According to a new report from Europol published in November, criminals leverage artificial intelligence for malicious use. The document draws attention to the potential benefits of the technology, such as greater efficiency, automation and autonomy, but also warns of the growing risks that come with it. Cybercriminals have always been early adopters of the latest technology, and AI is no different.

The jointly developed new report from Europol, the United Nations Interregional Crime and Justice Research Institute (UNICRI) and Trend Micro, looks into current and predicted criminal uses of artificial intelligence (AI). The document provides law enforcers, policymakers and other organisations with information on existing and potential attacks leveraging AI and recommendations on how to mitigate these risks.

The report concludes that cybercriminals will leverage AI as an attack surface. Deepfakes are currently the best-known use of AI as an attack vector. However, the report warns that new screening technology will be needed in the future to mitigate the risk of disinformation campaigns and extortion, as well as threats that target AI data sets.

For example, AI could be used to support:

• Convincing social engineering attacks at scale.

• Document-scraping malware to make attacks more efficient.

• Evasion of image recognition and voice biometrics.

• Ransomware attacks, through intelligent targeting and evasion.

• Data pollution, by identifying blind spots in detection rules.

The paper also warns that AI systems are being developed to enhance the effectiveness of malware and to disrupt anti-malware and facial recognition systems.

To conclude the report, the three organisations make several recommendations:

• Harness the potential of AI technology as a crime-fighting tool to protect the cybersecurity industry and facilitate its policing.

• Continue research to stimulate the development of defensive technology.

• Promote and develop secure AI design frameworks.

• Leverage public-private partnerships and establish multidisciplinary expert groups.

_____

Aquest apunt en català / Esta entrada en español / Post en français

The coronavirus pandemic has forced criminal organisations in Latin America to make various internal changes. These adjustments stem from a desire to maintain their illicit operations despite the inconveniences: the trafficking of drugs and contraband, extortion and controlling the passage of migrants across borders. Their activities have been complicated by increased police checks and a lack of human activity.

As a result, organised crime gangs are having to move into previously unexplored territories, such as cybercrime or stealing medical supplies, for example. Some of the diverse dynamics being adopted by organised crime groups in Latin America are outlined below:

More social capital for criminals. Gangs such as MS13 and Barrio18 in El Salvador or the Jalisco cartel in Mexico, have created a situation whereby the criminals have supplanted the role of the State. The lockdown has afforded them a chance to consolidate control, win-over citizens and cultivate support.

The emergence of a new black market for medical equipment and medicines. Several countries on the continent already suffered from an active black market in medicines, and the pandemic has brought about an increase in thefts of medical supplies such as masks, hand sanitisers and even coronavirus detection kits.

The pandemic has exposed a severe lack of supply chain control in the medical field, which allows for products to be easily stolen.

More corruption. Healthcare systems have long been a target for corruption. Corrupt civil servants are taking advantage of the pandemic and using it as an opportunity to line their pockets.

More cybercrime. Criminals and hackers are taking advantage of increased online activity from citizens, businesses and government bodies. Brazil, Mexico and Colombia are the top three countries in Latin America for malware attacks.

In addition, organised crime groups are increasingly laundering money through cryptocurrency.

Less human trafficking. The tightening of border controls in response to the pandemic’s arrival in Latin America has forced organised crime gangs to scale back their activity in this field. Furthermore, the prices charged by the people smugglers, known as «coyotes», have increased as crossing the various borders has become more difficult. They’re unlikely to lower these charges in the short-term.

Less illicit drugs, higher Prices. Drugs gangs have had to contend with transportation restrictions and increased patrols to enforce quarantines. As many borders have been closed, and police are monitoring vehicles, traffickers are finding it harder to move their product.

The impact has even been felt in US cities, where drug prices have spiked.

Inicio

_____

Aquest apunt en català / Esta entrada en español / Post en français

The arrival of the coronavirus pandemic in the United Stated prompted increased sales of all types of arms, even leading to queues outside some shops.[1] Many of the buyers say they need to feel safe during the lockdown, which is forcing them to stay at home, sometimes alone. The demand for weapons has been largely non-specific. Customers want almost any type of weapon they can use to defend themselves; this in itself is unusual because, typically, people who buy arms have a specific kind of weapon in mind.

