Connect with us

E-Business

How 20-Year Old Nigerian Attacked 4,000 Organizations Worldwide

Published

on

cyber atta.jpg

An international hacking campaign targeting thousands of oil, mining and construction firms sounds like the work of a sophisticated criminal operation.

The scale of such an endeavour suggests it would need extensive resources and manpower, potentially even nation-state backing.

But a newly uncovered cyberattack that targeted more than 4,000 organisations in the oil and gas, mining, construction, and transportation sectors has been found to have been carried out by a 20-year-old man in Nigeria.

The lone attacker successfully hacked into the networks of at least 14 organisations, including a marine and energy company in Croatia, a transportation company in Abu Dhabi, a mining company in Egypt, a construction company in Dubai, an oil and gas firm in Kuwait, and a construction organisation in Germany.

Using a remote access Trojan and a keylogger, the attacker stole login credentials and financial information from these companies.

The fact that attacks were targeted at financial staff working in specific regions and sectors — energy and transportation firms in Europe and the Middle East — and the use of a phishing email lure claiming to be from oil and gas giant Saudi Aramco, initially led researchers to believe the campaign was the work of a well-organised group.

But researchers at Check Point investigating the attack found this wasn’t the case.

“We realised this was just one person, because of the technical analysis of the malware and the C&C communications, we realised it was a criminal, not a nation state conducting espionage,” Maya Horowitz, head of research for Check Point, told ZDNet.

And unlike professional hacking gangs, the culprit has very poor operational security, allowing researchers to identify him and monitor his actions.

“You can see holes in the phishing emails themselves and there are holes all over the infrastructure,” Horowitz said.

Put simply, the phishing emails are crude and unconvincing, with spelling errors, generic subjects and the target referred to as ‘Sir/Ms’. The mass-mailed messages ask users to download an attachment, which asks for macros to be enabled then installs two forms of malware — both of which are freely available on the web.

Victims end up infected with Netwire, a remote access Trojan that allows the attacker to gain full control of infected machines, and Hawkeye, a commercially available form of keylogging software. While both forms of malware are relatively simple, they’ve enabled the attacker to steal banking and other credentials, and earn thousands by stealing from accounts and selling on credentials.

While they’ve managed to infiltrate a number of large organizations, the perpetrator is far from a cybercriminal mastermind. Indeed, he has not even made much of an effort to cover his tracks and has even discussed his actions on Facebook.

“He’s not very techie, but he’s on a Facebook group of several Nigerian hackers where they exchange tactics and techniques,” said Horowitz.

Attacks using phishing to infect machines with malware are gaining in popularity, she added, and are replacing the infamous 419 scams of old. “The same people who ten years ago were only able to send Nigerian Prince scams today they can just rent malware and send it to whoever,” said Horowitz.

“It’s the same people, with the same technical skills, but now this whole market works more like a business where you can just buy or rent your tools online as malware-as-as-service. In this case it’s not even on the dark web, it’s just on the internet,” she added.

The increasingly availability of malware-as-a-service — or freeware such as Netwire and Hawkeye — means it’s easier than ever for budding cybercriminals to get in on the action. However, in many cases, the attacker doesn’t have the knowledge to take the necessary steps to hide themselves.

In the case of this individual, Check Point has shared its findings with Nigerian police and international agencies in order to stop future attacks and arrest the culprit.

Those organisations that have already fallen victim to the attacks will need to take extra security precautions, because it’s likely log-in credentials and other sensitive information have been sold on to criminals who could use them to perform further attacks.

Ultimately, the phishing emails used in this attack were very basic but nonetheless fooled employees in the target organisations. Horowitz stressed the importance of companies making employees aware what these emails look like and the threats they pose.

“These attacks can be prevented, nobody has to be infected with this malware,” said Horowitz.

“Fourteen organisations were hit but there’s no reason they should have, because with proper security measures and — more importantly — education and awareness, these emails shouldn’t have got into the systems.”

Nigeria CommunicationsWeek believes that technology makes life more exciting and helps improve the lives of people around Nigeria and indeed the world. So since 2007, we have devoted our energy to independent reportage of technology and how they affect lives.

Continue Reading
Advertisement
Comments

E-Business

NITDA to Blacklist MDAs not Running Website on .gov.ng

Published

on

National Information Technology Development Agency (NITDA) has said any government agency or ministry not running its website on Nigerian domain name, .gov.ng, will be blacklisted.

 

Dr Ali Isa Ibrahim Pantami, NITDA director general in a statement made available in Abuja, added that most of the agencies still run their websites on generic top level domain (gTLD).

