Blog

The common vulnerabilities in the Fintech Industry

Digital innovations and trends in financial technology or the Fintech industry are revolutionizing how people, financial organizations, and banks manage their money and conduct business transactions. Post-pandemic era has drastically changed how people engage with finances. The COVID-19 pandemic has favored the techno-finance sector, which can give more efficient answers in terms of speed, and has also highlighted how corporate agility is among the key values of the future. Financial technology is improving and automating the process and services within organizations. Security threats disrupt business and hence these challenges push our imagination in new ways and encourage unparalleled growth, but there’s still room for improvement. The attractiveness of financial gain and access to confidential data are the two most important reasons for making the financial sector one of the biggest targets of hackers. Therefore, identifying cyber vulnerabilities and risks is vital to every financial organization. 

In this article, you will read about: 

Recent cyber incidents involving Financial Organizations

What is a vulnerability? 

Common cyber vulnerabilities in FinTech 

Tips for mitigating cyber risks 

Kinds of uncertainties resulting from cyber risks 

Handling uncertainty for FinTech cybersecurity risk 

Recent cyber incidents involving Financial Organizations

1.    Beanstalk Farms cryptocurrency theft

On April 17, 2022, the decentralized finance platform Beanstalk Farms lost $180 million in a cryptocurrency heist. The attackers took out a large enough loan to acquire enough voting rights to make the necessary governance changes to move all of Beanstalk’s reserves. The price of each Bean has since plummeted to near zero before coming back up to around one dollar.

2.    Lazarus ‘Trojanised’ decentralized finance app

On April 1, 2022, North Korean state-sponsored threat group Lazarus was found to be using ‘Trojanised’ decentralized finance apps to deliver malware in their latest spearphishing campaign. The malware is a full-featured backdoor containing sufficient capabilities to control the compromised victim.

3.    Hackers use MailChimp phishing attacks to hack cryptocurrency wallets.

Mailchimp CISO Siobhan Smyth said that the company had become aware of the breach on March 26th when it detected unauthorized access to a tool used by the company’s customer support and account administration teams.  Mailchimp attack primarily used social engineering to get MailChimp employee credentials to get in the door. Mailchimp’s analysis has concluded that the attackers focused on obtaining data from users in the cryptocurrency and finance sectors.

4.      Aon ransomware attack

On February 25, 2022, global insurance and reinsurance broker, Aon was hit by a ransomware attack, causing limited disruption to a number of their services. The attack reportedly left no significant impact on the company, and Aon has not disclosed further details about the incident.

5.     IRA Financial Trust cryptocurrency theft

 On February 8, 2022, IRA Financial Trust, which offers self-directed retirement accounts, lost $36 million in cryptocurrency when unknown threat actors drained $21 million in Bitcoin and $15 million in Ethereum from the accounts of IRA customers. IRA Financial allows its customers to purchase cryptocurrency through a partnership with the cryptocurrency exchange Gemini Trust Co.

6.     Medusa malware phishing attacks

On February 4, 2022, researchers reported that the Medusa Android banking Trojan has increased infection rates and the scope of geographic regions targeted. The malware aims to steal online credentials to go on and perform financial fraud. Medusa has begun targeting victims in North America and Europe, using the same distribution service as FluBot malware to carry out their smishing campaigns.

7.     Multichain cryptocurrency theft

On January 17, 2022, Multichain, a platform that allows users to swap tokens between blockchains, lost approximately $1.4 million when hackers exploited a vulnerability in the blockchain service. One of the attackers is now negotiating with the victims to return 80% of the stolen funds and keep the remaining 20% as a ‘tip’.

8.    Robinhood data breach

On November 8, 2021, Robinhood, the American stock trading platform, disclosed a data breach after their systems were hacked. A threat actor gained access to the personal information of around 7 million customers.

9.    Zloader banking malware

Since November 2021, the banking trojan Zloader has been exploiting Microsoft’s digital signature verification method to inject malicious code into a signed system dynamic link library (DLL). The banking trojan leverages Atera, an enterprise remote monitoring and management application, for initial access to targeted machines, and as of January 2022, the malicious DLL had been downloaded to 2000+ unique victim IPs.

