Lisa Vaas: [00:00:00] Welcome to Code Patrol: the podcast from contrast security that scrutinizes the tech scene with code colored glasses. I'm your host, Lisa Vaas, a computer security industry veteran who loves to chat with industry luminaries about all things security that collide with the code that runs the world.
Thank you so much for coming to this webinar. I'm really grateful you tuned in.
As we all know, cyberattacks are at a fever pitch. Cybercrime conspiracies have become more sophisticated and destructive. And when it comes to cyberattacks against financial institutions in particular, you can interpret these attacks as harbingers for how cybercrime cartel kill chains are evolving.
Today we're joined by our own Senior Vice President of Cyber [00:01:00] Strategy, Tom Kellerman. We're also joined by special guest Derek Booth, assistant to the special agent in charge of the U. S. Secret Service and head of the Mountain West Cyber Fraud Task Force. They're here to discuss cybersecurity threats facing the financial sector and the newly released Modern Bank Heist report, now available as the seventh edition in this series. Tom, Derek, welcome. It's really great to see you. How have you been since we talked last year, Derek?
Derek Booth: I've been great, Lisa. I really appreciate it. Life's good. It's a little hectic, but it's good.
Lisa Vaas: Oh, good. Well, I'm sorry that somebody in your position is busy, but I guess we shouldn't be surprised given what we saw in the Bank Heist report.
So Derek, let's start out with you. In your work for the Secret Se rvice, what changes or evolution have you been seeing over the past year vis a vis cybercrime?
Derek Booth: So I think the thing that stands out the most is just the dollar loss [00:02:00] that how much that is growing and how quickly it's growing D. O. J. Came out a couple yea rs ago and they went according to their stats. They said they went from 6. 9 billion to 10. 3 billion in a year. And that's even a couple years ago. We don't have full numbers with that and just the investment scams. The crypto scams, and we can talk about that here in a bit. Just the, just the sheer amount of them.
And just the dollar losses that are growing exponentially. That's what stands out the most to me.
Lisa Vaas: Well, great. Thank you for that. Tom the report highlighted that counter incident response is occurring in most of these breaches, the majority. What forms does that take?
Tom Kellermann: Yeah, this is interesting.
It really just shows that, you know, the defensive countermeasures that we have in place can be bypassed and many times. There's a recognition of defenders of the cyber security professionals and SOC teams that they actually believe they've been successfully attacked without having detected that attack.
Nearly half of all the respondents acknowledge the fact that they felt like they were successfully attacked [00:03:00] the past year unbeknownst to them. And this is interesting because as you see adversaries burrow into systems, the long term goal of these cyber criminals is to embed in those systems and conduct different types of cybercrime conspiracies, not merely conduct wire transfer fraud or extort the victim for, you know Virtual currency payments.
And one glaring reason for that is, you know, two thirds of these organizations said they cannot trace attacks to the exact line of code for the vulnerability that has been targeted. And because of that, more and more of these application attacks are effective in bypassing traditional perimeter defense.
And once the adversaries in those systems, the adversaries many times choose to move laterally through trusted traffic. Through existing protocols by living off the land. In addition, they actually delete timestamps manipulate blogs disable security controls to really make it much more difficult for the defender to defend and even conduct incident response and to root them out of those systems.
Lisa Vaas: Well, I [00:04:00] know you've both been aware of the fact that 48 percent of financial institutions reported these destructive attacks this year and what those attacks entail. Derek what are you seeing on your side that Tom is talking about here?
Derek Booth: So the number one attack we're seeing in the service is business email compromise attacks.
We're seeing the change the AI is making with this, how difficult it is for companies to keep track of their email systems and the amount of emails that are going out and causing these problems. And when we step in, we're finding that companies just aren't paying attention to a lot of their accounts, their forwarding rules are, are being changed.
Account takeovers are playing a big part of this as the suspects and the bad guys are getting in the system and then they can launch out, you know, thousands of emails in a heartbeat and do whatever they want. And the dollar loss here is growing as well. Because, you know, bad guy gets [00:05:00] in the system.
He can launch an email to say the account manager change bank account information overnight. And that account manager sending. You know, hundreds of thousands of dollars in transactions to fall to bank accounts. And then after the fact, they figure it out. And it usually takes, you know, too long for us to, to get in and play a part.
So BEC attacks is definitely our number one ransomware is on the, on the upswing as well again. And always it's funny, we mentioned last year, how those numbers had gone down a little bit, but they're, they're climbing back up. And I think pretty much we can say AI is playing a big part of that and that change.
So I would say right now BEC attacks would be our number one. Ransomware close number two.
Tom Kellermann: You know, it's interesting about what you just said there, Derek, about BEC attacks is you also describe that kind of that shift from traditional BEC, where it's a spoofed email trying to convince, right, various CFO to send money out to reverse [00:06:00] BEC, like reverse business email compromise, where they actually hijack The administrative rights to 0365 environments within the organization, such as they can facilitate fraud with existing email accounts.
And I think that's a notable shift. That's actually a technique that was pioneered by a Turla, which is a famous Russian cyber crime group that also act as cyber spies as well.
Lisa Vaas: It's always point of interest:, who's behind these attacks?
And I know the bank report always goes over you know, kind of the countries. of origin. But you're throwing AI in the mix which is, is probably the first time, I'd say, Tom ? But let's talk about who's behind these attacks. I'd love to hear both of you describe the evolution of these more sophisticated, more destructive cybercrime conspiracies you've been witnessing.
Tom Kellermann: Yeah, I just would like to highlight, you know, the the Russian dark web has always been the pioneers of attacks against the financial sector. They began in earnest in 1995 when money became electronic [00:07:00] with electronic finance and everyone moving towards E financial systems. And the true pioneers of the Russian dark web are really these organized groups of cyber criminals, which are now quasi cartel like that enjoy immunity from.
