According to statistics from the Central Bank of Russia, in 2017, 317.7 thousand users lost 961 million rubles on the Internet due to fraudsters. Moreover, in 97% of cases, victims of fraud did not apply to law enforcement agencies. And we are talking about incidents that were reported to the bank.
Let's analyze the common ways that attackers use to steal money on social networks. And so that you do not get into the network of scammers, we will give tips on how to protect yourself from cybercriminals.
1. Hacking account
Obtaining data to enter the account allows fraudsters to seize confidential information and deceive the user's friends. To do this, scammers use a whole arsenal of tricks:
virus infection on a computer or mobile gadget;
hacking databases of other sites and matching passwords;
brute force common passwords.
Virus infection occurs most often when receiving emails with attachments from unknown recipients or downloading files from free file hosting services. The viruses are aimed at scanning browser folders in search of unencrypted passwords, as well as tracking what the user enters from the keyboard. For example, Android.BankBot.358.origin is aimed at Sberbank customers and steals login data for a mobile application. The TrickBot Trojan is also looking for data to enter bank accounts, as well as cryptocurrency exchanges. The Fauxpersky keylogger masquerades as Kaspersky Lab products and collects everything the user types on the keyboard.
The information gathered by viruses is sent to attackers. Usually the virus generates a text file and connects to the mail service specified in the settings. Then he attaches the file to the email and sends it to the scammers.
Users use the same password for all sites (online stores, social networks, mail servers) in order not to keep unique passwords for each account in their heads and not to store on computers. Attackers attack less secure sites: directories, online stores, forums. A whole team of IT specialists responsible for cybersecurity is working on social networks. And online stores and forums run on CMS, in which scammers periodically find vulnerabilities for data theft.
Hackers copy a user database, which usually contains nicknames, email addresses and login passwords. Despite the fact that passwords are stored in an encrypted form, they can be decrypted, as most sites use the 128-bit MD5 hashing algorithm. It is decrypted using desktop software or online services. For example, the MD5 Decrypt service contains a database of 6 billion decrypted words. After decryption, passwords are checked for the possibility of accessing mail services and social networks. Using mail, you can restore the password on the social network if you could not pick it up.
Searching passwords is becoming less and less relevant every year. Its essence lies in the methodical verification of common combinations of letters and numbers in passwords for entering a social network account. Fraudsters use proxy servers and VPNs that hide the IP address of the computer so that they are not detected by the social network. However, social networks themselves protect users, for example, by introducing captcha.
How to protect yourself
To fight viruses, you must follow the basic rules of computer security:
- Do not download files from unfamiliar sources, since viruses can be disguised, for example, as a presentation file;
- Do not open attachments in letters from unfamiliar senders;
- install antivirus (Avast, NOD32, Kaspersky or Dr.Web);
- set two-factor authorization on sites that have this option;
- when accessing the service from someone else’s device, check the corresponding field in the authorization field;
- Do not use the browser’s ability to remember passwords.
The user should not use the same password for social networks, mail services, online stores and bank accounts. You can diversify passwords by adding service designators to their end. For example, 12345mail is suitable for mail, 12345shop for purchases, 12345socialnet for social networks.
2. Extortion and blackmail
Attackers deliberately hack accounts on social networks in order to obtain confidential data, then they blackmail the victim and extort money. For example, when it comes to intimate photos sent to a partner.
There is nothing criminal in the photos themselves. Attackers blackmail the user by sending the received pictures to relatives and friends. During communication, psychological pressure is used and attempts to cause guilt in the expectation that the victim will send money.
Even if the victim sent the money, there is no guarantee that the attackers will not decide to ask for "ransom" for the photos again or simply post pictures for fun.
How to protect yourself
Use services that allow you to send self-destructing or encrypted messages to Telegram or Snapchat. Or agree with a partner not to save the pictures, but to delete them immediately after viewing.
Do not go from other people's devices to mail and social networks. If you forget to get out of them, there is a risk that your correspondence will be in the wrong hands.
Fans of preserving confidential data are advised to encrypt folders using special software, for example, using Encrypting File System (EFS) technology.
