Cybercrimes: an Unprecedented Threat to the Society

What is a Cybercrime?

Cybercrime, or computer-oriented crime, is the crime that involves computer and its network. The computer may have been used in the commission of a crime, or it may be the target. Cybercrimes can be defined as: "Offences that are committed against individuals or groups of individuals with a criminal motive to intentionally harm the reputation of the victim or cause physical or mental harm, or loss, to the victim directly or indirectly, using modern telecommunication networks such as Internet (networks including but not limited to Chat rooms, emails, notice boards and groups) and mobile phones (Bluetooth/SMS/MMS)".

Why are cyber-crimes becoming increasingly popular?

Graham Day author of Security in the digital world says: "Attackers are slowly discovering all the ways that devices can be used to attack others. As this knowledge develops, the number and sophistication of attacks also increase. Reports have found that phishing is the most usual type of attack  it alone approximates to 1.3 million organizations, there are several other types as well.

Key reasons behind the increasing demand of cybercrimes:

• Financial Gain: It is the primary motivation, as data privacy and confidentiality are the biggest fear to many organizations today. The cyber criminals can steal the data from a company and anonymously sell it to their competitors or black mail the parent company for ransom sum of money to retrieve their data back.
• Egotistical: If the attacker is not seeking for financial aid, then it might be for personal grievance or recognition and acknowledgement that they have better skill set.

Dr. Michael McGurie presented an impressive work on cybercrime study and estimated that it would generate minimum of $1.5 trillion this year, because it's hardly the entire story. He arrived at this figure by considering data from the financial industry and law enforcement and constructed an underestimated statistic which he termed it as "The current state of the play.

For his study he considered, cyber crime revenues directly arisng from computers and its networks where only considered and other categories like mass communication scams where omitted.

Cyber attack statistics:

In recent times, there is not only extensive amount of large-scale security breaches but they are varied in type and severity level as well. Some of the major cyber security attacks are:

1. In 2016, 3 billion Yahoo accounts were hacked in one of the biggest breaches of all time.
2. In 2016, Uber reported that hackers stole the information of over 57 million riders and drivers.
3. Attacks involving cryptojacking increased by 8,500 percent in 2017.
4. 100,000 groups in at least 150 countries and more than 400,000 machines were infected by the Wannacry virus in 2017, at a total cost of around $4 billion.

Cybersecurity costs:

The average expenditure on cybercrimes are increasing dramatically, to those companies who haven't made cybersecurity part of their regular budget are facing a huge consequence. Few of the major companies who have incurred heavy loss due to security breach are:

1. In 2017, cybercrime costs accelerated with organizations spending nearly 23 percent more than 2016 on average about $11.7 million. (Accenture)
2. Ransomware damage costs exceed $5 billion in 2017, 15 times the cost in 2015. (CSO Online)
3. The Equifax breach cost the company over $4 billion in total. (Time Magazine)

Cybersecurity facts and figures:

1. Ransomware detections have been more dominant in countries with higher numbers of internet-connected populations. The United States ranks highest with 18.2 percent of all ransomware attacks (Symantec).
2. Microsoft Office formats such as Word, PowerPoint and Excel make up the most prevalent group of malicious file extensions at 38 percent of the total. (Cisco).
3. Over 20 percent of cyber-attacks in 2017 came from China, 11 percent from the US and 6 percent from the Russian Federation. (Symantec).
4. By 2020, the estimated number of passwords used by humans and machines worldwide will grow to 300 billion.

Cybersecurity Risks:

1. The cyber risks have drifted from securing files to more dangerous once, specially for government organizations and companies:
2. 21 percent of all files are not protected in any way. (Varonis).
3. Ransomware attacks are growing more than 350 percent annually. (Cisco)
4. IoT attacks were up 600 percent in 2017. (Symantec)
5. 41 percent of companies have over 1,000 sensitive files including credit card numbers and health records left unprotected. (Varonis)
6. 70 percent of organizations say that they believe their security risk increased significantly in 2017. (Ponemon Institute's 2017 Cost of Data Breach Study)

Types of Cyber-attacks:

Malware:

Malware is a term used to describe malicious software, including spyware, ransomware, viruses, and worms. Malware breaches a network through a vulnerability, typically when a user clicks a dangerous link or email attachment that then installs risky software. Once inside the system, malware can do the following:

• Blocks access to key components of the network (ransomware).
• Installs malware or additional harmful software.
• Covertly obtains information by transmitting data from the hard drive (spyware)
• Disrupts certain components and renders the system inoperable.

One of the biggest ransomware attacks during recent times:

The WannaCry ransomware attack was a May 2017 worldwide cyberattack by the WannaCry ransomware crypto worm, which targeted computers running the Microsoft Windows operating system by encrypting data and demanding ransom payments in the Bitcoin cryptocurrency. The attack was estimated to have affected more than 200,000 computers across 150 countries, with total damages ranging from hundreds of millions to billions of dollars.

Phishing:

It is the practice of sending fraudulent communications that appear to come from a reputable source, usually through emails. Cybercriminals craft emails to fool a target into taking some harmful actions. The recipient might be tricked into downloading malware that's disguised as an important document, for instance, or urged to click on a link that takes them to a fake website where they'll be asked for sensitive information like bank usernames and passwords. Many phishing emails are relatively crude and emailed to thousands of potential victims, but some are specifically crafted for valuable target individuals to try to get them to part with useful information.

One of the major Phishing attacks during recent times:

World cup and vacation rentals attack: As the worlds best soccer players face off during finals, during the world cup in Russia, fans want to witness the game but unfortunately the tickets cost hit the sky. The scammers duped the fans with phishing emails stating that the tickets where free and a trip to Moscow at an economical price. It was very tempting for the fans and many of then clicked on the link and provided their personal information and banking details using which a humungous amount of money was looted

Denial of Service attack:

A denial-of-service attack floods systems, servers, or networks with traffic to exhaust resources and bandwidth. For instance, attackers might send so much traffic to a website or so many requests to a database that it overwhelms those systems ability to function, making them unavailable to anybody. A distributed denial of service (DDoS) attack uses an army of computers, usually compromised by malware and under the control of cybercriminals, to funnel the traffic towards the targets.

Recent DDoS attack: On February 28th, 2018 GitHub was harassed by DDoS. This ensuing DDoS attack generated a floor of internet traffic that peaked at 1.35 Terabits per second, making it the largest on record.

Man-in-the-middle-attack:

Man-in-the-middle (MitM) attacks, also known as eavesdropping attacks, occur when attackers insert themselves into a two-party transaction. Once the attackers interrupt the traffic, they can filter and steal data.

Two common points of entry for MitM attacks:

• On unsecure public Wi-Fi, attackers can insert themselves between a visitor's device and the network. Without knowing, the visitor passes all information through the attacker.
• Once malware has breached a device, an attacker can install software to process all of the victim's information.

SQL injection:

A Structured Query Language (SQL) injection occurs when an attacker inserts malicious code into a server that uses SQL and forces the server to reveal information it normally would not. In a SQL injection attack, a hacker will, for instance, write some malicious SQL commands into a web form that's asking for name and address information; if the web site and database aren't programmed correctly, the database will try to execute those commands and the confidentiality of the information is compromised.

Crypto-jacking:

It is a form of cyber-attack in which a hacker hijacks a target's processing power in order to mine cryptocurrency on the hacker's behalf. It has become an increasingly popular way for bad actors to extract money from targets in the form of cryptocurrency. The attackers will either install malware on the victim's computer to perform the necessary calculations, or sometimes run the code in JavaScript that executes in the victim's browser. There are several approaches such as, harnessing victims' machines to "mine": perform the computations necessary to update cryptocurrencies' blockchains, creating new tokens and generating fees in the process. These new tokens and fees are deposited to wallets owned by the attacker, while the costs of mining  electricity and wear and tear to computers  are borne by the victim.

Zero-day attack:

A zero-day exploit hits after a network vulnerability is announced but before a patch or solution is implemented. Attackers target the disclosed vulnerability during this window of time. Zero-day vulnerability threat detection requires constant awareness.

Consequences of cybercrime:

Internet, in particular, is a great tool for scammers and other miscreants, since it allows them to ply their trade while hiding behind a shield of digital anonymity. Cybercrime affects society in a number of different ways, both online and in the offline world. For instance, Cyber security for military applications is a paramount issue.

Identity Theft:

Becoming the victim of cyber crime can have a long-lasting effect on our lives as our privacy is compromised. Attackers may employ phishing and send false e-mails purporting to come from a bank or other financial institution. If the information is given then the scammer can play with the data and can cause huge damage. This type pf damage might take almost a year to fix it.

Security Costs:

Cyber criminals not only focus on large organizations but rather small and medium type of business. As they are vulnerable to attack as the complexity involved in cyber security levels in small and medium sized organization are not very complex as they are financially less empowered. Hence, the hackers make an attempt to steal company servers  and information or use the machines for their own purposes. It's never guaranteed that organization with higher security levels are safe but the probability of theft is lower, as they have multiple security levels. Once the company's data is breached there will be a huge data loss and also the company will take cautionary measures to upgrade the firewall system with the hope that they wouldn't encounter a similar situation again. During this process there is double the amount of money spent.

Damage to reputation:

After the attack, the company's reputation collapses down and customers lose faith on the organization. Even if the issue gets resolved the company will still carry the black mark, it would affect the organization in the for a long run.

Litigation:

If the organizations security is under threat and if the attacker could access the customer information which was supposed to be confidential, the organization could be sued for not implementing reasonable protection measures.

Ex: Due to the emergence of thousands of E-commerce companies which handle confidential bank information of the customers cyber security is of high priority.

These are some of the top reasons why Cyber security is becoming a top-priority investment in organizations.

What is Cyber Security and how does it combat the cybercrimes?

Cybersecurity is the practice of protecting systems, networks, and programs from digital attacks. These attacks are usually aimed at accessing, changing, or destroying sensitive information; extorting money from users; or interrupting normal business processes. Implementing effective cybersecurity measures is particularly challenging today because there are more devices than people, and attackers are becoming more innovative.

There are multiple layers of protection spread across many computers, networks, programs or data which are intended to be kept safe. In an organization the people, process and technology must all complement one another to create an effective defense system to combat cyber-attacks.

Some of the simple and economic ways to prevent cyber-attacks:

1. Train employees in cyber security principles.
2. Install, use and regularly update antivirus and antispyware software on every computer used in your business.
3. Use a firewall for your Internet connection.
4. Download and install software updates for your operating systems and applications as they become available.
5. Make backup copies of important business data and information.
6. Control physical access to your computers and network components.
7. Secure your Wi-Fi networks. If you have a Wi-Fi network for your workplace make sure it is secure and hidden.
8. Require individual user accounts for each employee.
9. Limit employee access to data and information and limit authority to install software.
10. Regularly change passwords.

Conclusion:

Due to the advancing technology, there are stems of vulnerability of some kind being induced with it. According to Gene Spafford "The only truly secure system is one that is powered off, cast in a block of concrete and sealed in a lead-lined room with armed guards - and even then, I have my doubts, which is very true. The only way to defend such cybercrimes are by educating people and building strong human firewalls and to safe.

Did you like this example?

1421

75