Western law enforcement prosecution, and they enjoy an untouchable status because of the pax mafioso they have with the regime. But what's notable in this report is that China was also considered to be a significant threat to the financial sector for the first time. And traditionally Chinese Hackers have not really targeted the financial sector because A. They own large percentages of U. S. Banks B. They're very much a participant, significant hegemon in the global financial sector. But now, as you see, geopolitical tensions escalating between the U. S. And China over Taiwan and the South China Sea. Coupled with various economic sanctions coupled with the [00:08:00] advent of economic espionage by targeting financial institutions.
I do think it's notable that China is now considered to be as significant a threat to financial institutions as Russia, which has not been the case in the past seven years.
Lisa Vaas: And Derek, are you
Derek Booth: yeah, I'll add, yeah, I'll add to that. And what's interesting is even last week, the FBI director, Christopher Wray stood up in front of Congress.
And testified and said that People's Republic of China has a bigger hacking program than any other nation combined. So he was talking about them what a threat they are and not only to financial institutions, but also critical infrastructure or critical infrastructure organizations. So that's interesting that Tom points that out because, you know, China is definitely they're, they're always a threat.
When I came on the job in 99, we had what we call the West African task force and we would send agents to West Africa. We had, we had an office there. We've shut that down because the government wouldn't cooperate with us, but we're still seeing massive amounts of fraud.
and [00:09:00] attacks coming from West Africa. And we're talking more on the individual side, but these are also affecting the financial institutions. You know, this last year, there's been multiple arrests. Interpol back in August, arrested 14 players in this. I think they estimate about 40 million in loss.
And that's BEC attacks, romance scams, online extortion scams. 40 million sounds like a lot. But we're talking when the BEC total losses are 2. 7 billion. It's not really material there. And then there's members, you know, a year before Black Axe is as a known kind of a mafia type, like, like Tom had mentioned with the Russians these are West Africans in multiple countries and they act like a mafia type gang.
They're violent. They're organized and they go after financial institutions. They go after individuals. They go after mom and pop shop businesses all over the world. And that money's flowing. I mean, you're still talking millions and millions of dollars are coming into those, into those countries with those with those bad actors.
Lisa Vaas: Oh, interesting that the government wouldn't cooperate and God, what [00:10:00] can you even do if they don't cooperate? But that's another topic, you know, your life in the Secret Service. So, so, Tom, I wanted to ask you according to the report, 52 percent of respondents said that they've been victimized by island hopping.
Would you please explain what that is and give us an example?
Tom Kellermann: A great example would be the compromise of ongoing operations cloud service provider in December, wherein their infrastructure was compromised. And as a result, the adversaries used that hijacked digital transformation to launch attacks against 60 different credit unions.
So 60 different credit unions were compromised because of a cloud service provider being successfully attacked. Many times people would call this supply chain attacks. And I would say don't limit yourself to say that because that only specifically would state that that's a issue or a challenge for the technology sector, not necessarily for someone who's been compromised.
And what's illustrated by that stat is every year it's high in so much that the [00:11:00] adversaries won't only use the supply chain to get to the victim, but once in the victim, they will then launch a attacks from the victim's infrastructure against their constituency. And the way that manifests is, you know, there's network based island hopping as evidenced.
There's cloud based island hopping as evidenced. There's that reverse business email compromise where they commandeer the administrative rights to the O365 environments and launch attacks from there. There's watering holes where they Pollutes your website or your applications to target your users, et cetera, et cetera.
We just have to recognize that cybercrime cartels of today don't just want to burglarize the bank, but they want to kind of turn it into a hostage situation, wherein anyone that trusts that infrastructure or the application of the financial institution can successfully be targeted by them.
Lisa Vaas: Including every one of us who has a bank account.
Tom Kellermann: Correct. I mean, what happens when you can't trust the application that the bank has provided to you to conduct electronic finance? What happens when the bank itself is attacking you unbeknownst to the bank? [00:12:00] And that's what's scary about that earlier stat that I brought up. That nearly half of respondents believe they've been successfully attacked without having detected the attack.
Lisa Vaas: Well you know, you're talking about our banking applications, and that brings to mind something that I found really sobering in the most recent bank report, and that was the soaring number of attacks against application programming interfaces. Specifically, the, the report found that over the, Last year, the number of financial institutions that reported attacks against their public or private APIs reached 77%.
That's more than a 50 percent increase over last year's 50%. At this rate, it won't be long before the entire finance sector will have been attacked via their APIs. What is it about these little snippets of code that lead them to being targeted at such a furious rate?
Tom Kellermann: You know, I would liken API's to the armored car of banks.
They're implicitly trusted by the bank. They're implicitly trusted to move [00:13:00] finances by the bank. You're seeing so many API's being developed for the purposes of digital transformation and modern application development, and you have shadow API's that are abounding. I mean, if you just think about it, both public and private API's In use right now exceed 200 million out there.
So many of those people don't even know where they end and begin with their APIs, yet they implicitly trust these APIs, which allow for that ephemeral connected kind of tissue experience. This becomes even more difficult to secure as continuous development leads to sprawl and significant versioning issues.
Plus, most people employ out of date legacy kind of security controls to defend APIs like WAFs, which are really, they're just locks on the front door. They're not effective in defending the entire programming interface from the attacks of today or attacks on back end systems.
Lisa Vaas: Derek, do you want to jump in and comment on what's going on with APIs?
Derek Booth: You know, the only thing I would add, and Tom, Tom's the true expert [00:14:00] with this topic. I would just add, you know, the bad guys must be having success. If they're going to keep, keep attacking these and Tom points out in his report, how many APIs, you know, it was in the millions and they just continues to grow.
So I, I just, I think it's amazing that they're having great success. They're going to keep at it. And this problem, this problem is not going to go away. I mean, I think this is one of these true pivot points. It's just going to continue.
Lisa Vaas: Well, we, you know Tom mentioned, you mentioned that a web application firewalls are not very effective.
So let's, let's arm people with some tips on, you know, how to protect their APIs better. What do you, what do you say?
Tom Kellermann: Yeah, first, understand where you, where you end and begin. Maintain a complete inventory of your APIs running in your environments, both in development and in production. Obviously ensure rigorous access control with two factor authentication and authorization.
