Search This Blog
Powered by Blogger.

Blog Archive

Labels

Load More
Trendy Right Now

Popular Posts

Showing posts with label Cybersecurity Experts. Show all posts
VPN
2024 cyber crimes CISA Cyber crimes cybersecurity advisory Cybersecurity Experts Data Breach Data protection FBI IMF VPN

Rising Cybercrime Threats and Prevention Measures Ahead of 2024

 

According to projections from Statista, the FBI, and the IMF, the global cost of cybercrime is anticipated to experience a substantial increase. By 2027, it is estimated to surge to $23.84 trillion, marking a significant rise from the $8.44 trillion reported in 2022. 

Security expert James Milin-Ashmore, from Independent Advisor VPN, has provided a comprehensive list of 10 crucial guidelines aimed at enhancing digital safety by avoiding sharing sensitive information online. 

These guidelines serve as proactive measures to combat the rising threat of cybercrime and safeguard personal and confidential data from potential exploitation. 

1. Avoid Sharing Your Phone Number on Random Sites 

Sharing your phone number online can expose you to a range of security risks, warns an expert. Cybercriminals could exploit this information to gather personal details, increasing the likelihood of identity theft and other malicious scams: 

  • Subscriber Fraud: Scammers set up fake cell phone accounts with stolen info. 
  • Smishing: Fraudsters send text messages to trick victims into revealing data or visiting harmful sites.
  • Fake Call Frauds: Scammers pose as legitimate entities to extract sensitive information. 
  • Identity Theft: Phone numbers are exploited to commit financial fraud and impersonate individuals. 

2. Do Not Update Your Current Location 

It is not new or unknown that people share their current locations on social media handles however, experts caution against sharing personal addresses or current locations online, citing heightened risks of theft, stalking, and malicious online activity. 

Such information can be exploited to tailor phishing attempts, rendering them more convincing and increasing the likelihood of falling victim to scams. 

3. Do Not Post Your Holiday Plans 

As the holiday season approaches, many individuals may feel inclined to share their vacation plans on social media platforms. However, security experts are warning against this seemingly innocent practice, pointing out the potential risks associated with broadcasting one's absence from home. 

Announcing your vacation on social media not only informs friends and family of your whereabouts but also alerts criminals that your residence will be unoccupied. This information could make your home a target for burglary or other criminal activities. 

4. Do Not Take Risks of Sharing Password Online 

Passwords serve as the primary defense mechanism for safeguarding online accounts, making them crucial components of digital security. However, security expert emphasizes the importance of protecting passwords and refraining from sharing them online under any circumstances. Sharing passwords, regardless of the requester's identity, poses a significant risk to online security. 

Unauthorized access to sensitive accounts can lead to various forms of cybercrime, including identity theft, financial fraud, and data breaches. 

 5. Protect Your Financial and Employment Information 

Experts caution against sharing sensitive financial or employment details online, highlighting the potential risks associated with divulging such information. Financial details, including credit card numbers and bank account details, are highly sought after by online fraudsters. Similarly, sharing employment information can inadvertently provide criminals with valuable data for social engineering scams. 

 6. Protect Your ID Documentation 

Expert urges individuals to refrain from posting images of essential identification documents such as passports, birth certificates, or driver's licenses online. These documents contain sensitive information that could be exploited by identity thieves for various criminal activities, including opening unauthorized bank accounts or applying for credit cards. 

7. Stop Sharing Names of Your Loved Ones/Family/Pets 

Security experts advise against sharing personal details such as the names of loved ones or pets online. Hackers frequently attempt to exploit these details when guessing passwords or answering security questions. 

 8. Protect Your Medical Privacy 

Your medical history is a confidential matter and should be treated as such, caution experts. Sharing details about the hospitals or medical facilities you visit can inadvertently lead to a data breach, exposing personal information such as your name and address. 

 9. Protect Your Child's Privacy 

Expert warns against sharing information about your child's school online, as it can potentially put them at risk from online predators and expose them to identity theft. 

 10. Protect Your Ticket Information 

Expert advises against sharing pictures or details of tickets for concerts, events, or travel online. Scammers can exploit this information to impersonate legitimate representatives and deceive you into disclosing additional personal data. 

Furthermore, in 2023, the Internet Crime Complaint Center (IC3) reported a staggering surge in complaints from the American public. A total of 880,418 complaints were filed, marking a significant uptick of nearly 10% compared to the previous year. 

