Transatlantic Cable podcast episode 339 | Kaspersky official blog

/in

Episode 339 of the Transatlantic Cable podcast kicks off with news that several employees in TikTok were caught covertly spying on Forbes journalists. From there, the team talk about a new cooperation between governments to better tackle spyware and news that the FTC is looking at the upcoming Reddit IPO and AI training data.

To close out the podcast, the team discuss news that ‘at least 900’ websites built using Google’s FireBase cloud database may be leaking sensitive user data.

If you liked what you heard, please consider subscribing.

TikTok Spied On Forbes Journalists
Finland, Germany, Ireland, Japan, Poland, South Korea added to US-led spyware agreement
FTC investigating Reddit plan to sell user content for AI model training
900+ websites and expose millions of passwords via Firebase

Kaspersky official blog – ​Read More

What is SIM swapping, and how does it threaten business? | Kaspersky official blog

/in

Today’s topic is SIM swap fraud, aka SIM swapping. This attack method is far from new but remains a live threat because of how effective it is. SIM swapping attacks pose a serious danger to business because they enable threat actors to gain access to corporate communications, accounts, and sensitive information like financial data.

What is SIM swapping?

SIM swapping is an attack method for hijacking a mobile phone number and transferring it to a device owned by the attackers. Put simply, said attackers go to a mobile telecoms operator’s office, somehow wangle a new SIM card with the number of a victim-to-be (see below for examples of how), insert it into their own phone, and thus gain access to the target’s communications.

It’s typically text messages that are of most interest to the attackers — specifically ones that contain one-time verification codes. Having gained access, they can then log in to accounts linked to the phone number and/or confirm transactions using the intercepted codes.

As for the SIM swapping process itself, there are various approaches by the bad guys. In some cases the criminals employ the services of an accomplice working for the mobile operator. In others, they deceive an employee using forged documents or social engineering.

The fundamental issue that makes SIM swapping possible is that in today’s world, SIM cards and cell phone numbers are not used solely for their designated purpose. They were not originally intended to serve as proof-of-identity which they’ve evolved into.

Now, one-time codes by text are a very common means of account security, which means that all other protective measures can be rendered null and void by a fraudster who smooth-talked a store employee into issuing a new SIM card with your number. Such a threat cannot be ignored.

For the targeted organization, a SIM swapping attack can hit the bottom line hard. Cybercriminal interest in cryptocurrency assets continues to grow as they can be hijacked relatively easily and, more importantly, quickly. However, this method can be applied in more sophisticated attacks, too.

U.S. Securities and Exchange Commission loses X account

For instance, here’s a very recent case. On January 9, 2024, the U.S. Securities and Exchange Commission (SEC) posted on X (Twitter) that it had approved a Bitcoin spot exchange-traded fund (ETF).

This Bitcoin-boosting event had long been in the pipeline, so the news didn’t strike anyone as implausible. Naturally, in the wake of the announcement, the Bitcoin price soared (by roughly 10% to $48,000).

Fake post from the hacked SEC account announcing the approval of a Bitcoin ETF. Source

However, the post was later deleted and replaced with a message that the SEC account had been compromised. The next day, X issued a statement saying that the compromise was due not to a breach of its systems, but to an unidentified individual who had obtained control over a phone number associated with the @SECGov account. Most likely, the jump in the Bitcoin price caused by the fake post meant the fraudster made a killing.

Then, toward the end of January, the SEC itself officially acknowledged that its X account had been hacked by SIM swappers. On top of that, it turned out that two-factor authentication (2FA), at the request of SEC staff, had been disabled by X support in July 2023 to resolve login issues. The issues duly resolved, they then simply forgot to turn 2FA back on — so until the January incident, the account was left without additional protection.

$400 million FTX crypto heist

It was only recently revealed that one of the largest crypto heists in history was carried out using SIM swapping. We’re talking about the theft of $400 million worth of assets from the FTX crypto exchange in the fall of 2022.

Initially, many suspected that FTX founder Sam Bankman-Fried himself was behind the heist. However, the ensuing investigation showed that he appeared to have nothing to do with it. Then came the indictment of a “SIM swapping group” headed by a certain Robert Powell.

Part of the indictment in the case of the $400 million FTX SIM-swap crypto heist. Source

The text of the indictment gave us the details of this heist, which, incidentally, was neither the gang’s first nor its last. The list of victims of its SIM-swap operations runs into the dozens. The indictment goes on to mention at least six more cases, in addition to FTX, involving the theft of large sums of money.

Here’s how the criminals operated: first, they selected a suitable victim and obtained their personal information. Next, one of the perpetrators forged documents in the victim’s name, but with the photo of another criminal — the one doing the actual SIM swap.

