When CIOs talk about platforms, they’re usually referring to digital rather than political ones. But as Americans head to the polls, corporate tech leaders should be paying close attention to what a second Trump administration, or a first Biden one, could have in store for them.



The outcome of the contest will have profound consequences for skilled immigration, data privacy regimes, the regulation of AI and other issues such as cybersecurity that all matter to CIOs. It will also shape how America deals with China as a competitor and trading partner—a fraught relationship that’s sparked concerns over high-tech supply chains and the security of 5G communications networks<a href="https://www.forbes.com/sites/davidjeans/2020/10/09/huawei-rivals-nokia-ericsson-27-billion-us-sanctions/#7249ea2bde48">&nbsp;using equipment from Huawei and other Chinese firms</a>.



The election will also help determine whether America can sustain its role as a global innovation leader. The Information Technology and Innovation Foundation (ITIF), a think tank with close links to the tech industry, points out that the U.S. would need to spend at least an additional $100 billion a year, or an increase of around 80% over current spending levels, just to match what it was investing in research as a percentage of GDP back in the 1980s.



“The reality is that America is no longer the global innovation leader, at least on a per capita basis, and it risks losing out to China over the next decade or two,” the ITIF wrote in a recent study of the likely impact of the upcoming election on tech policy. “Whether or not the two major parties understand this threat and want to prioritize it is unclear.”



<h3 class="wp-block-heading">Tackling China</h3>



What is clear is that tensions over high-tech trade with China are likely to remain high under either a second Trump administration or a first Biden one. But the tactics a Biden presidency would adopt are likely to be quite different to those of its predecessor.



Speaking at the<a href="https://www.forbes.com/connect/event/forbes-cio-next-virtual-episode1/">&nbsp;Forbes&nbsp;CIO Next virtual summit</a>&nbsp;held on October 27, Darrell West, an expert on technology policy at the Brookings Institution, said that if President Trump is re-elected, he’s likely to continue his aggressive and unpredictable, go-it-alone policy towards pressuring China for trade concessions. “A company may wake up one day thinking they are a friend of the administration and the next day become a target,” said West.



A Biden presidency is likely to keep up the pressure on China, too, but will almost certainly create a clear set of processes for handling trade negotiations on high-tech and other issues. West thinks it will also want to forge a more united front with the European Union on dealing with the Chinese. While this approach may make it easier for CIOs and other executives to assess supply chain risks in dealing with Chinese manufacturers, both presidential candidates are likely to maintain U.S. efforts to keep hardware from China and other suppliers out of 5G networks in America and other countries on national security grounds.



With Chinese companies pulling ahead in areas such as<a href="https://www.forbes.com/sites/anthonytrippe/2020/08/31/china-is-gunning-to-be-the-world-leader-in-ai-chips-while-restricting-exports/#392b0c186d4e">&nbsp;chips that power artificial intelligence (AI) applications</a>, the issue of how the U.S. government can better support domestic innovation will be on the table no matter who becomes president. Neither candidate looks likely to bring government spending as a percentage of GDP back to 1980s levels, but the Biden camp has pledged to invest an additional $300 billion over four years to help close some of the gap. If he is re-elected, President Trump is likely to continue his current policy of reducing overall government support on R&amp;D while boosting investment<a href="https://www.forbes.com/sites/martingiles/2020/08/14/us-to-boost-ai-quantum-funding-in-2021/#291bef1521dd">&nbsp;in some key areas such as AI, quantum information science and advanced manufacturing</a>.



On cybersecurity, both candidates would likely step up efforts to protect U.S. companies and critical infrastructure such as electrical grids from cyberattacks. West thinks a Biden administration could press for a kind of Geneva convention on cyber arms control, whereas if President Trump is re-elected his administration will keep pursuing a more unilateral approach. If the Democrats win the presidency and perhaps carry the Senate too, they may also push for a mandatory regime that requires companies to report hacks to a national database. Republicans, on the other hand, are more likely to leave breach reporting requirements to individual states.&nbsp;



<h3 class="wp-block-heading">Importing talent</h3>



Finding enough skilled workers is one of CIOs’ biggest concerns, so they will be hoping for an easing of restrictions on H1-B visas and other channels that the present Trump administration has been restricting.



Robert Atkinson, the president of the ITIF, thinks a Biden administration will expand skilled immigration whereas a second Trump one is likely to extend the current crackdown. However, he cautions that if Biden wins, companies can’t count on a swift increase in H1-Bs. “There are a lot of folks on the left [of the Democratic party] who have pushed back on H1-Bs because these are seen as undermining U.S. wages,” he says. “You could instead see an expansion of other avenues and vehicles to bring in high-skilled workers.”



Atkinson also thinks that if Biden carries the White House, CIOs could find<a href="https://www.forbes.com/sites/marksettle/2020/10/20/the-proper-path-to-achieving--automation-at-scale/#2f8df7ef2a4a">&nbsp;robotic process automation (RPA) strategies</a>, which use software to take over tasks from workers, under intense political scrutiny because of fears these will destroy jobs and crater wages. “In a Biden administration, companies will have to be much more careful and cautious about how they portray this. Trump doesn’t mind automation; he minds offshoring.”



Companies’ automation drives could be blunted in other ways. For instance, tax reforms in 2018 made it possible for businesses to immediately deduct the entire cost of equipment purchases from taxable income; previously, they had generally only been allowed to write off a portion of the cost in a single year. This encouraged CIOs and other executives to accelerate purchases of everything from robots to servers. However, the changes will come up for review in a couple of years and a Biden administration would be less likely to push for an extension.



If Biden wins the election, CIOs will almost certainly face tougher rules on data privacy. Both candidates are in favor of a national consumer privacy regime to replace the present mix of different state ones, but the Democrats are more likely to push for<a href="https://www.forbes.com/sites/waynerash/2020/06/29/ccpa-enforcement-to-begin-on-wednesday-july-1-2020--steps-to-get-ready/#5650f7475f8b">&nbsp;a California-style framework</a>&nbsp;with significant compliance costs and hefty fines for rule-breakers. They are also more likely to support a national regime to regulate the use of artificial intelligence for things such as facial recognition systems.



<h3 class="wp-block-heading">Tech under the microscope</h3>



No matter which of the presidential candidates ends up in the White House after the election, it’s clear that the world of technology is going to face more intense scrutiny than ever before.



CIOs will want to keep an especially close watch on who ends up leading key government agencies, such as the Federal Trade Commission and the Department of Justice, which are responsible for oversight on antitrust policy. The Justice Department’s recent move to sue Google<a href="https://www.forbes.com/sites/alisondurkee/2020/10/20/justice-department-suing-google-for-antitrust-violations/#7e1f4243dbb8">&nbsp;for alleged antitrust violations</a>&nbsp;is likely to be followed by actions against Facebook and possibly other tech firms. It will also be important to watch who is chosen to sit on key congressional bodies such as the House Judiciary Committee’s Antitrust Subcommittee, which issued a report earlier this month<a href="https://www.forbes.com/sites/rachelsandler/2020/10/06/long-awaited-house-report-recommends-breaking-up-big-tech/#46776205c831">&nbsp;flagging multiple potential areas of potential concern</a>, including Amazon’s significant share of the cloud computing market.



The Brookings Institution’s West neatly encapsulated where things stand in his closing remarks at the Forbes CIO Next event. “Over the last 30 years, the mantra has been ‘permissionless innovation,’” he said, referring to a relatively laissez-faire view of technology’s impact on the economy and society. “That era is coming to an end. We’re going to have more public engagement [on tech issues], more public oversight, and more public regulation.”



-By Martin Giles, Forbes Staff

Man voting online

Here’s How The U.S. Election Could Impact Automation, Cybersecurity, Data Privacy And Other Key Issues CIOs Care About

The many ways in which it is now rife in South Africa.



