Connect with us

E-Business

Nigerian Hackers Steal $3Bn Worldwide- Reports

Published

on

hacked new.jpg

Nigerian hackers and cyber criminals are being accused of masterminding a grand theft of information and money running into billions of dollars, worldwide.

According to experts, the Nigerians are able to carry out the heist by sending phishing emails to commercial organizations and industrial enterprises, which they later steal dry.

The FBI estimates that these phishing attacks have cost companies over $3 billion.

The number of affected companies exceeds 22,143. Kaspersky Labs, an internet security company said it has found over 500 companies that are under attack in at least 50 countries.

Those under attack are mostly industrial enterprises and large transportation and logistics corporations, based in Germany, UAE, Russia and India.

In a blog post, Kaspersky said the cyber-criminals managed to steal technical drawings, floor plans and diagrams showing the structure of electrical and information networks.

Researchers said that all indications are that these were business email compromise (BEC) attacks that have come to be associated with Nigerian cyber-criminals. Emails received by victims looked authentic enough to fool people.

Some had attachments with names such as “Energy & Industrial Solutions W.L.L_pdf”, “Woodeck Specifications best Prices Quote.uue” and “Saudi Aramco Quotation Request for October 2016”.

These are well crafted emails that look legitimate and are crafted to make the victim open the malicious attachment.

The emails ask the recipients to check information as soon as possible, clarify product pricing or receive goods specified in the delivery note attached. The malicious attachments contain RTF files with an exploit for the CVE-2015-1641 vulnerability.

They may also contain archives of different formats containing malicious executable files or macros and OLE objects designed to download malicious executable files. Kaspersky discovered that the malicious files are intended to steal confidential data and install stealthy remote administration tools on infected systems.

Using Whois services, Kaspersky found that the domains used to host the malware were registered to residents of Nigeria.

Once in, the hackers compromise a legitimate email and change the banking account details. The malware used in these attacks belonged to families that are popular among cyber-criminals, such as ZeuS, Pony/FareIT, LokiBot, Luminosity RAT, NetWire RAT, HawkEye, ISR Stealer and iSpy keylogger.

”The phishers selected a toolset that included the functionality they needed, choosing from malware available on cyber-criminal forums. At the same time, the malware was packed using VB and .NET packers – a distinct feature of this campaign. To evade detection by security tools, the malicious files were regularly repacked using new modifications of the same packers,” said the researchers.

At least eight different Trojan-Spy and Backdoor families were used in the attacks. Further research found that the domain names of some of the malware command-and-control servers used by the attackers mimicked domain names used by industrial companies – “more proof that the attacks were primarily targeting industrial companies,” said researchers.

They added that most domains used for malware C&C servers were registered to residents of Nigeria. Researchers warned that it would be very dangerous if, because of an infection, cyber-criminals were able to gain access to computers that are part of an industrial control system (ICS).

“In such cases, they can gain remote access to the ICS and unauthorised control over industrial processes,” said researchers. Owen Connolly, vice president services (EMEA) at IOActive, told SC Media UK that this attack is not actually targeting industrial control systems or operational technology.

“It’s just targeting users that work for large companies. The fact that those companies may also have OT systems could just be coincidence, not correlation,” he said. Mark James, security specialist at ESET, told SC Media UK that scammers are opportunistic.

They understand they need to adapt and will change their tactics to get the best result. “With the 419 scams being so synonymous with the public, the scope for business users being victims is massive. We also need to consider the scope for larger, single successful attacks reaping the benefits much quicker than the smaller, and often much harder, sells through the public,” he said. Javvad Malik, security advocate at AlienVault, told SC that organisations dealing with industrial control systems may not be as savvy to scams as financial services, so it could be that the success rate of targeted emails is higher.

“Allowing criminals to make quick money. On the other hand, it could allow criminals to implant malware on industrial control systems, or at least on systems that support the ICS. This can then be allowed for further nefarious purposes such as deploying ransomware – or selling on the access to other criminals or ever nation states,” he said

Nigeria CommunicationsWeek believes that technology makes life more exciting and helps improve the lives of people around Nigeria and indeed the world. So since 2007, we have devoted our energy to independent reportage of technology and how they affect lives.

Continue Reading
Advertisement
Comments

E-Business

Visa Launches ID Intelligence for Smarter Customer Authentication

Published

on

Visa has launched Visa ID Intelligence, a platform that lets issuers, acquirers and merchants quickly adopt emerging authentication technologies, according to a press release.

Available through Visa Developer Platform, Visa ID Intelligence offers a curated selection of third-party authentication technologies that feature simple integration with Visa APIs and SDKs. This allows clients to create, test and adopt new authentication solutions.

This ultimately helps financial institutions and merchants to adopt effective and secure solutions and accelerate time-to-market with streamlined on boarding and implementation through Visa as a single trusted source, the company said.

Visa ID Intelligence features include: Identity Documents— the platform evaluates identification documents and matches selfies to photo IDs, while extracting document information and converting it into digital form.

Uses include creating new accounts, and performing password reset and lost or stolen card replacement.

-Biometrics — Visa ID Intelligence allows clients to use eye, face, fingerprint and voice to meet consumer needs for convenience, security and speed in authentication.

Uses include app login, payments, step-up authentication, and more.

