CAPE TOWN: Kaspersky Lab has shared the evolution of the digital threat landscape in the Middle East, Turkey and Africa (META) and worldwide during its annual Cyber Security Weekend, which took place in Cape Town, South Africa. Experts from Kaspersky Lab's Global Research & Analysis Team (GReAT) and featured experts discussed various topics and threats facing organizations and ordinary users nowadays, and shared the required steps to stay safe. Particular focus was laid on modern and emerging technologies such as IoT security, blockchain, and industry-specific threats that can have direct impact on business success and longevity.
Highlighted among the information shared was the META threat landscape during the first quarter of 2019. Kaspersky Lab reported more than 150 million malware attacks in Q1 alone, representing an average of 1.6 million attacks per day, and an alarming 108 percent increase over Q1 2018. With some of the highest mobile phone penetration rates in the world, it is no surprise that the META region also attracts a significant share of malware attacks targeted at mobiles. Mobile malware attacks in META in Q1 2019 numbered more than 368,000, an average of 4,098 per day, and a spike of 118 percent when compared to Q1 2018.
The META region also faced consistent attacks during Q1 2019 in areas such as:
Crypto-mining Malware: 3.16m attacks; daily average of 35k; 146 percent increase over Q1 2018
Phishing: 5.83m attacks; daily average of 64k; 334 percent increase over Q1 2018
Ransomware: 193k attacks; daily average of 2.1k; 18 percent decrease over Q1 2018
"A drop in ransomware incidents is a great showcase of the security consciousness that is growing in the META region. At the same time, we have to realize that if there are less ransomware attacks, malicious attention is being diverted elsewhere. Personal and organization-facing financial threats seem to be growing unabated, and we are using Cyber Security Weekend as a platform to strengthen awareness of new and emerging areas of vulnerability", said Amin Hasbini, Senior security Researcher, Global Research and Analysis Team at Kaspersky Lab.
Calling the continuing need for security awareness and education into clear relief, the Kaspersky Security Network cloud service statistics showed that an average of 27.3 percent of all users in the META region were affected by web threat incidents during Q1 2019. Saudi Arabia had the highest number of users (35.9 percent), while Namibia had the lowest (18.5 percent). Nearly half of all users (average 49.3 percent) in the META region have reported local threats (such as those spread in local networks, via USB/CD/DVD), with the highest concentration in Kenya (56.8 percent), and the lowest in South Africa (43.6 percent).
Users affected by malware in Q1 in META
At a more granular level, Kaspersky Lab revealed the threats faced by individual countries within the META region. This 'street-level' view shows that the threat landscape is not always uniform, and that some countries tend to experience more of certain types of threats than others. For instance, the UAE, with a population of 9 million, has experienced 1.1 million instances of phishing and 23 million instances of malware. Even so, from a numbers standpoint, Turkey takes pole position for incidents of phishing (1.24m), malware (39m), and mobile malware (87k).
Kaspersky Lab's CSW 2019 featured a panel discussion about cyber awareness and cyber education being the key element of building a sustainable protection for any organization - the human firewall. Baran Erdogan, Founder and CTO of Secure Computing, Turkey, who attended the event as an expert guest, commented: "Two major factors that are changing rapidly, significantly increase the need for cyber awareness. The first factor is that the attack perimeters are evolving. In the past IT centric security was mainly taken into consideration since users had limited access to IT resources from less complex interfaces."
"But now corporate data is accessed from everywhere including mobile devices and cloud, and any company that is willing to grow and develop, should make these opportunities accessible as much as possible. Second factor is that attack vectors are getting more complex and user centric. Cybercriminals are focusing on employees since it is much easier to penetrate cyber defense measures from inside of a company by leveraging employees without necessary awareness level rather than from outside," he added.
Recently launched Kaspersky Automated Security Awareness Platform (KASAP), which was also showcased at the event, aims at helping companies of any size to address gaps in employees' cybersecurity skills and knowledge, the online service aims to help companies boost the cyber-awareness of their employees enhancing training efficiency with micro learning, different lessons formats and continuous reinforcement.
Poor security controls
During Kaspersky Lab's annual Cyber Security Weekend 2019 that took place in Cape Town South Africa, Reuben Paul, a 13 year old, 7th grader known as the "Cyber Ninja", was able to hack into a drone, exposing the gaping holes in the security measures of millions of every day gadgets and technology devices, that are part of the Internet of Things (IoT).
Reuben demonstrated that he could disconnect a user from his drone and then take complete control of it by exploiting its insecure protocols. The drone hack performed by the 13 year old was a controlled stunt organized by Kaspersky Lab to highlight the urgent need for stricter measures from companies developing Internet of things related-devices such as drones, baby monitors, smart appliances, smart home devices, and connected toys.
Kaspersky Lab advises people to inquire about the security measures taken and to understand the associated risks before buying any connected device. While governments already have tight controls in place around devices such as drones, companies on the other hand, still need to take the security aspect more seriously.
"Many companies compete to get their connected products out to the market and the consumers at the fastest speed to start generating profit. However, doing so often means they overlook the security features or even completely ignore the security issues. Such devices can become lion's meat for hackers and if they fall prey, this could lead to invasion of privacy, loss of data, valuables and even life," said Maher Yamout, Senior Security Researcher at the Global Research and Analysis Team at Kaspersky Lab.
"It took me less than 10minutes to hack the drone and I managed to take full control of it. The insecurities in the drone are shared by other IoT devices. Now imagine if this had been done by cyber-criminals. If I can do it, who's not to say that more motivated cyber-criminals would not be able to do something very similar. The consequences could be disastrous," said Reuben Paul. "We need to reinvent cyber security because what we are doing so far is clearly not enough. It is important for manufacturers to implement security controls into their devices and not put consumers at risk!" he added. Reuben ended by cautioning, "Let us be careful that the Internet of Things does not become the Internet of Threats."
