Connect with us

Featured

Cyber whaling rises in SA

Published

on

Whaling is much like phishing, but hackers target more lucrative targets. Also, unlike phishing, whaling involves targeting fewer individuals and with more specific attacks. SIMEON TASSEV, offers some tips to prevent a company from becoming a whaling target.

One of the largest online security threats to individuals and businesses today doesn’t come from new sophisticated malware tools, but rather from distinctly low-tech phishing and whaling campaigns. A recent survey of IT experts from the US, UK, South Africa and Australia exposed the reality that cyber threats are increasing both in volume and size, and that up to 55% of organisations have seen a rise in whaling email attacks over the last three months of 2015. What is the difference between whaling and phishing? Realistically, “whaling” is just another term for “phishing”, the difference between the two lies in the size of the fish, and thus “whaling” refers to bigger, more lucrative targets.

Whaling involves targeting fewer individuals but the attacks are more specific. Whereas phishing is based on volume, whaling is the opposite and targets a much smaller audience, which is usually an organisation’s “big phish”. These are usually high-value individuals whose credentials or access to data, if compromised, could endanger the entire business; which is why these kind of attacks are also called “Business Email Compromise” attacks. These kinds of threats are harder to detect because they are stealthier and fewer in number than widespread phishing campaigns.   Targets of choice for whalers include senior executives and high-level officials in private businesses, as well as those with privileged access to government information.

The anatomy of a whaling attack

Whaling attacks are generally directed at business executives at large organisations and the intention behind these attacks is to trick financial staff into making fraudulent wire transfers to bank accounts controlled by whalers. How do these attackers get it right? Their targeted campaigns typically involve emails that appear to be from the CEO, Chief Financial Officer or other senior executive to an individual within the company who holds the authority to make electronic transfers on behalf of the organisation.

These emails make use of compelling language that conveys a sense of urgency to get the recipient to act as quickly as possible in response to the email. An example of such an attack is where an email comes through, purportedly from the CEO, asking finance staff to rush through a payment to a supplier that the executive cannot handle because they are out of the office.

Attacks from the inside

Research shows that most whaling attacks pretend to be from the CEO (72%), while 36% had seen whaling emails attributed to the CFO, which means that this type of targeted attack relies on a significant amount of prior research into the targeted organisation to allow attackers to identify their target correctly and obtain the most successful result possible. Whalers do their research on corporate databases and make use of social networking sites like Facebook, LinkedIn and Twitter to trawl for information. It is because whaling emails rely on social engineering to trick their targets into doing something, rather than tricking them to click on a hyperlink or malicious attachment, that whaling emails are harder to detect when compared to phishing emails.

Protecting your company from whaling attacks

From an organisational point of view, such attacks can be approached with the same mindset applied for corporate espionage security, as they are essentially the same. The controls are still along the lines of anti-phishing technology which is linked to email, but because of the targeted nature of the whaling attack, it can be a lot more difficult for technology to pick up, which is why it’s important to add an awareness element to preventive measures taken.

This means educating senior management, key personnel and finance teams about this specific kind of attack and asking them to be more suspicious of requests received through email. While there are technologies that can be used to confirm, for example, the originator’s email, it is incumbent on the recipient to confirm or identify the source of communication before they take action on the email and to this end, finance team procedures will need to be reviewed in order to prevent whaling, specifically how payments to external third parties are authorised.

Furthermore, senior executives need to be careful what kind of contact information is available for them in the public domain. This means that a company should have a policy in place which refers to access control to and disclosure of senior personnel contact information. Realistically, someone may not have an issue giving a contact number for the help desk, but they should have an issue giving a contact number for their senior executives and access controls should be implemented to hinder information gathering tactics.

It is also advisable to make use of various technological measures that simplify the matter. In terms of validating the source of emails, like with phishing, whaling emails can have the source of the email description and the technical structure of the email validated, using targeted threat prevention solutions integrated with email security.  Also useful is inbound email stationery that marks and alerts personnel to emails that have come from outside the corporate network. Additionally, domain name registration alerts can be used to notify an organisation when domains are created that closely resemble that corporate’s domain, making it that much harder for a whaler to launch a successful attack from within.

  • Simeon Tassev, Director and QSA, Galix Networking

Featured

Tech promotes connections across groups in emerging markets

Digital technology users say they more regularly interact with people from diverse backgrounds

Published

on

Smartphone users – especially those who use social media – say they are more regularly exposed to people who have different backgrounds. They are also more connected with friends they don’t see in person, a Pew Research Center survey of adults in 11 emerging economies finds.

South Africa, included in the study, has among the most consistent levels of connection across age groups and education levels and in terms of cross-cultural connections. This suggests both that smartphones have had a greater democratisation impact in South Africa, but also that the country is more geared to diversity than most others. Of 11 countries surveyed, it has the second-lowest spread between those using smartphones and those not using them in terms of exposure to other religious groups.

Across every country surveyed, those who use smartphones are more likely than those who use less sophisticated phones or no phones at all to regularly interact with people from different religious groups. In most countries, people with smartphones also tend to be more likely to interact regularly with people from different political parties, income levels and racial or ethnic backgrounds. 

