Anyone who’s over 30 years old must remember that 20 years ago the world was going to end. The Millennium dawned, and among many apocalyptic prophecies one stood above all others: the Millennium Bug, aka The Year 2000 problem, Y2K problem, the Y2K, the Y2K bug, the Y2K glitch. These names refer to a class of computer bugs related to the formatting and storage of calendar data for dates beginning in the year 2000. Problems were anticipated because many programs represented four-digit years with only the last two digits, making the year 2000 indistinguishable from 1900.

The assumption of a 20th century date in such programs could cause various errors, such as the incorrect display of dates and the inaccurate ordering of automated dated records or real-time events. All sorts of doomsday scenarios were heard all over the globe from nuclear meltdown (due to the computer system’s failure) and planes falling from the skies to communication breakdown and global shutdown.

Fortunately, none of these disaster scenarios materialized. The Y2K bug is now remembered as a moment of hysteria, a funny anecdote in time, much like the incidents that occurred 1000 years before it, when many were certain that the new Millennium would spell doom to them all (spoiler: that also didn’t happen!).

But the importance of The Millennium Bug was that for the first time in history, decision makers and ordinary citizens alike were considering cyber as a serious threat to our way of life. Fast forward 20 years and the internet is everywhere; we all use smartphones and order stuff online that is delivered to us overnight (and very soon by drones and electric vehicles). But with everything that has changed since the dawn of the millennium, are we more or less vulnerable than we have been before? Let’s examine some factors.

Connectivity: Power With a Fatal Weakness

The most notable difference between now and then is just how connected the world has become. In this sense, we are much more vulnerable today than we were before. We cannot imagine our lives without constant connectivity and all its benefits: online shopping, social media and online journalism. If this were taken away from us, even for a short while, panic might well ensue. Just remember the Dyn attacks of 2016 that resulted in “internet blackout” across the US east coast.

Connectivity is the backbone that enables the modern data economy and global commerce, but since we’ve become 100% reliant on it, if something were to happen that prevented our using it, the results would be grave.  

Open Source: Free Software, Free Vulnerabilities

20 years ago many companies were still selling perpetual software licenses, and it was impossible to imagine that free, open source software, developed by a community of hobbyists, would help many organizations run their businesses. But now open source software is an important component of almost every technology stack.

Also see: How Secure is Open Source Software?

However convenient and cheap, it embodies many risks. For instance, a recent study found that the most copied StackOverflow Java code snippet of all time contains a bug. A Java developer from Big data software company Palantir submitted this code back in 2010, and since then this code has been copied and embedded in more than 6,000 GitHub Java projects, more than any other StackOverflow Java snippet.

Utilizing someone else’s software has never been easier, but in doing so, we’re exposing our products to dependencies that may contain flaws and vulnerabilities as well as risking the possibility of a hard-to-detect supply-chain attack.

Mobiles: Universal Trackers, Universal Attackers

We had mobile phones back then. I mean, there were phones, and they were mobile: you could carry a phone in your pocket and talk to and text people and, well, that’s about all you could do with a phone in the year 2000. Fast forward to today, and it is hard to imagine how we could pass a single day without our smartphones, glued to the screen or broadcasting every aspect of our lives to the entire world in words, pictures and videos.

Unfortunately, this reliance on mobile technology makes us all more vulnerable. Cyber criminals know this and utilize this in myriad ways for fraud, theft and other exploits. In addition, since the mobile phone has become everyone’s “mobile command center” it has become the target of choice for reconnaissance and espionage efforts, which target users with crafted spearphishing and smishing attacks and tailored exploits for Android and iOS.

With mobile devices increasingly used on corporate networks, loaded with apps that are rarely evaluated for vulnerabilities, backdoors or data scraping and with a history of having been connected to a variety of external, possibly insecure networks, they present a rising threat to both personal and enterprise security.

The Cloud of Uncertainty: Who Has My Data?

The cloud represents an even bigger revolution than the smartphone. It was obvious to anyone back in 1999 that mobile phones would become more powerful and serve us to consume and create media. But very few people believed back then that we would all be storing our data on someone else’s Linux server, sitting quietly in some remote location completely unknown to us.

