DOCSLIB.ORG

2018 Payment Threats and Fraud Trends Report (EPC211-18V1.0)

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
2018 Payment Threats and Fraud Trends Report (EPC211-18V1.0) EPC211-18 Version 1.0 1 December 2018 [x] Public – [] Internal Use – [] Confidential – [ ] Strictest Confidence Distribution: 2018 PAYMENT THREATS AND FRAUD TRENDS REPORT This new edition of the threats trends report reflects the Abstract recent development concerning security threats and fraud in the payments landscape over the past year. Document EPC211-18 Reference Issue Version 1.0 Date of Issue 1 December 2018 European Payments Council. Cours Saint-Michel 30A, B-1040 Brussels. This document is public and may be copied or otherwise distributed provided attribution is made and the text is not used directly as a source of profit. Conseil Européen des Paiements AISBL– Cours Saint-Michel 30A, B-1040 Brussels Tel: +32 2 733 35 33 Fax: +32 2 736 49 88 Enterprise N° 0873.268.927 www.epc-cep.eu [email protected] Table of Contents Executive Summary ........................................................................................... 5 1 Document information .................................................................................. 7 1.1 Structure of the document ....................................................................... 7 1.2 References ............................................................................................. 7 1.3 Definitions ............................................................................................. 8 1.4 Abbreviations ....................................................................................... 11 2 General .................................................................................................... 14 2.1 About the EPC ...................................................................................... 14 2.2 Vision .................................................................................................. 14 2.3 Scope and objectives ............................................................................ 14 2.4 Audience ............................................................................................. 14 3 Main threats today ..................................................................................... 16 3.1 Social Engineering ................................................................................ 16 3.1.1 Definition ....................................................................................... 16 3.1.2 Fraud Description ............................................................................ 16 3.1.3 Impact & Context ............................................................................ 19 3.1.4 Suggested Controls and Mitigation ..................................................... 20 3.1.5 Final Considerations/Conclusions ....................................................... 21 3.2 Malware ............................................................................................... 21 3.2.1 Definition ....................................................................................... 22 3.2.2 Fraud Description ............................................................................ 23 3.2.3 Impact & Context ............................................................................ 23 3.2.4 Suggested Controls and Mitigation ..................................................... 24 3.2.5 Final Considerations/Conclusions ....................................................... 26 3.3 Advanced Persistent Threats (APTs) ........................................................ 26 3.3.1 Definition ....................................................................................... 26 3.3.2 Fraud description ............................................................................ 27 3.3.3 Impact & context ............................................................................ 31 3.3.4 Suggested Controls and Mitigation ..................................................... 32 3.3.5 Final Considerations/Conclusions ....................................................... 34 3.4 Mobile device related attacks.................................................................. 35 3.4.1 Attacks Targeting the Mobile Device .................................................. 37 3.4.2 SIM swapping ................................................................................. 43 3.4.3 Final Considerations/Conclusions ....................................................... 45 3.5 Denial of Service .................................................................................. 46 3.5.1 Definition ....................................................................................... 46 3.5.2 Fraud Description ............................................................................ 46 3.5.3 Impact & Context ............................................................................ 48 3.5.4 Suggested Controls and Mitigation ..................................................... 49 3.5.5 Final Considerations/Conclusions ....................................................... 50 EPC211-18v1.0 2018 Payment Threats and Fraud Trends Report Page 2 of 91 3.6 Botnets ............................................................................................... 51 3.6.1 Definition ....................................................................................... 51 3.6.2 Fraud Description ............................................................................ 51 3.6.3 Impact & Context ............................................................................ 53 3.6.4 Suggested Controls and Mitigation ..................................................... 