[2016]
In an IoT world where everything is being connected to the internet and to each other, it is easier than ever for fraudsters to wreak havoc. One of the risks of the increasing number of connected devices is the rise of IoT botnets.
Botnets are typically comprised of a large group of computers, routers or servers. The computing power of these devices is jointed together, typically without the owners’ knowledge, and remotely controlled by a single ‘botmaster’. The botmaster is often part of a criminal organization that uses the botnets for various types of fraud, including denial of service attacks, which can cripple financial institutions or ecommerce sites, costing businesses millions in losses. Or they can divert traffic to fake webpages and advertising sites, defrauding consumers by stealing their financial and personal information.
Earlier this summer, SC Magazine reported on a growing type of botnet fraud- one that uses IoT devices, instead of the more traditional hardware, to cause havoc. In one of the latest instances, a days-long distributed denial of service (DDoS) attack was initiated against a bricks-and-mortar jewelry store. After researching the event, it was discovered that the attackers had infected thousands of CCTV cameras, and used them to overwhelm the jewelry store’s servers with HTTP requests coming from all over the world - peaking to almost 50,000 per second.
CCTV cameras are typically used for surveillance purposes, and as of 2014, there were 245 million operating around the world. Like most IoT devices, they lack the anti-malware software that protects our more traditional computing hardware. Another case occurred when security researchers at Proofpoint uncovered the very first wide-scale hack that involved television sets and at least one refrigerator. Yes, a fridge. And this problem will only get worse over time. According to Juniper Research, by 2020 there will be close to 40 Billion connected devices on the planet.
With millions of these new smart devices coming into the market every month - everything from connected cars and machinery, to watches and yes, even refrigerators - the rush to meet demand has meant security has taken a back seat. Without the ability to install, let along update security software, these billions of ‘things’ could be commandeered to wreak all types of havoc – creating a futuristic Trojan horse. And while crashing a jewelry store website seems more like a nuisance than something to be alarmed about, the attackers are using DDoS to slow down the response to the real issue, which is the fraud that is actually taking place. In fact, DDoS attacks are typically just the first sign of bigger fraud problems to come. Can you imagine a CCTV camera or a refrigerator making calls to premium rate number service? Yes, your fridge is low on milk, but instead of communicating with the store, it is making calls to a hotline at $0.60 per minute, allowing fraudsters to collect the money on the other side.
While finding ways to improve security to prevent these attacks is important, it will never be enough. Creating tighter security is just the first layer of protection. What happens when the fraudsters break through? In an IoT world, with so many new devices creating so many potential points of failure, this is not just a risk, it is reality. If it doesn’t happen today, chances are it will happen tomorrow. After all, the end game for hackers and fraudsters doesn’t stop at just breaking into a CCTV camera or other device – it’s the damage they do once they gain access that is the real problem, but first you need to be able to find it. That is why the 2nd layer of protection is even more important - fraud management. Today’s leading Fraud Management systems allow businesses to constantly monitor information across an organization, watching for unusual trends, and even predicting fraud before it happens. This way, when the security layer is breached, the fraud management system will be able to identify the threat and minimize any potential damage. These two layers, Security and Fraud Management, need to work hand in hand.
At WeDo Technologies, we work constantly to monitor new and dangerous types of fraud. Our fraud management software prevents, detects and manages telecom fraud for many of the leading providers around the world. Using highly advanced machine learning techniques, RAID:FMS is able to identify unusual patterns and correlations from disparate data sources, going far beyond traditional rule based fraud management. For more information or to speak with one of our fraud management specialists, visit www.wedotechnologies.com.
Let Us Know What You Thought about this Post.
Put your Comment Below.