Securing Real Estate Transactions through Threat Intelligence
•Download as PPTX, PDF•
0 likes•282 views
This document summarizes a presentation about securing real estate transactions through threat intelligence. It notes that there were over 2 billion compromised records in data breaches in 2016. The real estate industry is being targeted by cybercriminals using business email compromise, phishing, and money laundering techniques. The presentation recommends key actions companies can take this week, quarter, and year to improve security through employee education, strong authentication, creating a threat intelligence program, and actively hunting for cyber threats.
Recommended
Recommended
More Related Content
What's hot
What's hot (19)
Viewers also liked
Viewers also liked (20)
Similar to Securing Real Estate Transactions through Threat Intelligence
Similar to Securing Real Estate Transactions through Threat Intelligence (20)
More from Inman News
More from Inman News (20)
Recently uploaded
Recently uploaded (20)
Securing Real Estate Transactions through Threat Intelligence
- 1. Inman Connect: Securing Real Estate Transactions through Threat Intelligence Thomas Kinsella Senior Manager, Cyber Intelligence & Investigations
- 2. 2 2,260 confirmed data breaches in 2016 2.2 Billion compromised records The forecasted average loss for a breach of 1,000 records is between $52,000 and $87,000 Customers, especially businesses, are using security as a discriminator The Real Estate Industry is a target! Why Are You Here? Why Am I Here?
- 3. Real Estate?
- 4. 4
- 6. 6 Future Business Email Compromise (BEC) Ecosystem BEC Infrastructure Phishing Interception Mule Management Money Transfer Malware Mule Pickups Exchange (e.g. BTC) Laundering Escrow Services WFH Recruitment Communication Cashout Services Target Email List Send Phish Check Phished Creds Detect Transactions Phishing Pages New Domains Hacked Websites Bulletproof Hosts Create Inbox Rules Design Invoices Communicate w/ Buyers & Sellers Design Exploit Kit Coding Injections Crypting Services AV Checking
- 8. 8
- 9. Key Actions!
- 10. 10 Key Actions! This Week: Network – Leverage industry knowledge to find out what companies are doing about this issue This Quarter: Educate – Train staff to detect and report phishing and social engineering attempts Use Strong Authentication – Utilize 2-Factor Authentication, Password Managers; monitor for corporate emails in third-party data breaches This Year: Create Threat Intelligence – Create a program to receive (and share) known Indicators of Compromise (IOCs) Hunt – Begin actively searching for known tactics, techniques and procedures in your environment
- 11. Questions
- 12. Thank you
Editor's Notes
- Opening Joke I’m Thomas Kinsella, I’m here to talk about Security.
- 2,260 reported in the Verizon Data Breach Investigation Report. 2.2 bn per haveibeenpwned. if you’ve been following the news over the last twelve months you cannot have escaped cybercrime headlines. From the DNC hack dominating the American election and headlines since, to San Francisco BART, DDoS Attacks taking down the internet, to the largest Data Breaches in history at LinkedIn, Yahoo, MySpace etc. to 80 million dollars stolen from a Bangladeshi bank… And the real estate industry has been targeted too. Fraudsters are after the money involved in real estate transactions – buyer’s deposits, rent deposits, balance transfers.The FTC, FBI have issued warnings about attacks specifically targeting the Real Estate industry, and it’s been covered in NYT, WSJ, FT, USA Today, CNN, MSNBC etc. There are lots of ways to attack of course – malware, DDoS, ransomware, and what I’m going to be talking to you about today is one of the ways you can keep yourself safe – by sharing information with each other about these attacks.
- This is what a sample of what a phishing email looks like, I’m using a DocuSign phishing email, but there are lots of brands impersonated. You can see the “Review Document” link actually brings you to a different site – gaanano1.com, and not DocuSign.net. It was also sent from “senacaprop.com”. And is very clearly about a real estate transaction. And this is an example of a phishing page – note that not all DocuSign phishing messages bring you to a DocuSign themed phishing page! If you received this message, I’d hope you’d notice it was fake, however because it was just created, there’s very little you can do to protect yourself or your employees proactively against it. That’s why later on I’m going to be talking about Threat Intelligence – information in near real-time about these phishing pages.
