Social Engineering Leads to Wire Fraud at Ubiquiti Networks

Ubiquiti Networks is a wireless technology provider and recently it also became the target of a $46.7 million business email compromise scheme; also called a masquerading attack.

In this case, criminals pretended to be C-Level executives and sent email messages to employees who have authorization to execute wire transfers from the corporate accounts. In an August 6 filing with the Securities and Exchange Commission (SEC), Ubiquiti wrote that this compromise “involved employee impersonation and fraudulent requests from an outside entity targeting the company’s finance department.” The scheme was detected June 5, but millions of funds had already been transferred to overseas accounts.

This is not a new strategy for hackers and it is surprisingly easy to do. It involves very little technology because they take advantage of people. Account takeovers such as this have evolved over time from mass email customer takeovers such as those involving PayPal, eBay, and Facebook, to being highly technical more recently with man-in-the-browser Trojans like Zeus. Zeus is one of those attacks that specifically tries to get to banking credentials. Others in that family include Carberp, Zeus Gameover, and Shylock.

Now, no malware is needed. It’s just spoofing email accounts to make them appear they come from someone else. Often, the email will portray a sense of urgency, secrecy, or otherwise in an effort to get the employee to bypass standard protocols such as in–person or phone call confirmations.

Avoiding this is not difficult, but does require that a process be followed. Just create one for executing wire transfers that includes explicit guidelines that must be followed. If they are followed, many attacks like this can be avoided. Include items such as:

• Use code words, call backs, and corporate resolutions that authorize only certain employees who can send payment orders;
• Require dual authorization and separation of duties to complete wire transactions.
• Maintain data on transfers made each day, including the wires sent and received and to whom;
• Independently review all wire transfers each day;
• Educate employees about corporate account takeovers, phishing, and email spoofing, and keep up continuous education regarding information security;
• Train employees on the wire transfer procedures and enforce them.

Total losses to Ubiquiti in this are expected to exceed $1 Billion including recovery and investigative costs. The company has been able to recover $8.1 million and expects to get back another $6.8 million when all is said and done. That leaves $31.8 million lost completely. Ubiquiti is cooperating with U.S. Federal and overseas law enforcement, which are actively investigating.