Definitely perform full security testing against running APIs during development so that you can identify and [00:15:00] remediate known vulnerabilities. Identify security gaps in the supply chain like Third party libraries and frameworks and services that are active, you know, validate your schemas, ensuring proper API behavior, because that's critically important, right, for compromise.
And then lastly, protect against zero day attacks by ensuring that all APIs are deployed with runtime protection. Runtime protection is incredibly efficient and almost foolproof when defending against zero day attacks for these types of interfaces.
Lisa Vaas: Tom, let's talk about the large percentage, as in 74 percent of financial institutions that detected campaigns to steal their non public market information.
I noticed that this is up from 50 percent in 2023, so another huge jump. What's causing the spike in these attacks?
Tom Kellermann: I think twofold. One is economic espionage now is is growing. You've got four rogue nation states that are [00:16:00] actively using cybercrime conspiracies against financial institutions to offset economic sanctions.
And two is there's greater knowledge of the interdependencies in the financial sector. And more importantly, what is considered to be the true treasure. Trove in a financial institution, which is nonpublic market information, market strategies, merger and acquisition information, right where the financial institutions backing that anything you can think of that is nonpublic is incredibly valuable and thus digital front running and digital insider trading have become mainstream now.
And this is something that Needs to be paid attention to because it's very difficult to discern the traditional surveillance departments and institutions are constantly looking for insider threats that would conduct this type of fraud and not recognizing or appreciating that there are digital insider threats and nation states that are actively involved in conducting this type of fraud.
But most interesting, I think there's a new form of digital insider trading. Which is being used by specific groups which is quite interesting. I coined [00:17:00] it shoxing where they'll hack a financial institution they'll then short the stock and then later on they'll dox, release sensitive information to the regulator of that institution such that they're punished and obviously the stock price goes down and this is becoming more mainstream.
The CISO for MasterCard noted this in a speech last year at RSA as well. But we should pay close attention and much more effort must be made between the cybersecurity team and the SOC and their conversations with their surveillance department as to how to discern these behavioral anomalies. And more importantly, how do you smoke out these types of digital front running or insider trading conspiracies that are targeting these financial institutions?
One example that I really want to refer to Derek on here is there was a pioneer of this. There's a Russian kind of pioneer of this type of digital front running insider trading, and it's Andrei Tyurin who began these types of attacks against institutions like JPMorgan Chase and E Trade back in 2012.
He's sitting in jail now, [00:18:00] but I think it would be best if Derek shed a little light on this investigation.
Derek Booth: Yeah, absolutely. And so Andre i he hacked into JPMorgan Chase. And he stole over 80 million customers PII. And at the time that was the, I think, and it might still be the single largest hack against one financial institution.
And he also attacked E Trade, Scott Trade and a couple others. And he grabbed, I think around a hundred million customers PII, but then he turned around and used that PII and customer information to manipulate the stock and mislead customers. into pricing and marketing and other, you know, other things that customers look for.
And then he, he compounded that got into some internet gambling sites and made some changes added information and marketing. And, and then he, then he, at the end, he went back and deleted everything and tried to, you know, cover his tracks. And it was quite a case. I mean, you're talking a lot of, a lot of PII out there, a lot of money and a lot of damage.
Lisa Vaas: Oh, wow. [00:19:00] That is a lot. That's a widespread assault. Okay. Well, thank you so much for, for all of that. That's a really interesting case study, Derek. So thank you for that. So, Derek and Tom, what other trends that are affecting the financial sector are worth calling out here?
Tom Kellermann: One thing that's notable, and even though there's been progress made, it's still glaring is that, you know, over 81%.
Of respondents said that they had a backlog. It took them three or more months to remediate vulnerabilities in the applications they're developing for the purposes of electronic finance. That's a long time to be forgive me for saying this. I live in Colorado, naked in the wild. I can't even understand how the backlog is that long.
Obviously, we know why it is because they're using static or or dynamic testing tools and they get a significant backlog because they haven't Built in, you know, DevSecOps into their production pipelines, but more importantly, it's, it's problematic given the [00:20:00] fact that there's over 70 CVEs released every day.
And so dealing with that backlog is an imperative as application attacks are surging. It's not just because Contrast is telling you every year, the Verizon Data Breach Report tells you the same thing and they're going to continue to surge. Until people recognize that APIs can be attacked in the very same way.
And APIs are now the latest and greatest attack surface to get into financial institutions. So that's highly problematic. Also, destructive attacks still remain high. And I think that's partially due to geopolitical tension, but also due to counter incident response where the adversary is willing to drop a wiper in your system to punish you or leverage a DDoS against you as you're responding to an incident or even, you know, drop ransomware, NotPetya style on you when you're responding to an incident.
And so the adversaries have become more punitive in nature, the more willing to hijack your digital transformation, and they're more willing to actually conduct intricate cybercrime conspiracies that go beyond wire [00:21:00] transfer, fraud or extortion.
Lisa Vaas: Okay, Derek, do you have anything to add to that?
Derek Booth: Yeah, definitely.
And I, I'm going to, I'm going to pivot here a little bit. Tom, you know, Tom does a great job studying these financial institutions, which are large, these large groups of companies. I'm going to change topics here for a little bit and just talk about small businesses and individuals and medium businesses as well.
And as those financial institutions are hit, these, these individuals and small businesses are hit too, because now they got to pay more fees. They got to, they, it trickles down, but also things trickle up. And when you have a small business that gets hit with a BEC attack or ransomware attack, you know, a hundred thousand dollars, isn't a whole lot to say JP Morgan chase or to Scottrade or whoever it might be, but a hundred thousand dollars is huge.
It's a huge material item for a small business or a mom and pop business or just even an individual. And, these people in these businesses are being crushed, with all kinds of scams, the scams we've already talked about, BEC [00:22:00] attacks, ransomware, but also you're, we got to go backwards a little bit to romance scams and investment scams and tech and law enforcement scams.
