According to Vicente Diaz, Senior Security Analyst at Kaspersky Lab in Iberia, Spain, it is not that Australia is being left out – it has good money (12th largest world economy), good politics, and a good relationship with the Asia Pacific region especially China (Wang Yi urged Australia to become a bridge between east and west). “Perhaps China is hesitant to attack its own,” he said.
Despite that it appears that there are significant state attacks emanating from China aimed at spying on the resources sector. “Chinese and Russian hackers tried to steal Australia’s future submarine plans,” he said.
Diaz works in an analytical capacity trying to figure out why attacks happen. “I need to know a countries politics, law and order, financial status, trading partners, and more. You are generally not a high value, APT target at the moment – that can change in a heartbeat,” he said.
He did point out that Australia had more than its fair share of ransomware attacks – probably because we can afford to pay and do so. Kaspersky is working with the National High Tech Crime Unit of the Netherlands to develop a ransomware decryptor. It has had some success with Coinvault and Bitcryptor and you can download a free tool from its web site.
He spoke of cyber-mercenaries that offer cyber-crime as a service. A new trend is business scare-ware where cyber-criminals threaten companies with massive Distributed Denial of Service (DDoS) attacks unless they pay 20 bit coins – and the penalty doubles for each day they do not pay.
This is not of concern to larger enterprises that can afford hardened web servers but it is a major concern to small business using local ISPs that have not done this for them. “You need to know that this is more about the threat than the execution so it gives time to address the issues that DDoS can cause,” he said.
He spoke of Banking threats that target bank tellers, ATM (automatic teller machines) and point of sale.
“Dyre Trojan, Carbanak, or Anunak can infect Automatic teller machines (ATM) capturing your card details and pin/password. New Zealand with 2.86% is number five and Australia with 2.78% is number seven in the world for this infection. Number one and two are Austria and Singapore with above 4%. These are aimed at not only stealing your money but they can be used to get to know you [profiling] and then for phishing,” he added.
Mobile threats see Australia at number five with a reported 24.31% of users attacked by mobile banking malware aimed at capturing mobile banking transactions.
That is on top of Adware, RiskToool, Trojan.SMS, Trojan.Spy, and a range pf other ‘backdoors’ that root Android and gain control that enables them to do almost anything. “iOS is harder to crack but not impossible as seen by the hackers that received US$1 million for gaining access to iOS 9.x. Windows 10 is much harder but cyber-criminals will find a way once the operating system gains more market share,” he added.
Apple does not allow third party antivirus companies to gain access to its iOS kernel so there is no additional protection on these devices.
A recent trend in APTs is to infect the hard disk firmware but this is a costly and difficult process and only 12 models of Seagate, WD, Maxtor, Toshiba, Samsung, and Hitachi are so far affected. “The main cyber-criminals are well resourced and are replacing old tools and new ones. They go after easy targets using minimum resources,” he said.
“The cloud is a whole new issue because it’s hard to define. Let’s not forget that it is really a bunch of connected computers in datacentres and op premise around the world and issues arise daily,” he said.
Australian Macs are not immune either with Macfog OS X version – we rate at number five for infection.
Governments are not immune with the MiniDuke Trojan aimed at them and Crouching Yeti (Energetic Bear) targeting academic and research networks.
“Two factor authentication (where both the user and the device must be authenticated) will help. Banking is starting to do this with an SMS message to your phone to prove who you are. Tokens are also being used by mobile malware can steal them. Then there is the issue of stopping infection and that requires a suite of countermeasures. Kaspersky offers Safe Money where all transactions are done in a pure, protected environment,” he said.
“in the end it for the consumer it comes down to the human factor – the importance of patching, good computer hygiene, updating AV programs, a better understanding of phishing, and the new minefield of social networking where it is all too easy to click on a referred link,” he said.
“For enterprise – the CISO, CTO, CIO – all C-Level must realise that it is not when but if they will be infected and they should not underestimate the resolve of cyber-criminals to gain access to personally identifiable information or business IP,” he finished.
He spoke about Kaspersky Lab. “It has 44 people covering 22 countries analysing over 200,000 pieces of malware daily. We have broad expertise in the regions we sell into and use advanced telemetry from users and the internet to help develop better protection.
Diaz for example has a Masters in Artificial Intelligence, has worked in penetration testing for banks, and has five years at Kaspersky Lab. He specializes in research on malware and fraud in the European region, including banking Trojans, social networking threats, cybercriminal ‘partner networks’ and mobile malware, as well as leading technical research projects and providing expert customer support.
Diaz is an analyst and reports things as he sees them.
Australian enterprise may be under the radar now but that is only because cyber-criminals are busy attacking a dozen or more countries that are lucrative enough. Our turn will come.
Australian consumers are a target, especially for mobile and banking malware and need to be more vigilant.