A report from Consumer watchdog Which? reveals that as many as 1.1 million people in the UK may have been caught up in a parcel delivery ‘brushing’ scam.

What Is Brushing?

Brushing is where people are sent packages of goods to their address that they didn’t order, apparently purchased on Amazon, by a person not known to them. Which? believes that third-party unscrupulous sellers, or agents acting on behalf of the sellers may be sending the goods. The reason for the scam is so that third-party sellers can log the deliveries as genuine sales, thereby boosting their own rankings on the highly competitive Amazon platform which favours products with high sales volumes and good reviews.

Where Do The Sellers Find The Addresses?

According to Amazon, sellers find the names and addresses from publicly available sources. The Which? website, however, gives an example which suggests that names and addresses can be easily collected and ‘consolidated’ from a variety of sources, such as Amazon itself (via its seller platform for merchants), from a seller’s list of customers that it serves on other marketplaces and platforms, or from previously unconnected website security breaches.

Accounts Set Up In Some Cases

Which? also reports that some unscrupulous sellers take the brushing scam a step further by creating a fake Amazon account linked to the unsuspecting recipient’s address to ‘purchase’ the item themselves and then leave a glowing (fake) review.

What Kind of Items?

A separate Which? survey showed that a wide variety of items have been received by victims of the scam including LED strip lights, books, envelopes, sunglasses, and headphones.

What Is Amazon Doing About Brushing Scam?

Amazon says it has ‘robust’ processes in place to prevent brushing, which it says are carried out by ‘bad actors’ using data from ‘external sources.’

What Happens To The Parcels?

Amazon’s reported position is that customers don’t need to return the items and can choose to keep the parcels or throw them away, whichever they find more convenient.

The Which? research shows that where there was an Amazon parcel not ordered by the recipient, not sent by a known person, and not taken in for a neighbour, 63 per cent said they kept them, 18 per cent said they threw them away, and 16 per cent said they gave the item away.

What Does This Mean For Your Business?

Although it may sound like a positive thing to be the ‘victim’ recipient of lots of goods that you don’t have to give back, there are some serious issues here. Some would argue that it’s not enough for Amazon to simply say that recipients can do what they like with the parcels, and the fact that the scam exists is a sign that that the system of the platform is not working as it should. Which? wants Amazon to do more to increase its scrutiny of seller profiles and monitor for suspicious activity that could suggest product purchases and reviews are not genuine. The apparent fake reviews that result from the fake sales are also something that could adversely affect Amazon customers and create a more unfair situation for the other Amazon sellers who behave honestly. A better position by Amazon could be to encourage those who have received unsolicited packages to report them to customer services so that it can investigate fully and take robust action against sellers that are attempting to mislead consumers. This would benefit other Amazon sellers and customers alike. There is also an argument that laws should be introduced to crack down on brushing and force tech giants to protect people online. It should also be noted that, at a time when environmental issues are high on the world’s priority list, more goods simply being thrown away is not helping (as in the case of 18 per cent of brushing recipients) .

The latest “ThreatLabz: The State of Encrypted Attacks,” 2021 report has shown a 300 per cent increase in online attackers using HTTPS to cloak their activities and blend in with other traffic.

HTTPS

HTTPS, the encrypted version of the Hypertext Transfer Protocol (HTTP), enables secure communication over a computer network, using Transport Layer Security (formerly, Secure Sockets Layer). HTTPS is particularly important for protecting the kind of personal data that’s submitted in online activities like shopping, banking, and remote work.

Massive Increase

The ThreatLabz report showed that threats inside encrypted traffic have increased 314 per cent as online attackers choose HTTPS to cloak their activities.

How?

Cybercriminals can use HTTPS to hide threats like malware from web security tools that don’t fully inspect encrypted traffic.

Why?

The rise of this type of attack has been driven by factors such as:

– Google making it known that the presence of HTTPS is an important consideration for search-results rankings, and Chrome and Firefox showing warnings about sites without HHTPS, thereby fuelling a general belief that HTTPS is totally safe.