Moreover, no one would have believed that enterprises and governments would also utilize this same infrastructure to host data and run applications. And yet, thanks to Amazon and Microsoft, the traditional IT infrastructure (which required a chilled data center at every physical location) has been replaced by a virtual infrastructure hosted somewhere in a huge data center on the other side of the world.

Our dependency on cloud services is complete. We cannot operate the global commerce and knowledge economy without it, but when an outage occurs like that which happened to MS Azure back in November – resulting in outage of several Microsoft services including Office 365, Xbox App, Xbox Live, Skype, Microsoft Azure – or the AWS outage of September, it has a tremendous impact on individuals, businesses and governments.

When mission critical services rely on data held outside our own immediate control, the notion of ‘security’ becomes an article of faith. Who is to say if those remote servers won’t lock us out unexpectedly? How are we to know who else has access to our data or whether the devices holding it have been compromised without our knowledge?

The Internet of Things: Network Entry Points, Everywhere

The cloud is also the enabler of the next revolution, that of connected ‘smart’ devices, aka ‘Machine to Machine (M2M) or ‘Internet of Things’ (IoT) devices. This connectivity bridges the divide between the physical and the online world and enables wired devices to “sense” their environment and then “talk” to other devices, or, through the cloud, with their owners.

Also see: IoT in the Enterprise | How Dangerous Are Today’s ‘Smart’ Devices to Network Security?

This kind of connectivity is being brought to everything from garbage cans to street lights to autonomous vehicles and aviation. However, it also enables nefarious cyber activities on a scale we’ve never seen before, like the Mirai botnet that generated the largest DDoS attack the world had seen to that point, and other huge botnets, sometimes comprising as many as 850,000 computers, that are then used for cryptocurrency mining.

IoT devices bring security risks and privacy risks. Increasingly, wired ‘Smart’ devices are being recruited by botnets to gain entry into networks, and many devices leak personally identifiable information.

Meet Cybercrime: The New ‘Cost of Doing Business’

As we’ve seen, the changes that have taken place over the last 20 years have given various threat actors fertile ground on which to flourish, and flourish they have. Cybercrime has become a truly global phenomenon which impacts most industries and is expected to cost the world over $6 trillion annually by 2021.

On the defenders side, cybersecurity-related spending is predicted to reach $133 billion in 2022, and the market has grown more than 30x in the last 20 years, adding to the overall financial burden on companies and governments, most of which see the money invested in cyber as a loss or “cost of doing business”, as it is generally viewed as an expense that does not yield profit or generate revenue.

However, this ‘new’ cost of doing business is a reality that no modern enterprise can afford to ignore. From script kiddies with ransomware projects to sophisticated attackers targeting universities, the only way to do business in 2020 is with cybersecurity firmly factored in to the operational budget.

From the smallest business to the largest multinational organization, being part of the connected world in 2020 exposes you to risks that simply didn’t exist in the year 2000.

Final Thoughts…

December 1999 feels like a log time ago. Indeed, it really is closer in nature to the remnant of the previous century and even millennia than to our time today. It is highly unlikely that a single point of failure (like the Millennium Bug) could lead to the “end of the world”. But on the other hand, our hyper-connected environment makes us more vulnerable on so many levels, in our offices, cars and even our homes. Luckily, the technology hasn’t stood still and modern security mechanisms now exist that are capable of dealing with these threats across platforms, including IoT, using the latest in our tech arsenal, leveraging AI and machine learning. The Y2K bug hasn’t taken us back to the analogue world, and if we continue to safeguard our connected way of living, neither will the hackers.

---

Like this article? Follow us on LinkedIn, Twitter, YouTube or Facebook to see the content we post.