These complaints reflected potential losses exceeding $12.5 billion, representing a substantial increase of 22% in losses suffered compared to 2022. Also, according to the Forbes Advisors, Ransomware, Misconfigurations and Unpatched Systems, Credential Stuffing, and Social Engineering will be the most common threats in 2024.
Read more »
Technology
AAP AI Artificial Intelligence cryptocurrency scams cyber literacy Cybersecurity Experts Fraudsters Law Enforcement online financial scams Pacific Islands Social Media Technology

Analysis: AI-Driven Online Financial Scams Surge

 

Cybersecurity experts are sounding the alarm about a surge in online financial scams, driven by artificial intelligence (AI), which they warn is becoming increasingly difficult to control. This warning coincides with an investigation by AAP FactCheck into cryptocurrency scams targeting the Pacific Islands.

AAP FactCheck's analysis of over 100 Facebook accounts purporting to be crypto traders reveals deceptive tactics such as fake profile images, altered bank notifications, and false affiliations with prestigious financial institutions.

The experts point out that Pacific Island nations, with their low levels of financial and media literacy and under-resourced law enforcement, are particularly vulnerable. However, they emphasize that this issue extends globally.

In 2022, Australians lost over $3 billion to scams, with a significant portion involving fraudulent investments. Ken Gamble, co-founder of IFW Global, notes that AI is amplifying the sophistication of scams, enabling faster dissemination across social media platforms and rendering them challenging to combat effectively.

Gamble highlights that scammers are leveraging AI to adapt to local languages, enabling them to target victims worldwide. While the Pacific Islands are a prime target due to their limited law enforcement capabilities, organized criminal groups from various countries, including Israel, China, and Nigeria, are behind many of these schemes.

Victims recount their experiences, such as a woman in PNG who fell prey to a scam after her relative's Facebook account was hacked, resulting in a loss of over 15,000 kina.

Dan Halpin from Cybertrace underscores the necessity of a coordinated global response involving law enforcement, international organizations like Interpol, public awareness campaigns, regulatory enhancements, and cross-border collaboration.

Halpin stresses the importance of improving cyber literacy levels in the region to mitigate these risks. However, Gamble warns that without prioritizing this issue, fueled by AI advancements, the situation will only deteriorate further.
Read more »
SEC probe
class action lawsuits Cybersecurity Experts Cybersecurity Incident Data Breach insurance settlements MOVEit breach personal information exposure Progress Software SEC investigation SEC probe

Progress Software Confirms SEC Investigation into MOVEit Mass-Hack

 

U.S. securities regulators are delving into the widespread MOVEit hack, which has left the personal information of over 64 million individuals exposed, according to the creators of the affected software.

Progress Software revealed in a recent regulatory filing that it has received a subpoena from the U.S. Securities and Exchange Commission (SEC), requesting "various documents and information" regarding the MOVEit vulnerability. 

“The SEC investigation is a fact-finding inquiry, the investigation does not mean that Progress or anyone else has violated federal securities laws and the investigation does not mean that the SEC has a negative opinion of any person, entity, or security,” the filing added. “Progress intends to cooperate fully with the SEC in its investigation

In the same filing, Progress assured that it anticipates only a marginal financial impact from the MOVEit mass-hacks, despite the extensive scope of the breach.

The company outlined expenses of $1 million related to the MOVEit vulnerability, accounting for both received and anticipated insurance reimbursements of around $1.9 million.

Nevertheless, Progress cautioned that potential losses may still occur, as 23 affected clients have initiated legal proceedings against the company and are seeking indemnification. Additionally, 58 class action lawsuits have been filed by individuals claiming to be affected.

Although almost half a year has passed since the discovery of the MOVEit zero-day vulnerability, the precise number of affected MOVEit Transfer customers remains uncertain. Cybersecurity firm Emsisoft reports that 2,546 organizations have confirmed being impacted, affecting more than 64 million individuals.

Fresh cases continue to surface. Just last week, Sony acknowledged that over 6,000 employees had their data accessed in an incident related to MOVEit. Flagstar Bank also disclosed that more than 800,000 customer records were pilfered.

November Security Breach

In its filing, Progress Software disclosed incurring additional expenses of $4.2 million linked to a distinct cybersecurity incident in November of 2022.

The filing did not divulge specifics about the event. However, John Eddy, a spokesperson for Progress, representing the company through a third-party agency, verified that during that period, Progress Software had identified signs of unauthorized entry into its corporate network, including evidence of certain company data being exfiltrated. The incident was made public in December 2022.

Progress Software has not disclosed the types of data that were accessed or the number of individuals affected. Eddy informed TechCrunch that the company maintained full functionality throughout the 2022 incident, which was unrelated to any "recently reported software vulnerabilities."

The company affirmed that expenses associated with this incident primarily encompassed the engagement of external cybersecurity experts and other incident response professionals. It also noted that it received approximately $3 million in insurance settlements.
Read more »
Vulnerabilities and Exploits
Cyberattacks CyberCrime Cybersecurity Cybersecurity Experts Cyberthreats ENISA Software Software Supply Chain Vulnerabilities and Exploits

From Vulnerabilities to Vigilance: Addressing Software Supply Chain Attacks

 


Cybersecurity experts have long been concerned about the possibility of supply chain attacks mainly due to the chain reaction that can be triggered by just one attack on one supplier, which can lead to a compromise of the entire supply chain. 

