Spend it safely: Norton looks at threats in consumer transactions

As spending increases around the Festive Season, consumers advised to watch out for Trojans
 

While special offers and tourism play a key role in fuelling the local economy as visitors flood the shopping malls and tourist attractions, more and more people moving to perform financial transactions online see Trojans create a huge and lucrative target for would-be criminals to exploit. Trojans by nature are nothing new and have been around for many years with detections back to 2003. The direct cash cost due to cybercrime in South Africa amounting to R4 billion in the last twelve months according to the Norton Cybercrime Report, indicates that each attack takes on average 16 days to resolve. With this in mind, there is a renewed need for local users to become more vigilant when banking and carrying out everyday tasks online.
 
“As with any holiday we can see consumers spending and travelling more across the region and abroad, and whether to book a flight to somewhere exotic or buy a gift for a relative, users can now choose to do this from the comfort of their home computer or from their smartphone or their tablet – essentially broadcasting sensitive financial information that could easily be put into the wrong hands. Cybercriminals are first and foremost financially motivated and we should be looking at how we are protecting ourselves when sharing these details online to prevent attacks through Trojans or otherwise” says Kara Rawden, Senior Marketing Manager, Consumer – Middle East and Africa Symantec Corporation.
 
How do they work?
For Trojans to spread, it must be invited onto your computer which could easily occur; for example, by opening an email attachment or downloading and running a file from the Internet. Once these Trojans containing malicious code are in, it could trigger loss, or even theft of data.

Traditionally Trojans typically captured data traffic exchanged between the user and the online banking website. The captured information included the authentication information, which is collected and sent to the attacker by the Trojan for their use or to sell on to other parties for a profit.

More sophisticated banking Trojans employ a man-in-the-browser (MITB) method that is designed to overcome defenses, such as SSL encryption and multi-factor authentication. MITB is achieved by monitoring and intercepting user activities in the browser in real time and modifying the HTML content inside the context of the browser, either to display false information to the user or to manipulate details of transactions sent from the user to the bank.

In addition to being able to just steal information, Trojans offer a back door, allowing a remote attacker to essentially control the infected computer. Commands range from listing and terminating processes running on the computer, clearing browser cookies, executing arbitrary programs, to completely rebooting the computer.
 
What can we do?
o        Be skeptical and be wary: Generally speaking, you should treat anything you see online with some degree of skepticism. Do not believe everything you read, be it financial advice, breaking news, or tips on free giveaways — especially if it involves clicking on a link or installing an application. If someone asks you for money in advance, it might be a scam. People on the Internet are not always who they claim to be.
 
o        Privacy Policies: Most banking services have specific privacy guidelines and rules that are published on their websites. Make sure you understand them, even though they may be tedious to read. Good, strong passwords are key to keeping safe, containing letters and numbers, as well as special characters if possible.
 
o        Stay Updated: Some of the newer attacks are very sophisticated and are sometimes hard to spot for an untrained eye. Use comprehensive security software to protect against these threats and always ensure that the software you use is up-to-date. Not only does this include the operating system and web browser, but also third-party plug-ins, such as PDF viewers.