Read more about Cyber Security

• 7 Scams of Holiday Season Cyber Criminals
• The Demise Of the Perimeter and the Rise Of the Security Platform
• MacOS Malware Outbreaks 2019 | The Second 6 Months
• Ransomware as a Service | What are Cryptonite, Recoil and Ghostly Locker?
• macOS Update | What’s New With Catalina 10.15.2?
• 5 Things to Know About SentinelLabs’ Finding Link Between Crimeware and APT Lazarus
• Preparing for 2020: Trends in Cybercrime, Threats and Risks

It’s that time of the year again when we’re all doing the two things that cyber criminals love most: spending money and giving generously. Those who seek ill-gotten gains from others have come up with plenty of ways to dupe, manipulate and steal during the holiday season. In this post, we cover seven scams to keep an eye out for.

1. Juice Jacking

The holiday season inevitably involves a lot of us traveling to and from distant friends and relatives, and that can mean visiting unfamiliar public places while in transit as well as seeking out the last drop of battery power from our mobile devices. Los Angeles County District Attorney has warned that criminals are taking advantage of this by loading malware into public USB power charging stations located in places like airports and hotels.

“Juice Jacking”, aka the USB Charger Scam, can take several forms. Fraudsters may install malware onto your device through an infected USB port or cable left hanging in a public charge point, or they may try to give away malicious USB cables as “free gifts” that are loaded with credential-stealing malware. The intent is to export personal data and passwords so that the cybercriminals can drain your bank accounts or commit identity theft.

To stay safe, never use a cable that’s been left in a charging station and don’t accept cables given away as promotional gifts.

Ideally, carry your own cables and a “power bank” charging pack. When charging on the move, find an AC outlet and plug your own charger directly into it.

2. Poisoned Public Wifi

We all love to stay connected while on the move, and retailers, coffee shops and bars know that a free, public wifi hotspot is good for business. Unfortunately, it’s easy for attackers to impersonate these or snoop other users on the same Wifi network.

Snooping means that other users of the network can see your unencrypted traffic – what websites you visit and any clear text data you send through the public hotspot, including what you type into web forms on unencrypted sites. Impersonation occurs when a threat actor sets up a malicious hotspot or rogue access point with an SSID the same as or very similar to the one that you intend to connect to.

In order to stay safe, avoid connecting to public Wifi networks where possible and disable any network discovery settings that allow your device to automatically join public hotspots. Where you do need access, ask staff to confirm the correct Wifi network name (SSID), ensure you’re only browsing sites that begin with https or display the green padlock icon.

Importantly, even if using https, avoid connecting to personal banking or other highly-sensitive, password-protected sites while on public Wifi. Save that kind of work for when you’re connected to a known, trusted network.

3. Holiday Charity Scams

The festive season draws out the best in many of us, but the worst in some, too. There are a number of known scams that target people’s generosity during the holiday season. Some fraudsters spoof the phone numbers of legitimate charities, making it appear on your caller ID that the incoming call is from a charitable organization – and use robocalls and texts to target unwitting consumers. Others go so far as to set up fake charities or pretend to be agents of legitimate organizations.

To stay safe, refuse solicitations from callers either online, on your phone or at your door claiming to represent a charity. If you wish to donate to an organization, approach them directly and check their credentials by visiting their official website.

Never give out personal information to an unsolicited caller, as they may use this to commit identity theft.

4. Seasonal Phishing Scams

The holiday season makes an ideal time for phishing scams as many of us are in a rush and desperate to buy gifts at bargain prices. Meanwhile, genuine online stores are bombarding our inboxes with holiday discounts and special offers. Prime conditions for spammers to hook victims with phishing links to malicious websites that may be clones of the real thing but are really intended to drop malware or phish login and password credentials.

These scams may take the form of special offers, gifts and coupons, or claims that you’ve been invoiced for something you didn’t order and that you need to click a link to “report a problem”. Some bad actors embed malware in images as well as attached documents, while one notorious malware platform has been spotted conducting a seasonal phishing campaign by inviting targets to accept an invitation to the staff Christmas party.

Of course, all these are just prompts to get the user to either download a malicious file, click a fraudulent link or enter credentials on a fake website.