The first days of the pandemic in the US quickly led to cases of deaths by firearm involving suicides or issues related to the social distancing rules implemented to curb the coronavirus. In Detroit, for example, armed demonstrators protested against the stay-at-home order and the closure of gun shops.[2]

Faced with the need to decide which businesses could remain open, the vast majority of governors opted to categorise gun shops as suppliers of essential products, basic necessities, and as such, have been allowed to continue trading as usual.[3] Only five states categorised gun shops as non-essential businesses, forcing them to close as a result: New York, New Mexico, Washington, Massachusetts and Michigan. To comply with social distancing rules, federally-licensed vendors can even sell guns on the street or to customers in their cars. It is worth noting that in Virginia, while not forcing gun stores to close due to lockdown, they have recently passed a law limiting the sale and possession of firearms.[4]

The National Rifle Association, which has been in dire financial straits for some time due to costly internal battles, among other things, and laid off staff immediately before the pandemic arrived is actively fighting the governors who have forced gun shops to close. It has even gone as far as to sue, as a minimum, the governors of New Mexico and Massachusetts.

Research on the subject is unequivocal:

• People are more likely to sustain injuries after threatening the attackers with a gun than if they call the police or run away.
• Having a firearm in the home increases the chance that members of that household will be injured or killed.
• Only one in every 40 firearm homicides are a legitimate act of self-defence.
• The more firearms in circulation, the more accidental shootings and homicides.

As a result, it seems evident that the increased number of weapons in homes during the lockdown increases the chance of domestic conflicts becoming life-threatening situations. As journalist Melinda Wenner Moyer concludes in a recently published article: “The more guns we have, and the closer we keep them to us, the more danger we will be in during this pandemic”.[5] By contrast, in a country where public opinion considers the possession of a weapon a fundamental right, guaranteed by the second amendment of the Constitution, only a few governors have dared to face the uproar that can be caused by the closure of gun shops.

[1] https://www.thetrace.org/2020/04/the-coronavirus-has-gun-sales-soaring-his-fear-is-selling-to-the-wrong-person/

[2] https://www.thetrace.org/rounds/daily-bulletin-armed-protesters-stay-at-home-order-michigan/

[3] https://www.thetrace.org/2020/03/coronavirus-gun-store-closures-state-map/

[4] https://www.thetrace.org/2020/01/virginia-lawmakers-advance-historic-gun-reform-package-heres-what-it-means/

[5] https://www.thetrace.org/2020/04/gun-safety-research-coronavirus-gun-sales/

_____

Aquest apunt en català / Esta entrada en español / Post en français

Ransomware attacks targeting network-attached storage devices (NAS) have exponentially increased in recent months.

NAS systems, available for business purposes and home setup, are devices connected to a network to provide centralised storage capacity and backup data.

The number of ransomware strains targeting NAS and backup storage devices is growing, with users as yet still unprepared for the threat.

Ransomware has many different guises. The malware variant is popular with cybercriminals who use it to attack businesses, critical services – including hospitals and utilities – and individuals.

Once deployed on a system, the malware will usually encrypt files or full drives, issue its victim with a ransom note, and demand payment in return for a way to decrypt and restore access to the locked content.

There’s no guarantee that paying will result in decryption, but many will do so rather than lose their files; and when critical systems such as those at government bodies or healthcare providers are locked, there’s additional pressure to return to normal operations as quickly as possible.

The average consumer will often come across ransomware deployed through phishing campaigns and fraudulent messages or bundled within illegitimate or compromised software. However, researchers say that network-attached storage devices (NAS) are now also under direct threat from malware operators.

The devices may be accessed directly through a network or may have a web interface. The problem is that user authentication can sometimes be bypassed due to integrated software in NAS systems that have vulnerabilities.

