The Coming “Quiet” War

Cybercrime knows no borders. There are thousands of attacks globally every day and cyber crime costs the UK £27 billion yearly. Tero Pollanen, international expert on cyber crime and security warns that this growing threat on the UK including global networks is a serious threat to economic security. “The magnitude of this threat cannot be overstated.”

With the increasing level of sophistication of attacks from both enemy states and criminal organizations, cyber security is one of the greatest challenges of today. The alarm has been sounded by the government and it has been “quietly” suggested that the UK should in fact declare war on states and criminals that are targeting the country by employing “aggressive retaliatory strikes” hoping to destroy their operatives.

The latest attacks are now focusing on business targets.  This, of course could include core infrastructure grids which, if compromised, would bring the country to its knees. Time after time Tero has reiterated that complacency is the biggest enemy within a company. Often they do not begin to realize that they have been compromised until sensitive information falls into other hands and/or their entire network is under the control of criminals. The bottom line is that companies are not taking this threat seriously.

The government has offered new guidance in it’s “10 Steps to Cyber Security.” But again complacency raises its ugly head as a recent survey has determined that nearly 9 out of 10 UK businesses were confident that they were already adequately protected. It has been said that such confidence is a grave mistake.

Ref.: http://www.telegraph.co.uk/news/uknews/law-and-order/9522969/Hackers-could-be-running-company-computers-GCHQ-chief-warns.html

No More Fish For The Phishers

Phishing, the art of deception is about to become a bit less successful according to some of the world’s largest banking institutions.  One morning before leaving for work you quickly scan your email and spot a quick note from your trusted bank that you have been with for years.  The typical scam pitch might go like “it’s that time of year again, dear member, to update and verify some information on your account…”  You are directed to your bank’s website, provide the vitals, and you are happily on your way to the office. Later in the day, with a shopping cart full of groceries you are horrified that your account cannot cover the charges.  The reality is that you are broke.  And, that website was NOT your trusted bank’s site at all.

“This cybercrime, known as Phishing, has cost industry an estimated $2.5 billion last year alone,” states Tero Pollanen, a well known fraud prevention specialist, “it is time to rethink security strategy.”  The latest school of thought is in the utilization of new exclusive internet addresses with unique domain endings such as dot-citi, dot-barclays or dot-bofa. The banking institutions are hoping that this will increase customer awareness that they actually are dealing with their bank rather than a scam website attempting to steal personal information.

According to Icann, the organization that more or less governs the internet, these new extensions could begin to appear in 2013. In addition to security concerns they would also aid in brand promotion.  But by far the greatest need for this change would be the possible security benefits over what they cannot obtain with a dot-com presence.

Fraud will still exist with careless customers and it is the weakest link in the chain of security.  But at least the institution can create a domain that ends in their bank name which will help to generate more trust in the institution. 

The key here of course is communication between the institution and its customers that when a web address ends in a particular dot-brand, it can be trusted. 

Ref.:  http://online.wsj.com/article/SB10000872396390444508504577593243972975650.html

Not really my normal blog post but still fraud

Hey Boy, Hey Girl… 

At a time when high-level fraud is in the news more and more, the story of Gemma Barker was unusual to say the very least. The story of the teenager hit newspapers across the country this week as the case was heard in court.

According to The Telegraph and The Metro newspapers, Gemma Barker created three male alter-egos for herself, and social media profiles to match. The 20 year old from Staines dressed as a boy to trick and seduce her female school friends. Despite already knowing Barker, who was 19 at the time, the 15-16 year olds had no idea that the ‘males’ were infact a female acquaintance of theirs. Some of the girls began relationships with Barker which “incolved kissing, cuddling and groping” according to Ruby Selva in court. To reinforce the lie, she created Facebook profiles and contact details for the three male characters Aaron Lampard, Conor McCormack and Luke Jones.

The police became involved after one of the victims grew suspicious. During the investigation Barker made allegations against one of her characters “Luke Jones”, claiming she had been assaulted by him. Furthermore, according to The Telegraph, she approached the Criminal Injuries Compensation Board in a bid to cheat money.

Miss Barker  appeared at Guildford Crown Court where the case is currently being heard. The defence is reported to have told Guildford Crown Court that Barker is autistic and a "rather lonely character". She admitted to two charges of sexual assault and one of fraud fraud, making it possible for her to receive a prison sentence of up to two years. For now she is remanded on bail until early March, when she faces sentencing and psychological reports.  Summing up in court, Judge Moss reportedly said "What concerns me is that it has got a very mean and manipulative streak to it. And it's very serious. The girls she preyed on are much younger than her." Miss Barker was forced to sign the Sex Offenders Register.

