Published by Malay Mail, Free Malaysia Today & New Straits Times, image from Malay Mail.
As we come to terms with the outbreak of coronavirus disease Covid-19, it would seem that a new normal is taking shape which might have a repercussion on the future landscape of the way we do things.
Here and now, working remotely is the new normal ― home-based learning is replacing the classroom education and video call is the main way for people to stay connected with families, friends and their workplaces.
Simply put, the internet has become an essential and indispensable global means of communication. However, there is a hidden threat arising in the digital space ― the risk of cyberattacks that prey on our increased reliance on digital tools.
Tech experts and security firms from all over the world are ringing alarm bells over the growing threat of the cybercriminals who are actively leveraging fake news, phishing scams and malicious malware under the coronavirus umbrella.
Data from Smart Protection Network shows that there are more than 900,000 threats across email, URL, and file from January to March 2020. The United States, Japan and Germany are the top three countries where users have inadvertently accessed malicious URLs with covid, covid-19, coronavirus or ncov in its strings.
According to the tech experts, these numbers of attacks so far have perhaps been the largest they’ve ever seen set around a single theme.
Alexander Urbelis, a cybersecurity researcher at Blackstone Law Group reported that a malicious site had been set up to mimic the World Health Organization (WHO) internal email system. The main purpose of this act was to steal passwords from multiple agency staffers to obtain sensitive information regarding the cures or vaccines relating to coronavirus.
Experts believe that the actors behind this attack seem more interested in gathering intelligence, rather than being financially motivated, as at time like this, such information would be priceless and become the priority of any intelligence organisation of an affected country.
Fortunately, the hackers were unsuccessful in their attack, but Flavio Aggio, WHO Chief Information Security Officer warned that hacking attempts against WHO and its partners have increased dramatically over the past months.
Moreover, while people are actively turning to digital means to track information about the outbreak, hackers have started to exploit on this situation by sending out emails that purport to offer health advice from reputable organisations such as governments and the WHO, but in reality, they are phishing attacks.
As people are hungry for up-to-date information about the virus and its spread, they are more likely to become so eager to click on any link that promises them such information, without knowing how dangerous it would be.
In brief, a phishing attack is an activity where cybercriminals imitate a genuine certified entity to steal sensitive information and install malevolent malware on the user’s computer that can cause damage.
And if your device were to crash as a result, you would no longer be able to use it for browsing or remote working. What’s worse, it might be very difficult to get it repaired because of the movement restrictions imposed due to the pandemic.
Luckily, there are some simple things you can do to spot and deal with phishing attacks. Most simply, you can check for obvious signs of fake or unofficial emails such as poor spelling, grammatical errors and punctuation, as most of these emails are generated from outside the country they are sent to.
Also, the National Cyber Security Agency (NACSA) has given some examples of the subject lines of phishing emails that cybercriminals use to fool people at this unprecedented time, so if you come across these subject lines below, do not fall into the trap.
― Re: Covid-19 update
― Covid-19 in the Workplace: The Malaysian Position
― Taklimat jangkitan Covid-19, Warga Awam Kementerian Pertahanan
Apart from phishing, one of the most recent scams that got updated under the coronavirus umbrella is known as sextortion scam emails. Previously, sextortion email was sent to potential victims and the scammers claimed that they have them (victims) recorded on video while they were browsing adult site.
But now, sextortion email is also sent as an attempt to extort money or get victims to do something against their will by threatening to infect the victim and their family with Covid-19, besides revealing all their “dirty secrets”.
The cybercriminals claim to know the passwords, whereabouts and daily routines of the victim. They further declare that they “ could even infect your whole family with the CoronaVirus ”. To stop them from doing so, they demand US$4,000 (RM17,239) in bitcoins.
According to experts, a sextortion email often begins with a subject line like “your password is ” followed by one of the victim’s passwords that the cybercriminal has actually gained from a data breach. Thus, do not panic yet as they are just trying to scare you into paying up.
Instead of being alarmed by such gratuitous threats, you should go ahead and mark such emails as spam as soon as you receive them, so your email service can automatically block them in the future before they can even land in your inbox.
Even though the cyber-attacks relating to Covid-19 are still new, the methods used to battle these issues remain the same. Individuals should all be encouraged to take the time to access the authenticity of all communication prior to following links, opening attachments or taking any action that could compromise the security of sensitive information.
Plus, as many companies adopt work-from-home policies in response to the Covid-19 pandemic, business leaders need to work with their security teams to identify the likely attack vectors and be particularly diligent when it comes to reminding the employees of information security issues and best practices.
Remember, if you are a human being who uses the internet ― you are a potential target for cybercrime or cyber-attacks. Indeed, in these bizarre times, when it comes to cybersecurity, it is worth stopping and asking yourself: “WHO ― can you actually trust?”.
All in all, while our health is now undoubtedly becoming our top priority, maintaining our resilience to cyber-attacks is also vital, to avoid unnecessary additional costs and disruptions when we can least afford them.
Nurafifah Mohammad Suhaimi is Research Assistant at EMIR Research, an independent think tank focused on strategic policy recommendations based on rigorous research.