The latter criminal then paid a visit to the respective mobile operator’s office and got a replacement SIM card. Text messages with confirmation codes sent to the victim’s number were then intercepted and used to log in to the latter’s accounts and approve transactions for the transfer of assets to the gang. Interestingly, the very next day after the FTX heist, the group robbed a private individual in the exact same way to steal a modest-by-comparison $590,000.

How to guard against SIM swapping

As we see, in cases involving serious amounts of money, your SIM card and, accordingly, 2FA through one-time codes by text become the weak link. As the above examples show, SIM swapping attacks can be extremely effective; therefore, threat actors will doubtless continue to use them.

Here’s what to do to protect yourself:

Wherever possible, instead of a phone number, use alternative options to link your accounts.
Be sure to turn on notifications about account logins, pay close attention to them, and respond to suspicious logins as quickly as possible.
Again, where possible, avoid using 2FA with one-time codes by text.
For your 2FA needs, it’s better to use an authenticator app and a FIDO U2F hardware key — commonly called YubiKeys after the best-known brand.
Always use strong passwords to protect your accounts – this means unique, very long, and preferably randomly generated. To generate and store them, use a password manager.
And remember to protect those devices where passwords are stored and authenticator apps are installed.

Kaspersky official blog – ​Read More

How Wi-Fi WPA2 is hacked using PMKID interception | Kaspersky official blog

/in

Being concerned about the security of your wireless network is not as paranoid as some may think it is. Many routers have a setting enabled by default that makes your WPA/WPA2-protected Wi-Fi network rather vulnerable. In this post, we’ll discuss one of the most effective methods of hacking wireless networks that exploits this setting, and how to protect against it.

The simplest and most effective attack on WPA/WPA2-PSK: PMKID interception

PMKID interception is the most effective, easy-to-execute, and completely undetectable method of attacking wireless networks protected by the WPA/WPA2 standards. In essence, this attack involves intercepting the encrypted Wi-Fi passwords that wireless routers broadcast constantly — even when no devices are connected to them. Having obtained the encrypted password, the attacker can use the brute-force method to decrypt it — and thereby connect to the Wi-Fi network.

This attack can also be carried out on a large scale using a technique called wardriving. Here, the attacker drives around a city scanning all available wireless networks and intercepting encrypted passwords that are broadcast by routers. Not much equipment is required for this — just a laptop, a long-range Wi-Fi adapter, and a powerful antenna.

The intercepted encrypted passwords can be cracked on the go. But an attacker may prefer to wait until they’re home and enter all the garnered passwords into a password-cracking tool on a high-performance computer (or rent computing power in the cloud). The effectiveness of this attack was recently demonstrated in Hanoi: a Vietnamese hacker scanned around 10,000 wireless networks and managed to decrypt the passwords for half of them.

This is all you need to hack 5000 wireless networks using PMKID interception. Source

How is it even possible to hack Wi-Fi using PMKID interception?

So why do wireless routers broadcast their Wi-Fi password all the time, albeit in encrypted form? Well, this is a basic function of the 802.11r standard, which is implemented on most routers and usually enabled by default. This standard enables fast roaming in Wi-Fi networks using multiple access points. To speed up the reconnection of the client device to new access points, they constantly broadcast their identifier — the very same PMKID.

This identifier is a derivative of the Pairwise Master Key (PMK). More precisely, it contains the result of an SHA-1 hash function calculation, whose source data includes the PMK key and some additional data. The PMK key itself, in turn, is the result of an SHA-1 hash function calculation of the Wi-Fi password.

In other words, the PMKID contains the wireless network password, hashed twice. In theory, the hashing process is irreversible, meaning it’s impossible to recover the original data from the resulting hashed value. Presumably, the creators of the 802.11r standard relied on this when devising the PMKID-based fast roaming mechanism.

However, hashed data can be brute-forced. This is made especially straightforward by the fact that people rarely use particularly strong passwords for wireless networks, often relying on fairly predictable combinations of characters instead. The creators of 802.11r obviously didn’t take this into account.

This problem was discovered a few years ago by the team behind one of the most popular password recovery utilities — in other words, a password-cracking tool — Hashcat. Since then, specialized tools have been developed specifically for cracking intercepted PMKIDs.

Successful extraction of the password “hashcat!” from the intercepted PMKID of a wireless network. Source

Thus, in practice, the attacker usually intercepts the PMKID containing the encrypted password, and then uses a dictionary attack — that is, they brute-force the most common passwords, which are collected in a database.