10. FBI warns of novel ransomware extortion methods

On November 1, 2021, the FBI warned that ransomware actors have been using significant financial events and stock information, specifically, publicly available information such as upcoming mergers to inform their targeting and extortion of victims.

11. Diebold Nixdorf ATM vulnerability

On October 28, 2021, researchers from Positive Technologies discovered vulnerabilities in the Wincor Cineo ATMs, owned by Diebold Nixdorf, an American multinational financial and retail technology company. With access to the dispenser controller’s USB port, outdated or modified firmware could be installed to bypass the encryption and make cash ATM withdrawals.

Cybersecurity risks to the financial system have grown in recent years, in part because the cyber threat landscape is worsening; in particular, state-sponsored cyberattacks targeting financial institutions are becoming more frequent, sophisticated, and destructive. In 2017, the G20 warned that cyberattacks could “undermine the security and confidence and endanger financial stability.”  

What is a vulnerability? 

A vulnerability is a weakness that can be exploited by a cyber-attack launched by a threat actor. In other words, vulnerability is a flaw, loophole, error, limitation, oversight, or susceptibility in any aspect of FinTech, especially the IT environment. If the vulnerability is exploited, it can cause severe losses or damage to the assets. These losses or damages are referred to as risks. 

National Institute of Standards and Technology Special Publication (NIST SP) 800-28 Version 2 defines cyber risk as “A measure of the likelihood and the consequence of events or acts that could cause a system compromise, including the unauthorized disclosure, destruction, removal, modification, or interruption of system assets”. 

Common cyber vulnerabilities in FinTech 

Some of the general vulnerabilities that can be exploited in the technologies, platforms, frameworks, and related solutions used by FinTech are summarized below. 

• Money laundering: Most financial institutions are vulnerable to money laundering. The term is used to refer to making substantial amounts of money through illegal activities and processing it to make it clean and come from a legitimate source.   
• Phone verification without OTP: This vulnerability bypasses the authentication process of confirming a One-Time Password (OTP) generated as a part of the financial transaction. 
• Ransomware: It is a type of malware that encrypts files and directories on the target computer to disrupt authorized access and demand a handsome amount of ransom to provide the decryption key. Ransomware remains the most common form of malware in 2022. It has grown in popularity due to its capacity to extort large sums of money while posing a low risk to cybercriminals. 
• Information disclosure: It is a vulnerability in which sensitive information is revealed intentionally or unintentionally to unauthorized personnel. 
• Unpatched operating systems and applications: Unpatched operating systems and applications expose vulnerabilities to attackers who are always peeping into security flaws. Security breaches due to the exploitation of vulnerabilities exposed by unpatched software can run rampant on business owners by reducing productivity and economic stability. 
• Injecting malware to steal login credentials and other important data: The use of smartphones for online banking and payment is an essential application of FinTech. Attackers inject malicious code into mobile applications to steal login credentials and use them to perform financial fraud, especially credit card fraud. 
• Auto-saving login credentials: Some users prefer to save their login credentials rather than remember them. The web browser stores the session cookies and the username and password used to log in to the system. If an attacker hijacks the session, he can easily steal login details.  
• Inculcating best practices for cyber hygiene amongst employees: There is a lack of cyber education and training among common people so that they can be made aware of what vulnerable situations are and how to respond to those situations to stay protected. 
• Regulatory compliance: Regulatory compliance isn’t a cybersecurity risk per se, but it is a challenge. The fintech industry is strictly managed and must comply with a wide range of banking regulations, data privacy laws, payment processing standards, investing regulations, and standard security protocols. Keeping up and complying with all the requirements is difficult but necessary. Regulators won’t hack you or steal your data, but they will impose severe penalties if you suffer a data breach due to lax security or compliance.

Tips for mitigating cyber risks 

To help organizations fortify existing plans, the National Security Agency (NSA) has a list of recommendations and best practices for mitigating cyberattacks. 

