Pages

Ads 468x60px

Featured Posts

Sunday, July 6, 2014

An Abney Associates Fraud Awareness Program: Cyber-Attacks Seen Defrauding Brazilian Payment System of Billions


Cyber- criminals have abused the Boleto Bancário online payment system to steal potentially billions of dollars, according to security firm RSA.

Cyber-Criminals have infected nearly 200,000 computers in Brazil and used their access to issue payment vouchers with an estimated value of $3.75 billion, according to an analysis of the attack published by security firm RSA on July 1.

Dubbed the "Bolware" gang, the criminals abuse the Brazilian payment system known as Boleto Bancário, which allows customers to promise to pay an online merchant, print out a payment slip with a barcode and remit money at a bank. While previous attempts to defraud the payment system used fake boleto, the latest attack, which started in late 2012, infects Web browsers on compromised computers and modifies legitimate boleto to route payment to the criminal accounts.

"The Boleto Malware (is) a newer and more sophisticated kind of fraud in Brazil that leverages MITB (man-in-the-browser) technology to attack online operations, and is based on transaction modification on the client side," RSA stated in its analysis. "Like any substantial cyber-criminal operation, the Bolware gang has continued to innovate, revising their purpose-built malware through 19 different versions.

While the details of the fraud differ from payment fraud in other nations, the techniques—such as using a man-in-the-browser attacks—are similar to how criminals are attempting to steal money from financial institutions in the U.S. and Europe. Criminals adopted man-in-the-browser attacks to defeat additional countermeasures—such as IP address and device identification—deployed by financial institutions.

"It is a class of problem where the arms race has migrated," Dan Kaminsky, co-founder and chief scientist of White Ops, an anti-fraud technology firm. "Once upon time, it was good enough to steal a customer's username and password and log into the bank from wherever and do whatever you wanted, but they soon figured out that a California customer should not be logging in from Latvia."

While banks in Brazil and other nations continue to fight against payment fraud, such attacks expose weaknesses and undermine trust in the financial ecosystem in most countries. Because customer-owned computers are generally thought to work on behalf of the user, banks typically argue that any fraud that originates from compromised customer systems are the responsibility of the victims. Such fraud rose more than 200 percent in the first nine months of 2013, according to Symantec.

Small U.S. businesses, for example, have lost hundreds of thousands of dollars to such attacks and sued their banks for allowing funds to be transferred to foreign nations, even though it was the business's machine that was compromised. Courts have generally split on whether the business is responsible for the lost money, or if banks should catch anomalous transactions and perform extra security measures.

A similar scam, where the attacker changed the banking information to which publisher Conde Nast sent funds, resulted in $8 million being transferred in six weeks, but the money was frozen before attackers could transfer it to their own bank accounts

While the Brazilian crime network is not large compared to other botnets, the potential profits for its operators are huge, according to RSA.

"Boleto malware is a major fraud operation and a serious cyber-crime threat to banks, merchants and banking customers in Brazil," the company stated. "While the Bolware fraud ring may not be as far-reaching as some larger international cybercrime operations, it does appear to be an extremely lucrative venture for its masterminds."

Monday, June 30, 2014

An Abney Associates Fraud Awareness Program: The resurgence of data-entry phishing attacks



‘Old school’ email social engineering or data-entry phishing is an attack method that has been on the rise in recent months, notably employed by the Syrian Electronic Army to hack seemingly every major media outlet in the Western hemisphere.

Data-Entry phishing emails lure employees into freely giving up their login credentials by taking them to a seemingly legitimate landing page. Attackers then use the credentials to establish a foothold in the network.

When spear phishing, data-entry style emails contain a link that takes the recipient to a webpage that appears to be a genuine corporate or commercial site soliciting login information.

Despite their pervasiveness and high-success rate, data-entry attacks seeking login credentials and other sensitive information have been a secondary concern for enterprises.

Information security teams have been more concerned with phishing emails that attempt to carry out drive-by attacks through a malicious link or malware delivery via an attachment.

Since data-entry phishing attacks don’t require malware, it’s quite possible to fall victim to this technique and never even realise it. Victims will often enter their information and not recognize something is wrong. Without the presence of malware, these attacks often go undetected by technical solutions.

However, this doesn’t mean the consequences are any less severe. 

Once attackers gain legitimate credentials into the network, their activity is difficult to detect. Using these credentials they can often exfiltrate significant amounts of information from overly permissive file shares, search for other devices with weak or default credentials, and possibly escalate privileges to dump entire username/password databases that can continue to grant future access.

This activity may have the appearance of an insider threat, so breaches caused by data-entry phishing are often attributed to this source. Is it really an inside job if they gained access through a spear phish?

