Exposing the cyber crime underground

January 2014 Information Security

Advances in technology across industries are yielding significant opportunities for cyber criminals, both organised and otherwise, says KPMG.

Kajen Subramoney
Kajen Subramoney

Kajen Subramoney, associate director at KPMG in South Africa and specialist in forensic technology services, says, “Considering the evolution in technology and the digital age we now find ourselves in, the traditional ‘stick-‘em-up’ bank robbery, for example, has evolved into a far more sophisticated crime – often resulting in lower risk, greater anonymity and even greater financial rewards for such cyber criminals than before. Today, organised criminals tend to focus on the use of an array of services offered in what we call the cyber underground, a criminal cyber network and syndicate that needs to be recognised by both consumers and business alike to mitigate risk.”

For financial institutions, bank accounts and credit cards are the main targets of such crime. In fact, one such financial crime, committed in 2013, simultaneously targeted multiple locations throughout the world, pointing to how criminals relied upon a combination of unrivalled knowledge of ATM systems, processes and the technological prowess of a criminal network.

Continues Subramoney; “Here, hackers gained access to the bank’s databases to compromise hundreds of credit cards linked to seemingly legitimate bank accounts. Apparently with the help of insiders, the hackers were able to gain remote access to a terminal to increase the daily ATM withdrawal limits on each of the cards to more than $100 000. By exploiting this weakness in the bank’s IT security, the hackers essentially created the availability of fake money which could then be accessed through magnetic strip cards with appropriated codes, via ATMs around the world. You can imagine the amount of money withdrawn here and also while unchallenged.”

According to KPMG, this type of robbery is a foretaste of things to come. “We know that criminals are not only acting unilaterally, but today are buying and leasing the services of cyber criminals, and expanding their networks far and wide, using tactics and tools where the criminal literally becomes invisible.”

Mirroring this sentiment, Jason Gottschalk; associate director at KPMG says; “Africa has the strong potential to become a hotspot for cyber crime, especially now that the continent is well recognised on the global map and investment in Africa is becoming rife. This reality could pose a threat on critical infrastructures. In fact, KPMG feels strongly that the cyber security issue is the invisible war that should be a top of mind priority for local businesses now, in order for them to protect themselves.”

Globally, KPMG has seen that cyber criminal activity and security is on the rise, where the topic is now on almost all board agendas. Continues Gottschalk; “These discussions should be leading businesses, in particular, to an outlook of approaching cyber security proactively. Organisations need to undertake internal business IT security infrastructure audits, defining what their security strategies should be and then taking steps forward to implement this.”

According to KPMG, one of the biggest concerns within the local environment around IT security is the reactive versus the proactive approach that the brand sees among businesses. Says Subramoney; “This has to change. Cyber criminals are becoming smarter and with this are finding new ways of performing such criminals attacks daily – ways that we wouldn’t think could be possible, yet can cause severe damage.”





Share this article:
Share via emailShare via LinkedInPrint this page



Further reading:

What are MFA fatigue attacks, and how can they be prevented?
Information Security
Multifactor authentication is a security measure that requires users to provide a second form of verification before they can log into a corporate network. It has long been considered essential for keeping fraudsters out. However, cybercriminals have been discovering clever ways to bypass it.

Read more...
SA's cybersecurity risks to watch
Information Security
The persistent myth is that cybercrime only targets the biggest companies and economies, but cybercriminals are not bound by geography, and rapidly digitising economies lure them in large numbers.

Read more...
Cyber insurance a key component in cyber defence strategies
Information Security
[Sponsored] Cyber insurance has become a key part of South African organisations’ risk reduction strategies, driven by the need for additional financial protection and contingency plans in the event of a cyber incident.

Read more...
Deception technology crucial to unmasking data theft
Information Security Security Services & Risk Management
The ‘silent theft’ of data is an increasingly prevalent cyber threat to businesses, driving the ongoing leakage of personal information in the public domain through undetected attacks that cannot even be policed by data privacy legislation.

Read more...
Data security and privacy in global mobility
Security Services & Risk Management Information Security
Data security and privacy in today’s interconnected world is of paramount importance. In the realm of global mobility, where individuals and organisations traverse borders for various reasons, safeguarding sensitive information becomes an even more critical imperative.

Read more...
Sophos celebrates partners and cybersecurity innovation at annual conference
News & Events Information Security
[Sponsored] Sun City hosted Sophos' annual partner event this year, which took place from 12 to 14 March. Sophos’ South African cybersecurity distributors and resellers gathered for an engaging two-day conference.

Read more...
The CIPC hack has potentially serious consequences
Editor's Choice Information Security
A cyber breach at the South African Companies and Intellectual Property Commission (CIPC) has put millions of companies at risk. The organisation holds a vast database of registration details, including sensitive data like ID numbers, addresses, and contact information.

Read more...
Navigating South Africa's cybersecurity regulations
Sophos Information Security Infrastructure
[Sponsored] Data privacy and compliance are not just buzzwords; they are essential components of a robust cybersecurity strategy that cannot be ignored. Understanding and adhering to local data protection laws and regulations becomes paramount.

Read more...
AI augmentation in security software and the resistance to IT
Security Services & Risk Management Information Security
The integration of AI technology into security software has been met with resistance. In this, the first in a series of two articles, Paul Meyer explores the challenges and obstacles that must be overcome to empower AI-enabled, human-centric decision-making.

Read more...
Milestone Systems joins CVE programme
Milestone Systems News & Events Information Security
Milestone Systems has partnered with the Common Vulnerability and Exposures (CVE) Programme as a CVE Numbering Authority (CNA), to assist the programme to find, describe, and catalogue known cybersecurity issues.

Read more...