Re: [Covidimpacts-workshop] Some COVID-19 security stats

[Kirsty P <[e-mail]>]

Here are some figures for takedown comparison, though to repeat what I said today - focusing on numbers alone won't describe the qualitative shift in patterns we've seen since March, from our handling and managing a variety of incidents. It would be painful to go through the variety and volume we've dealt with and count... so I won't.

But I can still say some specifics like - we've seen more attacks (that have been detected) where attackers use VPN vulnerabilities as the access vector; this is likely because of an increase in VPN usage and new rollouts, due to a shift to homeworking. I'd logically conclude this is at least one specific pivot in attacker methods, caused by COVID circumstances. (See also this advisory that was released in response to COVID exploitation by malicious actors, p7: https://www.ncsc.gov.uk/files/Final%20Joint%20Advisory%20COVID-19%20exploited%20by%20malicious%20cyber%20actors%20v3.pdf)

That said, for comparison on figures:

  *   in the 2018-2019 year, the takedown service took down 177,335 phishing URLs (23,311 attacks by group) [p12, https://www.ncsc.gov.uk/annual-review/2019/ncsc/docs/ncsc_2019-annual-review.pdf].
  *   This year (2019-2020), 166,710 phishing URLs in total were taken down, with 15,354 campaigns using coronavirus as the lure since March.
  *   Since the annual review runs 1 September - 31 August, you could draw a flat average across the year, to find rough conclusions about frequency between the two years/expectations for March-August vs. what we saw, if you wanted.

However, obviously there are caveats and questions with all data - this is no different. E.g. we don't know what we haven't found, so phishing URLs that are found and taken down are not necessarily the full set of phishing URLs out there. You'd like to think we're getting better at finding them, but it's hard to quantify what increase that means for a year-on-year comparison of much is "us getting better" and "more malicious stuff existing". Even a decrease in campaigns could be for reasons like "each campaign is more successful, so fewer are needed" or "the infrastructure underpinning each campaign is harder to detect and takedown, so the campaign lasts longer".

Thanks for the discussions on this topic so far and for organising the workshop - it's been great to see COVID's security impact be a cornerstone of discussions.

Kirsty


________________________________
From: Stephen Farrell
Sent: Thursday, November 12, 2020 20:49
To: Kirsty P; [e-mail]
Subject: Re: [Covidimpacts-workshop] Some COVID-19 security stats


Hiya,

On 12/11/2020 11:31, Kirsty P wrote:
> Stephen asked yesterday if malicious campaigns, scams/fraud overall increased, or if the numbers were the same but it was just a change in lure.
>
> I think focusing on numbers alone won't describe the full shift in patterns that we saw, but I'll share some stats from our annual review now it's been published (https://www.ncsc.gov.uk/annual-review/2020/docs/ncsc_2020-annual-review_s.pdf - page 98) below.
>
> It gives an indication of how much effort went to COVID campaigns, the shift in behaviours, and the relative takedown responses:
>   - 166,710 phishing URLs discovered across all campaigns were successfully taken down. 42,576 URLs were associated with UK Government-themed phishing attacks. The UK-hosted global share of visible phishing attacks further reduced to 1.27 % (from 2.1% last year).
>   - Since March, the NCSC has taken down 15,354 campaigns which used coronavirus themes in the "lure". These were hosted globally.
>    -- 8,800 were Advance Fee Fraud (419 scams)
>    -- 1,156 were associated with fake shops selling bogus PPE, coronavirus products, test kits (and even vaccines)
>    -- 251 phishing campaigns
>    -- 2,984 mail servers distributing malware

Do you have any info on how that's changed e.g. vs. 2019.
Reason to ask is I've seen various claims as to how working
from home has affected security but I don't recall any
before/after studies. (That may well be because I've not
looked though, hard to imagine nobody was doing that.)

Ta,
S.


>
> Kirsty
> This information is exempt under the Freedom of Information Act 2000 (FOIA) and may be exempt under other UK information legislation. Refer any FOIA queries to [e-mail]. All material is UK Crown Copyright �
>
>