In August 2020, South Africa experienced its largest-ever data leak, which exposed the personal information of around 24 million South Africans and just under 800,000 businesses. The suspected fraudster deceived credit bureau Experian under the guise of being an existing client.



Despite Experian claiming that “no sensitive consumer credit or financial information was obtained by the fraudster in this incident”, the Information Regulator (South Africa) confirmed that the data made its way onto the dark web via a whistleblower.



“The whistleblower has informed the regulator that the information of natural persons that is hosted on the dark web includes their cell numbers, home and work phone numbers, employment details and identity numbers,” it said via a statement.&nbsp;



“The personal information of companies includes the names of the companies, contact details, VAT numbers and banking details.”



Experian is pursuing criminal and civil charges against the fraudster.



Mimecast says cybercriminals are targeting South African public and private sector organizations in orchestrated attacks that could lead to devastating losses in business productivity, reputational damage and revenue.



Brian Pinnock, cybersecurity expert at Mimecast, says the global pandemic only served to accelerate the volume of attacks. It reportedly found a 75% increase in impersonation fraud in South Africa over the first 100 days of the pandemic.



<blockquote class="wp-block-quote is-layout-flow wp-block-quote-is-layout-flow">“As South African organizations implement systems and policies to ensure compliance to the Protection of Personal Information Act (POPI), which comes into force in July 2021, we are likely to hear about more data breaches.” – Brian Pinnock, a cybersecurity expert at Mimecast</blockquote>



“As South African organizations implement systems and policies to ensure compliance to the Protection of Personal Information Act (POPI), which comes into force in July 2021, we are likely to hear about more data breaches. This is in part because of the legislative requirement to inform customers and regulators of any breach as soon as reasonably possible. The regulator appears to have since indicated that 72 hours is a reasonable period,” says Pinnock.



According to the World Economic Forum (WEF), cybercrime remains one of the greatest threats to global prosperity and is expected to cost the global economy $2.9 million every minute in 2020.



The Covid-19 pandemic has led to a complete digital shift for both business and personal interaction from video calls to collaborative tools and down-time activities such as shopping, streaming or gaming.&nbsp;



Cybercriminals have proven highly adept at exploiting a crisis or global event, and a digital ecosystem where the risk of getting caught remains very low and the potential returns are very high, says the WEF.



Additionally, the profits from these malicious activities allow for continuous improvement in capabilities that often surpass the intensive cybersecurity investments made by government or corporate victims.



Since lockdown began in South Africa, impersonation attacks have escalated as workers are forced into remote work, says Pinnock.



“Home information technology is generally insecure, and most organizations have not planned to securely support remote users at this kind of scale.”



He says criminals will look at trends and popular services, brands or topics and exploit these because they know there’s a greater chance of individuals clicking on links and falling into traps.&nbsp;



John Mc Loughlin, CEO of J2 Software, an African security-focused company based in Johannesburg says cyber security and privacy risks should be top priority for any business at present, especially whilst trying to accommodate all staff in their remote working environments.



“More concerning is the intensification of cyberattacks; unscrupulous cybercriminals are exploiting vulnerable and unsuspecting home workers,” says Mc Loughlin.



The South African Banking Risk Information Centre (SABRIC) says it has already seen an increase in new scams involving personal protective equipment, fake vaccines as well as other phishing scams.&nbsp;



SABRIC CEO Nischal Mewalall says: “Amendments to grant distribution processes, the increased use of deviations in procurement processes and the availability of relief funding to businesses and employers will make South Africa even more vulnerable to corruption, armed robberies, application and procurement fraud in 2020 and beyond.”



SABRIC has warned that cybercriminals are exploiting the spread of the coronavirus by using “coronamania” panic to spread scams through phishing and SMS phishing.&nbsp;



Mc Loughlin says that cybercriminals are using SMS phishing, more commonly known as ‘SMishing’, to trick victims into clicking on a link disguised as information on a coronavirus breakout in their area to steal credentials. “Some of these texts claim to provide free masks or pretend to be companies that have experienced delays in deliveries due to the coronavirus.”



<blockquote class="wp-block-quote is-style-large is-layout-flow wp-block-quote-is-layout-flow">According to the World Economic Forum, cybercrime remains one of the greatest threats to global prosperity and is expected to cost the global economy $2.9 million every minute in 2020.</blockquote>



He adds that cybercriminals will also create fake news, links and stories to incite rage and spread these via platforms such as WhatsApp. “As unsuspecting people share fake news and malicious websites, these criminals expand their reach, which stems back to common attack methods that use our built-in fear and uncertainty to trick us to click.”



While investigations are pending from South Africa’s largest data leak, Experian won’t be held liable as the POPI Act allows companies to comply with its new rules by 1 July 2021. Depending on how serious a breach is, the new Act makes provision for fines of up to R10-million ($597,000) and a jail sentence of up to 10 years.



By Nafisa Akabor

Hacker in front of computer

Cybersecurity: Covid-19 Or Not, Cybercrime Is Here To Stay

Remote and flexible working policies are increasingly popular, but put companies at huge risk when it comes to cyber security. If starting your own business, these pointers could be useful.



IF YOU’RE A MODERN, PROGRESSIVE COMPANY, IT’S highly likely you’ve got some sort of flexible remote working policy. Unfortunately, with this greater freedom comes greater risk, and remote workers are often the brittle link in a business’s security chain. Employees in general, according to beleaguered IT professionals, are lackadaisical about security software, lackluster about the Wi-Fi they use, and apathetic about their physical security too; writing their passwords on Post It notes and sticking them blatantly on their laptops.



And cyber security is not something to be ignored.



“Cyber-attacks are increasing exponentially,” explains Lukas van der Merwe, a specialist sales executive for security at T-Systems South Africa. Working globally, T-Systems picked up a peak of four million cyber-attacks in 2017. In 2019, this number was a breath-taking 53 million. Every IT security expert interviewed for this article viewed a cyber breach as a matter of when, not if, for most companies.



Remote work is also on the rise. Says Johnny Kromer, a technology executive at Nashua Communications: “We have definitely seen an increase in remote workers, almost all customer solutions today have to be installed with a different percent of mobile access.”



So, how do remote workers open you up to ransomware, phishing, hacking and general cyber security lawlessness?



There are two broad divisions to be made here: digital and physical.



DIGITAL



Remote workers make you vulnerable simply by taking their devices out of the safe online space your IT department has set up in the office, and recklessly using the free Wi-Fi available at most coffee shops. Nothing that’s free is really free, as they say, and the cost of using free Wi-Fi to access your email, client information and more means you open the fence and share your online picnic blanket with a bunch of randoms who might have their eyes on your data. Since public Wi-Fi is unencrypted, it’s easy for hackers to target the individuals using it.



Remote workers are also at a risk of falling for email phishing scams, as generally most of their communication is done via email with their company.



Van der Merwe has helped clients recover from cleverly crafted phishing mails that made it all the way to the CFO for sign-offs on large amounts of money, authentically copying documents and even signatures from the inboxes they had access to. One client lost R1 million ($69,000) to such a scam.



There are some simple things that companies and individuals can do to reduce hacking risks – a) setting up a VPN, or virtual private network, which allows workers to safely access the internet from any Wi-Fi connection; b) Ensuring workers have adequate anti-virus software. This is a bit of a pain point as many remote workers use their own devices and are reluctant to give their companies access to their computers, but this should be a non-negotiable requirement. c) Password documents that list every login are a huge no-no – with most corporates not realizing that these documents are available to anyone on the internet (if saved incorrectly on the Cloud). It is recommended you rather use an online password program that is encrypted; d) 2-factor authentication for logins is one of the easiest ways to secure access, and you can set it for most online programs through their security settings (including social media like Facebook); e) Set up BYOD (bring your own device) policies with strict rules around security measures and the ability to remotely wipe a device, whether a phone or laptop.



