Beating cyber criminals

ENABLED by the sharing culture on social media — and with ever more sophisticated malicious software known as malware at their disposal — cyber criminals have become far more adept at crafting attacks and targeting individuals and organisations.

Phishing emails purporting to be from friends, often reflecting our interests — perhaps gleaned from social media sites — or from trusted organisations such as your bank or government bodies — encourage us to click on infected links or attachments containing malware. (A recent example was disguised as a security warning from Microsoft’s digital crimes unit.) We have a level of trust in certain organisations and criminals exploit it.

Typically, these so-called “man-in-the-middle” attacks install colourfully named Trojans (pieces of malware, essentially) such as Zeus, SpyEye or Citadel on computers, which have the effect of compromising, for example, online banking transactions. “Everything you then do on your compromised laptop is subverted through a hacking site which means when you [communicate] with your bank, you are going through a man in the middle. Initially, man-in-the-middle attacks were passwords used in authentication — the criminal would wait until you had finished to start using the credentials they’d just gathered. This is why banks brought in one-time passwords or codes,” says Garry Sidaway, director of security strategy at Integralis.