Cyber Scam is a concept that could be translated in plain language as ‘all the different kinds of Security fraud’.
A Cyber Scam could be either targeted, with actions that imply attackers are focused on a special niche of persons/audits, or generalists, basically addressed to every and anyone.
In Cyber Scam attacks, the main target is the individual, while taking advantage of ignorance on security matters and protection. In fact, IT Security risks are underestimated by a great majority of people and organizations.
We can say of course, that there is no one Cyber Scam, but there are many types of Cyber Scams. Year after year, these attacks evolve, from their ability to derive significant economic returns, to their ability to hide and bypass any cyber security prevention barrier.
Email phishing is a ploy to get users to reveal – by deception – personal or financial information through an email or a website, but increasingly also by incoming messages from the most popular applications like WhatsUp or Facebook. One example is the so called Nigerian Scam. Nigerian scams involved someone overseas offering a share of a large sum of money or a payment if you help them to transfer money out of their country, paying fees or taxes. While this type of scam originated in Nigeria, now it could come from anywhere in the world.
Fake news is a neologism often used to refer to fabricated news. This type of news, found in traditional news outlets, social media or fake news websites, has no basis in fact, but is presented as being factually accurate. In this case, the fake news is generated to drive the victim to click and access to a specific webpage where he can be infected by viruses or eventually driven to dangerous web spaces.
Bitcoin is a scammer’s dream for several reasons: Very few people really understand it. This makes it easier to make false promises and unusual moves without getting caught. It’s mostly anonymous. It’s a lot easier for scammers to cover their tracks. Once bitcoin or other cryptocurrencies have been stolen, they are probably never coming back to their rightful owners. It’s largely unregulated. There are ways for scammers to steal bitcoin without breaking the law, and there are few authorities that will ever go after them.
The approach is to drive the victim to Web Pages where Crypto Currencies are traded, to then enter in a so called ‘Ponzi scheme’ (the Ponzi scheme is an economic model of fraudulent selling that promises strong profits to the victims as long as they recruit new “investors”, who in turn are victims of the fraud) or to force you to install malware and then get and resell in the black market all this personal information, or directly steal money from you.
Malware or malicious software, is any program or file that is harmful for a computer user. Malware includes computer viruses, worms, Trojans and spyware. These malicious programs can perform a variety of functions, including stealing, encrypting or deleting sensitive data, altering or hijacking core computing functions, and monitoring users’ computer activity without their permission.
Ransomware is a form of malware that takes control of your computer, and then threatens you with harm, usually by denying you access to your data and/or the threat to delete your data. The attacker demands a ransom from the victim, promising — not always truthfully — to restore access to the data upon payment. Users are shown instructions for how to pay a fee to get the decryption key. The costs can range from a few hundred dollars to thousands, payable to cybercriminals in Bitcoin.
Alternatively, the data of a user’s hard disk is blocked or encrypted and the encryption key is released in exchange for a ransom. Often, unfortunately, despite payment of the sum, the data is no longer unlocked and the unfortunate user does not get his data back.
Ransom against compromising info stored in the Hard Disk: The attacker claims via an out-of-the-blue email that he has taken over the control of the victim’s computer and that he is then able deliver to anyone any compromising content stored in the Hard Disk, like videos, pictures, etc. unless a ransom is paid through Bitcoin. In this case, there is one aspect to be considered: if you do not have anything compromising there is no reason to be scared. However, cyber scammers trust there are lots of people who have something to leak, and statistically this could be a relevant number.
Job Offer mailings: Another aspect that leverages on a great malaise of our times, are the emails that hide malware or viruses and that appear as job offers. Considering the squalor of speculating on human weakness and even suffering, it must be said that every time a need appears in society, three categories move first and fast: black hackers, marketing and advertising, and politicians.
A zero-day attack is a brand-new kind of cyberattack when perpetrated. The zero-day attacks could be defined as the first examples of attacks that occur using that strategy or that technology, so “Zero” means “never perpetrated before”. For these risks, you can’t necessarily count on any security protection such as a typical antivirus, and in some cases the only safeguard can be awareness in security protection behavior.
One of the aspects that should be emphasized is the impact of Social Media, which means that every time we put a comment, a like, a content, a photo, we use Google search, we pay online by credit card, etc. we are tracked, and “someone” may see where and how we move and what we do. Marketing uses data for targeted campaigns; politicians increasingly use it to give us what we “ask”; hackers cheat us by discovering our preferences and potential weaknesses.
One fundamental cornerstone to reduce the risks driven by Cyber Threats is the capacity to establish some vigilance around the more important assets of the company. This means being prudent and carefully managing the gates of access to the critical applications, wherever they are.
One topic that should be always highlighted is the diligent updating of the installed software based on the latest release. Part of a hacker intrusion’s success is due to people’s negligence in performing updates, be it antivirus software, security software, program patches, and the likes.
Phishing, malware, ransomware, hacking: all these risks can really be minimized if every member of the company follows the rules, which should be generally explained in a Security Training Session. There must be proper awareness of it at every level of the company ladder.
Cyberattack Tests
Cybertech is able to simulate a Cyber Scam attack at any department level, highlighting strengths and weaknesses of the Security defense. In the test mode, there are simulations of attacks, and attempts of intrusion in the data base. This test can last for many days, and the final result is a report with pros and cons, including the indication of the remediation recommendation.
Cybertech RED Team
Another possible approach is the so called RED Team. In this case, the team is trained to check the reaction of the people against unusual situations, and to see where and how security basic rules could by leapfrogged. Especially in locations with very sensitive data, like Banks and insurance companies, the outcome of these tests is sometimes disappointing. A lot of basic rules are left unattended and the real possibility of a breach is more than real. Real life example: Cybertech performed a RED Test with an important Italian company. The test was on both physical location and systems access/data intrusion. The outcome was poor. In many cases, the ‘spy’ was able to enter the location pretending to be there for maintenance, and just few rooms were not violated. In the access area, in many cases access and passwords to critical applications were discovered and potential breaches were possible.
Cyber Scams come from multiple sources, and the risks are in steady and constant evolution. To remedy and minimize the risks there are some concrete actions that can be taken in these fields:
- The best technology: Cyberattacks are more and more sophisticated now, and some use cutting edge technology. Companies must adopt proper defense postures, with the latest technology available.
- Drive human behavior: There is still no super-technology on the market that can save companies from the mindlessness of humans or from their bad faith. We must constantly remind people that their behavior is important, regarding phishing, password handling, access, ransomware, etc.
- Establish Rules and processes: Every company must consider having established rules and procedures to guide internal conduct and control postures.
- Find professional support in Security: In general, companies need a professional team with the right skills and the right solutions to effectively support their security.