PHYSICAL



The other risk is taken far less seriously, with most companies focusing on their digital perimeter rather than any physical one. Some physical risks include:



a) Open laptops when heading to the loo: best practice is to enable auto-locking after a certain period of inactivity; b) Over-the-shoulder hacks: don’t, for example, work on vulnerable files in a public space like the Gautrain (rail service in Johannesburg) where people can peer over your shoulder;



c) Eavesdropping: ever said your ID number or password out loud in a coffee shop? Yeah, don’t do that; d) Unshredded documents: you could have your identity stolen through unshredded documents – this is a real risk; e) Passwords physically written down: the Post It note password on your laptop is a terrible idea.



BEHAVIOR CHANGES



“Train staff, then train them some more! Most companies could do more security training and still be unprepared,” says Jon Tullett, a senior research manager for IT services sub-Saharan Africa, at IDC South Africa. “An employee who sees security as an impediment is on the side of the attacker, since they’re likely to circumvent safeguards in the name of productivity.” Businesses need to make security a priority with clear policies in place, and regular training of staff. Overall, internet security is something companies should take far more seriously. Every expert interviewed was horrified at the belligerent indifference most businesses take to their vulnerabilities, and everyone viewed breaches and security scares as a certainty in the next few years. South Africa has already had its taste of this,



with government departments, newspapers and ISPs (internet service providers) alike all coming under fire in 2019 alone. As Van der Merwe says, “Most people trade off convenience for security.” But be one of those people at your own risk.



<h4 class="has-text-align-center wp-block-heading">IF THE WORST HAPPENS… BUSINESS (CYBER) INSURANCE</h4>



Vera Nagtegaal, executive head of Hippo.co.za, says that your insurance should look at the following aspects:



REPLACEMENT COST: Insure your tech items for the value of replacement and not necessarily what you paid for it.



WHAT’S INCLUDED IN COVER: Should you insure your laptop, enquire whether there will be cover provided for software as well, as this can be quite costly, and find out what kind of damage is covered.



CLAIMS TURN-AROUND TIME: Some providers can authorize and/or pay out a claim within two to 24 hours, others take a few days and some could take even longer.



REPLACEMENT PROVIDERS: Enquire about the service providers they use to replace your cell phone and research reviews to ensure they are reputable and have good warranties on new devices.



-by Samantha Steele

Afro american young man typing on laptop

REMOTE WORKING: PROGRESS AND PERILS

If governments don’t focus on strong privacy protections in their COVID-19 contact tracking tools, it could exacerbate domestic abuse and endanger survivors, according to a warning from women’s support charities.



They’ve urged the U.K. government to include domestic abuse and violence against women and girls (VAWG) experts in the development of such initiatives.



Though the U.K. doesn’t yet have a widely available track and trace app, the charities &#8211; including Women’s Aid and Refuge &#8211; are already anxious enough about the current tracing program, where infected people are called up and asked to register themselves online as someone who has contracted COVID-19. They’re then asked to share details on people with whom they’ve been in contact so they too can be informed.



In a joint whitepaper, the nonprofits said they were anxious about contact tracing staff inadvertently leaking contact details of survivors to perpetrators. They also raised fears the program could be turned into a “tool for abuse.” 



“For example, perpetrators may make fraudulent claims that they have been in contact with survivors in order for them to be asked to self-isolate unnecessarily, and in these circumstances survivors will have no means to identify the perpetrator as the original source,” they warned. “Perpetrators or associates may also pose as contact tracing staff and make contact with victims [or] survivors requesting they self-isolate or requesting personal information.”



The paper also claims abusers are already using the coronavirus pandemic for “coercive control,” in some cases deliberately breathing, spitting and coughing in survivors’ faces. As <a href="https://www.forbes.com/sites/thomasbrewster/2020/05/09/online-child-abuse-complaints-surpass-4-million-in-april-this-is-how-cops-are-coping-despite-covid-19/">Forbes previously reported</a>, the sharing of child abuse material has also spiked during global COVID-19 lockdowns.



As for apps, the report warned they required location services to be switched on. “While the NHS app itself doesn’t collect location data, if a perpetrator has installed spyware onto a survivor’s phone or is able to hack into it, then turning on location services will expose their location.”



Problems with Palantir?



The charities also raised concerns about a number of companies who’d partnered with the U.K. on the contact tracing initiatives. They said Serco, which is handling recruiting for contact tracing staff, “has a significant track record of failings and human rights violations, including running a controversial women’s immigration detention centre where&nbsp;<a href="https://www.independent.co.uk/news/uk/politics/serco-given-yarl-s-wood-immigration-contract-despite-vast-failings-9880772.html" target="_blank" rel="noreferrer noopener">staff have been accused of sexual misconduct</a>&nbsp;and involvement in unlawful evictions of asylum seekers.” Serco also&nbsp;<a href="https://www.theguardian.com/business/2020/may/20/serco-accidentally-shares-contact-tracers-email-addresses-covid-19" target="_blank" rel="noreferrer noopener">recently had to apologize for leaking email addresses</a>&nbsp;of contact tracer staff.



Serco denies that it has any kind of significant track record of failing and human rights violations and that the evictions to which the charities are referring were in Scotland and were ruled legal. It also said that in seven years there had been no substantiated complaints about any sexual wrongdoing at the Yarl’s Wood immigration removal centre, where reports had revealed allegations.



“We are proud to be supporting the government’s test and trace programme with our Tier 3 contact centre team working from pre-approved Public Health England scripts. This is important work and we would like to thank all our teams who have stepped forward. In just four week we mobilised many thousands of people, which is a huge achievement, and we are focussed on ensuring that all our people are able to support the government’s programme going forwards,” a Serco spokesperson said.



Palantir, the $20 billion big data crunching business, also raised an eyebrow. The company, which has&nbsp;<a href="https://www.forbes.com/sites/thomasbrewster/2020/03/31/palantir-the-20-billion-peter-thiel-backed-big-data-giant-is-providing-a-coronavirus-monitoring-tool-to-the-cdc/">secured millions of dollars in contracts to help health agencies manage the outbreak</a>, has come in for criticism for assisting U.S. immigration authorities on finding and ejecting illegal aliens.



Palantir hadn’t responded to a request for comment at the time of publication.



<h2 class="wp-block-heading">UK’s delayed COVID-19 app</h2>



The charities’ warning comes as the U.K. announced its contact tracing app would be shifting to the Apple and Google models, which promise stronger privacy protections than the app being tested by the government. The main difference is in where user information goes. In the government’s app, anonymized phone IDs of both the infected person and the people they’ve been near are sent to a centralized server, which determines who to warn about possible COVID-19 infection. In the Apple and Google model, only the phone ID of the infected person is sent to a centralized database. The phone then downloads the database and decides where to send alerts. The latter means the government has access to far less data on people’s phones, pleasing some critics but aggravating the government.



Health secretary Matt Hancock said on Thursday that Apple&#8217;s restrictions on third-party apps&#8217; use of Bluetooth may’ve been one reason the government’s own app wasn’t as successful as hoped. Bluetooth is being used to determine whether an infected person has been in close proximity with another person’s phone.



Earlier this week, Amnesty International cybersecurity researcher Claudio Guarnieri&nbsp;<a href="https://www.forbes.com/sites/thomasbrewster/2020/06/16/covid-19-tracking-apps-a-privacy-trash-fire-as-norway-nixes-its-own/">warned</a>&nbsp;that global rollouts of contact tracing apps were a privacy “trash fire.” After analyzing 11 apps, he found many contained privacy shortcomings. So concerned was Norway that it suspended its tool.



