Posts tagged Cyber Security
When I first spoke about Deliveroo scams for BBC Watchdog in 2016, I had hoped the fast food delivery service would have taken away some tips on how to keep its customers’ accounts safe from fraudsters.
Yet here we are in 2019 and once again I’m investigating – this time for The One Show – why Deliveroo can’t seem to be able to keep its customers’ accounts secure.
Three years on and it seems little has changed at Deliveroo HQ.
Desperate Deliveroo customers are still finding orders being placed without their consent and delivered to addresses they know nothing about. Victims are still discovering that their email address is being changed, passwords updated, payment details changed, refunds issued – and even their name changed – without any apparent verification or controls.
Deliveroo vehemently denies that its own systems have been hacked. Instead it deflects responsibility back to its customers, admonishing them for reusing passwords across multiple online services.
Deliveroo: You Get Stuffed
Deliveroo claims that criminals are using “credential stuffing” attacks to take over customer accounts. It says usernames and passwords leaked from other online services are used to try and log in to Deliveroo accounts. Because many of us use the same passwords for multiple services, this can be a fruitful method of attack for criminals looking to hijack others’ accounts.
In my opinion, this victim-blaming doesn’t let Deliveroo off the hook. Other online services also acknowledge that these kind of attacks take place – and take further sensible precautions to protect their users.
One method used by many online services to add an extra layer of security is two-factor authentication. With “2FA”, a text message containing a one-off security passcode is sent to the account owner’s smartphone. It works because even if a hacker has identified a potential victim’s username and password, it’s unlikely they will have access to their smartphone too.
Fixing Deliveroo’s Fraud Problem
At the time of writing, Deliveroo does not ask customers to validate updates made to their account. A change of email, new delivery address, payment details, even name – I mean, how often do you change your name? – go unchallenged by Deliveroo’s security systems. Yes, an email advising of a change is sent after the event, but by then it’s often too late for victims.
Adding an additional security step like this for significant or out-of-character account activities would, it seems to me, stem much of the fraud Deliveroo customers have been facing.
Deliveroo does say that it employs advanced machine learning technology to catch fraud. However, with its algorithms failing to identify seemingly bizarre patterns of behaviour, it appears that Deliveroo’s computer all too rarely says no.
During the investigation I discovered tutorials shared by hackers on how to break in to Deliveroo accounts – and other services such as Netflix, Spotify or Amazon Prime Video – many hidden online in plain sight. I saw the encrypted chat rooms where hijacked user accounts are bought, sold and requested in bulk.
I also found evidence of fraudulent Deliveroo shop-fronts that offer hefty discounts for ordering through them instead of directly with Deliveroo. These middle-men place orders on behalf of their clients using hijacked Deliveroo accounts, funded with victims’ details, stolen credit cards or refunded credit. They are paid a cut of the order value – typically 30 percent – using tough-to-trace cryptocurrencies.
On the surface, takeaway food crime may appear low-key – but there’s clearly more here than meets the eye.
My advice for Deliveroo customers is this:
- Use password manager software to create and store long, strong, unique passwords for your online accounts – including Deliveroo – that will be almost impossible for a hacker to guess. There is no such thing as infallible security, but in my opinion a password manager is the best choice you can make right now.
- For those accounts that support it – and there’s a long list of major online services do – enable two-factor authentication. Here’s hoping that, one day, Deliveroo joins that list.
Finally, and most important of all, if you don’t trust an online service to keep your account, your personal information or your payment details safe, then vote with your feet and use another service.
The weekly podcast takes a lighter look at the serious business of cyber security, and I appear to have been pigeon-holed as the show’s resident cyber-sex reporter. Oh well.
In last week’s episode I reported on AgeID, the latest attempt by a leading adult-content outlet to adhere to the UK’s upcoming age verification legislation which seeks to protect under-18s from accessing explicit online material.
We’ve never had so many people download an episode of the “Smashing Security” podcast as quickly as our latest one:
“Hijacked homes, porn passports, and ransomware regret”
— Graham Cluley (@gcluley) March 19, 2019
Clearly, there are a lot of challenges with this piece of law – practically, technically and morally – which is why the UK government has struggled with guidance and deadlines. At the time of writing, we’re still no clearer when the go-live date will be or how effective any block may prove.
