Tag Archive for Fraud

Russia Trolls Public Health

Everything you see on the Internet is trueHey here is a surprise – things on Facebook are fake. GovInfo Security is reporting that social media trolls sponsored by Russia have been actively stirring up the mindless vaccination debates. Researchers from George Washington University and Johns Hopkins University published their findings on (08/23/2018). They published a report, “Weaponized Health Communication: Twitter Bots and Russian Trolls Amplify the Vaccine Debate,” in the American Journal of Public Health. In the article, they based studied social media tweets collected from 2014 to 2017 on the vaccine debate.

Facebook profited from Russia-backed accounts trying to sway the 2016 U.S. presidential election

According to the research the Internet Research Agency, a company backed by the Russian government is at the center of the dis-information. The known Russian social media troll which specializes in online influence operations is linked to the spread of “polarized and anti-vaccine” misinformation via social media. The social media posts appear designed to undercut trust in vaccines. Such information could lead to lower vaccination rates and further contribute to a rise in mass outbreaks of measles, mumps, and rubella among children, among other viral infections.

How do anti-vaccine messages spread?

From 2014-2017, Twitter bots and Russian trolls disseminated anti-vaccine messages in trying to erode public consensus on vaccination in the U.S.

From 2014-2017, Twitter bots & Russian trolls disseminated anti-#vaccine messages in an attempt to erode public consensus on #vaccination in the US

The researchers’ review of anti-vaccine messaging on Twitter found the sources of disinformation are automated. There appears to be a steady stream of vaccine discussion being undertaken by social media bots. Social media bots are automated accounts. The researchers also identified and social media cyborgs’, that are hacked accounts taken over by bots. There are also social media trolls. Social media trolls are people who often disguise their identity and seek to sow discord.

The researchers also identified “content polluters.” Content polluters used anti-vaccine messages as bait to entice their followers to click on advertisements and links to malicious websites. The researchers contend that content polluters collate to high levels of anti-vaccine content. In the case of Russian trolls, however, their “messages were more political and divisive” and included both pro-vaccine and anti-vaccine content.

Trolls tied to Russia

Examples of Russian troll commentsTo identify accounts controlled by Russian trolls, the researchers used previously published information on Twitter accounts that intelligence agencies have tied to Russian government disinformation campaigns. As an example, CNN reports that one Russian troll account sent 253 tweets containing the #VaccinateUS hashtag among their sample. Among those tweets with the hashtag;

  • 43% were pro-vaccine,
  • 38% were anti-vaccine,
  • 19% were neutral.

By posting a variety of anti-, pro-, and neutral tweets and directly confronting vaccine skeptics, trolls, and bots “legitimize” the vaccine debate, the researchers wrote in the study. The researchers noted,

This is consistent with a strategy of promoting discord across a range of controversial topics, a known tactic employed by Russian troll accounts … One commonly used online disinformation strategy, amplification, seeks to create impressions of false equivalence or consensus through the use of bots and trolls.

amplification, seeks to create impressions of false equivalence or consensus through the use of bots and trollsThe prevalence of social media bots, trolls, and cyborgs – accounts in online discourse about vaccines threatens to skew discussions.  Researchers warn. “This is vital knowledge for risk communicators, especially considering that neither members of the public nor algorithmic approaches may be able to easily identify bots, trolls, or cyborgs.

The researchers found that the trolls, bots, and cyborgs goal is to create open-ended discussions designed to amplify online debates and disagreements. One tact cited in the article is rehashing discredited research published 20 years ago with fake claims of risks that have led to some parents opting to not vaccinate their children.

Threats from online misinformation

The threat from online misinformation is that even fewer parents will vaccinate their children against measles, mumps, and rubella. The researchers wrote that vaccine-hesitant parents are more likely to turn to the internet for information and less likely to trust healthcare providers and public health experts on the subject … Exposure to the vaccine debate may suggest that there is no scientific consensus, shaking confidence in vaccination. The researchers warn,

Recent resurgences of measles, mumps, and pertussis and increased mortality from vaccine-preventable diseases such as influenza and viral pneumonia underscore the importance of combating online misinformation about vaccines.