3. Prizes, inheritance and free items
Fraudsters offer to get an expensive thing for free, provided that you pay for the shipment to your address or insurance for the shipment. You may come across a similar offer, for example, in the “Free” group of your city. As a reason, they can indicate an urgent move or receive the same thing as a gift. Quite often, expensive things are used as “bait”: iPhone, iPad, Xbox, and the like. To pay for shipping costs, scammers ask for the amount with which the user is comfortable to leave - up to 10,000 rubles.
Fraudsters can not only offer free things, but also products with a very low price tag, for example iPhone X for 5,000 rubles. Thus, they want to steal money or card data using a fake payment gateway form. Fraudsters disguise a card payment page as a page of a popular payment gateway.
Attackers can pretend to be employees of a bank or a notary agency, asking for help in cashing funds from an account or money received by inheritance. To do this, they will ask you to transfer a small amount to establish a current account.
Also, for registration of the prize can send a link leading to a phishing site.
How to protect yourself
Do not believe in "free cheese." Just ignore such requests or complain using the built-in tools of the social network. To do this, go to the account page, click on the "Report user" button and write a reason for contacting. The service of moderators of the social network will review the information.
Do not click on unfamiliar links, especially if they are done using the link reduction services goo.gl, bit.ly and others. However, you can decrypt the link using the UnTinyURL service.
Suppose you received a message on a social network about a profitable sale of a phone or tablet. Do not believe in luck and immediately pay for the purchase. If you went to the page with the payment gateway form , carefully check the domain is correct and mention the PCI DSS standard. You can check the correctness of the payment form at the technical support of the payment gateway. To do this, just contact her by email. For example, on the sites of payment providers PayOnline and Fondy, email addresses of customer support services are indicated.
4. "Throw a hundred"
Fraudsters use the hacked page to ask friends and acquaintances of the victim to transfer money to the account. Now not only requests for transfers are sent, but also photographs of bank cards, on which the name and surname of the owner of the hacked account are applied using a graphical editor.
As a rule, attackers ask to transfer money urgently, because they are afraid of losing control of the account. Often, requests contain elements of psychological pressure and a constant reminder that everything needs to be done urgently. Fraudsters can study the history of communication in advance and even use calls known to you by name or nickname.
How to protect yourself
Call a friend and ask directly if he needs money. So you will be convinced of the veracity of the request and immediately be able to warn about breaking the page.
If you know well the person whose account was hacked, pay attention to the manner of speech. The attacker, most likely, will not have time to completely copy his communication style and will use speech patterns unusual for him.
Pay attention to the photo of the bank card. You can calculate the fake by poor-quality processing in a graphical editor: the letters will “jump”, the initials will not be on the same line with the date of the card’s validity, and sometimes they will even fit on the card’s validity period.
Survive on social networks
From December 2014 to December 2016, the number of attacks on users using social engineering increased 11 times. 37.6% of attacks were aimed at stealing personal data, including information about bank cards.
According to a ZeroFOX study, Facebook accounted for 41.2% of attacks, on Google+ - 21.6%, on Twitter - 19.7%. The social network VKontakte was not taken into account in the study.
Experts identify 7 popular scam tactics on social networks:
- Fake page verification. Fraudsters on behalf of a social network offer to get the coveted checkmark of the “verified” page. The address of a specially prepared page for data theft is sent to the victims.
- Distribute fake links using targeted advertising. Attackers create an advertisement to attract low prices to users' pages and to sell counterfeit goods.
- Imitation of the support service of famous brands. Attackers disguise themselves as technical support services for large brands and receive confidential information from their customers.
- Use of old accounts. Attackers can use old accounts by changing their settings in order to bypass control from social networks.
- Fake pages of online stores and brands. Attackers fake online community store pages and lead users to phishing pages for authorization by stealing login details or selling counterfeit goods.
- Fake promotions. To participate in the action, attackers can ask for an email or photo supposedly for participation, which can later be used in illegal actions.
- Financial fraud. Attackers offer inflated income in a short period, simply stealing money from unsuspecting users.
- Fake pages of HR companies. Some scammers imitate the official style of large companies and require payment for considering an application for employment.
There is only one way to protect yourself from social engineering - knowledge. Therefore, you need to learn the rules of computer security well and not believe too generous offers.