From an attacker’s perspective, what is easier: researching social media to craft a spear phishing email, or recruiting an actual insider within the organisation?

Some experts in the security industry have identified two-factor authentication as a way to mitigate this threat; however, two-factor authentication will not prevent phishing. While two-factor authentication makes it more difficult to phish an account, it will not prevent this type of attack from being successful.

If a user is tricked into revealing login credentials to a false landing page, two-factor authentication will only limit the time the hacker has access to the account. Attackers would need to collect the second factor of authentication, but the underlying tactics would remain the same.

Even if two-factor authentication could prevent phishing, for large enterprises implementing the solution across the board is often cost prohibitive and a logistical nightmare. This isn’t to say that two-factor authentication doesn’t improve security, but it isn’t a panacea.

The same goes for technologies and services that take down phishing websites. At best, these technologies offer lead times of four to eight hours to take down phishing sites. It can often take longer, particularly if the site’s domain is in an unfriendly country or if the site is hosted using a subdomain on a large provider. Continue reading…

Sunday, June 29, 2014

An Abney Associates Fraud Awareness Program: Identity fraud is on the increase




Recent statistics by the Southern African Fraud Prevention Service (SAFPS) reveal that identity fraud is on the increase.

Based on the year-to-date figure, 1 370 cases had been reported to the SAFPS as at the end of April. 

Experts warn that the figure could be the tip of the iceberg as the statistics only indicate the cases that have been recorded.

There was a 16% increase in fraud from a total of 3327 cases in 2012 to a total of 3873 cases in 2013. 

The crime cost the local economy a whopping R1bneach year. It is estimated that the number of incidents could exceed the 4000 mark by the end of 2014.

Frank Lenisa, director of credit bureau Compuscan, said they had been keeping a close watch on the situation and was endeavouring to educate consumers and assist them in preventing the negative impact that fraud can have on their credit reports.

“It’s concerning to see that there is an increase in identity fraud.

What worries us even more is that consumers are often unaware that they have fallen victim to such a crime and this could have a severe negative knock-on effect in their ability to obtain credit in future,” said Lenisa

Lenisa also said it was important for credit-active consumers to keep a close eye on account activity in their name to prevent and recover from identity fraud.

“This is one of the steps that can be taken to protect the health of their credit records.

Credit-active consumers can safeguard themselves by obtaining a copy of their credit reports as regularly as possible and carefully examining every piece of information. 

It is recommended that this is done once a month,” he said

He added that consumers should carefully examine their statements, keep their passwords and identity numbers secure and shred receipts and statements before discarding them.

“It must also be stressed that personal information should never be given over the phone and the authenticity of websites should be checked before entering any personal information,” said

According to the latest National Credit Regulator Credit Bureau Monitor, there were 20.

64 million credit-active consumers in South Africa as at the end of December last year and each one of these consumers are urged to pay close attention to the threat of fraudulent activity that could affect their credit records.


Credit-active consumers can safeguard themselves by obtaining a copy of their credit reports as regularly as possible and carefully examining every piece of information.

Friday, June 27, 2014

An Abney Associates Fraud Awareness Program: Little reform since Snowden spilled the beans

LONDON – A year has passed since the American former intelligence contractor Edward J. Snowden began revealing the massive scope of Internet surveillance by the U.S. National Security Agency.

His disclosures have elicited public outrage and sharp rebukes from close U.S. allies like Germany, upending rosy assumptions about how free and secure the Internet and telecommunications networks really are.

Single-handedly Snowden has changed how people regard their phones, tablets and laptops, and sparked a public debate about the protection of personal data.

What his revelations have not done is bring about significant reforms.

To be sure, U.S. President Barack Obama, spurred by an alliance between civil society organizations and the technology industry, has taken some action. In a January speech, and an accompanying presidential policy directive, Obama ordered American spies to recognize that “all persons should be treated with dignity and respect, regardless of their nationality or wherever they might reside, and that all persons have legitimate privacy interests in the handling of their personal information.”

Some specific advances, unprecedented in the shadowy world of intelligence agencies, have accompanied this rhetorical commitment to privacy. When technology companies sued the government to release details about intelligence requests, the Obama administration compromised, supporting a settlement that allows for more detailed reporting. Under this agreement, companies have the option of publishing figures on data requests by intelligence agencies in ranges of 250 or 1,000, depending on the degree of disaggregation of the types of orders.

Though this represents a step forward, it is far from adequate, with gaping loopholes that prohibit reporting on some of the most notorious NSA programs such as the dragnet collection of phone records under Section 215 of the USA Patriot Act.