Russian troll use Facebook to amplify online disagreementsAmplifying debates over vaccines appear to be part of what ambassador John B. Emerson described as the Kremlin’s 4D campaigns – for dismiss, distort, distract and dismay. In a 2015 speech, Mr. Emerson warned that the Russian government was becoming more expert at running these types of propaganda campaigns.

Intelligence experts in the U.S. and Europe have warned that these Kremlin campaigns continue. In February, U.S. Director of National Intelligence Dan Coats warned the Senate Intelligence Committee that the intelligence community expected Russia to attempt to amplify existing divisions in U.S. society to spread chaos for strategic effect. Ambassador Coats warned,

At a minimum, we expect Russia to continue using propaganda, social media, false-flag personas, sympathetic spokespeople and other means of influence to try to exacerbate social and political fissures in the United States.

Anti-Bot research

Little research has gone into researching how to identify social media trolls or bots that influence online discussions. (rb- I covered some of the efforts underway to detect bots in 2016.) In 2015, DARPA ran a contest in which it asked researchers to classify whether a stream of tweets it had harvested about vaccines in 2014 were bots. Researchers were given a data set with more than 4 million messages harvested from 7,000 accounts, of which 39 were bots.

MIT Technology Review reported the winner, data science and social analytics firm SentiMetrix, correctly identified all the bots, with only one false positive. SentiMetrix was able to use an algorithm to  look for “linguistic cues” the poster was fake, like

  • Little research has gone into researching how to identify social media trolls or botTweets that used bad grammar,
  • Output was similar to other chatbots like Eliza,
  • Profile pictures that used stock images,
  • Numbers of tweets posted over time,
  • Unusual posting patterns,
  • Female username with a profile photo of a bearded man. (rb- Sound familiar? I wrote about some of these same steps in 2016)

The research led SentiMetrix to identify 25 bots, which enabled it to train a machine-learning algorithm to pinpoint 10 more. Despite such work, “the public health community largely overlooked the implications of these findings,” the Johns Hopkins and George Washington researchers say.

The impact of social media bots on the vaccine debates is not an abstract concern. The U.S. Centers for Disease Control and Prevention reports they are investigating 124 cases of measles across 22 states and DC, including Michigan. That’s already more than the 118 cases counted in the U.S. during all of 2017.

Spreading measles in Michigan

WOODTV in Grand Rapids reports that cases of measles in Michigan have hit a two-decade high. Angela Minicuci with the MDHHS told WOODTV the state has “tallied 10 cases of measles so far this year — the highest case count since 1998.

The CDC says low vaccination rates are to blame for recent measles outbreaks. They report the majority of those who contract measles, which is highly contagious, have not been vaccinated.

One reason so many are at risk of spreading measles is that 18 states allow parents to opt-out of vaccinating their schoolchildren for non-medical reasons. In June 2018 researchers found  multiple “hotspot” areas,” at high risk for vaccine-preventable pediatric infection epidemics.” Included in these hotspots are Detroit, Troy, and Warren, Michigan. The DetNews reports these areas had more than 400 kindergartners receive the non-medical vaccination exemptions.

Grand Traverse AcademyIn 2017 an outbreak of measles and whooping cough forced Grand Traverse Academy in Traverse City Michigan to close for a week. Grand Traverse County has one of Michigan’s highest rates of schoolchildren opting out of vaccines — twice the state average and six times the national rate for kindergartners in 2013-14.

The problem is not limited to the United States. In Europe, there’s been a “dramatic increase” in measles infections. WHO says there were 23,927 cases of measles in Europe during 2017 and 5,273 in 2016.

rb-

They want you to ignore the truthRenée DiResta, who researches disinformation online at Data For Democracy, pointed out the obvious,  “This isn’t just happening on Twitter. This is happening on Facebook, and this is happening on YouTube, where searching for vaccine information on social media returns a majority of anti-vaccine propaganda,”

She says. “The social platforms have a responsibility to start investigating how this content is spreading and the impact these narratives are having on targeted audiences.

