Experts have raised the alarm that the activities of cybercriminals which currently result in an estimated loss of over N127b in the country annually is bound to get worse judging by the increasing level of sophistication by the practitioners. Ibrahim Apekhade Yusuf in this report examines the clear and present dangers
Almost everyone is very familiar with the exploits of the infamous Yahoo Yahoo Boys, the byword for fraudsters, who have since gained notoriety for using the internet and other social media platforms to defraud their unsuspecting victims, especially those gullible enough to fall for their silly pranks.
Like the practiced crooks that they are, the Yahoo Yahoo Boys who have since upped their games are now playing in the big league such that their silly exploits are really causing a lot of upsets and havocs in the economy.
Startling revelations
Investigation by The Nation revealed that several organisations in the country, especially banks have suffered cyber attacks in the recent past as their Information and Communication Technology (ICT) infrastructure got compromised. In most cases, the affected companies had to pay huge ransoms for their data to be released.
Tope Aladenusi, who currently heads the Cyber Risk services at Deloitte Nigeria, had conducted an independent study on the activities of cybercriminals last year, the outcome of which formed a treatise tagged: ‘2017 Nigeria Cybersecurity Outlook,’ lending credence to the fact that cybercriminals are on the prowl.
The document, obtained from the firm’s website revealed that year 2016 took cyber attacks to an unprecedented level. According to Aladenusi, the cyber security forecast for 2016 saw a rise in the number of sophisticated phishing attacks as these occurred on multiple Nigerian financial institutions and utility companies.
Horrible stories of cyberattacks worldwide
Cyber attack is a menace afflicting everyone world over from the advanced economies to the developing and the third world economies.
In early 2016, a cyber-attack hit the main website of the British Broadcasting Corporation (BBC) and its iPlayer Streaming service. The BBC’s websites were unavailable for several hours as a result of the attack. This was the first widely reported cyber-attack of the year 2016.
Coming nearer home, the 2015 forecast by Deloitte indicated higher risk of current and former employees or contractors perpetrated cybercrime as a means to maintain their standard of living. Thus forensic specialists were kept busy as several companies had to engage them to investigate cybercrime perpetrated by various suspects who are largely made up of serving employees and former employees of the victim organisations.
The forecast further highlighted the fact that there would be an increase in cyber-attacks of websites and information technology infrastructure of political organisations and public institutions.
Specifically, there was the reported hack and de-facing of the Independent National Electoral Commission (INEC) website in March 2015 and also that of the Lagos state government in December 2015.
In 2016, there was an undeniably high likelihood this threat, especially sophisticated phishing techniques was on the rise.
Phishing mail is a type of social engineering that has literally become the attack of first choice. Typically most of the phishing mails are poorly crafted oftentimes containing spelling and grammar errors, however we are likely to get to the era where the mails are properly crafted and the messages more targeted to the victims.
Aladenusi also warned that Western style hack attempts by terrorists may grow in Nigeria as local hacktivists are likely to take it a notch higher to make hack attempts on government and private institutions’ infrastructures.
Giving further insights on the burgeoning industry of pranksters, Senator representing Oyo North Senatorial District, Dr. Abdulfatai Buhari said Nigeria records about N127b loss annually to cybercrime.
Buhari spoke recently during an annual lecture entitled ‘Legislative Commitment and Cyber Crime’, at the Faculty of Law, Lead City University, Ibadan.
He lamented that the figure would continue to grow unless the National Assembly acted fast and intensified its efforts in preventing the unwholesome act. He declared that the figure represented 0.8% of the country’s GDP.
Citing a report from the Office of the National Security Adviser (NSA), the lawmaker revealed that Nigeria has been ranked third in global internet crimes, coming after United States of America and United Kingdom respectively.
“In the year 2015, the Information Security Society of Nigeria (ISSAN) revealed that 25% of the cybercrimes in Nigeria were unresolved and that 7.5% of the world’s hackers are Nigerians. In 2014 alone, Economic and Financial Crimes Commission (EFCC) reported that customers in Nigeria lost about N6billion to cyber criminals, while Nigeria Deposit Insurance Corporation (NDIC) report for 2015 showed a 183% increase on the e-payment platform in Nigerian banks.”
