The IT Nerd

Darktrace, the world’s leading cyber AI company, has today announced that McLaren Racing is using Antigena Email to defend against sophisticated and targeted phishing emails.

McLaren Racing was founded by New Zealand racing driver Bruce McLaren in 1963. The team entered its first Formula 1 race in 1966, since when McLaren has won 20 Formula 1 World Championships, more than 180 Formula 1 Grand Prix, the Le Mans 24 Hours at its first attempt and the Indianapolis 500 three times.

McLaren Racing competes in the 2020 FIA Formula 1 World Championship with Lando Norris and Carlos Sainz, and the 2020 INDYCAR Series in the US with Pato O’Ward and Oliver Askew.

With the number of COVID-19-related email attacks surging over the course of the pandemic, McLaren decided to extend its AI-based security system to protect its Microsoft Office 365 system, and safeguard its workforce from malicious emails, including the team’s drivers. Darktrace’s Antigena Email solution is critical in protecting highly sensitive data including car updates that could be at risk from phishing attacks.

Powered by cyber AI, Antigena Email is currently Darktrace’s fastest-growing product area, with its ability to prevent novel and targeted malicious emails from being delivered to the user. It works by forming an evolving understanding of ‘normal activity’ for individual email users and the email environment as a whole, and detects subtle indicators of change that traditional approaches miss. McLaren already relies on Darktrace’s cyber AI technology to protect other parts of its digital infrastructure, including cloud services, data centers, and the IoT sensors on the cars.

Darktrace, the world’s leading cyber AI company, has today announced that the Vatican Library, which holds one of the oldest and most significant collections of historical texts in the world, has selected Darktrace AI to protect it against cyber-attacks.

Founded in 1451 by Nicholas V, the Vatican Library holds invaluable documents from across history including letters from ancient figures, drawings and writings from Michelangelo and Galileo and the oldest surviving copy of the Bible.

Eight years ago, the Library embarked on a project to digitize over 80,000 of these documents in order to help preserve the content for posterity, and broaden access to new audiences and academics. As a result, however, the collections have become vulnerable to cyber-attacks, and securing their digital versions is paramount. 

The Vatican Library selected Darktrace Immune System technology to protect against a range of potential attackers that pose a risk to these priceless works and writings. Powered by AI, the technology works by forming an evolving understanding of the ‘normal’ activity within the Vatican Library’s digital systems, and detects significant changes that may indicate that a cyber-threat is emerging. On average, Darktrace Cyber AI defends against 100 security incidents every month at the Library, spotting genuine threats before they escalate into crisis.

Darktrace, the world’s leading cyber AI company, today launched Version 5 of its self-learning, self-defending Darktrace Immune System, allowing security teams to meet the novel challenges presented by more dynamic ways of working. 

Darktrace was the first to use machine learning to analyze normal patterns of work, adapt on the job, and autonomously respond when changes in employees’ behaviors introduce security risks. With flexible work, Darktrace Immune System Version 5 extends protection against insider threat, data leaks, and advanced cyber-attacks beyond office walls, with lightweight client sensors and one-click integrations to provide a holistic view. 

As the C-suite balances managing employee productivity with cyber security, organizations are also accelerating digital transformation investments to support cloud-based business and customer engagement models. Darktrace Immune System Version 5 delivers security both from the cloud and for the cloud, including new Autonomous Response for SaaS applications like Microsoft365.

Digital transformation also encompasses more automation, integration, and artificial intelligence to streamline processes, extend existing investments and augment human teams. One of the most significant advancements in these areas is Darktrace Cyber AI Analyst, which mimics world-class threat analysts to prioritize, investigate and report on top threats. Investigations can now be kicked off by threats identified by people, for example the HR department, or from third-party security tools. Incidents can now also be fed into SIEMs, SOAR, or ticketing systems.

