Sophisticated OTP code theft scam, cyber attacks exploit new vulnerabilities

Sophisticated OTP code theft scam appears

According to Kaspersky, between March 1 and May 31, 2024, the unit blocked 653,088 visits to websites created by phishing kits targeting banks.

During the same period, Kaspersky detected 4,721 phishing websites created by toolkits aimed at bypassing two-factor authentication measures.

w message code otp 3035.jpg — OTP text messages are a two-factor authentication method commonly used in Vietnam. Photo: Trong Dat

When the victim enters their username and password on the fake website, the scammer will automatically collect the information immediately, in real time. They will then log in and trigger the OTP code to be sent to the victim's phone.

Normally, even if the password is revealed, the user's account will be protected by 2-factor authentication or 2-step authentication. However, a new trick has appeared when scammers use OTP bots to trick users into revealing the OTP code.

OTP bots will automatically call the victim, impersonating an employee of a trusted organization. OTP bots use pre-programmed conversation scripts to convince the victim to reveal the OTP code. Through this, the hacker obtains the OTP code and uses it to gain unauthorized access to the account.

Scammers prefer to use voice calls over text messages, as victims tend to respond more quickly to this method.

In any case, users should never provide OTP codes to others, especially via calls or messages, no matter how convincing the information content may seem.

Two-factor authentication (2FA) is a standard security feature in cybersecurity. It requires users to verify their identity with a second authentication step, typically a one-time password (OTP) sent via text message, email, or app.

Vietnam will have 10 more submarine optical cables

On June 14, the Ministry of Information and Communications issued a decision approving the "Strategy for developing Vietnam's international optical cable system to 2030, with a vision to 2035".

Vietnam's international fiber optic cable system development strategy aims to put into operation at least 10 new submarine fiber optic cable lines by 2030, bringing the total number of submarine fiber optic cable lines in Vietnam to at least 15.

w national number conversion 1 1 1042.jpg — Analysis by the Telecommunications Department shows that to meet the need to ensure the security of Vietnam's Internet network as well as meet backup needs, the total capacity will need to be at least 350 Tbps. Illustration: Hoang Ha

Specifically, according to the roadmap, by 2027, Vietnam will deploy and put into operation 4 new submarine optical cable lines, increasing the total capacity to at least 134 Tbps; Continue to maintain at least Singapore, Hong Kong (China), and Japan as the main Digital Hubs; Periodically review and evaluate the Digital Hubs to develop plans to maintain, shift, and add appropriate connection points for each period.

Of the four new submarine cable lines to be deployed by 2027, at least one submarine cable line will be owned by Vietnam.

In the period from 2028 to 2030, at least 6 new submarine optical cable lines, including 1 line owned by Vietnam, will be deployed and put into use, bringing the total designed capacity of Vietnam's submarine optical cables to at least 350 Tbps.

During this period, Vietnam will also deploy and put into operation at least 1 more international land-based optical cable line. At the same time, maintain a maximum connection of 90% of the submarine optical cable capacity to at least 4 large neighboring Digital Hubs in the Asia region; Maintain a minimum backup connection of 10% of the submarine optical cable capacity to at least 2 large Digital Hubs in the Americas and Europe.

According to the Telecommunications Department, in addition to the two land cables connecting to Hong Kong (China) and Singapore with a total capacity of 5 Tbps, Vietnam currently has five international submarine cable lines with a total capacity in use of more than 20 Tbps, and a total available capacity of 34 Tbps. According to statistics, on average, there are 15 submarine cable incidents each year, with the repair time before 2022 being about 1-2 months/incident, and after 2022 being from 1-3 months/incident. Therefore, there was a time when Vietnam experienced incidents on all five submarine cable lines in use, causing a loss of about 60% of international Internet connection capacity for nearly 2 months.

Hackers increase speed of exploiting new vulnerabilities

Hackers are increasingly exploiting newly disclosed vulnerabilities to launch cyber attacks on the systems of agencies and organizations.

The above comment was shared by Mr. Nguyen Gia Duc, Country Director of Fortinet Vietnam, with VietNamNet reporter, on the sidelines of the annual security event Fortinet Accelerate Vietnam 2024 held in Hanoi recently.

To prove his point, Mr. Nguyen Gia Duc said that the FortiGuard Labs research team sought to determine the time it takes for a security vulnerability to move from initial release to exploitation, whether vulnerabilities with high Exploit Prediction Scoring System (EPS) scores are exploited more quickly, and whether it is possible to predict the average time hackers exploit using data from the EPSS system.

bag red 1 1447.jpg — Exploiting security vulnerabilities of popular technology products to infiltrate and attack systems is still a prominent cyber attack trend in Vietnam as well as globally. Illustration photo: Internet

Based on this analysis, Fortinet experts pointed out that in the second half of last year, hackers increased the rate at which newly disclosed vulnerabilities were exploited, 43% faster than in the first half of 2023. This shows the importance of vendors committing to self-detecting vulnerabilities from internal teams and developing patches before exploitation can occur, minimizing the cases of 'sticking' to Zero-Day security vulnerabilities.

According to experts, exploiting security vulnerabilities, especially high-impact and serious vulnerabilities that exist in popular technology solutions to use as a 'springboard' to infiltrate the system and thereby take control and steal information from the organization is one of the prominent cyber attack trends in recent years.

Ho Chi Minh City allocates 1,800 billion VND for digital transformation but has not used any of it

On the morning of June 14, at the second working day of the 31st Conference of the Ho Chi Minh City Party Committee, Vice Chairman of the Ho Chi Minh City People's Committee Vo Van Hoan presented a report on the results of the city's digital transformation. According to Mr. Hoan, promoting digital transformation is also a content in the 2024 theme of Ho Chi Minh City.

According to the Vice Chairman of the Ho Chi Minh City People's Committee, in implementing digital transformation, the city identifies 5 main pillars, including: digital platform, digital economy, digital society, digital government, and digital safety and security.

Also according to Mr. Hoan, in 2024, Ho Chi Minh City approved a regular budget of more than 1,800 billion VND for investment activities in information technology application and digital transformation of the city in 2024 (reaching a rate of 1.22% of the total budget in 2024).

However, the disbursement rate for digital transformation is currently 0%. The reason is that the City Department of Finance has just assigned the budget on May 3, 2024.

“The city has allocated more than VND1,800 billion for digital transformation but has not used any of it. The reason is that we have not been able to complete the equipment procurement, bidding, and auction process through many stages,” said the Vice Chairman of the City People’s Committee.

Units have not yet implemented 100% of the reception, digitization, and processing on the administrative procedure settlement information system due to the parallel use of two public service portal systems. In addition, digital signatures have been implemented but only as a pilot internally and have not been widely disseminated and are still hesitant in implementation.