To begin an attack chain, operators will first scan a range of IP addresses to locate internet-accessible NAS devices. Next, they will attempt to exploit its vulnerabilities and, if successful, deploy Trojans and begin encrypting the data of all the devices connected to the NAS unit.

Researchers cite WannaCry as the most popular type of ransomware used by cybercriminals, followed by Phny and Gandcrypt.

https://www.ooda.com/

_____

Aquest apunt en català / Esta entrada en español / Post en français

With the end-of-year 2019 Black Friday and Cyber Monday sales behind us, the company Adobe Digital Insights analyses the, yet again, record-breaking numbers of online transactions. North American consumers alone spent 7.5 billion dollars online on Black Friday. The figures for Cyber Monday are even higher, accounting for nearly 30 billion dollars of consumer spending.

Yet, amidst all the Christmas-shopping enthusiasm, some of the deals seem too good to be true. An email promotion, for example, was offering 80% discounts on designer sunglasses. An offer like that can be hard to refuse, and purchase required just a simple click on the link. But it was all just a scam. The email address, the website, the links; they were all fake. And that’s just one of many. This type of fraud is now so commonplace that experts advise against clicking on any links promoted by emails altogether.

In a new report, published on the 26th of November 2019, investigators from leading cybersecurity firm Check Point warned of the growing risk of cybercrime during the Christmas period and concluded that changes must be made to the way we shop online.

According to their research, November 2018 saw a significant increase in phishing emails. A year later, the situation is notably worse. When Check Point compiled their report in mid-November 2019, even prior to the peak shopping dates of Black Friday and Cyber Monday, the amount of e-commerce related phishing websites had more than doubled, by up to 233%. A week after the Christmas holidays, that figure had increased to 275%. It should be pointed out that 2018 saw a tremendous increase in phishing emails during the Christmas period, but in 2019, there were almost three times as many.

The total 2019 Christmas shopping spending for the United States amounted to 144 billion dollars, a 14% increase on the 2018 figure. And this sizeable spend took place between the end of November and the Christmas holidays. Of this figure, some 30 billion dollars were spent on Cyber Monday. And this is why Cyber Monday presents an almost unmissable opportunity for cybercriminals.

Investigators warn of how easy it is to disguise scams in bogus emails, text messages and social media posts. In this context, adds Check Point, it’s incredibly easy to obtain credit card details or take payment through PayPal without ever sending the supposedly purchased goods. The first step is to lure consumers by creating a domain that plausibly impersonates a legitimate shopping site. Many appear to be secure HTTPS addresses, and they load a long URL with legitimate text.

Some fraudulent campaigns are sent out to thousands of potential consumers through infected computers which act like bots, sending emails from diverse global locations to evade spam filters. Investigators noted that during the last six months of 2019 alone, more than 1,700 domains which look similar to the official Amazon website were registered.

Relevant links:

https://www.ooda.com/

_____

Aquest apunt en català / Esta entrada en español / Post en français

In October 2019, more than 400 experts from law enforcement, the private sector, and academia gathered at Europol’s headquarters in The Hague, to discuss “Law enforcement in a connected future”.

The 7th Europol-INTERPOL Cybercrime Conference looked at ways of efficiently combining the expertise, resources, and insights of law enforcement, the private sector, and the academic world to make the internet a safer environment, especially in a society which is becoming increasingly dependent on digital capabilities.

Key themes discussed included:

The benefits and challenges of Artificial Intelligence for the police; the potential impact of 5G technology; cross-border access to electronic evidence; obstacles to international cooperation in cybercrime investigations; the importance of cyber capacity building; cryptocurrency trends and challenges; the use of open-source intelligence and privacy considerations.

The meetings highlighted the fact that cybercriminals are becoming increasingly audacious, moving their focus to more widespread and elaborate attacks on more substantial and more profitable targets, with ominous potential for causing more damage.

This year’s conference saw 100 organisations and more than 70 different law-enforcement agencies participate in solution-orientated debates on how to collectively tackle the practical challenges at hand.