Darktrace Immune System Version 5’s numerous innovations include:

• Extended Visibility: new ‘client sensors’ extend the Enterprise Immune System’s visibility to remote and decentralized workers, on clients on or off VPN

• Autonomous Response for SaaS: Darktrace Antigena can now take action to stop emerging threats within Microsoft 365 and Zoom

• Upgrade to Cyber AI Analyst: automated threat investigations and reporting can now be produced for Cloud, SaaS and Industrial environments, triggered on-demand by humans and third-party security tools

• Dedicated SaaS Console: new, intuitive visualization of SaaS-based threats, seamlessly harmonized with other interface views

• New One-Click Integrations – easier to integrate with a range of additional third-party security tools for telemetry, SOC workflow and active Autonomous Response integrations

• Cloud-Native Delivery – Darktrace’s flexible delivery options include 100% cloud-hosted deployments, with AWS Marketplace or AWS QuickStart

School rivalry takes on a different meaning for university and college students this year, with cyber hackers advancing their methods of attack in the new normal. In the last three months alone, we’ve seen cyberattacks carried out against two of Canada’s largest universities, with both Western University and York University falling victim to a ransomware attacks.

Apparently, covering cars in shaving cream is so last century.

As the long-term shift to online learning becomes a reality, students and institutions alike will need to protect themselves when using tools such as Zoom, Slack and other platforms to complete studies online.

David Masson, Director of Enterprise Security at Darktrace had this to say about universities needing to up their game when it comes to their cyber defenses:

“Universities work in an environment based on free exchange of knowledge and national and international cooperation. Threat actors know this and will seek to exploit the relative ease of access to networks provided by the nature of universities’ transparent approaches. 

Security teams who protect universities know that attackers will look to take advantage, and so they use training methods and technology to combat imminent cyber threats. Security teams also realise how difficult it is to defend themselves; it is difficult to have full visibility of their entire digital infrastructure and additionally being able to respond quickly to impending attacks. 

In order to deal with the quantity and quality of threats, which are increasingly complex and happening at machine speed thanks to attackers’ use of AI and developments in 5G, those defending universities need to embrace AI technology themselves to augment and support their security teams to regain the advantage on the defensive side in the cyber arms race.”

Darktrace, today reported that its Cyber AI Analyst product has performed millions of threat investigations, mimicking human thought processes to zoom in on and explore potential threats, and report on the severity of an attack. Mike Beck, Global CISO at Darktrace, will be discussing these capabilities and real-world examples during a presentation at Black Hat USA on Wednesday, August 5^th at 10am PDT. 

Initially released last September following a 3-year research project at Darktrace’s AI labs in Cambridge, UK, Cyber AI Analyst trains by observing world-class security analysts performing investigations – not on examples of previous attacks. The technology questions raw security alerts, seeks out additional context, and asks questions of third-party sources to come to a conclusion. Using natural language processing, the AI Analyst reports relevant findings at the right moment to security operations personnel, in their local language.

With human security analysts spending an average of 3 hours per security investigation, scaling teams to meet the demand for fast and accurate triaging has become unviable. Today, thousands of organizations rely on Cyber AI Analyst to run investigations alongside their teams, delivering a 92% time saving.

By: Dan Fien, Director of Email Security Products for the Americas, Darktrace

In recent months, Antigena Email has seen a surge in email attacks claiming to be from file sharing site WeTransfer. These attacks attempt to deploy malware into a recipient’s device and further infiltrate an organization. 

This is a common technique deployed by attackers, who find success in masquerading behind the trusted brands of well-known SaaS vendors. Darktrace has recently seen similar attacks leveraging both QuickBooks and Microsoft Teams. 

Incident one

This email was directed at an employee in the accounts department of a leading financial services organization in the APAC region. 

Figure 1: An interactive snapshot of Antigena Email’s user interface.

The subject line of this email – “We sent you an invoice via WeTransfer” – is typical of a solicitation attack. Hidden behind a button reading ‘Get your files’ was a webpage that contained malware but displayed a login page. If a user entered their username and password in an attempt to access this ‘invoice’, the malware would harvest their credentials and send them to the attacker.

Figure 2: The fake login page, branded as Microsoft Excel, which would have likely sent the credentials to a spreadsheet controlled by the attacker.

This attack bypassed the other security tools in place, but was detected by Antigena Email due to a number of anomalies that when stitched together unmistakably reveal a threat.

Figure 3: Antigena Email’s dashboard reveals the true sender of the email.

