The Coming “Quiet” War

Cybercrime knows no borders. There are thousands of attacks globally every day and cyber crime costs the UK £27 billion yearly. Tero Pollanen, international expert on cyber crime and security warns that this growing threat on the UK including global networks is a serious threat to economic security. “The magnitude of this threat cannot be overstated.”

With the increasing level of sophistication of attacks from both enemy states and criminal organizations, cyber security is one of the greatest challenges of today. The alarm has been sounded by the government and it has been “quietly” suggested that the UK should in fact declare war on states and criminals that are targeting the country by employing “aggressive retaliatory strikes” hoping to destroy their operatives.

The latest attacks are now focusing on business targets.  This, of course could include core infrastructure grids which, if compromised, would bring the country to its knees. Time after time Tero has reiterated that complacency is the biggest enemy within a company. Often they do not begin to realize that they have been compromised until sensitive information falls into other hands and/or their entire network is under the control of criminals. The bottom line is that companies are not taking this threat seriously.

The government has offered new guidance in it’s “10 Steps to Cyber Security.” But again complacency raises its ugly head as a recent survey has determined that nearly 9 out of 10 UK businesses were confident that they were already adequately protected. It has been said that such confidence is a grave mistake.

Ref.: http://www.telegraph.co.uk/news/uknews/law-and-order/9522969/Hackers-could-be-running-company-computers-GCHQ-chief-warns.html

Is Your Data Secure?

New information revealed under the Freedom of Information Act shows alarming statistics concerning data breaches in the UK. According to the Information Commissioner’sOffice, data breaches have increased by a factor of ten in the last five years. The good news, however, is that organizations are reporting many more breaches than before.

Tero Pollanen, international fraud prevention specialist has stated time after time the importance of both awareness and stepped up government participation are the keys to turning the tide against cyber crimes. The word is getting out as the ICO’s numbers demonstrate that awareness of the legal requirements on companies to secure information and large fines on companies that “lose” information is precipitating positive change. The telecom sector has actually seen a decrease in the number of information breaches in the past five years.

The ICO provides a wealth of information and guidance across the UK. It should be noted the both health service and government sectors are expected to report serious breaches which involve large volumes of personal data and/or sensitive materials. Again, Tero Pollanen reminds us both to be aware and encourages additional sectors to work with the ICO in reducing the number of data breaches.

Ref.: http://www.bbc.co.uk/news/technology-19424197

No More Fish For The Phishers

Phishing, the art of deception is about to become a bit less successful according to some of the world’s largest banking institutions.  One morning before leaving for work you quickly scan your email and spot a quick note from your trusted bank that you have been with for years.  The typical scam pitch might go like “it’s that time of year again, dear member, to update and verify some information on your account…”  You are directed to your bank’s website, provide the vitals, and you are happily on your way to the office. Later in the day, with a shopping cart full of groceries you are horrified that your account cannot cover the charges.  The reality is that you are broke.  And, that website was NOT your trusted bank’s site at all.

“This cybercrime, known as Phishing, has cost industry an estimated $2.5 billion last year alone,” states Tero Pollanen, a well known fraud prevention specialist, “it is time to rethink security strategy.”  The latest school of thought is in the utilization of new exclusive internet addresses with unique domain endings such as dot-citi, dot-barclays or dot-bofa. The banking institutions are hoping that this will increase customer awareness that they actually are dealing with their bank rather than a scam website attempting to steal personal information.

According to Icann, the organization that more or less governs the internet, these new extensions could begin to appear in 2013. In addition to security concerns they would also aid in brand promotion.  But by far the greatest need for this change would be the possible security benefits over what they cannot obtain with a dot-com presence.

Fraud will still exist with careless customers and it is the weakest link in the chain of security.  But at least the institution can create a domain that ends in their bank name which will help to generate more trust in the institution. 

The key here of course is communication between the institution and its customers that when a web address ends in a particular dot-brand, it can be trusted. 

