admin
Tom Muleya-Fraud Insight
In the previous article, it was noted that CID Commercial Crimes Division is increasingly investigating cases involving corporates hacking.
Due to technological development and increased use of mobile technology within corporates, hacking scams are poised to be a big challenge.
Managers and all those charged with organisational security, data or information protection must understand the crime of hacking so that their organisations may save money.
Since the crime of hacking has many faces, and ranges from simple to complex hacking, corporates should be knowledgeable of various typologies.
In addition to the types of hackings we discussed in the previous installment, the following are some of the techniques hackers use to commit hacking scams against corporates;
Infecting devices with malware
“Malware” refers to various forms of harmful software, such as viruses. Once malware is in your computer, it can wreck all sorts of havoc, from taking control of your machine, to monitoring your actions and keystrokes, to silently sending all sorts of confidential data from your computer to or network to the attacker’s base.
Hackers may infiltrate a user’s device to install malware more likely by targeting potential victims via emails, instant messages and websites with downloadable content or peer to peer networks.
Gaining backdoor access
Hackers may create programmes that search for unprotected pathways into network systems and computers. Hackers may gain backdoor access by infecting a computer or system with a Trojan horse, created by hackers to acquire and steal important data without the victim noticing.
Spying on emails
Hackers can create code which allows them to intercept and read emails. Most emails programmes today use encryption formulas which mean that even if hackers intercept a message, they cannot read it.
Logging keystrokes
Some programmes allow hackers to track every keystroke a computer user makes. Once installed on a victim’s computer, the programmes record each keystroke, giving the hacker everything they need to infiltrate a system or steal someone’s identity.
Creating zombie computers
A zombie computer or bot is a computer that a hacker can use to send a spam or commit Distributed Denial of Service (DDoS) attacks. After a victim executes a seemingly innocent code, a connection opens between their computer and the hackers’ system. The hacker can then secretly control the victim’s computer using it to commit crimes or spread spam.
SQL Injection Attack
SQL (pronounced “sequel”) stands for structured query language; it is a programming language used to communicate with databases. Many of the servers store critical data for websites and services use SQL to manage the data in their databases. A SQL injection attack specifically targets this kind of server, using malicious code to get the server to divulge information it normally would not.
This is especially problematic if the server stores private customer information from website such as credit card numbers, usernames and passwords (credentials), or other personally identifiable information, which are tempting and lucrative targets for an attacker.
A SQL injection attack works by exploiting any one of known SQL vulnerabilities that allow the SQL server to run malicious code. For example, if a SQL server is vulnerable to an injection attack, it may be possible for an attacker to go to a website’s search box and type in code that would force the site’s SQL server to dump all of its stored usernames and passwords for the site.
Participate in the fight against fraud and cybercrimes and create a safe environment and crime free Zimbabwe. Think security. Watch out for the next issue.
Tom Muleya is a Detective Assistant Inspector working under the CID Commercial Crimes Division. He is also a member of the National Cyber Security Awareness Taskforce, Zimbabwe. Feedback:WhatsApp line: 0772 764 043, or e-mail: [email protected].
Online Reporter