Story image

Cyber threat spotlight: Kiwis report more, lose less in Q2

19 Sep 2018

CERT NZ’s April-June 2018 Quarterly Report suggests that cyber threats – and the amount of people who are reporting them – are once again on the rise, and fewer people are losing money.

The report says that there were 736 incident reports in Q2, compared to 506 in Q1. While Kiwis lost $2.2 million from those incidents, it’s a 24% drop in just a single quarter, and 68% of incidents reporting money loss were for amounts lower than $500.

That doesn’t mean that New Zealanders should rest easy, as CERT NZ’s analysis of incident types found that phishing and credential harvesting is taking a toll on businesses and individuals. 

The number of phishing and credential harvesting reports skyrocketed from 196 in Q1 to 455 in Q2. Some of this can be attributed to CERT NZ’s close collaboration with the finance sector, which reported 74% of incidents.

The ever-persistent scam industry is still up to its old tricks – there were 104 reports of scam and fraud, of which most related to individuals. 

The report also found that those most likely to be impacted by direct financial loss are over 55 years of age, however those aged 35-44 also reported $77,300 in losses.

In addition, most reports about individuals came from those aged 65 and over (25%), while those aged 25-34 followed closely behind (21%).

Two incidents involved scam and fraud involved losses of $100,000 or more. They join two other incidents to make up 77% of all reported financial losses, totalling $1.7 million. The other two incidents of phishing and credential harvesting and unauthorised access.

While phishing and credential harvesting affected many organisations, vulnerabilities were also responsible for 69 incidents in organisations.

Those reported vulnerabilities include ones in websites or web servers (37 reports), authentication, authorisation and accounting (10 reports), networking (9 reports), and a number of others across software, applications, mobile devices, peripherals, and IoT devices.

“Of the 69 vulnerability reports received 1 January -30 June 2018, 54% related to website applications and servers, 14% to authentication, authorisation and accounting and 13% to networking,” the report says.

In one case a security researcher at ZX Security discovered vulnerabilities in cybersecurity products from global cybersecurity firm WatchGuard Technologies. WatchGuard, CERT NZ and the researcher worked together to analyse and verify the three vulnerabilities as part of a coordinated disclosure.

They released CVE identifiers as part of their findings and WatchGuard patched the vulnerabilities.

"By working together, potentially serious flaws in these products were able to be resolved in a timely and positive way, helping keep New Zealand businesses and organisations safe,” CERT NZ states.

Businesses and individuals can report cybersecurity incidents to CERT NZ. To do so, visit www.cert.govt.nz or call Freephone 0800 CERT NZ (0800 2378 69).

Security professionals want to return fire – Venafi
Seventy-two percent of professionals surveyed believe nation-states have the right to ‘hack back’ cybercriminals.
Alcatraz AI to replace corporate badges with AI security
The Palo Alto-based startup supposedly leverages facial recognition, 3D sensing, and machine learning to enable secure access control.
NZ ISPs issue open letter to social media giants to discuss censorship
Content sharing platforms have a duty of care to proactively monitor for harmful content, act expeditiously to remove content which is flagged to them as illegal.
Unencrypted Gearbest database leaves over 1.5mil shoppers’ records exposed
Depending on the countries and information requirements, the data could give hackers access to online government portals, banking apps, and health insurance records.
Bitdefender invests in A/NZ with new offices and regional director
Bitdefender has opened its Partner Advantage Network (PAN) programme with the aim of recruiting and supporting its over 500 local resellers.
Mozilla launches Firefox Send, an encrypted file transfer service
Mozille Firefox has launched a free encrypted file transfer service that allows people to securely share files from any web browser – not just Firefox.
Online attackers abusing Kiwis' generosity in wake of Chch tragedy
It doesn’t take some people long to abuse people’s kindness and generosity in a time of mourning.
Ransomware’s decline equals cryptomining’s rise
ESET’s Security Days Conference recently took place to go over the current threat environment and what to look out for next.