Ref.:  http://online.wsj.com/article/SB10000872396390444508504577593243972975650.html

Tag Team: Father & Son Scam

“Just when we thought we had seen it all, says Tero Pollanen, a well known fraud specialist, we see yet another major institution fall victim.” With all the chatter about the major world banks, now it’s Western Union and a money transferring scam involving a father and son team.  Here we have 2 people, illegal immigrants facing deportation from the UK. The father was bankrupt several years ago and yet became an agent for a Western Union transferring company after “various checks had been carried out”. Apparently these checks were not quite thorough.

The business they set up offered unsustainable transfer rates and was marketed to their own people in India and Pakistan. “..the money transfer service had quickly gone wrong because they were offering such good exchange rates that they made no profit.” 

More than 20 customers over a three month period were defrauded as they used this service which offered “excellent rates on transactions.” The judge that eventually tried the case “described their offenses against their own Asian community as ‘despicable’”. Both men knew they were facing deportation to Pakistan; the elder being fearful of returning there because he received better health services in the UK. Apparently despite his status, he had been receiving free medication.

It seems there is no limit to the depth to which people will sink in these most desperate times. Everyone must be vigilant.

Ref.: http://www.dailymail.co.uk/news/article-2187830/Western-Union-money-transfer-scam-Illegal-immigrant-father-son-defrauded-50-000.html?ITO=1490

And The Beat Goes On…

“You never know whom, from where, or what will occur but there is a war going on out there,” says Tero Pollanen, a well-known cyber crime and fraud prevention specialist. The scam of the day comes to you from Bhubaneswar, India where we read of a graduate engineer being arrested for hacking a victim’s credit card and going on a spending spree over the last several months. Over a three month period, he defrauded the victim of nearly £1100

on internet adult sites alone, in addition to purchasing a cell phone and other assorted electronics.

An ongoing investigation is in progress to see it the arrested was simply acting independently or if he is part of an organized crime group. It is sad that here we witness a bright mind whom we would expect to trust and aid in the prevention of such affairs, rather falls into temptation and thus violates our trust.

Ref.: http://www.ndtv.com/article/cities/engineer-held-for-credit-card-fraud-251903

Olympic Size Scam Observed

Bigger, faster, and automated.  We’ve come a long way since Mario Puzo…

Organized crime sophistication we are talking about. “In the latest reincarnation,” Mr. Pollanen, a well respected international financial anti fraud specialist asserts, “we find a banking fraud ring attempting a £2billion heist from large account holdings all over the globe.” These automated attacks move extremely rapidly and yes, cloud based services are becoming more popular by these hi-tech fraudsters. They are so sophisticated that they have developed methods of bypassing chip and pin authentication.

Due to the magnitude and adeptness of this Olympic-Sized threat with alleged organized crime signatures, warnings are being issued for the upcoming Olympic games. Wherever crowds assemble for large scale media and/or sporting events, these modern day pickpockets will gravitate. We will see new phishing scams mushrooming and all should take caution in using WiFi spots that possibly could be intercepted.

“It is very important to be aware of one’s surroundings whether in a business environment, in public, or at home,” according to Mr. Pollanen.  Crime sophistication is on the rise and as we mentioned in a previous blog, new methods of strict, punitive law enforcement efforts must be developed and implemented. 

Further reading: http://www.itpro.co.uk/641386/mcafee-uncovers-europe-wide-bank-fraud-scam

When Cyberbullying Becomes Cyberstalking

Cyberbullying stories are popping up in the news more and more. An incredibly diverse range of people have fallen victim to the intimiation and life destroying intrusion.

Unfortunately I was one of those targetted.

In an attempt to find some form of a positive outcome of this horrific situation, I wanted to share my research and a small insight to my experience.

What is cyberbullying, stalking  and online harassment?