Critical for Antigena Email’s detection of this attack was that the email contained an anomalous link. It would be highly unusual for WeTransfer to link to SharePoint – a direct competitor – in their emails. The AI also recognized that neither the employee in the accounting department, nor anyone else in the organization, had previously visited the domain in question, and deemed this email to be 100% anomalous. These details, along with other characteristics of the URL, gave Darktrace’s AI reason to tag this email with the ‘suspicious link’ tag, prompting Antigena Email to double lock the offending link and hold the message back from the recipient’s inbox.

Incident two

A second incident leveraging WeTransfer’s name was detected just a week later at a law firm in Europe. This email was more sophisticated and even more convincing, appearing to come from the legitimate WeTransfer domain. However, it still set off over a dozen Darktrace models, again prompting Antigena to lock links and hold the email back.

Figure 4: An interactive UI snapshot of the second email.

This attack went a step further. Whereas in the previous scenario the attacker simply changed the personal name, leveraging <noreply[.]com>, here the attacker manipulated the headers to make the email appear to come from the WeTransfer domain. 

Recent research that will be further unveiled at BlackHat indicates there could be as many as 18 different methods to mislead common email verification checks like Domain Keys Identified Mail (DKIM) and Domain-based Message Authentication, Reporting and Conformance (DMARC). Some of these techniques may be as simple as including two FROM lines in an email header, which may result in a mail server verifying the first FROM header while the email client displays the second FROM address. As a result, an email sent from an attacker’s mail server can be verified as coming from a legitimate address – in this case <noreply@wetransfer[.]com.

The familiarity of the apparent sender of this email is reflected in the ‘Depth’ and ‘Width’ scores below of 19 and 47 respectively, indicating moderate communication history. However, Antigena Email reveals that the true sender is from a rare domain, and one that is unrelated to WeTransfer.

Figure 6: The metrics of the second email.

Darktrace’s AI also detected two suspicious links within the email that were considered highly anomalous given previous communication between WeTransfer and the client. And importantly – the absence of a WeTransfer link!

Figure 7: Two links in the email were considered highly anomalous and threatening

These unusual links combined with the recognition of a spoofing attempt prompted Antigena Email to deem this email as 100% anomalous and intervene, protecting the recipient — and business — from harm. Despite this second email attack employing more sophisticated attack methods, allowing it to evade legacy email tools and closely resembling a legitimate email, Darktrace’s AI was able to recognize an even wider array of indicators that prompted it to hold the email back.

To learn more about Antigena Email, click here >

With the move to remote working having surged, the number of active daily users on Microsoft Teams has grown to 75 million, up from 20 million this time last year. Similar trends are being seen across Slack, Zoom, and Google Meet. With these SaaS applications becoming a staple in Canadian’s working lives, businesses should anticipate cyber-criminals to begin leveraging their household names and trusted reputation to launch email attack campaigns.

Darktrace’s AI, Antigena Email, picked up on one such attempt last month while deployed in passive mode at a multinational conglomerate – identifying 48 incoming emails that impersonated a Microsoft Teams notifications, but in fact came from an unknown sender and rare domain. The attacker was targeting employees alphabetically, seemingly working methodically through the address book.

With so much of the Canadian workforce moving to a more long-term work from home arrangement – and conference calls utilizing programs like Microsoft Teams a big part of the day-to-day – it’s imperative for businesses to safeguard themselves against threats. 

Cyber-attacks on industrial environments are on the rise. Whether caused by attacks that bleed from the IT network and spill out on to critical systems or malware that specifically targets them, cyber criminals and nation states now have the ability to cause chaos at the click of a button: halting production or even causing power outages across cities.

The potential impact of an attack on critical national infrastructure should not be understated. As smart buildings, cities and the Internet of Things become more common, vulnerabilities are growing, and state sponsored attackers are on the lookout for ways in. The lines between cyber and physical are blurring and this raises the stakes for all involved – increasing the likelihood of unintentional escalations and further complicating international relations.

The key point is that critical environments do not fail gracefully. There isn’t the option of reverting to pen and paper and muddling along. 

Now is the time to build in cyber resiliency so these systems are able to resist and fight back against cyber-attacks.

Industrial environments cannot simply be air-gapped to keep them safe and so organizations need to invest in artificial intelligence systems that can work in the background to automatically and dynamically block attacks that not only bleed from IT but originate in industrial systems.