How to protect your wireless network from a PMKID attack

What can you do to prevent a PMKID interception attack on your wireless network? Fortunately, there are several protective measures that aren’t too difficult to implement:

Create a password for your wireless network that is as long and complex as possible. If a PMKID attacker intercepts the hashed password from your Wi-Fi, they still need to decrypt it afterward, but the more complex the password — the less likely the attackers are to succeed. Therefore, to protect against this attack, create the longest and most unguessable password possible for your wireless network.
Disable PMKID transmission in the router settings. Unfortunately, not all routers allow this, but it’s worth checking if yours has this setting. You can find it by searching for PMKID or 802.11r.
Switch to WPA3. If all your devices support this newer Wi-Fi security standard, it’s worth considering switching to it: WPA3 is generally much more secure than WPA2 and, importantly, isn’t susceptible to PMKID interception.
Set up a guest network. It can be tedious to have to frequently enter a strong password for the main network on new devices, so set up a guest network with a simpler password. By the way, it’s also a good idea to transfer potentially insecure things like IoT devices to the guest network.
Use the “Devices on My Network“ feature, which is available in our Kaspersky Plus and Kaspersky Premium This feature shows a list of devices on your network and alerts you if a new device connects to it.

For additional protection of transmitted data in case someone still manages to hack your Wi-Fi, use a VPN on all your devices to secure the internet connection — for example, our Kaspersky Secure Connection, which is also included in the Kaspersky Plus and Kaspersky Premium subscriptions.

Kaspersky official blog – ​Read More

PrintListener: remote fingerprint theft | Kaspersky official blog

/in

Researchers from the U.S. and China recently published a paper proposing a mindboggling new method of fingerprint theft…

Imagine you get a call from a cybercriminal; or you connect via your smartphone to a conference call that an attacker has access to. During either call, you’d something on your phone, which, naturally enough, involves sliding a finger across its screen. The sound of such a movement is clearly audible through the phone’s built-in mic, allowing the threat actor to record and analyze the sound. From this, they can recreate enough fragments of the fingerprint to unlock your phone using an “artificial finger”! Just think about it: the gentle friction of your finger sliding over the screen can reveal the pattern on the fingertip — a side-channel attack of exquisite beauty!

How to steal a fingerprint through audio

The general schematic of the new PrintListener attack is given in the image:

If the potential victim swipes the screen during a call, the attacker can reconstruct parts of the fingerprint from the sound it makes. Source

When the user moves a finger across the surface of the screen, it produces a noise almost inaudible to the human ear. These “rustling” sounds differ depending on which particular loops, arches, and swirls and whirls on the fingertip come into contact with the screen. If the noise is captured by the device’s mic and later analyzed, based on the data obtained, the approximate pattern of these ridges can be determined.

The pronounced features of a fingerprint are key to determining whether a scanned print is identical to the one previously saved. Source

The authors of the paper took great pains to make the study as true to life as possible. First, to avoid having to find such hard-to-detect events manually, they created an automated system to search for sounds similar to a finger being swiped across the screen. Second, they created a large database of photos of fingerprints and the corresponding sounds of finger swipes in different directions, with different background noise, for different smartphone models, and other parameters.

A total of 65 volunteers took part in the experiment, in which 180 fingers were scanned. The data was processed by a machine-learning algorithm. The trained algorithm was able to predict with confidence certain fingerprint characteristics solely by the sound of finger movement across the surface of the smartphone.

How effective is PrintListener?

PrintListener is by no means the first attack on fingerprint scanners. In 2017, a paper was published laying out a scheme in which, instead of the user’s real fingerprint, a synthetic one with random fingerprint patterns was applied to the scanner. And in some cases, it worked! Why? In many modern smartphones, the fingerprint scanner is built into the power button and is pretty narrow. By definition, such a scanner can only see a fragment of the fingerprint. What’s more, the scanner is focused squarely on the pronounced features of the fingerprint pattern. If some loop or swirl on the synthetic finger matches any on the real one, the scanner can authorize the user! The attack was dubbed MasterPrint.

Another important parameter of scanner performance is the rate of false positives. The ideal scanner should only validate a fingerprint if the pattern is a 100% match. But such perfection is unworkable in the real world. Two swipes are never the same — the user’s finger may be at a different angle, a little higher, or a little lower. The finger may be dry or wet, dirty or cut. To take this into account, the scanner is configured to validate not only 100% matches but “good enough” ones as well. This inevitably leads to false positives: when the scanner mistakes a wrong print for the true one. The typical percentage of unwanted positives varies from 0.01% (in the strictest case) to 1%. The latter makes life easier for the user but increases the likelihood that someone else’s finger could unlock the device.

The MasterPrint attack showed that a synthetic fingerprint with some similarly shaped loops or swirls was partially recognized in 2.4–3.7% of cases — and on the first try at that. If multiple attempts are allowed, the likelihood of a false positive rises considerably. In the study, given 12 consecutive swipes, a fake fingerprint got validated 26–30% of the time! In those experiments, the false positive rate was 0.1%.

