STE WILLIAMS

Apple has emitted a handful of software patches to address security vulnerabilities in iOS, macOS, and various peripherals.

The round of updates includes a number of fixes for critical flaws in WebKit, FaceTime, and Mac and iThing kernels.

FaceTime, WebKit, and Magellan fixes for iOS

For iOS handhelds, the update is billed as iOS 12.1.3. It applies to iPhone 5s and newer, iPad Air and newer, and iPod Touch 6th generation devices.

Fixes for the mobile OS include a man-in-the-middle code execution flaw over Bluetooth (CVE-2019-6200), a remote code execution flaw in FaceTime (CVE-2019-6224), and eight different remote code execution bugs in the WebKit browser engine that could be exploited simply by loading specially-crafted web content. A separate WebKit flaw, CVE-2019-6229, could allow for cross-site scripting attacks.

The WebRTC component in iOS was also found to contain a memory corruption flaw CVE-2019-6211 that would allow for remote code execution attacks via web content.

Also addressed in the iOS update were a trio of remote code execution flaws in SQLite that had been collectively known as Magellan. Discovery of the flaws has been credited to Tencent’s Blade Team.

The iOS kernel was found to contain six different vulnerabilities that would allow an installed application to elevate privileges and view restricted memory contents on a vulnerable device. Because Apple maintains such tight control over the iOS App Store, these vulnerabilities are far less likely to be exploited in the wild than, say, a WebKit flaw that can simply be baked into a webpage.

macOS follows suit

As is often the case, many of the vulnerabilities addressed in the iOS update also had to be patched in the macOS update (known as Mojave 10.14.3 or Security Update 2019-001 for Sierra and High Sierra.)

Old bugs, new bugs, red bugs … yes, it’s Oracle mega-update day again

READ MORE

In this case, the BlueTooth, FaceTime, and WebKit patches were all repeated, as were the WebRTC, SQLite flaws, as well as a pair of sandbox escape/elevation of privilege vulnerabilities in Core Animation.

The above-mentioned elevation of privilege and memory snooping bugs in the macOS Kernel were also patched, and as Mac users are more apt to download and run untrusted applications, those flaws would pose a significantly higher risk in the wild than they do on iOS devices.

Among the patches unique to macOS were fixes for an elevation of privilege bug (CVE-2018-4467) in Hypervisor and an arbitrary code execution flaw in the Mac’s Intel Graphics Driver (CVE-2018-4452).

The nine WebKit bugs, meanwhile, are addressed in the Safari 12.0.3 update for macOS Mojave, Sierra, and High Sierra. In addition to the browser engine fixes, the Safari release cleans up CVE-2019-6228, a cross site scripting vulnerability that stemmed from improper URL validation.

Apple Watch and TV patches

Those using Apple’s wrist-slab and set-top boxes will want to be sure to get the firmware updates for those devices as well. Thanks to sharing a number of components with iOS (including part of WebKit and Kernel) as well as FaceTime, IOKit, and SQLite, both the Apple Watch (watchOS 5.1.3) and the Apple TV (tvOS 12.1.2) will be getting a set of their own updates.

Those using AppleTV can get the fixes by checking the ‘software updates’ under the box’s system settings menu. Apple Watch owners, meanwhile, will want to use the Apple Watch app on the iPhone to download and install the firmware update.

Windows users get a patch as well

Even those who use PCs will want to keep an eye out for updates for their Apple software. Cupertino is giving Windows users an iCloud for Windows update (version 7.10) that includes the three SQLite security fixes as well as the WebKit patches. That fix will be served up through the Apple software update tool. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2019/01/23/january_apple_patch/

IT and cybersecurity positions continue to rank near the top of the salary ranges paid to IT professionals, according to a new survey.

Cybersecurity skills remain near the top of the “most wanted” in enterprise technology hiring, with salaries continuing to reflect that fact, according to a new tech salary guide released today.

The “2019 Tech Digital Marketing Salary Guide,” published by tech staffing agency Mondo, places CISOs in the No. 2 position on the list for highest annual salary (behind CTO/CIO), ranging from $175,000 to $275,000.

Other top security titles and their average salary ranges include:

• Manager, information security ($120,000 to $185,000)
• Application security engineer ($120,000 to $182,500)
• Network security engineer ($115,000 to $172,500)
• Cybersecurity engineer ($110,000 to $165,000)

In addition to the security positions seen to be in demand, the survey reports that Salesforce.com developers and those working in artifical intelligence and the Internet of Things are demanding salaries that can reach $200,000 annually.