“Traditional methods for authenticating a customer can create frustration or are simply not designed for the new ways people are shopping and paying. We built Visa ID Intelligence to help accelerate smarter and easy-to-use authentication solutions for any commerce environment — to better protect against fraud and to move closer to a world without passwords,” Mark Nelson, Visa senior vice president of risk and authentication products, said in the release.

Continue Reading

E-Business

ESET Works With Google To Protect Chrome Against Dangerous Malware

Published

on

By peter oluka

ESET, a leading global cybersecurity company, on Thursday launches Chrome Cleanup, a new scanner and cleaner for Google Chrome designed to help users browse the web safely and without interruption.

Chrome Cleanup will be available for all Google Chrome users running on Windows.

As cyber-attacks become more complex and difficult to spot, browsing the web can lead users to dangerous sites which can install malicious software onto devices.

Chrome Cleanup will alert Google Chrome users to potential threats when it detects unwanted software.

Google Chrome will then give users the option to remove the software. Chrome Cleanup operates in the background, without visibility or interruptions to the user. It deletes the software and notifies the user once the cleanup has been successfully completed.

“Using the internet should always be a smooth and safe experience for everyone,” said Juraj Malcho, chief technology officer at ESET. “For three decades, ESET has developed a number of security solutions that allow users to safely enjoy their technology and to mitigate a variety of cyber threats. Chrome Cleanup addresses unwanted software that can negatively influence a users’ experience on the internet.”

Chrome Cleanup is included in the latest version of Google Chrome. For more information about these tools, read Google’s blog post, here.

For 30 years, ESET® has been developing industry-leading IT security software and services for businesses and consumers worldwide.

With solutions ranging from endpoint and mobile security, to encryption and two-factor authentication, ESET’s high-performing, easy-to-use products give consumers and businesses the peace of mind to enjoy the full potential of their technology.

ESET unobtrusively protects and monitors 24/7, updating defenses in real-time to keep users safe and businesses running without interruption. Evolving threats require an evolving IT security company.

Backed by R&D centers worldwide, ESET becomes the first IT security company to earn 100 Virus Bulletin VB100awards, identifying every single “in-the-wild” malware without interruption since 2003.

Continue Reading

E-Business

A Buyer’s Market in the Global Economics of DDoS Attacks

Published

on

It’s a buyer’s market in the local property arena at the moment, according to certain industry experts.

 

This is largely as a result of the slower economy, which has seen a rise in the number of properties for sale.

 

But did you know that globally, it’s a buyer’s market as well when we look at the economics of Distributed Denial of Service (DDoS) attacks? The second, of course, is an underground market, largely regarded as a criminal one.

 

So said Bryan Hamman, Arbor Network’s territory manager for Sub-Saharan Africa.

 

Referring to recently released information from Arbor Networks, he said, “It is interesting to analyse the current economics in global DDoS attacks, which are attempts to make an online service unavailable by overwhelming it with traffic from multiple sources. Most people who are aware of DDoS attacks understand that there will be a perpetrator and a target.

 

“However, we’re now seeing a growing number of third-party providers of DDoS attacks as a service, who advertise their abilities online in order to either sell would-be attackers access to the tools needed to conduct a DDoS attack, or who perform the attack themselves on the customer’s behalf and provide reports afterwards.”

 

Hamman noted  that the fees of these underworld providers are lessening, due to rapidly expanding competition and the supply of readily available attack resources such as botnets. As a result, he says, the DDoS business is currently a buyer’s market.

 

Arbor reported that the prices for attack services, sometimes called “stressers” or “booters” vary widely, as do estimates of the total cost of an attack to the victim. But the economics are simple: DDoS attacks are becoming cheaper than ever for the perpetrator; are extremely lucrative for the attack service provider, and potentially financially devastating for the target.

 

Arbor noted that an increasing number of operators resemble legitimate service provider infrastructures with significant computing power, typically running their own botnet armies to unleash DDoS attacks. Perpetrators can essentially rent the providers’ botnets by the hour, day or week, or in some cases can buy a specific number of bots outright. The mechanics of transactions follow a classic web service model, meaning the perpetrator and the provider need never come in contact.

 

Providers that conduct attacks-as-a-service even post their services online, with tiered pricing reflecting the different types of attack that they offer. Prices are based on several factors. They can include the duration of the attack, the perceived value of the target, the country in which the attack takes place and/or the different methodologies employed.

 

In Arbor Networks 12th annual Worldwide Infrastructure Security Report, 59 percent of respondents estimated their downtime costs as being more than USD500/ minute in lost revenue (some ZAR6,700 per minute with the rand/dollar exchange rate on around ZAR13.50 to the dollar), with some indicating even higher losses. This also does not factor in the costs of repairing the damage, potential legal costs of settling with customers denied service, or reputational damage to the company’s brand.

 

Hamman concluded, “Here in South Africa, we may not yet face the overtness of DDoS operators advertising their services, as can be seen in the US. However, this does not mean that local companies shouldn’t be vigilant against DDoS attacks – protection is more vital than ever. A hybrid solution that combines on-premises and cloud-based protection is the industry best practice in DDoS defence. When you accept that DDoS attacks aren’t going away, and in fact are projected to escalate, it makes the best economic sense of all to make sure that you are adequately prepared against a DDoS attack.”

 

Continue Reading

Trending

Copyright © 2017 Communication Week Media Limited.