Covid-19 pandemic times are difficult and unprecedented. Our priorities have shifted and more attention is being paid on safety from the coronavirus than on cyber safety. More and more people are anxiously searching the internet for information and advisories related to this virus as well as boosting immunity, staying fit, etc. During lockdown, people have more free time, a lot of which is being spent online. Companies are encouraging employees to work from home through new, and often, insecure tele-working infrastructure. Children are at home, engaging themselves in online studies, entertainment or social networking. The use of e-wallets and e-payments has grown, too.
Police have the extra workload of maintaining law and order, amid the corona-related tasks. This unusual situation offers highly fertile ground for cyber crimes to grow.
Cyber criminals are taking advantage of this unusual situation and setting up corona or Covid-19 as targeted bait. A large number of domain names with corona as a theme have surfaced. Several of them are malicious and visiting them is likely to infect your computer or device. One such site, coronavirus.app.site, claims to be a real-time tracker of the virus and tempts you to download an app, which is actually a ransomware, named CovidLock. Once the phone is locked, it asks for $100 in bitcoins to be paid in 48 hours. A number of malicious mobile applications have appeared which, in the name of giving you advice or tracking coronavirus, are reading all contents on your phone. Fictitious UPI handles have appeared, soliciting donations on the pretext of helping coronavirus victims.
There is a sharp increase in spear phishing email attacks, with corona as the content. Often, the sender impersonates as government/health authorities. Opening of any attachment in these emails leads to malware infection. SMS falsely notifying that “someone who came in contact with you tested positive. Click the link below for details'' are rampant. Clicking the link leads to infection of your mobile device. Trojan virus Cerberus gets installed through unsuspecting SMS messages, with a link to provide Covid-19 updates. Once clicked, it installs malware to steal financial information from mobile phones. KYC verification frauds have also become rampant in which the SMS message or the caller, on the pretext of online KYC verification, lures you into revealing details of your credit card/debit card, siphoning off money in your account.
Fake messages of income tax rebate/refund in view of corona have also come to notice. Work from home requires people to use their own devices, networks, etc many of which are unprotected or infected, weakening the whole chain of cyber security.
Interpol, CBI, CERT-In and various other agencies have been issuing specific advisories to guard against cyber crimes in this difficult time.
However, it may be seen that there is no new cyber attack vector noticed. It is still the old wine in a new bottle. Cyber criminals have always been using the current themes/topics as bait. This time it happens to be corona. It is unique as it is globally present, its duration is long and attention grabbing power is also high.
As is the case with coronavirus, for cyber crimes, too, prevention is better than cure. Similarly, observing basic cyber hygiene can prevent you from 80 per cent of cyber crimes. Some of these #WashYourCyberHands measures are listed below:-
• Use a strong password along with two-factor authentication.
• Use different passwords for different accounts and change them periodically.
• Do not allow browsers/mobile devices to remember passwords.
• Do not reveal your password, debit/credit card PIN/CVV and other details to anyone.
• Do not download attachments in unsolicited e-mail from suspicious/unknown sources.
• Do not click on web links received through SMSes or e-mails, unless you are sure of it.
• Do not download apps indiscriminately on your mobile devices.
• Use updated anti-malware software on your computers/mobile devices to regularly scan them.
• Regularly update your operating system and other software. Needless to say, do not use pirated software.
• Back up your precious data regularly to external drives or cloud.
• Do not use free Wi-Fi to carry out e-commerce or e-banking.
• Use VPN for connecting to your organisation network while working from home.
• Do not install remote access software on your computer or mobile.
• Protect your important files using encryption.
• Stay away from porn sites or sites offering pirated software, books, films, songs, etc.
• Educate your children about online safety tips just like we do for road safety.
• Beware of fraudulent people offering online sales of face masks, sanitisers, medicines, etc.
• Do not accept friendship requests on your social media account from strangers.
• Take Covid-19 updates and tips from official sites only.
• Check and harden privacy settings of your social media accounts. Do not reveal personally identifiable information on them.
• Control your greed, emotions and tendency to double-click on click baits.
• Subscribe to @CyberDost Twitter handle for cyber safety awareness.
• Organisations need to take a risk management approach with business continuity planning while putting cyber security systems in place.
• Healthcare and medical research organisations need to be extra careful as ransomware can disrupt their organisations and cyber thieves may be on a look out for sensitive research data.
• Social engineers take advantage of human weaknesses. Cyber security education and awareness of employees must be promoted to bring in an overall culture of cyber safety.
In spite of taking all possible precautions, if you still fall prey to cyber crime, immediately report online on the website of your state police, district police or cyber crime police station as the case may be. You may also report it on national portal cybercrime.gov.in. Block your debit/credit card, bank account, e-wallet etc if compromised. Pursue your complaint, even though police may be busy in Covid-19 policing.
In the end, I would like to remind you of the age-old protection/safety advice. There are no free lunches. Do not take chocolates from strangers. Money does not grow on trees. If something is too good, it is, probably, not true.
(Chander is Special Commissioner of Police (Operations), Delhi Police. He is a cyber security expert and former director of the National Critical Information Infrastructure Protection Centre.)
(As told to Namrata Biji Ahuja)