Below are a series of industrial threat finds Darktrace AI has detected in recent weeks. These real-life threat finds are great examples of the threats facing industrial environments, as well as the vulnerability of IoT devices, and how AI is capable of stopping them in their tracks.

HACKERS TARGET AIR CONDITIONING AT US CONSTRUCTION GIANT

Like almost every other business across the globe, a US construction company transitioned to remote working.

To facilitate the transition, they protected their IT network with the usual firewalls and anti-virus software and focused on how industrial technology could continue to safely operate while employees worked from home.

What they failed to remember was that the air conditioning units back at their HQ were connected to the corporate network – so that the temperature could be automatically monitored. As attackers scanned all devices at the HQ for vulnerabilities, they noticed this air conditioning unit was left exposed and hacked into the air conditioning.

In a stroke of good timing, the company deployed Darktrace’s cyber AI – entrusting the technology to not only detect but automatically respond to cyber-attacks. Immediately, AI spotted that one air conditioning unit was acting suspiciously compared to the other 9 units and, without human intervention, stopped the hackers from pivoting into more critical industrial control systems.

CRYPTOMINING USED AS A DISTRACTION FOR ADVANCED THREAT AT SINGAPOREAN RESEARCH AGENCY

Governments around the world have issued official warnings for state hackers targeting universities and research agencies in a bid to steal information on a cure for COVID-19. 

This month, at a renowned academic institution in Singapore, AI detected and automatically stopped an academic cryptocurrency malware in the organization: likely to be a variant of Shellbot. On the face of it, this attack may not seem like one aiming to steal or halt research efforts.

However cryptomining is extremely resource-intensive for security teams. It is often a tactic used by sophisticated hackers to distract security teams from a more serious attack like subtle data exfiltration. What’s more, if AI had not stepped in at machine speed, the malware could have bled into the industrial control systems at the institution, resulting in widespread outages. This would physically interrupt production of vaccines, medicines or cutting-edge technology.

HACKERS TARGET CCTV CAMERA AT CANADIAN LOGISTICS GIANT

IoT devices, such as Internet-connected cameras, are becoming increasingly common in personal, business and industrial environments, yet threats targeting IoT are difficult to detect and often go unnoticed since these devices effortlessly connect to digital infrastructure.

In late May, Darktrace detected Mirai malware infecting an Internet-facing CCTV surveillance camera at a Canadian logistics company. Mirai is an old threat that is still used to target IoT devices.

Having analysed this device’s transfers within the context of a continuously evolving understanding of what is normal both for this device and for the wider organization, Darktrace AI spotted some unusual behaviour: the infected camera was making connections to multiple IP addresses that were statistically rare for the network. Specifically, the compromised device began transferring large amounts of data to an IP address in China.

As there were no antivirus or other security tools covering the IoT camera, without AI this would have gone undetected – the client saw no indicators of malicious activity beyond a sluggish network. Once the client was promptly notified, the compromise was deescalated, and the client took the camera offline.

As a result of the COVID-19 pandemic, Canada is paving the way in supporting brick-and-mortar businesses struggling to make ends meet through the Digital Main Street’s ShopHERE program. This program, powered by the likes of Google Canada, provides free website support and marketing tools to increase the digital presence of small businesses to sell goods and services, given the need for many businesses to take operations online.

However, as businesses scramble to move online in order to keep afloat, many small business owners overlook a major concern that could jeopardize the entire operation – safeguarding themselves from cyber threats. For some small businesses, it could be impossible to recover from a successful cyber-attack.  

David Masson, Director of Enterprise Security for Darktrace had this comment in regards to how small business owners must invest in the right technology to safeguard themselves against threats:

“The provincial and federal government’s offer to help small businesses create online stores is great news for the country. The ongoing pandemic has created a real, pressing reliance on online commerce. Moving businesses online opens up new and exciting revenue streams and can also be more efficient, particularly with customer outreach and retention.

However, there is a big concern as businesses move into the virtual realm: security. Progressing too quickly can lead to future consequences or costs, including theft of their customers’ financial details or the damaging operational downtime following a successful attack. We’ve seen time and time again that when businesses move quickly, security can often be overlooked or underemphasized. Cyber security for newly online retail businesses is very doable, but requires forethought, planning, and investment in the right technology.”