Cyber Attacks on the Rise in Latin America Antonio Larronda and Carlos Barahona - Infosurhoy
go to original June 11, 2012

Manuel Escobar, a bank employee in Bogotá, said everything “looked completely legal.”

Until he found out it wasn’t.

By then, it was too late.

He lost everything.

“All I know is that I received an email that looked like it was sent from [my] bank telling me to change my pass code for security reasons,” he said. “When I finished, I dropped the issue for a couple of hours. But when I went to the bank to withdraw money, the account was empty. It was too late. I had lost all my savings.”

Escobar’s story is becoming quite common throughout the region where phishing – a crime in which perpetrators, generally computer hackers, send false emails or websites of banking institutions to get account holders to reveal their security codes – has become a major problem.

Phishing causes annual losses of about US$93 billion and affects about 2,500 banks in the region, according to a recent study on cybercrimes by the Latin American and Caribbean Internet Addresses Registry (LACNIC).

Phishing has emerged as the most common type of fraud in the region behind pharming, where hackers download software onto servers that directs account holders to fraudulent websites with the intent of getting them to enter personal data so it can be obtained by criminals, who then can access victims’ bank accounts.

Phishing and pharming were major topics at the LACNIC XVII meeting held in Quito, Ecuador, where 490 experts gathered from May 6 to 11 to sign agreements so countries will work together in their fights against the cybercrimes.

“With phishing we talk about a rate of ‘success’ of around one in one million,” said Carlos Martínez, a research and development engineer at LACNIC, adding cybercriminals frequently concentrate pharming on “a certain niche in society, such as the employees of one company, [where] the challenges are harder [for the attacker] but the potential reward is higher.”

Martínez said communities with a high concentration of financial entities, such as banks, are often targeted.

“Brazil is the attackers’ main destination because of the high density of the population and strong Internet banking culture,” he said. “Then they move on to Uruguay, Argentina and Chile, among others because of their high Internet use.”

A transnational problem

Officials are concerned that it doesn’t take very long – about 24 hours – for criminals to create a website that can obtain information used to steal account holders’ money, according to LACNIC.

It’s also rather difficult for countries to work together to combat phishing or pharming since the targeted financial institutions, Internet providers, servers and the Community Emergency Response Teams (CERT) and Computer Security Incidence Response Teams (CSIRT) vary greatly from nation to nation. The emphasis on fighting pharming and phishing also varies throughout the region, Martínez said.

“The matter is subject to the laws of each one [of the countries], and sometimes information is protected as personal data,” he added. “Another influence is the willingness of the governments [to take on the issue].”

Officials’ main weapon against pharming and phishing is the AMPARO project, a LACNIC initiative that works to inform private business sector and social organizations throughout the region of the dangers of cybercrimes and how they can avoid becoming victims.

The project is yielding results.

Argentina passed a law addressing cybercrimes in 2008. Three years later, it signed an international agreement mandating those found guilty of cybercrimes would be punished.

The Colombian government approved the creation of CERT in July of last year to combat Internet fraud and strengthen cybersecurity nationwide.

The government allocated CERT a US$3 million budget in 2012, a substantial increase over the US$787,000 given last year.

Brazil, Argentina, Chile, Venezuela and Uruguay also have a government-funded CERT.

There are also private initiatives with CSIRT teams such as Antel in Uruguay and Banelco in Argentina.

Martínez said the rise in Internet users increases the pool of potential victims for all cybercrimes, which is why users should use common sense when they receive a suspicious email asking for their passwords.

Here are some steps to follow to avoid becoming a cybercrime victim:

• Never click on an external link to enter a bank’s website – go directly to the institution’s website;
• Become familiar with a financial institution’s protocols for entering passcodes;
• Protect all personal information, especially passwords and passcodes;
• Constantly monitor accounts, transactions and statements for suspicious transactions;
• Use updated antivirus software;
• Never download files from emails, especially if they seem suspicious, such as those that have misspellings;
• Don’t trust an email that promises a free gift.

“No banking institution normally asks the user to give away his or her passwords,” Martínez said.

We invite you to add your charity or supporting organizations' news stories and coming events to PVAngels so we can share them with the world. Do it now!