Even with lockdowns easing, those who’re infected are still being advised to isolate. However,  the NHS guidance <a rel="noreferrer noopener" href="https://www.hpft.nhs.uk/information-and-resources/coronavirus/domestic-violenceabuse-during-the-coronavirus-covid-19-pandemic/" target="_blank">says</a> that “the household isolation instruction as a result of Coronavirus (COVID-19) does not apply if you need to leave your home to escape domestic abuse.” That message may not have been amplified as much as it should’ve been.



&#8211;<a href="https://www.forbes.com/sites/thomasbrewster/">Thomas Brewster</a>, Forbes Staff, <a href="https://www.forbes.com/cybersecurity">Cybersecurity</a>

gettyimages-1221768016-170667a

Warning: COVID-19 Contact Tracing Apps Could Be Turned Into Tools For Domestic Abuse

If you’re hunkered down at home because of the&nbsp;<a href="https://www.forbes.com/coronavirus">coronavirus</a>&nbsp;pandemic and trying to go about your working day without any distractions, you’ll want to avoid being the victim of any attack on your computer or smartphone. Not only do you put your own personal data at risk by failing to take some extra precautions, but because of the sudden jump in folk working from home, you might be putting your business in danger too.



Some companies are sagely scoring brownie points with customers and the wider security community by making some of their services available for free. It’s responsible capitalism in action and a little ray of light in what’s been an otherwise bleak few weeks. “It’s difficult to predict what the next few weeks will look like, but we need to work together to protect our teams, loved ones, and local communities,” wrote John Shiner, CEO of 1Password. “Reduce unnecessary travel — including travel to and from the office — and be empathetic to the challenges that remote work can bring to your teams and their families.”



If you haven’t already got a password manager or two-factor authentication, you might be wise to avail yourself of some of these offers.



Free password managers and more for remote workers



Networking giant&nbsp;<a href="https://blogs.cisco.com/security/cisco-expands-free-security-offerings-to-help-with-rise-in-remote-workers" target="_blank" rel="noreferrer noopener">Cisco</a>, for instance, is letting customers of its Duo Security tool go above their user limit as their employees increasingly work from home, whilst new customers can get a&nbsp;free license. Duo Security’s primary service is a two-factor authentication tool that can be added to web and mobile apps. When a user wants to login, they have to get another key from Duo. That can come in the form of a simple phone call, text or a code from the Duo app. Cisco’s offering the same deal for its web security tool Umbrella and its VPN product AnyConnect. It’s making those deals available until July 1.



Canadian company 1Password, meanwhile, has <a rel="noreferrer noopener" href="https://blog.1password.com/covid-19-response/" target="_blank">removed</a> the 30-day trial period on 1Password Business, meaning the first six months are free. The usual cost is $7.99 per head. Its password manager keeps all your logins in one place so you don’t have to remember them. Like competitor products, like LastPass or Dashlane, it’ll suggest more secure passwords too. If you or your company doesn’t already have a password manager, it’s not a bad place to start.



And&nbsp;<a href="https://www.onelogin.com/press-center/press-releases/trusted-experience-platform-virtual-learning" target="_blank" rel="noreferrer noopener">OneLogin</a>&nbsp;has made its Trusted Experience Platform free for all K-12 schools, colleges and universities doing remote learning over the coming weeks and months. The product includes single sign-on (SSO), so students and teachers don’t have to keep signing into different apps. It remains secure as each app checks in with a trusted third-party who can verify they’re the right user. OneLogin’s tool also provides multi-factor authentication (a Duo competitor).



As&nbsp;Forbes&nbsp;reported earlier this week,&nbsp;<a href="https://www.forbes.com/sites/alexkonrad/2020/03/13/zoom-video-coronavirus-eric-yuan-schools/">Zoom has made its videoconferencing tools available free to K-12 schools</a>&nbsp;too.



This page will continue to be updated as we learn about other COVID-19-coping security tech.



&#8211;<a href="https://www.forbes.com/sites/thomasbrewster/">Thomas Brewster</a>, Forbes Staff, <a href="https://www.forbes.com/cybersecurity">Cybersecurity</a>

Security system of circuit padlock hologram in network space.

Get This Free Cybersecurity Tech To Cope With Your Coronavirus Chaos

Every day millions of us rely on tech to protect our cars from thieves. Immobilizers, for instance, ensure only the owner of the right key fob can start the vehicle.



But now that technology has become a security threat, after hackers told&nbsp;Forbes&nbsp;they could lock down up to 25,000 cars at once. It&#8217;s all thanks to a vulnerability (now fixed) that made it frighteningly simple to quickly take remote control of a car’s immobilizer and prevent drivers from starting their vehicle.



Your car’s immobilizer is  supposed to be used for good. If a crook steals your car, it&#8217;s possible for you to connect to the immobilizer, which tracks the vehicle and allows you to stop anyone from turning on the engine. 



READ MORE | <a rel="noreferrer noopener" aria-label="Hack Breaks Your Visa Card’s Contactless Limit For Big Frauds (opens in a new tab)" href="https://www.forbesafrica.com/technology/2019/07/30/hack-breaks-your-visa-cards-contactless-limit-for-big-frauds/" target="_blank">Hack Breaks Your Visa Card’s Contactless Limit For Big Frauds</a>



But with one particular immobilizer &#8211; the U.K.-made SmarTrack tool from Global Telemetrics &#8211; an easy-to-hack vulnerability meant it was simple for researchers at Pen Test Partners to turn on the immobilizer permanently, without the customer knowing a thing.



To prove it was possible, the researchers from British cybersecurity company Pen Test Partners hacked the vehicle of one of their own employees, disabling his car whilst they were in the U.K. and he was in Greece, not long before he was due to head to a wedding.



&#8216;We own your immobilizer&#8217;



Ken Munro, cybersecurity researcher and partner at Pen Test Partners, first described the hack to&nbsp;Forbes&nbsp;at the DEF CON convention in Las Vegas.



He found that it was possible to turn the immobilizer on and the car off by sending a simple request via a browser. Once he&#8217;d entered the command, it took less than a second for the immobilizer to be triggered. 



It was as if Munro was acting as one of the SmarTrack call center employees who were permitted to turn the immobilizer on. SmarTrack systems just weren&#8217;t correctly checking that the commands were being sent by an authorized user, Munro said.



READ MORE | <a rel="noreferrer noopener" aria-label="Google Is Making Android As Difficult To Hack As iPhone—And Cops Are Suffering (opens in a new tab)" href="https://www.forbesafrica.com/technology/2019/05/24/google-is-making-android-as-difficult-to-hack-as-iphone-and-cops-are-suffering/" target="_blank">Google Is Making Android As Difficult To Hack As iPhone—And Cops Are Suffering</a>



Munro warned that it would be impossible for anyone to start the car again with the immobilizer fitted. The only option would be to have the tech removed entirely, he added. &#8220;We now control the immobiliser, so only we can de-immobilize the car.&#8221;



And, if the hacker turned the immobilizer on when the car is moving, it would simply prevent the car from running as soon as the engine stopped. As Munro noted, that could be &#8220;quite nasty&#8221; if the car has an auto start and stop function (such a feature is found in many modern models to help cut emissions in traffic).



Munro was also critical of Thatcham Research, the industry body which had given accreditation to the SmarTrack devices, saying it was safe to use.&nbsp;&#8220;People buy these devices thinking that the accreditation means something. We’ve shown that in some cases, fitting a theft tracker makes your car less secure,&#8221; Munro said.



Thatcham said that it accredits security products against a minimum set of requirements, including alarm and driver identification functionality. &#8220;The process also includes an attack test where the system on the vehicle needs to resist physical deactivation for two minutes,&#8221; the spokesperson added. &#8220;We do not, however, test the security of the vehicle system or the surrounding ecosystem.&#8221;



READ MORE | <a rel="noreferrer noopener" aria-label="#30Under30: Technology Category 2019 (opens in a new tab)" href="https://www.forbesafrica.com/30-under-30/2019/07/01/30under30-technology-category-2019/" target="_blank">#30Under30: Technology Category 2019</a>



Fixes available



Fortunately for SmarTrack customers, the flaws have now been addressed. &#8220;All potential vulnerabilities have now been resolved,&#8221; a Global Telemetrics spokesperson said. &#8220;Our customers can be assured that no password or personal details were compromised by this process and there are no security or safety concerns with any of our products.