59 3.6.5 Final Considerations ........................................................................ 62 3.7 Cloud Services and Big Data .................................................................. 63 3.7.1 Definitions ...................................................................................... 63 3.7.2 Fraud Description ............................................................................ 63 3.7.3 Impact & Context ............................................................................ 64 3.7.4 Suggested Controls and Mitigation ..................................................... 64 3.7.5 Final Considerations/Conclusions ....................................................... 66 3.8 Internet of Things (IoT) ......................................................................... 66 3.8.1 Definition ....................................................................................... 66 3.8.2 Fraud Description ............................................................................ 67 3.8.3 Impact & Context ............................................................................ 67 3.8.4 Suggested Controls and Mitigation ..................................................... 67 3.8.5 Final Considerations/Conclusions ....................................................... 68 3.9 Virtual currencies .................................................................................. 68 3.9.1 Introduction ................................................................................... 68 3.9.2 Types of Fraud ................................................................................ 69 3.9.3 Impact and context ......................................................................... 72 3.9.4 Suggested controls and mitigations ................................................... 72 3.9.5 Conclusions and final considerations .................................................. 73 3.10 Multi-vector attacks .............................................................................. 73 4 Payment fraud ........................................................................................... 74 4.1 Card related fraud ................................................................................. 74 4.1.1 Definition ....................................................................................... 74 4.1.2 Card Fraud Scenarios ....................................................................... 74 4.1.3 Current and New Payment Card Fraud Trends ..................................... 75 4.1.4 Suggested Controls and Mitigation ..................................................... 77 4.1.5 Final Considerations/Conclusions ....................................................... 78 4.2 ATM Fraud ........................................................................................... 78 4.2.1 Definition ....................................................................................... 78 4.2.2 Fraud description ............................................................................ 79 4.2.3 Current and new ATM fraud trends .................................................... 79 4.2.4 Suggested Controls and Mitigation ..................................................... 80 4.2.5 Final Considerations/Conclusions ....................................................... 81 4.3 SEPA Credit Transfer (including instant) and Direct Debit fraud .................. 81 5 Conclusions ............................................................................................... 83 Annex I – SEPA Payment Instruments ................................................................ 87 Annex II – Summary Threats versus Controls and Mitigations ................................ 89 EPC211-18v1.0 2018 Payment Threats and Fraud Trends Report Page 3 of 91 List of Tables Table 1: Bibliography ..................................................................................... 8 Table
Load more

Recommended publications
  • Iot Threats, Challenges and Secured Integration
    IoT Threats, Challenges and Secured Integration Christian Shink, p. eng., CSSLP System Engineer • Why IoT Devices? • Bot Attacks • 3 Botnets fighting over IoT Firepower • Secure IoT integration Why IoT Devices Internet of Things Internet working of physical devices, vehicles, buildings, … Devices embedded with electronics, software, sensors, actuators Network connectivity Any Path Any Service Any Network Anytime Any Business Any context Anyone Machinery Anybody Building energy Anything Management Any Device Healthcare Retail A Rapidly Growing Number of Connected Devices Copyright © 2017 Radware. All rights reserved. IoT is Highly Susceptible to Cyber Attacks IoT devices run an embedded or stripped-down version of the familiar Linux operating system. 1 Malware can easily be compiled for the target architecture, mostly ARM, MIPS, x86 internet-accessible, lots of (I)IoT and ICS/SCADA are deployed without any form of 2 firewall protection Stripped-down operating system and processing power leaves less room for security 3 features, including auditing, and most compromises go unnoticed by the owners To save engineering time, manufacturers re-use portions of hardware and software in different 4 classes of devices resulting in default passwords and vulnerabilities being shared across device classes and manufacturers Internet Security Trend report 2015 by Nexus guard: IoT is becoming a soft target for cyber-attack Copyright © 2017 Radware. All rights reserved. From the News “D-Link failed to take reasonable steps to secure its routers and IP cameras, potentially compromising sensitive consumer information” “The cameras aren’t designed to receive software updates so the zero-day exploits can’t be patched.” “We believe that this backdoor was introduced by Sony developers on purpose” Sources: 1.