1. Update and upgrade software 

Apply all software updates as soon as they are available. The process should be automated as cybercriminals work round the clock to engineer exploits almost as soon as a patch is released. These “N-day” exploits can be as damaging as a zero-day. Vendor updates must also, be authentic; updates are typically signed and delivered over protected links to assure the integrity of the content. Without rapid and thorough patch application, threat actors can operate inside a defender’s patch cycle.  

2. Limit and control account access 

Follow a zero-trust approach. Under this model, account privileges are assigned sparingly only as users need them. Have documented procedures for securely resetting credentials or use a privileged access management tool to automate credential management. Also, update your onboarding and offboarding procedures to align with a zero-trust approach. 

 3. Formalize a disaster recovery plan 

Formalizing a disaster recovery plan (DRP) is key to effectively mitigating cyberattacks. Your plan should start with business continuity and address data protection, data restoration, offsite backups, system reconstitution, configurations, and logs. Remember, a DRP is not a static document; it should be continuously reviewed and updated. Building periodic reviews into your overall cybersecurity risk management plan will help identify any gaps. 

 4. Actively manage systems and configurations 

Regularly scan and take inventory of your network devices and software. Remove unnecessary or unexpected hardware and software from the network. Such hygiene contributes to cyber risk mitigation by reducing the attack surface and establishing control of the operational environment. 

 5. Continuously Hunt for network intrusions 

Operate under the assumption that a compromise has occurred and take proactive measures to detect, contain and remove any malicious presence. Automated tools like endpoint detection and response endpoint detection are paired with hunt operations and penetration testing. Such steps can evolve your cybersecurity defense strategies beyond basic detection methods and toward real-time threat detection and remediation. 

6. Leverage hardware security features 

Contemporary hardware security features built into modern computers can increase system integrity. Schedule older devices for a hardware refresh, or at the least, use an updated operating system on outdated hardware. This can help better protect systems, critical data, and user credentials from threat actors. 

7. Leverage multifactor authentication 

Multifactor authentication is a necessity for mitigating cyberattacks. Use this protection for accounts with elevated privileges, remote access, and/or containing high-value assets. Physical token-based authentication systems should be used to supplement knowledge-based factors such as passwords and PINs. 

 8. Monitor third-party security posture 

Vendors, third-party suppliers, and clients that do business with you present a unique set of security risks. External partners often have access to your organization’s sensitive data or support essential business processes. It’s critical that you continuously monitor third-party risks and properly assess partner cybersecurity plans to help secure your assets. 

9. Assume insider threats exist 

Insider threats occur in various forms, ranging from intentional misuse of system access and confidential information to inadvertent errors like clicking on a phishing email. Consider adopting a layered approach for addressing insider threats, including regular assessments and ongoing employee training and awareness campaigns.  

10. Integrate Threat Reputation Services 

Leverage multi-sourced threat reputation services for files, DNS, URLs, IPs, and email addresses. Reputation services assist in the detection and prevention of malicious events and allow for rapid global responses to threats, a reduction of exposure from known threats, and provide access to a much larger threat analysis and tipping capability than an organization can provide on its own. Emerging threats, whether targeted or global campaigns, occur faster than most organizations can handle, resulting in poor coverage of new threats. Multi-source reputation and information-sharing services can provide a more timely and effective security posture against dynamic threat actors. 

Kinds of uncertainties resulting from cyber risks 

FinTech uncertainties can be broadly divided into three categories: 

The dominance, of banks over technology: Despite growing technologies, there are still many banks that prefer to work traditionally. These banks fear technological disruption. Their reluctance to emerging technology and preference for traditional working culture makes the future of FinTech uncertain. 

Data breach: Information theft or data breach is one of the important challenges for FinTech. From credit card and bank account numbers to addresses and security question answers, fintech apps contain an incredible amount of personal and financial data. This sensitive data is highly coveted by cyber attackers looking to either use the data to commit financial fraud or profit by selling it to others. Cybercriminals steal information and sell it for monetary gain. Stolen information is also used by hacker groups to send phishing emails, emulate personal identity, illegally transfer money, money laundering, and fund nation-state terrorist activities. Surging data breaches is a cause of concern for financial institutions since it adds to the uncertainty of FinTech security. 

