NEW YORK, Aug. 01, 2016 (GLOBE NEWSWIRE) -- The email hacks of the Democratic National Committee (DNC) and Hillary Clinton campaign highlight a pervasive problem with cloud-based email security, according to cloud security researchers at Avanan.
Information publicly available about the attack from bitly.com reveals that 108 email addresses in the hillaryclinton.com domain were attacked via a spear-phishing link— and that 20 users working on the campaign clicked the link to execute the attack (Source: SecureWorks).
One might assume attacking such a high-profile organization would require a sophisticated method or the exploitation of a zero-day vulnerability, but this was a basic attack. Today’s cloud-based email makes it simpler for hackers to successfully breach accounts.
“People’s false belief that cloud-based email systems are secure is what lies at the heart of this hack,” said IT security expert Gil Friedrich, Avanan’s CEO. “The reality is that this could happen to anybody. The exploit is only getting attention because of the high-profile victims.”
“Attacking cloud-based mail servers such as Gmail or Office 365 is easier today because when mail servers were in the data center and users were sitting behind firewalls, there was a stack of security layers to protect them. Today’s cloud-based email services offer basic security tools but lack the advanced anti-phishing, malware protection, web filtering and secure login that organizations have deployed in their data centers. Hackers know this and design their attacks to bypass the security of the cloud providers and get through undetected,” said Friedrich.
The Gmail user agreement makes it very clear that the security of its service is provided “as is,” in practical terms, leaving the ultimate responsibility on the customer.
“The core issue is that the IT team that put together the Google-hosted mail server for the DNC may have assumed that Google would ‘take care of them’ and did not add the critical layers of security necessary to prevent this type of common attack,” concluded Friedrich.
The problem is not unique to the DNC and Clinton team – many IT security professionals are still not sure how to secure SaaS email. It is also not unique to Google. In late June 2016, Avanan published a blog on a massive attack against Microsoft's Office 365 users that, though very different in its target and details, leveraged the same core problem – missing security layers in cloud-based Office 365.
Friedrich advises that IT security teams understand the holes in SaaS-based email and research how to best protect those services.
Avanan will demonstrate the exploit at 1 p.m. ET on Tuesday, Aug. 9 and describe preventative measures when using cloud-based email. Register here: http://www.avanan.com/webinar/gmail-dnc-attack.
About Avanan, The Cloud Security Platform (http://www.avanan.com)
Avanan secures any SaaS application, such as Office 365 and Google Mail, or any cloud application with one click, using best-of-breed security technology from industry-leading vendors. Avanan has been named a 2016 Gartner Cool Vendor, a Red Herring Top 100 North American Tech Startup and one of CRN’s 20 Coolest Cloud Security Vendors of 2016.