    [Show full text]
  • DMARC and Email Authentication
    DMARC and Email Authentication Steve Jones Executive Director DMARC.org Cloud & Messaging Day 2016 Tokyo, Japan November 28th, 2016 What is DMARC.org? • DMARC.org is an independent, non-profit advocate for the use of email authentication • Supported by global industry leaders: Sponsors: Supporters: Copyright © 2016 Trusted Domain Project 2 What Does DMARC Do, Briefly? • DMARC allows the domain owner to signal that fraudulent messages using that domain should be blocked • Mailbox providers use DMARC to detect and block fraudulent messages from reaching your customers • Organizations can use DMARC to perform this filtering on incoming messages – helps protect from some kinds of phishing and “wire transfer fraud” email, also known as Business Email Compromise (BEC) • Encourage your partners/vendors to deploy inbound DMARC filtering for protection when receiving messages • More information available at https://dmarc.org Copyright © 2016 Trusted Domain Project 3 Overview Of Presentation •DMARC Adoption •Case Study - Uber •Technical Challenges •Roadmap Copyright © 2016 Trusted Domain Project 4 DMARC Adoption This section will provide an overview of DMARC adoption since it was introduced, globally and within particular country-specific top-level domains. It will also show how the DMARC policies published by top websites has evolved over the past two years. Copyright © 2016 Trusted Domain Project 5 Deployment & Adoption Highlights 2013: • 60% of 3.3Bn global mailboxes, 80% consumers in US protected • Outlook.com users submitted 50% fewer phishing
    [Show full text]
  • Security Now! #664 - 05-22-18 Spectreng Revealed
    Security Now! #664 - 05-22-18 SpectreNG Revealed This week on Security Now! This week we examine the recent flaws discovered in the secure Signal messaging app for desktops, the rise in DNS router hijacking, another seriously flawed consumer router family, Microsoft Spectre patches for Win10's April 2018 feature update, the threat of voice assistant spoofing attacks, the evolving security of HTTP, still more new trouble with GPON routers, Facebook's Android app mistake, BMW's 14 security flaws and some fun miscellany. Then we examine the news of the next-generation of Spectre processor speculation flaws and what they mean for us. Our Picture of the Week Security News Update your Signal Desktop Apps for Windows & Linux A few weeks ago, Argentinian security researchers discovered a severe vulnerability in the Signal messaging app for Windows and Linux desktops that allows remote attackers to execute malicious code on recipient systems simply by sending a message—without requiring any user interaction. The vulnerability was accidentally discovered while researchers–amond them Juliano Rizzo–were chatting on Signal messenger and one of them shared a link of a vulnerable site with an XSS payload in its URL. However, the XSS payload unexpectedly got executed on the Signal desktop app!! (Juliano Rizzo was on the beach when the BEAST and CRIME attacks occurred to him.) After analyzing the scope of this issue by testing multiple XSS payloads, they found that the vulnerability resides in the function responsible for handling shared links, allowing attackers to inject user-defined HTML/JavaScript code via iFrame, image, video and audio tags.
    [Show full text]
  • Research Report Email Fraud Landscape, Q2 2018
    2018 Q2 Email Fraud Landscape The Fake Email Crisis 6.4 Billion Fake Messages Every Day Email Fraud Landscape, Q2 2018 Executive Summary The crisis of fake email continues. Far from being merely a “social engineering” issue, fake email is a direct result of technical issues with the way email is implemented: It lacks a built-in authentication mechanism making it all too easy to spoof senders. However, this problem is also amenable to a technical solution, starting with the email authentication standards DMARC, SPF, and DKIM. For the purposes of this report, Valimail used proprietary data from our analysis of billions of email message authentication requests, plus our analysis of more than 3 million publicly accessible DMARC and SPF records, to compile a unique view of the email fraud landscape. Now in its third consecutive quarter, our report shows how the fight against fake email is progressing worldwide, in a variety of industry categories. Key Findings • 6.4 billion fake emails (with fake From: addresses) are sent worldwide every day • The United States continues to lead the world as a source of fake email • The rate of DMARC implementation continues to grow in every industry • DMARC enforcement remains a major challenge, with a failure rate of 75-80 percent in every industry • The rate of SPF usage continues to grow in every industry • SPF errors remain a significant problem • The U.S. federal government leads all other sectors in DMARC usage and DMARC enforcement www.valimail.com 2 2018 Q2 Email Fraud Landscape Life on Planet Email Email continues to be a robust, effective medium for communications worldwide, and it is both the last remaining truly open network in wide use as well as the largest digital network, connecting half the planet.
