Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

Cybercriminals Ready for Banner Holiday Shopping Season

Black Friday and Cyber Monday will kick off a record run for online fraudsters, researchers say

Two days before Black Friday, and cybercriminals are on the brink of some of the best hunting they've ever had, according to companies that study the retail security market.

In the last week, several researchers have released their studies predicting cybercrime trends for the impending holiday shopping season. Unless you're a criminal, the news isn't good.

The cost of cyber fraud will rise to $3.6 billion this holiday season, up from $3.1 billion in 2006, according to the annual study conducted by CyberSource, an e-payment and risk management vendor. The percentage of fraudulent transactions will stay about the same -- around 1.4 percent -- but the costs of handling those incidents is rising, and the total volume of fraud is expected to increase along with the volume of online shopping, CyberSource says.

"The picture is one of merchants swimming harder against an accelerating current," says Doug Schwegman, director of customer and market intelligence at CyberSource.

And there's no indication that end users will behave more responsibly or intelligently than they have in past years, according to a new report from Webroot Software, a maker of anti-spyware and other security applications for consumers and small businesses.

Almost 70 percent of consumers say they have "no concern" about online transaction security, according to the Webroot report. Only 20 percent said they will alter their online shopping behavior because of security threats, and 30 percent said they will not check their credit reports to see if they have a problem.

"With high percentages of online shoppers using their credit and debit cards unaware of the security risks or necessary precautions, it's going to be open season for cyber criminals," said Mike Irwin, COO at Webroot.

Some cybercriminals save up their new exploits for the holidays, Irwin suggested. "Last year, we saw a 173 percent spike in spyware in the October to December time frame," he said. "Twenty percent of that spike involved new malware. Clearly, these thieves are literally breaking out their finest new malware for the season."

Security vendor Sophos predicts that the number of online shoppers will rise again this year, from 71 percent of computer users last year to 73 percent this year. The company warned consumers and businesses to be wary of fraud during the holiday season.

"Cybercriminals are becoming craftier and smarter in the ways they exploit consumers to steal their personal information," said Mike Haro, senior security analyst for Sophos. "This holiday season, consumers should be more prepared and aware of the risks, especially as these crimes have been reported quite heavily in the news. Having the right line of defense in place and knowing what signs to look out for will help online shoppers to avoid potential credit card fraud and identity theft."

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.

  • CyberSource Corp.
  • Sophos plc
  • Webroot Software Inc.

    Tim Wilson is Editor in Chief and co-founder of Dark Reading.com, UBM Tech's online community for information security professionals. He is responsible for managing the site, assigning and editing content, and writing breaking news stories. Wilson has been recognized as one ... View Full Bio

    Comment  | 
    Print  | 
    More Insights
  • Comments
    Newest First  |  Oldest First  |  Threaded View
    Cybersecurity Industry: It's Time to Stop the Victim Blame Game
    Jessica Smith, Senior Vice President, The Crypsis Group,  2/25/2020
    Google Adds More Security Features Via Chronicle Division
    Robert Lemos, Contributing Writer,  2/25/2020
    Register for Dark Reading Newsletters
    White Papers
    Video
    Cartoon
    Current Issue
    6 Emerging Cyber Threats That Enterprises Face in 2020
    This Tech Digest gives an in-depth look at six emerging cyber threats that enterprises could face in 2020. Download your copy today!
    Flash Poll
    How Enterprises Are Developing and Maintaining Secure Applications
    How Enterprises Are Developing and Maintaining Secure Applications
    The concept of application security is well known, but application security testing and remediation processes remain unbalanced. Most organizations are confident in their approach to AppSec, although others seem to have no approach at all. Read this report to find out more.
    Twitter Feed
    Dark Reading - Bug Report
    Bug Report
    Enterprise Vulnerabilities
    From DHS/US-CERT's National Vulnerability Database
    CVE-2020-9431
    PUBLISHED: 2020-02-27
    In Wireshark 3.2.0 to 3.2.1, 3.0.0 to 3.0.8, and 2.6.0 to 2.6.14, the LTE RRC dissector could leak memory. This was addressed in epan/dissectors/packet-lte-rrc.c by adjusting certain append operations.
    CVE-2020-9432
    PUBLISHED: 2020-02-27
    openssl_x509_check_host in lua-openssl 0.7.7-1 mishandles X.509 certificate validation because it uses lua_pushboolean for certain non-boolean return values.
    CVE-2020-9433
    PUBLISHED: 2020-02-27
    openssl_x509_check_email in lua-openssl 0.7.7-1 mishandles X.509 certificate validation because it uses lua_pushboolean for certain non-boolean return values.
    CVE-2020-9434
    PUBLISHED: 2020-02-27
    openssl_x509_check_ip_asc in lua-openssl 0.7.7-1 mishandles X.509 certificate validation because it uses lua_pushboolean for certain non-boolean return values.
    CVE-2020-6383
    PUBLISHED: 2020-02-27
    Type confusion in V8 in Google Chrome prior to 80.0.3987.116 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.