And, and then another big one that is not so much financially reckoning, but it is still, there's a huge financial payoff for the bad guy is sextortion. And I know this is not, this isn't the, that's not a comfortable word we like to talk about, but the stats that are coming, the repercussions that are coming from that are never ending.
The DOJ has issued multiple, multiple notices. We've had a big, we have a big ongoing case right now coming out of Idaho. The rise in teen suicide coming from this is crazy. And so I know we're talking financial institutions and, and money that way, but these things trickle down, they trickle up because this affects.
These companies, individuals, and sometimes it puts them into bankruptcy or laying off businesses or causes, you know, life changing decisions like divorce or, [00:23:00] you know, having to move the family different places. So I think the potential of some of these scams are just never ending. And most of them are, they're targeting these financial institutions because the payoff is so high.
And it makes sense, right? A bank robber wants to get in and get out because he can get a quick payoff. Some of these bad guys, they're patient. They're getting in like Tom's talking about. They're getting into doing these account takeovers and they can hang out for a little bit and then cause problems through the market.
And that's pretty brazen. And it's pretty impressive actually to watch how these guys are working. But at the same time, I don't want to forget about those little guys that are getting hit as well. So.
Lisa Vaas: Yeah, I'm so glad you brought up those suicides. As soon as you say the word sextortion, it's like I think about the tragic things that are happening to teenagers, or even younger than that, so, so acknowledging that is a great thing to do.
Thank you. Okay, so let's round this out by talking a little bit more about advice for banks [00:24:00] or any other organizations or individuals really dealing with attacks like this. Tom, you were kind enough to give advice about securing APIs. And you did mention that dynamic and static application security testing, DAST and SAST are kind of hobbling organizations.
Do you want to give out some better advice that can help?
Tom Kellermann: Yes. So from a governance perspective, I still can't believe that 41 percent of CISOs are still reporting to CIOs. Your defensive coordinator cannot be reporting to your offensive coordinator. It's high time that you elevate the CISO to a proper position at the C level and give them the corresponding authority and resources to do what needs to be done to manage your risk and protect your brand.
Secondarily, yes, I think XDR is here to stay, but detection response can't be limited to just networks and endpoints and cloud. It must be extended to applications. Behavioral anomaly detection must extend to [00:25:00] applications. So I think, you know, runtime security is an imperative to defend applications from behavioral anomalies and correspondently defend APIs from anomalies.
I think threat hunting must be expanded. It must be continuous. It should be weekly. Not monthly or not after an incident, and it should be extended to any managed service provider that provides you with significant infrastructure, cloud or capability services. Obviously, 2 factor authentication is quintessentially important, but at some point it will be hijacked.
So I do think there's a great utility in defending those environments with deception technology. Which can be used to trigger when your first line of defense fails. And then lastly, penetration testing itself shouldn't just be from the outside in, but should be from the inside out. And what I mean by that is, can you conduct attack path mapping to understand where an adversary can go within your environment?
Or to get outside of your environment, because I think the name of the game now is intrusion suppression. Can you prevent the [00:26:00] adversary from moving freely laterally in your environment? And more importantly, can you prevent them from departing your environment and stealing your crown jewels? Whether that be information,
et cetera, et cetera. So, so with that, yes Elevate your CISO, deploy XDR, but don't limit yourself. Also employ runtime security to protect your applications and APIs. Really start embracing deception technology. Expand those threat hunts and begin to think differently. Allow offense to inform your defense.
Okay, great.
Lisa Vaas: Thank you. Derek, anything to add to that?
Derek Booth: So the only thing I would add is and Tom's a perfect example of this. He, he has reached out through the community and to law enforcement and our other private partners tremendously, and he does a great job and we appreciate it. And he's a perfect example of this, but I would suggest that people reach out, reach out to their law enforcement communities, reach out to the other security.
Personnel in their communities and help each other out. I mean, this is a team game and we do need to help each other out. And also, you know, law [00:27:00] enforcement. Sometimes we have a negative stigma. We're not here to cause any problems. We're here to solve the problem and we're trying to find the, you know, find the bad actors and we are having some success.
It's tough because most of them are across, you know, the ocean and we can't get to them. But at the same time, we're not always told what's going on. A lot of people still don't trust us, don't contact us. We can only do as much as we know, and we have partnerships. We have what we call our cyber fraud task force.
I coordinate that here in the mountain West. And we have over 250 members of law enforcement, network, security personnel, community members, business owners, who they just want to just know what's going on. They want to know, Hey, how can I protect my company? How can I protect my group of people?
And then on the law enforcement side, how can we help the community, especially the state and locals? How can we help if there's a massive ransomware attack or business email compromise that shuts down a business, how can we step in and help? And so I strongly suggest to everyone out there to get involved.
mentioned when I came on the job in 99, there was one task [00:28:00] force in New York city. Tom played a part in that. And cooperated with those guys and worked with those guys for a long time. We're now up to 42 task force around the world.
And that includes London and Rome. And we also have partnerships with Europol, Interpol. We have working groups in London, South America, Australia. My old boss is in Australia now. He's been down there a couple of years. He plans on being there a couple more years. And we just, we work as a team. That's the way Secret Service has always done that.
We work in a counterpart system. We do that in protection. We do that now in investigations and it works. Because we're not, we don't have all of the answers and we're not, you know, experts in every single thing, but we try to hook up and, and team with the experts. And if we do that, if we all do that together, I think we can, we can attack a lot of these problems in a, in a more efficient way.
So. That's the only, that's the only suggestion I would say, just reach out. And there's people out there to help you. You know, we work with the FBI, we work with CISA, we work with the state OIT offices. There's, there's multiple people out there that we, that we tap into or ask for [00:29:00] help as well. And so it's, it's definitely a team game.
Great.
Lisa Vaas: Well, it shouldn't be too hard to find somebody nearby since you guys are so well dispersed all over the globe, really. So for that important tip. Well, that just about does it for today's webinar. I want to thank our guests, Tom Kellerman and Derek Booth, for taking the time to talk today. Listeners, thanks for tuning in.
