Indian companies and banks lose $4bn a year to hackers
Companies and banks in India are coming under attack from increasingly sophisticated hackers, with about $4bn being lost to fraud every year. Although some firms have taken cybersecurity measures to protect themselves, the pace of spending on IT protection is far behind that of countries such as the US, and the culture of secrecy surrounding attacks is also hampering their prevention. To combat the rising tide of cyber attacks, some banks are putting honeypots in place, while other firms are turning to ethical hackers to ensure their security measures are adequately robust.

MUMBAI: In May 2015, two Indian conglomerates were forced to pay $5 million each in order to prevent hackers from disclosing information that could have implicated them in a wrongdoing. Investigations revealed that the hackers had gotten into the companies' IT systems two years back but waited for a right opportunity. The blackmail demands were made only after a scam involving thefts of documents from the petroleum and other ministries erupted in 2015. The hackers threatened that both the companies pay the money or the documents and email trail would be leaked to Indian government. Eventually, both companies paid the money to the hackers.In 2014 Gujarat-based Rs, 1,500 cr BSE listed, Deepak Nitrite was surprised when one of its regular customers based in the US, didn't pay even after receiving a consignment. When the company asked the customer about the payment, they were told that the payment was made to a new account in Malaysia. The client had received an email from Deepak Nitrate's official id just earlier informing it of a change in bank account details. Deepak Nitrite had neither changed the bank account nor communicated any such thing to its customer. The Gujarat based company has filed a complaint with cyber cell of Vadodara police but nothing has come of it yet.In July this year, state run Union Bank of India was breached by cyber hackers. The hackers had managed to get past the bank’s security systems but the money trail was traced and the movement of funds was blocked. If the hackers had been successful, this could be the biggest incident even bigger than hackers stealing money from Bangladesh central bank.Biggest Indian conglomerates, mid-scale companies based in tier 2 or tier 3 cities and the country's biggest banks; everybody is being targeted by the hackers. And as the days go by, the breach attempts are not just basic as they used to be, but getting sophisticated by the day.In fact, there is a joke amongst cyber security experts: There are only two type of companies: the ones that know that they are hacked into and the ones who don’t."Increasingly, more and more Indian companies are witnessing sophisticated hacking attempts and cyber risks are increasing. Hacking attempts can be categorized in to three parts, one by amateur hackers who only deface websites, sophisticated hackers who are after money or information and state owned hackers who are guided by their country's policies," said Sivarama Krishnan, leader, cyber security, at PwC India. Krishnan heads the country's largest team of 300 cyber security experts including ethical hackers.While no figure is available officially, in-house analysis conducted by the biggest cyber security firms say that Indian companies lose anywhere around $ 4 billion every year due to cyber-attacks.Experts point out that the bigger problem in India is the secrecy, something that works in hackers' advantage. Most of the companies and promoters who are hit by the hackers prefer to push it under the carpet.The problem with pushing things under the carpet would mean, other companies who are a potential targets don't get a chance to even be prepared. Worse still, hackers do tend to share their secrets on what is famously known as the dark web—a platform where hackers interact, buy, sell information anonymously.In what appeared as a synchronised attack, hackers seized control of computers at three Indian banks and a pharmaceutical company in January this year. The hackers got into the IT system and then locked each and every computer. The hackers had demanded that the company pay one bit coin per computer so as to unfreeze the computers.Neither the banks nor the pharma company approached the police or any other investigation agency. Rather they decided to rope in a private investigator. It was found in the investigations that in all four cases, the hackers had used the Lechiffre ransomware. And how did the ransomware got downloaded in the company's IT system in the first place? In all the instances, the infection began when an email disguised as a communication from senior management was opened by some junior employees."Targeted attacks are increasing and insider related compromises are the largest in India. These are basically ones where employees, including top executives, secretaries/assistants unknowingly and innocently, click on links or open attachments or download content from genuine looking emails, and compromise the company's IT infrastructure," said Altaf Halde, managing director, South Asia, Kaspersky Lab , India.The hacking attempts on banks may still be kept under