Category: cyber security

Fraud Investigation

There are many private investigators, fraud protection businesses, cyber-crime specialists etc. who may be able to help if you are the victim of a fraud.  This is usually only for business fraud as few individuals have the resources to employ professionals in this field.

One such specialist business is Requite Solutions. Their website is at www.requitesolutions.com/

Requite say they are cybercrime, fraud prevention and investigation specialists – a London based consultancy service operating globally.

They employ senior fraud detectives, cybercrime investigators, and former armed surveillance operatives who have years of experience tackling cybercrime, money laundering, organised, and business crime.

They provide high quality penetration testing by CREST certified penetration testers. Our teams of experts work manually to find more of the issues that matter.

Asset Tracing & Recovery, Investigation, Hackers,Financial Investigation, Suspect profiling, Evidential packages, Recovery, Dispute resolution.

 Requite Say businesses should choose them because of the following:-

  • Criminals are exploiting the advances in technology. Every day both large and small organisations are falling victim to fraud and cyber attacks. If you have experienced fraud or a cyber attack, then you will understand the frustration, stress, and panic that often ensues.
  • We will gather crucial evidence, trace assets, absorb your stress, and assist with achieving a positive outcome through recovery of assets and/or prosecution.
  • Staff at your company are often the first line of defence and the importance of training, and continuing education is essential. We can deliver this training in a clear and concise manner.
  • Ensuring that you are adequately protected against fraud and cyber-attacks is paramount. Failures to address any impending threats could damage your brand and reputation and may result in significant financial losses that are not always recoverable.

If you have any experiences with scammers, spammers or time-waster do let me know, by email.

Fightback Ninja Signature

UK Cyber Force

The UK government announced the creation of a £250m cyber-force unit that will combat terrorist groups and domestic gangs.

The government is planning it to be an offensive cyber warfare unit in a bid to meet the online threat posed by Russia, North Korea, Iran and other countries active in cyber-attacks.

Experts will be recruited from the military, security services and industry for the project which will be set up by the Ministry of Defence and GCHQ.

In July 2019, a parliamentary committee warned that ministers are failing to get to grip with the shortage in cyber security experts despite the “potentially severe implications” for national security.

MPs and peers said the situation is of “serious concern”, but the Government response lacks “urgency”.

They warned that the WannaCry attack in May 2017, which hit the NHS, showed the need to protect critical national infrastructure  from cyber threats.

In July, a Government spokeswoman said: “We have a £1.9 billion National Cyber Security Strategy, opened the world-leading National Cyber Security Centre and continue to build on our cyber security knowledge, skills and capability.”

For obvious reasons, the UK’s cyber-attack capabilities are a secret, but are widely regarded to be very active.

Do leave a comment on this post – click on the post title then scroll down to leave your comment.

Fightback Ninja Signature

Google Advanced Protection Programme

Google’s Advanced Protection Program safeguards the personal Google Accounts of anyone at risk of targeted attacks – such as journalists, activists, business leaders and political campaign teams.

Google say that it’s not needed for everyone, but if you feel you are a target then maybe this is a necessary safeguard for you.

Basic security for a Google account is just a password. Two factor authentication is the next step and it means you have to identify yourself using two items such as a password and a PIN sent to you by text message.

The third stage of security is the use of a physical security key.

Q. What is phishing?

Phishing is a common technique used by fraudsters to trick you into giving away your login details for example. The phishing attack may be via email, text message phone call, website or in an APP.

Q. How does Advanced Protection defend against phishing?

Even if you do fall for a phishing attack that discloses your username and password, an unauthorised user won’t be able to access your account without one of your physical Security Keys.

To enrol, you’ll need to purchase two Security Keys — one wireless-enabled key to act as your main key, and one backup key. After you enrol, other authentication factors you might be used to, like codes sent via SMS or the Google Authenticator app, will no longer work.

Safeguard your data by limiting access to it

When you sign up for new apps or services, you are sometimes asked to give access to data in your Google Account. Usually this doesn’t pose a risk, but sophisticated attackers could compromise or impersonate an app or service to gain access to your personal data. To help protect you, Advanced Protection allows only Google apps and select third-party apps to access your emails and Drive files.

As a trade-off for this tightened security, the functionality of some of your apps may be affected. Most third-party apps that require access to your Gmail or Drive data, such as travel tracking apps, will no longer have permission. And you will only be able to use Chrome and Firefox to access your signed-in Google services like Gmail or Photos.

Apple’s Mail, Calendar, and Contacts apps will continue to be able to access your Google data as normal.

A common way that hackers try to access your account is by impersonating you and pretending they have been locked out of your account. To give you the strongest protection against this type of fraudulent account access, Advanced Protection adds extra steps to verify your identity during the account recovery process.