There are around seven billion internet-connected devices in the world according to data from IoT analytics, with the cyber security risk remaining phenomenal. The impacts of these hacks are seen already, with multiple IoT related security incidents happening around the world. Kaspersky Lab experts, therefore gathered to shed light on the consequences IoT threats as well as drone exploitation, whilst educating and raising awareness on potential dangers that could result due to such vulnerabilities.
SIM swap fraud
During Kaspersky Lab's annual Cyber Security Weekend that took place in Cape Town, South Africa, Kaspersky Lab experts discussed the wide spread growth of mobile payments across the globe and the many cyber risks that surround such technology. Especially the recent SIM swap fraud wave, which have become very common in Africa and the wider region. In South Africa this type of fraud more than double in the last year, according a report of South African Banking Risk Information Centre (SABRIC).
A SIM swap fraud happens when someone convinces your carrier to switch your phone number over to a SIM card that a criminal possesses. In some cases, there are carrier's employees working together with criminals. By diverting your incoming SMS messages, scammers can easily complete the text-based two-factor authentication checks that protect your most sensitive accounts in financial services, social networks, webmail services and instant messengers.
Many African countries are suited to mobile payment methods. In fact, research notes that at the end of 2017, there were 135 live mobile money services across the Sub-Saharan African region, with 122 million active accounts. While payment methods through mobiles offer a convenience that is hard to debate, Kaspersky Lab research shows that mobile payments and the banking system are suffering a wave of attack - mostly powered by SIM swap fraud - and people are losing their money as a result.
This type of attack is used to not only steal credentials and capture one-time passwords (OTPs) sent via an SMS, but also to cause financial damage to victims, resetting the accounts on financial services, allowing to the fraudsters access to currency accounts not only in banks but also in fintechs and credit unions. Fraudsters are also using it as way to steal money using WhatsApp, loading the messages in a new phone, contacting the victim's contacts asking for money, simulating an emergency situation.
"Despite financial inclusion services prospering, the flip side to this is that it opens up a world of opportunities to cybercriminals and fraudsters who are using the convenience a mobile phone offers to exploit and poke holes in a two-factor authentication processes. Frauds using SIM swap are becoming common in Africa and Middle East, affecting countries like South Africa, Turkey and UAE. Countries like Mozambique have experienced this firsthand. The implemented solution, by banks and mobile operators in Mozambique, as a result, is something I believe we must learn from and encourage other regions to investigate and apply, among other aspects, to mobile payment methods of the future - as a way to ensure that mobile phones do not become an enemy in our pockets," said Fabio Assolini, Senior Security Researcher of Kaspersky Lab.
The total money lost in the attacks varies by country: there are extreme cases, such as one in the United Arab Emirates, where one victim lost $ 1 million, while in South Africa one victim reported losing $ 20,000. "In average fraudsters can steal $2,500 to $3,000 per victim, while the cost to perform the SIM swap starts with $10 to $40", conclude Assolini.
In order to protect the growing mobile digital life and payment methods, Kaspersky Lab recommends the following key considerations:
Voice and SMS methods avoided as authentication methods for payments - OTPs in mobile apps like Google Authenticator or the use of physical tokens should be used.
Biometrics - there is no better authentication than that of a physical characteristic. Voice authentication is an option that can be investigated further.
An automated 'Your number will be deactivated' message - to be shared upon SIM swap request. This will support the user to report the activity, if it is not legitimate, faster.
Activate 2FA on WhatsApp-in an attempt to minimize WhatsApp hijacking, activating Two-factor authentication using a six-digit PIN on your device is critical. This supports the user in having an additional layer of security on the device.
MuddyWater's disguise
MuddyWater is an advanced threat actor that first surfaced in 2017. In October 2018, Kaspersky Lab reported on a major operation by MuddyWater, targeting governmental and telecom targetsentities in Saudi Arabia, Iraq, Jordan, Lebanon and Turkey as well as neighboring countries like Azerbaijan, Afghanistan and Pakistan. The malicious tools and infrastructure uncovered during this investigation show how the threat actor tried to confuse and distract investigators and the security industry - and also reveal a string of operational security failures that ultimately meant this approach failed.
In the first publicly available report on what happens to MuddyWater victims after initial infection, Kaspersky Lab researchers outline the various deception techniques implemented by the attackers. These include Chinese and Russian word strings in the malware code, the use of the filename 'Turk', as well as attempts to impersonate the RXR Saudi Arabia hacking group.
The attackers appear to have been fairly well equipped to achieve their intended goals. Most of the malicious tools discovered were relatively simple and expendable, Python and PowerShell-based tools, and were mainly developed in-house by the group. They seemed to have allowed the attackers flexibility to adapt and customize the toolset for victims.
"MuddyWater's ability to continuously adjust and enhance its attacks to adapt to changes in the Middle Eastern geopolitical scene, have made this group a solid adversary that keeps growing," said Mohamad Amin Hasbini, Head of Global Research & Analysis team for META at Kaspersky Lab. "We expect it to keep developing and to acquire additional tools, maybe even zero-days. Nevertheless, its multiple operational mistakes betray an element of weakness, and provide investigators with trails that lead to important information," he added.
Kaspersky Lab will continue to monitor the group's activities. Details of the latest threat actor activity is available to subscribers of Kaspersky Lab's private threat intelligence reports, which also include Indicators of Compromise (IOC) data and YARA rules to assist in forensics and malware-hunting.
By Islam Sharaa