Also in the episode we ask when it makes sense to pay off that ransomware fee, and uncover the ‘$150 million mansion hijack’.
Tap here to catch the full episode, or find it in your favourite podcast player.
I was back in the BBC Watchdog studio last night for an item on how Nectar card fraud has been leaving some viewers with a decidedly sour taste in their mouths.
Reports of fraudsters targeting the Nectar loyalty scheme aren’t new, but a recent spate of activity has brought it back to the top of the Watchdog mailbag.
Nectar began rewarding shoppers in 2002, and now around 20 million members collect and spend points at a variety of high-street and online retailers. In February this year, Nectar was bought by supermarket chain Sainsbury’s, which now also owns catalogue chain Argos.
In the fraud, Nectar points are redeemed – often in high street stores – to buy goods. The first victims know is when they try to spend their Nectar balance and find instead that their account is empty. So prolific are the fraudsters that, in some cases, victims have even found they‘be been left with a negative balance.
There are some patterns to the fraud:
- Victims are adamant that their physical Nectar card – which is required to redeem points for goods in store – hasn’t been stolen, mislaid or even in the same town as where the points were redeemed
- Argos appears to be a hot-spot for fraudsters redeeming Nectar points
How does Nectar card fraud work?
That is the million Nectar point question. On the surface, this is very straightforward:
Click to read on
The new series of Rip Off Britain – series nine! – began on BBC1 this month and once I am on-hand as its resident technology expert.
Earlier this week, I spoke with Angela about how high-tech car criminals are able to hack their way past current keyless security systems. I also shared a few tips that may help concerned viewers prevent their cars being stolen. Here’s a quick taster:
Car crime has largely moved on from the coat hanger and hot-wire days of old, with crime rates decreasing by 80 percent since 1993 according to the Office for National Statistics. However, a new wave of tech-savvy car criminals is now making easy work of making off with many makes of car.
I’ve been following the high-tech car crime trend closely, trying to understand the ways in which criminals are able to bypass or subvert car keyless security systems – whether through signal amplification, wireless jamming or keyless code capture. Criminals often steal to order, targeting high-value vehicles that are driven to so-called ‘chop-shops’ and sold on for parts.
Next week I travel to Glasgow for BBC Rip Off Britain Live. I find the live shows particularly enjoyable because we are able to be responsive to news stories as they break. As such, I can’t say yet exactly which stories I’ll be covering, but I believe we’ll be discussing how the Internet of Things has made our homes vulnerable to hackers.
I turned the internet’s air blue as I guested on this week’s Smashing Security podcast.
I’ve been listening to and enjoying the Smashing Security podcast since it began late last year.
So, I had no hesitation when Graham asked if I might appear as a guest on the show. I suspect he may hesitate before asking me again though…
Tasked with covering some of the week’s news, I quickly rounded on three sex stories:
- how the UK government plans to enforce age verification for sites serving adult content by April 2018
- how the owner of the Ashley Madison website has set aside $11 million to settle with disgruntled users following the 2015 data leak
- how one online adult service has introduced biometric authentication for male members
Needless to say, we covered the news with a professionalism befitting the material. Well, mostly. Hear for yourself:
To check out further episodes of the show, and to subscribe, visit the Smashing Security website.
In today’s Metro I investigate whether the CIA really can ‘hackcess all areas’. Plus, I ask if wearable tech has fallen from fashion. Hold on tight, it’s time to Connect…
Last week’s WikiLeaks document dump professes to reveal how the CIA has – with help from agencies including MI5 – been collecting and developing an arsenal of hacking tools, exploits and cyber skeleton keys to pick its way into the devices we use every day.
We shouldn’t be surprised. Covert surveillance is a tool widely used by intelligence agencies to maintain national security and counter terrorism.
But if the good guys can find a backdoor into our connected kit, surely the bad guys can too? Read on in the Metro e-edition…
The Apple Watch launched less than two years ago. I know this because on the day of the launch I confidently declared that ‘wearable tech is the next big thing’ on stage at the Gadget Show Live, enthusing about the upcoming Pebble Time smartwatch and the latest Jawbone and Fitbit gear.
How times change.
Less than two years on and the wearables phenomenon has failed to catch on, leading analysts to rein in their optimism.