Go to https://landing.google.com/advancedprotection/ if you want to know more about Google Advanced Security.

If you’ve enjoyed this post or found it useful then do share – click on the post title then scroll down to the social media share buttons.

Fightback Ninja Signature

Trusteer Rapport

Trusteer Rapport is a free security tool that’s often promoted by banks for online banking.

It’s advertised as an additional layer of security over and above anti-virus software. It is designed to protect confidential data, such as account credentials, from being stolen by malicious software (malware) or by phishing.

The software includes anti-phishing measures to protect against misdirection and attempts to prevent malicious screen scraping; it attempts to protect users against the attacks know as:- man-in-the-browser, man-in-the-middle, session hijacking and screen capturing.

Trusteer Rapport is installed as a browser extension.

This all sounds very good, but there are reviews on the Internet suggesting that Trusteer can cause computers to run very slowly, cause conflicts with your already installed anti-virus software and cause browser crashes.

Various financial institutions have been distributing the software to their customers via internet banking services.

This has included:- Bank of America, Société Générale,Tangerine, INGDirect, HSBC,The Royal Bank of Scotland, CIBC, Ulster Bank, First Direct, Santander, Standard Bank of South Africa, Nedbank, Scotiabank and more.

It is usually good advice to follow your banks recommendations, but do be careful if you install Trusteer and report any problems immediately to your bank. .

Fightback Ninja Signature

 

The New Breed of Computer Takeover Compensation Scam

A computer takeover scam has been doing the rounds for years now, where a scammer will call, claiming to be from Microsoft or Virgin or

BT or a similarly well-known company, saying that your computer has been hit with a virus and that they can remove it for you remotely. When you let them take over your computer, they then try to take as much personal information as possible (logins, password, card payment details etc.) in order to steal your identity or steal from your accounts.  

However, according to Financial Fraud Action (FFA) UK, scammers are branching out by impersonating other firms or organisations, and offering to help with a slow computer or internet connection, or even claiming your information has been hacked and you are due compensation.

The Scam

Once the victim has handed over remote control of their computer, the fraudster will tell the victim that they may be entitled to compensation, or put them through to a supervisor who will appear to make an offer of compensation.

The scammer will say that they are sending the money and ask the victim to log into their bank account to check that it has arrived.

But the fraudsters will put up a fake screen to make it appear that the money has arrived. Meanwhile they will be working away in the background to empty your bank account.

They may ask for a bank passcode to be sent by text, which they will claim is necessary in order to process the refund. In reality, they need this to set themselves up as a new payee from your bank account and take your money.

How to Protect Yourself

The FFA recommends following these steps to ensure you aren’t duped by this version of the scam:

  • be wary of any unsolicited approaches by phone offering compensation
  • do not let someone you do not know have access to your computer, especially remotely
  • do not log onto your bank account while someone else has control of your computer
  • do not share one-time passcodes or card reader codes with anyone
  • do not share your Pin or online banking password, even by tapping them into a telephone keypad.

If you are in doubt, then call the organisation back on a number you trust; if they are legitimate they will help.

Do enter your email address and click on the subscribe button on top right to keep up to date with new posts.

Fightback Ninja Signature

Ticketmaster Data Breach Failings

Ticketmaster is a well-known global ticket selling business and they suffered a data breach starting in February 2018 and continuing through to late June.

A piece of malware on a customer service system operated by a third party had been exporting customer data to a scammer and Ticketmaster claim to have known nothing about this until June 23rd.

However, Digital bank Monzo did spot in April that customers’ cards were being compromised and warned Ticketmaster but “couldn’t get any traction” out of the company.

Monzo contacted all of its customers who had ever dealt with Ticketmaster – about 5,000 – and replaced their cards.

It also told banks that are part of the UK Finance group in April that it was aware of what appeared to be a significant data breach at Ticketmaster.

Ticketmaster say they investigated at the time but found no problem. The fault was in third party software not Ticketmaster’s own software, but that doesn’t excuse their apparent lack of responsibility for their customers who were being compromised.

Ticketmaster eventually realised there was a serious problem and said customers who bought concert, theatre and sporting event tickets between February and 23 June 2018 may have been affected by the incident, which involved malicious software being used to steal people’s names, addresses, email addresses, phone numbers, payment details and Ticketmaster login details.

The breach also affects customers of two other UK websites owned by Ticketmaster: TicketWeb and the resale website Get Me In!

Ticketmaster claims that the data for less than 40,000 people was affected.

Ticketmaster could face questions over whether there was a delay in disclosing the breach after it emerged that some UK banks had known about the incident since early April.