Read more here.

Dark Reading’s Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Article source: https://www.darkreading.com/careers-and-people/security-talent-continues-to-fetch-top-dollar-on-it-job-market/d/d-id/1333701?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

An intruder thought to be a former employee used a backdoor into the WPML website to skim email addresses and send a mass email blast.

When the website of a very popular plug-in used in an amazingly popular Web content management system (CMS) is hacked, this makes for big security news — even if, according to the plug-in’s publisher, there’s nothing to worry about.

WordPress is used as the content platform for around 75,000,000 websites. According to some observers, WordPress is used more than all the other CMS platforms combined, and it’s the platform behind roughly one-third of all the content on the Internet. So when an email message was sent to the users of popular WordPress plug-in WPML (which stands for WordPress Multi-Language) telling them that major security holes had been found in the plug-in, the collective blood pressure of WordPress users went up a notch. 

The thing is, no such security holes had been found in the plug-in that is used by publishers who present versions of their site in multiple languages. Instead, an intruder thought to be a former employee used a backdoor into the WPML website to skim email addresses and send a mass email blast to the entire list from WPML.org‘s own servers.

In a blog post at WPML.org, CEO Amir Helzer detailed the steps the organization had taken to remediate the damage: “We updated wpml.org, rebuilt everything and reinstalled everything. We secured access to the admin use 2-factor authentication and minimized the access that the web server has to the file system.”

While the organization stressed that no payment information had been compromised, it noted that login credentials for customer accounts had been taken. The group has sent legitimate follow-up email message to all users and is requiring them to reset their password on their next login.

In a statement provided to Dark Reading, Bill Evans, vice president of marketing for One Identity described a likely contributor to the hack. “In the case of this developer, they likely had access to a privileged account password, a database password, or an administrator password that was shared by many employees for the purpose of doing maintenance on critical systems.” Helzer confirmed much of this in his blog post when he wrote, “Our data shows that the hacker used inside information (an old SSH password) and a hole that he left for himself while he was our employee.”

In his extended statement, Evans stressed the importance of good privileged access management practices to eliminate the possibility of old and outdated passwords stored in code or DevOps config files.

Related Content:

• Web Vulnerabilities Up, IoT Flaws Down
• WordPress Sites Targeted in World Cup-Themed Spam Scam
• Gandcrab Ransomware Exploits Website Vulnerabilities
• Real-World Threats That Trump Spectre Meltdown

Curtis Franklin Jr. is Senior Editor at Dark Reading. In this role he focuses on product and technology coverage for the publication. In addition he works on audio and video programming for Dark Reading and contributes to activities at Interop ITX, Black Hat, INsecurity, and … View Full Bio

Article source: https://www.darkreading.com/vulnerabilities-and-threats/hack-of-plug-in-website-ruffles-wordpress-community/d/d-id/1333702?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Adversaries took advantage of the large attack surface of large communications networks to spread small volumes of junk traffic across hundreds of IP prefixes in Q3 2018, Nexusguard says.

Distributed denial-of-service attacks targeting large Internet service providers surged in the third quarter of last year as attackers began using a stealthy new tactic to sneak DDoS traffic past detection mechanisms.

An analysis of DDoS data during Q3 2018 by Nexusguard showed attackers trying to overwhelm targeted sites, and even entire ISP — aka communications provider (CSP) — networks, by spreading attack traffic across a large number of IP prefixes. Unlike a typical volumetric attack on a single IP address, many of the DDoS campaigns that Nexusguard analyzed involved attackers contaminating legitimate traffic across hundreds of IP addresses with small bits of junk.

The attack traffic within each IP address was small enough to avoid detection by DDoS mitigation tools but big enough to take down a targeted site once converged, Nexusguard said in a report published this week. For example, the average attacks involved just 33.2Mbps of traffic per targeted IP making it hard for service providers to detect and mitigate the traffic.

In total, about 159 autonomous systems – most belonging to service providers – were targeted in “bit-and-piece” attacks in Q3 of 2018. In many of the attacks, hackers appear to have conducted reconnaissance to map out the CSP network and identify critical IP address ranges, Nexusguard said.

The largest attacks involved small bits of DDoS attacks traffic being dispersed to IP addresses across 38 IP prefixes. The maximum number of targeted IP addresses per prefix in these attacks was 252, and the average was 141.  