&#8220;Security has always been and remains of paramount importance to us and as a result of the contact from Pen Test Partners we now have reassessed our ongoing security improvement project to ensure we remain market leaders in security and safety.&#8221;



To deal with the issues, Global Telemetrics brought in cybersecurity consultancy Hedgehog Security. Peter Bassill, founder of  Hedgehog, confirmed that what Munro claimed to have found was accurate. 



READ MORE | <a rel="noreferrer noopener" aria-label="Navigating Bitcoin, Ethereum, XRP: How Google Is Quietly Making Blockchains Searchable (opens in a new tab)" href="https://www.forbesafrica.com/technology/2019/02/27/navigating-bitcoin-ethereum-xrp-how-google-is-quietly-making-blockchains-searchable/" target="_blank">Navigating Bitcoin, Ethereum, XRP: How Google Is Quietly Making Blockchains Searchable</a>



Of the ability to shut down 25,000 cars at once, Bassill said: “It&#8217;s one of those assertions security researchers make&#8230; but there&#8217;s certainly capability where that could&#8217;ve happened&#8230; it certainly would&#8217;ve taken longer than one line of code, but the art of the possible is certainly possible.&#8221;



He said the vulnerabilities were likely down to developers writing code without enough attention to security. But Bassill has been working with new developers on the SmarTrack team to patch the vulnerabilities and set up processes to make sure issues are fixed quickly in the future.



But, as Bassill and Munro are warning, there are many immobilizers being used in millions of cars across the world. With many similar devices potentially containing security weaknesses, something we use every day without thought could very quickly become the latest weapon in a hacker’s arsenal.



-Thomas Brewster; Forbes

gettyimages-760226865-170667a

Hacker Claims He Can ‘Turn Off 25,000 Cars’ At The Push Of A Button

Think that £30 limit on contactless payments is going to protect you from big thefts? Think again.&nbsp;



<hr class="wp-block-separator"/>



Security researchers have found a way to bypass that limit on Visa cards. Their hack, which isn’t limited to U.K. cards, could let opportunistic crooks drain accounts with a single tap, and they claim they don’t even need to steal the credit card. And little on Visa’s side is being done to address this fresh fraud threat.



Forbes&nbsp;let the researchers—Leigh-Anne Galloway and Tim Yunusov from cybersecurity company Positive Technologies—try it out on a personal Visa card. They extracted three successful payments of £31 ($38). On their own cards they made contactless payments as high as £101, though it’s possible more could be stolen with just a tap.



Their hacks show how contactless fraud could get a lot worse. Typically, if a bank sees multiple £30 contactless payments, the card will cease to work, as fraud detection systems suspect it’s in the hands of a thief. But if it’s possible to make large transactions in one tap, the potential for significant frauds rises.&nbsp;



READ MORE | <a rel="noreferrer noopener" aria-label="Is Forex A Scam Or Money Goals? (opens in a new tab)" href="https://www.forbesafrica.com/investment/2019/04/01/is-forex-a-scam-or-money-goals/" target="_blank">Is Forex A Scam Or Money Goals?</a>



Card thieves can now make larger payments than they could before. But now, they don’t even need to steal the card. Criminals could, for instance, take a payment from a card when the user wasn’t looking with their own mobile payments machine (though a malicious merchant would eventually be caught by banks’ fraud systems if they used the same terminal). 



Or even more dastardly, it’s possible to take a payment reading from a credit card using a mobile phone, send the data to another phone and make a payment on that second device going beyond the limit, the researchers claimed. For the hack to work, all the fraudsters need is to be close to their victim.



“So that means if you found someone’s card or if someone stole your card, they wouldn’t have to know your PIN, they wouldn’t have to impersonate your signature, and they could make a payment for a much higher value,” said Galloway.



There should be some limits on just how much a hacker could steal. Galloway said that while it may be that thieves could go much higher than the £101 they tested, into the hundreds or possibly thousands, fraud detection systems at the banks may be able to spot any wildly high transactions. 



<blockquote class="wp-block-quote is-layout-flow wp-block-quote-is-layout-flow">“What we found is that actually, we can make reasonably high-value payments. So in the U.K., we’re able to make payments of £100 without any detection,” she added.</blockquote>



They’re still testing whether the hack would work elsewhere in the world, but Galloway confirmed it was not limited to a single country. The limit, of course, differs between nations. For instance, in the U.S., it’s considerably higher at $100.



No fix planned?



That doesn’t detract from the finding that the limit set on Visa cards can be broken. But Visa isn’t planning on updating its systems to deal with the hack. The financial industry giant argued that such a hack wouldn’t be likely to occur in the real world as the criminals would need to have their hands on the card and this doesn’t happen frequently.&nbsp;



A spokesperson for the company went as far as to say that despite the research there wasn’t a security problem that needed addressing.



“One key limitation of this type of attack is that it requires a physically stolen card that has not yet been reported to the card issuer,” a Visa spokesperson told&nbsp;Forbes, noting that Visa was continually working on improving its fraud detection tech.&nbsp;



“Likewise, the transaction must pass issuer validations and detection protocols. It is not a scalable fraud approach that we typically see criminals employ in the real world.”



READ MORE| <a rel="noreferrer noopener" aria-label="#30Under30: Technology Category 2019 (opens in a new tab)" href="https://www.forbesafrica.com/30-under-30/2019/07/01/30under30-technology-category-2019/" target="_blank">#30Under30: Technology Category 2019</a>



Galloway disagreed that the fraudster would need to steal the card. As their tests showed, the hacker only needs to get close enough to the victim’s card for a short period of time to take a payment. This kind of “skimming” has long been proven possible, even if it relies on the card owner being caught unawares.



The Visa spokesperson also claimed that Visa’s global contactless fraud rate declined by 33% between 2017 and 2018 and in Europe by 40%. But data from UK Finance shows fraud using contactless caused £19.5 million of losses during 2018, up from £14 million in 2017. 



UK Finance did, however, note this was “low” in light of total spending of £69 billion over the same year. And neither UK finance nor Visa said they’d ever recorded a case of contactless fraud in which the card hadn’t been stolen.



How the contactless hack works



To carry out their hack, the researchers used a specialized piece of hardware to intercept and insert messages in the communications between the card and the reader. For instance, they could tell the card that verification—like a PIN—wasn’t needed, even though the requested amount was more than £30. They then told the terminal that verification has already been made by another means.&nbsp;



The researchers said these checks hadn’t been made mandatory by Visa, as they had been by its rivals. And as banks follow the guidelines laid out by Visa, it could be doing more to address the issue, Galloway said. Though Visa said that card issuers are ultimately responsible for validating transactions.



For the attack using two mobiles, Galloway explained that it was possible to use one smartphone to tap a card and effectively clone it for a short period. That first mobile takes what’s known as a “payment cryptogram” from the card. This is essentially a signature that is supposed to guarantee the authenticity of future payments. 



READ MORE | <a rel="noreferrer noopener" aria-label="Cryptocurrency Thefts, Scams Hit $1.7 Billion in 2018: Report (opens in a new tab)" href="https://www.forbesafrica.com/technology/2019/01/31/cryptocurrency-thefts-scams-hit-1-7-billion-in-2018-report/" target="_blank">Cryptocurrency Thefts, Scams Hit $1.7 Billion in 2018: Report</a>



The cryptogram is sent to the second phone, which simulates the card as if it were making a mobile payment. The hackers can then go beyond the limit by doing the same interception attack as before.