To download a copy of Contrast's modern bank heist 2024 report, head to www.contrastsecurity.com/cyber-bank-heists-report.
Thank you so much for coming to this webinar. I'm really grateful you tuned in.
As we all know, cyberattacks are at a fever pitch. Cybercrime conspiracies have become more sophisticated and destructive. And when it comes to cyberattacks against financial institutions in particular, you can interpret these attacks as harbingers for how cybercrime cartel kill chains are evolving.
Today we're joined by our own Senior Vice President of Cyber [00:01:00] Strategy, Tom Kellerman. We're also joined by special guest Derek Booth, assistant to the special agent in charge of the U. S. Secret Service and head of the Mountain West Cyber Fraud Task Force. They're here to discuss cybersecurity threats facing the financial sector and the newly released Modern Bank Heist report, now available as the seventh edition in this series. Tom, Derek, welcome. It's really great to see you. How have you been since we talked last year, Derek?
Derek Booth: I've been great, Lisa. I really appreciate it. Life's good. It's a little hectic, but it's good.
Lisa Vaas: Oh, good. Well, I'm sorry that somebody in your position is busy, but I guess we shouldn't be surprised given what we saw in the Bank Heist report.
So Derek, let's start out with you. In your work for the Secret Se rvice, what changes or evolution have you been seeing over the past year vis a vis cybercrime?
Derek Booth: So I think the thing that stands out the most is just the dollar loss [00:02:00] that how much that is growing and how quickly it's growing D. O. J. Came out a couple yea rs ago and they went according to their stats. They said they went from 6. 9 billion to 10. 3 billion in a year. And that's even a couple years ago. We don't have full numbers with that and just the investment scams. The crypto scams, and we can talk about that here in a bit. Just the, just the sheer amount of them.
And just the dollar losses that are growing exponentially. That's what stands out the most to me.
Lisa Vaas: Well, great. Thank you for that. Tom the report highlighted that counter incident response is occurring in most of these breaches, the majority. What forms does that take?
Tom Kellermann: Yeah, this is interesting.
It really just shows that, you know, the defensive countermeasures that we have in place can be bypassed and many times. There's a recognition of defenders of the cyber security professionals and SOC teams that they actually believe they've been successfully attacked without having detected that attack.
Nearly half of all the respondents acknowledge the fact that they felt like they were successfully attacked [00:03:00] the past year unbeknownst to them. And this is interesting because as you see adversaries burrow into systems, the long term goal of these cyber criminals is to embed in those systems and conduct different types of cybercrime conspiracies, not merely conduct wire transfer fraud or extort the victim for, you know Virtual currency payments.
And one glaring reason for that is, you know, two thirds of these organizations said they cannot trace attacks to the exact line of code for the vulnerability that has been targeted. And because of that, more and more of these application attacks are effective in bypassing traditional perimeter defense.
And once the adversaries in those systems, the adversaries many times choose to move laterally through trusted traffic. Through existing protocols by living off the land. In addition, they actually delete timestamps manipulate blogs disable security controls to really make it much more difficult for the defender to defend and even conduct incident response and to root them out of those systems.
Lisa Vaas: Well, I [00:04:00] know you've both been aware of the fact that 48 percent of financial institutions reported these destructive attacks this year and what those attacks entail. Derek what are you seeing on your side that Tom is talking about here?
Derek Booth: So the number one attack we're seeing in the service is business email compromise attacks.
We're seeing the change the AI is making with this, how difficult it is for companies to keep track of their email systems and the amount of emails that are going out and causing these problems. And when we step in, we're finding that companies just aren't paying attention to a lot of their accounts, their forwarding rules are, are being changed.
Account takeovers are playing a big part of this as the suspects and the bad guys are getting in the system and then they can launch out, you know, thousands of emails in a heartbeat and do whatever they want. And the dollar loss here is growing as well. Because, you know, bad guy gets [00:05:00] in the system.
He can launch an email to say the account manager change bank account information overnight. And that account manager sending. You know, hundreds of thousands of dollars in transactions to fall to bank accounts. And then after the fact, they figure it out. And it usually takes, you know, too long for us to, to get in and play a part.
So BEC attacks is definitely our number one ransomware is on the, on the upswing as well again. And always it's funny, we mentioned last year, how those numbers had gone down a little bit, but they're, they're climbing back up. And I think pretty much we can say AI is playing a big part of that and that change.
So I would say right now BEC attacks would be our number one. Ransomware close number two.
Tom Kellermann: You know, it's interesting about what you just said there, Derek, about BEC attacks is you also describe that kind of that shift from traditional BEC, where it's a spoofed email trying to convince, right, various CFO to send money out to reverse [00:06:00] BEC, like reverse business email compromise, where they actually hijack The administrative rights to 0365 environments within the organization, such as they can facilitate fraud with existing email accounts.
And I think that's a notable shift. That's actually a technique that was pioneered by a Turla, which is a famous Russian cyber crime group that also act as cyber spies as well.
Lisa Vaas: It's always point of interest:, who's behind these attacks?
And I know the bank report always goes over you know, kind of the countries. of origin. But you're throwing AI in the mix which is, is probably the first time, I'd say, Tom ? But let's talk about who's behind these attacks. I'd love to hear both of you describe the evolution of these more sophisticated, more destructive cybercrime conspiracies you've been witnessing.
Tom Kellermann: Yeah, I just would like to highlight, you know, the the Russian dark web has always been the pioneers of attacks against the financial sector. They began in earnest in 1995 when money became electronic [00:07:00] with electronic finance and everyone moving towards E financial systems. And the true pioneers of the Russian dark web are really these organized groups of cyber criminals, which are now quasi cartel like that enjoy immunity from.
Western law enforcement prosecution, and they enjoy an untouchable status because of the pax mafioso they have with the regime. But what's notable in this report is that China was also considered to be a significant threat to the financial sector for the first time. And traditionally Chinese Hackers have not really targeted the financial sector because A. They own large percentages of U. S. Banks B. They're very much a participant, significant hegemon in the global financial sector. But now, as you see, geopolitical tensions escalating between the U. S. And China over Taiwan and the South China Sea. Coupled with various economic sanctions coupled with the [00:08:00] advent of economic espionage by targeting financial institutions.