Attacks sizes per IP address ranged from over 300Mbps at the high-end, to just 2.5Mbps at the low-end, with the average at 33.2Mbps. The average attack size per IP prefix was 2.48Gbps. In a worst-case scenario, an attack of this size spread across 38 IP prefixes is potent enough to overwhelm a 10Gbps ISP line, Nexusguard’s report noted.

Mitigation Gap

Donny Chong, product director at Nexusguard, says such attacks highlight the need for enterprises to pay closer attention to the DDoS mitigation abilities of their communications service providers.

DDoS detection and mitigation mechanisms that are based on traffic volume thresholds alone are not sufficient in attacks involving very small volumes of attack traffic, he says. Typical anti-DDoS measures like blackholing traffic is not going to work well either, because of the large number IP addresses that are being used to distribute the attack traffic, Chong notes.

CSPs must step up mitigation measures and go beyond the usual threshold and traffic anomaly detection controls, he says.

Of the thousands of DDoS attacks around the world that Nexusguard measured for its study, nearly 66% or two-thirds, were targeted at CSPs. Simple Service Discovery Protocol (SSDP) amplification attacks—a type of DNS amplification attack—increased more than seven-fold in Q3 compared to Q2 2018 because of the increased focus on CSPs.  

Because so many DDoS attacks in last year’s third-quarter involved small traffic volumes, average attack size decreased 82% year-over-year to 0.97Gbps and by more than 96% compared to Q2 2018.

DDoS in Stealth

The new attacks are a continued trend of threat actors evolving DDoS attacks to sneak them past enterprise security controls. Despite the smaller average sizes that Nexusguard reported, DDoS attacks have generally gotten bigger, more sophisticated and multi-faceted in recent years. Many involve multiple attack vectors and, increasingly, services are becoming available that carry out attacks on request or make available tools that allow almost anyone to launch a DDoS attack.

“In 2019, we anticipate more attackers crawling out of the woodwork to offer their services to the highest bidder,” NETSCOUT said in a blog earlier this month. Many of these services will provide DIY DDoS tools that lower the bar for attackers, the blog noted.

“While these tools are not necessarily new to the scene, the ease of access, quick iteration at including new attack types, and a broader range of international customers will result in lots of amateur cybercriminals getting hold of destructive malware,” the company said.

Related Content:

• Why DDoS Just Won’t Die
• Memcached Servers Being Exploited in Huge DDoS Attacks
• DDoS Attacks Become More Complex and Costly
• 7 Things to Know About Today’s DDoS Attacks

 

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year … View Full Bio

Article source: https://www.darkreading.com/attacks-breaches/stealthy-new-ddos-attacks-target-internet-service-providers-/d/d-id/1333703?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

If you’re still using TLS-SNI-01, stop: a year after a slip-up allowed miscreants to claim Let’s Encrypt certificates for domains they didn’t own, the free certificate authority has announced the final sunset of the protocol involved.

In January 2018, Let’s Encrypt discovered that validation based on TLS-SNI-01 and its planned successor TLS-SNI-02 could be abused. As we explained at the time: “A company might have investors.techcorp.com set up and pointed at a cloud-based web host to serve content, but not investor.techcorp.com. An attacker could potentially create an account on said cloud provider, and add a HTTPS server for investor.techcorp.com to that account, allowing the miscreant to masquerade as that business – and with a Let’s Encrypt HTTPS cert, too, via TLS-SNI-01, to make it look totally legit.”

Let’s Encrypt plugs hole that let miscreants grab HTTPS web certs for strangers’ domains

READ MORE

The SNI extension to the TLS protocol is supposed to validate the name presented by the server, something particularly important when a single IP address is serving a large number of websites. As we noted last year, the opportunity for abuse arises if the hosting provider doesn’t verify ownership of a domain.

Let’s Encrypt’s response at the time was to block TLS-SNI-01 for new accounts. However, it decided to continue support for certificates already issued.

That’s going to end on February 13, 2019, the organisation has now confirmed.

In the blog post, Internet Security Research Group executive director Josh Aas explained that anyone still using TLS-SNI need to switch to DNS-01 and HTTP-01 as their validation mechanism.

“We apologize for any inconvenience but we believe this is the right thing to do for the integrity of the Web PKI,” Aas concluded. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2019/01/22/lets_encrypt_gives_admins_until_february_13_to_switch_off_tlssni/

The US may have finally complied with the European Commission’s repeated requests to name a permanent Privacy Shield ombudsperson, The Register understands.

The White House, late last week, said that president Donald Trump intends to nominate former DocuSign CEO Keith Krach as under-secretary of state for economic growth, energy and the environment.