the wraps but for the Reserve Bank of India, that has now made it mandatory for the banks to disclose those. The vulnerability of the banks came into light recently when data of about 3.2 million debit cards was lost in what is claimed to the India's biggest breaches. SBI, HDFC Bank, ICICI, YES Bank and Axis were worst hit by the breach of the debit cards.The recent breaches have now led many banks to beef up their security systems. Some banks are now creating a parallel and a decoy IT system so that the hackers attack those instead of actual IT systems."Many large banks are putting honeypots in place, which are mainly parallel IT systems in the virtual world but this requires a lot of investment in terms of time, money and R&D," said Mukul Shrivastava, partner for fraud investigation and dispute services at EY. Honeypots are mainly decoy computer systems to detect cyber attackers and study how they attack the server, and then putting proper checks in actual system against similar attacks.Industry experts point out that while the banks may just have begun to realise their weakness many other Indian companies are still ignoring the threat.So grave is the threat, that even Indian information technology companies are not safe. Hackers, suspected to be based out of China, managed to break into two major IT firms last year, possibly chasing information on some American firms. While in both the cases no information was lost, the “audacity of the hackers” had shaken the firm, people close to the development said."Knowing the spend of Indian banks on cyber security versus their USA counterparts, we still have a long way to go when it comes to being equally matured against sophisticated cyber-attacks. Banks; however are the more matured among other industries like manufacturing, hospitality and health Care where the focus on cyber security is still extremely low,” said a cyber security expert.Often companies complain that whatever steps they take; hackers seem to be at least a step ahead. Enter ethical hackers who are bounty hunting weaknesses in companies’ IT systems and getting paid for it. Saket Modi , a 25-year-old techie, and CEO of Lucideus, an online cyber security firm is Blondie in the cyber world equivalent of The good, the bad and the ugly. Modi and his teammates — about 60 typical IIT engineer and ethical hackers — attack companies’ IT system to find loopholes and get paid for it. And all this is completely legal.Many companies including ecommerce and mobile app-based service providers are increasingly roping in ethical hackers to look for loopholes in their system by continuously trying to hack into them from outside and report back to the company. In some cases these ethical hackers also help companies fix the glitch."We're in the job of finding flaws across people, process and technology of an organisation's digital setup. We hack them with their permission and produce an overall maturity scorecard of the organisation providing the CEO/CFO the information about the overall cyber risk they are sitting on along with a roadmap to enhance the cyber security maturity of the organisation," said Modi, CEO at Lucideus, an online cyber security firm.Experts point out that the new age companies like Flipkart, Ola or Paytm are better prepared for the cyber hackers. These companies compared to the traditional companies have been proactive in tackling the threats."Considering the large number of vulnerabilities that we find across platforms, I believe companies should focus on pro-actively building secure products than to later spend on security products to reduce the risk," said Modi.While bounty hunting by security experts may be one of the flashiest of the techniques that’s not the only trick experts have up their sleeves. During a conversation cyber security head of PwC said that some of its tech experts do monitor even the dark web, disguised as hackers. This is mainly to keep an eye on what’s happening behind the closed door, and if they can stay a step ahead of the hackers. Recently, many Indian companies have been informed about attacks and vulnerabilities on similar companies across the world.So In January this year when American hotel chain Hyatt Hotels Corporation said its properties in India were also hit by a malware that was found on its customer payments system, many other Indian hotels sprung into action.In many cases a malware was sent to the hotel networks either through emails attachments. In some cases the malware was sent through the hotel WiFi networks, said cyber experts. One of the latest entrants in a slew of malwares targeted at hotels is 'darkhotel'. The malware is said to be used by hackers to spy on business travellers/corporates, who conduct meetings in top hotels. The modus-operandi of the hackers is to gain access to computers or phones of the corporate, while using the hotel's WiFi services. Many five star hotels, which conducted the investigations, found that several of their WiFi networks to be compromised. Thankfully for them neither these breaches were made public, nor has any customer come forward claiming that they have lost the data. If the things go as they are already, it might not be long before that happens.