Routers and IoT proven path to hacking insecure smart homes and businesses – Technologist

Fans of the Die Hard franchise will recall that in the fourth instalment, Live Free or Die Hard, an attack was made against American public infrastructure.

That attack may not be so fictional, as the latest Trend Micro report suggests that devices such as routers are entry points to attacks. Recall the infamous attack against Bangladesh’s central bank which saw hackers steal US$80 million. Reuters blamed the successful hack because the bank “skimped on network hardware and security software”.

According to Trend Micro vulnerabilities cut across both industrial, commercial and consumers, such as routers and IoT devices being used for cryptocurrency mining and pharming attacks.

Cryptocurrency owners have become a major target in 2018 using cryptocurrency-mining malware and cryptocurrency-stealing malware. Trend Micro says underground forums continued to peddle wares that use smartphones, routers and IoT devices for mining activities.

Healthcare industry is a lucrative one that remained highly vulnerable to attacks due to both the nature of the data they keep and the state of network and supply chain security, particularly in connected hospitals.

Trend Micro uncovered exposed HMIs in oil, gas, biogas, power, and water companies, where there was little or no authentication required to view or interact with consoles. This finding is especially concerning because of the nature of the services these companies supply; for instance, an attack on the water supply of a certain region can have disruptive results and may lead to several knockoff effects.

Trend Micro concluded that the industry remained highly vulnerable to attacks due to both the nature of the data they keep and the state of network and supply chain security, particularly in connected hospitals.

The security vendor drew up several attack scenarios related to the exposure of the communication protocols Message Queuing Telemetry Transport (MQTT) and Constrained Application Protocol (CoAP). Organizations need to stop using default configuration settings and need to deploy encryption and authentication methods.

Singapore: SEA hub for malicious URLs in SEA

2018 Trend Micro survey identifies Singapore as top stop for compromised business email.

As part of its 2018 annual security roundup Trend Micro identified Singapore as the most vulnerable (68.1%) country in Southeast Asia (SEA). Malicious URLs hosted locally were blocked more than 3 million times, and over 15 million attempts by Singaporeans to access malicious URLs were blocked by Trend Micro.

Attacks that capitalize on the human desire to respond to urgent requests from authority are on the rise. The number of business email compromise (BEC) attacks in 2018 increased by 28% globally. While these attacks are less frequent than phishing attacks, they are more sophisticated and take more careful planning for cybercriminals.

BEC scams are a pressing issue amongst Singapore-based companies. The nation ranked first in SEA for experiencing the most BEC attacks (consisting of CEO fraud) last year (27.3%), followed by Malaysia (26.1%) and Indonesia (25%). On average, they yield approximately S$177,000 per attack.

Vietnam, Indonesia and Singapore were the three SEA countries with the highest numbers of email threats blocked by Trend Micro at 46.2%, 21.3% and 10.9% respectively. Trend Micro detected more than 55 million malware attacks in SEA. Malaysia took top spot at 29.6%, followed by Singapore (19.8%) and Thailand (16.4%).

Those are the bad news. The good news is there is rising interest in machine learning and artificial intelligence technologies to enable enterprises to circumvent these threats.

Nilesh Jain, vice president, Southeast Asia and India, Trend Micro said: “Previously, attackers relied on spray and pray style attacks. Today, they can be more effective with targeted phishing emails to infect victims who click the links or open the attachments. Enterprises need to strengthen their cyber defences at every touchpoint, namely, on the endpoint, in the cloud, and at the network layer.”

Making the digital world a safe place for information exchange requires several approaches. Not least of these is a deep understanding of the current landscape, especially around public service sector equipment and systems, to which connectedness introduces notable risks even as it provides expansive efficiency.