    [Show full text]
  • Large-Scale Malware Experiments
    LARGE-SCALE MALWARE EXPERIMENTS ... CALVET ET AL. LARGE-SCALE MALWARE • Unlike with in-the-wild experiments [1], there are fewer ethical or legal issues to deal with than when performing EXPERIMENTS: WHY, HOW, AND arbitrary attacks against infected computers. SO WHAT? • Having an in vitro environment provides us with a way to Joan Calvet, Jose M. Fernandez conduct computer security research in a scientifi c way: we École Polytechnique de Montréal, Montréal, Canada can reproduce experiments and test the effect of various independent variables. Email {joan.calvet, jose.fernandez}@polymtl.ca We decided to use the Waledac botnet as a fi rst experiment for the following reasons: Pierre-Marc Bureau ESET, Montréal, Canada • Thanks to prior reverse engineering [2], we had in-depth knowledge of this threat family. Email [email protected] • This malware does not replicate, thus limiting the risk of running an experiment that might get out of control. Jean-Yves Marion LORIA, Nancy, France • There exists a set of vulnerabilities in Waledac’s peer-to- peer protocol that were worth investigating. We wanted to Email [email protected] evaluate the impact of a mitigation scheme against the botnet. ABSTRACT 1.1 The Waledac case study One of the most popular research areas in the anti-malware The architecture of the Waledac botnet is split into four layers. industry (second only to detection) is to document malware The fi rst layer contains infected hosts with private IP addresses characteristics and understand their operations. Most initiatives that are referred to as spammers. They are essentially the are based on reverse engineering of malicious binaries so as to ‘worker’ bots and constitute approximately 80% of the botnet.
    [Show full text]
  • Internet of Things Botnet Detection Approaches: Analysis and Recommendations for Future Research
    applied sciences Systematic Review Internet of Things Botnet Detection Approaches: Analysis and Recommendations for Future Research Majda Wazzan 1,*, Daniyal Algazzawi 2 , Omaima Bamasaq 1, Aiiad Albeshri 1 and Li Cheng 3 1 Computer Science Department, Faculty of Computing and Information Technology, King Abdulaziz University, Jeddah 21589, Saudi Arabia; [email protected] (O.B.); [email protected] (A.A.) 2 Information Systems Department, Faculty of Computing and Information Technology, King Abdulaziz University, Jeddah 21589, Saudi Arabia; [email protected] 3 Xinjiang Technical Institute of Physics & Chemistry Chinese Academy of Sciences, Urumqi 830011, China; [email protected] * Correspondence: [email protected] Abstract: Internet of Things (IoT) is promising technology that brings tremendous benefits if used optimally. At the same time, it has resulted in an increase in cybersecurity risks due to the lack of security for IoT devices. IoT botnets, for instance, have become a critical threat; however, systematic and comprehensive studies analyzing the importance of botnet detection methods are limited in the IoT environment. Thus, this study aimed to identify, assess and provide a thoroughly review of experimental works on the research relevant to the detection of IoT botnets. To accomplish this goal, a systematic literature review (SLR), an effective method, was applied for gathering and critically reviewing research papers. This work employed three research questions on the detection methods used to detect IoT botnets, the botnet phases and the different malicious activity scenarios. The authors analyzed the nominated research and the key methods related to them. The detection Citation: Wazzan, M.; Algazzawi, D.; methods have been classified based on the techniques used, and the authors investigated the botnet Bamasaq, O.; Albeshri, A.; Cheng, L.