I do think it's notable that China is now considered to be as significant a threat to financial institutions as Russia, which has not been the case in the past seven years.
Lisa Vaas: And Derek, are you
Derek Booth: yeah, I'll add, yeah, I'll add to that. And what's interesting is even last week, the FBI director, Christopher Wray stood up in front of Congress.
And testified and said that People's Republic of China has a bigger hacking program than any other nation combined. So he was talking about them what a threat they are and not only to financial institutions, but also critical infrastructure or critical infrastructure organizations. So that's interesting that Tom points that out because, you know, China is definitely they're, they're always a threat.
When I came on the job in 99, we had what we call the West African task force and we would send agents to West Africa. We had, we had an office there. We've shut that down because the government wouldn't cooperate with us, but we're still seeing massive amounts of fraud.
and [00:09:00] attacks coming from West Africa. And we're talking more on the individual side, but these are also affecting the financial institutions. You know, this last year, there's been multiple arrests. Interpol back in August, arrested 14 players in this. I think they estimate about 40 million in loss.
And that's BEC attacks, romance scams, online extortion scams. 40 million sounds like a lot. But we're talking when the BEC total losses are 2. 7 billion. It's not really material there. And then there's members, you know, a year before Black Axe is as a known kind of a mafia type, like, like Tom had mentioned with the Russians these are West Africans in multiple countries and they act like a mafia type gang.
They're violent. They're organized and they go after financial institutions. They go after individuals. They go after mom and pop shop businesses all over the world. And that money's flowing. I mean, you're still talking millions and millions of dollars are coming into those, into those countries with those with those bad actors.
Lisa Vaas: Oh, interesting that the government wouldn't cooperate and God, what [00:10:00] can you even do if they don't cooperate? But that's another topic, you know, your life in the Secret Service. So, so, Tom, I wanted to ask you according to the report, 52 percent of respondents said that they've been victimized by island hopping.
Would you please explain what that is and give us an example?
Tom Kellermann: A great example would be the compromise of ongoing operations cloud service provider in December, wherein their infrastructure was compromised. And as a result, the adversaries used that hijacked digital transformation to launch attacks against 60 different credit unions.
So 60 different credit unions were compromised because of a cloud service provider being successfully attacked. Many times people would call this supply chain attacks. And I would say don't limit yourself to say that because that only specifically would state that that's a issue or a challenge for the technology sector, not necessarily for someone who's been compromised.
And what's illustrated by that stat is every year it's high in so much that the [00:11:00] adversaries won't only use the supply chain to get to the victim, but once in the victim, they will then launch a attacks from the victim's infrastructure against their constituency. And the way that manifests is, you know, there's network based island hopping as evidenced.
There's cloud based island hopping as evidenced. There's that reverse business email compromise where they commandeer the administrative rights to the O365 environments and launch attacks from there. There's watering holes where they Pollutes your website or your applications to target your users, et cetera, et cetera.
We just have to recognize that cybercrime cartels of today don't just want to burglarize the bank, but they want to kind of turn it into a hostage situation, wherein anyone that trusts that infrastructure or the application of the financial institution can successfully be targeted by them.
Lisa Vaas: Including every one of us who has a bank account.
Tom Kellermann: Correct. I mean, what happens when you can't trust the application that the bank has provided to you to conduct electronic finance? What happens when the bank itself is attacking you unbeknownst to the bank? [00:12:00] And that's what's scary about that earlier stat that I brought up. That nearly half of respondents believe they've been successfully attacked without having detected the attack.
Lisa Vaas: Well you know, you're talking about our banking applications, and that brings to mind something that I found really sobering in the most recent bank report, and that was the soaring number of attacks against application programming interfaces. Specifically, the, the report found that over the, Last year, the number of financial institutions that reported attacks against their public or private APIs reached 77%.
That's more than a 50 percent increase over last year's 50%. At this rate, it won't be long before the entire finance sector will have been attacked via their APIs. What is it about these little snippets of code that lead them to being targeted at such a furious rate?
Tom Kellermann: You know, I would liken API's to the armored car of banks.
They're implicitly trusted by the bank. They're implicitly trusted to move [00:13:00] finances by the bank. You're seeing so many API's being developed for the purposes of digital transformation and modern application development, and you have shadow API's that are abounding. I mean, if you just think about it, both public and private API's In use right now exceed 200 million out there.
So many of those people don't even know where they end and begin with their APIs, yet they implicitly trust these APIs, which allow for that ephemeral connected kind of tissue experience. This becomes even more difficult to secure as continuous development leads to sprawl and significant versioning issues.
Plus, most people employ out of date legacy kind of security controls to defend APIs like WAFs, which are really, they're just locks on the front door. They're not effective in defending the entire programming interface from the attacks of today or attacks on back end systems.
Lisa Vaas: Derek, do you want to jump in and comment on what's going on with APIs?
Derek Booth: You know, the only thing I would add, and Tom, Tom's the true expert [00:14:00] with this topic. I would just add, you know, the bad guys must be having success. If they're going to keep, keep attacking these and Tom points out in his report, how many APIs, you know, it was in the millions and they just continues to grow.
So I, I just, I think it's amazing that they're having great success. They're going to keep at it. And this problem, this problem is not going to go away. I mean, I think this is one of these true pivot points. It's just going to continue.
Lisa Vaas: Well, we, you know Tom mentioned, you mentioned that a web application firewalls are not very effective.
So let's, let's arm people with some tips on, you know, how to protect their APIs better. What do you, what do you say?
Tom Kellermann: Yeah, first, understand where you, where you end and begin. Maintain a complete inventory of your APIs running in your environments, both in development and in production. Obviously ensure rigorous access control with two factor authentication and authorization.