The conclusions emphasised the need for even closer cooperation in the areas of:

• Business email compromise (BEC): while BEC continues to evolve, it continues to cause economic damage, taking advantage of segregated corporate structures and internal gaps in payment verification processes.
• The dark web: as the dark web evolves, it becomes a threat in its own right and not just a platform for the sale of illegal products such as drugs, firearms, or compromised data.
• Research and development: technology is developing at an ever-increasing pace, creating new challenges and opportunities for law enforcement. This is compounded by the data-volume challenge, legal challenges, and a constantly expanding threat surface.
• Innovation: The incorporation of innovation, as part of an effective response to crime, is not exclusively a matter for the private sector.

The conference made clear that the world of cybercrime is agile and adapting, connecting and cooperating in ways we could never have imagined just a few years ago. Law enforcement must, therefore, adapt to this ever-changing criminal environment to protect society in the cyber domain.

_____

Aquest apunt en català / Esta entrada en español / Post en français

 

Among today’s many technological advancements, 5G (fifth-generation wireless network) is among the ones that will have the most impact on citizens. It offers two significant improvements in data transmission: more volume and more speed. These enhancements to the current network could have a significant effect on both the public and private sectors.

The issue of cybersecurity is one of the challenges facing 5G deployment, and the European Union wants its institutions to be instrumental in dealing with the problem. In March 2019, the European Council and the European Commission presented a series of recommendations outlining the steps and measures to be taken, both at a national and European level, to achieve the necessary high levels of 5G cybersecurity throughout the European Union.

One of the European-level measures was the issue of the Threat Landscape Report to assist member states with their national risk assessments. In October 2019, this was complemented by the publication of the EU coordinated risk assessment of the cybersecurity of 5G networks report. The report was compiled from information provided by Member States and from ENISA (the European Union Agency for Cybersecurity). Its risk assessment outlines the principal threats and threat actors, the assets that could be at risk from those threats, vulnerabilities, risk scenarios, and a set of existing security measures that could be used as a baseline for mitigating those risks and threats.

With regard to principal threats, the scenarios which pose the greatest danger are:

• Local or global 5G network disruption affecting the availability of the network;
• Spying of traffic or data in the 5G network infrastructure with implications for confidentiality;
• The modification or re-routing of traffic or data in the 5G network infrastructure, which could affect the integrity or confidentiality of communications; and
• The destruction or alteration of other digital infrastructures or information systems through the 5G network, which could affect the integrity or availability of services.

These threats, which already exist for the current network, become more significant with 5G because it increases their potential intensity and impact.

Among the conclusions drawn in the document, four are highlighted:

• The technological changes introduced by 5G will bring about enhanced functionality at the edge of the network, a less centralised architecture, and an increase in the use of software as part of the 5G equipment. These factors will increase the overall attack surface and the number of potential entry points for attackers.
• The new technological features of 5G will lead mobile network operators to rely more on third-party suppliers, which, in turn, will increase the number of system attack paths.
• Any dependency on a single supplier increases the exposure to and consequences of potential supply incidences.
• 5G networks will play an important role in the supply chain of critical network applications. This will impact the confidentiality, privacy, integrity, and availability of those networks, becoming one of the major national-security concerns and most significant security challenges from an EU perspective.

It should be noted that the Catalan Government has made the deployment of 5G technology a priority for the country, and already has the infrastructure to run usage tests like the one undertaken by TV3 when broadcasting the National Day of Catalonia on the 11th of September 2019.

https://europa.eu/rapid/press-release_IP-19-1832_en.htm

_____

Aquest apunt en català / Esta entrada en español / Post en français

An emerging reality over recent years throughout Europe is the arrival of foreign minors (MENA). These are foreign minors under the age of eighteen who are nationals of a non-EU state who arrive in European territory without a responsible adult or who abandon them once they are here.

According to UNICEF, the countries with most arrivals of these youths in 2017 were: Italy (15,779), Spain (2,426) and Greece (1,458), and it is estimated that the total number of arrivals in European Union countries was 20,000 non-accompanied foreign minors.