Ticketmaster has subsequently warned customers: “We recommend that you monitor your account statements for evidence of fraud or identity theft.

Ticketmaster said it was offering affected customers a free 12-month identity monitoring service. There is a dedicated website at security.ticketmaster.co.uk, and customers can also email fan.help@ticketmaster.co.uk for further information or to register their concern.

Companies need to protect their customer’s data, but also how they deal with such problems when they occur,  can affect the outcome as much as the details of the actual problem. Ticketmaster have not come out of this very well.

Do leave a comment on this post – click on the post title then scroll down to leave your comment.

Fightback Ninja Signature

The Impact of Cyber Attacks on Business

The impact of cyber-attacks can be bruising for a business with both short and long term effects to consider.

A 2016 survey of 428 businesses that have suffered cyber-attacks in the previous months.

You can see from the statistics above for 2016, that the biggest impact reported by businesses that have suffered from cyber-attacks is the provision of new measures to prevent further attacks. This can be costly but is essential to protect against further attacks.

There are the short term issues:-

  • Bringing in expert technical staff to find out how the attack happened
  • Technical expertise needed to start to build defences against further such attacks
  • Extra staff to deal with recovery, communications with customers, legal ramifications etc.
  • Disruption to staff and service to customers

Then there are the long term effects:-

  • Reputation damage
  • Steps needed to restore reputation and customer confidence
  • Share price

It is better to build strong defences against cyber-attacks than simply trust to luck.

It is prudent to have plans in place for how to deal with such attacks as the FBI now say that it’s not a question of whether any organisation will be attacked, but simply when.

Do Share this post on social media – click on the post title then scroll down to the social media share buttons.

Fightback Ninja Signature

UK Government Cyber Essentials Scheme

https://www.cyberessentials.ncsc.gov.uk/

The government says Cyber Essentials helps your business to guard against the most common cyber threats and demonstrate your commitment to cyber security

Self-Help for Cyber Essentials

The guide explains how to:

  • Secure your Internet connection
  • Secure your devices and software
  • Control access to your data and services
  • Protect from viruses and other malware
  • Keep your devices and software up to date

The Three levels of Engagement

Not everyone has the time or resources needed to develop a full-on cyber security system. So Cyber Essentials has been designed to fit with whatever level of commitment you are able to sustain. There are three levels of engagement:

  1. The simplest is to familiarise yourself with cyber security terminology, gaining enough knowledge to begin securing your IT.
  2. Basic Cyber Essentials certification.
  3. Cyber Essentials Plus certification.

1.     Self Help

The self-assessment option gives you protection against a wide variety of the most common cyber attacks. This is important because vulnerability to simple attacks can mark you out as target for more in-depth unwanted attention from cyber criminals and others.

2.     Certified Cyber Security

Cyber Essentials Certificate £300 approx. (+VAT)

Certification gives you peace of mind that your defences will protect against the vast majority of common cyber attacks simply because these attacks are looking for targets which do not have the Cyber Essentials technical controls in place.

In the process of obtaining Cyber Essentials Certification is simple, you can opt to buy as much or as little help as you need from the company you choose to certify you.

Cyber Essentials shows you how to address those basics and prevent the most common attacks.

  • Reassure customers that you are working to secure your IT against cyber attack
  • Attract new business with the promise you have cyber security measures in place
  • You have a clear picture of your organisation’s cyber security level
  • Some Government contracts require Cyber Essentials certification

3.     Cyber Essentials Plus Certificate

The cost for this is only available on application.

It has all the benefits of Cyber Essentials PLUS your cyber security is verified by independent experts.

Cyber attacks come in many shapes and sizes, but the vast majority are very basic in nature, carried out by relatively unskilled individuals. They’re the digital equivalent of a thief trying your front door to see if it’s unlocked. The advice is designed to prevent these attacks.

Cyber Essentials Plus still has the Cyber Essentials trademark simplicity of approach, and the protections you need to put in place are the same, but this time the verification of your cyber security is carried out independently by your Certification Body.

The more rigorous nature of the certification may mean you need to buy additional support from your Certification Body.

Cyber Essentials and Government Contracts

If you would like to bid for central government contracts which involve handling sensitive and personal information or the provision of certain technical products and services, you will require Cyber Essentials Certification.

Fightback Ninja Signature

 

UK Government Cyber Essentials 10 Step Plan

 

This is a summary of the UK Government 10 step plan for Cyber Essentials, which is designed for organisations looking to protect themselves in cyberspace.

1.     Risk Management

Embed an appropriate risk management regime across the organisation. This should be supported by an empowered governance structure, which is actively supported by the board and senior managers. These should aim to ensure that all employees, contractors and suppliers are aware of the approach, how decisions are made, and any applicable risk boundaries.

