Cyber Defense eMagazine December Edition for 2021

ATO Detection
Account takeover benefits from the account’s credibility and history with their own company and external
organizations that they do business with. A fraudster who has access to an account can cause
tremendous damage.
Why is this difficult to detect?
• With ATO, the email is coming straight from the vendor’s IP and the actual sender’s mailbox.
• The attacker will read the email communications, and wait for the perfect time to inject a message
for fund transfer. He will usually reply back with a signature that’s identical to the vendor’s and
will ask for you to transfer money to other bank accounts.
Blacklisting email security vendor IP addresses
Hackers blacklist email security vendors’ IP addresses. They create phishing websites, being aware that
their target is highly fortified, and they assume email security solutions will scan their website before it
will reach the end user.
Why is this difficult to detect?
By fingerprinting the different email security solutions, a hacker can understand what the IP addresses
are of the email security provider services. Once fingerprinted, they can easily blacklist that IP.
Recommendations
1) When selecting an email security solution, an organization should consider a service that identifies
all threats before they arrive in a user’s inbox. The ideal solution should provide various detection
layers to identify advanced phishing attacks as well as ATO, malware, 0-days and more.
Look for services that:
• Dynamically scan 100% of emails and their embedded content before they arrive to the user’s
inbox without affecting user experience
• Use technology to deterministically provide verdicts on malware and not rely on behavioral
analysis
• Leverage image analysis Image recognition of URLs
• Can detect account takeover detection
Cyber Defense eMagazine – December 2021 Edition 117
Copyright © 2021, Cyber Defense Magazine. All rights reserved worldwide.