seeing now is tax season themed attacks and it's to achieve similar objectives. We see one of the interesting ones or more complex like sophisticated ones that we saw was a message to a CPA or to like the finance organization. And that initial message from the adversary was completely innocuous. It was just like about the tax season. They had a few email exchanges back and forth and after about two or three, the attacker then sent a malicious PDF that was like a tax form. So we've seen like, like 1120s or W2S and that PDF had a URL embedded in it and when that was clicked it downloaded a zip file and within that zip file was an lnk and within that eventually delivered the adwind rat. And so we've seen. So that was like one of the more sophisticated ones we saw and sublime. From a sublime like detection perspective we can follow all that attack chain. We can also tell when something just doesn't look right from a initial context and behavioral perspective. But we can also get all the way down to the zip and the actual RAT that's being delivered when we detect, when we analyze these messages. So we're seeing that in terms of like malware delivery, we're seeing similar types of living off trusted sites attacks where DocuSign is being abused. But it's tax themed. So hey, you need to confirm or to receive your tax refund. Who doesn't want to click on that? You know, so it's always going to have some sort of timeliness. We're seeing like W2 form verifications with QR codes embedded. So we're absolutely seeing the seasonality play a big part.
- [10:33]
B
You described these super complex attack chains. How common are these in email attacks these days? Are these just for specific high value targets or, or is it just mass produced now?
- [10:47]
A
These are commoditized now so many of the phishing kits or even the AI generated stuff. It's very much commoditized in terms of the multi stage stuff. It can make the conducting the operation a little bit more complex. But in terms of sending, these aren't, these aren't reserved for specific spear phishing attacks. It's very much mass volume types of attacks that we're seeing. Even These types of sophistication, and I think we're very much at the beginning stages of this too, where once we see truly more adoption of Gen AI from adversaries, there's going to be more, I suspect, more and more conversational like back and forths, where you're establishing rapport with the individual before you deliver the initial, the actual payload. Because the limiting factor for conducting these types of operations previously has been time. Right. And resources. If you, you just simply can't, you know, and actually also skill when it comes to language skills, where it was only for. For you to conduct a more sophisticated spear phishing operation with proper English, you needed a translator. Like Google Translate was going to screw that up. Right. But now you can use language models to do that perfectly and you can automate the whole thing. So I think we're still at the very beginning stages of how we'll see adversaries use these types of new tooling at scale.
- [12:26]
B
So how are you adapting on Sublime side to all of these changes in techniques? Like is there something that you're designing in your product to make sure it can also adapt with the attacks? Like last time I talked, you referenced your email query language that can be used to basically write on the fly detection rules. Is there something else that you're doing to keep pace and make sure your platform detects attacks that you didn't plan for or didn't know about initially?
- [12:59]
A
Yeah. So we're taking really a fundamentally new approach to real time detection. And the way that Sublime works under the hood is we have all of our models that are kind of like the foundational models. We've got our natural language model, which is like a fine tuned BERT model. We've got our computer vision model, we've got all these kind of underlying models. Then we have our control layer, which is a layer in between the user interface and our models. And that's the dsl, that's the programmable layer. And, and that layer is what has access to even all the raw signals of our models, which means that we can adapt much, much more rapidly without having to go and actually retrain a model. And so it's the combination of the kind of foundational models as well as this layer of control that allows us to adapt very rapidly to the landscape.
- [13:59]
B
Okay, Josh, I think that's the perfect way to end it. Sweet. Thank you for.
- [14:02]
A
That was cool, man.