Expatiating, he recalled that a similar report in 2015 by the Central Bank of Nigeria (CBN) showed that 70% of attempted or successful fraud/forgery cases in Nigeria banking system were perpetrated via the electronic channels.
“Banks in Nigeria have lost approximately N159 billion to electronic frauds and cybercrime between 2000 and 2013 and the impact on the nation’s economy and cash less policy is significant,” he said.
Speaking on the legislative commitment of the National Assembly in the past, the Ogbomoso born politician said: “The commitment of National Assembly in the past can be said to have not been fruitful and successful. Until 2015, there were over 100 IT-related bills before the Nigeria Legislature – the National Assembly, none of which was passed into law.”
Interestingly, he revealed that the creation of standing committee on Information and Communication Technology (ICT) and Cyber Crime by the Senate was part of commitment by the 8th Assembly towards curbing cybercrime in the country.
Clear and present danger
The country is said to be at severe risk of cyber attacks from all fronts as a result of the lack of appropriate legal and technical framework by the federal government, Mr. Lanre Ajayi, the immediate past president of the Association of Telecommunications Companies of Nigeria (ATCON) revealed in an interview with The Nation.
Ajayi made this submission against the backdrop of the alleged report of North Korean hackers subjecting Nigerian banks to attack for the purpose of raising money to fund its nuclear programmes.
Nigeria is listed among 18 countries where North Korean hackers have allegedly been attacking banks to get funds for sponsoring nuclear programme.
The finding comes after more than a year-long investigation into the activities of Lazarus, a hacking group allegedly responsible for the theft of $81million in US currency from the Central Bank of Bangladesh last year.
The company’s report —presented at a cybersecurity conference in the Caribbean, claims it found evidence of the same hacking operation launching attacks on financial institutions in Costa Rica, Ethiopia, Gabon, India, Indonesia, Iraq, Kenya, Malaysia, Nigeria, Poland, Taiwan, Thailand, and Uruguay.
But speaking in an interview with The Nation, the Acting Director of Communications at the Central Bank of Nigeria, Isaac Okoroafor refuted such claims, saying there is no reported incidence with any banks yet.
The CBN, he insisted, has an existing cybersecurity policy. “l’m telling you we have a policy, we have procedures and processes that protect us from such attacks on all our IT system.”
On whether the fears over cyberattacks on banks are actually unfounded, he said the apex bank has what it takes to respond to such attacks.
“We’ve adequate security measures to detect such attacks on our banking system. But of course, these things keep evolving. Hackers are always working, nobody is safe. But to the best of my knowledge, we’ve the best cybersecurity process that is available anywhere in the world. We have those things to protect our system.”
However some stakeholders said if CBN’s cyber security policy exists at all, it may be gathering dusts somewhere.
According to Ajayi: “There is nothing to suggest that the threat of cyber attacks is an imagination because there is a lot of hacking going around in the world so it would be very naïve to think that it’s an imagination. The only thing is that I’m not sure the hacking is taking place in just North Korea. I think hacking attempts can come from any part of the world and it’s real.”
He lamented that the country may not be fully prepared to fight the cybersecurity threat. “As a nation, I’m not sure we are really truly prepared for cyber attacks.”
He was however quick to admit that some individuals and organisations within the country, particularly the banks are aware of these threats and are taking the necessary precautions.
“The banks in Nigeria are serious entities and they know the implication of vulnerability to those attacks. I’m confident that the banks have put adequate measures in place to withstand the attacks,” he maintained.
Expatiating, he said: “The issue is not limited to legal framework. The people hacking are less bothered about legal framework. I think the most important thing is about technical framework, technical capability to withstand those attacks. The people doing it they are not bothered because they know they are not operating within the country. They are operating outside the jurisdiction of our land and laws so it doesn’t really bother them.”
