0
1
Cyber-criminals are increasingly targeting user accounts to harvest their reward points, which are then used to fuel an illegal dark web travel services sector.
Researchers at security intelligence firm Flashpoint revealed that the hackers usually compromise accounts associated with reward points credit cards — with the points subsequently being used to purchase hotel rooms, flights and car rentals, through online booking services.
The Russian cybercrime underground is apparently a hotbed for this kind of activity, although English and Spanish-speaking cyber-criminals are also getting in on the act.
“These services have become so widespread on one lower-tier Russian-language forum that the community has established its own group of members dedicated to cybercrime targeting hotels,” Flashpoint revealed in a blog post.
“One such member has been advertising their travel ‘booking service’ on two lower-tier forums since December 2014. Through their service, users can order tickets to anywhere in the world; the only restriction is no domestic flights within Russia. Grateful customers regularly post photos taken on trips purchased through the actor’s offerings.”
The scam has been facilitated in part by the use of brute-forcing software capable of checking large numbers of password combinations to access accounts, the firm said.
“A symbiotic relationship exists between the expanding presence of these tools and the marketplace for compromised credentials,” it added.
Flashpoint recommended users bolster their account security through the use of long, complex passwords which are hard to crack.
Javvad Malik, security advocate at AlienVault, claimed “shadow currencies” like Air Miles can be just as valuable as hard cash for cyber-criminals.
« Others can include gift cards, vouchers, or non-traditional banks like PayPal. In 2016 it was reported that Starbucks had over $1.2bn loaded onto its cards, while PayPal had an eye-watering $13bn,” he explained.
To read the original article :
https://www.infosecurity-magazine.com/news/hackers-reward-points-illegal/?utm_source=dlvr.it&utm_medium=twitter
