Money and Stuff

Lee este artículo en español

Today, in the second edition of What They’re Up to, I bring you the latest in cybercriminal activity.

Microsoft’s Tech Support

You’re working on your PC or laptop and you get a pop-up from Microsoft saying that a threat to your computer has been detected, and it has the 800-number to call. You call and a Microsoft tech support asks your permission to scan your equipment to see what’s going on, and they provide you a link to download scanning software from their site that will tell you, when run, what threat is currently in your computer. You install it, watch them checking out your PC , the tech person mentions that you have a good computer, and asks you what kind of browsing you’ve done recently (to find out what could have infected your computer, supposedly). They remind you –ironic- of the need to visit only trusted sites, and let you know that they can clean your computer for around $300.

It’s a very subtle scam. They make you, the victim, feel that you have a nice computer, worthy of fixing, and use your trust in a household name –Microsoft’s- to get you to pay and protect your equipment from a threat that never existed. The real Microsoft indicates that, to get read of this ‘malware scam’ all you have to do is maximize the window to its full size, and then close it at the X on the corner. It’s really just a normal pup-up window, no malware involved.

Ransomware as a service
As of late there’s been a lot of talk of denial of service attacks (DDOS) on very large online services providers, like the one that took place in late 2016, when Amazon, Google, Facebook, Netflix, and Twitter, among others, suffered saturation attacks that crippled their services for hours.

While these giants are getting all the media’s attention, there’s very little talk of the enormous threat that ransomware is to businesses worldwide. Practically any private individual with no prior programming knowledge is able to procure online, for around $100, a bit of ransomware software with easy-to-follow instructions that will allow him or her to extort money from businesses worldwide. And, according to statistics, the amount request in ransom is also on the rise. The average ransomware payment in 2015 was $294; at the end of 2016 it was up to $679. If you run your own business, or work at a small or medium business, please consider that this is a severe threat that should be addressed in your company’s business continuity plan. Here’s the Department of Justice downloadable report on the subject, complete with suggestions and plans of action for businesses. 

The Internet of Things as silent partner in crime

If you have any online activity, you know of last October’s global DDOS attack on providers, which lasted two days. What you might not know is that the success of such a large-scale attack relied heavily on the access to the IoT (internet of things) of unsuspecting people worldwide.

The Internet of Things is comprised of all the ‘smart’ devices that people have on their home

and/o office networks: the TV, the scanner copier, the router, DVR, CCTV cameras, touch screens, connected cars, the wearables, and so forth. They’re connected to your network and are capable of sending and receiving data, and not just to your computer or phone: once programmer with a special type of porgramming known as Mirai, they can become part of a global team of devices that executes attacks worldwide, from your home or office without your knowledge.

It’s logical to think that if you know nothing of this activity, you are not guilty of any crimes. While that is the case from a legal standpoint, it won’t stop an investigation on you if it happens, and you may receive a lifetime ban from the sites that were attacked using your network’s IoT.

Furthermore, experts warn that the Internet of Things is already being used to steal personal and financial data for identity theft and theft.

In order to protect your network, those very same experts recommend that, every time you add a device to your network, you change the password, and that you set reminders to change those password every six months.