IndiaThink

Indian Hackers Join the Pump & Dump Phenomena

US News issued its top 5 computer crime report a few days back listing a group in India as number one.  Looks like the pump and dump scheme has caught on inside the "Incredible" Continent. 

For those of you without daily insight into the ways and means of computer hackers this scam is ever more popular and usually results in intense confusion for the consumer that is targeted.  One client of mine was using an un-named online brokerage account to manager her stocks and bank accounts.  She checked her account one afternoon to find lots of cash, over $50,000 missing that was used to purchase penny shares.  These shares were quickly "dumped" after being "pumped" by hackers buying the stock across hundreds of accounts, unknown to these account owners of course.

But here in lies the problem---the client called her brokerage who then changed her password thinking as customer service folks usually do, that this would resolve the problem.  Next day same thing happens again.  Password is reset again.  Account is hacked again.  What is she didn't realize, and of course the bank failed to consider this as well, was that a trojan was living on her machine stealing her passwords and sending them back to the hacker.  Guess what?  New password were transported immediately.  How did she find this out?  After loosing over $100K and having her bank refuse to refund her the money she called my company for help who immediately --- like within about 2 hours -- determine the problem.

The moral of this story is watch your online accounts, don't download questionable files, and consider using a bank that offers intense password security such as etrade who offers a securID key. 

Security Articles: CSI Presentation

As promised, here are the links to all security incidents mentioned during my talk today at CSI.  GREAT audience this afternoon, I really enjoyed speaking to all of you!

As I mentioned, there is some fierce security inside the call centers in India.  This article talks about the strength of physical security.  I continue to be puzzled about how people continue to walk out with data when these measures are in place...

 

SECURITY INCIDENTS:

1. MsourceE (owner of MphasiS) outsourcer for Citibank Heist

Criminals move $350,000 moved from US Citibank Customers accounts to local accounts in India.  Actions performed by former employees (five were charged) who likely memorized account numbers. Citibank is reporting a loss of $425,000 or 17.5 million rupees. 

2. HSBC Electronic Data Processing India Pvt Ltd

Employee sold identities to third party who used them to conduct fraudulent transactions through ATM and telephone banking services. Reported loss was £2.3 million ($4.3 million) and was found after over 20 customers complained of financial loss from accounts.

3. V-Angles British Telecom Data Loss

V-Angels reported theft of “extremely confidential and critical” British telecom data. Data stolen by ex-employee who sold the information to another party.

4. Indian subsidiary of US-based Parsec Technologies

USFour employees of Parsec Technologies arrested for stealing leads for refinancing mortgages from Parsec and selling the information other to call centers in India.  Loss reported in as 30 million rupees (known as 2 crore) or $681,813 US.  SANS covered this story--forcing it into the eyes of may security professionals.

 

 

India Data: Global State of Information Security Survey in CIO Magazine

CIO Magazine presented data from their annual Global State of Information Security in their September edition.  There is a section that focuses only on security in India which sounds the alarm bells for information security leaders in the US who already loose sleep at night over their data being lost through an open door in India. 

I can't say it any better than the article so I am re-posting the paragraph that everyone with an India outsourcing relationship should steer to:

"The widespread absence of even the most routine security tools (patch management, content filters and access control software) and policies (secure disposal of hardware, business continuity plans, setting security baselines for outside business partners) has left many Indian companies vulnerable to serious attack and the inevitable financial losses that follow. Extortion, fraud and intellectual property theft occurred last year at one in every five or six Indian companies—rates that are double and even quadruple those of the rest of the world. Nearly one in three Indian organizations suffered some financial loss because of a cyber­attack last year, compared with one out of five worldwide and one out of eight in the United States. "You cannot take information security for granted in India," PwC's Lobel warns."

To repeat:

• 1 in 5 to 6 companies were victims of extortion, fraud, and IP theft

• 1 in 3 suffered financial data loss through online attacks

I encourage readers to look over the articles I have begun to collect in the security category.  These reports are hard to find so there are few posted.  The crimes that are prevelant relate to selling customer data to buyers for a variety of strange reasons.  Motivations and marketplaces differences should be considered when devising a way to tackle your Indian relationship with a data protection plan.

Why US companies should start paying attention to security concerns in India.

Yet another example of an Indian national stealing data from the numerous identity depositories accessible to call center staff. This article is confusing as it does not say where he stole the data from only mentioning the he indicated to undercover officers that he could and in addition could ask his friends to help if additional data was needed.

Additional digging shines light on the origin of these accusations-apparently they were made through an undercover investigation via Channel 4 in the UK.
Generate your own opinions on this piece with the knowledge that the Indian media is similar in many ways to the British demonstrated here with the tinge of sarcasm.

One of the items that is confusing to me—and I would LOVE to get an explanation from anyone out there who has one is this idea that “new call centers” starting up need names. This is not the first time I have run across this theme as a way that crooks are snagged. Is there this notion that a thriving business is precipitated by a viable call list?