Rutter’s chain hacked, Android text cons and phone scam arrests in Canada.
Welcome to Cyber Security Today. It’s Monday February 17th. I’m Howard Solomon, contributing reporter on cyber security for ITWorldCanada.com.
To hear the podcast click on the arrow below:
 |
 |
 |
The Rutter’s chain of American convenience stores and gas stations says payment card data of some customers paying at pumps and in stores may have been stolen. Most victims were hit during an eight-month period starting in October 2018, but at one location the thefts started as far back as August 2018. The biggest number of victims used their credit or debit cards to pay for gas at the pumps. Malware in the system was able to read data from the black stripe on the back of cards including the user name, card number and verification code. That’s enough for fraud. In the Rutter’s stores they use chip-enabled card readers that are more secure the malware can only get the card number and not any personal information. Payment card transactions at Rutter’s car washes, ATM’s, and lottery machines in Rutter’s stores were not involved.
Criminals are finding new ways to exploit vulnerabilities in Android devices. One of them is the standard text messaging app. It’s not very secure. Two new reports warn of the dangers. A security company called Lookout discovered bank scam aimed at Canadians and Americans. Victims get a text that appears to come from a financial institution. Click on the link and you get sent to a login page that looks very much like it came from a real bank. The page may even ask victims to answer several security questions, including data of birth. Of course those who filled in the forms likely had their bank accounts emptied. The banks have been notified and this attack is over.
In addition a report from security company Kaspersky warns there’s a new strain of malware that can fake incoming texts. Those texts can be from anyone — a bank or Google. What they want is you to click on something which will make a form pop up and ask for your credit or debit card.
So here’s how you avoid being suckered: Don’t click on links in text messages. It’s hard to verify the source of a text message or email message on the small screen of a smartphone. If you get a text or email from a bank and think it might be legitimate don’t click on the link. Instead go to the bank website or app. On Android devices don’t give Accessibility permissions to any app. Accessibility is for people with visual impairments. But if you get infected malware can use this feature to take over your phone. Block the installation of programs from unknown sources. You do this through the Settings, usually under Apps and Notifications and then go to Special App Access. And only download apps only from the Google Play store.
Police in Canada have arrested two people here in connection with telephone scams that cost people $30 million. About half of that was from a scam where callers pretended to be from Canada Revenue and demanding money for back taxes. Other scams involved callers pretending to be bank investigators or computer tech support staff warning of an infected computer. The two arrested are allegedly what police call money mules, people who collect and launder cash from victims before sending to the masterminds of the schemes. Police believe at least one scam operates from India
Finally, another reminder that crooks are exploiting fears about the coronavirus with a number of email and social media scams designed to get you to click on an infected link or attachment. They may say something like here’s the latest information from a medical expert. One scam supposedly from a shipping company says it may be delaying transport due to the virus and you should check the attachment for details. Worried about the coronavirus? Do your own research at reputable medical sites, Don’t click on links, don’t forward possible infected messages to your family or friends.
That’s it for Cyber Security Today. Links to details about these stories can be found in the text version of each podcast at ITWorldCanada.com. That’s where you’ll also find my news stories aimed at businesses and cyber security professionals. Cyber Security Today can be heard on Mondays, Wednesdays and Fridays. Subscribe on Apple Podcasts, Google Podcasts or add us to your Flash Briefing on your smart speaker. Thanks for listening. I’m Howard Solomon