Moreover, Obama has demurred on the most significant recommendations of the independent review group that he appointed.

And the USA Freedom Act, which was meant to stop the mass collection of Americans’ phone records, is being diluted by a set of amendments that would enable the government to continue collecting metadata on millions of individuals without their consent.

This metadata — covering whom we talk to, when and for how long — can reveal as much about our private lives as the content itself.

Relative to the rest of the world, the United States has taken the strongest action since the Snowden revelations began. Of course, Snowden exposed more about the U.S. government’s surveillance activities than any other country. But the documents also included egregious examples of overreach by the Government Communications Headquarters, the United Kingdom’s signals intelligence agency and information about intelligence sharing in the so-called “Five Eyes” network of the United States, the United Kingdom, Canada, Australia, and New Zealand.

The agreements that govern the pooling and exchange of intelligence among these governments remain closely guarded secrets. Continue reading…


Wednesday, June 25, 2014

An Abney Associates Fraud Awareness Program on Apple implements MAC anti-tracking technique


Apple is going to implement random MAC addresses technology in its iOS8 devices, an anonymity-granting technique which late computer prodigy Aaron Swartz was accused of using to carry out his infamous MIT hack.

Swartz, who faced criminal prosecution on charges of mass downloading academic documents and articles, was also accused of using MAC (Media Access Control) spoofing address technology to gain access to MIT’s subscription database.

At the time of his suicide at the age 26, Swartz was facing up to 35 years in prison, the confiscation of assets and a $1 million fine on various charges.


Now computer giant Apple is installing a MAC address randomizing system into its products. The company announced that in its new iOS 8, Wi-Fi scanning behavior will be “changed to use random, locally administered MAC addresses.”

MAC-address is a unique identifier used by network adapters to identify themselves on a network, and changing it could be regarded as an anti-tracking measure.

David Seaman, journalist and podcast host of “The DL Show,” told RT that a single technology cannot protect users from being spied upon and advised users to trust no one, particularly the companies that have been caught cooperating with agencies such as the NSA, or those who used to turn a blind eye toward governments’ illegal activities.

RT: Why is Apple suddenly becoming interested in boosting the privacy protection of its devices by spoofing MAC-addresses?

David Seaman: That’s one of the techniques that Apple has adopted to spoof these MAC-addresses and it’s just another step to make smart phones and other devices, other mobile devices a bit more secure. Of course you have to keep in mind that a smart phone is to begin with not all that secure, because there are so many different application developers, as well as the fact that you have to rely on whatever cell phone company is providing you with a signal. So this definitely doesn’t make phones completely secure, but I think it’s a step in the right direction.

RT: Some argue that Apple’s attempt to protect the privacy of its users is pretty much useless because there are many ways to see where the device is. Do you agree that what they are trying to give us is perhaps not really the full picture?

DS: There are a number of other hardware identifiers, aside from the MAC-address that your cell phone is still emitting, and which, using cell towers, they can still find your exact location. So this definitely doesn’t restore total privacy to the user, it’s just one band aid. And I think if you’re injured, you should use as many band aids as possible.


But there’s also a larger thing here which is that governments are spying on us and these cell phones are not designed to be all that secure from day one. And there are a number of private companies that, I wouldn’t say spying, but eavesdropping on what you’re doing to make money out of you. And this is a growing problem as we spend more and more of our lives online and on our phones and we expect these things to be secure. Continue reading…

Tuesday, June 24, 2014

An Abney Associates Fraud Awareness Program on YouTube Video Teaches Credit Card Fraud




The YouTube video features Lil Wayne rapping over a melancholy beat: "I see that guilt beneath the shame. I see your soul through your window pane."

Displayed on the screen is a message for aspiring credit card fraudsters.

"Everyone...I'm selling full cc generator...I also sell full cc...Have much more hacking tools, software   and other Business to offer. Only serious buyers."

The pitch for credit card fraud plays alongside an ad for American Express credit cards -- which means that the apparent cybercriminal who posted the video may profit not just on the stolen data   but also on the ads purchased by the credit card companies that had their data stolen.

The odd set-up, it turns out, is not unique. YouTube is littered with videos marketing stolen credit cards and other tools for criminal ventures. (Many liven up their pitches with unauthorized samplings from famous musicians.)

A report to be released Tuesday by the Digital Citizens Alliance, an Internet safety advocacy organization, blasts Google Inc., YouTube's parent company, for profiting from ads paired with such videos.

The illicit videos are so common that it's almost inevitable that legitimate advertisers will get paired with them.

