Cyber Gestion
Related Articles
Cyber crooks use the KISS method – Keep it Simple… Quickbooks, Credit Cards and your supposedly anonymized data – things we think we know and trust are used in scams that not only evade technical detection and are so simple in concept that almost anyone could be fooled.
I’m Jim Love, CIO of ITWC, publishers of IT World Canada and TechNewsDay in the US, replacing Howard Solomon on vacation.
QuickBooks is the accounting software that is a boon for small and even medium-sized businesses. It’s reasonably priced, accessible to any business, and can automate many tasks, from bookkeeping and accounting to time tracking and invoicing.
Among its productivity benefits, the software has the ability to send invoices and even enable phone follow-up. It’s this ability that hackers have turned into a surprisingly low-tech phone scam.
As software and automated defenses have become more and more sophisticated in anti-phishing defenses: proven phone fraud is becoming more and more attractive and it even has its own name – vishing, short for voice phishing.
The attackers just need a phone number which they call the unsuspecting mark. When they do, an agent will try to extract valuable information from them.
These attacks were very effective in evading detection because they were identical to non-fraudulent QuickBooks notifications,
What makes it even easier is that QuickBooks offers free trials for 30 days. Scammers create free accounts and send fraudulent invoices from QuickBooks and generate phone calls.
Inky reports that they impersonated a number of well-known brands:
Attackers call a legitimate customer telling who is presented with an invoice or order confirmation that their credit card has already been charged. They are asked if they wish to contest the charge. If so, they should contact the phone number provided in the email.
Once a victim calls, a scammer will try to get information (login credentials, credit card information, other personally identifiable information) or send them to a form on a site that will look genuine, but exists to steal information.
If you steal a credit card number or buy a stolen number, the first thing to do is to determine if it still works without setting off an alarm. Once you’ve verified that it hasn’t been reported as compromised, you can head to town.
Automatic card attacks have a similar pattern: bots are used to attempt small purchases with stolen credit, debit and gift card data. If the transaction is successful, the fraudster knows that the card is valid. Valid cards can be used to make larger purchases of goods or gift cards, or resold on the dark web for a much higher value.
Consumers are incredibly schizophrenic when it comes to their data. On the one hand, there is a growing desire for privacy and protection of their personal information. On the other hand, many people willingly give their data in exchange for services – like – tell me the fastest way home through traffic. What they don’t want is to release highly sensitive data.
But the reality is that there are a growing number of “dark ad tech and data brokers” who harvest huge amounts of personal data, then process and sell that data.
There are several ways to collect this data. Mobile apps are among the biggest offenders, and many sell that data. Software Development Kits (SDKs) have built-in functions that collect data from a number of sources and then sell access to ii.
The U.S. Federal Trade Commission (FTC) warned this week that it will crack down on tech companies’ illegal use and sharing of highly sensitive data and false claims about data anonymization.
Until that crackdown happens, many security professionals suggest that you look very carefully at any app that asks to collect data it doesn’t need. Suppose anything an app should give you is the equivalent of a US Miranda warning – anything you do or say can be used against you.
And a breakup story sent to us just as we went on air:
It’s cybersecurity today for Friday, July 15, 2022.
Follow Cyber Security Today wherever you get your podcasts – Apple, Google or other sources. You can also have it delivered to you via your Google or Alexa smart speaker.
Thanks for letting me into your day.
Howard will be back this weekend.