 

According to Dr Pantami, NITDA has observed the disregard to the use of .gov.ng domain in transaction of government business despite previous warning.

 

The DG said the agency would henceforth ensure strict compliance stressing that government business transactions should be carried out in the country’s code top level domain of the Nigerian government (ccTLD.ng)

 

However, for easy compliance, he said NITDA would henceforth approve request for .gov.ng within 24 hours, with the provision of special purpose phone numbers coupled with regular evaluation of agencies sites.

 

He said: “Furthermore, .gov.ng domain names are free with no rental or renewal cost attached. We therefore call on all MDAs and service providers to support government on the scale on the scale of ease of doing business.” (Daily Trust)

 

Continue Reading

E-Business

Swift Networks Launches Customised ICT Solutions for SMEs

Published

on

Swift Networks Limited, Nigeria’s leading broadband services provider has launched a suite of information and communications technology products customized to support Nigerian SMEs.

 

These bundled solutions will reduce cost and give small businesses better control of their operations to drive efficiencies and growth.

 

To operate under the sub-brand of SWIFT SMARTBusiness Kit,these all-in-one service bundles will consist of all the office and home connectivity, hosting and bespoke business software solutions available to small businesses in the market today.

 

“SWIFT SMARTBusiness Kit continues in SWIFT’s tradition of demystifying and simplifying technology to help unlock Nigeria’s abundant potentials so that people can achieve more in their daily undertakings”, enthused Mr. Charles Anudu, managing director of SWIFT.

 

“SWIFT SMARTBusiness Kit is user friendly and will resolve the problem of small businesses dealing with multiple vendors who often present them with conflicting solutions that are not future-proof. With our solution, SMEs will obtain all their ICT solutions from a single trusted service provider with probably the industry’s best of customer care team on one monthly bill”, according to Mr. Chukwuma Okoye, chief operating officer of SWIFT.

 

“And because we are sure that our target small businesses will like this solution, SWIFT SMARTBusiness kit will come with a 30-day money back guarantee with no questions asked if the customer is not satisfied with the solution.”

 

He further added that “for the early birds, we shall throw in a free home internet access for the business for as long as the subscription is current.”

 

A sample SWIFT Business Kit solution will consist of office (and free home) internet, web and e-mail hosting, attractive business and international travel voice call rates, a la carte business software modules for sales, accounting, customer relationship management, inventory management and human resource management.

 

A customer can start with a basic plan and either add or drop modules as the business evolves. This is because our solutions basket are well aligned and future-proof.

 

SWIFT SMART Business Kit is specially targeted at businesses in the professional services, eCommerce, traditional retail, educational, healthcare, hospitality and cottage industries.

 

The services will be distributed directly through SWIFT’s customer centres as well as those of its online and off-line channel partners. It will also be supported by a professional field sales team from SWIFT.

Continue Reading

E-Business

Gates Foundation Open-source Tool Enables Digital Payment Interoperability

Published

on

The new Mojaloop software, sponsored by the Bill and Melinda Gates Foundation, is available, free-of-cost, for software developers to adapt and banks, financial service providers and companies to implement.

Mojaloop is said to be the first model that can help extend interoperability from mobile money providers to any bank, merchant or government institution in a way that specifically meets the needs of the poor. It reduces the complexity and cost of building all-inclusive payment platforms.

Kosta Peric, deputy director, Financial Services for the Poor at the Gates Foundation, says just as the Internet revolutionised digital communication, open source solutions like Mojaloop can spark innovation, democratise access to digital payments, empower billions of new customers, and drive massive economic growth in developing markets.

“Interoperability of digital payments has been the toughest hurdle for the financial services industry to overcome. With Mojaloop, our technology partners have finally achieved a solution that can apply to any service, and we invite banks and the payment industry to explore and test this tool,” Peric adds.

Mojaloop (from the Swahili word ‘moja’ which means ‘one’) was created by the Gates Foundation’s Level One Project, which aims to build inclusive payment models to benefit the world’s poor.

It was created in partnership with fintech developers Ripple, Dwolla, ModusBox, Crosslake Technologies and Software Group, using technology such as the Interledger Protocol, a solution for settling funds among multiple providers across their individual systems.

The Mojaloop development project also brought together four mobile systems companies – Ericsson, Huawei, Telepin, and Mahindra Comviva – to develop an Open API for mobile money interoperability. These APIs will allow mobile money providers to integrate seamlessly with Mojaloop and products built from it.

It was designed to ultimately serve as a model for national payment switching systems that, for example, enable an individual’s digital wallet to connect with an employer’s bank account and her children’s school account to complete monthly transactions.

Continue Reading

Trending

Copyright © 2017 Communication Week Media Limited.