FROM A SECURITY PERSPECTIVE, IF YOU'RE CONNECTED, YOU'RE SCREWED

John Brennan, director of the notoriously secretive US Central Intelligence

Agency (CIA) has said that no one is safe from hackers only a few months after his personal email account was breached and the contents leaked online.

"The cyber environment can pose a very, very serious and significant attack vector for our adversaries if they want to take down our infrastructure, if they want to create havoc in transportation systems, if they want to do great damage to our financial networks," he said.

When asked whether other nations have the capability to 'turn off the lights' of the US he said: "I think fortunately right now those who may have the capability do not have the intent. Those who may have the intent right now I believe do not have the capability.

YOUR PAYPAL ACCOUNT IS WORTH $6.43

Online criminals are more interested in getting their hands on stolen Uber, PayPal and even Facebook accounts, than credit card numbers and other personally identifiable information.

 The price of these stolen identifiers on the underground marketplace, or “the Dark Web,” shows the value of credit cards has declined in the last year, according to security firm Trend Micro.

Last week, stolen Uber account information could be found on underground marketplaces for an average of $3.78 per account, while personally identifiable information, such as Social Security Numbers or dates of birth, ranged from $1 to $3.30 on average – down from $4 per record in 2014, reported CNBC.

Furthermore, PayPal accounts – with a guaranteed balance of $500 –were found to have an average selling price of $6.43. Facebook logins sold for an average of $3.02, while Netflix credentials sold for about 76 cents.

By contrast, U.S.-issued credit card information, which is sold in bundles, was listed for no more than 22 cents each,

“It’s an incredible underground ecosystem. There is a high level of competition for these criminal buyers and there are a lot of different types of forums. It’s incredibly diverse, but incredibly mature,”Said Ed Carbera, Trend Micro’s vice president of cyber security strategy.

Cyber criminals will often use stolen Uber credentials to book “ghost rides,” in which they create a fake driver account and charge nonexistent rides to stolen accounts, experts say.
Another way fraudsters leverage this information is to simply build a fuller picture of a victim for identify theft.

“They are doing their own market research or where they can find the data that’s most valuable in the criminal underground and they develop their attacks accordingly,” said Cabrera.

Meanwhile, Forrester research analyst Andras Cser adds these incidents highlight the need of these service providers to be more cognizant of sudden changes in user’s account behavior.

“If a user suddenly takes a cross country ride versus following their usual movements, that should spark an alert,” notes Cser

To address the issue of fraudulent transactions, Uber is reportedly testing its version of two-step authentication, which would require users to enter additional credentials when logging in from an unknown device.

The time has come to move away from passwords.

“Firms should be looking at behavioral biometrics solutions to authenticate users — how the user actually behaves, how they hold a phone, how big their fingers are and how hard they press the touch screen."

Are We Blindly Moving Forward?

In just the last few days reports of hacking and ad fraud appeared as footnotes in the trade media.

CMOs have much to be concerned about.

ITPRO announced that a YAHOO malvertising attack left 900 million users at risk of ransomware.  Yes, that was 900 MILLION.  On the same day, Trustwave Holdings discovered hackers who were using RTB platforms to spread a Trojan virus through programmatic ads that do not need to be clicked on to activate the virus.  In other words, simply visiting a site can infect a computer.

As most programmatic platforms do not have robust technology to distinguish between hackers and advertisers, Trustwave believes it is fairly easy to pose as a legitimate business and buy up infectious ads.

It is no wonder that the Association of National Advertisers and the International Advertising Association are raising the specter of transparency concerns.  As a result, they are commissioning studies and surveys in an attempt to stem the flow of fraud across all media disciplines.

ComScore recently tracked NHT (Non-Human Traffic) across a number of campaigns and recognized that 14% of the campaigns generated 5-20% of NHT, accounting for 45% of the total NHT impressions. Another company at the forefront of fraud analysis is Forensiq, "relentlessly fighting online ad fraud".

I would venture that most CMOs have no standards in place with sellers, technology platforms feeding programmatic and traditional trades, their agencies and data providers.

 

Recently, a Jeep SUV was hacked through its entertainment system and controlled from a remote (10 mile) distance and forced to drive off the road.  Chrysler and Harmon are now facing class-action suits.  Could Yahoo face similar negligence suits for failing to protect its users from the malvertising hack?  

It’s getting ugly and it’s just the beginning.