Cyber 321: 24th December 2021

Plain English cyber in 3 articles, 2 numbers, and 1 action.

This week: NatWest’s scrutiny failed to see anything wrong with black bags of cash, Microsoft services are the prime target of phishing attacks, and more on my journey down the crypto rabbit hole.

This week’s action: Have a Happy Christmas!

THREE ARTICLES

1: There was so much cash, it was brought to the branch in black bin bags

(Nothing to do with cyber, but I couldn’t ignore the story)

“NatWest has been fined more than £264m for anti-money-laundering failures that involved black bin liners stuffed full of cash being deposited [by one business], and sums so large that one branch’s two floor-to-ceiling safes proved “inadequate” for storing it all. [..] About 50 branches across the country were used to make deposits, with Southall receiving £42m in cash between January 2015 to March 2016 – but no report was made that it was suspicious. [..] The court heard £700,000 was paid into the Walsall branch in a single day.”

The bank attempted to defend itself by saying “It did not escape the bank’s system, it did not go under the radar [..] It was identified and subjected to scrutiny.”

It then went on to state the obvious: “The quality or adequacy of that scrutiny is another matter.”

You couldn’t make it up.

2: That Microsoft site you’re visiting may be a phishing page

“Phishing has fast become one of the key ways that cybercriminals manage to gain access to victims’ details and launch attacks [..] In all, 73% of phishing pages identified by cybersecurity firm Agari are impersonating Microsoft product-related pages. [..] That proportion isn’t hugely surprising, given the role Microsoft and its products play in our day-to-day lives.”

Using a password manager (and its browser plugin) will reduce the risk of you being fooled by a phishing site. After all, when you go to a genuine site, your password manager will suggest the login credentials that you have stored for that site. However, if you visit a malicious site pretending to be that genuine site, your password manager won’t suggest any credentials. This could be a key red flag for you.

3: Cryptocurrency solves problems that we don’t have

As I continue down the rabbit hole of blockchain, DeFi, and cryptocurrencies, I have to remind myself that many of the problems solved by these technologies are not true pains in our comfortable lives in the West. We have current solutions that are ‘good enough’.

But, that’s not the case across the world. This is the subject of ‘Chain Reaction’, a book I mentioned in October. This Wired article talks about another problem that is solved / circumvented by crypto – Sanctions and currency controls in places like Cuba, Venezuala and Nigeria. This might also indicate why so many jurisdictions are keen to assert some sort of control over crypto.

TWO STATISTICS

1: 79%

79% of the emails that were reported as suspicious by employees were phishing or spam emails, according to an experiment involving 14,000 staff members of a large organisation over a 15-month period.

10% of these reports were submitted within 5 minutes of the suspicious email being received. This suggests the use of a ‘Report Phishing’ button within an organisation’s email system could be a very effective way to get early sight of a phishing attack.

There are some other significant findings in this paper (which you can download from https://arxiv.org/pdf/2112.07498.pdf). I will delve into these in a January edition of Cyber 3-2-1.

2: 100%

100% of elves used ‘Elf1234’ as their password, according to a recent interview with Santa.

ONE ACTION

1: Have a great Christmas

I hope Cyber 3-2-1 has helped you to protect yourself against the most common cybersecurity attacks in 2021. And as a result, I hope you can now switch off and enjoy the Christmas break.

To anyone who has reached out to say hello to me this year, thanks for all of your feedback. To the rest of you lurkers, I’d love to hear from you in 2022.