The Russians want us focused on our own problems so that we don’t focus on them. 

Related articles

 

Ralph Bach has been in IT long enough to know better and has blogged from his Bach Seat about IT, careers, and anything else that catches his attention since 2005. You can follow him on LinkedInFacebook, and Twitter. Email the Bach Seat here.

Riskiest ZIP Codes

Riskiest ZIP CodesCredit rating firm Experian recently published a list of the top 100 riskiest shipping ZIP codes for 2017. In the list, U.S. ZIP codes were rated on the number of attempted fraudulent e-commerce transactions against the population of overall e-commerce orders for the ZIP codes.

Experian’s analysis of fraudulent transactions says international IP addresses affect the overall riskiness of a transaction. e-Commerce transactions from international IP addresses are much riskier than average—6.7x riskier from a shipping perspective. Additionally, Experian’s analysis shows that traffic coming from a proxy server—which could originate from domestic and international IP addresses — is 74 times riskier
then the average transaction.

The riskiest ZIP code for e-commerce fraud in 2017 was 97079 in Beaverton, Oregon according to Experian. In fact, Oregon had nearly half of the top 25 riskiest ZIP codes in 2017. The areas in and around Portland OR occupied 10 of the top 25 spots for riskiest e-commerce transactions. Beaverton’s highest risk international IP county is China.

The Miami Florida area put the sunshine state at #2 in the top 25 with nearly a quarter of the riskiest ZIP codes. Miami had 6 of the top 25 slots for the next most risky ZIP Codes for e-commerce firms. The riskiest Miami ZIP code is 33122. Miami’s highest risk international IP county is Venezuela.

The riskiest Miami zip code is 33122.

South El Monte, California ZIP code 91733 is the third riskiest ZIP code on the Experian list for e-commerce firms to ship to. Experian says that 91733’s highest risk international IP countries are Taiwan and Hong Kong.

South El Monte, Califronia zip code 91733 is the third riskiest zip code

The riskiest Michigan ZIP code is 48204 in Detroit, which ranked 32nd on the list and is only 15% of the risk of Beaverton OR.

The riskiest Michigan Zip code is 48204 in Detroit

Other Michigan ZIP Codes on the top 100 list are:

RankCityStateZip CodeFraud Attack Rate
64DetroitMI48227276.6
68DetroitMI
48206270.3
74DetroitMI48228262.4

The top 25 riskiest ZIP Codes according to Experian. Fraud attack rates show the attempted fraudulent e-commerce transactions against the population of overall e-commerce orders.

RankCityStateZip CodeFraud attack rates
1Beaverton OR970792741.9
2Miami FL331221935.1
3South El MonteCA917331473.5
4Portland OR972511257.6
5Portland OR972501178.6
6Miami FL331661155.1
7Portland OR972521059.4
8Miami FL331981010.6
9Miami FL33195921.7
10Miami FL33192769.1
11Portland OR97253726.2
12Portland OR97230676
13Portland OR97217635.8
14Minden NV89423629.2
15HoustonTX77072625.4
16Portland OR97233623.4
17Wilmington DE19801584.6
18Portland OR97218562.1
19Des Moines IA50314544.1
20Chicago IL60621539.8
21Portland OR97203535.6
22Miami FL33191518.7
23Hillsboro OR97124505.3
24Portland OR97254502.5
25Manchester NH3101490.4

rb-

The increase in e-commerce fraud attacks should not surprise anyone. The growth of online information and the continuing tsunami of data breaches has put over 9.7 billion data records on the dark web. The plethora of stolen PII enables criminals to open fraudulent accounts, take over legitimate accounts and submit fraudulent transactions.