2.     Secure Configuration

Identify baseline technology builds and processes for ensuring configuration management can greatly improve the security of systems. Develop a strategy to remove or disable unnecessary functionality from systems, and to quickly fix known vulnerabilities.

3.     Network Security

The connections from your networks to the Internet, and other partner networks, expose your systems and technologies to attack. By creating and implementing some simple policies and appropriate architectural and technical responses, you can reduce the chances of these attacks succeeding. Your organisation’s networks may use of mobile or remote working, and cloud services, makes defining a fixed network boundary difficult.

4.     Managing User Privileges

All users should be provided with a reasonable (but minimal) level of system privileges and rights needed for their role. The granting of highly elevated system privileges should be carefully controlled and managed.

5.     User Education and Awareness

It’s important that security rules and the technology provided enable users to do their job as well as help keep the organisation secure. This can be supported by a systematic delivery of awareness programmes and training that deliver security expertise as well as helping to establish a security-conscious culture.

6.     Incident Management

Invest in establishing effective incident management policies and processes to help to improve resilience, support business continuity, improve customer and stakeholder confidence and potentially reduce any impact.

7.     Malware Prevention

Malicious software, or malware is an umbrella term to cover any code or content that could have a malicious, undesirable impact on systems. The risk may be reduced by developing and implementing appropriate anti-malware policies as part of an overall ‘defence in depth’ approach.

8.     Monitoring

System monitoring provides a capability that aims to detect actual or attempted attacks on systems and business services. Monitoring allows you to ensure that systems are being used appropriately in accordance with organisational policies.

9.     Removable Media Controls

Removable media provide a common route for the introduction of malware and the accidental or deliberate export of sensitive data. You should be clear about the business need to use removable media and apply appropriate security controls to its use.

10.Home and Mobile Working

Mobile working and remote system access offers great benefits, but exposes new risks that need to be managed. You should establish risk based policies and procedures that support mobile working or remote access to systems that are applicable to users, as well as service providers.

https://www.ncsc.gov.uk/guidance/10-steps-cyber-security has further information.

Do you have an opinion on this matter? Please comment in the box below.

Fightback Ninja Signature

UK Cyber Security Centre One Year On

In November 2016 the National Cyber Security Centre (NCSC) was created as part of GCHQ and given a mandate to pursue the radical action required to better protect the UK’s interests in cyberspace.

A key strand in this new approach is the NCSC’s Active Cyber Defence (ACD) programme, which aspires to protect the majority of people in the UK from the majority of the harm, caused by the majority of the attacks, for the majority of the time. It is intended to tackle the high-volume commodity attacks that affect people’s everyday lives, rather than the highly sophisticated and targeted attacks, which are dealt with in other ways.

One key intervention is the Takedown Service.

The Takedown Service

This service works by requesting that hosting providers remove malicious content that is pretending to be related to UK government and also certain types of malicious content hosted in the UK.

  • In 2017, we removed 18,067 unique phishing sites across 2,929 attack groups that pretended to be a UK government brand, wherever in the world they were hosted.
  • As a consequence, we have reduced the median availability of a UK government-related phishing site from 42 hours to 10 hours. That means that these sites are available for much less time to do harm to UK citizens. 65.8% of those are down in 24 hours, up from 39% before we started takedowns.
  • In 2017, we removed 121,479 unique phishing sites across 20,763 attack groups physically hosted in the UK, regardless of who it was pretending to be. As a consequence, we have reduced the median availability of a phishing site physically hosted in the UK from 26 hours to 3 hours, again giving them much less time to do harm. 76.8% of those were down in 24 hours, up from 47.3% before NCSC started takedowns.
  • In 2017, we worked with 1,719 compromised sites in the UK that were being used to host 5,111 attacks, intended to compromise the people that visited them. As a consequence, we have reduced the median availability of these compromises from 525 hours to 39 hours.
  • Over the year 2017, the month-by-month volume of each of these has fallen, suggesting that criminals are using the UK government brand less and hosting fewer of their malicious sites in UK infrastructure.
  • In 2017, we notified email providers about 3,243 Advance Fee Fraud attacks, pretending to be related to UK government.
  • In 2017, we stopped several thousand mail servers being used to impersonate government domains and sending malware to people, in the expectation that the government link makes them more realistic. We have also removed a number of deceptive domains that were registered with the sole intention of deceiving people.
  • While the volume of global phishing we can see has gone up significantly (nearly 50%) over the last 18 months, the share hosted in the UK has reduced from 5.5% to 2.9%.

That’s a great first year – keep up the good work.

Do leave a comment on this post – click on the post title then scroll down to leave your comment.

Fightback Ninja Signature