Check .lt domain

USA expert: the amount of the web surfers suffering from the cyberterrorism is increasing

With increasing number of the cyberattacks, the most vulnerable remain the users who are not concerned about the safety online, warns Dave Piscitello, Senior Security Technologist and Vice-President for Safety and Information and Communication Technology (ICT) at the Internet Corporation for Assigned Names and Numbers (ICANN). According to the expert, the viruses distributed with spam, as well as website forgery remain the biggest issues of cyber safety faced by the web surfers.

D. Piscitello visited Lithuania at the invitation of the .lt registry, the Internet Service Centre DOMREG at Kaunas University of Technology (KTU). During his visit, D. Piscitello organised the training on cyber security for KTU students and scientists, specialists of the Lithuanian Criminal Police Bureau, National Cyber Security Centre under the Ministry of National Defence, State Data Protection Inspectorate and Lithuanian Research and Education Network (LITNET).

– What do you consider the biggest issues of cyber security? – we asked D. Piscitello.

– It may sound strange, but one of the biggest issues of cyber security is spam. Spam is like a nuclear submarine carrying secret terrorist weapon that is very harmful. Spam is used for sending the files with viruses. The users think that it is a document and click on such viruses, activate them and become the victims of such viruses. These kinds of viruses collect the user names, passwords and other information and transfer it to the criminals.

Another serious problem is sending of so-called “financial” spam to the users; when they are sent supposedly from the bank, attempting to get the login data for the e-banking systems in a fraudulent manner. Thus, spam makes is probably the most harmful.

– Does the so-called cyberterrorism exist, what is it and how prevalent is it? Could you distinguish the world’s regions or countries that suffer most from the organised crime?

– Cyberterrorism is like an art; its concept is complicated. There is a saying in the United States of America: it is impossible to distinguish the differences between art and pornography, but everyone knows what they see. The citizens see cyberterrorism as consequences of the coordinated attacks. Cyberterrorism is used against the countries and public administration systems, as well as against the citizens; often it has no physical borders. However, each country has to provide appropriate protection to its IT systems and computers of its citizens against the attacks of the organised cyberterrorism. Cyberterrorism is a very promising and growing area of crimes; thus, it poses very serious threats.

– The number of cyber incidents in the Baltics is also increasing. What is your opinion on the situation of cyber security in the Baltic States and Lithuania?

– Our organisation solves more and more tasks not only in the USA, but also in Europe, Middle East and Africa. We notice that Eastern and Central European, and Baltic countries become more and more active in their fight with cybercrimes. We have to understand that criminals constantly look for new ways to act online; therefore one country is not capable of dealing with the growing threats. The criminal infrastructure is large and strong. We had practical cases of hackers using the resources of the data administration infrastructures of 60 countries; therefore, no country is protected and they all have to think about the possibility of becoming the target of the cyber terrorists at any time.

Dave Piscitello, Senior Security Technologist at ICANN

– Counterfeiting of domains and websites for the commitment of crimes online is quite common. What domain-related crimes have you noticed? Are DNS (Domain Name System) redirections to the criminal servers common?

– One of the largest problems – domain registered for the commitment of crimes and false websites or e-shops. Such criminals, who often copy the legitimate websites for their criminal offences and register very similar domains, manage to obtain SSL security certificates; therefore such false websites seem secure to the users. It is not difficult for the criminals – the internet user logins to the seemingly secure website protected by HTTPS protocol, enters data of the credit cards and other personal data and, without realising it, becomes the victim of the fraud.

Do not click on any suspicious links, especially the ones sent by email, because such links and domains are used for the user redirection to the false websites. I would like to warn that SSL certificates should not be trusted easily; you should always check the entity they are issued to; and the best solution – not to click on any links.

SSL certificate is only one component of security. If you want to shop online safely or use e-banking services, it is better to enter the domain name in your browser by hand. I, personally, never click the links, even when I receive my bank’s newsletter; that is how I make sure that I really open my bank’s website. Be careful and do not trust the technologies too much, because criminals try to overcome them. It is not easy to trace and block the false websites of the criminals, even though both the police and other institutions solving cybercrimes are working hard.

– According to the programmers, the number of insecure websites is increasing. Can a well-maintained, constantly updated blog using a free content management system be insecure?

– Yes, the problem is there are too many insecure websites, therefore, they are often “cracked”, inserting a harmful program code that allows infecting the user computers, collecting and transferring their information. That is how the criminals use the legitimate domains and websites for the commitment of crimes. Such attacks against the visitors of the insecure websites are carried out for a long time unnoticed and they are particularly dangerous. Website administrators have to protect the security of their website and its visitors by updating the software used for the website’s content management system.

Security must be protected at the highest level

Tomas Mackus, Head of the Client Service Office at KTU Internet Service Centre DOMREG advices how to protect your domain to make your website secure:

“The thoughts of ICANN expert D. Piscitello on the biggest security issues faced by the users are also relevant in Lithuania. We hear about the intrusions into the IT systems of the state institutions, media and, businesses, theft of data; therefore, security has to be protected at the highest level.

I am happy that specialists of the Lithuanian Criminal Police Bureau, National Cyber Security Centre under the Ministry of National Defence, State Data Protection Inspectorate, Lithuanian Research and Education Network LITNET, KTU specialists and scientists accepted the invitation and participated in the training for the cybercrime investigation provided by ICANN cyber security expert and organised by DOMREG.

We, as .lt registry, fight the criminal offences in the domain registration and cooperate with the representatives of the law enforcement who investigate cybercrimes. We advise the customers of domains to register all similar domain related to their activities, instead of waiting for them to be used by the criminals. If a trademark contains the specific Lithuanian letters ą, č, ę, ė, į, š, ų, ū, ž, we suggest checking both options of the domain – “incorrectly spelled” using Latin letters and correct one with specific Lithuanian letters. If they are available – register both of them.

Registration of the domains with specific Lithuanian characters provide an easier access to the users, while prevent the criminals and competitors from appropriating or copying your website and trademark. In the presence of the big risks of the cybercrimes related to the false domains, it will restrict the hackers' criminal attempts.

For the users, who are particularly concerned with security, we recommend to use domains with DNSSEC security extension. DNSSEC technology enables a reliable authentication of DNS inquiries and replies, preventing their counterfeiting; therefore, we recommend this technology to the providers of financial services, e-commerce and security-sensitive public services online.

We began applying DNSSEC technology back in 2013; however, it is not widely used due to its complex administration. Only 61 registered .lt domains out of 192 thousands currently use the above-mentioned security extension.”

Published 2018-05-16