Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

6/26/2017
04:17 PM
Connect Directly
Twitter
LinkedIn
Google+
RSS
E-Mail
100%
0%

FBI Highlights BEC, Tech Support Scams, Ransomware Concerns

The 2016 Internet Crime Report found tech support fraud, business email compromise, and ransomware were major fraud categories last year.

Nearly $8 million was lost among victims of tech support scams, which exceeded 10,000 in 2016. It's one of last year's major fraud categories, along with business email compromise (BEC), ransomware, and extortion.

These numbers come from the FBI's Internet Crime Complaint Center (IC3), which recently published its 2016 Internet Crime Report. In the past year, the IC3 received 298,728 complaints with reported victim losses of more than $1.3 billion.

It's worth noting the IC3 states only about 15% of fraud victims in the United States report their crimes to law enforcement -- a small subset of the world's cybercrime targets.

The IC3 monitors BEC and Email Account Compromise (EAC) scams as a single crime type, acknowledging how the two have become increasingly similar. In BEC attacks, the attacker gains control over an executive's email and uses the account to steal money from the business.

BEC does not always involve transferring funds. In 2016, the IC3 discovered, these attacks evolved to include the compromise of legitimate business email accounts and requests for employees' personally identifiable information (PII) and W-2 forms.

In the last year, the IC3 received 12,005 BEC/EAC complaints amounting to more than $360 million in losses, making this the most expensive crime type by more than $1 million. Most victims of BEC/EAC are based in the US and may be hired to illegally transfer funds for others.

Earlier this year, the FBI issued an alert for the rise of BEC attacks and stated the average loss is $140,000 per incident. Researchers at Proofpoint found a 45% increase in email account compromises and email-account spoofing (in which an attacker creates an email account similar to that of the account holder) between October and December 2016.

"With more than $360 million lost in 2016, which is in addition to the billions already lost over the years, you would think that organizations would be more vigilant about defending their organizations against negligent insiders," says Christy Wyatt, CEO of Dtex Systems, noting how these scams have consistently proven successful for threat actors.

Businesses can make it tougher for cybercriminals to succeed by implementing a system of checks and balances for transferring money that goes beyond email authorization. They should also have insight into employee behaviors that can lead to security issues, and plan to address problems before they have major consequences.

 

Ransomware was another hot topic in the IC3 report. The organization received 2,673 ransomware complaints, which amounted to losses exceeding $2.4 million, in 2016.

While ransomware has been top-of-mind for security leaders following the massive WannaCry attack, it has been a growing cybercrime concern for far longer. Threat actors don't need to be technically advanced to launch potentially devastating attacks.

"It's a low barrier of entry to a highly effective attack," says John Pironti, president of IP Architects. "You don't have to be a sophisticated attacker to be effective now."

Basic security hygiene like access control management, patching and hardening systems, and monitoring traffic are all necessary to defend against ransomware he says. "Nobody wants to do it because it's not fun," he adds, but these steps are critical.

Research from Kaspersky indicates a rise in competition among ransomware actors, who are varying their techniques to remain effective. More threat actors are turning their attention to target ransomware attacks against businesses and specifically targeting financial organizations.

Experts anticipate ransomware on PCs will increase, albeit at a slower growth rate. Attacks are becoming increasingly targeted as cybercriminals recognize the profit gained from hitting businesses as opposed to individual users.

IC3 also put the spotlight on tech support scams, in which the attacker pretends to be associated with a software or security company and offers technical support. They obtain funds by taking control of the victim's device for ransom, installing viruses on the target device, accessing computer files containing personal data, or threatening to destroy the machine.

Last year the IC3 received 10,850 tech support fraud complaints amounting to losses exceeding $7.8 million.

The IC3 states older victims are most vulnerable to tech support scams; however, other research indicates targets are increasingly younger. A study of 1,000 adults, by Microsoft and the National Cyber Security Alliance (NCSA), found 17% of victims who engaged with fraudsters were older than 55, and 50% were between the ages of 18 and 34.

Related Content:

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Why Cyber-Risk Is a C-Suite Issue
Marc Wilczek, Digital Strategist & CIO Advisor,  11/12/2019
DevSecOps: The Answer to the Cloud Security Skills Gap
Lamont Orange, Chief Information Security Officer at Netskope,  11/15/2019
Unreasonable Security Best Practices vs. Good Risk Management
Jack Freund, Director, Risk Science at RiskLens,  11/13/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Navigating the Deluge of Security Data
In this Tech Digest, Dark Reading shares the experiences of some top security practitioners as they navigate volumes of security data. We examine some examples of how enterprises can cull this data to find the clues they need.
Flash Poll
Rethinking Enterprise Data Defense
Rethinking Enterprise Data Defense
Frustrated with recurring intrusions and breaches, cybersecurity professionals are questioning some of the industrys conventional wisdom. Heres a look at what theyre thinking about.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-19040
PUBLISHED: 2019-11-17
KairosDB through 1.2.2 has XSS in view.html because of showErrorMessage in js/graph.js, as demonstrated by view.html?q= with a '"sampling":{"value":"<script>' substring.
CVE-2019-19041
PUBLISHED: 2019-11-17
An issue was discovered in Xorux Lpar2RRD 6.11 and Stor2RRD 2.61, as distributed in Xorux 2.41. They do not correctly verify the integrity of an upgrade package before processing it. As a result, official upgrade packages can be modified to inject an arbitrary Bash script that will be executed by th...
CVE-2019-19012
PUBLISHED: 2019-11-17
An integer overflow in the search_in_range function in regexec.c in Oniguruma 6.x before 6.9.4_rc2 leads to an out-of-bounds read, in which the offset of this read is under the control of an attacker. (This only affects the 32-bit compiled version). Remote attackers can cause a denial-of-service or ...
CVE-2019-19022
PUBLISHED: 2019-11-17
iTerm2 through 3.3.6 has potentially insufficient documentation about the presence of search history in com.googlecode.iterm2.plist, which might allow remote attackers to obtain sensitive information, as demonstrated by searching for the NoSyncSearchHistory string in .plist files within public Git r...
CVE-2019-19035
PUBLISHED: 2019-11-17
jhead 3.03 is affected by: heap-based buffer over-read. The impact is: Denial of service. The component is: ReadJpegSections and process_SOFn in jpgfile.c. The attack vector is: Open a specially crafted JPEG file.