Online Fraud – How Serious Is The Problem?

Cloud For Dummies.png
The Sticky Note.png
Data Bed.png
Answer To Everything.png
The Manuscript.png

Cloud-Based Fraud

Cloud services have brought untold benefits to both personal users and businesses around the world, but with its success has come a darker side – as the cloud unquestionably helps criminals commit fraud and other illegal activities.

Why does it Happen?

The cloud’s key benefits, such as rapid elasticity, on-demand provisioning, high availability and competitive pricing, are all equally as appealing to cybercriminals as to ordinary users.

Cloud-Based Fraud – How Serious is the Problem?

Cloud services are easy to purchase, can be reasonably anonymous, and can be controlled from anywhere in the world. Jeff Spivey, International Vice President of ISACA (an independent, non-profit, global association that engages in the development, adoption and use of globally accepted information systems knowledge and practices) says, “All of the advantages of the cloud for enterprises are [also] the advantages for the bad guys”. Adding “It’s the anonymity and scale that’s attractive to the fraudsters”.

How does it Happen?

There are many different routes open to a cybercriminal. From phishing schemes and money-transfer scams to identity theft and Malware – each has its own dangers and requires its own prevention methods.

For a would-be criminal, the process is easy. Research suggests that stolen credit cards can be obtained on the black market for as little as one dollar. Once a criminal has a card it only takes a matter of minutes to sign up online and take control of their own server. The server will have been purchased using a stolen identity on a stolen card without physically talking to anyone from the service provider itself – it’s almost the perfect crime.

Raj Samani, Vice President and Chief Technology Officer of McAfee, also points out that despite the vast resources dedicated to protecting customer data by cloud providers, for a criminal it can still be easy to hack a legitimate customer account. “They use the VMs to use for their own fraudulent activities” says Raj. “Cybercriminals are now looking to Infrastructure as a Service to provide vast amounts of on-demand processing power to launch distributed-denial-of-service attacks”.

Banking Fraud in the Cloud

One of the most high profile fraud cases in recent years is that of ‘Operation High Roller’. An international criminal ring targeted wealthy people and commercial accounts across European banks, with McAfee estimating that anywhere between $75 million and $2.5 billion was stolen.

The entire fraud was conducted through the cloud. The combination of remote servers and the criminals’ intimate knowledge of banking transaction systems made it possible to automate the theft, rather than simply stealing user names and passwords and manually transferring money from a computer.

The fraud started with an email disguised to look like it came from the recipient’s bank. Clicking on a link in the message downloaded the malware that would later steal the information needed to perform fund transfers. Commenting on the attack, Dave Marcus, Director of Advanced Research and Threat Intelligence at McAfee, said “You can’t make a fraudulent transaction look like a valid transaction, if you don’t know what you’re doing, and these guys know what they’re doing”.

Detecting and Protecting

There is a fine line between balancing customer privacy concerns and preventing illegal activities. As result, cloud providers have spent huge sums on developing systems that monitor how customers use the service without monitoring the actual data. As soon as large scale fraud is detected the information is passed to the relevant authorities.

The difficultly for providers is not being over-zealous with their detection software. Customers who are regularly prevented from using the service the way they want because the provider wrongly assumes there is criminal activity will quickly get disenfranchised with the cloud and look to alternative methods of storage.

What do you think? Have you been a victim of cyber-fraud? Do you receive regular attempts to phish your details via email?

By Daniel Price

Virtana

Episode 8: Managing Cloud Strategy During the Chaos of 2020, Plus an Outlook for 2021

An Interview with Kash Shaikh, CEO of Virtana Companies are wrestling with the idea of moving to the cloud, staying on-prem or finding a hybrid solution. Kash Shaikh, the new CEO of Virtana, looks at ...
Jim Fagan

Behind The Headlines: Capacity For The Rest Of Us

Capacity For The Rest Of Us We live in the connected age, and the rise of cloud computing that creates previously unheard of value in our professional and personal lives is at the very heart ...
Data Web Accessibility

Protecting Yourself from the Rise in Ransomware this Holiday Season

Rise in Ransomware The Baltimore Public Schools system was already dealing with pandemic learning conditions when it was hit by a ransomware attack the day before Thanksgiving. School officials were calling it a "catastrophic attack ...
Gary Bernstein

5 Popular Telemedicine Software Services

Telemedicine Software Since the beginning of the Covid-19 pandemic, telemedicine software services have become extremely popular, and every day more people are using this service instead of going to hospitals and emergency departments as they ...
Dr. Mike Lloyd

How to Mitigate Security Risks in the Cloud

How to Mitigate Security Risks in the Cloud Enterprises continue to spend billions annually on security technology, yet cyber breaches continue to come fast and furious. So what exactly is going on here? Why are ...

TECH ELEARNING

The CloudTweaks technology lists will include updated resources to leading services from around the globe. Examples include leading IT Monitoring Services, Bootcamps, VPNs, CDNs, Reseller Programs and much more...

  • Plural Site

    Pluralsite

    Pluralsight provides online courses on popular programming languages and developer tools. Other courses cover fields such as IT security best practices, server infrastructure, and virtualization.

  • Isc2

    ISC2

    (ISC)² provides IT training, certifications, and exams that run online, on your premises, or in classrooms. Self-study resources are available. You can also train groups of 10 or more of your employees. If you want a job in cybersecurity, this is the route to take.

  • App Academy

    App Academy

    Immersive software engineering programs. No experience required. Pay $0 until you're hired. Join an online info session to learn more

  • Cybrary

    Cybrary

    CYBRARY Open source Cyber Security learning. Free for everyone, forever. The world's largest cyber security community. Cybrary provides free IT training and paid IT certificates. Courses for beginners, intermediates, and advanced users are available.