STE WILLIAMS

UK Businesses Suffer Regular Ecrime Losses

The average UK business is losing £10,000 a year thanks to cyber espionage, extortion and other forms of online fraud.

In total the UK economy is losing £27bn a year and British businesses soak up £21bn of this loss. Given there are 2.1 million UK firms registered for VAT this gives a loss per firm of £10,000.

The numbers, available from the Office of Cyber Security (pdf) and Detica, claim an estimated loss of £9.2bn from IP theft – not illegal file-sharing but theft of trade secrets from UK firms.

A further £7.6bn is lost due to industrial espionage – defined as the theft of non-IP related data and £2.2bn is handed to criminal gangs by UK firms as the result of extortion. The OCS admits it has no evidence for such extortion, because it believes this crime is mostly not reported.

£1bn a year is lost due to loss or theft of customer data and £1.3bn goes thanks to direct online theft.

A spokesman for the Cabinet Office said it was impossible to say how much cyber crooks benefited from the billions they’re extracting from Blighty.

The figures are based on a “most-likely scenario” but will form the basis of future policy.

The OCS warned: “Our assessments are, necessarily, based on assumptions and informed judgements rather than specific examples of cyber crime, or from data of a classified or commercially-sensitive origin.”

It suggests approaching selected companies to ask if they are victims of cyber crime in order to both build awareness of the issues and to get some solid data on the problem.

The OCS also recommends the creation of a website to publicise the issue and to act as a central, anonymous, reporting hub for UK firms to report fraud.

The OCS estimates that the UK government loses £2.2bn due to cyber crime.

Even this number is an estimate. It is based on total tax and benefit fraud in the UK combined with an estimate of how many of these are due to “criminal attacks”. The OCS treated all these attacks as cyber crimes “due in the main to the volume of transactions now conducted online”.

The OCS release is available for download here.?

 

Exxon, Shell and BP in 4yr Hack

Bloomberg News has identified six of the energy companies targeted in recent series of “coordinated covert and targeted cyberattacks” and says the victims could face legal liability for choosing not to disclose them to shareholders.

The roster includes Exxon Mobil, Royal Dutch Shell, BP, Marathon Oil, ConocoPhillips, and Baker Hughes, according to an article the news service published on Thursday. The report cited one of the victim companies and investigators who declined to be identified.

The attacks were ongoing for at least two years and possibly as long as four years. The unknown hackers worked through servers located in China. (more…)

Lush online store hacked

Australian cosmetics retailer Lush has pulled the kill-switch on its web store following a security breach.

In a statement that replaced its home page on Tuesday, Lush Australia says it has been alerted that the security breach may have exposed customers’ credit card information. The statement directs customers to contact their bank to discuss whether cancellation is warranted.

In spite of the similarity to a similar breach of Lush’s security in the UK, the company claims the two incidents are not related.

“Our Website is not linked to the Lush UK Website, which was recently compromised,” the company’s statement said.

Update: card theft confirmed

According to a report by the ABC, Lush has since confirmed that card details were stolen, along with the company’s entire customer database.

Lush Australasia director Mark Lincoln says customers would not have been aware that their card details were kept. The ABC report says the vulnerability occurred because of a “failure to keep the Website updated”.

The company told the ABC it does not know how long breaches may have been occurring. ?

Source

Hardware keyloggers discovered in public libraries in Greater Manchester

Two USB devices, attached to keyboard sockets on the back of computers in Wilmslow and Handforth libraries, would have enabled baddies to record every keystroke made on compromised PCs. It’s unclear who placed the snooping devices on the machines but the likely purpose was to capture banking login credentials on the devices prior to their retrieval and use in banking fraud.

A third detected device was discovered but disappeared before it was turned over to local police, the Manchester Evening News reports.

(more…)

Home Secretary promises £63m for cybercrime fight

Home Secretary Theresa May has announced a £63m boost to police budgets for combating cyber crime.

The money will come from the £650m being spent on beefing up the UK’s national cyber defences announced last year.

The move to a proactive, and attacking, form of cyber defence was explained to the Reg by “senior Whitehall officials” in 2009. They warned the newly-formed Office of Cyber Security, within the Cabinet Office, that the main threats to UK infrastructure comes from organised criminals, not terrorists.

Officials also made clear that attacks were no longer likely to be “online only” – 90 per cent of UK high street transactions are now “online” in some sense.

A potted statement from the Home Office said: “This proposed new funding will be used to develop the UK’s overall response to cyber crime. The Government is determined to build an effective law enforcement response to the cyber crime threat building upon the existing expertise within SOCA and the Met Police Central e-Crime Unit.

“More details of the funding allocation will be made public in due course.”

The Home Office press office was unable to confirm the figure of £63m, which was reported by eGovmonitor reporting comments made by Theresa May. ®

?Source