The National Cyber Security Centre Finland’s weekly review – 9/2023
Information security now!
This is the weekly review of the National Cyber Security Centre Finland (NCSC-FI) (reporting period 24 February–2 March 2023). The purpose of the weekly review is to share information about current cyber phenomena. The weekly review is intended for a wide audience, from cyber security specialists to regular citizens.
Topics covered in this week’s review
- “Your rent is overdue" – Beware of a new scam
- Consumers plagued by fake webshops
- Downtime in online services is common and often harmless
- New instructions contain information on cyber threats and risk management concerning local mobile networks
- Towards cyber-safe smart devices – Important information for Finnish companies
“Your rent is overdue" – Beware of a new scam
This week, the NCSC-FI has received many reports of a new type of scam in which a text message recipient is lured to transfer rent money to criminals. Financial losses have already occurred.
The criminals sending these scam texts usually sign their messages with ‘Taloyhtiö’ (housing company). Scams have also been sent in the name of several rental housing companies.
The messages say that the account number used for paying rent has changed and provide a new account number, which the recipient should use going forward. The messages also try to make the recipient alarmed by saying that they are behind on their rent.
The messages are not authentic. The criminals are trying to reach as many people as possible using these non-specific messages. Based on the reports we have received, it would seem that these scam messages are being sent to a large group of people, and not all recipients even rent their homes.
“The criminals are trying to exploit people’s sense of duty and responsibility. You should take a moment to think things through when it comes to invoices and payments. If you have any doubts, you should verify the validity of the invoice from the billing party before you pay anything," says Information Security Specialist Juuso Tunkelo at the NCSC-FI.
If you receive suspicious messages, always verify their validity from the party purporting to send the message by using some other means. You should not respond to suspicious messages. In the cases mentioned in this article, you can verify the authenticity of the message from your landlord by email, for example. If you respond to a suspicious message directly, you will end up communicating with criminals, which is why you should use another communication channel.
Do as follows, if you have received a message described above and paid rent to the account mentioned in the message:
- Contact your bank.
- File a police report (External link) online or at the nearest police station.
- Contact Victim Support Finland (External link) if you need help after being targeted by criminals.
Consumers plagued by fake webshops
With the rising popularity of online shopping, the number of fake webshops has also risen and an increasing number of people have lost money after inadvertently shopping at a fake webshop.
Identifying fake webshops may be difficult, because the websites may look identical to the websites of well-known brands. Products purchased from fake webshops are rarely delivered to the customer, and if they are, they may not be what was ordered. The NCSC-FI has also received reports of cases where the product has been a forgery or otherwise low in quality.
Fake webshops may also serve as phishing sites, meaning that consumers’ payment card details or banking credentials may be at risk of ending up in the hands of criminals.
If you have purchased products from a fake webshop, it is important to contact your bank quickly and file a police report. Not all suspicious webshops are fake webshops. If the webshop displays contact details, you can try to contact the vendor if you are unsure about ordering.
Downtime in online services is common and often harmless
Denial-of-service attacks against the websites and services of organisations are commonplace. In practice, these attacks occur at all times and everywhere. They are also prepared for and prevented daily. As far as the consumer is concerned, a denial-of-service attack will cause the website of a bank or health care provider to be down. Maintenance breaks and other disruptions may also cause downtime on websites.
“The visible effects of the most conventional denial-of-service attacks can be compared to rush hour at the till in the supermarket on a Friday afternoon. You need to queue patiently for a while, and you are good to go," says Information Security Specialist Matias Mesiä at the NCSC-FI.
Denial-of-service attacks are often covered by the media, which may make it seem that they are more impactful than they are. Usually, denial-of-service attacks do not, however, cause any other effects than a short downtime and some reputational damage to the targeted organisation or service provider. Preparing for them and preventing them are a normal part of organisations’ risk management. In Finland, networks operate reliably and there are relatively few disruptions. Functional networks are built in cooperation with operators and authorities.
New instructions contain information on cyber threats and risk management concerning local mobile networks
What types of cyber threats and risks are associated with local mobile networks? What types of things should be considered when building networks? The new instructions provide information to organisations thinking about establishing new local mobile networks.
As a rule, new network technologies have better performance and are safer compared to earlier generations of technologies. Local networks built using 5G technology are also more versatile and efficient than many of the currently used local WLAN solutions. However, they pose new types of risks and require new kinds of skills, which is highlighted in the changing operating environment.
What should organisations take into account when designing and building local 5G mobile networks? What type of special characteristics, cyber threats and risks are associated with the networks? Which regulatory obligations are set for the organisations implementing these networks? The new instructions issued by the National Cyber Security Centre Finland and the National Emergency Supply Agency offer information concerning these matters, among others. The instructions are primarily intended for organisations producing operations critical to society, but they are informative from the point of view of other organisations wanting to utilise local mobile networks in their operations, as well.
Towards cyber-safe smart devices – Important information for Finnish companies
New requirements will be introduced for the information security of smart devices as of 1 August 2024. How can excellent information security be turned into a selling point? Why is ensuring information security part of corporate responsibility? These and other themes will be discussed at Oulu BusinessAsema on 21 March 2023.
The event will feature views on security by design and responsibility from experts at Netox Oy, BusinessOulu and the University of Oulu. Traficom experts will talk about regulation concerning the information security of smart devices.
The event is intended for management in charge of corporate business operations and marketing. We will also be hosting events in Tampere and Jyväskylä in the spring.
Subscribe to the NCSC-FI’s newsletters or RSS feeds to be notified as soon as new information is published.