Chapter 2 WWW.TARGET.SG Global Trends Point-of-Sale Attacks Supply Chain Attacks Point-of-Sale (POS) attacks refer to the compromise of touchpoints such as online shopping websites and cash terminals in brick-andmortar stores, where retail transactions take place. The separation of front- and back-end servers, where the website design and the payment processing functions of e-commerce retailers are outsourced to separate vendors, opens up more vulnerabilities for exploitation. Active since 2016, Magecart cybercrime operators have been conducting POS attacks by injecting malicious codes into e-commerce websites to skim credit card details. They have stepped up their activities in recent years, targeting a range of businesses from Small and Medium Enterprises (SMEs) to multinational corporations. According to cybersecurity firm NortonLifeLock (formerly Symantec), supply chain attacks grew by almost 80 per cent in 2018.29 Supply chain attacks target the less secure components of systems, and could be aimed at accessing and stealing confidential information, or gaining a foothold to springboard attacks into other parts of the system and connected networks. Third-party service providers with access to an organisation’s data are often the weak links targeted by threat actors. Notably, many third-party providers which were hit by cyber incidents in 2019 had inadequate cybersecurity measures which placed the supply chains of their clients at risk. Data Breaches Mobile Attacks Spear Phishing 2019 witnessed an exponential increase in data breaches around the world, with the total number of records exposed registering a near 300 per cent increase, compared to 2018.30 Data breaches can be costly. Based on a study by IBM Security on the costs of data breaches, organisations stand to lose up to US$4 million on average in the event of a data breach, including investigation and recovery costs, as well as potential lawsuits brought on by clients.31 The large amounts of personal and financial information held in organisations such as governments, healthcare institutions and technology firms serve as attractive targets for threat actors, who see opportunities to profit from such data. Threat actors are shifting towards targeting mobile devices such as smartphones and tablets to conduct credential theft, surveillance and malicious advertising. The number of attacks using banking malware against mobile devices in the first half of 2019 alone saw a 50 per cent increase over the whole of 2018.32 A major factor behind this spike in mobile attacks is likely due to the increased usage of mobile banking applications, which provide lucrative avenues for threat actors to gain access to and steal sensitive information such as credit card and bank account details. With more than five billion unique mobile devices in the world33, and an estimated 8.5 million subscriptions (representing a mobile penetration rate of ~150 per cent)34 in Singapore, this ever-growing reliance on mobile devices will only increase the attack surface for mobile threats. In 2019, nearly 90 per cent of organisations worldwide have been targeted by spear phishing e-mails pretending to be from trusted senders aiming to obtain information from their victims.35 To add authenticity to the spear phishing e-mails, threat actors are also observed to adapt the writing styles of spoofed individuals and organisations, as well as use information from publicly available sources, such as social media posts, so that their e-mails appear more convincing to their victims. 32 33 29 30 31 20 Symantec Internet Security Threat Report (ISTR) Volume 24, February 2019, https://docs.broadcom.com/doc/istr-24-2019-en. “In 2019, a total of 7,098 reported breaches exposed 15.1 billion records,” Help Net Security, 11 February 2020, https://www.helpnetsecurity.com/2020/02/11/2019reported-breaches. IBM Security — 2019 Cost of a Data Breach Report, https://databreachcalculator.mybluemix.net. SINGAPORE CYBER LANDSCAPE 2019 34 35 Business e-mail compromise is another form of spear phishing which is increasing. This scam involves phishing e-mails purportedly sent by high-ranking officials or senior personnel to employees and customers of an organisation, in order to trick them into making fund transfers or divulging sensitive information. Check Point Research — 2020 Cyber Security Report, https://www.checkpoint.com/downloads/resources/cyber-security-report-2020.pdf. Koetsier, John. “Why 2020 is a Critical Global Tipping Point for Social Media,” Forbes, 18 February 2020, https://www.forbes.com/sites/johnkoetsier/2020/02/18/why2020-is-a-critical-global-tipping-point-for-social-media/. “Statistic on Telecom Service for 2019 Jul – Dec,” Infocomm Media Development Authority (IMDA), Retrieved 1 March 2020, https://www.imda.gov.sg/infocomm-medialandscape/research-and-statistics/telecommunications/statistics-on-telecom-services/statistic-on-telecom-service-for-2019-jul. Proofpoint — 2020 State of the Phish Report, https://www.proofpoint.com/us/resources/threat-reports/state-of-phish. 21