The definition of online harassment varies according to who is involved. Generally, when the victim and the perpetrtor are both children, the harassment is termed cyberbullying as detailed by Stop Cyberbullying. Whilst the actions are the same, once both parties are adult, the term, according to Wikipedia, changes to cyberstalking or cyberharassment.

Wikipedia defines cyberstalking as “the use of the Internet or other electronic means to stalk or harass an individual, a group of individuals, or an organization. It may include false accusations, monitoring, making threats, identity theft, damage to data or equipment, the solicitation of minors for sex, or gathering information in order to harass. Cyberstalking is different from spatial or offline stalking in that it occurs through the use of electronic communications technology such as the internet. However, it sometimes leads to it, or is accompanied by it. A cyberstalker may be an online stranger or a person whom the target knows.

“Cyberstalking may include false accusations, monitoring, making threats, identity theft, damage to data or equipment, the solicitation of minors for sex, or gathering information in order to harass. A repeated pattern of such actions and harassment against a target by an adult constitutes cyberstalking”.

Methods Used

Wired Safety put together a powerpoint presentation about a study in to cyberstalking and its findings. They identified the methods used in cyberstalking as:

• ¨     E-mail and instant messaging direct threats
• ¨     Identity theft
• ¨     Building websites targeting the victim
• ¨     Posting false profiles
• ¨     Hacking
• ¨     Posting fake sex ads
• ¨     Pasting the victim’s image onto a pornographic image or posting real sexual images of the victim online
• ¨     Provoking attacks against the victim by others
• ¨     Posing as the victim and attacking others
• ¨     Contacting victim’s family or employer
• ¨     Posting in a newsgroup or on a bulletin board, online
• ¨     Following the victim from site to site

My experience

After much research online, I’ve learnt that my particular experience is most likely defined as Corporate Cyberstalking. Wikipedia’s definition of which is: “when a company harasses an individual online, or an individual or group of individuals harasses an organization. Motives for corporate cyberstalking are ideological, or include a desire for financial gain or revenge”.

Paul Bocij – an expert in the field, goes in to much greater detail. His comprehensive work in this particular field has lead to the table below; a proposed typology of corporate cyberstalking.

Table 1: A proposed typology of corporate cyberstalking incidents

Stalker/Victim	Category Name	Description
Individual/Organisation	Vengeful	The individual wishes to exact some form of revenge against the organisation e.g. cyber-smearing.
Individual /Organisation	Individual Gain	The individual is seeking some form of benefit e.g. financial gain obtained via stock fraud.
Individual/Organisation	Ideological	The individual acts in support of beliefs e.g. cyberterrorism and hacktivism.
Organisation/Individual	Unwitting	The organisation is unaware of the actions of an employee and is an unknowing accomplice.
Organisation/Individual	For Profit	The organisation seeks to realise some form of (business) benefit by its actions, e.g. silencing critics using SLAPP. The victim is normally an individual.
Organisation/Individual	Competitive	The organisation seeks to improve its competitive position. The victim is another organisation.

Table copyright of Paul Bocij http://pear.accc.uic.edu/htbin/cgiwrap/bin/ojs/index.php/fm/article/view/1002/923

Mr Bocij explains; “The coloured part of the table represents categories of corporate cyberstalking where an organisation becomes a victim. Category names have been used as a simple way of identifying and describing a given category. These names also help to make clear the differences between categories”.

Mr Bocij goes on to detail each scenario with an actual case.

What laws exist?

Laws change from country to country. My knowledge is based around English laws, so this is what I refer to. As explained by the law firm Pinsent Masons in their article on Defamation; “Any disparaging statement made by one person about another, which is communicated or ‘published,’ may well be a defamatory statement and can give rise to an action for either libel or slander in English law”.

Cyberstalking is a criminal offense in the United Kingdom under the Malicious Communications Act  of 1998.

What needs to change?

Whatever term you chose to use; cyberstalking, cyberbullying, electronic/online harassment, it NEEDS TO STOP NOW. The fact that it happens through a particular media rather than face-to-face does not change the affect it has on an individual, nor should the laws be any different.