Business logic flaws present the most dangerous type of vulnerabilities that make it possible for users to exploit the legitimate functionality of your application to gain access to sensitive data and must be identified and corrected before hackers have a chance to exploit them.

They are also very time-consuming and difficult to test for manually because you have to craft a separate test for every possible way the API could be abused.

Cyber risk: The unrivaled threat of cyber risk is creating havoc in the FinTech industry. Only a handful of cyber incidents are reported from a massive pool of total cyber incidents per year. Many financial institutions believe that concealing cyber incidents helps them not to reduce their market value. However, the reality is something else. A financial institution may be attacked again if the vulnerabilities are not fixed. Implementing a cyber risk management solution is necessary to compute cyber risks in advance and plan some measures to mitigate them at the earliest. 

Handling uncertainty for FinTech cybersecurity risk 

Based on the types of cyber risks and uncertainties resulting from them, the following measures can be adopted to reduce the impact of these uncertainties. 

Secure digital transactions: Digital transactions need to be governed by a secure communications protocol standard that ensures the security of credit card transactions over the Internet. One example of a secure communication protocol standard is Secure Electronic Transaction (SET). It was initially supported by Mastercard, Visa, Microsoft, Netscape, and others. It uses a digital certificate that verifies a transaction among merchants by using a combination of digital signatures and digital certificates. In this way, it enforces the privacy and confidentiality of digital data. 

Know your vulnerabilities: One basic principle of cybersecurity is knowing the enemies you need to fight with. For an effective FinTech cybersecurity risk management system, it is imperative to list the vulnerabilities in the system that may be exposed to internal and external threats. Once weaknesses are known, proper measures can be taken to fix them to avoid any risks. 

Compute risks: FinTech companies must be aware of the potential cyber risks that can impact their business. Computed risk scores help to prioritize some risks over others. This way, companies can address severe risks with appropriate remedies. 

Backup data regularly: One of the protective measures in the cybersecurity arsenal is to back up the data at regular intervals of time. It aids in keeping a copy of the essential data files on an alternative server. In case the primary server is under a distributed denial of service attack or ransomware attack, the users can access their data from the alternative server. It also always ensures the availability of data. 

How Rainbow Secure helps a Fintech Organisation 

Agility wins in the fast-moving world of financial services. Banking and FI platforms and data are some of the most valuable in the world and must be protected from cyber-attacks. 

Recent breaches:  

• Employee & customer personal & financial info exposed on the dark web 
• Unauthorized changes to eWallets 
• Customer credit data exposed 
• Phishing attacks on customers and employees of Banks & crypto customers 

Hacked employee credentials & improper access were the main reasons for these breaches. 

Rainbow Secure eliminates cyber threats such as account takeover, phishing, DDOS ransomware, password reuse, stolen credentials, keylogger, and insider threat and reduces data breach incidents.  

Rainbow Secure Solutions for Banking and Financial Institutions 

Secure Workforce & Customer login Use Authentication Plug-in by Rainbow Secure to secure workforce and customer logins. In this plug-in, you get a multi-dimensional password, passwordless login solutions with AI monitoring, Risk Analytics, and location fencing. 

Meet Compliance Requirements: Use Authentication Plug-in by Rainbow

Secure with your business application and in SSO (Single Sign-on) and meet industry standards and compliance regulations such as NIST, ISO, FTC, SOX, SOC2, CMMC, CMMI, HIPAA, PCI, and others. 

Securely communicate and Collaborate: Use Secure Business Email by Rainbow Secure and get protection against account takeover, phishing, ransomware, and automated login cyber frauds. In this email, you get options to send encrypted emails, single sign-on with Office 365, and Google, and 1 TB one drive storage. 

Connect Business applications: Get one unified login using Rainbow Secure Single Sign-On  

Manage User Onboarding / OffBoarding using Rainbow Secure IAM 

Verify User using Smart Multi-factor MFA 

 Contact us at hello@rainbowsecure.com