Radia L wrote:
-
- As far as I can see, this happened to freelancers in South Asia only. Am I wrong? What other similar point between these cases? If it's a phishing or social engineering case, how and where it happened?
I'm in information security. The attack vector here is the end-user (as it is unlikely that Upwork is being hacked). To be able to pull such an attack, the following logical steps need to be done:
1. The attacker must get the FL/Agency Upwork account credentials (e.g., username/password) via compromising a computer or a mobile device. The attacker either has RAT (remote access tool) that captures typing or malware that is harvested the passwords, for example, saved in Google Chrome (it's quite easy to read passwords saved in Chrome).
Maybe there was a phishing email where the end-user clicked on a link and was tricked into providing the credentials.
Possible mitigations: Have a proper AV system installed on the endpoints, have an up-to-date operating system, and learn about phishing and how to recognize it. ENABLE Multifactor authentication, so when a new IP, browser, or OS is trying to log in, an additional step is needed to verify the login.
2. The attacker has to add its bank credentials to Upwork. In order to do that: They must create an account which is matching the FL/Agency name. To get this, they may a) find a person with a similar name willing to cooperate, to open the bank account b) forger/fake an ID/company documents that can be used to open the bank account. Opening a bank account can be done within 24 hours nowadays, using an all-online process.
3) The attacker has to wait for the Upwork account verification process, which, when I had done it, took 3 days. I don't know what is the current timeline for this.
Possible mitigation: Upwork should send an e-mail or text notification to the FL that a new bank account was added. I don't know if it is already done and the attacker has captured and deleted these messages, or it is not done at all.
4) The attacker pulls down the money from Upwork to the newly created and added bank account. The get paid now only requires the same password.
Possible mitigation: Upwork could require MFA confirmation for manual withdrawal. But that would only work if MFA is enabled on the FL account (which would prevent the breach).
Upwork is not a bank, so keeping money in the account is not a good idea. From UW's standpoint, they have followed all the procedures and safeguards related to the payment method, and the responsibility here falls to the FL to protect its account information. I'm pretty sure Upwork is investigating the case, and I'm certain that what they will find:
- During a period, there will be a number of IP addresses that have accessed the account
- They will filter down the ones that are regular IP addresses and try to identify the attackers IP, which should be only seen a couple of times accessing UW, as the attacker does not log in ofter to check jobs or do other activities, only to do the necessary steps for the attack.
- Once they have identified the attackers IP, they most probably will find it out that it is 1) belongs to a no-log VPN service, 2) a TOR exit node, 3) a compromised (zombie) host no matter what it is, but the attacker ensures that it is in the same geographical region as the freelancer legit address is.
- Now they can't identify the attacker by IP; they might be able to contact the MUFGs compliance and fraud team (if they will and have the drive for it) to report the incident and ask for cooperation, but there is a big problem here. This is something international; someone's money - who is from Pakistan, India, etc. - was stolen from a US company (Upwork Escrow which is a Delaware registered entity) which is not even a bank, to one of the largest banks in Japan. So which police should investigate the case? Who should report the incident? To which jurisdiction? The MUFG Fraud team will not answer questions from a US company representing an FL in another country. They are not going to answer as in Japan (anywhere in the world), there is a bank secrecy act, privacy protection acts, etc.; they simply can't share by law the details of their customers without a formal law enforcement inquiry.
I have worked at a small bank's Fraud and Security team; we were swamped in police requests, and our lead time to answer them was 30-45 days (and that was a very small bank compared to MUFG). So even if MUFG would answer any questions to Upwork (and they won't, but if they would), that would take, I guess, somewhere between 2-6 months. By that time, the money is gone from the account, and the person who opened the account is also gone.
So the summary is: while Upwork could improve in some areas (verification/notification if a new account is added to an account), it is not their responsibility to protect the FLs accounts. They have created the tools for it, but it is the responsibility of the FL to do it. I feel the loss of everyone who has been a victim of such an attack, and I would be pretty mad if it happened to me, but please try to understand, Upwork can't really do much in here.