The Center’s new report is the third in a series exploring digital connectivity among populations in emerging economies based on nationally representative surveys of adults in Colombia, India, Jordan, Kenya, Lebanon, Mexico, the Philippines, Tunisia, South Africa, Venezuela and Vietnam. Earlier reports examined attitudes toward misinformation and mobile technology’s social impact

The survey finds that smartphone and social media use are intertwined: A median of 91% of smartphone users in these countries also use social media or messaging apps, while a median of 81% of social media users say they own or share a smartphone. And, as with smartphone users, social media and messaging app users stand apart from non-users in how often they interact with people who are different from them. For example, 52% of Mexican social media users say they regularly interact with people of a different income level, compared with 28% of non-users. 

These results do not show with certainty that smartphones or social media are the cause of people feeling like they have more diverse networks. For example, those who have resources to buy and maintain a smartphone are likely to differ in many key ways from those who don’t, and it could be that some combination of those differences drives this phenomenon. Still, statistical modelling indicates that smartphone and social media use are independent predictors of greater social network diversity when other factors such as age, education and sex are held constant. 

Other key findings in the report include: 

  • Mobile phones and social media are broadening people’s social networks. More than half in most countries say they see in person only about half or fewer of the people they call or text. Mobile phones are also allowing many to stay in touch with people who live far away: A median of 93% of mobile phone users across the 11 countries surveyed say their phones have mostly helped them keep in touch with those who are far-flung. When it comes to social media, large shares report relationships with “friends” online who are distinct from those they see in person. A median of 46% of Facebook users across the 11 countries report seeing few or none of their Facebook friends in person regularly, compared with a median of 31% of Facebook users who often see most or all of their Facebook friends in person. 
  • Social activities and information seeking on subjects like health and education top the list of mobile activities. The survey asked mobile phone users about 10 different activities they might do on their mobile phones – activities that are social, information-seeking or commercial in nature. Among the most commonly reported activities are casual, social activities. For example, a median of 82% of mobile phone users in the 11 countries surveyed say they used their phone over the past year to send text messages and a median of 69% of users say they took pictures or videos. Many mobile phone users are also using their phones to find new information. For example, a median of 61% of mobile phone users say they used their phones over the past year to look up information about health and medicine for themselves or their families. This is more than the proportion that reports using their phones to get news and information about politics (median of 47%) or to look up information about government services (37%). Additionally, around half or more of mobile phone users in nearly all countries report having used their phones over the past 12 months to learn something important for work or school. 
  • Digital divides emerge in the new mobile-social environment. People with smartphones and social media – as well as younger people, those with higher levels of education, and men – are in some ways reaping more benefits than others, potentially contributing to digital divides. 
    • People with smartphones are much more likely to engage in activities on their phones than people with less sophisticated devices – even if the activity itself is quite simple. For example, people with smartphones are more likely than those with feature or basic phones to send text messages in each of the 11 countries surveyed, even though the activity is technically feasible from all mobile phones. Those who have smartphones are also much more likely to look up information for their households, including about health and government services. 
    •  There are also major differences in mobile usage by age and education level in how their devices are – or are not – broadening their horizons. Younger people are more likely to use their phones for nearly all activities asked about, whether those activities are social, information-seeking or commercial. Phone users with higher levels of education are also more likely to do most activities on their phones and to interact with those who are different from them regularly than those with lower levels of education. 
    •  Gender, too, plays a role in what people do with their devices and how they are exposed to different people and information. Men are more likely than women to say they encounter people who are different from them, whether in terms of race, politics, religion or income. And men tend to be more likely to look up information about government services and to obtain political news and information. 

These findings are drawn from a Pew Research Center survey conducted among 28,122 adults in 11 countries from Sept. 7 to Dec. 7, 2018. In addition to the survey, the Center conducted focus groups with participants in Kenya, Mexico, the Philippines and Tunisia in March 2018, and their comments are included throughout the report. 

Read the full report at https://www.pewinternet.org/2019/08/22/in-emerging-economies-smartphone-and-social-media-users-have-broader-social-networks.

Continue Reading

Featured

Nokia to be first with Android 10

Published

on

Nokia is likely to be the first smartphone brand to roll out Android 10, after its manufacturer, HMD Global, announced that the Android 10 software upgrade would start in the fourth quarter of 2019.

Previously named Android Q, it was given the number after Google announced it was ditching sweet and dessert names due to confusion in different languages. Android 10 is due for release at the end of the year.

Juho Sarvikas, chief product officer of HMD Global said: “With a proven track record in delivering software updates fast, Nokia smartphones were the first whole portfolio to benefit from a 2-letter upgrade from Android Nougat to Android Oreo and then Android Pie. We were the fastest manufacturer to upgrade from Android Oreo to Android Pie across the range. 

“With today’s roll out plan we look set to do it even faster for Android Pie to Android 10 upgrades. We are the only manufacturer 100% committed to having the latest Android across the entire portfolio.”

HMD Global has given a guarantee that Nokia smartphone owners benefit from two years of OS upgrades and 3 years of security updates.

Continue Reading

Trending

Copyright © 2019 World Wide Worx