This role has consistently come with the position of public advocate for the Privacy Shield agreement on transatlantic data flows. The Register understands that officials in the bloc expect this to continue.

At the moment, the acting under-secretary, Manisha Singh, also serves as the Privacy Shield ombud.

And this was also the case in the previous administration when Catherine Novelli was under-secretary for economic growth, energy and the environment.

Assuming the appointment goes ahead, it would place the ombudsperson on a permanent footing, something the commission has repeatedly called for in its reviews of the deal, which was rushed through in 2016 after its predecessor Safe Harbor was scrapped.

US told to appoint a damn Privacy Shield ombudsperson already or EU will take action

READ MORE

In the 2018 review, published in December, the commission gave the US until 28 February to name a permanent role-holder – or it would take “appropriate measures”.

The ombudsperson mechanism was created to oversee the transfer of data between the European Union and the US, and is responsible for handling complaints or requests.

However, the position has yet to receive any requests – although a complaint has been submitted to the Croatian data protection agency and, as of December, was under review.

Nonetheless, the delays in appointing someone to the position on a permanent basis drew criticism as it was seen by some as evidence that the US was not taking the terms of the agreement seriously.

The nominee to the under-secretary position, Krach, is the chairman of e-signature biz DocuSign, having served as CEO for six years up to 2017. Prior to that, he co-founded business commerce firm Ariba, which was slurped up by German ERP giant SAP in 2012 for $4.3bn.

In 2017, he was named as one of the first members of the NYCx Technology Leadership Advisory Council, which was launched by New York mayor Bill de Blasio to use tech to improve service delivery and boost digital inclusion in the city.

As well as the under-secretary of state role, he will also be nominated for a series of US alternate governors, including of the European Bank for Reconstruction and Development, International Bank for Reconstruction and Development, and to the Inter-American Development Bank.

The US government shutdown meant El Reg was unable to get an on-record comment from officials. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2019/01/22/privacy_shield_ombudsperson/

FIC2019 A French diplomat has suggested that future global regulation of cyberspace could exempt spying from regulation “as long as some specific sectors are preserved”.

Although he prefaced his comments by saying “I speak on my behalf, not for France,” Jean Heilbronn went on to tell an audience at French infosec conference FIC2019: “I don’t think we need a new global agreement to stabilise cyberspace.”

Heilbronn – a diplomat whose background includes posts as a political advisor to the French Ministry of Defence and at NATO, as well as a period spent studying at the London School of Economics – spoke during a panel discussion at the Forum Internationale de Cybersécurité titled: “Which form of multilateral regulation can lead to a safe and stable cyberspace?”

“We already have rules in international law with the UN Charter which prevents restrictions on the use of force,” said Heilbronn through a translator, though later in the talk he switched to fluent English. “That also applies to cyberspace… let’s be careful with this notion.”

He continued: “What matters is that states have to respect some lines and shouldn’t cross some red lines. States spying on each other? That’s normal. We should not normally prevent this. If we have a ban [on spying] then we need to check that the ban is not breached. There would be no consensus on how to punish a ban. Let’s not get into negotiations we would lose.”

After the panel session, he clarified his remarks to The Register by saying that states are always going to engage in espionage, something that is not actually illegal under international law, and that recognising these types of grey areas is vital in diplomacy. Spying for the purpose of gaining industrial advantage (IP theft) was one example he gave of an unacceptable use of spying. During his talk he boiled down the problem of cyberspace regulation to one of crisis prevention, crisis management and international regulation “as a lawmaking activity” intended to create “new standards [and] new behaviours”.

Heilbronn’s fellow panelists were broadly of the view that current international bodies are good enough to regulate cyberspace, insofar as it needs regulating to help prevent potentially warlike escalations of force arising out of nation-state-level hacks. They also thought that the world could do this without needing dedicated new cyber multinational bodies.

Michael Daniel of the Cyber Threat Alliance, a former advisor to past American president Barack Obama, characterised cyberspace regulation as “not just a technological problem but also a physical problem, an economic problem… and an international relations problem”.

“Cyberspace is relatively young,” said Daniel, contrasting it with how international treaties on maritime borders and commerce evolved over centuries. “In the US the [world wide web] is barely able to drink.”

Frédérick Douzet, a member of the Global Commission for Stability in Cybersecurity, gloomily opened with: “We really believe that cyberspace stability is at risk, international security and peace is also at risk,” He qualifyed that by saying it was “because of a broader geopolitical context that shows a lot of tension right now”.