Another reason for the increase in online fraud activity is automation. In the past, criminals needed to do something, but they can now attack by simply downloading a file and automating the submission of thousands of applications or transactions
simultaneously.

Related article

Ralph Bach has been in IT long enough to know better and has blogged from his Bach Seat about IT, careers, and anything else that catches his attention since 2005. You can follow him on LinkedInFacebook, and Twitter. Email the Bach Seat here.

Malware Steals Your Cash At ATM

Malware Steals Your Cash At ATMOn September 2, 1969, America’s first automatic teller machine (ATM) started dispensing cash to customers at Chemical Bank in Rockville Center, New York. Since then ATMs have been a trusted avenue for many banking transactions. However, Business Insider warns that the next time you pull cash out of the ATM, or “Tap the Mac” you should take extra care. BI reports that Internet security firm Kaspersky Lab has announced the return of a newer and more dangerous version of the Skimer malware.

TATMs hackedhe report characterizes Skimer as an especially dangerous malware that turns whole ATMs into card-skimming machines. The malware first appeared in 2009 and has been distributed at ATMs all over the world.

The majority of ATM fraud takes place through card skimming. Card skimming is usually physical, as criminals typically install an illegal card-reading device into ATMs, film people entering their PINs on keypads, and then create duplicate cards for sale and use, reports the New York Times. Fortunately, users can uncover these card skimmers because they’ll spot a problem with the card reader or notice an unusual camera.

Gas pump skimmerSkimer is particularly problematic because it is software-based. The article explains the threat is undetectable to the common ATM user since there is no physical sign of the ATM being tampered with. The Russian-based program lets criminals access an ATM remotely, install the malware, and then gather data such as PINs, card numbers, and account numbers over the course of time. A “money mule” can then insert a special magnetic stripe card into the ATM to access the stolen data, take out money, or print card numbers onto a receipt.

The attack begins by gaining access to the ATM system either through physical access or via the bank’s internal network. Then Backdoor.Win32.Skimer malware is installed which infects the core of the ATM. The ATM core is responsible for the machine’s interactions with the banking infrastructure, cash processing, and credit cards. After that, the ATM has become a skimmer. The compromise allows the attackers to withdraw all the funds in the ATM or grab the data from cards used at the ATM, including customers’ bank account numbers and PIN codes.

Kaspersky logoKaspersky is trying to help banks detect Skimer and is providing techniques for identifying affecting machines and securing their ATM networks in the future. Sergey Golovanov, a principal security researcher at Kaspersky Lab explains it is possible for banks to stop Skimer.

We have discovered the hardcoded numbers used by the malware, and we share them freely with banks … they can proactively search for them inside their processing systems, detect potentially infected ATMs and money mules, or block any attempts by attackers to activate the malware

To prevent ATM attacks, Kaspersky recommends that banks:

  • Perform regular AV scans,
  • Use whitelisting technologies,
  • Have a good device management policy,
  • Enable full-disk encryption,
  • Protect the ATM’s BIOS with a password,
  • Only allow HDD booting,
  • Isolate the ATM network from any other internal bank network.

ATM fraud continues to growDespite a way to control Skimer, ATM fraud continues to grow according to BI. A recent FICO study found the number of compromised ATMs in the U.S. surged 546% from 2014 to 2015, thanks in large part to the slow EMV migration of debit cards and ATMs. The article speculates that EMV upgrades would stop Skimer. The resistance to EMV means ATM fraud could grow even more from 2015 to 2016.

John Heggestuen, at BI Intelligence, explains that EMV cards are being rolled out with an embedded microchip for added security. The microchip carries out real-time risk assessments on a person’s card purchase activity based on the card user’s profile. The chip also generates dynamic cryptograms when the card is inserted into a payment terminal. Because these cryptograms change with every purchase, it makes it difficult for fraudsters to make counterfeit cards that can be used for in-store transactions.

EMV cardsRetail card fraud cost U.S. retailers approximately $32 billion in 2014, up from $23 billion in 2013. To solve the card fraud problem across all channels, payment companies and merchants are implementing new payment protocols that could finally help mitigate fraud. In the article, BI’s Heggestuen describes some of the other technologies that financial institutions are utilizing to reduce fraud risks.

Encryption of payments data is being widely implemented. Encryption degrades valuable data by using an algorithm to translate card numbers into new values. This makes it difficult for fraudsters to harvest the payments data for use in future transactions.EncryptionPoint-to-point encryption electronically changes sensitive payment data from the point of capture at the payments terminal all the way through to the gateway or acquirer. This makes it much more difficult for fraudsters to harvest usable data from transactions.

Point-to-point encryption
Tokenization increases transaction security. Tokenization assigns a random value to payment data, making it effectively impossible for hackers to access the sensitive data from the token itself. Tokens are often “multiuse,” meaning merchants don’t have to force consumers to re-enter their payment details. Apple Pay uses one emerging form of tokenization.Tokenization
3D Secure is an imperfect answer to user authentication online. One difficulty in fighting online fraud is that it is hard to confirm that the person using card data is actually the cardholder. 3D Secure adds a level of user authentication by requiring the customer to enter a passcode or biometric data as well as payment data to complete a transaction online.

rb-

The best recommendation to protect yourself from Skimer and other ATM threats is to use the ATMs at your bank or credit union. These ATMs are harder for thieves to install any type of skimmers or malware on because of the higher traffic and monitoring. ATMs located outside a financial institution like at a 7-11 are highly suspect.

Related articles

 

Ralph Bach has been in IT long enough to know better and has blogged from his Bach Seat about IT, careers, and anything else that catches his attention since 2005. You can follow him on LinkedInFacebook, and Twitter. Email the Bach Seat here.

9 Emails You Should Never Open

9 Emails You Should Never OpenThe increasing pace of life coupled with mobile computing which bombards us with emails and messages, from more sources, and across more devices than ever before has created what Proofpoint calls a generation of trigger-happy clickers.

fake emails from cyber criminals.Trigger-happy clickers are falling more and more for fake emails from cybercriminals. These fake emails are so convincing and compelling that they fool 10% of recipients into clicking on the malicious link according to the article. To put that into context a legitimate marketing department typically expects <2% click rate on their advertising campaigns.

So, despite the best efforts of security professionals, too many people are still falling prey to email scams at home and work. Whether it’s a get-rich-quick scheme or a sophisticated spearphishing attack, here are some emails to steer clear of:

1. The government scam

These emails look as if they come from government agencies, such as the IRS, FBI, or CIA. If these TLA’s want to get a hold of you, it won’t be through email.

2. The “long-lost friend”

tries to make you think you know themThis scammer tries to make you think you know them, but it might also be a contact of yours that was hacked.

3. The billing issue

These emails typically come in the form of legitimate-looking communications. If you catch one of these, log into your member account on the website or call the call center.

4. The expiration date

A company claims your account is about to expire, and you must sign in to keep your data. Again, sign in directly to the member website instead of clicking a link in the email.

5. You’re infected

you’re infected with a virusA message claims you’re infected with a virus. Simple fix: Just run your antivirus and check. In a recent twist, scammers claiming to be computer techs associated with well-known companies like Microsoft. They say that they’ve detected viruses or other malware on your computer to trick you into giving them remote access or paying for software you don’t need.

Scammers have been peddling bogus security software for years. They set up fake websites, offer free “security” scans, and send alarming messages to try to convince you that your computer is infected with malware. Then, they try to sell you software to fix the problem. At best, the software is worthless or available elsewhere for free. At worst, it could be malware — software designed to give criminals access to your computer and your personal information.

But wait it gets worse – If you paid for their “tech support” you could later get a call about a refund. The refund scam works like this: Several months after the purchase, someone might call to ask if you were happy with the service. When you say you weren’t, the scammer offers a refund.

Or the caller may say that the company is going out of business and providing refunds for “warranties” and other services.

The scammers eventually ask for a bank or credit card account number. Or they ask you to create a Western Union account. They might even ask for remote access to your computer to help you fill out the necessary forms. But instead of putting money in your account, the scammers withdraw money from your account.

6. You’ve won

you won a contest you never enteredClaims you won a contest you never entered. You’re not that lucky; delete it. It’s illegal to play a foreign lottery. Any letter or email from a lottery or sweepstakes that ask you to pay taxes, fees, shipping, or insurance to claim your prize is a scam.

Some scammers ask you to send the money through a wire transfer. That’s because wire transfers are efficient: your money is transferred and available for pick up very quickly. Once it’s transferred, it’s gone. Others ask you to send a check or pay for your supposed winnings with a credit card. The reason: they use your bank account numbers to withdraw funds without your approval, or your credit card numbers to run up charges.

7. The bank notification

An email claiming some type of deposit or withdrawal. Give the bank a call to be safe.

8. Playing the victim

emails make you out to be the bad guyThese emails make you out to be the bad guy and claim you hurt them in some way. Ignore.

9. The security check

A very common phishing scam where a company just wants you to “verify your account.” Companies almost never ask you to do this via email.

What To Do Instead of Clicking Links

In the case of your bank or other institution, just go to the website yourself and log in. Type in the address manually in the browser or click your bookmark. That way you can see if there’s something that needs taken care of without the risk of ending up on a phishing site.

In the case of your friend’s email, chances are that they copied/pasted the link into the message. That means you can see the full address. You can just copy/paste the address into the browser yourself without clicking anything. Of course, before doing that make sure you recognize the website and that it’s not misspelled.

Proofpoint’s bottom line is that unless you explicitly know and trust it, avoid it. That’s all there is to it. Make this a habit and you can avoid one of the biggest mistakes in internet safety.

Related articles

 

Ralph Bach has been in IT long enough to know better and has blogged from his Bach Seat about IT, careers, and anything else that catches his attention since 2005. You can follow him on LinkedInFacebook, and Twitter. Email the Bach Seat here.

Giving Safely

Giving SafelyIt is the holiday season and most people want to try to be a little nicer. During the giving season, you need to stay vigilant and protect those that are not so tech-savvy from fraudsters who want to rip you off during this season of goodwill. Cyber thieves can use social networking sites and mobile devices to solicit fake donations to take advantage of your charity. Experts recommend that no matter how they reach out to you, post-office, Facebook, email, phone, or text, avoid any charity or fundraiser that:

  • ake advantage of your charityRefuses to share detailed information about its identity, mission, costs, and how the donation will be used.
  • Won’t give proof that a contribution is tax-deductible.
  • Uses a name that closely resembles that of a better-known, reputable organization.
  • Thanks you for a pledge you don’t remember making.
  • Uses high-pressure tactics like trying to get you to donate immediately, without giving you time to think about it and do your research.
  • Asks for donations in cash or asks you to wire money.
  • Offers to send a courier or overnight delivery service to collect the donation immediately.
  • Guarantees sweepstakes winnings in exchange for a contribution. (By law, you never have to give a donation to be eligible to win a sweepstakes.)

To slow down the cyber-thieves, take the following precautions to make sure your donation helps the causes you want to help and not the scammers:

  • Ask for detailed information about the charity, including name, address, and telephone number.
  • Get the exact name of the organization and do some research.
  • Call the charity. Find out if the organization is aware of the solicitation and has authorized the use of its name.
  • Check if the charity is trustworthy by contacting the
  • Keep a record of your donations.
  • Make an annual donation plan. That way, you can decide which causes to support and which reputable charities should receive your donations.
Related articles

 

Ralph Bach has been in IT long enough to know better and has blogged from his Bach Seat about IT, careers, and anything else that catches his attention since 2005. You can follow him on LinkedInFacebook, and Twitter. Email the Bach Seat here.