The PrintListener attack takes the ideas of the 2017 MasterPrint paper and develops them further. Processing the audio information permits detection of the presence of pronounced ridges with a high degree of certainty. This then makes it possible to attack the scanner not at random, but using a fingerprint feature reconstructed from the audio. An attacker can then 3D-print a finger with a synthetic fingerprint that contains this feature.

With an acceptable false positive rate of 0.1%, the PrintListener attack successfully duped the fingerprint scanner 48–53% of the time. A more stringent scenario, with an acceptable false positive rate of 0.01%, still saw the biometric scanner get hacked in 7.8–9.8% of cases. That’s a significant improvement on MasterPrint. Moreover, in each case, no more than five attempts were made to scan the synthetic finger, which corresponds to real-life restrictions on biometric authorization in these same smartphones.

Biometrics pros and cons

We covered the traditional risks associated with fingerprint scanners in a previous post. In short, they’re not an ideal means of authorization in any way. It’s actually quite easy to steal your fingerprint using traditional methods. People always leave fingerprints on the objects and surfaces they touch. In some cases, it’s even possible to extract a usable print from a photograph. And not just from a close-up of your fingers — an ordinary high-res shot taken from a reasonable distance of three meters would do.

The simplest scanners can be fooled by a printout of stolen biometric information. This trick won’t work with the ultrasonic sensors found under modern smartphone displays, but, again, it’s possible to 3D-print an artificial finger with the required pattern. A problem common to all biometric authentication systems is that such information is hard to keep secret. And, unlike a password, you can’t change your fingerprint if it’s compromised.

That’s not to say that the new paper gives new reasons to worry about our data security. The imperfect nature of biometrics is already factored into the logic of the sensors in the devices we use. It’s precisely because a fingerprint is fairly easy to misrecognize that smartphones regularly ask us to enter a PIN or confirm an online purchase with a password. In combination with other security methods, fingerprint scanners aren’t all that bad. Such protection against unauthorized access is better than none at all, of course. Remember, too, that a simple digital unlock code for a smartphone can also be snooped or brute-forced based on traces left on the display.

Nevertheless, the PrintListener attack is indeed remarkable, allowing as it does to pull valuable fingerprint data from the unlikeliest of sources. The attack scenario also looks quite realistic —similar in concept to previous studies in which user keystrokes were recognized by sound. One might conclude from all this that it’s best to refrain from touching your screen during a call or online meeting. But the moral of the story is actually simpler: don’t protect highly sensitive information — especially confidential business-related data — with biometrics alone.

Kaspersky official blog – ​Read More

Third-party app stores are coming to iOS: should we brace for new threats? | Kaspersky official blog

/in

iOS has been a mostly impenetrable fortress throughout the full 17 years of its existence. Users only had access to apps and functions if Apple allowed them to. But now the U.S. company has had to yield to market and regulatory pressure by changing the status quo. As of March 6, when the EU’s Digital Markets Act (DMA) came into effect, the new iOS version (17.4) now allows installing alternative marketplaces and third-party browsers on the iPhone — but only by EU users. At the same time, certain familiar features, such as progressive web apps (PWAs) running in the browser and added as icons to the home screen, will disappear. What new capabilities and threats does this bring to users?

How to install an alternative app store

To ensure fair competition, regulators have required Apple to allow third-party app marketplaces on iPhones. The user will be able to go to an alternative app store’s website, tap install (that is, install the… app-store app!), and after explicitly confirming their intention, install the app-store app on their device. It can then be used instead of Apple’s App Store or alongside it.

It’s still unclear what these alternative app-stores will contain, or who would want to open one. What matters is that these stores won’t be required to observe all of Apple’s rules, so they’re expected to offer services and technology previously restricted by Apple — most notably payments outside the App Store. Epic Games, a principal lobbyist behind the legal case along with Spotify, will likely want to open an app marketplace, although the latest episode of the Apple vs. Epic Games tug-of-war suggests this might be a long time coming.

Importantly, Apple appears bent on preventing anarchy: to register an app marketplace, a creator has to pass screening and provide a €1 million standby letter of credit. Uploading different versions of the same app to the both App Store and alternative stores is prohibited: if a developer wants to publish its app in every store it must be identical. Finally, all applications will need to pass “notarization” with Apple. If the process proves identical to macOS notarization, rather than a manual review this will likely involve Apple running an automated scan for malware and checking compliance with certain technical recommendations.

Security implications: iOS will see more malware. Apple will continue to partially regulate the installation of third-party apps: you won’t be able to just tap a button in the settings and install an unknown app from a shady website as you can on Android. That said, the automated scanning process designed by the Cupertino engineers for third-party app marketplaces will be even easier to fool than the App Store’s human moderators. This means the quantity and variety of malware on iOS will likely increase.

