INTERPOL tests investigators’ know-how in fake IoT attack on bank

Because IoT devices pose a major risk for cyberattacks, INTERPOL tested 43 cybercrime investigators and digital forensics experts in a digital challenge involving a fictitious attack on a bank through an IoT device. This comes as no surprise, since in recent years hackers have actively targeted the financial sector.

After an increased number of attacks in 2016 on ATMs and intercepted SWIFT transactions, 2017 brought financial fraud, DDoS attacks and data breaches. In 2018, the financial sector will remain among the most targeted, together with the healthcare industry.

To ensure global police are ready to handle an IoT attack, INTERPOL asked experts to join forces in Vienna, Austria, and test their knowledge in webcam protection against attacks or in detecting whether a smart device has been manipulated to carry out attacks.

“Cybercrime investigations are becoming more and more complex and operational exercises such as the Digital Security Challenge, which simulate some of the hurdles that investigators face every day, are vital for the development of our capacities,” said Peter Goldgruber, Secretary General of the Austrian Ministry of the Interior.

Cybercriminals take advantage of lack of police know how in collecting forensic data from devices other than computers and mobiles. In this exercise, participants had to determine when malware had been deployed, and on which device, to steal a large sum of money.

After an extensive investigation, it appeared the malware propagated through an email attachment sent through an infected webcam. The webcam was exploited from a remote location to carry out the attack. The teams eventually identified the C&C servers used to manipulate the vulnerabilities in the web cam.

“The ever-changing world of cybercrime is constantly presenting new challenges for law enforcement, but we cannot successfully counter them by working in isolation,” said Noboru Nakatani, Executive Director of the INTERPOL Global Complex for Innovation.

“A multi-stakeholder approach which engages the expertise of the private sector is essential for anticipating new threats and ensuring police have access to the technology and knowledge necessary to detect and investigate cyberattacks.”