Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

4/29/2019
04:40 PM
Connect Directly
Twitter
LinkedIn
Google+
RSS
E-Mail
50%
50%

Credit Card Compromise Up 212% as Hackers Eye Financial Sector

Financial services firms saw upticks in credential leaks and credit card compromise as cybercriminals go where the money is.

More than one-quarter of all malware attacks target the financial services sector, which has seen dramatic spikes in credential theft, compromised credit cards, and malicious mobile apps as cybercriminals seek new ways to generate illicit profits.

It's hardly surprising to learn attackers want money; what researchers highlight in IntSights' "Banking & Financial Services Cyber Threat Landscape Report" is what they look for and how they obtain it. The first quarter of 2019 saw a 212% year-over-year spike in compromised credit cards, 129% surge in credential leaks, and 102% growth in malicious financial mobile apps.

Banks and other financial services organizations were targeted in 25.7% of all malware attacks last year – more than any of the other 27 industries tracked. Researchers point to two key events that largely shaped the modern financial services threat landscape: the shutdown of cybercriminal forum Altenen and "Collections #1-5," a major global data leak earlier this year.

In January 2019, roughly 2.2 billion usernames and passwords were leaked on the Dark Web in an incident dubbed "Collections #1-5," named for the relatively bland file names containing the data. Researchers saw a major increase in leaked credentials during this time frame – credential leaks in the first quarter of 2019 nearly doubled those of any of the previous four quarters.

There was also the shutdown of Altenen, a major hub for buying and selling credit card data that was taken down in May 2018 when Israeli authorities arrested its manager. Researchers estimate Altenen facilitated fraud for more than 20,000 credit cards and $31 million in money laundering. Since it was taken down, new sites – including Altenen.nz – emerged in its place, but experts say it's unlikely any of the substitutes will grow to reach the scale of the original.

"That was a huge setback," says Hadar Rosenberg, white hat hacker and IntSights threat intelligence research analyst, of the Altenen shutdown. "That was the biggest black market that was selling credit cards. It was the most well-known, and everybody was using it." When asked whether Altenen.nz has the potential to replace Altenen, she says it "doesn't seem so right now."

Credential theft is a pervasive and dangerous threat in financial services, Accenture researchers note in a new report on industry threats. In 2018, more than 43,000 breaches across industries involved the use of customer credentials stolen from botnet-infected clients. Credential theft is a rapidly growing threat to enterprise networks, especially if cybercriminals gain access to the username and password of a privileged employee. With this level of access, they don't need malware to achieve their goals.

In addition to credential compromise, IntSights researchers saw 9,708 instances of exposed credit card data in the first quarter, marking a 212% increase year-over-year. The number of leaked credit cards continued to rise throughout 2018 and spiked in the first quarter of 2019, which Rosenberg says came as a surprise.

"You do expect that the industry would do more to mitigate this problem, but you still see where hackers are going," she says. "It's the easiest money for them."

Cybercriminals primarily use compromised credit card numbers to make small purchases, a tactic they can use to evade detection while generating nearly 10 times more "free money" than what the card is worth on the Dark Web. Credit card companies usually reimburse people affected by card fraud; as a result, cybercriminals see potentially big gains and little risk.

IntSights also noticed 102% growth in the frequency of malicious mobile applications since early 2018. More than one in three consumers are tricked by fake mobile apps, which include fraudulent banking apps that mimic apps from major companies. Researchers anticipate the risk of these apps will grow as consumers become more comfortable with mobile banking.

Malicious apps aside, cybercriminals are targeting financial firms with a range of tactics, the most common of which are malware (banking Trojans Adload, Atrpas, and Emotet), ransomware, ATM malware and card skimmers, and vulnerabilities in SS7, which attackers exploit to intercept text messages authorizing payments from bank accounts. The first publicly reported SS7 exploitation affected the UK-based Metro Bank in February 2019. While rare now, Rosenberg anticipates we may see more SS7 exploitation as hackers learn to understand it.

Related Content:

 

 

 

Join Dark Reading LIVE for two cybersecurity summits at Interop 2019. Learn from the industry's most knowledgeable IT security experts. Check out the Interop agenda here.

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
10 Ways to Keep a Rogue RasPi From Wrecking Your Network
Curtis Franklin Jr., Senior Editor at Dark Reading,  7/10/2019
The Security of Cloud Applications
Hillel Solow, CTO and Co-founder, Protego,  7/11/2019
Where Businesses Waste Endpoint Security Budgets
Kelly Sheridan, Staff Editor, Dark Reading,  7/15/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: "Jim, stop pretending you're drowning in tickets."
Current Issue
Building and Managing an IT Security Operations Program
As cyber threats grow, many organizations are building security operations centers (SOCs) to improve their defenses. In this Tech Digest you will learn tips on how to get the most out of a SOC in your organization - and what to do if you can't afford to build one.
Flash Poll
The State of IT Operations and Cybersecurity Operations
The State of IT Operations and Cybersecurity Operations
Your enterprise's cyber risk may depend upon the relationship between the IT team and the security team. Heres some insight on what's working and what isn't in the data center.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-3571
PUBLISHED: 2019-07-16
An input validation issue affected WhatsApp Desktop versions prior to 0.3.3793 which allows malicious clients to send files to users that would be displayed with a wrong extension.
CVE-2019-6160
PUBLISHED: 2019-07-16
A vulnerability in various versions of Iomega and LenovoEMC NAS products could allow an unauthenticated user to access files on NAS shares via the API.
CVE-2019-9700
PUBLISHED: 2019-07-16
Norton Password Manager, prior to 6.3.0.2082, may be susceptible to an address spoofing issue. This type of issue may allow an attacker to disguise their origin IP address in order to obfuscate the source of network traffic.
CVE-2019-12990
PUBLISHED: 2019-07-16
Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 allow Directory Traversal.
CVE-2019-12991
PUBLISHED: 2019-07-16
Citrix SD-WAN 10.2.x before 10.2.3 and NetScaler SD-WAN 10.0.x before 10.0.8 have Improper Input Validation (issue 5 of 6).