“There is a strong incentive to find a way to regulate this space to avoid a major catastrophe,” she added, pointing out that nation states’ tools (such as the NSA’s Eternalblue) have a nasty habit of leaking into the public domain, with elements ending up in malware such as WannaCry and NotPetya.

“10 years ago,” mused Daniel, “we’d have been talking about website defacements. When was the last time we talked about website defacement as a problem? Now we’re talking about NotPetya as a problem.” ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2019/01/22/countries_spy_regardless_global_cybersecurity_regulation/

FIC2019 France’s defence secretary Florence Parly today declared “Cyber war has begun.”

And she said the Euro nation’s military will use its “cyber arms as all other traditional weapons… to respond and attack,” as well as setting up a military bug bounty program.

Parly made her pledges during a speech to the Forum International de Cybersecurite (FIC) in the northern French town of Lille. Her speech was on a topic that most Western countries shy away from addressing directly in public.

“The cyber weapon is not only for our enemies,” said France’s defence secretary this afternoon, speaking through a translator. “No. It’s also, in France, a tool to defend ourselves. To respond and attack.”

Her remarks will be seen as moving the debate about offensive cyber capabilities – not just so-called “active defence” but using infosec techniques as another weapon in the arsenal of state-on-state warfare – to a new level. Coming from a prominent NATO member and EU country, it could set the tone for future discussion of nation states’ offensive cyber doctrines.

As well as having “published the main lines of that [offensive] doctrine” of the use of cyber weapons last week, Parly called for “more co-operation and partnerships and convergence with our European allies because if a threat is over the heads of all of us, that’s the cyber threat and it has no border.”

“Today I would like to make a proposition to our defence industrialists,” she continued. “Let’s unite our strengths to protect, from the cyber threat, our supply chain.”

Parly also revealed that France’s Ministry of Defence (MoD) has established no less than a military bug bounty program, saying: “When I talk about trust it goes very far. A partnership has been done between [France’s military] cyber command and the startups. That is called Yes We Hack. I announce it.

South Korea reckons mystery hackers cracked open advanced weapons servers

READ MORE

“At the end of February we are going to announce the first bug bounty of the MoD. Ethical hackers were recruited in the cyber operational research [department] and they’re going to track down the faults of our systems. If they find some they will be rewarded for it.”

Britain, which prides itself on its defensive hacking capabilities, as well as taking a much more muted line about its offensive cyber capabilites, tends to shy away from talking about its own hacking plans openly. That said, the UK’s abilities in the area have been quietly acknowledged by officials.

France’s new approach to its industrial supply chain will raise some eyebrows on the far side of the English Channel as well. Parly said she “intends to engage” with SMEs to further develop France’s cyber defences, adding: “we need to create links between the MoD and our defence industrialists, between ministry and SMEs, and we need to work for a [EU] of cyber defence.”

In contrast, Britain’s Ministry of Defence spends a relatively small £80m a year on funding good ideas from SMEs, with the vague hope that the better ones will be adopted by the ministry for frontline use. While cyber forms a part of the Defence Innovation Initiative, France appears to have gone all in with a dedicated push to develop offensive cyber capabilities in full partnership with its private sector.

This is a sharp contrast to the UK, where large defence contractors (“primes” in the lingo) are the ones snapping up contracts for major military cyber work. Whether, in the post-Brexit world, the UK will change tack and adopt elements of the French approach remains to be seen. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2019/01/22/france_cyber_war/

The fine represents the first major penalty for a US technology company under the new European regulations.

France’s data privacy agency on Monday slapped a 50 million euro fine on Google for not fully disclosing how the company gathers and uses the personal information of its users.

The Commission Nationale de l’Informatique (CNI) said Google also did not secure the proper consent from users to provide them with personalized ads. The approximately $57 million penalty under Europe’s new General Data Protection Regulation (GDPR) was the first massive fine under the new privacy law on a US tech company.

Google said it’s “studying the decision to determine our next steps,” according to a report by The Washington Post. “People expect high standards of transparency and control from us. We’re deeply committed to meeting those expectations and the consent requirements of the GDPR,” Google said.

Read more here.

 

Dark Reading’s Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Article source: https://www.darkreading.com/endpoint/privacy/google-hit-with-$57-million-gdpr-fine-in-france/d/d-id/1333697?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

By using a combination of new cryptocurrencies and peer-to-peer marketplaces, cybercriminals are laundering up to an estimated $200 billion in ill-gotten gains a year. And that’s just the beginning.

