Financial Influenza Cyber Crime Check Fraud
Total Page:16
File Type:pdf, Size:1020Kb
Financial Influenza: This file contains 114 slides on Cyber Crime and Check Fraud. Cyber Crime and Check Fraud Cyber Crime begins with Slide 3 Check Fraud begins with Slide 55 - Vaccines For Your Organization A longer version of this presentation that includes ATM Fraud can be downloaded at: www.safechecks.com/services/fraudprevention.html Greg Litster SAFEChecks (800) 949-2265 Cyber Crime Internet Spam 350 300 250 200 2007 119.6 billion 150 2008 349.6 billion 100 50 0 Spam Detected Symantec observed a 192% increase in spam Download this presentation at: across the Internet, from 119 billion messages in 2007 to 349 billion in 2008. www.safechecks.com/services/fraudprevention.html Bot networks were responsible for 90% of all spam. Malicious Code Threats Malicious Code Threats 500,000 450,000 400,000 1,500,000 350,000 2005 113,025 300,000 New 1,000,000 250,000 Malicious 2006 140,690 200,000 Code 500,000 150,000 Threats 2007 624,267 100,000 2008 1,656,227 50,000 0 0 New Malicious Jan- Jul-Dec Jan- Jul-Dec Jan- Jul-Dec Jan- Jul-Dec Jun 2004 Jun 2005 Jun 2006 Jun 2007 Code Threats 2004 2005 2006 2007 2/3 of ALL malicious code thru 2007 was created in 2007 The trend today is to “customize” code to target a specific organization or industry 1 1 Data Breach: Cost Data Breach: Compromise to Discovery 50 Minutes 0% In 2008 the average cost per data breach 40 Hours 8% incident in the United States was $6.7 million. 30 Days 16% 20 Lost business was $4.6 million. Weeks 25% 10 Months 49% 0 Years 1% Compromise to Unsure 0% Discovery Phishing Phishing Hosts • Attackers lure Web users to fake websites by using authentic-looking emails and real logos Purpose : Steal user names, passwords, personal info, introduce a virus attack Phishing Hosts Pharming Hacker’s attack to redirect a legitimate website’s traffic to a fraudulent website . Hard to tell the difference? Hacker gets paid by the click. The primary difference is URL address . 2 2 Malware Virus Malware – MAL icious soft WARE Designed to infiltrate and damage a Virus – a computer program that computer system infects a computer and copies itself. - Viruses A virus spreads: - Trojan Horses - Network or Internet (email, Web sites) - Spyware - Infected files on a file network system - Worms - Floppy Disk, CD or USB drive Trojan Horse Spyware Trojan Horse - a malicious program Spyware – program that secretly monitors concealed in something innocuous or desirable (free music downloads) the user's Internet behavior Invites user to run it, but conceals a harmful payload, such as a keystroke logger Examples include: Six main types of Trojan Horse Payloads: - Remote Access - Monitoring Internet surfing habits - Data Destruction - Downloader - Installing additional software - Server Trojan - Redirecting web browser activity - Security Software Disabler - Denial of Service Attack - Change computer settings Worms - A self-replicating computer program Clear and Present Danger - Uses a network to make copies of itself onto other networks is in the - Causes harm to a network , not an individual computer New Trends - Does not need to attach itself to an existing program 3 3 Criminals now target Why Attack Websites? • End users on individual computers through the Web • Specific websites • Social networking websites, e.g. MySpace, Facebook 1. Websites & end users’ computers are • Specific organizations less likely to be found and quickly fixed • Industry segments 2. Look at the NUMBERS! Facebook Exploitation Facebook has 400,000,000 members! “Computer users have been conditioned not to open an attachment from an e-mail or click a link found within, but won't think MySpace has 100,000,000+ twice about checking out a hot new video linked to by a trusted friend on Facebook." “Later, the cyber-criminals used Alice's company logon to slip deep March 4, 2010 inside the financial firm's network, where they roamed for two weeks . They had managed to grab control of two servers, and were probing deeper, when they were detected. How cyber-criminals invade social networks, companies “The attackers reviewed the hourly keystroke reports from Alice's “"Hey Alice, look at the pics I took of us last weekend at the picnic. laptop and took note when she logged into a virtual private network Bob" account to access her company's network. With her username and “That Facebook message, sent last fall between co-workers at a large password, the attackers logged on to the bank’s network and roamed U.S. bank, rang true enough. Alice had attended a picnic with Bob, around it for two weeks. who mentioned the outing on his Facebook page. “So Alice clicked on the accompanying Web link, expecting to see “First they ran a program, called a port scan, to map out key network Bob's photos. But the message had come from thieves who had connection points . Next they systematically scanned all of the hijacked Bob's Facebook account. And the link carried an infection, company's computer servers looking for any that were not current on a keystroke logger designed to save everything she typed at her Windows security patches. Companies often leave servers unpatched, keyboard. Once an hour it sent a text file of her keystrokes to a free relying on perimeter firewalls to keep intruders at bay. The attackers Gmail account controlled by the attacker. eventually found a vulnerable server, and breached it , gaining a www.usatoday.com/money/industries/technology/2010-03-04-1Anetsecurity04_CV_N.htm foothold to go deeper when they were discovered.” 4 4 Facebook Exploitation Black Market Advertising Goods and Current Current Previous Previous Price Range Services Rank % Rank % 22% 21% “Stolen credentials flow into eBay-like hacking forums where Bank accounts 1 2 $10 – $1000 Credit cards 2 13% 1 22% $0.40 – $20 a batch of 1,000 Facebook user name and password pairs, Full identities 3 9% 7 6% $1 – $15 guaranteed valid, sells for $75 to $200, depending on the Online auction 4 7% N/A N/A $1 – $8 number of friends tied to the accounts. site accounts Scams 5 7% 8 6% $2.50 – $50 per week for hosting; $25/ design “From each account, Cyber-scammers can scoop up e-mail Mailers 6 6% 4 8% $1 – $10 addresses, contact lists, birth dates, hometowns, mothers' Email addresses 7 5% 5 6% $0.83 – $10 per Mb 5% 8% maiden names, photos and recent gossip — all useful for Email passwords 8 3 $4–$30 Drop 9 5% N/A N/A 10% – 50% of total targeting specific victims and turning his or her PC into an (request or offer) amount 5% 6% obedient bot.” Proxies 10 6 $1.50 – $30 Bots and Botnets Bots Statistics Bots are programs secretly installed on a computer, allowing a malicious user to control it remotely. Symantec: Bot-infected computers Visiting a website, downloading files, opening links, attachments, or images in spam email can install Year End 2007 = 5,000,000 hidden “bot” software Botnets are a large number of computers controlled Year End 2008 = 10,000,000 by a single attacker Year End 2009 = Moooooore! Can be used to launch coordinated attacks Can be updated to perform new functions Future Trends February 19, 2010 1. The release rate of malicious code may exceed that Trove of 68,000 stolen log-ons in hands of 'amateur' hackers of legitimate software applications 2. Portable storage devices “In four weeks in early 2010, cyber-thieves’ USB flash thumb drives, known as the Kneber gang, pilfered 68,000 Portable audio and video players account log-ons from 2,411 companies, Digital picture frames with Internet connectivity including user names and passwords for 3. Thieves aim to get into manufacturing stream 3,644 Facebook accounts.” 4.Now, 40% of malicious code copy themselves to removable media www.usatoday.com/money/industries/technology/2010-03-04-1Anetsecurity04_CV_N.htm 5 5 Verizon : “End-users and IT administrators continue to Why Does It Matter? be the culprits behind most internal breaches. two- thirds were the result of deliberate action and the rest were unintentional. While it’s tempting to infer that They will steal your money . And your life! administrators acted more deliberately and maliciously than end-users and other employees, the evidence • Company in the Midwest does not support this conclusion. The ratio was • CFO got a virus; had her keystrokes captured roughly equal between them. • Thief logged into bank using CFO’s bank log on “It is worth noting that both cases involving senior • Sent $160,000 ACH credits to controlled accts management were the result of deliberate action which was taken after the person was terminated. • Money was wired out of country the next day We also noticed several other breaches in the • Company discovered the transfer 11 days later caseload were perpetrated by recently terminated • Bank denied their claim for reimbursement employees. Anti-Virus, Anti-Spyware Software Software to identify, neutralize or eliminate malicious code - Monitors behavior of all programs. If one tries to activate an executable Solutions program, it will alert the user AVG, Webroot Spy Sweeper, Kaspersky, BitDefender, Norton Internet Security 2009 is no longer a resource hog! FIREWALLS Authentication Tools Multi-Factor Authentication: Using more than one A firewall is different than anti-virus and anti- factor to identify users accessing computers, networks spyware software, which removes or and applications quarantines viruses. - Encryption A properly-configured firewall helps make you - Digital Certificates invisible on the Internet and blocks incoming - Tokens communications from unauthorized sources. - Biometrics - Knowledge-based options 6 6 Encryption Digital Certificates Encryption: Uses algorithms to convert data into a form Digital Certificates: an electronic "credit card" that cannot be easily deciphered or understood by issued by a certification authority that establishes unauthorized people.