To stay safe, use trusted security software to block malware. Disable the loading of remote content in your email client preferences, and inspect link addresses before clicking on them. Look out for simple tricks where the scammer users what looks like a real address, say google.com and replaces one or more letters with a homograph or punctuation, like go0gle.com or goo.gle.com. Such tricks may seem obvious on inspection, but are easily overlooked when only glanced at. When you do land on a website, pay attention to what’s in the address bar.

It helps to ensure your browser preferences show full website addresses and that your Safe Browsing prefs in ‘Privacy & Security’ are turned on.

5. Fake Updates

Keen to share and join in the fun, we’re all prone to clicking on a video shared across social media, text message or email, particularly during the festive season. But beware of those that pop up a message telling you that you need to update or download some kind of media player – fake Flash players are a favorite of adware and malware scammers – in order to view it.

These are almost always the first sign of a scam in which the fraudsters aim is to infect your device either with a PUP/adware installer or a more serious Emotet, Trickbot or other trojan platform.

To stay safe from these kinds of threats, always dismiss any such pop-up alerts. Launch your usual media player from the Dock or Taskbar and check if it really needs an update.

Note that if your media player won’t play the media file of a type it should, assume the offending file is malicious and send it to the Trash. Again, a good security solution can protect you from this kind of threat.

6. Fake Coupon & Discount Apps

Fraudsters don’t only restrict themselves to setting up fake websites; they’ll even build entire fake applications and distribute those through unofficial app repositories in the aim of getting users to download malware. These apps typically offer users multiple discounts or coupons promising great deals on many popular products.

In general, you’re safer sticking to apps distributed from reputable app stores, but it’s worth bearing in mind that these have also become increasingly targeted by malicious actors. Apple’s iOS App Store has had a few high-profile cases of data exfiltrating malware and spyware, and problems with Google’s Play Store are a common news item.

To stay safe, only download and install applications that you have a genuine need for, and always check out the details of the developer.

Most ‘free apps’, particularly those offering shopping discounts are going to be at best plaguing you with in-app advertisements in order to generate their income. At worst, they may be delivering malware or stealing you data.

7. Fraudulent Ads

Encountered all year round but descending like a plague between November and January, scam ads can be found not only on sketchy websites but also circulated through social media like Facebook, Twitter, and other sharing platforms. With billions of users, these platforms make attractive targets for ads containing malicious links.

In some cases, these fake ads may show multiple items, with several listed at normal prices but one item at some incredibly low price. They may even contain text such as “Due to a pricing error, this item is now on sale at half it’s RRP, but it won’t be for long!” The aim is to make people click immediately to take advantage of what they think is a mistake. Of course, it’s all a scam and the link takes the user to a fake sale site with credit card skimmers embedded in the code.

Ads run by scammers can be difficult to spot, since they use many of the same marketing tricks as legitimate ads. And although there is a breed of such ads that use poor quality, blurred images, others simply steal glossy, highly-produced photos from real products. If you are tempted into clicking on an ad placed through social media, check all the details carefully. Does the website offer comprehensive information about product details, shipping costs, returns and customer support? Is the language on the website error-free?

Use a whois lookup to see how long the website has been around (scam sites are usually less than a few months old). And ultimately, is the deal “too good to be true?” The best defence against fraudulent ads is buyer caution.

Conclusion

The holiday season is a time for giving and reflection, and not a little relaxation. Unfortunately, there’s plenty of scammers and fraudsters out there intent on selfishly exploiting this time of year for their own ends and ruining the festivities for others. We hope that the tips above will help you to avoid becoming a victim and wish everyone a safe and happy festive season.

---

Like this article? Follow us on LinkedIn, Twitter, YouTube or Facebook to see the content we post.

Read more about Cyber Security

• The Demise Of the Perimeter and the Rise Of the Security Platform
• MacOS Malware Outbreaks 2019 | The Second 6 Months
• Ransomware as a Service | What are Cryptonite, Recoil and Ghostly Locker?
• macOS Update | What’s New With Catalina 10.15.2?
• 5 Things to Know About SentinelLabs’ Finding Link Between Crimeware and APT Lazarus
• Preparing for 2020: Trends in Cybercrime, Threats and Risks
• macOS Red Team: Calling Apple APIs Without Building Binaries