    [Show full text]
  • Acid-H1-2021-Report.Pdf
    AGARI CYBER INTELLIGENCE DIVISION REPORT H1 2021 Email Fraud & Identity Deception Trends Global Insights from the Agari Identity Graph™ © Copyright 2021 Agari Data, Inc. Executive Summary Call it a case of locking the back window while leaving the front door wide open. A year into the pandemic and amid successful attacks on GoDaddy1, Magellan Health², and a continuous stream of revelations about the SolarWinds “hack of the decade,” cyber-attackers are proving all too successful at circumventing the elaborate defenses erected against them³. But despite billions spent on perimeter and endpoint security, phishing and business email compromise (BEC) scams continue to be the primary attack vectors into organizations, often giving threat actors the toehold they need to wreak havoc. In addition to nearly $7.5 billion in direct losses each year, advanced email threats like the kind implicated in the SolarWinds case⁴ suggest the price tag could be much higher. As corroborated in this analysis from the Agari Cyber Intelligence Division (ACID), the success of these attacks is growing far less reliant on complex technology than on savvy social engineering ploys that easily evade most of the email defenses in use today. Sophisticated New BEC Actors Signal Serious Consequences Credential phishing accounted for 63% of all phishing attacks during the second half of 2020 as schemes related to COVID-19 gave way to a sharp rise in payroll diversion scams, as well as fraudulent Zoom, Microsoft and Amazon alerts targeting millions of corporate employees working from home. Meanwhile, the state- sponsored operatives behind the SolarWinds hack were just a few of the more sophisticated threat actors moving into vendor email compromise (VEC) and other forms of BEC.
    [Show full text]
  • SECURITY GUIDE with Internet Use on the Rise, Cybercrime Is Big Business
    SECURITY GUIDE With internet use on the rise, cybercrime is big business. Computer savvy hackers and opportunistic spammers are constantly trying to steal or scam money from internet users. PayPal works hard to keep your information secure. We have lots of security measures in place that help protect your personal and financial information. PayPal security key Encryption This provides extra security when When you communicate with Here’s you log in to PayPal and eBay. When PayPal online or on your mobile, how to get you opt for a mobile security key, the information you provide is we’ll SMS you a random 6 digit encrypted. This means it can only a security key code to enter with your password be read by you. A padlock symbol when you log in to your accounts. is displayed on the right side of your 1. Log in to your PayPal You can also buy a credit card sized web browser to let you know you account at device that will generate this code. are viewing a secure web page. www.paypal.com.au Visit our website and click Security to learn more. Automatic timeout period 2. Click Profile then If you’re logged into PayPal and My settings. Website identity verification there’s been no activity for 15 3. Click Get started beside If your web browser supports an minutes, we’ll log you out to help “Security key.” Extended Validation Certificate, the stop anyone from accessing your address bar will turn green when information or transferring funds 4. Click Get security key you’re on PayPal’s site.
    [Show full text]
  • Technical Brief P2P Iot Botnets Clean AC Font
    Uncleanable and Unkillable: The Evolution of IoT Botnets Through P2P Networking Technical Brief By Stephen Hilt, Robert McArdle, Fernando Merces, Mayra Rosario, and David Sancho Introduction Peer-to-peer (P2P) networking is a way for computers to connect to one another without the need for a central server. It was originally invented for file sharing, with BitTorrent being the most famous P2P implementation. Decentralized file-sharing systems built on P2P networking have stood the test of time. Even though they have been used to share illegal pirated content for over 20 years, authorities have not been able to put a stop to these systems. Of course, malicious actors have used it for malware for quite a long time as well. Being able to create and manage botnets without the need for a central server is a powerful capability, mostly because law enforcement and security companies typically take down criminal servers. And since a P2P botnet does not need a central command-and-control (C&C) server, it is much more difficult to take down. From the point of view of defenders, this is the scariest problem presented by P2P botnets: If they cannot be taken down centrally, the only option available would be to disinfect each of the bot clients separately. Since computers communicate only with their own peers, the good guys would need to clean all the members one by one for a botnet to disappear. Originally, P2P botnets were implemented in Windows, but developers of internet-of-things (IoT) botnets do have a tendency to start incorporating this feature into their creations.