The process begins with a user posting a video onto the site and agreeing to allow ads. If the videos get a certain number of hits, their producers can get a cut of the revenue coming from the ads.

A search   of credit card fraud terms reveals the extent of the problem: "CC Fullz" brings up 2,030 videos, according to the report. (Fullz is slang for a full package of identifying information on a credit card holder.) "Buy cc numbers" shows 4,850 results. And "CC info with CW" brings up 8,820 hits.

"Many of these videos are embedded with advertisements, which means that Google is effectively in business   with crooks peddling stolen or bogus credit cards," the report states.

The videos are commonly displayed alongside ads for major companies. In one instance, the accompanying pitch was for Target, a company still reeling from the kind of credit card attacks these videos help facilitate.

Asked about the pairing by The Times, Target spokesman Evan Lapiska said "the ad placement in question is a clear violation of the contract terms with the vendor who manages ad placements online."

"We are working with them to address this issue as soon as possible," Lapiska said in a statement.

Target and other advertisers have little control over whether their promotions get paired up with fraud videos. The responsibility for weeding out such videos falls on YouTube and Google.

Tom Galvin, executive director of Digital Citizens Alliance, said Google has failed to implement a systemic fix for keeping such videos from going live.

Galvin acknowledged that it would be untenable for YouTube to check every video that gets uploaded onto the site. But he said common search terms such as "fake credit card numbers" should be vetted.

"YouTube is supposed to be this mainstream site," Galvin said. "It's not a good thing when these mainstream sites start looking like the dark corners of the Internet."

Galvin said he didn't blame the advertisers, such as Target, who ended up on the illicit videos: "They're kind of captive to the system."


Google, which owns YouTube, did not respond to questions from The Times.

Monday, June 23, 2014

An Abney Associates Fraud Awareness Program: Mock email scam ensnares hundreds of bureaucrats



OTTAWA – Many of the Justice Department’s finest legal minds are falling prey to a garden-variety Internet scam.

An internal survey shows almost 2,000 staff were conned into clicking on a phoney “phishing” link in their email, raising questions about the security of sensitive information.

The department launched the mock scam in December as a security exercise, sending emails to 5,000 employees to test their ability to recognize cyber fraud.

The emails looked like genuine communications from government or financial institutions, and contained a link to a fake website that was also made to look like the real thing.

Across the globe, an estimated 156 million of these so-called “phishing” emails are sent daily, and anyone duped into clicking on the embedded web link risks transferring confidential information – such as online banking passwords – to criminals.

The Justice Department’s mock exercise caught 1,850 people clicking on the phoney embedded links, or 37 per cent of everyone who received the emails.

That’s a much higher rate than for the general population, which a federal website says is only about five per cent.

The exercise did not put any confidential information at risk, but the poor results raise red flags about public servants being caught by actual phishing emails.

A spokeswoman says “no privacy breaches have been reported” from any real phishing scams at Justice Canada.

Carole Saindon also said that two more waves of mock emails in February and April show improved results, with clicking rates falling by half.

“This is an awareness campaign designed to inform and educate employees on issues surrounding cyber security to protect the integrity of the department’s information systems and in turn better protect Canadians,” she said in an email.

“As this project progresses, we are pleased that the effectiveness of this campaign is showing significant improvement.”

A February briefing note on the exercise was obtained by The Canadian Press under the Access to Information Act.

The document indicates there are more such exercises planned – in June, August and October – and that the simulations will be “graduating in levels of sophistication.”

Those caught by the simulation are notified by a pop-up window, giving them tips on spotting malicious messages.

The federal government’s Get Cyber Safe website says about 10 per cent of the 156 million phishing emails globally make it through spam filters each day.

Of those, some eight million are actually opened by the recipient, but only 800,000 click on the links – or about five per cent of those who received the emails.

About 10 per cent of those opening the link are fooled into providing confidential information – which represents a worldwide haul of 80,000 credit-card numbers, bank accounts, passwords and other confidential information every day.

“Don’t get phished!,” says the federal website, “Phishing emails often look like real emails from a trusted source such as your bank or an online retailer, right down to logos and graphics.”

The site says more than one million Canadians have entered personal banking details on a site they don’t know, based on surveys.

In late 2012, Justice Canada was embroiled in a major privacy breach when one of its lawyers working at Human Resources and Skills Development Canada was involved in the loss of a USB key.

The key contained unencrypted confidential information about 5,045 Canadians who had appealed disability rulings under the Canada Pension Plan, including their medical condition and SIN numbers. The privacy commissioner is still investigating the breach.

The department has some 5,000 employees, about half of them lawyers.

Visit our facebook page and follow us on twitter @Abney_and_Assoc.