Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Endpoint

11/30/2018
04:00 PM
Kelly Sheridan
Kelly Sheridan
Slideshows
Connect Directly
Twitter
LinkedIn
Google+
RSS
E-Mail
50%
50%

Holiday Hacks: 6 Cyberthreats to Watch Right Now

'Tis the season for holiday crafted phishes, scams, and a range of cyberattacks. Experts list the hottest holiday hacks for 2018.
Previous
1 of 7
Next

(Image: Andranik123 - stock.adobe.com)

(Image: Andranik123 stock.adobe.com)

It's the most wonderful time of the year – for holiday cheer, of course, but also for cybercriminals who use the season as leverage to manipulate their victims.

Like holiday music playing in department stores and decorations adorning your neighborhood, themed cyberattacks start around Thanksgiving and continue through Christmas. "These scams ride the wave of the holiday season, when users are more inclined to purchase online," explains Jerome Dangu, co-founder and CEO of Confiant, which has analyzed seasonal cyberattacks.

Most criminals aim to capitalize on the shopping frenzy that is the holiday season, and methods vary from victim to victim. Consumers are hit with fake delivery notices in phishing emails and credit card fraud; brands are targeted with malvertising campaigns and watering-hole attacks.

Holiday season cyberattacks are on pace to escalate by nearly 60% this season, states Carbon Black's Threat Analysis Unit (TAU) in this year's "Holiday Threat Report." Analysts considered the 2017 season for comparison: After Thanksgiving, notable security alerts spiked on Black Friday/Cyber Monday and continued at elevated levels through year's end.

Think you're safe after Christmas? Think again. The high point for seasonal crime happens in the days following Dec. 25, when people are taking advantage of post-holiday deals.

Here, cybercrime experts describe the threats that are top of mind for them during this year's holiday season. Read on to learn more about what you and your employees should watch for.

 

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio

Previous
1 of 7
Next
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
I 'Hacked' My Accounts Using My Mobile Number: Here's What I Learned
Nicole Sette, Director in the Cyber Risk practice of Kroll, a division of Duff & Phelps,  11/19/2019
DevSecOps: The Answer to the Cloud Security Skills Gap
Lamont Orange, Chief Information Security Officer at Netskope,  11/15/2019
Attackers' Costs Increasing as Businesses Focus on Security
Robert Lemos, Contributing Writer,  11/15/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Navigating the Deluge of Security Data
In this Tech Digest, Dark Reading shares the experiences of some top security practitioners as they navigate volumes of security data. We examine some examples of how enterprises can cull this data to find the clues they need.
Flash Poll
Rethinking Enterprise Data Defense
Rethinking Enterprise Data Defense
Frustrated with recurring intrusions and breaches, cybersecurity professionals are questioning some of the industrys conventional wisdom. Heres a look at what theyre thinking about.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-3311
PUBLISHED: 2019-11-21
Directory traversal vulnerability in the Loftek Nexus 543 IP Camera allows remote attackers to read arbitrary files via a .. (dot dot) in the URL of an HTTP GET request.
CVE-2013-3312
PUBLISHED: 2019-11-21
Multiple cross-site request forgery (CSRF) vulnerabilities in the Loftek Nexus 543 IP Camera allow remote attackers to hijack the authentication of unspecified victims for requests that change (1) passwords or (2) firewall configuration, as demonstrated by a request to set_users.cgi.
CVE-2013-3313
PUBLISHED: 2019-11-21
The Loftek Nexus 543 IP Camera stores passwords in cleartext, which allows remote attackers to obtain sensitive information via an HTTP GET request to check_users.cgi. NOTE: cleartext passwords can also be obtained from proc/kcore when leveraging the directory traversal vulnerability in CVE-2013-331...
CVE-2013-3314
PUBLISHED: 2019-11-21
The Loftek Nexus 543 IP Camera allows remote attackers to obtain (1) IP addresses via a request to get_realip.cgi or (2) firmware versions (ui and system), timestamp, serial number, p2p port number, and wifi status via a request to get_status.cgi.
CVE-2015-2793
PUBLISHED: 2019-11-21
Cross-site scripting (XSS) vulnerability in templates/openid-selector.tmpl in ikiwiki before 3.20150329 allows remote attackers to inject arbitrary web script or HTML via the openid_identifier parameter in a verify action to ikiwiki.cgi.