Besides obvious malware, Apple is reasonably concerned about the higher risk of apps appearing with scam content and non-transparent payment schemes. These aren’t the kind of issues that can be detected with automated scanning.

Unfortunately, the new rules do nothing to help with bringing Android-style operating-system-level antivirus and security solutions to iOS, as the latter is still missing the required functionality for such a thing. Therefore, we recommend carefully considering before installing third-party app stores and downloading from these. It’s likely safe to install a marketplace created by a large company to get a famed game with tens of millions of downloads. However, the advice to stay vigilant that we gave to Android users earlier now also becomes relevant for European iOS users. As a reminder, malware downloads from Google Play exceeded 600 million last year.

Privacy implications: According to Apple, in-app tracking restrictions will apply to apps downloaded from third-party stores. However, the app privacy details, which developers fill out before uploading their apps to the App Store, may be less in-depth or even non-existent in other stores.

Parental control implications. Although screen-time limits will continue to work with any apps, restrictions on in-game or family purchases and app purchase requests requiring parental confirmation may function improperly or be absent in apps downloaded from alternative marketplaces.

Third-party browsers

Alternative browsers in iOS are nothing new, but before the DMA came into force they were merely skins that wrapped around Apple’s WebKit engine, which was the only option available for displaying Web content on iOS. Apple will now allow other engines — but only after they pass a special certification procedure. Truth be told, the browser engine situation on other platforms is no better, with nearly every “alternative” browser being based on Chromium code (Blink engine) maintained by Google. Mozilla’s Gecko, used in Firefox, has a notable market share, but that’s about as far as consumer options go.

Both Google and Mozilla have been seen preparing to launch Blink and Gecko on iOS, so it’s very likely that EU users will see full-fledged Firefox and Chrome browsers soon. When opening Safari for the first time — or a web page from any app — users in the EU will be able to choose a default browser.

Security implications: these are two-sided, as we expect some security improvements in some areas, and deterioration in others. In addition to known WebKit issues, there will be potential flaws in both Firefox and Chrome, and it remains to be seen how promptly these will be fixed by their respective developers. However, both of them have solid reputations when it comes to vulnerability patching. On the other hand, zero-day vulnerabilities in Apple software, including WebKit, were always the main vector for attacks on iPhones using spyware — both commercial like Pegasus, and targeted like Triangulation. Today, the developers behind these attacks know for sure that victims are using Safari/WebKit browsers. Tomorrow, the need to consider every browser option will make it more challenging to design and conduct these attacks.

Privacy implications: these depend on the alternative browser you choose. If Windows and macOS counterparts are any indication, switching to Firefox would likely improve the level of privacy or keep it at Safari levels, whereas using Chrome may result in reduced privacy, as suggested by these browsers’ anti-tracking tools and default settings.

Parental control impact: it’s still unclear how alternative browsers will protect kids from undesired content, but it seems that control will be technically more difficult to configure. Hence, we have doubts about its efficiency.

A noticeable loss

European users stand to both gain and lose from the DMA. Regarding the latter, to implement the functionality required for alternative browsers, Apple is completely dropping progressive web app support in the EU. Although these apps are essentially web pages, they’re hard to distinguish from full-fledged apps, as they can save content on the device, send notifications, and behave very similarly in other ways. Online stores, magazines, and restaurants usually choose PWAs for their apps. All these mini-apps, so easily added to the iPhone home screen, will no longer function in the EU the next time iOS is updated. Not every company that has packaged their apps as a PWA will have enough time to adapt to the change.

Third-party browser and app marketplace availability outside the EU

Apple has gone to great lengths to make sure the new functionality is only available within the region where it’s legally mandated — the European Union. Only users registered in one of the 27 EU member states will get the iOS 17.4 updates described here. Residents of other countries won’t be affected by the changes, so simply turning on a Dutch VPN or going to Cyprus on vacation won’t be enough to get the iOS updates in question. Furthermore, even EU residents who leave the territory of the Union for more than 30 days will lose access to app updates from third-party marketplaces until they return.

Kaspersky official blog – ​Read More

Transatlantic Cable podcast episode 338 | Kaspersky official blog

/in

Episode 338 of the Transatlantic Cable podcast kicks off with the story of the year (so far) as some people see it – the Kate Middleton / photoshop mess. Is it really as big a deal as some believe it to be, or is it just a silly mistake?

From there the team discuss news that South Korea have developed a tool to help scan images for deepfakes, but will it be useful enough to be of any use? Additionally, the team talk about the Play ransomware gang and will GDPR shut down WorldCoin?

If you liked what you heard, please consider subscribing.

Kate photo withdrawn by five news agencies amid ‘manipulation’ concerns
South Korean Police Develops Deepfake Detection Tool
Worldcoin hit with temporary ban in Spain over privacy concerns
Play ransomware leaked 65,000 government documents

Kaspersky official blog – ​Read More

How to protect yourself from the pig butchering scam | Kaspersky official blog

/in

Today, we’re discussing the increasingly common scam known as pig butchering. Due to its high profitability, this scheme is rapidly gaining popularity among fraudsters, and the number of victims is constantly growing. What is it? How does it work? And how can you protect yourself? We’ll cover it all in today’s post.

What is pig butchering and how does this scam work?

Pig butchering is a type of scam associated, on the one hand, with investing (often in cryptocurrencies), and on the other, with online romantic relationships.

Just as pigs are raised for a long time before being slaughtered, in the pig butchering fraud scheme, scammers typically spend a lot of time and effort carefully courting their victims — usually over a period of weeks or even months. In this regard, pig butchering differs significantly from other fraudulent schemes, whose creators are often impatient and looking for quick profits.

The setup: a random message and a friendly stranger

It all starts with some random message in a messenger, social network or SMS. The scammer either pretends to have sent the message to the wrong recipient or refers to some distant mutual acquaintance that are easy to find and collect information about from the victim’s social media profile. If the victim responds to the scammer, saying something like “You’ve got the wrong number”, the scammer politely apologizes and tries to initiate a casual conversation. Message by message, an ongoing relationship develops between victim and scammer.

It should be noted here that scammers often deliberately select the victims based on their status and personal traits. That is, they look for reasonably well-off but perhaps lonely and vulnerable individuals who may not be opposed to engaging in conversation with a friendly stranger. At this stage, the scammer’s goal is to build at least friendly relations with the victim and, ideally, a romantic connection.

Thus, the scammer gains the victim’s trust and lulls their vigilance. As mentioned earlier, these scammers are usually in no rush and spend a lot of time communicating with the victim, which is uncharacteristic of online fraudsters. So even if the victim has some suspicions at first, they tend to fade away after a while.

The plot thickens: an opportunity to invest profitably

Sooner or later, the scammer finds a way to steer the conversation toward financial topics. Specific approaches here may vary, but the general idea is that the scammer carefully presents the victim with an opportunity to make a profitable investment.

This could be something traditional like stocks, bonds, futures or options. But lately, it’s more often associated with some “promising” cryptocurrency projects. The overall complexity and opacity of crypto, coupled with the ease of moving funds, make it ideal for such fraud.

At this stage, the victim may become alarmed and suspect something is amiss. However, the scammer is quick to reassure their precious… pig: there’s no need for the victim to transfer any money personally to them or anyone associated with them. All the victim needs do is simply create an account on a trading platform and try to deposit some money there to see how it works.

Climax: incredible profits and new money deposits

An important detail of the pig butchering scheme is that at every stage the scammer carefully maintains the victim’s illusion of control. The victim independently creates an account on the trading platform and can independently choose what to trade there. The scammer only provides helpful advice, making the whole process faster and easier — and of course, as profitable as possible.

The scammer’s trading tips turn out to work well — who would have guessed it? The victim quickly makes their first profit on the trading platform, gets excited, and starts depositing more and more for even bigger earnings.

Finale: the scammer vanishes with the money

But of course, sooner or later, the scammer absconds. This usually happens once a reasonable balance has formed in the account. Alternatively, the scammer may milk the victim until the moment they try to withdraw money from the platform.

That’s when the victim learns the truth: the trading platform was fake, and all those incredible profits just disappeared into thin air. As for the real money, it has long gone to some unknown account. At this stage, the scammer cuts all communication with the victim, deletes the accounts used for the scam, and — poof! — vanishes in a puff of smoke.

The victim has lost everything invested in the platform, and we’re usually talking significant amounts: the fraudsters often manage to get away with tens or even hundreds of thousands of dollars — sometimes even millions.

Scam farms in Southeast Asia

As you may have gathered from the description of pig butchering, this scheme has several key differences from most scams. First, the criminals come well-prepared — they have effective tools to deceive their victims. Second, they’re in no hurry and are ready to work on a single target for a long time, gradually moving toward their sinister goal. Third, we’re talking about truly large sums of money — meaning the amount of time and effort involved eventually pays off.

The secret to this success is that, in the vast majority of cases, it’s not individual scammers who are behind pig butchering, but large criminal groups. These organizations run huge fraudulent “farms”, most often located in the least prosperous countries of Southeast Asia. Such farms exist in Laos and the Philippines, but most farms are in Cambodia and, above all, Myanmar, where a civil war has been going on for several years.

One of the largest scam farms engaged in pig butchering — KK Park. This farm, located in Myanmar near the border with Thailand, employs over 2000 people. Source

These enterprises are truly massive: for example, a report last year about one of the largest scam farms, called KK Park, claimed that over 2000 people work there, and it has even earned its own article on Wikipedia. Moreover, the farms are constantly expanding and, of course, new ones are being opened.

Generally speaking, these fraud farms should more accurately be called labor camps — and this is perhaps the saddest detail of this scheme. For it turns out that the rank-and-file operators of pig butchering — the ones who directly communicate with the victims — are usually doing so against their own will.

Scam enterprises require highly skilled, well-educated, multilingual employees with strong online communication abilities. As you might imagine, such people don’t naturally appear in the jungles of Myanmar or Cambodia. Usually, these are citizens of other countries who are lured by the promise of high-paying jobs — call center operators, SMM specialists, translators or IT specialists.

Scam farms are constantly expanding: this photo, taken on July 1, 2023, shows the construction of a new building at KKII — a newer part of KK Park. Most likely, it has already been completed by now. Source

Usually, new scam-farm workers first end up in neighboring Thailand, from where they’re taken to Myanmar or Cambodia. There they’re transported to a camp located far away from any large populated areas and have their documents confiscated. Then these people essentially become slaves: they’re forced to work 12-16 hours a day for nothing but food, can be subjected to violence, and sometimes even resold to other fraudsters.

The overall scale of the problem is extremely serious. A report last year by the UN Office of the High Commissioner for Human Rights, citing reliable sources, gave the following figures: at least 120,000 people are employed in scam farms in Myanmar, and approximately another 100,000 in Cambodia.

How to protect yourself from pig butchering

It’s difficult to calculate the exact total losses of pig butchering victims because it’s a global problem — scammers target citizens of different countries. In addition, not everyone reports that they’ve been a victim. However, rough estimates suggest the size of the pig butchering industry runs to billions of dollars.

It’s a very lucrative business, so there’s no use hoping the problem will simply go away by itself. Nor is there any hope that the authorities in Cambodia or Myanmar will address it — they appear to have other priorities. Therefore, unfortunately, we must protect ourselves and our loved ones on our own. Here’s what we can advise:

Be cautious with random online acquaintances — even if the person has been communicating with you for a long time and doesn’t seem to be a scammer.
Don’t invest carelessly in obscure investment schemes — even if they apparently demonstrate high profitability.
In particular, don’t invest carelessly in cryptocurrency schemes, as due to the quirks of this topic the number of scammers in this sphere is unfortunately very high. Additionally, it’s important to note that all blockchain transactions are irreversible and uninsured.
Remember the golden rule of investing: the higher the potential profit — the higher the risk. When it comes to risky schemes, never invest money that you are not prepared to lose.
Inform your family and close ones about this fraudulent scheme — it’s possible that this could protect them from financial loss, plus the inevitable psychological trauma resulting from such deep deception.

Kaspersky official blog – ​Read More

Transatlantic Cable podcast, episode 337

/in

 

In this special episode of the Transatlantic Cable Podcast, we engage in a thoughtful conversation with guests Genie Gan and Ekaterina Burdova about the pivotal topic of Women in Technology, coinciding with the celebration of International Women’s Day. Throughout the episode, we delve into various aspects of empowering women in STEM fields, touching on strategies for governmental and academic institutions to foster greater female participation, community-driven initiatives aimed at providing support and encouragement, and corporate measures to promote gender diversity and create inclusive workplaces. Additionally, the discussion explores the influence of media representation, citing examples like “The Queen’s Gambit” and its impact on shaping perceptions of female protagonists in male-dominated spheres. Emphasizing the significance of representation for aspiring female leaders, the guests also discuss ways to serve as role models for young girls interested in pursuing careers in technology. Furthermore, the conversation highlights the importance of mentoring programs in women’s professional development, as well as the challenges and strategies for maintaining a healthy work-life-family-education balance. Ultimately, the episode aims to challenge myths surrounding women in tech and inspire meaningful change within the industry.

If you liked what you heard, please consider subscribing.

 

Kaspersky official blog – ​Read More

Transatlantic Cable podcast episode 336 | Kaspersky official blog

/in

Episode 336 of the Transatlantic Cable Podcast begins with news that Tumblr and WordPress are set to begin selling user data for AI training. From there the team talk about META’s decision to begin helping assist the EU in combatting fake news and disinformation on their platforms.

To wrap up, the team talk about LockBit’s resurgence and a truly bizarre Wi-Fi password scanning tool.

If you liked what you heard, please consider subscribing.

