By Javvad Malik, our new Security Awareness Advocate for EMEA. A multi-national collaborative law enforcement effort has arrested individuals allegedly behind Nymaim and Gozi, also known as GozNym.
The global crime network is reportedly responsible for stealing an estimated $100 million from banks around the world.
It’s a nice story and some believe it should serve as a blueprint for future operations. Which is all well and good until you start looking through the details, squint a bit and tilt your head when looking at the details.
Something Phishy
The criminals infected computers of over 40 thousand victims via phishing emails.
That’s right, it boils down to plain old simple phishing. Users would receive an email with a link, they’d click on the link which would redirect them to a website after which malware got downloaded.
Once victims machines were compromised, they would steal their banking credentials. While the impact of the criminal group was huge, a couple of measures taken by the financial institutions could have helped a great deal.
Simple Banking
While it’s great to have law enforcement from different countries work together to share intelligence and zero in on perpetrators, a few simple steps could have possibly reduced the impact.
1. Awareness
Financial institutes in particular should continually remind and educate users of what the official communication channels through which they will make contact. It doesn’t take much to remind people to not click on any links in emails and to never enter credentials into any websites they haven’t navigated to themselves.
2. Authentication
Multi-factor authentication is becoming more commonly deployed and consumers are increasingly familiar with it. Strong authentication mechanisms should be the default for financial institutes. No one should ever be able to log into an account simply by having a static password.
Sum up
Cyber crime is everywhere and will continue to rise. But taking a step back and looking at some of the root causes, while not all roads lead to Rome, there aren’t that many different places they lead back to. So I’d say it’s best to look at how bad guys are actually targeting individuals and companies and put in place measures to plug those holes - or find ways of detecting them quickly.
Find out how affordable new-school security awareness training is for your organization. Get a quote now.