    [Show full text]
  • An Introduction to Malware
    Downloaded from orbit.dtu.dk on: Sep 24, 2021 An Introduction to Malware Sharp, Robin Publication date: 2017 Document Version Publisher's PDF, also known as Version of record Link back to DTU Orbit Citation (APA): Sharp, R. (2017). An Introduction to Malware. General rights Copyright and moral rights for the publications made accessible in the public portal are retained by the authors and/or other copyright owners and it is a condition of accessing publications that users recognise and abide by the legal requirements associated with these rights. Users may download and print one copy of any publication from the public portal for the purpose of private study or research. You may not further distribute the material or use it for any profit-making activity or commercial gain You may freely distribute the URL identifying the publication in the public portal If you believe that this document breaches copyright please contact us providing details, and we will remove access to the work immediately and investigate your claim. An Introduction to Malware Robin Sharp DTU Compute Spring 2017 Abstract These notes, written for use in DTU course 02233 on Network Security, give a short introduction to the topic of malware. The most important types of malware are described, together with their basic principles of operation and dissemination, and defenses against malware are discussed. Contents 1 Some Definitions............................2 2 Classification of Malware........................2 3 Vira..................................3 4 Worms................................
    [Show full text]
  • View Presentation Slides
    www.staysafeonline.org Goal of 5-Step Approach Is Resilience Know the threats Detect problems Know what recovery and Identify and and respond quickly looks like and prepare Protect your assets and appropriately Thanks to our National Sponsors Corey Allert, Manager Network Security How to identify SPAM and protect yourself Corey Allert 8/14/2018 Confidential Definitions • Spam is the practice of sending unsolicited e-mail messages, frequently with commercial content, in large quantities to an indiscriminate set of recipients. • Phishing is a way of attempting to acquire sensitive information such as usernames, passwords and credit card details by masquerading as a trustworthy entity in an electronic communication. • Spoofing is e-mail activity in which the sender address is altered to appear as though the e-mail originated from a different source. Email doesn't provide any authentication, it is very easy to impersonate and forge emails. • Ransomware is a type of malware that prevents or limits users from accessing their system, either by locking the system's screen or by locking the users' files unless a ransom is paid 8/14/2018 Where does spam come from? • Spam today is sent via “bot-nets”, networks of virus- or worm-infected personal computers in homes and offices around the globe. • Some worms install a backdoor which allows the spammer access to the computer and use it for malicious purposes. • Others steal credentials for public or small company email accounts and send spam from there. • A common misconception is that spam is blocked based on the sending email address. • Spam is primarily identified by sending IP address and content.
    [Show full text]
  • Reporting, and General Mentions Seem to Be in Decline
    CYBER THREAT ANALYSIS Return to Normalcy: False Flags and the Decline of International Hacktivism By Insikt Group® CTA-2019-0821 CYBER THREAT ANALYSIS Groups with the trappings of hacktivism have recently dumped Russian and Iranian state security organization records online, although neither have proclaimed themselves to be hacktivists. In addition, hacktivism has taken a back seat in news reporting, and general mentions seem to be in decline. Insikt Group utilized the Recorded FutureⓇ Platform and reports of historical hacktivism events to analyze the shifting targets and players in the hacktivism space. The target audience of this research includes security practitioners whose enterprises may be targets for hacktivism. Executive Summary Hacktivism often brings to mind a loose collective of individuals globally that band together to achieve a common goal. However, Insikt Group research demonstrates that this is a misleading assumption; the hacktivist landscape has consistently included actors reacting to regional events, and has also involved states operating under the guise of hacktivism to achieve geopolitical goals. In the last 10 years, the number of large-scale, international hacking operations most commonly associated with hacktivism has risen astronomically, only to fall off just as dramatically after 2015 and 2016. This constitutes a return to normalcy, in which hacktivist groups are usually small sets of regional actors targeting specific organizations to protest regional events, or nation-state groups operating under the guise of hacktivism. Attack vectors used by hacktivist groups have remained largely consistent from 2010 to 2019, and tooling has assisted actors to conduct larger-scale attacks. However, company defenses have also become significantly better in the last decade, which has likely contributed to the decline in successful hacktivist operations.
    [Show full text]