Cyberscammers tapping into minds - Conmen get personal data from social media
<< You’ve been had: A user checking an SMS alert about an unauthorised credit card transaction.
PETALING JAYA: Cybercriminals are getting into your head.
Realising that victims are no longer falling for the ‘I’m a Prince who wants to deposit US$50mil (RM199mil) into your account’ e-mail, these syndicates have enlisted psychologists and behavioural experts to launch targetted attacks on companies, groups and individuals.
By going through their victims’ social media accounts, they learn more about their targets and are able to craft attractive e-mail, prompting them to respond.
Clicking on the link in the e-mail will download malware that encrypts your device. Computers, smartphones, smartwatches and any other network-connected device, can be locked by cybercriminals who will only release it for a fee, or “ransom”.
Such ransomware has reached our shores, with a total of 5,069 attacks in Malaysia last year, according to cybersecurity company Symantec Corporation.
“The new modus operandi uses social engineering, with the e-mail being crafted by Malaysians who know the local scenario and how to trigger emotional reactions,” Symantec (Asia Pacific and Japan) cyber security services senior director Peter Sparkes told Sunday Star.
For example, if they find out from Facebook that you went shopping, you could get an official-looking e-mail from a trusted source like a government body or postal department saying: ‘You’ve received a free gift from shopping at our KL outlet. Click this link to trace your parcel’.
“Or if they see you at a cycling event, the e-mail could say: ‘Thank you for participating. Click on the link for photos and videos of the ride’,” he said.
“To decrypt your device, they’ll ask for about US$200 (RM782) in virtual currency like Bitcoin, to bypass the banks,” Sparkes added.
Acknowledging this new threat, Malaysian Communications and Multimedia Commission (MCMC) strategic communication head Sheikh Raffie Abd Rahman urged the public to be more alert.
He said one of the most commonly used social engineering techniques was phishing attacks targetting online banking customers.
Such cases would be investigated by the police under the Computer Crimes Act 1997 or the Penal Code.
A total of 1,311 phishing websites have been blocked by the MCMC between last year and March 8.
This includes fake pages created to acquire personal information such as usernames, passwords, banking information and credit card details by masquerading as a trusted entity in an electronic communication.
CyberSecurity Malaysia (CSM) chief executive officer Dr Amirudin Abdul Wahab said the number of incidents reported to the CSM indicates the growing threat of ransomware here.
Revealing that local businesses are also targeted, he said the CSM will work together with international communities to share current information on ransomware threats and disseminate them to the public.
Malaysian Mental Health Association deputy president Datuk Dr Andrew Mohanraj said cybercriminals have become more sophisticated in their approach by enlisting psychologists.
“But whichever methods they use, there is an underlying modus operandi of appealing to human emotions of fear, greed, curiosity, loneliness, compassion or even spirituality,” he said.
By Christina Chin
and Yuen Meikeng The Star
Cybercriminals preying on gullible
Users beware! With cybercriminals leveling up, ransomware attacks are expected to spike here. Malaysians shouldn't let their guard down when it comes to personal information and should be on the lookout for online scams.
HE wasn’t the fastest, but Eugene (not his real name) feels like a champion after finishing his first marathon.
Posting a selfie he made public on his Facebook account, the 28-year-old later receives an e-mail congratulating him on the feat. “Click on this link to see more pictures and videos of the event,” says the e-mail, which appears to be sent from the organiser of the run.
Curious and hoping to see images of himself, Eugene clicks open the link on his laptop but instead, gets a message telling him his device is now locked. All his files have been encrypted and he can’t access them, including his work document to be submitted on Monday.
The only way he can retrieve them is to pay a hacker a ransom of US$300 (RM1,181) in Bitcoin currency. Such an incident, known as a ransomware attack, could very well happen to you if you are not careful.
To top it all off, these cases are expected to increase this year, with “very specific ransomware targeted very specifically at Malaysians” being detected, says Symantec (Asia Pacific and Japan) cyber security services senior director Peter Sparkes.
According to cybersecurity company Symantec Corporation, Malaysia ranks 47th globally, and 12th in the Asia Pacific and Japan region, in terms of ransomware attacks.
Last year, there were 5,069 ransomware attacks or 14 per day in Malaysia. But Sparkes foresees that these numbers will surge.
“Ransomware is very attractive because it makes lots of money. It’ll be big here in the coming months, probably averaging 20 attacks per day.
“We’ve seen a lot of smartphone attacks recently. They love WhatsApp because the best way to get someone to click on a link is if it comes from someone you know,” he says.
Sparkes describes such crypto ransomware as the latest, and most dangerous malware threat because it’s near impossible to get rid of.
He adds that the experience is very emotional because many people do not back up their data.
“For individuals, losing personal data like photos and videos is traumatic so most victims will pay. Some will even tell you how to infect your friends to decrease your ransom,” he reveals.
Ransomware hackers are also using help from psychologists and behavioural experts to study their victims on social media before sending them personalised messages to trigger a response.
But it is not just ransomware that needs to be taken seriously as Malaysians need to be vigilant over social media scams, with these two being named as key trends in the country now by Symantec Malaysia systems engineering director David Rajoo.
He says cybercrime is extremely widespread with one in three Malaysians surveyed having experienced it in the past year and 83% know of someone else who was a victim.
“Consumers here lost an average of 27 hours and about RM8.9bil over the past year, dealing with the fallout of online crime.
“The amount of personal data stored online continues to grow, and while this free flow of data creates immense opportunities, it also opens the doors to new risks,” he warns.
Cybercriminals preying on personal data are also a cause for concern here and globally.
Sparkes points out that personal assistants and those in human resources are popular targets because that’s how cybercriminals gain access into an organisation’s database.
“Take a hotel for example. I’d target the CEO’s personal assistant. All I need is 200,000 of their best guests. If I sold the details at US$50 (RM197), it’s pretty good money for a day’s work. HR staff’s another good one because they look at CVs,” he says.
Last year, 500 million personal information was breached globally. That, he says, is a conservative estimate.
Someone checks out your Facebook activities, creates a personalised e-mail to get you to click on a link, and that’s it.
Everytime you download an app on social media, you could be giving access to your life, he cautions.
Of 10.8 million apps analysed in 2015, three million were collecting way more information than necessary, Sparkes says.
“Cyber scammers are also making you call them to hand over your cash,” he adds.
They send fake warning messages to devices like smartphones, driving users to attacker-run call centers to dupe them into buying useless services.
The services industry is the most vulnerable sector in the country, attracting 72.4% of spear phishing attacks.
There was also a significant spam increase with Malaysia jumping up the global ranking from 44 in 2014 to 23 last year, he adds, lamenting how many still don’t realise that cybercrime is an industry.
Cybercriminals are professionals using very sophisticated tools and techniques.
“They work like any other legit organisation – it’s a 9am to 5pm job with weekends off, holidays and proper offices. A lot of users still think it’s 18-year-olds in the garage fooling around. Nothing could be further from truth. The guys sell info to the underground economy,” Sparkes says.
Syndicates only need three things – cheap broadband, a cyber-savvy workforce they can hire, and countries where cyber laws are weak. Asia Pacific and Japan has invested significantly to give their population access to the Internet, he adds, explaining the shocking rise of cybercrime.
“I’m particularly concerned about the senior citizens as many are just discovering the Internet. They’re very trusting and will download without questioning. People stress on being streetsmart, but it’s just as crucial to be cybersmart,” he feels.
By Christina Chin
and Yuen Meikeng The Star
Related story:
