A fortnight past, the demonetization of Indian notes of Rs. 500 and Rs. 1000 denomination continues to strap the common people of cold, hard cash. Cash, which used to be the King in India, is now a royal pain. While the Prime Minister has assured that the fluidity of money is likely to be restored in a matter of 50 days (starting 14th Nov), the battle against black money is combating the interest of the common man.

Simultaneously, Fintech companies are cashing in on the opportunity of cashless wallet payments, coming as a relief to the sea of tech-friendly population. To facilitate payments via Mobile Wallets, the Reserve Bank of India recently raised the limit of monthly money transfer via Prepaid Payment Instruments (PPIs) from 10,000 to 20,000. While, the #PaytmKaro effect is springing leaps and bounds, other Prepaid Payment solutions providers like Freecharge, Oxigen Wallet, and Mobikwik are seen picking up a significant pace.

Paytm and Freecharge share their year as well as concept of inception, the former has evolved at a much higher scale, thanks to its union with e-commerce giant Alibaba. While we already wrapped up how Paytm functions, this article gives an in-depth look into Freecharge as it is the second most favourite choice as mobile wallet.

How To SignUp:

Freecharge is currently supported on Android, iOS as well as on Windows Phones. In order to register for cashless money transfer using Freecharge App, you must enter the following personal details:

• Name,
• Mobile number, and
• email id

Following, an OTP is generated and delivered the registered mobile number for the purpose of verification. Entering the OTP completes the process of registration.

How to Add Money into your Wallet:

You can add money to your Freecharge wallet in a jiffy using standard options like a Debit or Credit card, or by using Netbanking.

How to Pay Using Freecharge:

To pay via Freecharge you can choose from the following modes:

             

1. Enter payee’s mobile number associated with Freecharge, or
2. If you are not willing to share your phone number, you may scan merchant’s QR code, or
3. Allow merchant to scan QR code on your phone
4. Pay merchants or vendors who are registered with Freecharge using an “ON-THE-GO” pin, or
5. Keep your phone near ToneTag-enabled device for a sound-enabled linkage.

             

How to Receive Money by Freecharge:

Sending money is a convenience, thanks to a score of options listed above. But, the option of receiving money is limited to entering the mobile number of the person you are requesting payment from. The option of scanning any graphical code is not available for sending money.

The person is then notified of your request for money via an SMS and message within the Freecharge app on their phone. This, however, does not guarantee if you will receive the solicited payment or not.

Transferring money from Freecharge into Bank Account:

You may choose to transfer money from your Freecharge account to your bank account by tapping on the Withdraw option. For wallet-to-bank transfers, there is a limit of Rs. 5000 per transaction, Rs. 20,000 per day and Rs. 25,000 per month. While Paytm levies a charge of 1% for its non-premium customers up to Rs. 50,000, Freecharge has waived off charges for bank transfer. The limit, however, remains unchanged.

Additional Features:

When using the Freecharge app, you don’t have to hop between your messenger and Freecharge while keeping a tab on your payment. You can easily communicate via (Instant Messaging) IM-style interface with your contacts while requesting them for money.

             

Users can sign up for a virtual MasterCard to enable online transactions, restricted to India.

The parent company, Snapdeal has realized “Wallet on Delivery” service to do away with the hassles of cash or change, appealing to online shoppers.

Freecharge, similar to Paytm offers a variety of Cashback offers and purchase options in its online store.

Although buying using Paytm or Freecharge from your go-to vendor for veggies could still be a far off vision in Tier II and Tier III cities, Metros have witnessed notable growth in vendors and merchants willing to use the cashless methods. These Fintech enterprises are popularizing the idea through extensive marketing, and armies of field agents. They are also seeking support from existing to raise awareness of their services. The question lies in whether these promotions and incentives  will help consumers in the long run or not.

Cyber miscreants have developed a new strain of malware based on Mirai to turn insecure IoT devices into a DDoS attack platform.