Tumblr, WordPress Announce User Data Sales for AI Training
Meta unveils team to combat disinformation and AI harms in EU elections
Back from the dead: LockBit taunts cops, threatens to leak Trump docs
Cybersecurity enthusiast collects Wi-Fi passwords using homemade device

Kaspersky official blog – ​Read More

How cybercriminals scam women ahead of March 8 | Kaspersky official blog

/in

Taking place every year on March 8 in many countries across the world, International Women’s Day is celebrated differently depending on the country: in some it’s a national holiday; in others it’s not a holiday but still widely observed. But what’s the same everywhere is that it’s a day when everyone’s eyes are on women from all walks of life; and when I write everyone’s, that includes scammers’ eyes too. The feverish days running up to March 8 (ordering this, buying that – and all in good time, but not too early if we’re talking fresh flowers) provide a perfect opportunity for cybercriminals to make money, so they triple-down on sending links to fake sites, generating countless fake promotional codes, and making false promises of valuable gifts for every purchase.

In this post, we discuss ways in which women can protect themselves from falling prey to these scams.

Fake marketplace gifts

Statistics show that women are far more likely to shop at online marketplaces than men: 43 percent against 32 percent. Thus, women are more likely to be targeted by promotions that appear in dazzling quantities ahead of any public holiday. Sadly, these campaigns aren’t always legal and run by the brands whose names are used in sending out unprecedentedly generous offers.

For several years in a row, shortly before March 8, young women receive WhatsApp messages purportedly from Amazon and offering a valuable gift: “Welcome to the Amazon International Women’s Day Giveaway! We have more than 10,000 free gifts!” To participate, the recipient is asked to follow a link and fill out a quick survey, and then share the message with a few dozen friends and verify their identity through email. Needless to say, respondents get no fancy smartphones, hair dryers, or laptops. Instead, according to security researchers, victims’ devices may have been compromised, with the scammers getting access to the camera, microphone, banking apps, contacts, and gallery.

In fact, some brands do employ instant messaging services and email to spread promotional offers, and Amazon is no exception. So, if you receive such a message, start by carefully scanning it: suspicious generosity, grammatical errors, an odd sender’s address, and an urgent call to follow a link “while it still lasts” may be a sign that it’s a scam. Remember the rules for safe online shopping and use reliable security to be confident you’re following a link to an official website — not a fake.

“Flowers for our regular customers!”

The tradition of giving women flowers on March 8 dates back to 1946, when Italian women’s rights activists chose the yellow mimosa as a symbol of resilience, sustained growth, and solidarity. Young women still get flowers from their friends and family every March 8. Scammers exploit this sweet tradition too.

On the eve of International Women’s Day, scammers promise to send women flowers, while the recipient women, they say, will only need to pay for delivery. If a woman agrees, she receives a payment link in an instant messaging app. To no one’s surprise, after following all the instructions, the victim gets no flowers, and the florist shop’s phone number turns out to be somehow unavailable.

The whole story is a typical delivery scam, which we’ve written about earlier. Losses in this case include both the “cost of delivery” and the bank card details, which can later be used to steal far larger sums. Here’s a golden rule for you if you want to avoid being scammed: never pay for a gift. After all, it should be free because it’s a gift. If a florist shop, nail salon, or spa decides to be nice and send you flowers all of a sudden, make sure they don’t charge you for this.

“Anything you say can be used against you”

You must have heard the Miranda warning in movies: “Anything you say can be used against you…”. Well, it’s just as true for digital life as it is for real life. We’re talking about doxers. These are people who collect any and all information available about their potential victims — information the victims themselves have published — and threaten to make it public. This type of threat is known as doxing.

Young women are especially defenseless before doxers. A malicious actor can use data on the victim for catfishing: creating a fake online identity with the victim’s name, face, and other personal details to set up further scams on social networks and in dating services. The least they can do is harass you with text messages, phone calls, fake deliveries, or even swatting. Popular streamer Amouranth, with more than 6.3 million Twitch followers, says she gets swatted several times a month.

Streamer Wolfabelle experienced a different kind of doxing: a stalker found out her address and threatened to publish it unless she gave him sexual favors. She even received a photo of her house made by the doxer to prove he wasn’t bluffing.

On a positive note, this isn’t something you can’t prevent. In a nutshell, here’s what you should do: avoid sharing your geolocation, publish only a minimum of information that can appear in online searches, or make your social profiles private. If you’ve already been a victim of doxing, please refer to our other post.

Celebrating March 8 safely

Keep your eyes open when accepting promotional offers. Gifts and giveaways are nice, but as soon as they ask you to pay or share the link with your friends, that’s when you know you’re dealing with scammers.
Avoid clicking suspicious links in instant messages. Please read our detailed anti-phishing tips and remember that malicious actors become more active in the run-up to and during holidays.
Publish your personal details in private social profiles only. This life hack will go at least some way toward keeping you safe from doxing. Remember to carefully select followers and friends who can view your profile details.
Use comprehensive security that keeps you from visiting phishing and scam sites, protects your payment and personal details, and prevents identity theft.

Kaspersky official blog – ​Read More