The reason for this increase cannot be explained by one factor alone, as there is a synergy of factors that come into play when a minor ventures into a foreign country in an irregular way. The situations that tend to occur may be: an armed conflict in the country of origin, the hope of a better life, to help their families, because of the poverty they are subjected to in their country of origin, because of the discrimination they suffer, because they are victims of people trafficking or several other reasons.

Because of this increase in destitute youths, the European Union developed the following directives and regulations:

1. The directive regarding conditions of reception:it aims to guarantee better reception and more harmonised conditions all over the Union. It ensures that applicants have access to housing, food, clothes, healthcare, education and access to employment with certain conditions.
2. The Directive regarding asylum conditions: it establishes common procedures for all EU member states to concede and withdraw international protection.
3. The classification Directive: this establishes criteria to classify the status of the refugee, for subsidiary protection and defines the rights conceded to beneficiaries of these conditions. This directive allows member states to apply or maintain more favourable standards than those established in their provisions.
4. The Asylum, Migration and Integration Fund (AMIF):  was constituted for the 2014-2020 period. It promotes the efficient management of migratory flows and the implementation, the reinforcement and development of a common Union focus on asylum and immigration.

The Dublin Regulation establishes that the member state is responsible for examining the asylum application. It guarantees quick access to asylum procedures and the in-depth examination of an application for a clearly determined particular state member.

Moreover, there still exists the action plan of the European Union regarding non-accompanied foreigners (2010-2014), an instrument of the European Commission that tries to establish the bases for action by establishing as a first priority the best interest of the minor.

The afore-mentioned regulations are neither homogeneous nor binding, meaning that they are neither specific nor obligatory to any state member of the European Union, as they involve recommendations that may or may not be complied with.

_____

Aquest apunt en català / Esta entrada en español / Post en français

Additive manufacturing (AM), otherwise known as 3D impression, is a kind of emerging technology with a security-related implication both locally and internationally.

According to RAND Corporations this type of invention would involve a threat in the near future in security issues, as in, for example, the proliferation of weapons and economic insecurity. These are some examples of how these impressions can threaten our security:

• Hackers can infiltrate the databases of large intelligence networks to steal weapon blueprints with all the associated implications. They can also interfere with real blueprints to cause defects to the product. As a result, there would be cybernetic sabotage with consequences affecting the physical world. To combat this, a computerised algorithm is being developed to detect any deviation during the impression process of the end product.
• This could result in new criminals and new threats. In the United States a new weapon has already been created, the so-called Rapid Additively Manufactured Ballistics Ordenanceo RAMBO, which fires grenades already made with a 3D impression. Analysts fear that terrorist groups could get hold of these types of technology and apply them to drones and explosives. With such resources, organisation and enough time attackers can get a 3D impresser, put it in a safe place and begin to manufacture all kinds of weapons. Moreover, it will be much more difficult to track down terrorist groups. However, according to RAND investigators, the weapons are not the only threat, as there is also the production and distribution of drugs, perceived as personalised chemical impressions.
• There may be new game rules in international relations. This would be the case of economic sanctions and embargos, which would be less effective, meaning that, if a state can print whatever it wants, the objective of the sanction is somewhat useless.“ 3D impressions could indirectly support the existence of states like North Korea, which would not suffer sanctions imposed by the international community”- RAND investigators.

In any case, 3D impressions not only pose a threat, as their creation also has positive effects. For example, 3D impressions can cover real needs in ways unknown to us until now. There is the case of an earthquake in a town in Nepal, where the natural disaster destroyed a pipeline supplying the town with water. A 3D impression made it possible to reconstruct it and the extent of the disaster was reduced.

Sources of interest:

https://www.rand.org/pubs/perspectives/PE283.html

https://www.rand.org/blog/articles/2018/05/four-ways-3d-printing-may-threaten-security.html

https://www.vox.com/2018/7/31/17634558/3d-printed-guns-trump-cody-wilson-defcad

_____

Aquest apunt en català / Esta entrada en español / Post en français