Approximately 62% of the attacks carried out by attackers are done using malware as an attack technique. Cybersecurity professionals are probably better aware of malware than the average person who is not familiar with it. Malware is known worldwide due to the success of the program, which has thus made it a universal and ever-evolving threat to computer systems, networks, and organizations. 

It is estimated that around 150,000 new variants of malware were discovered in 2019 by experts. It is estimated that by 2020, this number will have increased to 270,000. Security teams need to stay up-to-date on the latest ways to prevent malware attacks within their organizations because the threat posed by malware grows every year.  

In the wake of the global pandemic, which disrupted many traditional business methods, the workforce became more dispersed. It relocated far from the traditional secure enterprise environments in which they would normally conduct business. 

As a result of a large and increasingly vulnerable attack surface that hackers have taken advantage of during this period of upheaval, they have launched a record number of software supply chain and ransomware attacks to take advantage of the opportunity. As a result of several recent attacks on supply chain companies (SolarWinds and Kaseya; Colonial Pipeline, NBA, and Kia Motors for ransomware), these companies have suffered significantly. 

It is estimated that the number of supply chain attacks will increase by four in 2021 in comparison to what it was in 2020, according to the European Union Agency for Cybersecurity (ENISA). According to research conducted by ENISA, 66% of attacks target the code of the target to steal information. 

What is a supply chain attack?

Supply chains are all the resources put together in a system that allows a product to be designed, manufactured, and distributed. A cybersecurity supply chain consists of hardware, software, and distribution mechanisms that can store and distribute data on a cloud or local system. 

Attacks targeting supply chains are a method of infiltrating a company's infrastructure, especially through third-party suppliers who can access sensitive data, which is becoming an increasingly common type of cyberattack. 

People mainly target software developers, service providers and technology providers. As a result of the above attacks, malicious actors have gained access to source code, development processes, or update mechanisms, to distribute malware to legitimate programs to spread their malicious code.  

A supply chain attack is one of the most effective methods of introducing malicious software into a target organization, especially if the business is large. A supplier or manufacturer's relationship with a customer is shaky, which is why supply chain attacks often rely on the trust between them and their customers.

 It is difficult to envisage how a cyberattack on a software supply chain would work but in general, it is a cyberattack that targets the software and service providers within the digital supply chain of an organization. 

These attacks are primarily designed to breach the security of target organizations by exploiting vulnerabilities or suppliers' systems to gain access to the data within them. An attack in this manner may damage an organization's reputation, as the attacker may be able to access sensitive data and resources, disrupt operations, or damage an organization's operations. 

Attackers exploit a wide variety of vulnerabilities during supply chain incidents, and exploitation methods that attackers use during these attacks come in a wide variety of forms. Trying to protect your business from supply chain threats is becoming increasingly difficult since supply chains can vary greatly from one industry to the next, and you must understand the most common attack paths you may identify and then deploy a multifaceted defence to combat them. 

Supply chain exploits are a serious problem because they have a variety of causes, including a range of vulnerabilities. In the first place, there does not appear to be any unified governance model that can consolidate all stakeholders in one place: developers, end users, customers, and senior management. 

It is common for software supply chain attacks to be caused by a weakness in one of the pipelines, services, applications, or software components that form the backbone of the software supply chain. Attacks targeting supply chains are unique in the sense that they typically begin with vulnerabilities found in third-party software, as opposed to your company's applications or resources that are vulnerable. 

Cyber threats are constantly evolving, so it is important to keep up to date. A policymaking system that can support policymakers and practitioners in gathering up-to-date and accurate information about the current threat landscape is essential, both for policymakers and practitioners. 

ENISA Threat Landscape is published annually in response to the need to provide a comprehensive overview of the threat landscapes around the world. According to these reports, based on publically available information, threats provide an independent evaluation of threats, threats agents, trends, and attack vectors as over the last nine months. 

To interact with the broad range of stakeholders, ENISA established an Ad-Hoc Working Group on Cyber Threat Landscapes to receive advice on methods for drawing cyber threat landscapes, including ENISA's annual Threat Landscape, and to design, update, and review the approach required to do so.  

Among the range fifth-generation, the agency analyses are artificial intelligence and fifth-generation networks, which are recent threats landscapes that the agency has been investigating. This report is aimed at identifying the nature of supply chain attacks that are taking place and to examine the possible countermeasures which can be taken to counter them. ENISA published this report in 2012 (and updated it in 2015) which looks at the possible countermeasures to these attacks.
Read more »
Subscribe to: Posts (Atom)