Connect with us


How 20-Year Old Nigerian Attacked 4,000 Organizations Worldwide



cyber atta.jpg

An international hacking campaign targeting thousands of oil, mining and construction firms sounds like the work of a sophisticated criminal operation.

The scale of such an endeavour suggests it would need extensive resources and manpower, potentially even nation-state backing.

But a newly uncovered cyberattack that targeted more than 4,000 organisations in the oil and gas, mining, construction, and transportation sectors has been found to have been carried out by a 20-year-old man in Nigeria.

The lone attacker successfully hacked into the networks of at least 14 organisations, including a marine and energy company in Croatia, a transportation company in Abu Dhabi, a mining company in Egypt, a construction company in Dubai, an oil and gas firm in Kuwait, and a construction organisation in Germany.

Using a remote access Trojan and a keylogger, the attacker stole login credentials and financial information from these companies.

The fact that attacks were targeted at financial staff working in specific regions and sectors — energy and transportation firms in Europe and the Middle East — and the use of a phishing email lure claiming to be from oil and gas giant Saudi Aramco, initially led researchers to believe the campaign was the work of a well-organised group.

But researchers at Check Point investigating the attack found this wasn’t the case.

“We realised this was just one person, because of the technical analysis of the malware and the C&C communications, we realised it was a criminal, not a nation state conducting espionage,” Maya Horowitz, head of research for Check Point, told ZDNet.

And unlike professional hacking gangs, the culprit has very poor operational security, allowing researchers to identify him and monitor his actions.

“You can see holes in the phishing emails themselves and there are holes all over the infrastructure,” Horowitz said.

Put simply, the phishing emails are crude and unconvincing, with spelling errors, generic subjects and the target referred to as ‘Sir/Ms’. The mass-mailed messages ask users to download an attachment, which asks for macros to be enabled then installs two forms of malware — both of which are freely available on the web.

Victims end up infected with Netwire, a remote access Trojan that allows the attacker to gain full control of infected machines, and Hawkeye, a commercially available form of keylogging software. While both forms of malware are relatively simple, they’ve enabled the attacker to steal banking and other credentials, and earn thousands by stealing from accounts and selling on credentials.

While they’ve managed to infiltrate a number of large organizations, the perpetrator is far from a cybercriminal mastermind. Indeed, he has not even made much of an effort to cover his tracks and has even discussed his actions on Facebook.

“He’s not very techie, but he’s on a Facebook group of several Nigerian hackers where they exchange tactics and techniques,” said Horowitz.

Attacks using phishing to infect machines with malware are gaining in popularity, she added, and are replacing the infamous 419 scams of old. “The same people who ten years ago were only able to send Nigerian Prince scams today they can just rent malware and send it to whoever,” said Horowitz.

“It’s the same people, with the same technical skills, but now this whole market works more like a business where you can just buy or rent your tools online as malware-as-as-service. In this case it’s not even on the dark web, it’s just on the internet,” she added.

The increasingly availability of malware-as-a-service — or freeware such as Netwire and Hawkeye — means it’s easier than ever for budding cybercriminals to get in on the action. However, in many cases, the attacker doesn’t have the knowledge to take the necessary steps to hide themselves.

In the case of this individual, Check Point has shared its findings with Nigerian police and international agencies in order to stop future attacks and arrest the culprit.

Those organisations that have already fallen victim to the attacks will need to take extra security precautions, because it’s likely log-in credentials and other sensitive information have been sold on to criminals who could use them to perform further attacks.

Ultimately, the phishing emails used in this attack were very basic but nonetheless fooled employees in the target organisations. Horowitz stressed the importance of companies making employees aware what these emails look like and the threats they pose.

“These attacks can be prevented, nobody has to be infected with this malware,” said Horowitz.

“Fourteen organisations were hit but there’s no reason they should have, because with proper security measures and — more importantly — education and awareness, these emails shouldn’t have got into the systems.”

Nigeria CommunicationsWeek believes that technology makes life more exciting and helps improve the lives of people around Nigeria and indeed the world. So since 2007, we have devoted our energy to independent reportage of technology and how they affect lives.

Continue Reading


Visa Launches ID Intelligence for Smarter Customer Authentication



Visa has launched Visa ID Intelligence, a platform that lets issuers, acquirers and merchants quickly adopt emerging authentication technologies, according to a press release.

Available through Visa Developer Platform, Visa ID Intelligence offers a curated selection of third-party authentication technologies that feature simple integration with Visa APIs and SDKs. This allows clients to create, test and adopt new authentication solutions.

This ultimately helps financial institutions and merchants to adopt effective and secure solutions and accelerate time-to-market with streamlined on boarding and implementation through Visa as a single trusted source, the company said.

Visa ID Intelligence features include: Identity Documents— the platform evaluates identification documents and matches selfies to photo IDs, while extracting document information and converting it into digital form.

Uses include creating new accounts, and performing password reset and lost or stolen card replacement.

-Biometrics — Visa ID Intelligence allows clients to use eye, face, fingerprint and voice to meet consumer needs for convenience, security and speed in authentication.

Uses include app login, payments, step-up authentication, and more.

