Employees are still one of the greatest threats to corporate security, as "new-age" mafia gangs infiltrate companies, the U.K.'s crime-fighting agency has said.

Speaking on Tuesday at the Infosecurity 2006 conference in London, Tony Neate, e-crime liaison for the Serious Organised Crime Agency (SOCA), said insider "plants" are causing significant damage to companies.

"We have fraud and ID theft, but one of the big threats still comes from the trusted insiders. That is, people inside the company who are attacking the systems," he said.

"(Organized crime) has changed. You still have traditional organized crime, but now they have learned to compromise employees and contractors. (They are) new-age, maybe have computer degrees and are enterprising themselves. They have a wide circle of associates and new structures," he added.

Charges laid in Bank of Canada identity fraud


 Subsequent to the recent announcement of a joint Ottawa RCMP and Ottawa Police Service investigation into the theft of personal information from Bank of Canada databases, one individual has been charged.

Charged: Chukwuemeka MADUMELU, 27 years old, of Ottawa

Charges:
Fraud over $5000, Section 380 (1) (a) of the Criminal Code
Possession of Property obtained by Crime, Section 355 (a) of the Criminal Code

The RCMP and the Ottawa Police continue to focus their investigation on the fraudulent redemption of Canada Savings Bonds and the creation of counterfeit identity documents. Additional individuals may be charged.

To date, the investigation has confirmed that the identities stolen in Ottawa from the Bank of Canada's Savings Bond payroll deduction database belonged to Canadians from various parts of the country.

The stolen information has been used to obtain fraudulent credit cards and open cellular telephone accounts in Ottawa, Montreal and Calgary.

It has been confirmed that an additional 15 identities have also been compromised. These people have been notified by the Bank of Canada.

If you suspect that your identity has been used to commit fraud, you must take immediate action. File a report with your local police or with the police in the community where the identity theft took place. Also, notify the creditors of any accounts that have been opened or tampered with — for example, credit card companies, phone companies, banks and other lenders.

Identity theft is one of the fastest growing crimes in Canada and it can happen to anyone. While it cannot be prevented entirely, you can minimize your risk of falling victim to this crime by carefully reviewing the accuracy of your financial statements and remaining aware of the issue.

For information on how to recognize and stop identity fraud and other scams, please visit the RCMP’s Scams/Fraud web page at the following link: www.rcmp.ca/scams/index_e.htm.

Information:

Ottawa RCMP
Sgt. Monique Beauchamp
(613) 993-8820

Bots increasingly behind cybercrime

Online fraudsters and data thieves are more frequently using bot networks to get home and business PCs to do their bidding, with some estimates of the number of infected systems as high as 47 million.

An article in USA Today delves into three arrests in the last year of the people who allegedly created and controlled bot networks, known as bot masters or bot herders: Jeanson James Ancheta, who plead guilty in January to computer intrusion charges; Farid Essebar, the alleged creator of the Zotob worm; and Christopher Maxwell, charged with creating a bot network to grow an adware affiliate network.

The Messaging Anti-Abuse Working Groups' believes that as many as 7 percent of PCs worldwide--about 47 million--are infected by bots and that 70 percent of spam is sent from bot nets, according to the article.

Bot software, especially openly developed code that allows plug-and-play programming, has quickly risen to prominence in the past three years, despite some high profile arrests. Bot masters can quickly develop attacks for the latest vulnerabilities in popular software and update their programs. More stealthy bots have infiltrated computers at government agencies and large companies.

Fraudsters are using stolen information to lure victims into divulging additional sensitive information in a new form of phishing attack. These so-called personalised phishing attacks target individual named accountholders at specific banks, according to anti-fraud software firm Cyota.

Crooks are using real information about the accountholder – such as the person’s name, correct full account number, and other bank information – to make the emails look more legitimate and thereby increase response rates. The approach contrasts with typical phishing attack where fraudsters randomly dispatch thousands of spam emails without the slightest attempts to target their attacks.

Personalised phishing attacks seek to supplement existing lists of stolen credentials with even more sensitive information, such as ATM PIN numbers or credit card CVV codes.

"This highly coordinated, two-phase fraud attack demonstrates the lengths that fraudsters will go to maintain a high rate of success, and the need for constant innovation among banks and their security providers to match the continuing evolution of online threats," said Amir Orad, executive VP of marketing at Cyota.

The company advises consumers not to follow links within emails ostensibly from their bank or online merchant requesting personal or account information. Instead, users should go directly to the site concerned to verify a request or complete the transaction

Many popular browsers are affected by a vulnerability that makes it easy to spoof the content of websites, security firm Secunia warns.

Features built into browsers makes it possible for malicious websites to change the content of pop-up windows created by trusted websites such as online banks. Users would have no inkling that potentially hostile content has been injected into a pop-up window. Exploits rely on misusing browser functionality rather than taking advantage of a software bug. Thomas Kristensen, Secunia’s chief technology officer, described the problem as “perhaps the simplest phishing trick yet.”

Secunia has confirmed the vulnerability on fully patched versions of Internet Explorer 6.0 and Windows XP SP1 and SP2 (advisory here), Mozilla 1.7.3, Mozilla Firefox 1.0, Netscape 7.2, Apple's Safari 1.2.4, Opera 7.54, and KDE's Konqueror 3.2.2-6. Other versions of these browsers might also be affected. Secunia has issued five advisories (summary here) and an on-line test.

Secunia describes the vulnerabilities as "moderately critical". It advises users not to browse untrusted sites while browsing trusted sites.

First it was a security breach that left ChoicePoint's treasure chest of personal information (145,000 accounts) vulnerable to prying eyes. Less than a fortnight later, Bank of America backup tapes containing data on 1.2 million accounts went missing. More recently, someone hacked into a confidential database containing as many as 32,000 records at Seisint, a company owned by LexisNexis.

The Enterprise Strategy Group recently surveyed 229 U.S.-based security professionals from organizations with more than 1,000 employees. The majority of respondents (52 percent) came from organizations with more than $1 billion in annual revenue. Our goal was to get an objective metric of just how bad the internal security threat really is.

The results paint a frightening picture. For example, 23 percent of respondents reported their organization had suffered an internal security breach in the past 12 months, while 27 percent didn't know if it had or not. Note to self: Make sure the people you do business with know whether they've been hacked or not.

The Privacy Acts of Canada and the United States mean companies can be sued and fined for data leakage

Tower Records has reached a settlement with the Federal Trade Commission (FTC) over a 2002 security problem that made data on customers accessible to outsiders. A site redesign had opened a hole in Tower Records' e-commerce site that allowed users to call up customers' order histories by manipulating an identification number in the order status page, revealing names, addresses, e-mails, phone numbers, and past purchases. In the settlement, Tower Records promises to maintain a comprehensive security program, to be certified by an independent expert within six months and biannually for ten years.

The company faces an $11,000 fine for each violation of the agreement. The FTC has no authority over Internet security, but can target companies for deceptive trade practices. In the case of Tower Records, the FTC targeted statements in its privacy policy to address the security breach.