Story image

Under the spotlight: CERT NZ reveals last year’s most pervasive cyber threats

29 Mar 18

New Zealanders from ‘all walks of life’ reported 1131 cybersecurity issues ranging from cryptocurrency scams to phishing in 2017, resulting in more than $5.3 million in losses.

CERT NZ is New Zealand’s national computer emergency response team. It launched in April 2017 and since then it has released quarterly reports that analyse what threats are affecting Kiwis.

From CERT NZ’s Q4 report, people reported $3.4 million in losses – a large chunk of the $5.3 million total over 2017.

While that $5.3 million loss figure may be daunting, it is not clear how much of the losses were recovered. There were nine incidents that involved losses of more than $100,000 each.

Other loss factors including data loss, operational impacts, reputational loss and technical damage.

“Cyber criminals are indiscriminate in their targeting and anyone online can be affected,” comments CERT NZ director, Rob Pope.

In Q4, 377 incidents were reported to CERT NZ, of which 144 involved cybercrime and were referred to the police.

139 incidents involved scams and fraud; 126 involved phishing and credential harvesting; 36 involved successful unauthorised access; and 29 involved malware.

The report notes that there was a notable uptick of cryptocurrency scams.

In Q4, 6% of reports involved cryptocurrency and the total financial loss was $262,323 – 8% of the total losses last quarter.

In one case study, a cryptocurrency investor reported a Bitcoin theft after falling for what appeared to be a phishing scam. CERT NZ says it’s unlike the investor will be able to recover the missing Bitcoin.

“Some of these scams are variations on existing ones, using simple phishing techniques to trick users into giving scammers their passwords and thereby access to their digital wallets. Others are more sophisticated, adapting cybercrime techniques to commit theft. Tracing and recovering stolen cryptocurrencies is very difficult due to the nature of the technology,” the report says.

There were also new twists on various other scams, including fake tech support scams, and fake investment websites.

Tech support scammers have cost Kiwis more than $90,000 in Q4. Scammers set up fake tech support websites and are now taking advantage of known brand names including Google, Xero, Samsung, and Dell.

“They rely on users searching for a genuine product support website and instead finding the scammer’s fake support site. Users are typically asked to pay a fee to receive support, but no help is provided and the unlucky users are left out of pocket,” the report explains.

CERT NZ combined data from Q2, Q3 and Q4 2017 to provide a regional breakdown of where most threats were reported.

Overall, Wellington incident reports accounted for 230 of the 812 reports; followed by Auckland (221), Canterbury (62) and the Waikato (35). 106 reports did not provide a location.

“We use data to help New Zealanders stay safe from cyber security threats and we need people to lodge a report with CERT NZ to help us build a more detailed picture of the issues Kiwis are facing in their online lives. Anyone can report a cyber security incident to CERT NZ and get help to recover. Receiving these reports also means we can proactively help other New Zealanders who may be affected by the same issue,” Pope concludes.

If you or your organisation experiences a cyber security threat – or if you suspect you may have been exposed to one – contact CERT NZ any time at www.cert.govt.nz or call 0800 CERT NZ, Monday to Friday, 7am – 7pm.

IDC: Smartphone shipments ready to stabilise in 2019
IDC expects year-over-year shipment growth of 2.6% in 2019, while the world's largest market is still forecast to be down 8.8% in 2018.
52mil users affected by Google+’s second data breach
Google+ APIs will be shut down within the next 90 days, and the consumer platform will be disabled in April 2019 instead of August 2019 as originally planned.
New app conducts background checks on potential tenants
Landlords and house owners need to obtain a tenant’s full name, date of birth, email address, and mobile number in order to conduct the search. And most importantly, they have to get the tenant’s permission first.
GirlBoss wins 2018 YES Emerging Alumni of the Year Award
The people have spoken – GirlBoss CEO and founder Alexia Hilbertidou has been crowned this year’s Young Enterprise Scheme (YES) Emerging Alumni of the Year.
IDC: Standalone VR headset shipments grow 428.6% in 3Q18
The VR headset market returned to growth in 3Q18 after four consecutive quarters of decline and now makes up 97% of the combined market.
Meet Rentbot, the chatbot that can help with tenancy law
If you find yourself in a tricky situation  - or if you just want to understand your rights as a landlord or tenant, you can now turn to a chatbot for help.
PlayerUnknown’s Battlegrounds (PUBG) finally releases on PS4
PUBG on PS4 feels like it’s still in Early Access as the graphics look horribly outdated and the game runs poorly too. 
How AI can fundamentally change the business landscape
“This is an extremely interesting if not pivotal time to discuss how AI is being deployed and leveraged, both in business and at home.”