Stephen Ridgway, cofounder and chief technology officer at cybersecurity startup th4ts3cur1ty.company, said that addressing such attacks at a technical level could be problematic. 



“There may be no ‘quick fix’ for this, even if the payment providers mandate authentication for payments over £30, if the card and reader are susceptible to a ‘man-in-the-middle’ attack that tricks the system into believing that authentication has already taken place,” he said.&nbsp;



As for what concerned cardholders can do to protect themselves, keeping cards physically secure is vital. For anyone worried about someone reading their card through their wallet, there are covers that can prevent such “skimming” from working. Ridgway said another cheap solution was to use a phone cover, as they often provide the same protection. And monitoring transactions could help consumers detect fraudulent transactions before banks do.



Improving bank security and fresh new regulation should also improve matters. Ridgway said that should contactless limit bypasses become common, it’s very likely that payment providers will quickly learn to recognize and block them. 



And incoming new EU rules could also prove a boon. From September 2019, banks will need to ensure a PIN is required once total contactless payments exceed a value of £130 or when five contactless transactions have been made in a day.



-Thomas Brewster; Forbes

960×0

Hack Breaks Your Visa Card’s Contactless Limit For Big Frauds

Cryptocurrency Mining In Africa As Poor Sheperdherder Proves A Point

Cryptopia In Crisis: Joe Lubin’s Ethereum Experiment Is A Mess. How Long Will He Prop It Up?

The world suffered another <a href="https://www.forbes.com/sites/thomasbrewster/2017/06/27/ransomware-spreads-rapidly-hitting-power-companies-banks-airlines-metro/" target="_blank" rel="noopener noreferrer">ransomware nightmare </a>on Tuesday, with pharmaceutical companies, Chernobyl radiation detection systems, the Kiev metro, an airport and banks all affected. One U.S. hospital also <a href="http://amp.wtae.com/article/cybersecurity-incident-heritage-valley-health-system/10228015" target="_blank" rel="noopener noreferrer">appears to be a victim</a>. Worse is expected, thanks to some pernicious features in the ransomware sample.
The malware widely believed to be responsible is a version of Petya which security researchers are calling &#8220;NotPetya&#8221;. It&#8217;s similar to Petya, but different enough to qualify as an entirely new form of ransomware, researchers say. Backing up NotPetya is an exploit method borrowed from a leaked <a href="https://www.forbes.com/sites/thomasbrewster/2017/05/12/nsa-exploit-used-by-wannacry-ransomware-in-global-explosion/" target="_blank" rel="noopener noreferrer">NSA hack called EternalBlue</a>, the same which WannaCry used to infect hundreds of thousands of computers and take down hospital networks. Though with the new strain, only computers on a local network are scanned, not the entire internet, as WannaCry attempted.
<a href="http://www.forbesafrica.com/technology/2017/06/28/mayday-mayday-ive-hacked/" target="_blank" rel="noopener noreferrer">Mayday! Mayday! I&#8217;ve Been Hacked</a>
That&#8217;s cause for embarrassment among infected companies: Microsoft <a href="https://www.forbes.com/sites/leemathews/2017/05/13/microsoft-update-wannacrypt-ransomware/" target="_self">released a patch</a> earlier this year which prevented any EternalBlue hacks, even pushing out updates for older, unsupported Windows systems like XP. Businesses should have patched by now, especially given the carnage WannaCry caused.
<h3>Extra powers</h3>
NotPetya has some extra powers that security experts say make it deadlier than WannaCry. While EternalBlue has allowed it to spread via a weakness in Windows&#8217; SMB, it has other tools for moving at speed across networks. For instance, according to former NSA analyst and cybersecurity entrepreneur David Kennedy, the ransomware finds passwords on the infected computer to move to other systems. It does that by extracting passwords from memory or from the local filesystem, he explained.
<blockquote>&#8220;This is going to be a big one. Real big one,&#8221; Kennedy added.</blockquote>
Another proliferation technique is NotPetya&#8217;s abuse of <a href="https://technet.microsoft.com/en-us/sysinternals/bb897553.aspx" target="_blank" rel="noopener noreferrer">PsExec</a>. The tool is meant to carry out limited actions on other systems, but in this case its  spreading the infection by executing malicious code on other computers. For instance, if the infected PC has administrator access to the network, every computer can become infected. A similar method is used by NotPetya with the Windows Management Instrumentation (WMI) tool, <a href="https://twitter.com/GossiTheDog/status/879761465061904394" target="_blank" rel="noopener noreferrer">according to security expert Kevin Beaumont</a>.
&#8220;This dangerous combination may be the reason why this outbreak has spread globally and rapidly, even after the previous outbreaks have generated media headlines and hopefully most vulnerabilities have been patched,&#8221; said ESET researcher Robert Lipovsky. &#8220;It only takes one unpatched computer to get inside the network, and the malware can get administrator rights and spread to other computers.&#8221;
Perhaps most crucially, thanks to all these added features, the new strain will infect even patched Windows PCs, including those with Windows 10, as one IT professional <a href="http://colsec.blogspot.co.uk/2017/06/petya-outbreak-june-27th.html" target="_blank" rel="noopener noreferrer">noted</a> in a blog, whereas WannaCry worked largely on older systems.
A Microsoft spokesperson said the company was aware of the reports and was investigating, adding: &#8220;Our initial analysis found that the ransomware uses multiple techniques to spread, including one which was addressed by a security update previously provided for all platforms from Windows XP to Windows 10 [the EternalBlue vulnerability <a href="https://technet.microsoft.com/en-us/library/security/ms17-010.aspx" target="_blank" rel="noopener noreferrer">MS17-010</a>]. As ransomware also typically spreads via email, customers should exercise caution when opening unknown files. We are continuing to investigate and will take appropriate action to protect customers.&#8221; It also claimed its anti-malware product, Windows Defender, detected and blocked the malware.
<h3>Pro ransomware</h3>
This latest attack appears to be the work of a professional group, unlike WannaCry, which was full of bugs and had a killswitch. which a British security researcher accessed and turned off (though more infections occurred just last week). There is no obvious killswitch with NotPetya, which Kaspersky <a href="https://twitter.com/kaspersky/status/879749175570817024/photo/1" target="_blank" rel="noopener noreferrer">said</a> has infected at least 2,000 organizations across the globe, including Ukraine, Russia, the U.K. and the United States.
NotPetya&#8217;s professionalism might come from Petya&#8217;s birth in the bustling, highly technical cybercriminal underground. Jakub Kroustek, Threat Lab Team lead at Avast, said: &#8220;One of the perfidious characteristics of Petya ransomware is that its creators offer it on the darknet with an affiliate model which gives distributors a share of up to 85% of the paid ransom amount, while 15% is kept by the malware authors.&#8221; This kind of &#8220;ransomware-as-a-service&#8221; has been a growing concern of late, given it opens up the crime to a non-technical audience.
Whatever the class of criminal behind today&#8217;s outbreak, they&#8217;ve had a good pay day, though not an astounding one. At the time of publication, 22 payments had been made to 2.39818893 Bitcoin, worth around $5,515.
Anyone even considering paying hackers to unlock their computers should reverse course, however: the email account set up to provide keys has been <a href="https://posteo.de/en/blog/info-on-the-petrwrappetya-ransomware-email-account-in-question-already-blocked-since-midday" target="_blank" rel="noopener noreferrer">shut down</a> by the provider, Posteo. Thanks to that, there&#8217;s no obvious way of recovering files without backups. &#8211; Written by <a class="link preload-hidden ng-binding" href="http://www.forbes.com/sites/thomasbrewster/" target="_blank" rel="noopener noreferrer">Thomas Fox-Brewster</a>, FORBES STAFF