Definitely perform full security testing against running APIs during development so that you can identify and [00:15:00] remediate known vulnerabilities. Identify security gaps in the supply chain like Third party libraries and frameworks and services that are active, you know, validate your schemas, ensuring proper API behavior, because that's critically important, right, for compromise.
And then lastly, protect against zero day attacks by ensuring that all APIs are deployed with runtime protection. Runtime protection is incredibly efficient and almost foolproof when defending against zero day attacks for these types of interfaces.
Lisa Vaas: Tom, let's talk about the large percentage, as in 74 percent of financial institutions that detected campaigns to steal their non public market information.
I noticed that this is up from 50 percent in 2023, so another huge jump. What's causing the spike in these attacks?
Tom Kellermann: I think twofold. One is economic espionage now is is growing. You've got four rogue nation states that are [00:16:00] actively using cybercrime conspiracies against financial institutions to offset economic sanctions.
And two is there's greater knowledge of the interdependencies in the financial sector. And more importantly, what is considered to be the true treasure. Trove in a financial institution, which is nonpublic market information, market strategies, merger and acquisition information, right where the financial institutions backing that anything you can think of that is nonpublic is incredibly valuable and thus digital front running and digital insider trading have become mainstream now.
And this is something that Needs to be paid attention to because it's very difficult to discern the traditional surveillance departments and institutions are constantly looking for insider threats that would conduct this type of fraud and not recognizing or appreciating that there are digital insider threats and nation states that are actively involved in conducting this type of fraud.
But most interesting, I think there's a new form of digital insider trading. Which is being used by specific groups which is quite interesting. I coined [00:17:00] it shoxing where they'll hack a financial institution they'll then short the stock and then later on they'll dox, release sensitive information to the regulator of that institution such that they're punished and obviously the stock price goes down and this is becoming more mainstream.
The CISO for MasterCard noted this in a speech last year at RSA as well. But we should pay close attention and much more effort must be made between the cybersecurity team and the SOC and their conversations with their surveillance department as to how to discern these behavioral anomalies. And more importantly, how do you smoke out these types of digital front running or insider trading conspiracies that are targeting these financial institutions?
One example that I really want to refer to Derek on here is there was a pioneer of this. There's a Russian kind of pioneer of this type of digital front running insider trading, and it's Andrei Tyurin who began these types of attacks against institutions like JPMorgan Chase and E Trade back in 2012.
He's sitting in jail now, [00:18:00] but I think it would be best if Derek shed a little light on this investigation.
Derek Booth: Yeah, absolutely. And so Andre i he hacked into JPMorgan Chase. And he stole over 80 million customers PII. And at the time that was the, I think, and it might still be the single largest hack against one financial institution.
And he also attacked E Trade, Scott Trade and a couple others. And he grabbed, I think around a hundred million customers PII, but then he turned around and used that PII and customer information to manipulate the stock and mislead customers. into pricing and marketing and other, you know, other things that customers look for.
And then he, he compounded that got into some internet gambling sites and made some changes added information and marketing. And, and then he, then he, at the end, he went back and deleted everything and tried to, you know, cover his tracks. And it was quite a case. I mean, you're talking a lot of, a lot of PII out there, a lot of money and a lot of damage.
Lisa Vaas: Oh, wow. [00:19:00] That is a lot. That's a widespread assault. Okay. Well, thank you so much for, for all of that. That's a really interesting case study, Derek. So thank you for that. So, Derek and Tom, what other trends that are affecting the financial sector are worth calling out here?
Tom Kellermann: One thing that's notable, and even though there's been progress made, it's still glaring is that, you know, over 81%.
Of respondents said that they had a backlog. It took them three or more months to remediate vulnerabilities in the applications they're developing for the purposes of electronic finance. That's a long time to be forgive me for saying this. I live in Colorado, naked in the wild. I can't even understand how the backlog is that long.
Obviously, we know why it is because they're using static or or dynamic testing tools and they get a significant backlog because they haven't Built in, you know, DevSecOps into their production pipelines, but more importantly, it's, it's problematic given the [00:20:00] fact that there's over 70 CVEs released every day.
And so dealing with that backlog is an imperative as application attacks are surging. It's not just because Contrast is telling you every year, the Verizon Data Breach Report tells you the same thing and they're going to continue to surge. Until people recognize that APIs can be attacked in the very same way.
And APIs are now the latest and greatest attack surface to get into financial institutions. So that's highly problematic. Also, destructive attacks still remain high. And I think that's partially due to geopolitical tension, but also due to counter incident response where the adversary is willing to drop a wiper in your system to punish you or leverage a DDoS against you as you're responding to an incident or even, you know, drop ransomware, NotPetya style on you when you're responding to an incident.
And so the adversaries have become more punitive in nature, the more willing to hijack your digital transformation, and they're more willing to actually conduct intricate cybercrime conspiracies that go beyond wire [00:21:00] transfer, fraud or extortion.
Lisa Vaas: Okay, Derek, do you have anything to add to that?
Derek Booth: Yeah, definitely.
And I, I'm going to, I'm going to pivot here a little bit. Tom, you know, Tom does a great job studying these financial institutions, which are large, these large groups of companies. I'm going to change topics here for a little bit and just talk about small businesses and individuals and medium businesses as well.
And as those financial institutions are hit, these, these individuals and small businesses are hit too, because now they got to pay more fees. They got to, they, it trickles down, but also things trickle up. And when you have a small business that gets hit with a BEC attack or ransomware attack, you know, a hundred thousand dollars, isn't a whole lot to say JP Morgan chase or to Scottrade or whoever it might be, but a hundred thousand dollars is huge.
It's a huge material item for a small business or a mom and pop business or just even an individual. And, these people in these businesses are being crushed, with all kinds of scams, the scams we've already talked about, BEC [00:22:00] attacks, ransomware, but also you're, we got to go backwards a little bit to romance scams and investment scams and tech and law enforcement scams.
And, and then another big one that is not so much financially reckoning, but it is still, there's a huge financial payoff for the bad guy is sextortion. And I know this is not, this isn't the, that's not a comfortable word we like to talk about, but the stats that are coming, the repercussions that are coming from that are never ending.