– Attackers (as well as legitimate businesses) can now enable and auto-renew HTTPS for their sites, regardless of whether the content is suspect.

– New types of malware are now being shared behind a lock symbol.

Types of Attack

The types of attack that criminals are using HTTPS to hide include:

– Malware (including ransomware). This type of attack has grown by 212 percent and nine out of ten attacks via HTTP(S) involved malware. Spyware has also shown a 435 per cent increase.

– Phishing has grown by 90 per cent on last year and is being driven by attacks launched through legitimate services. For example, Microsoft 365 was the most common attack vector for phishers.

– Web applications like credential stuffing. For example, the ThreatLabz report shows that attackers interacted with almost 70 per cent of HTTPS-based web-facing applications.

Who Was Attacked The Most?

The report showed that technology companies were attacked the most using HTTPS cloaking (a 2,344 per cent rise) followed by retail and wholesale companies which saw an 841 percent increase in this type of stealth attack. Increased scrutiny by law enforcement on healthcare companies/organisations and government (which have been heavily targeted before) appears to be the reason for a decrease in the numbers of HTTPS-based attacks on these targets.

What To Do?

Ways that businesses can protect themselves against cybercriminals hiding attacks using HTTPs include:

– Not assuming that SSL traffic is automatically secure traffic – the padlock icon of HTTPS does not guarantee security.

– Start from a position of zero trust, where there is no lateral movement, apps are invisible to attackers, and authorised users directly can only access needed resources, not the entire network.

– If possible, use AI-driven quarantine rather than firewall-based passthrough approaches.

– Use a proxy-based architecture and cloud-native performance to decrypt detect and prevent threats from SSL traffic.

– Make sure all company network users have the same high level of security at all times, at all locations (e.g., when working remotely or even when on the go). All traffic on and off-premises needs to be inspected to stop encrypted threats.

What Does This Mean For Your Business?

Even though HTTPS has been designed to provide a valuable layer of encryption, it has also become relatively easy for cybercriminals to create websites with the HTTPS distinction. Also, cybercriminals have been helped by an assumption that HTTPS and a padlock must mean that everything is secure, and by web security tools which don’t fully inspect and check encrypted traffic, on and off-premises. Businesses should not assume the HTTPS is totally secure and one of the key ways that many businesses are now protecting themselves from a wide range of threats, including HTTPS-based attacks, is to adopt a Zero Trust approach to IT Security where the approach is “never trust, always verify.”

After one of the most publicised re-brands in history, as Facebook changes its name to ‘Meta,’ we look at the reaction in the media and the marketplace, and the issues for the company going forward.

‘Meta’ … ?

Facebook CEO Mark Zuckerberg announced at Connect 2021 last week that the company had brought together its apps and technologies under the new company brand name of ‘Meta’. It was explained that the re-branded “Social Technology Company” had changed its name to Meta because it is short for ‘metaverse,’ which is Zuckerberg’s vision for the future of the platform.

What Is ‘Metaverse’?

Currently more of a concept than a (virtual) reality, Zuckerberg describes the metaverse as “even more immersive – an embodied internet where you’re in the experience, not just looking at it.”  He went on to explain that “the defining quality of the metaverse will be a feeling of presence — like you are right there with another person or in another place. Feeling truly present with another person is the ultimate dream of social technology”, and that “In the metaverse, you’ll be able to do almost anything you can imagine — get together with friends and family, work, learn, play, shop, create — as well as completely new experiences that don’t really fit how we think about computers or phones today”.

Wave of Criticism

Inevitably, Facebook’s announcement led to a wave of criticism online including:

– U.S. lawmaker Alexandria -Ocasio Cortez Tweeting “Meta as in ‘we are a cancer to democracy metastasizing into a global surveillance and propaganda machine for boosting authoritarian regimes and destroying civil society’… for profit!”

– Criticism that the timing may be a step for the company to distance itself from recent controversy.

