12 CYBER CRIME & CYBER SECURITY TRENDS IN AFRICA Social Media, Scams, & Email Threats Cyber crime on the continent of Africa has moved far beyond the notorious 419 Nigerian email scams, coined after the code of legislation aimed to suppress such scams.15,16 The sophistication of some attacks and tactics used by cyber criminals demonstrates how vulnerable individuals are online and has chipped away at public confidence in online security and commerce. Data breaches, government surveillance, and good old-fashioned scams came together to further encroach on personal privacy, whether it is personal photos, login credentials or medical histories. In 2015, Symantec saw plenty of traditional scams and malware attacks intended to gather personal information. For example, one scam promised large numbers of followers for free on Instagram, while seeking to fool people into revealing their passwords. Some attacks impersonated tax officials in an attempt to trick people into downloading malicious email attachments. In their simplest form, many scams still rely on the poor security habits of the general public to succeed. However, we have also seen how poor website security can expose customer data. In the latter example, it doesn’t matter how strong a password may be if the website is vulnerable to a data breach. Global Social Media 100% 2013 90 80 70 70 76 2014 2015 81 60 50 40 30 23 17 20 10 7 2 Manual Sharing Fake Offering 5 5 Likejacking 2 1 Fake Apps 2 0 0 <1 Fake Plugin TT    Manual Sharing – These rely on victims to actually do the work of sharing the scam by presenting them with intriguing videos, fake offers, or messages that they share with their friends. TT    Fake Offering – These scams invite social network users to join a fake event or group with incentives, such as free gift cards. Joining often requires the user to share credentials with the attacker or send a text to a premium rate number. More concerning are attacks in 2015 that made use of sophisticated social engineering to bypass the two-factor authentication systems designed to safeguard users. By going through a legitimate password-reset process and posing as Google via SMS, however, one scam was able exploit the public’s trust in a reputable brand to gain access to email accounts without raising the victims’ suspicions. TT    Likejacking – Using fake “Like” buttons, attackers trick users into Social media remains a favored target of scammers, as criminals seek to leverage the trust people have in their own social circles to spread scams, fake links, and phishing. To succeed, the social engineering involved must be convincing, so we have seen more ingenious tactics being used to dupe potential victims. Social media is quickly becoming a daily part of life across Africa. Around 9% of the population uses social media and that number is growing each year, with South Africans among the world’s leaders in time spent on social networks at 3.2 hours per day. 17 In 2015, 120 million people were using Facebook across Africa, over 80% via their mobile device.18 but the plugin is malicious and may spread by re-posting the fake video message to a victim’s profile page without permission. Examples include installing a fake YouTube premium browser extension to view the video, or noticing that a DivX plugin is required, and the fake plugin masquerades as such. For more information visit: http://www.symantec.com/connect/blogs/fake-browser-plugnew-vehicle-scammers 15 16 17 18 http://www.bbc.com/news/business-32079748 http://foreignpolicy.com/2010/03/24/africas-cyber-wmd/ https://www.facebook.com/business/news/connecting-100-million-people-inafrica http://www.cnn.com/2016/01/13/africa/africa-social-media-consumption/ clicking website buttons that install malware and may post updates on a user’s newsfeed, spreading the attack. TT    Fake Apps – Users are invited to subscribe to an application that appears to be integrated for use with a social network, but is not as described, and may be used to steal credentials or harvest other personal data. TT    Fake Plugin – Users are invited to install a plugin to view a video,