Scale & complexity of cyber crime rose significantly in 2017, says NCA
16 May 2018
The National Crime Agency (NCA) recently released its report on serious and organised crime in the UK, noting that cyber crime continued to rise in scale and complexity in 2017, resulting in a significant expansion in the visibility of cyber crime.
The agency noted that cyber crime groups, both domestic and those based in other countries, have continued to mature and are using sophisticated malware variants to launch damaging attacks on the UK’s industries. It added that attribution of cyber attacks are becoming increasingly difficult as the distinction between nation states and criminal groups is becoming frequently more blurred.
Poor response to cyber crime
The NCA lamented that the cyber criminals have not been effectively thwarted from carrying out fresh attacks not only because a lot of cyber crimes go unreported, but also because convictions of criminals are not sufficient to deter them.
It noted that 62 percent of Brits did not have confidence in the law enforcement response to cyber-dependant crime and the level of sentences awarded by the courts did not necessarily reflect the seriousness required to fight cyber crime. “As many convictions are under the Fraud Act rather than the CMA (Computer Misuse Act), this compounds the problem and furthers the perception of ‘cyber crime without consequence’,” it said.
Rising profile of cyber crime
In November last year, UK Chief Constable Peter Goldman said that cyber crime was the “fastest-growing, most complex, difficult form of volume crime we’ve ever seen,” and that personal details of almost every Briton were being sold on the Dark Web.
“I can almost guarantee that every single one of you around this table has had a data breach against you and that some of your personal data is held somewhere on the dark web and is being sold, traded—are you happy with that? And you probably don’t know about it,” said Goldman while addressing a media briefing.
Goldman also bemoaned the fact that most citizens found out that they were hacked only after checking certain websites that contained details of breached accounts. This is because a large number of businesses have not been transparent in disclosing incidents of data breach and the impact of each incident.
Earlier this year, in its Global Risk Report for 2018, the World Economic Forum also ranked cyber crime as among the top three risks the world will face this year in terms of likelihood.
“Attacks against businesses have almost doubled in five years, and incidents that would once have been considered extraordinary are becoming more and more commonplace. The financial impact of cybersecurity breaches is rising, and some of the largest costs in 2017 related to ransomware attacks, which accounted for 64% of all malicious emails,’ the World Economic Forum noted.
Changing tactics of cyber criminals
In order to increase the effectiveness of their attacks, cyber criminals have started targeting businesses over individuals, especially those in the supply chain, either by hijacking third-party software, infiltrating malicious code into enterprise systems or by compromising third-party suppliers whose defences are not as strong as those of their clients, said the NCA.
At the same time, cyber criminals are finding new ways to launch cyber attacks against targeted entities as they can easily access methodologies of deploying cyber tools on forums, even though they have limited knowledge and have low-level technology to begin with. In many cases, cyber criminals are driven not by financial reward, but by the acquisition of reputational kudos amongst their peers.
The NCA also touched on how cyber criminals have been using techniques such as network intrusions, ransomware attacks, DDoS attacks, using exploit kits, botnets, social enginnering, spamming and phishing attacks to target individuals and enterprises.
“The majority of cyber crime continues to be undertaken for financial gain and in these cases the ability to cash out forms a critical aspect of the criminal business model. We have identified money exchange services (that operate similarly to PayPal) that facilitate predominantly criminal-to-criminal payments. Whilst not explicitly criminal, they often additionally promise greater anonymity and an unwillingness to cooperate with law enforcement,” it said.
Even though the awareness and preparedness of organisations for GDPR has been found to be limited, the NCA expressed hope that the upcoming regulation would help in tackling cyber crime and to get a true picture of the scale and regularity of data breaches.
“The threat of crime to businesses and people is growing and dark web platforms like Tor and the Invisible Internet Project offer criminals a way to evade law enforcement and commoditise cybercrime and other activities, like the sale of guns and drugs,” said Gregory Webb, CEO of Bromium.
“This platform criminality model is productising cyber threats and making cybercrime as easy as shopping online. Not only is it easy to access cybercriminal tools, services and expertise: it means enterprises and governments alike are going to see more sophisticated, costly and disruptive attacks.
“It is equally easy for them to wash that money and convert it into cash – and the rise in the use of unregulated, virtual currencies is making this even easier. We can’t solve this problem using old thinking or outdated technology. By focusing on new methods of cybersecurity that protect rather than detect, we believe we can make cybercrime a lot harder, allowing organisations and the security industry to disrupt this web of profit,” he added.