January Consumer Cyber Safety Pulse Report

What you need to know about Covid and Popular Shows scams (and why they won’t go away). Plus, online tracking, and the 2021 year’s greatest hacks 

You might expect a new year to ring out the old and ring in the new, but that is might not be the case when it comes to your Cyber Safety in 2022. Old threats to your online privacy and security are likely to overstay their welcome, and new cyberthreats are always on deck. 

We crunched the numbers for our fourth quarterly Consumer Cyber Safety Pulse Report, and we’re sharing a look back at cyberthreats from the final three months of the year, plus we’ve captured a full overview of 2021.

In this Pulse Report, the Norton Labs team rounds up noteworthy phishing finds, uncovers online tracking, and digs into 2021 top exploits and breaches. 

Cyber Safety threats by the numbers 

NortonLifeLock technology blocked more than 9 million cyberthreats on an average every day in 2021. In New Zealand, Norton technology blocked 6,327,788 cyberthreats during the last quarter - an average of 68,780 blocks per day between October and December

Here’s a closer look at the numbers from October through December and for all of 2021.

Spotlight #1 – Recent Phishing and Scam Samples 

Phishing emails and scams top the list of threats. Each quarter we like to highlight some of the more interesting or unique pages that we have recently found. Three themes this past quarter were COVID, Cupid, and culture.

• Covid-19 scams. Goal: Steal your personal information and money.        
• Dating website scams. Goal: There is no love to be found here. These scammers only want your personal information.        
• Pop-culture scams. Goal: Swipe your personal information and cash for trendy but fake items.

A Covid-related phishing page. Much like how the virus seems never-ending, the Covid phishing attempts are relentless and mutating.

A phishing page resembling Match.com trying to grab usernames and passwords. It’s been a lonely pandemic, with dating site use significantly increased they’re ripe targets for phishers. 

A website leveraging interest in popular shows to collect personal information to contact you. 

Spotlight #2 – Online Tracking 

It’s common knowledge that web trackers know an astonishing amount of information about you. Our new research discovered that sometimes they know as much as twice what was previously found. And even if you delete your browser’s your data history, they can reconstruct your online activities within hours. 

Background:

Web tracking keeps tabs of what you do online. It plays a role in the web advertising industry and is the target of legislative efforts to rein it in. 

Can trackers really track every movement of web users? Pretty much.

How it works:

We looked at how web trackers are following users around the internet We found previous studies underestimate the knowledge that trackers have and how quickly they collect this information. 

Surprises we found:        

• Top Trackers: Our study reveals that top trackers can see 73% of an average user’s browsing history despite appearing on a smaller number of unique domains.       
• The power of sharing: We also estimate how much additional knowledge organizations can gain if they cooperate. Two organizations would see a 5% bump if they shared data; more than two organizations cooperating could push that number up to 50%.        
• Getting to know you — quickly: Consumers encounter, on average, 177 tracking organizations in one week. They will encounter half of those trackers in the first two hours of browsing. In other words, if the user were to start with a fresh browser it would only take two hours on average to re-encounter 50% of all trackers.

Advice for consumers:

Web trackers have a vested interest in knowing as much about you as is technologically possible. It doesn’t have to be that way. You can take steps to help protect your web activities from snoops. For instance, a VPN and private browsing can help. 

Spotlight #3 – A big year for exploits and breaches 

You might like to breathe a sigh of relief that the hacks and breaches of 2021 are behind us. But not so fast. You might feel the effects of some of these cyberthreats for years. Presenting the highlights (and low lights) of the year: 

Breach roundup: 

LinkedIn scrape: Though originally suspected to be an actual breach, an investigation in April 2021 revealed that LinkedIn’s website had been scraped, collecting public information of more than 700 million users. After failing to sell the data, it was dumped for all to see.

Twitch incident: The well-known gamer streaming platform Twitch confirmed it was the target of a data breach in October 2021, of which more than 100GB was posted online. Included in the dumped data were earnings of one of the platform’s most popular streamers over the past two years. Most damaging to the company, however, was their acknowledgement that the breach also included the source code that drives their platform. 

Stripchat breach: In November of 2021 the adult webcam site Stripchat revealed that 200 million records were stolen by cybercriminals. The breach was particularly concerning as it contained not only personal identifiable information (PII) of customers and some of the models, but also more than 700,000 private messages that could eventually lead to blackmail. 

Robinhood incident: Also in November of 2021, online trading platform Robinhood disclosed a breach of about 300 of their customers. The breach was significant not in scale, but because it was the result of attackers using social engineering to convince an internal Robinhood support representative to disclose information that led to the compromise — all over a phone call.

Hack roundup:

Kaseya vulnerability: In July 2021, nearly 2,000 companies whose networks and computers are maintained by managed services companies were infected with ransomware after a vulnerability was discovered in the Kaseya VSA software used by managed services companies. A well-known criminal gang known as REvil took credit for the attack and said the operation infected more than a million systems. 

Pegasus spyware: The Pegasus Project coordinated publications in July of 2021 through multiple news outlets, detailing alleged abuses of the Pegasus spyware program made by the Israeli firm NSO group. Since the disclosures, additional articles detailing further abuses have been published leading to a lawsuit from Apple and the company being blacklisted by the U.S. Department of Commerce. 

Log4j: In November 2021, a critical bug was found in the Log4j software package used in Java — and potentially billions of devices worldwide. The ease with which the bug, nicknamed Log4shell, can be exploited — and the fact that it allows attackers to do nearly anything they want on affected systems — established the vulnerability as the most severe in a decade.

Bottom line: 

Though 2021 brought some significant data breaches and concerning hacks, the global cybersecurity community has once again coordinated to share information and develop systems to help businesses and consumers.

Looking ahead 

Norton Labs continues to track scams and cyberthreats targeting consumers. Find out more when we publish our next Consumer Cyber Safety Pulse Report in April.