- Once a fraudster has compromised an email account of a real estate agent they’ll perform this switch. The money is what they are after. They’ll impersonate the real estate agent and send an email to the buyer with different instructions. So, for example, if they’re supposed to send the money to an attorney’s Bank of America account, they’ll actually get them to wire the money to a Citibank under their control. Immediately after the money is transferred they’ll transfer it to another account outside the country, and then another account outside the country. The buyer will almost always not know about it until it’s too late. Once the fraudsters are in your email, stopping the scam is very difficult, however reporting to law enforcement and your bank immediately may mean the victims will get some of the money back. FBI Warns of Dramatic Increase in Business E-Mail Compromise Scams - https://www.fbi.gov/contact-us/field-offices/boston/news/press-releases/fbi-warns-of-dramatic-increase-in-business-e-mail-compromise-scams
- Already in real estate this is no longer one person in a bedroom or in an internet café in Nigeria. It’s not, and it’s only going to get more sophisticated. The above image shows the general cybercrime infrastructure for a banking trojan - it’s sophisticated, but so are the people targeting Real Estate. For just one victim you need someone to create a phishing email, create a phishing page, generate a list of targets, check the emails that were phished. That’s not all the same person. You need a bank account, and usually that’s a money mule recruited from a work from home scam, so you need someone creating the WFH accounts, talking to mules, managing their recruitment. You then need a network of other bank accounts across the world, and a way to launder the money at home. This is a serious crime. And with hundreds of thousands at stake from each victim it’s no wonder groups are now professional.
- So how can you stop this – by helping each other using Threat Intelligence. What is threat intelligence? It’s timely and actionable information about threats and it usually comes in the form of what’s known as indicators of compromse – md5s, urls, ips, domains. An example of a really good indicator of compromise, an excellent piece of threat intelligence, would be a phishing email your organization received earlier today. Today if one of your employees received an email with a link to realestate_login.com, that’s an incredibly useful piece of intelligence. Why? Because it’s a) definitely bad B) actionable and c) timely. What would you do? You’d ask the employee if they clicked it! And if they had, you’d change their password. Then you’d check if someone else in your organisation received it. And then you’d check if someone else clicked it. You might even check if someone else visited the same IP address through your logs. Now threat intelligence can come in many forms. You can get threat intelligence in the form of TOR exit node IP addresses. That’s useful… in some circumstances. If you want to find if someone is using Tor on a computer, for example. It’s not useful for detecting, e.g. a Russian government spy ring in your network. Another example of that would be a phish hosted on dropbox.com – yes, that’s very useful intelligence if you’re searching for URLs, but it’s reallynot useful if you’re searching for domains… and that matters. Sharing Threat Intelligence is what I want to promote here today.
- Facebook Threat Exchange is an example of a threat intelligence program – 250 customers have signed up, it’s incredibly easy, and you’ll instantly start being able to receive, or search for, other “indicators of compromise”. DocuSign share inidicators of compromise with everyone else using this platform. Every single time we receive a phishing message reported to spam@docusign.com we analyze the page, and if we detect it as malicious we’ll share it with Facebook Threat Exchange – and with you, the wider industry. We’ll also send it for takedown, and share it with Google Safe Browsing, Microsoft, AntiVirus companies etc. What this means is that if someone from Century 21 receives a phishing message and reports it to spam@docusign.com, within a short period of time, usually below 30 minutes, we can confirm that it’s malicious, and as soon as we have we’ll share that information with anyone in Facebook Threat Exchange. You can then use that information to scan your own logs to see if anyone clicked the link. If you received a phishing message and you know it’s malicious, we’d encourage you to share your information too – then you can keep your peers, all your colleagues in this room, safe too. Similarly with malware targeting DocuSign users, we send the hash to Threat Exchange. This also works, obviously, even if you’re not a real estate agent – if you develop websites, offer a system to communicate between sellers and buyers. If you list properties. Obviously the ones we’re seeing are pretty specific, but it’s effective. If you’re marketing products then every single one of your customers is going to be targeted, maybe using your brand. If you use Carbon Black as your endpoint protection, for example, you may even be getting alerts already from us! If you think DocuSign information is useful you can just receive ours, or else you can opt to receive information from Facebook, DropBox, Yahoo, Tumblr, Pinterest and hundreds of other companies. Not only that, you should be alerting users as soon as you detect this. Furthermore, you should be telling people if they log in from their phone in New York and 15 mintues later in Seattle, asking them what’s going on!
- Haveibeenpwned.com
- Announcing