Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

4/29/2019
04:40 PM
Connect Directly
Twitter
LinkedIn
Google+
RSS
E-Mail
50%
50%

Credit Card Compromise Up 212% as Hackers Eye Financial Sector

Financial services firms saw upticks in credential leaks and credit card compromise as cybercriminals go where the money is.

More than one-quarter of all malware attacks target the financial services sector, which has seen dramatic spikes in credential theft, compromised credit cards, and malicious mobile apps as cybercriminals seek new ways to generate illicit profits.

It's hardly surprising to learn attackers want money; what researchers highlight in IntSights' "Banking & Financial Services Cyber Threat Landscape Report" is what they look for and how they obtain it. The first quarter of 2019 saw a 212% year-over-year spike in compromised credit cards, 129% surge in credential leaks, and 102% growth in malicious financial mobile apps.

Banks and other financial services organizations were targeted in 25.7% of all malware attacks last year – more than any of the other 27 industries tracked. Researchers point to two key events that largely shaped the modern financial services threat landscape: the shutdown of cybercriminal forum Altenen and "Collections #1-5," a major global data leak earlier this year.

In January 2019, roughly 2.2 billion usernames and passwords were leaked on the Dark Web in an incident dubbed "Collections #1-5," named for the relatively bland file names containing the data. Researchers saw a major increase in leaked credentials during this time frame – credential leaks in the first quarter of 2019 nearly doubled those of any of the previous four quarters.

There was also the shutdown of Altenen, a major hub for buying and selling credit card data that was taken down in May 2018 when Israeli authorities arrested its manager. Researchers estimate Altenen facilitated fraud for more than 20,000 credit cards and $31 million in money laundering. Since it was taken down, new sites – including Altenen.nz – emerged in its place, but experts say it's unlikely any of the substitutes will grow to reach the scale of the original.

"That was a huge setback," says Hadar Rosenberg, white hat hacker and IntSights threat intelligence research analyst, of the Altenen shutdown. "That was the biggest black market that was selling credit cards. It was the most well-known, and everybody was using it." When asked whether Altenen.nz has the potential to replace Altenen, she says it "doesn't seem so right now."

Credential theft is a pervasive and dangerous threat in financial services, Accenture researchers note in a new report on industry threats. In 2018, more than 43,000 breaches across industries involved the use of customer credentials stolen from botnet-infected clients. Credential theft is a rapidly growing threat to enterprise networks, especially if cybercriminals gain access to the username and password of a privileged employee. With this level of access, they don't need malware to achieve their goals.

In addition to credential compromise, IntSights researchers saw 9,708 instances of exposed credit card data in the first quarter, marking a 212% increase year-over-year. The number of leaked credit cards continued to rise throughout 2018 and spiked in the first quarter of 2019, which Rosenberg says came as a surprise.

"You do expect that the industry would do more to mitigate this problem, but you still see where hackers are going," she says. "It's the easiest money for them."

Cybercriminals primarily use compromised credit card numbers to make small purchases, a tactic they can use to evade detection while generating nearly 10 times more "free money" than what the card is worth on the Dark Web. Credit card companies usually reimburse people affected by card fraud; as a result, cybercriminals see potentially big gains and little risk.

IntSights also noticed 102% growth in the frequency of malicious mobile applications since early 2018. More than one in three consumers are tricked by fake mobile apps, which include fraudulent banking apps that mimic apps from major companies. Researchers anticipate the risk of these apps will grow as consumers become more comfortable with mobile banking.

Malicious apps aside, cybercriminals are targeting financial firms with a range of tactics, the most common of which are malware (banking Trojans Adload, Atrpas, and Emotet), ransomware, ATM malware and card skimmers, and vulnerabilities in SS7, which attackers exploit to intercept text messages authorizing payments from bank accounts. The first publicly reported SS7 exploitation affected the UK-based Metro Bank in February 2019. While rare now, Rosenberg anticipates we may see more SS7 exploitation as hackers learn to understand it.

Related Content:

 

 

 

Join Dark Reading LIVE for two cybersecurity summits at Interop 2019. Learn from the industry's most knowledgeable IT security experts. Check out the Interop agenda here.

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Limited-Time Free Offers to Secure the Enterprise Amid COVID-19
Curtis Franklin Jr., Senior Editor at Dark Reading,  3/31/2020
COVID-19: Latest Security News & Commentary
Dark Reading Staff 4/3/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
6 Emerging Cyber Threats That Enterprises Face in 2020
This Tech Digest gives an in-depth look at six emerging cyber threats that enterprises could face in 2020. Download your copy today!
Flash Poll
State of Cybersecurity Incident Response
State of Cybersecurity Incident Response
Data breaches and regulations have forced organizations to pay closer attention to the security incident response function. However, security leaders may be overestimating their ability to detect and respond to security incidents. Read this report to find out more.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-11586
PUBLISHED: 2020-04-06
An XXE issue was discovered in CIPPlanner CIPAce 9.1 Build 2019092801. An unauthenticated attacker can make an API request that contains malicious XML DTD data.
CVE-2020-11587
PUBLISHED: 2020-04-06
An issue was discovered in CIPPlanner CIPAce 9.1 Build 2019092801. An unauthenticated attacker can make an API request and get the content of ETL Processes running on the server.
CVE-2020-11589
PUBLISHED: 2020-04-06
An Insecure Direct Object Reference issue was discovered in CIPPlanner CIPAce 9.1 Build 2019092801. An unauthenticated attacker can make a GET request to a certain URL and obtain information that should be provided to authenticated users only.
CVE-2020-11590
PUBLISHED: 2020-04-06
An issue was discovered in CIPPlanner CIPAce 9.1 Build 2019092801. An unauthenticated attacker can make an HTTP GET request to HealthPage.aspx and obtain the internal server name.
CVE-2020-11591
PUBLISHED: 2020-04-06
An issue was discovered in CIPPlanner CIPAce 9.1 Build 2019092801. An unauthenticated attacker can make an API request and obtain the full application path along with the customer name.