Nov. 23 (Portaltic/EP) –
‘Typosquatting’, ‘vishing’ and ‘smishing’ are just some of the techniques that cybercriminals use on dates such as Black Friday and Cyber Monday, when online purchases multiply, often plagued by offers that are not what they are. that appear and result in the massive theft of user data and money.
In recent years, the day after Thanksgiving – the last Thursday in November – and the following Monday have been established in Spain as two important dates on the calendar for buy Christmas gifts, whether consumer products or services.
So much so that seven out of ten Spaniards assures that it will buy some product during the campaign, according to the ‘Study on savings habits of Spaniards’, recently carried out by Chollometro among users between the ages of 18 and 44. This means that this year 20 percent more people will shop during Black Friday and Cyber Monday compared to last year, according to data provided by U-tad.
This situation is more than favorable for cybercriminals, who design different social engineering campaigns – attacks designed to trick users into accessing useful information – to take advantage of the movement of purchases and data, so it is worth taking into account what they are. the most frequent these days.
First of all, it should be noted that during these shopping days frauds with Fake coupons, discounts and the well-known ‘flash’ promotionswhich seek to attract the most unsuspecting users who believe that they should not miss out on an offer that is too attractive.
These also tend to be victims of the so-called ‘malvertising’ or distribution of online advertisements used by cyber attackers to distribute malicious programs or redirect user traffic.
There is also a wide dissemination of malicious applicationsdesigned with the intention of stealing data by posing as legitimate ones, damaging devices or compromising the security of users, who end up becoming victims after their installation.
Although Black Friday and Cyber Monday are important dates for cybercriminals, they also take advantage of the opportunity to execute campaigns with techniques as simple and effective as the ‘typosquatting‘, which consists of creating both ‘apps’ and fake websites taking advantage of common typographical errors and changing letters and numbers that look very similar. For example, the letter ‘o’ for a zero (0) or the letter ‘l’ for a capital ‘i’ (I).
Although they are not exclusive to these shopping days, on these dates there is never a lack of attacks of ‘phishing’fraud through emails aimed at obtaining personal and financial data. This consists of deceiving a user by posing as a trusted company, service or person.
To do this, scammers create a seemingly legitimate email and send communications that require immediate action. For example, clicking on a link to a website that turns out to be fake, even though it may look legitimate.
Taking advantage of this technique, it is worth noting that it is also common to website cloning, illegitimate pages that malicious actors use to collect personally identifiable information (PII), login credentials, and personal data from consumers.
In both cases, and so that users do not end up taking the bait, it is advisable to access the proposed service through the browser, entering the URL sent through these messages manually, instead of clicking directly on the link. .
He ‘vishing’ It also points to an alleged urgency through fake phone calls, in which malicious agents impersonate a company or service to obtain confidential information. The most common thing is that they impersonate the bank and report an alleged problem with the victims’ credit cards and that they need personal information to block them to avoid fraud.
In line with these telephone scams, it is worth remembering that a new type of deception has multiplied where the victim receives a call and, when they respond with a ‘yes’, a message appears in which they are notified that they have formalized the hiring of a specific service.
Users, bewildered, call back and give their confidential information to, presumably, cancel that service, leaving all their personal information exposed so that cybercriminals can do whatever they want with it, including hiring another service at their expense. .
THE MOBILE, THE GREATEST DANGER
As has been seen, the vast majority of malicious campaigns target the victims’ smartphones, something logical considering that it is a device that accompanies the user wherever they go and works like a small computer.
Therefore, in addition to the scams mentioned, it doesn’t hurt to closely monitor SMS messages and SIM cards. This is because advertising campaigns are also frequent. ‘smishing’a social engineering technique of the same type as ‘phishing’, which sends the scam through an SMS.
The duplicate SIM card is called SIM swapping and they take place after the victims’ information has been stolen, when the attackers impersonate them to request a duplicate of their SIM card. In many cases, to get it, it is enough to call the telephone company and give your ID and full name.
Once they are exposed, it is very common that when attackers want to access an ‘online’ service, such as an application or electronic banking, they are asked for extra identification, for which an SMS is sent. If this security code has not been requested, it is advisable call the phone company to cancel the duplicate card.
IMPROVE SAFETY IN NAVIGATION
Although a good part of the purchases are made through mobile phones, cybersecurity experts agree that the scams mentioned also frequently reach other electronic devices. Likewise, they point out that there are a series of tools that can help prevent your information from ending up in the hands of scammers.
To avoid disappointment in purchases made through all electronic devices, it is advisable to use an ad blocker in the browser you use. This is because ads collect enough information about usage habits and cybercriminals can use it to design malicious campaigns according to their preferences.
The use of extensions such as uBlock Origin or Ghostery, among others, not only protects users, but also makes internet browsing easier and faster, consuming less bandwidth, according to Sophos.
It is also interesting to use the Private browsing from Mozilla Firefox or the incognito mode of Google Chrome, which blocks tracking ‘cookies’ and prevents the browsing history from being saved, which could be accessed by malicious agents in the event of theft of credentials or even the device.
On the other hand, it is convenient avoid the ‘Sign in with Facebook’ or ‘Sign in with Google’ buttons. Although they are tempting, because they allow users to save time logging in, it is better to create a new login for more privacy.
In this sense, the option of guest login It is also very useful and recurring, because it is not necessary to enter all user data – name, telephone, address, etc. – if you are going to make a single purchase.
Add Comment