Whilst this incident is unusual, it does highlight the often faceless side to the crime. The human factor in this incident, whilst traumatic, does drive home the dark, manipulative, and dishonest side to fraud. 

Cybercrime and Phishing Scams Sweeping China

A wave of cybercrime has swept across China this past week, triggering the Chinese government to mount a counter campaign. Whilst the criminals attempt to steal online banking details, the government has sought expert advice on how to combat the issue. One of the key results, is that phishing sites will now appear below those of legitimate banks in search results.

The personal details of over 45 million Chinese people (almost 10% of China’s online population) were stolen during wave of attacks. China’s Ministry of Industry and Information is investigating the crimes, and has said "The department believes the recent leak of user information is a serious infringement of the rights of internet users and threatens internet safety". The phishing scams work by impersonating a legitimate bank (or similar), and sending messages directing people to the fake sites. Once people visit the fake sites, their login details are taken, and then used by the criminals to steal money from the account.

The way in which the Chinese government fought back was to employ SEO (search engine optimisation) tactics; that is to say ensuring what results users get from searching particular terms online. The Chinese government has managed to get the 10 biggest search engines in China on board the anti-phishing campaign. Furthermore, some of the Chinese search engines are going to introduce an icon, confirming the legitimacy of a site. These two techniques combined should reduce the number of people being tricked and scammed.

Phishing scams are common globally, and are relatively easy to avoid if you follow these simple tips:

-        Beware email messages!!

Look out for emails that claim to be from companies asking you to click-through to update your details or rectify a problem with your account. If you’re unsure about the authenticity of an email, don’t open it and contact the company it claims to be from.

-        Keep an eye on your accounts

Be vigilant for any transactions you don’t recognise. Contact your bank or credit card provider to query a transaction if it looks unfamiliar. You should also contact your bank or credit card provider if your statements fail to arrive. They may have been redirected by a fraudster.

-        Avoid attachments!

Genuine banks will never send emails with attachments.

-        View an example

There is a good example of what a phishing email might look like, with annotations of things to look out for on the Lloyds TSB site.

Up to date information, tips and more can be found on online blogs such as http://fightbankfraud.blogspot.com/

No More Mr Nice Guy?

Security analysts believe the US should clarify the repercussions of cyberattacks following sustained hacks from China.  It is also believed that the Chinese attacks are carried out by as few as 12 groups directed, for the most part, by the Chinese government. During the cyberattacks, the Chinese groups have stolen billions of dollars' worth of intellectual property and information from US companies and government agencies, according to online security experts.

Thanks to advances in technologies and increasing knowledge amongst experts, more cybercriminals are being identified by their ‘digital fingerprint’. The distinguishing characteristics of each attack is monitored by US experts enabling them to link individuals to particular groups of hackers, and sometimes where they are, or who they are. These techniques have, according to US security experts, shown an intensifying pattern. This escalating issue has sparked the recent concern amongst industry experts. As James Cartwright, a retired Marine general and former vice chairman of the Joint Chiefs of Staff puts it, "If you want to attack me you can do it all you want, because I can't do anything about it. It's risk free, and you're willing to take almost any risk to come after me."

The problems the US has in confronting the issue are the same as any other country has: firstly it is very hard to prove exactly who carried out the attack, and secondly both countries must have mutual agreements on such a situation. Mr Cartwright went on to say that the US "needs to say, 'if you come after me, I'm going to find you, I'm going to do something about it.' It will be proportional, but I'm going to do something ... and if you're hiding in a third country, I'm going to tell that country you're there, if they don't stop you from doing it, I'm going to come and get you."

The question is, how should the US proceed? Due to the nature of what is being stolen, the response is pretty much unanimous from  US government campaigners: a clear and firm message must be sent to those breaking the law. Online security specialist, Tero Pollanen, agrees Cartwright that "the US needs a clear policy on dealing with cyber attacks, and the countries through which the attacks are routed. This way, when an attck is apparent, the US can request the country to stop the attack. If the request is refused, the US then has the right to stop the computer server from sending the attack. "

The problem is, he goes on, "there is no international police force. Enforcing laws in another territory is always going to be tricky to manage."

This article is by Tero Pollanen; an online security and fraud prevention specialist. For the latest online security and financial news, tips and more, check out his blog: http://tero-pollanen.blogspot.com/

Sister Blogs

Hello All and happy Friday.

I have created two sister sites
http://fightbankfraud.blogspot.com/ to promote awareness of fighting and preventing bank fraud
http://fightcardfraud.blogspot.com/ to promote awareness of fighting and preventing card fraud

I hope you will find the blogs useful and feel free to send me questions or suggestions.

Kind Regards,
Tero Pollanen