– Former Biden White House adviser, Andy Slavitt, Tweeting “Meta accomplishes only one thing. It allows Mark Zuckerberg to say he’s not the CEO of Facebook. He will now do less controversial things like build a new virtual universe where he can be king. While running Facebook.”

– Nicola Mendelsohn, Facebook’s vice president of Meta for Europe, the Middle East and Africa Faced some tough interviews and accusations that (as highlighted by former Facebook employee-turned-whistleblower, Frances Haugen) the company is putting profit before people, not addressing alleged issues about the safety of young users (Facebook and Instagram). For example, Frances Haugen claimed that Facebook was “unquestionably” making online hate worse, and told UK MPs that safety teams were under-resourced, leading to “Facebook has been unwilling to accept even little slivers of profit being sacrificed for safety” and being “more dangerous than other forms of social media”.

Sounds Like Hebrew Word For ‘Dead’

Whereas the name “Meta” comes from the Greek word meaning “beyond,” the company has faced some criticism from Israel where it has been pointed out that “Meta” sounds like the Hebrew pronunciation of the word for “dead”.

It Could Be Much Worse…

If this is the case, the new name could be joining a long list of famous marketing naming blunders (and urban legends) including:

Nokia’s ‘Lumia’ brand translating to ‘prostitute’ in Spanish.

Apple’s ‘Siri’ personal assistant is pronounced in Japan as “shiri” which translates to ‘buttocks.’

Nintendo’s much ridiculed 2005 decision to name their Touch Dictionary service in South Korea as ‘Touch Dic’.

Facebook Answers

Facebook has been answering its critics by saying that the platform is being wrongly portrayed as a place that is awash with danger and hate speech. For example, Nicola Mendelson has highlighted how the company is spending £3.6bn this year “on protecting people’s safety, data and their privacy on our platforms”, and that “We make our money from advertising. Advertisers don’t want their ads next to harmful content.”

Mark Zuckerberg has described recent allegations that Instagram harmed teenage mental health as a “coordinated effort to selectively use leaked documents to paint a false picture of our company”.

So, What IS The Metaverse?

Mark Zuckerberg sees ‘Meta’ as a better way to “encompass” the company’s future direction beyond social media, as it moves more into virtual reality, gaming, and creating its own immersive virtual world where users will become more engaged by and committed to the new different and experiences on offer. There is also the notion that Facebook may want to be seen as trying to set users free from simply being tied to the screen and craving likes and offering some kind of more genuine human experience.

The vision, however, may not be realised for another five years or so and in the meantime, despite the rebrand, it is unlikely to deflect attention away from what many people (including some governments) see as still pressing issues that Facebook may not have convincingly addressed.

Competition

Competitively, this is a move to differentiate itself from competitors, dictate and lead in what it sees as the future for social media technology, and prove that a rebrand of this scale can work. For example, Alphabet Inc and Google may still be perceived as a separate parent company and another brand.

What Does This Mean for Your Business?

Some would argue that given the metaverse concept is years away and can be made to sound as brilliant as Facebook (now Meta) wishes is a great way to try and deflect and escape from much of the bad publicity that the company has received recently (e.g., the revelations from whistleblower, Frances Haugen). The announcement, however, appears to have drawn more criticism, stirred up some negative feelings and trust issues about the company, and caused some people to suggest that there are more pressing issues than a re-brand and a future vision i.e., making the platforms (Facebook and Instagram) safe for young users. Facebook/Meta has defended the progress it has made (thanks to AI), has suggested that it is not as bad as it is being portrayed, and is staking its claim as the most forward-thinking of the social media giants. New questions about old issues have now been asked such as : how will this new metaverse be effectively governed? Facebook/Meta has pointed out that it gets much of its revenue from advertising and advertisers would not want to be associated with Facebook if it was as irreputable as some say. The metaverse, however, may present many new and interesting advertising opportunities for companies, thereby potentially making it more profitable for Facebook than the current system. Until we actually see the metaverse it will be difficult to tell how much of a new experience it offers.

Trying to open a file where you don’t know the file type and there’s no extension can be frustrating, time-consuming and potentially insecure so here are options to help: