CHAPTER 2 TARGET.SG TARGET.YOU.SG Many individuals continue to lack cybersecurity awareness and practise poor cyber hygiene. According to the Singapore Police Force, there were 1,204 cases investigated under the Computer Misuse Act (CMA)12 in 2018, a 40 per cent increase from 2017. Some of these cases were a result of victims who were not alert to phishing e-mails intended to steal their sensitive personal information such as passwords and credit card details. All individuals should protect themselves from cyber threats proactively, and practise good cyber hygiene habits at all times. These include checking for signs of phishing before clicking on unknown links or opening attachments in suspicious e-mails, installing computer protection software (i.e. anti-virus, anti-spyware/ malware, and firewall) and keeping them updated, and enabling Two-Factor Authentication (2FA) where possible. Separately, online scams continued to be a concern. There were about 2,125 e-commerce scams reported in 2018, with victims losing a total of about S$1.9 million. 70 per cent of such scams took place on e-commerce platform Carousell, and involved electronic products and tickets to events and attractions. It is important for all individuals to exercise caution towards unrealistic bargains for merchandise on e-commerce platforms to avoid falling prey to such scams. CASE STUDY NEARLY@SCAMMED.COM WHAT HAPPENED? In July 2018, a member of the public sought SingCERT’s help after receiving a threatening e-mail. The e-mail claimed that the victim’s computer had been infected with malware, and demanded payment in exchange for not exposing video clips of the victim in compromising situations, allegedly recorded with the computer’s own web camera. To substantiate the threat, the e-mail also contained the victim’s e-mail password. It was later determined that the e-mail represented a new form of extortion scam that surfaced recently. The victim’s e-mail address and password were likely exposed in a previous data breach – where login credentials of affected individuals were leaked – and not obtained through malware that had compromised the victim’s computer, as the scammer had claimed. FOLLOW-UP ACTION SingCERT advised the victim to change all passwords associated with the compromised e-mail account immediately, enable two-factor authentication for the e-mail account if possible, and not to make any form of payment. As a precautionary measure, SingCERT also recommended performing anti-virus scans on all the victim’s computing devices. As our cyber threat surface increases, potential points of vulnerability will become commonplace. All individuals need to play a conscious role in creating a safe and secure cyberspace. – Dr Shashi Jayakumar, Senior Fellow, S Rajaratnam School of International Studies (RSIS), and Head, Centre of Excellence for National Security and Executive Coordinator, Future Issues and Technology, highlighting individuals’ role in cybersecurity 12 The Computer Misuse Act (CMA) replaces the Computer Misuse and Cybersecurity Act (CMCA) when the Cybersecurity Act came into force on 31 August 2018. 30 31