Cybercriminals, the same shadowy figures who use ransomware, email scams, denial-of-service attacks and other methods to earn a living, have turned to money laundering to hide and eventually “cash out” the profits of their criminal deeds. And it’s no wonder why when you consider that cybercrime is a lucrative business, with some bad guys making an estimated $20,000 per month or more.

By definition, money laundering is the process of disguising the proceeds of crime by integrating it into the legitimate financial system. The bad guys do so because spending illicit money can attract unwanted attention, and it is difficult to explain where the funds came from.

By using a combination of new cryptocurrencies and peer-to-peer (P2P) marketplaces, cybercriminals are laundering up to an estimated $200 billion in ill-gotten gains a year, according to a nine-month academic study by Dr. Mike McGuire, senior lecturer in criminology at Surrey University. That number represents an estimated 8%-10% of total illegal profits laundered globally.

It did not take long for the bad guys to jump on the cryptocurrency bandwagon — and for all the wrong reasons. First it was bitcoin and its use on sites such as Silk Road and AlphaBay. Now they are moving to newer and lesser-known virtual currencies that are not in as many headlines and easier to manipulate. These transactions do not require people to use their real names, so they can buy and sell currency from unidentifiable addresses. Cryptocurrencies are also attractive because they are highly portable; you can carry millions of pounds of coins on a USB drive and easily move across borders via email or on a plane.

Modern e-commerce is another target for cybercriminals. They create money-laundering schemes that use legitimate websites as payment processors. First, they make illegal purchases online and have them appear as lawful transactions on their bank statements. Next, the dirty money moves straight to online merchants, who funnel it through other legitimate payment ecosystems.

In other instances, the bad guys create fake e-commerce sites that look and feel like the real thing but actually don’t sell anything. They are simply online money-laundering boutiques, just like that empty bricks-and-mortar store that is actually a front for illegal activity.

Exploiting Brand-Name Payment Systems
Some of the Internet’s biggest marketplaces are now being exploited by cybercriminal money launderers thanks to their online payment systems, ease of use, and huge global adoption. This allows the bad guys to stay under the radar among thousands of other users. P2P marketplaces such as Uber and Airbnb have also been exploited by criminals looking to launder dirty money, hiding their activity among thousands of legitimate transactions.

According to news accounts, criminals were booking fake Airbnb stays to launder dirty money. They used credit cards and money transfers from mule accounts to book and pay for rooms through this peer-to-peer platform. All of this is conducted online and is a very effective way to turn illicit proceeds into legitimate earnings. Plus, it has the added advantage of moving many of these payments across borders.

Criminals have also discovered how to launder their money through fake Uber transactions. To do so, middlemen use stolen credit cards to book “ghost rides” — rides that never happened — with complicit drivers. The middlemen and drivers take a cut, leaving the rest of the now-laundered money with the client. The ease with which this can be done is testament to the difficulty of policing thousands of P2P transactions across multiple territories. The current systems, put in place to monitor transactions and flag suspicious activity, simply aren’t stringent enough to spot these types of cons.

The bottom line is that money laundering continues to be a complex issue, and technology is increasing the complexity of this challenge. Why? Because money laundering often starts with small dollar amounts that travel undetected before being moved around the world in large volumes. It involves a complicated web of companies, individuals, trades, settlements and payments organized by seemingly ordinary individuals who are hard to identify as money launderers.

This past year has been especially noteworthy as several large, high-profile European financial institutions have gone under fire for money-laundering scandals. Yet money laundering today isn’t just something rich white-collar criminals do to hide illicit money. Nor is it, despite the many headlines, just a European problem. Even worse, going forward, experts such as Cisco predict that there will be more than 50 billion connected devices across the world by 2020, so criminals will have an even better chance to hide their activities via P2P lending and the ability to initiate payments via mobile providers, Facebook, and a multitude of payment apps.

Related Content:

• 2019 Attacker Playbook
• Online Fraud: Now a Major Application Layer Security Problem
• Your Life Is the Attack Surface: The Risks of IoT

 

Alexon is a hands-on anti-money laundering (AML) practitioner with over 16 years’ experience helping financial institutions with AML strategies, architectures and implementations. He has a wealth of experience in helping customers deploy and crucially optimize AML, KYC … View Full Bio

Article source: https://www.darkreading.com/attacks-breaches/how-cybercriminals-clean-their-dirty-money-/a/d-id/1333670?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple