Introduction

We have a tradition to start the working day with a cup of coffee and call with our lovely customer or associate. Just after this, I've got informed that there is a potential customer requesting us. It's an amazing start of the day, right?

The message

I've opened the message, it was brief and inspiring:

But something was not right. I felt discomfort. So, I've examined this message once again. And discovered, that Jennifer Webb has the e-mail address This email address is being protected from spambots. You need JavaScript enabled to view it. Well, who knows, maybe that's her nickname, right?. So, I've decided to google for this e-mail address. Fortunately, about a year ago this case already happened to another web development studio: SearchRank Special thanks to Devid Wallace.

How does it work?

Sure, as a vendor you are interested in obtaining a new customer. Credit card payments interface accessible for your business via PayPal, Square, Quickbooks. Why not? Moreover, "customer" is paying in advance, leaving tips and transferring more.

According to our stats, about 20% of people will gladly and happily accept this proposal. Unfortunately, the level of awareness is too low, to prevent others to be fooled by these scammers, but what we really can do - is to spread this information further. So, at least these, who will google, can read and avoid financial loses.

The scam is really simple.

• Somehow they aren't able to wire payment to the vendor, but the vendor can charge their credit card. By the way, maybe this is a real, but stolen credit card.
• The vendor is charging them and they accept the payment.
• Now the vendor has to transfer $XXXXX to their designer.
• Next day the transaction will be declined by the bank.

What to do?

Just ignore this. If you have a doubt or want to play with these scammers - check with your Cyber Security Expert what you can and what you shouldn't do. But better - save your time and ignore scammers. Actually, that's exactly what they will do if they'll get that you are just playing with them.

Be careful!

Be aware!

Be safe!

What to do if you've got breached?

As every good thriller, this one started from the call. Our local partner called me about his associate insistingly dialing him and texting about a security incident. He mentioned, that he will really appreciate if our security team can handle this request. As the typical unaware victim of the thriller I've said: "Of course!" and answered the call. Indeed, I never mind about helping our local partner and his associate. So, a bright, shiny, and sunny day of business as usual stops right now and the action begins!

The Threat.

Through more than 10 years we passed through a few hundreds of security incidents. But it was only a second one when the cybersecurity intrusion has been followed by breaking in a customer's premises.
Yeah, you can see there is nothing fun with this. Imagine that credit card information of several employees has been stolen, website was showing weird images, other people got contacted from accounts, related to this company in Linkedin, Facebook, Twitter, regarding financial help, accounting department laptops got compromised and out of control and finally, someone broke into the security room and perhaps to other premises, switched off surveillance and stolen all records related to this day.

Even having a good experience with such incidents, that's too much.

By the moment we've arrived at the customer's office, they've already called the police, called the bank and blocked their credit cards, shut down the office internet. The action involved me and all our cybersecurity team in this action thriller.

So what was right on this stage and what was missed:

• Call cybersecurity consultants. CORRECT. Indeed, you need to have experts to get the situation under control without any delay.
• Call the police. CORRECT only if somebody broke into your premises. The police can potentially react on cybersecurity threat and perhaps, in future, they will do this as a part of their day-to-day duties, but now - they can start an investigation only if your privacy has been violated, life or health is in danger, something has been stolen.
• Call the bank and block the cards. CORRECT. In fact, even if no-one made an attempt to use your credit cards after the security incident - it's a very good idea to mitigate the future risks and change your credit cards information. For sure, the future will be less insulting to you.
• Shut down the office internet. Not quite correct. From one point of view, it's overreacting. From another, if the malicious software is already in your office - it still can spread through your computers and other devices connected to the intranet. Nevertheless, compromised computers should be turned off for sure. Their hard-drives should be removed for further investigation. They may have evidence regarding this intrusion.
• Gather all your employees. Inform them about the threat. According to statistics about 25% of confirmed cybersecurity incidents happened with the assistance from inside. In our case, if there was an intruder, who'd hit the surveillance room (which was in the basement, there were no people inside, an intruder had a key) - the probability of the "mole" assistance is ~99%.
• Record any and all evidence of the intrusion.Hackers will wipe out all signs of their presence as soon as they can. They only thing they are afraid of is exposure. Make a photo, screenshot, video, save the log file in another place. Anything with timestamps will help the investigation and will be included in forensics.
• Mirror log files, surveillance data, and key business information in another place. You already know that Hackers don't like exposure. If they will note that they can't hide their presence and/or it's very complicated - perhaps they even won't try to breach your infrastructure. Well, sure, if they are smart enough.
• Inform all and everyone that your social networks and/or e-mail accounts got compromised. Block these accounts or Change passwords to automatically generated strong passwords ASAP. As soon your associates and relatives will be informed - they won't do mistakes and less impact to your environment will be.
• Inform your customers/business associates about such a force-major incident ASAP. For sure, the business will be paralyzed for a while. Some deliveries will miss the date. Some important calls and meetings will be missed. It's better to let businesses linked to you know about this than wonder about your reliability. They also can eventually know about this, so your silence can be associated as an attempt to hide the impact to their business.
• Point the address to the website out from the compromised one. This is not only the bad PR for the company if the website got compromised - it potentially can be used by intruders for their own objectives. So, just cut this threat out until the further investigation.

To be continued

Be cyber-careful!

Be info-aware!

Be safe!

Social Engineering

According to Wiki #SocialEngineering is the psychological manipulation of people into performing actions or divulging confidential information. A type of confidence trick for the purpose of information gathering, fraud, or system access, it differs from a traditional "con" in that it is often one of many steps in a more complex fraud scheme.

How it works?

Imagine that something weird is happening to someone's website. What will you do? In fact, the real answer does not matter, because now you know that it happens.

Now imagine that your associate or friend has got his website hacked. How do you feel now? With an 80% probability, you'll be sorry. But what's matter - since this very moment you'll be sure that it can happen to you too.

Finally, something weird is going on with your website or computer.

THAT'S THE STARTING POINT

If you know something about it and definitely confident with it - good for you, so you can calmly investigate, understand and fix it.

If not - you'll decide to google for security protection tools, actually, like you did last time with antivirus software [which in fact is really useless without other cybersecurity tools] last year. For some time you'll feel quite confident and protected until things will turn to even weirder. So, what's up?

THE CON

In many cases the spyware, rootkits and trojan horses are quite hard to market, right? Like my marketing friend said once "Do you know what is the difference between a rat and a squirrel? No? Squirrel has better marketing". It works definitely the same way with spyware, rootkits, and trojan horses. They are never marketed as "a rat". They are always aggressively promoted as "a squirrel". Moreover, the FREE squirrel. These people think "Why have I pay for the subscription or the product from a well-known source if there is one FREE?!"

The con is inside. Nobody will agree that he is not smart. Everybody thinks that he is smarter than others. You should know this feeling, right? So, what "smart" people do? Exactly, they are doing smart things and downloading free. Because Free is Cheaper.

THIS POINT IS THE LAST ONE TO TURN AWAY FROM IMMINENT PROBLEMS