“Traditional methods for authenticating a customer can create frustration or are simply not designed for the new ways people are shopping and paying. We built Visa ID Intelligence to help accelerate smarter and easy-to-use authentication solutions for any commerce environment — to better protect against fraud and to move closer to a world without passwords,” Mark Nelson, Visa senior vice president of risk and authentication products, said in the release.

Continue Reading


ESET Works With Google To Protect Chrome Against Dangerous Malware



By peter oluka

ESET, a leading global cybersecurity company, on Thursday launches Chrome Cleanup, a new scanner and cleaner for Google Chrome designed to help users browse the web safely and without interruption.

Chrome Cleanup will be available for all Google Chrome users running on Windows.

As cyber-attacks become more complex and difficult to spot, browsing the web can lead users to dangerous sites which can install malicious software onto devices.

Chrome Cleanup will alert Google Chrome users to potential threats when it detects unwanted software.

Google Chrome will then give users the option to remove the software. Chrome Cleanup operates in the background, without visibility or interruptions to the user. It deletes the software and notifies the user once the cleanup has been successfully completed.

“Using the internet should always be a smooth and safe experience for everyone,” said Juraj Malcho, chief technology officer at ESET. “For three decades, ESET has developed a number of security solutions that allow users to safely enjoy their technology and to mitigate a variety of cyber threats. Chrome Cleanup addresses unwanted software that can negatively influence a users’ experience on the internet.”

Chrome Cleanup is included in the latest version of Google Chrome. For more information about these tools, read Google’s blog post, here.

For 30 years, ESET® has been developing industry-leading IT security software and services for businesses and consumers worldwide.

With solutions ranging from endpoint and mobile security, to encryption and two-factor authentication, ESET’s high-performing, easy-to-use products give consumers and businesses the peace of mind to enjoy the full potential of their technology.

ESET unobtrusively protects and monitors 24/7, updating defenses in real-time to keep users safe and businesses running without interruption. Evolving threats require an evolving IT security company.

Backed by R&D centers worldwide, ESET becomes the first IT security company to earn 100 Virus Bulletin VB100awards, identifying every single “in-the-wild” malware without interruption since 2003.

Continue Reading


A Buyer’s Market in the Global Economics of DDoS Attacks



It’s a buyer’s market in the local property arena at the moment, according to certain industry experts.


This is largely as a result of the slower economy, which has seen a rise in the number of properties for sale.


But did you know that globally, it’s a buyer’s market as well when we look at the economics of Distributed Denial of Service (DDoS) attacks? The second, of course, is an underground market, largely regarded as a criminal one.


So said Bryan Hamman, Arbor Network’s territory manager for Sub-Saharan Africa.


Referring to recently released information from Arbor Networks, he said, “It is interesting to analyse the current economics in global DDoS attacks, which are attempts to make an online service unavailable by overwhelming it with traffic from multiple sources. Most people who are aware of DDoS attacks understand that there will be a perpetrator and a target.


“However, we’re now seeing a growing number of third-party providers of DDoS attacks as a service, who advertise their abilities online in order to either sell would-be attackers access to the tools needed to conduct a DDoS attack, or who perform the attack themselves on the customer’s behalf and provide reports afterwards.”


Hamman noted  that the fees of these underworld providers are lessening, due to rapidly expanding competition and the supply of readily available attack resources such as botnets. As a result, he says, the DDoS business is currently a buyer’s market.


Arbor reported that the prices for attack services, sometimes called “stressers” or “booters” vary widely, as do estimates of the total cost of an attack to the victim. But the economics are simple: DDoS attacks are becoming cheaper than ever for the perpetrator; are extremely lucrative for the attack service provider, and potentially financially devastating for the target.


Arbor noted that an increasing number of operators resemble legitimate service provider infrastructures with significant computing power, typically running their own botnet armies to unleash DDoS attacks. Perpetrators can essentially rent the providers’ botnets by the hour, day or week, or in some cases can buy a specific number of bots outright. The mechanics of transactions follow a classic web service model, meaning the perpetrator and the provider need never come in contact.


Providers that conduct attacks-as-a-service even post their services online, with tiered pricing reflecting the different types of attack that they offer. Prices are based on several factors. They can include the duration of the attack, the perceived value of the target, the country in which the attack takes place and/or the different methodologies employed.


In Arbor Networks 12th annual Worldwide Infrastructure Security Report, 59 percent of respondents estimated their downtime costs as being more than USD500/ minute in lost revenue (some ZAR6,700 per minute with the rand/dollar exchange rate on around ZAR13.50 to the dollar), with some indicating even higher losses. This also does not factor in the costs of repairing the damage, potential legal costs of settling with customers denied service, or reputational damage to the company’s brand.


Hamman concluded, “Here in South Africa, we may not yet face the overtness of DDoS operators advertising their services, as can be seen in the US. However, this does not mean that local companies shouldn’t be vigilant against DDoS attacks – protection is more vital than ever. A hybrid solution that combines on-premises and cloud-based protection is the industry best practice in DDoS defence. When you accept that DDoS attacks aren’t going away, and in fact are projected to escalate, it makes the best economic sense of all to make sure that you are adequately prepared against a DDoS attack.”


Continue Reading


Copyright © 2017 Communication Week Media Limited.