The DOJ has issued multiple, multiple notices. We've had a big, we have a big ongoing case right now coming out of Idaho. The rise in teen suicide coming from this is crazy. And so I know we're talking financial institutions and, and money that way, but these things trickle down, they trickle up because this affects.
These companies, individuals, and sometimes it puts them into bankruptcy or laying off businesses or causes, you know, life changing decisions like divorce or, [00:23:00] you know, having to move the family different places. So I think the potential of some of these scams are just never ending. And most of them are, they're targeting these financial institutions because the payoff is so high.
And it makes sense, right? A bank robber wants to get in and get out because he can get a quick payoff. Some of these bad guys, they're patient. They're getting in like Tom's talking about. They're getting into doing these account takeovers and they can hang out for a little bit and then cause problems through the market.
And that's pretty brazen. And it's pretty impressive actually to watch how these guys are working. But at the same time, I don't want to forget about those little guys that are getting hit as well. So.
Lisa Vaas: Yeah, I'm so glad you brought up those suicides. As soon as you say the word sextortion, it's like I think about the tragic things that are happening to teenagers, or even younger than that, so, so acknowledging that is a great thing to do.
Thank you. Okay, so let's round this out by talking a little bit more about advice for banks [00:24:00] or any other organizations or individuals really dealing with attacks like this. Tom, you were kind enough to give advice about securing APIs. And you did mention that dynamic and static application security testing, DAST and SAST are kind of hobbling organizations.
Do you want to give out some better advice that can help?
Tom Kellermann: Yes. So from a governance perspective, I still can't believe that 41 percent of CISOs are still reporting to CIOs. Your defensive coordinator cannot be reporting to your offensive coordinator. It's high time that you elevate the CISO to a proper position at the C level and give them the corresponding authority and resources to do what needs to be done to manage your risk and protect your brand.
Secondarily, yes, I think XDR is here to stay, but detection response can't be limited to just networks and endpoints and cloud. It must be extended to applications. Behavioral anomaly detection must extend to [00:25:00] applications. So I think, you know, runtime security is an imperative to defend applications from behavioral anomalies and correspondently defend APIs from anomalies.
I think threat hunting must be expanded. It must be continuous. It should be weekly. Not monthly or not after an incident, and it should be extended to any managed service provider that provides you with significant infrastructure, cloud or capability services. Obviously, 2 factor authentication is quintessentially important, but at some point it will be hijacked.
So I do think there's a great utility in defending those environments with deception technology. Which can be used to trigger when your first line of defense fails. And then lastly, penetration testing itself shouldn't just be from the outside in, but should be from the inside out. And what I mean by that is, can you conduct attack path mapping to understand where an adversary can go within your environment?
Or to get outside of your environment, because I think the name of the game now is intrusion suppression. Can you prevent the [00:26:00] adversary from moving freely laterally in your environment? And more importantly, can you prevent them from departing your environment and stealing your crown jewels? Whether that be information,
et cetera, et cetera. So, so with that, yes Elevate your CISO, deploy XDR, but don't limit yourself. Also employ runtime security to protect your applications and APIs. Really start embracing deception technology. Expand those threat hunts and begin to think differently. Allow offense to inform your defense.
Okay, great.
Lisa Vaas: Thank you. Derek, anything to add to that?
Derek Booth: So the only thing I would add is and Tom's a perfect example of this. He, he has reached out through the community and to law enforcement and our other private partners tremendously, and he does a great job and we appreciate it. And he's a perfect example of this, but I would suggest that people reach out, reach out to their law enforcement communities, reach out to the other security.
Personnel in their communities and help each other out. I mean, this is a team game and we do need to help each other out. And also, you know, law [00:27:00] enforcement. Sometimes we have a negative stigma. We're not here to cause any problems. We're here to solve the problem and we're trying to find the, you know, find the bad actors and we are having some success.
It's tough because most of them are across, you know, the ocean and we can't get to them. But at the same time, we're not always told what's going on. A lot of people still don't trust us, don't contact us. We can only do as much as we know, and we have partnerships. We have what we call our cyber fraud task force.
I coordinate that here in the mountain West. And we have over 250 members of law enforcement, network, security personnel, community members, business owners, who they just want to just know what's going on. They want to know, Hey, how can I protect my company? How can I protect my group of people?
And then on the law enforcement side, how can we help the community, especially the state and locals? How can we help if there's a massive ransomware attack or business email compromise that shuts down a business, how can we step in and help? And so I strongly suggest to everyone out there to get involved.
mentioned when I came on the job in 99, there was one task [00:28:00] force in New York city. Tom played a part in that. And cooperated with those guys and worked with those guys for a long time. We're now up to 42 task force around the world.
And that includes London and Rome. And we also have partnerships with Europol, Interpol. We have working groups in London, South America, Australia. My old boss is in Australia now. He's been down there a couple of years. He plans on being there a couple more years. And we just, we work as a team. That's the way Secret Service has always done that.
We work in a counterpart system. We do that in protection. We do that now in investigations and it works. Because we're not, we don't have all of the answers and we're not, you know, experts in every single thing, but we try to hook up and, and team with the experts. And if we do that, if we all do that together, I think we can, we can attack a lot of these problems in a, in a more efficient way.
So. That's the only, that's the only suggestion I would say, just reach out. And there's people out there to help you. You know, we work with the FBI, we work with CISA, we work with the state OIT offices. There's, there's multiple people out there that we, that we tap into or ask for [00:29:00] help as well. And so it's, it's definitely a team game.
Great.
Lisa Vaas: Well, it shouldn't be too hard to find somebody nearby since you guys are so well dispersed all over the globe, really. So for that important tip. Well, that just about does it for today's webinar. I want to thank our guests, Tom Kellerman and Derek Booth, for taking the time to talk today. Listeners, thanks for tuning in.
To download a copy of Contrast's modern bank heist 2024 report, head to www.contrastsecurity.com/cyber-bank-heists-report.
