What is a cyber attack?

From virtual bank heists to semi-open attacks from nation-states, the last couple of years has been rough on IT security. 

A cyber attack is an attack launched from one or more computers against another computer, multiple computers or networks. Cyber attacks can be broken down into two broad types: attacks where the goal is to disable the target computer or knock it offline, or attacks where the goal is to get access to the target computer's data and perhaps gain admin privileges on it.

Josh Fruhlinger posting on CSO fills us in on cyber attacks using some of the major recent cyber attacks and analyses what we can learn from them.

Read his article - What is a cyber attack? Recent examples show disturbing trends

 

Wirecard and the missing €1.9bn

Surveillance, spear phishing and missing billions. 'At times I thought I was going crazy.' Journalist Dan McCrum explains the twists and turns behind the massive fraud.

Mobile Payments Surge Could Opens Door to New Era of Phishing Attacks

From The Csuite –

 
“The mobile payments industry continues to surge in volume - there is a risk that it will spark a new wave of phishing attacks suggests one industry specialists.

At Agari, we predict that the rapid adoption of new mobile payment systems will drive a spike in the volume of phishing emails aimed at payment customers in the later half of 2015.

Last year, our ‘State of Email Trust’ report, which measures the amount of fraudulent email sent using a company’s domain, revealed that the payments industry had a ThreatScore of under two until the second half of the year, when the number jumped up to 23 in Q3 and 39 in Q4.

This makes payments customers almost 13 times more likely to be attacked by malicious emails in Q4. European banks also saw their ThreatScore rise from 2 in Q1 to 30 in Q3.”

Read more>>


 

IBM uncovers new, sophisticated bank transfer cyber scam

From Reuters –

“IBM has uncovered a sophisticated fraud scheme run by a well- funded Eastern European gang of cyber criminals that uses a combination of phishing, malware and phone calls that the technology company says has netted more than $1 million from large and medium-sized U.S. companies.

The scheme, which IBM security researchers have dubbed "The Dyre Wolf," is small in comparison with more recent widespread online fraud schemes but represents a new level of sophistication.”

Read more>>

Carbanak Hackers Target Banks in $1bn Attack Campaign

From Info Security –

“Security experts have uncovered a major targeted attack campaign in which criminals infiltrated around 100 banks worldwide and made off with up to $1bn over a two-year period.

Interpol, Europol, local law enforcers and Kaspersky Lab worked together on the case.

They estimate that the hackers – who hail from Russia, Ukraine, Europe and China – stole up to $10m per raid, with each attack lasting between two and four months.

The attacks are said to begin with a classic spear phishing email sent to a bank employee, infecting them with the Carbanak malware.

Once in the bank’s internal network, the hackers searched for administrator machines which allowed them to monitor cash transfer activity. They were then able to mimic that same activity at a later stage to transfer money out to themselves, according to Kaspersky Lab.

Sometimes they used online banking or international e-payment systems to transfer the funds out to accounts in the US and China.

On other occasions they would hack a victim bank’s accounting systems, inflating customers’ account balances by adding some extra zeros and then stealing the extra funds via a fraudulent transaction.

A third method of stealing cash was apparently to program specific ATMs to dispense money at certain times and then arrange for a gang member to collect it.”

Read more>>

Spear Phishing: A Bigger Concern in 2015

From Bank Info Security -

“Spear phishing has been linked to numerous cyber-attacks this year, including the spring breach that compromised a remote server at JPMorgan Chase, as well as the point-of-sale and bank account attacks waged by the Russian crime ring known as Anunak.

Now, hackers are increasingly focusing their phishing campaigns against bank employees, rather than bank customers, says Jay McLaughlin, chief security officer for Austin, Texas-based Q2ebanking, an online banking platform provider.

"Instead of going after thousands of customers, they are going after the bank itself," he says. "And they are finding that they are really successful."

Hackers are targeting banking institution employees with convincing e-mails that fool them into clicking on malicious links - which ultimately compromise their credentials or other sensitive information - or trick them into providing details about accountholders and their accounts. This information is often used by hackers to take over customers' accounts to perpetrate fraud.”

Read more>>

Spear-Phishing: What Banks Must Do

From Bank Info Security

“Current Efforts to Protect Employees from Fraudsters Inadequate. The Federal Bureau of Investigation recently warned of an uptick in spear-phishing attacks targeting employees across numerous industries.

And the final results of Information Security Media Group's “2013 Faces of Fraud Survey” confirm that the financial services sector is among those seeing the increase in targeted phishing attacks.”

read more>>