What should I do?

If you believe you have fallen victim to Cyberstalking of any description, the advice remains the same. As suggested by The Guardian; “gather evidence including times and means of stalking. Save any texts, emails, Facebook messages, screenshots. You should then assist police AND report to the network provider/ISP/Facebook. The service providers may not be able or willing to help, but you must log the complaint”.

Convicted Criminal? Maybe he can help

As unemployment rises, and competition for jobs gets increasingly stiffer, companies are often spoilt for choice with the creme-de-la-creme of potential employees. With an average of over 30 applicants for each position in London, many businesses are able to appoint higher caliber candidates than ever before.

Many firms are employing individuals capable of innovation and ‘thinking outside the box’ through purposefully hiring convicted criminals. Whilst on first consideration this may appear an odd choice, it appears to be producing the desired results. Some of the more high profile appointments are rumoured to include George Hotz, a hacker hired (reportedly) by facebook. Whilst not officially a convicted criminal, the youngster has settled a previous case out of court.

Many of the biggest names in technology are reputed to have hired hackers in the past too. Whilst few employers would openly admit to it, it is commonly believed that Apple, Microsoft, and Google have done so. Security firms and government agencies such as GCHQ in the UK even entice applicants by setting challenges for wannabe applicants to solve.

Whilst hiring, or even associating with hired hackers and convicted criminals is a risk for and company, it is a calculated risk considered by many to pay off. Not only will it create a certain amount of ‘buzz’ online, if the incentives are deemed sufficient by the individual, they may choose to invest in the company. Being able to manipulate the latest technology to a firms advantage, as well as the ability to see the bigger picture and truly improve and redesign the world in which we live is a genuinely exciting prospect.

In truth, employment in any context becomes a question of risk; how much a firm is content on risking, and how much an employee is prepared to risk in favour of, or indeed against, that position of trust.

Tero Pollanen is a online security specialist with years of experience on advising organisations on online fraud and security, he has experience from both sides of the security world.

Not really my normal blog post but still fraud

Hey Boy, Hey Girl… 

At a time when high-level fraud is in the news more and more, the story of Gemma Barker was unusual to say the very least. The story of the teenager hit newspapers across the country this week as the case was heard in court.

According to The Telegraph and The Metro newspapers, Gemma Barker created three male alter-egos for herself, and social media profiles to match. The 20 year old from Staines dressed as a boy to trick and seduce her female school friends. Despite already knowing Barker, who was 19 at the time, the 15-16 year olds had no idea that the ‘males’ were infact a female acquaintance of theirs. Some of the girls began relationships with Barker which “incolved kissing, cuddling and groping” according to Ruby Selva in court. To reinforce the lie, she created Facebook profiles and contact details for the three male characters Aaron Lampard, Conor McCormack and Luke Jones.

The police became involved after one of the victims grew suspicious. During the investigation Barker made allegations against one of her characters “Luke Jones”, claiming she had been assaulted by him. Furthermore, according to The Telegraph, she approached the Criminal Injuries Compensation Board in a bid to cheat money.

Miss Barker  appeared at Guildford Crown Court where the case is currently being heard. The defence is reported to have told Guildford Crown Court that Barker is autistic and a "rather lonely character". She admitted to two charges of sexual assault and one of fraud fraud, making it possible for her to receive a prison sentence of up to two years. For now she is remanded on bail until early March, when she faces sentencing and psychological reports.  Summing up in court, Judge Moss reportedly said "What concerns me is that it has got a very mean and manipulative streak to it. And it's very serious. The girls she preyed on are much younger than her." Miss Barker was forced to sign the Sex Offenders Register.

Whilst this incident is unusual, it does highlight the often faceless side to the crime. The human factor in this incident, whilst traumatic, does drive home the dark, manipulative, and dishonest side to fraud.