June 2017 - Parks & Recreation - 50

Operations

The Digital Imposter
After penetrating your website, a hacker can do business as you
By Joe Dysart

n the latest twist on identity theft, hackers are clandestinely taking over business
websites - and then brazenly billing the customers who visit those sites as if the
sites are their own. While any sort of website identity theft is alarming, the version that results in a hacker taking command and control of your website - and
ultimately your business dealings - is especially brutal.
Under this scenario, hackers find a way
to break into your website, and then take
over all the interfaces your business uses
to operate it. Simultaneously, the hacker
also gets access to your business' accounts
payable and receivables software, as well
as its email correspondence software.
With all the tools in hand to do business
as you, the hacker begins cutting deals
with your customers via your website,
instructing them to wire payments for
goods and services to a new bank account
- one that the hacker owns and operates.
After a few quick deals, the hacker vanishes - along with all the cash that has
been wired to his or her bank account. Ultimately, the victimized business or organi-

zation only finds out about the scam weeks
or months later, when hordes of angry customers start calling, demanding goods and
services that were never delivered.
Perhaps most unsettling about this new
spin on cybercrime is that even the most
strongly secured websites are vulnerable. " Security will always be an evolving arms race between the attackers and
defenders, " says Adolfo Cruz, director,
Parks, Recreation and Community Services Department, Riverside, California.
Indeed, IT security researcher Arun
Sureshkuma proved that reality with
chilling clarity last summer, when he
demonstrated how he could hack any
Facebook page - and take over that

page as its administrator - in less than
10 seconds (http://bit.ly/2qobTkr).
Moreover, once established as administrator, Sureshkuma could have easily set
up payment processing on the hijacked
page for any sort of deals he felt like
making, using popular payment processors like PayPal and Stripe (http://bit.
ly/2qgrKXa).
Sureshkuma did alert the social media goliath to the security glitch, which
it immediately patched. But, his ruse
underscored a hard reality: No business,
no matter how seemingly powerful and
mighty, is immune to website identity
theft. According to an April 2016 study
from Symantec, an IT security firm,
more than 75 percent of popular sites on
the web have unpatched vulnerabilities
(http://symc.ly/2qBx2cG). Online fraud
is expected to reach $25.6 billion by 2020,
up $10.7 billion from 2015, according to a
2016 study by Juniper Research.
" While no website is hack-proof - evidenced by the worldwide hacking group,
" Anonymous, " hacking high-profile government organizations - there are a
number of best practices that should redundantly cover your bases, " says Zack
Poelwijk, a senior marketing consultant
for Limelight Development, a web services firm. " The importance in this space
is to be preventative, not reactive. "
Following is a list of preventative measures that web security experts suggest
you take to make your website less vulnerable to hacking:

Joe Dysart is an Internet Speaker and Business
Consultant based in Manhattan (joe@joedysart.
com).

Parks & Recreation

| J U N E 2 0 1 7 | W W W. PA R K S A N D R E C R E AT I O N . O R G

June 2017 - Parks & Recreation

Table of Contents for the Digital Edition of June 2017 - Parks & Recreation