What is important, he stressed, “Is to have technical capacity to be able to withstand those attacks. The attacks will always come. That’s the honest truth and there is nothing you can do about it. It will always come from various sources. Whether for an individual or corporate body, it will come and it’s coming and the target is not only Nigeria, it’s targeted everywhere in the world. So the onus is on you to get ready to withstand the attack.”
How recession fuel cyber attacks
Aladenusi who has significant security consulting experience in several organisations including Nigeria, Togo, Ghana, South Africa, Cameroon and UK, observed that with the recession in 2016 came several schemes that promised unbelievable financial returns on investment. These schemes generate returns for older investors by acquiring new investors or from re-investors.
Such schemes, he noted, rely on a constant flow of new investments to continue. When this flow runs out, the scheme falls apart. The end game is eventually that there will not be enough money to go around, and the schemes unravel.
A key characteristic of these schemes is that they are not regulated; if something goes wrong, no one is accountable. In 2017, there would be a continuous rise in these cyber ponzi schemes as the economic recession looms.
As these schemes evolve and begin to use crypt ocurrencies such as bitcoins that are not yet regulated or where identities are not traceable, the schemes will become more fraudulent and people would lose their money.
Rising to the occasion
It is also instructive to note that the Cybercrime Act was passed into law in May 2015. But the thinking is that many key stakeholders such as the judiciary and law enforcement agencies are yet to come up to speed in understanding and implementing the Act.
“We should expect the enforcement of the cybercrime act to be more pronounced and the Office of the National Security Adviser will play a more active and leading role in the campaign,” Aladenusi suggested.
To give the Act teeth, he further admonished that, “Anyone or organisation that violates any of the laws should expect to suffer the consequences. Companies will need to share and report threats to the National Computer Emergency Response Team (National CERT) Coordination Centre in accordance with the Act.”
Individuals/organisations that need to prosecute violators, he further observed, “Will need digital forensics services to preserve data in a manner that is admissible in the court of law.”
Specialists, he noted, would also be required to analyse digital data to answer key questions such as “where did the data go?”, “who had access to it?” and “has it been modified?” etc. Consequently, there will be a rise in the demand for computer forensic professionals.
It may be recalled that a presidential order was issued in 2015 to all Ministries, Departments and Agencies (MDAs) that request and retain biometric data, to expeditiously harmonise their biometric databases. It is expected that the data harmonisation will effectively link all MDA databases. The Vice President, Professor Yemi Osinbajo had explained at the time that government’s interest in the citizens’ data harmonisation is to assist the government in its quest to improve the socio-economic landscape of Nigeria, particularly targeting the poorest and most vulnerable persons, as well as to issue unique identification numbers to every Nigerian and legal resident for the improvement of national security, among others.
In a related development, the Chief Security Officers (CSOs) of banks had last month asked the CBN to provide them with security framework that would blacklist cyber criminals in banks.
The CSOs’ resolve was presented by their leader, Mr Sam Okenye, at the end of a week-long conference on Nigerian Financial Sector Global Cyber Security held at Transcorp Hotel, Calabar.
Okenye said banks do not need to compete on security matters but rather collaborate in fighting cyber-crimes and carry out constant evaluation of their system.
He was also quick to add that the introduction of Biometric Verification Number (BVN) in the banking sector is an important tool to kick out fraud in banks.
The CSOs agreed in principle that the CBN should implement the anti-cyber crime policy in the banking sector as a means of curbing the activities of internet fraudsters that use the banks to perpetrate their illicit activities.
Building safety nets
Another idea that is being mooted by security experts is the need for organisations operating in the country to explore cyber insurance, especially in the financial services industry which is the major target of cyber-attacks in Nigeria.
This is because cyber insurance is designed to mitigate losses from a variety of cyber incidents, including data breaches, business interruption, and network damage. This should hedge a firm from cyber losses and curtail recovery costs in the event of a cyber-attack. The coverage also protects against third party liabilities a business might suffer as a result of a failure of system security.
“Cyber insurance has not been a popular insurance policy in Nigeria. There is possibility that insurance companies will see this as a premium policy to deliver once clients start requesting for it,” Aladenusi enthused.