Petya Or NotPetya: Why The Latest Ransomware Is Deadlier Than WannaCry

For years, security experts warned Africa&#8217;s slumbering companies of cyberattacks. On May 12, many woke up. On this day cyberattacks struck 150 countries,  infecting more than 200,000 computers and holding multi-billion-dollar businesses, like France’s Renault, Britain&#8217;s National Health Service, Spain&#8217;s Telefónica, the United States’ FedEx and Germany’s Deutsche Bahn, to ransom.
<a href="https://www.forbesafrica.com/technology/2017/06/28/petya-notpetya-latest-ransomware-deadlier-wannacry/" target="_blank" rel="noopener noreferrer">Petya Or NotPetya: Why The Latest Ransomware Is Deadlier Than WannaCry</a>
Behind it is <a href="https://www.forbes.com/forbes/welcome/?toURL=https://www.forbes.com/sites/peterlyon/2017/06/22/cyber-attack-at-honda-stops-production-after-wannacry-worm-strikes/&amp;refURL=https://www.google.co.za/&amp;referrer=https://www.google.co.za/" target="_blank" rel="noopener noreferrer">WannaCry</a>. This malicious software (malware) encrypts your computer files until a ransom of $300 is paid in the virtual currency, bitcoins. In simple words, it spreads like worms in a bag of rotten apples.
Experts say the reason why this malware squirmed easily into so many companies is that they see cybersecurity as a joke. Many hadn&#8217;t updated their security in over two months.
This made it easy for hackers to exploit Microsoft Windows XP operating systems by bypassing security checks. Once into the core, the malware can search for other files to exploit.
&#8220;Africa, in fact the whole world, is woefully unprepared. Traditional security measures aren’t keeping up with the emerging threats. And it’s becoming increasingly difficult, economically, to keep throwing money at the problem, when [top level management] doesn’t necessarily understand the difference between defending against attackers versus defending against auditors, all the while, tightening the purse strings and treating security as a grudge purchase or necessary evil,&#8221; says Tim Morty, Cyber Security Specialist at Information Security Architects (ISA).
<a href="http://www.forbesafrica.com/technology/2012/02/01/web-vigilantes/" target="_blank" rel="noopener noreferrer">Web Vigilantes</a>
When your computer is under attack, Morty is the kind of guy you want at you back. For 10 years he has battled cyberattacks on the frontline in Africa, from Botswana and Namibia to Mauritius, Tanzania, Uganda and South Africa.
&#8220;Until not too long ago, the prevalent opinion was that only the big corporate and financial institutions had a need to protect their data against corporate espionage, which many considered the main external threat over and above the usual defences against spam and malware. That has changed in recent times. Cybercriminals have not only expanded their reach, they have also found a ready market in our personal data,&#8221; says Morty.
Often it can be your employees and their cell phones that make you vulnerable.
&#8220;Careless posting on social media is a major concern, as is the use of corporate resources on non-corporate networks. Let’s face it, we all love free WiFi! However, do you really know who is behind the connection, and what are they doing with the information that you are transmitting or receiving?&#8221;
One reason why Africa is so vulnerable is many of its people are still learning how the internet works.
&#8220;We need to begin learning how to survive in the virtual worlds we have created. Cybercriminals have rapidly adapted to the virtual world and are using the advantages they have developed to thrive, while others are still taking their first tentative steps in this new frontier.&#8221;
It was not long ago that businesses, according to <a href="https://home.kpmg.com/xx/en/home/campaigns/2016/06/ceo-outlook.html" target="_blank" rel="noopener noreferrer">KPMG&#8217;s 2016 Global CEO Outlook</a> study, considered cybersecurity as an afterthought. The study found cybersecurity has become a major concern for many CEOs. One in five business leaders now list information security as the risk they are most concerned about, while a third sees cybersecurity as the issue with the biggest impact on their company.
<a href="https://www.forbesafrica.com/focus/2016/03/01/making-millions-paranoia/" target="_blank" rel="noopener noreferrer">Making Millions From Paranoia</a>
The study is made from the views of nearly 1,300 CEOs from companies across 11 industries in 10 countries. Cyberattacks loom larger in Africa when many businesses are on the cusp of the Fourth Industrial Revolution, the age of machine learning, cognitive computing and artificial intelligence, play over the internet.
&#8220;Cyberattack is like cancer, there is not one form of cancer and cybersecurity has a lot of different areas. It&#8217;s one thing for somebody to steal your Mastercard and cause you aggravation, but stealing a vaccine for something like a virus, could be worth billions,&#8221; says J. Patrick Michaels Jr, the founder at Communications Equity Associates (CEA).
Michaels founded CEA in 1973 as a US Cable TV brokerage firm.  Nearly half a century later, it has investments of $1.3 billion in private equity wealth across 60 countries.
Known as a globetrotting investment banker, Michaels learned of cybersecurity in his days as Vice Chairman of the Board of Visitors of the U.S. Naval Academy. Michaels believes small businesses in Africa are prime targets for cyber blackmail.
&#8220;Hackers are starting to target the smaller companies to freeze up their businesses. A lion isn&#8217;t going to attack an elephant, when maybe a water buffalo or springbok is easier prey,&#8221; says Michaels.
&#8220;If you hijack the IT systems for a corporation, the impact on that company&#8217;s shares would be crippling. We could be sitting in Prague, sending a message to this company that to unfreeze their systems, the payment of $100 million to various bank accounts around the world would be appropriate. $100 million would be nothing compared to how much they would lose on the JSE stock markets if they were shut down for just 10 minutes.&#8221;
<a href="https://www.forbesafrica.com/focus/2013/09/01/industrial-thief-line-can-rob/" target="_blank" rel="noopener noreferrer">Industrial Thief On The Line, How Can I Rob You?</a>
On the ground in Africa, Morty warns cyberattacks are on the rise because businesses can’t foot the bill.
&#8220;South Africa is, on average, ahead of the curve, in terms of Africa, although we’ve still got a lot of room for improvement… Economically, it is sometimes prohibitively expensive to keep up with the latest and greatest technologies. For those that can afford it, the next challenge is staff upskilling and, often, retention, in a market where skilled individuals are always sought after,&#8221; says Morty.
&#8220;There have been a few occasions when we have documented some major security concerns while working with a client; from open wireless access points and often basic networking flaws at one financial institution to simple lack of visibility and understanding of the client’s environment, with the security role being taken care of by networking staff with minimal training or understanding of the technologies in use.&#8221;
External threats are only part of the problem. Disgruntled employees or moles find it easy to expose weaknesses from within.
&#8220;The typical image, often conjured by media, of hooded figures hunched ominously over a laptop keyboard, is quite misleading. Threats from within are a reality; sometimes with intent, sometimes through neglect, often by accident, especially due to poor user education about a topic that isn’t always user friendly,&#8221; says Morty.
&#8220;Rapid adoption of social media has contributed to security woes, as its users willingly provide attackers with a wealth of information to use against both organizations and individuals alike, making reconnaissance, planning and execution of social engineering attacks that much easier.&#8221;
According to the 2017 Harvey Nash/KPMG CIO Survey, the world’s largest survey of IT leadership, cybersecurity vulnerability is at an all-time high, with a third of IT leaders (32%) reporting their organization had been subject to a major cyberattack in the past 24 months – a 45% increase on 2013.
Only one in five say they are very well prepared to respond to these attacks, down from 29% in 2014. Despite very visible headline-grabbing attacks, such as the recent WannaCry ransomware attack, the biggest jump in threats comes from insider attacks, increasing from 40% to 47% over the last year.
So should we be spending millions on encrypting our phones and protecting computers from hackers?
&#8220;Oddly enough, I’m inclined to say no. Throwing money at the problem will only help up to a point. What we need to do is change the way we work. Educate our users about what it means to be part of the connected world; illustrate what the risks are as well as what can be done to protect themselves, and teach good security practices rather than dictate an intimidating list of do’s and don’ts,&#8221; says Morty.
It will take a while yet for online security to become second nature. Until then Africa&#8217;s blind spot could be expensive.
Relentless rise of organizations being subject to major cyberattacks during past four years:
2017: 32%
2016: 28%
2015: 25%
2014: 22%
Source: <a href="https://www.hnkpmgciosurvey.com/" target="_blank" rel="noopener noreferrer">The 2017 Harvey Nash/KPMG CIO Survey</a>

Mayday! Mayday! I’ve Been Hacked

Google&#8217;s <a href="https://www.forbes.com/sites/thomasbrewster/2017/03/22/google-android-government-surveillance-fight/" target="_blank" rel="noopener noreferrer">proud of its track record</a> in protecting more than one billion Android phones and tablets from malevolent hackers. But in the last 12 months, it&#8217;s been dealt a few blows, including the <a href="https://www.forbes.com/sites/thomasbrewster/2017/05/26/google-shuts-down-massive-ad-fraud-on-play-store/" target="_blank" rel="noopener noreferrer">biggest ad fraud to ever hit its mobile operating system</a> and the <a href="https://www.forbes.com/sites/thomasbrewster/2016/11/30/gooligan-android-malware-1m-google-account-breaches-check-point-finds/" target="_blank" rel="noopener noreferrer">most significant single theft of Google accounts</a> thanks to an Android malware called Gooligan.
Those alarming events were set off via networks of cybercriminals focused on the platform, where coders combine their technical skills with the will and financial backing of organized gangs. Sometimes, the latter group don&#8217;t even have to pay for the former&#8217;s digital tools. Sometimes, the technically-savvy types open their minds for free.
That&#8217;s just what a character calling himself Maza-In did just before last Christmas, when he or she posted an in-depth guide on the Exploit.in hacker forum for creating Android &#8220;bankers&#8221; &#8211; malware designed to steal bank login details from users of Google&#8217;s platform. The post not only included directions, but source code for a banker too. There was also a description of the required backend infrastructure, all of which combined could deliver realistic-looking bank pages designed to trick victims into handing over their usernames and passwords.
And now, Android security experts have <a href="http://blog.checkpoint.com/2017/05/16/the-mobile-banker-threat-from-end-to-end/" target="_blank" rel="noopener noreferrer">pinned</a> a spike in banking malware on Maza-In and that post. They claim that Maza-In, in one fell swoop, caused a sudden leap in Android banking fraud, as cybercriminals took that open sourced code and adapted it to spread both in and outside Google’s official Play store. According to an independent researcher going by the moniker <a href="http://b0n1.blogspot.co.uk/2017/05/tracking-android-bankbot.html" target="_blank" rel="noopener noreferrer">b0n1</a>, as many as 60 variants of malware containing the Maza-In banker have been pushed out into the wider world by hackers hoping to make some easy money.
<a href="http://www.forbesafrica.com/focus/2016/03/01/making-millions-paranoia/" target="_blank" rel="noopener noreferrer">Making Millions From Paranoia</a>
Check Point, which has been tracking the mini-explosion in Android bank fraud with ElevenPaths, a Telefónica security unit, told Forbes it had records of several dozen servers operating Maza-In&#8217;s malware, the largest of which controlled close to 3,000 bots. ElevenPaths said that, from Google Play alone, downloads of apps based on Maza-In&#8217;s code stood at above 10,000 and expected to rise, not to mention the number of downloads outside the store.
Those aren&#8217;t massive numbers. But what Maza-In and those who adapted his work for their own machinations have proven repeatedly are flaws in Google Play&#8217;s security, namely the Bouncer technology that&#8217;s supposed to keep bad apples out. Just two weeks ago, a sample of BankBot, based on Maza-In&#8217;s creation, was seen inside Google Play initially disguised as a video downloader tool. On June 13th, a very similar looking video downloader was up on the market; underneath was, again, a banker using Maza-In&#8217;s work. Going further back to April, a malware called Charger, which also borrowed heavily from Maza-In, was doing much the same, but masquerading as a flashlight app inside the official store, <a href="https://www.welivesecurity.com/2017/04/19/turn-light-give-passwords/" target="_blank" rel="noopener noreferrer">ESET reported</a>. All were removed from Google Play as soon as the tech giant was alerted, but not before thousands were infected.
&#8220;Before this Maza-In code, there were a lot of Android banking Trojans, for sure,&#8221; said ElevenPaths security researcher Sergio de los Santos. “But accessing the source code was not easy and this helps all kinds of people create variants and even get into Google Play. Giving a very simple and effective framework to create and manage your own banking Trojan opens the door to hundreds of profiles of attackers that want to get into business the easy way.
&#8220;Maza-in made it very simple to add different banks to attack, so you may see people from Latin America with their own samples focused on banks in there, UK people, Russians.&#8221;
A hacker responds
Maza-In says he is no cybercriminal, though. (As Maza-In uses a profile picture of Bob Marley, Forbes has chosen to refer to the hacker in the masculine). In an interview over encrypted chat, he said he only wanted to highlight weaknesses in Google’s operating system, not spawn a spike in Android cybercrime. He claimed, for instance, that despite security firms&#8217; claims he was behind the BankBot banker, another individual was responsible.
Yet he was aware of the criminal use of his code, revealing others, whether they&#8217;d given the malware additional features or not, were selling it for between $2,000 and $3,000 a pop on the web&#8217;s underground markets. &#8220;I did not expect it to work out that way, that it would spread so much,” he told me in Russian (translated by Google Translate).
&#8220;I did not write an article to harm people… I&#8217;m interested in studying the holey Android, since Google is not able to make a good operating system… by this I wanted to show the vulnerability of the Android and thought that Google would take care of security.&#8221; Unlike security pros who disclose bugs in return for credit or monetary reward, Maza-In said he didn&#8217;t contact Google.
<a href="http://www.forbesafrica.com/focus/2013/09/01/industrial-thief-line-can-rob/" target="_blank" rel="noopener noreferrer">Industrial Thief On The Line, How Can I Rob You?</a>
In describing just what he thought was wrong with Android security, he added: &#8220;The biggest problem is that the device can install any application, get full access to the device and can be substituted for fake banking applications [that can] intercept SMS [and] manage the device. In general, everything is possible.&#8221;
As for Check Point and ElevenPaths&#8217; assessment he was a malware creator supporting criminal operations, Maza-In said they&#8217;d exaggerated. He even claimed to be working on an Android anti-virus application.
But whilst analysts from both firms agree there&#8217;s no evidence he&#8217;s actively exploiting Android devices, they say it&#8217;s clear he is a malware creator who&#8217;s not followed best practise in highlighting security issues. &#8220;The blog contains explicit evidence that Maza-in is indeed behind the malware. He also boasted about his malware not being caught until January on one forum,&#8221; said Daniel Padon, mobile security researcher at Check Point. According to Lookout Mobile Security researcher Michael Flossman, Maza-In is just one handle used by a crew of Android fraudsters running all the aforementioned fraud malware.
&#8220;If you really want to show how unsecure Android is, you write an article about it, you code a proof of concept, you contact the right people to spread the word,&#8221; said de los Santos, explaining his disbelief at Maza-In&#8217;s claims to innocence.&#8221;But creating a Trojan? Oh, come on.&#8221;
Whatever the hacker&#8217;s involvement in the murkier parts of the internet, he and those who took advantage of his guide have given Google a headache. The company didn&#8217;t respond to requests for comment. But with the frequent appearances of these bankers on Google Play, it&#8217;s apparent the company has some work to do to keep ne&#8217;er-do-wells out of the market and users&#8217; Android devices. &#8211; Written by Thomas Fox-Brewster, FORBES STAFF

Tag: Cybersecurity

FORBES AFRICA SOCIAL MEDIA