Back to the Apple Watch.
Many – myself included – saw the launch of Apple’s highly-anticipated wearable as a watershed moment. Indeed it was, but rather than sparking a wearables revolution it had the opposite effect. ‘Oh, is that it?’, was the consensus.
However, as Bill Gates once quipped, we tend to over-estimate the impact of a technology in its first two years but underestimate its impact in ten. It might be in the depths of the trough of disillusionment but I can’t see anything other than wearable tech to playing a huge part in our future.
My feature on how to secure your Amazon Echo was published in TechRadar last week. Here is my take on why securing these intelligent home hubs is of vital importance.
Buttons are obsolete. Simply by conversing with my Alexa I can control my central heating and the lighting around my house and garden; I can buy products with my voice, check my personal calendar, set alarms or reminders, update my things to do list, read my favourite book or play any song, album or playlist on Spotify. With my voice.
Hear no Evil
The convenience this offers is staggering and, in a little over three months since I plugged it in and powered it on, my Amazon Echo has already changed many behaviours in our household. For the better? I think so. However…
With convenience comes compromise, especially when it comes to security. We should never be blinded by the utility of any new piece of technology.
I made one mistake in extolling the virtues of our Amazon Echo above. You see, all of these amazing things and more can be commanded not only with my voice, they can be asked by anybody’s voice.
Voice Recognition versus Speech Recognition
While Alexa has enviable speech recognition – the ability to understand and interpret natural language input by speech – she has yet to learn the skill of voice recognition. Often confused, voice recognition is the ability to uniquely distinguish between different people’s voices by analysing physical and behavioural characteristics.
With voice recognition Alexa would know whether it was me (ie authorised) ordering that Nintendo Switch console from Amazon Prime, or if it was my Mario Kart-loving daughter trying her luck (sorry, denied). Did I just ask Alexa for a 2am alarm call or was somebody outside my living room window attempting to play a prank?
Amazon has no plans to introduce voice recognition into the Amazon Echo just yet. Nevertheless, there are steps that Echo owners can take to make sure they enjoy the convenience of a virtual assistant without the worry of being woken up by a 2am prank alarm call.
Pop over to TechRadar to read my 8 top tips to lock down your Alexa.
On BBC Watchdog tonight I appear in an item highlighting gaping holes in home food delivery service Deliveroo’s security and fraud prevention systems.
Victims of so-called ‘Deliveroo fraud’ report having their credit and debit cards emptied of many hundreds of pounds on food and drink orders they never placed, to addresses many hundreds of miles from where they live.
Deliveroo’s standard response to claims of a security breach has left those affected with a bitter taste in their mouths, suggesting victims look to their own security failings instead.
The first a victim knows of the fraud is when they receive an email from Deliveroo confirming an order has been placed.
Deliveroo insists that its own systems have not been the subject of a hack or data breach; instead, the firm advises that customers should not reuse passwords and usernames across multiple online accounts.
Sound advice on its own, but a critical mass of Deliveroo victims all suffering the same fraud might suggest that Deliveroo should look again at its own security measures.
- Smart fraud prevention mechanisms, if present at all, appear to be ineffectual here. Purchases that are so out of character – such as those highlighted in the show – should easily be picked up by automated systems and subjected to additional verification.
- Similarly, a change of delivery address should also trigger additional verification – a PIN sent to the account holder’s smartphone, for example.
- Deliveroo chooses not to authenticate customer card payments with a CVV2 code.
The Card Verification Value is one of the names given for the additional security numbers printed on the signature strip or front of the card. Deliveroo is far from the only retailer to forego ‘card not present’ security – Amazon, with its 1-click purchase, is another. However, this lack of verification allows fraudsters to place orders on credit cards that are not theirs with no challenge at all.
Deliveroo’s light touch on security can be put down to one thing: sales. Here’s how skimping on security benefits Deliveroo’s bottom line:
- When we buy something, the more hoops we have to jump through to make that purchase, the more likely we’ll drop out and go somewhere else.
- Understandably Deliveroo wants to make placing an order with them as simple a process as possible by cutting out as many hoops as it can.
- However, some of those hoops are there for reasons of security; in removing those, Deliveroo is not only making it easier for its customers to place an order, it’s making it easier for them to be defrauded.