Last week, a distributed denial of service attack (DDoS) on DNS provider Dyn last week managed to disrupt an array of the internet’s biggest websites, including Spotify, Twitter, and PayPal.

What was most interesting about this attack was that it was largely carried out using an Internet of Things (IoT) botnet called Mirai (Linux.Gafgyt).

The new version of this malware has been discovered by security researchers at MalwareMustDie.org and relies on default hard-coded credentials to spread across vulnerable devices like the infamous Mirai botnet. The malware is primed for DDoS and IPv6 ready.

According to the researchers, it is designed to target IoT device via telnet protocol. It then deploys the originally coded telnet scanner function, which is brute-forcing the known vulnerable credential of the Linux IoT boxes, via a command sent from a CNC malicious IRC server.

The botnet is having DoS attack mechanism like UDP flood, TCP flood, along with other attack methods, in both IPv4 and IPv6 protocol, with extra IP spoof option in IPv4 or IPv6 too.

When did Mirai emerge?

Mirai first came to public attention when it was used in a huge DDoS attack against the website of journalist Brian Krebs, which reached 620 Gbps, on September 20. The source code for the botnet was then publicly released on the English-language hacking community Hack forums on September 30 by a user using the screen name Anna-senpai.

How does Mirai work?

Mirai works by exploiting the weak security on many IoT devices. It operates by continuously scanning for IoT devices that are accessible over the internet and are protected by factory default or hardcoded user names and passwords. In a Security Response blog last month, Symantec indicated that the default user names and passwords for IoT devices are often never changed. Mirai infects devices with malware that forces them to report to a central control server, turning them into a bot that can be used in DDoS attacks.

In which attacks has Mirai been used?

Following the aforementioned Krebs attacks, which was record-breaking at the time, Mirai was used in an attack on French hosting company OVH that peaked at 1 Tbps. However, it was last week’s attack on Dyn, which brought the internet to a standstill and raised questions about how powerful these DDoS attacks could become. In a blog following the attack, Dyn said it had “observed 10s of millions of discrete IP addresses associated with the Mirai botnet that were part of the attack.” Upon further analysis, Dyn lowered that estimate.

What devices are at risk of exploitation/infection?

Routers, DVRs, CCTV cameras, and any other ‘smart’, internet-connected appliances are at risk of attack. Webcams were the primary devices exploited in the Dyn attack, while CCTV cameras are believed to have been the IoT device primarily utilized in the attack on OVH. These devices weren’t protected by a firewall or router using NAT, which allowed them to be easily compromised. Additionally, many IoT devices take advantage of a feature known as Universal Plug and Play (UPnP) which opens a port on the router to allow them to be accessible from the internet.

How are device manufacturers responding?

The Chinese electronics firm behind many of the webcams used in the attack on Dyn’s services, XiongMai Technologies, issued a recall for many of its devices following the attack.

What is the likelihood my device will be attacked?

Analysis this week by Symantec concluded the average IoT device is scanned every two minutes. This means that a vulnerable device, such as one with a default password, could be compromised within minutes of going online.

Why are IoT devices being targeted?

Poor security on many IoT devices makes them soft targets and attackers often pre-program their malware with commonly used and default passwords. Processing power limitations and basic operating systems mean many IoT devices don’t have advanced security features. As they are often designed to be plugged in and forgotten about, owners often don’t apply security updates and it is easy for an attack on such devices to go unnoticed.

Why was Mirai’s source code leaked?

This is unknown. However, leaks often occur when attackers become concerned about discovery and want to “muddy the waters” by putting the malware in the hands of more attackers.

Source code leaks can also lead to new varieties of the malware emerging. It is possible that other attack groups may modify Mirai to attack a wider range of IoT devices.

How many passwords is Mirai configured to try?

Analysis by Symantec of recent Mirai samples has found the malware is configured to use a list of at least 62 username and password combinations, most of which are commonly used default credentials for IoT devices.

Can a Mirai infection be removed?

Devices that become infected with Mirai can be cleaned by restarting them. However, due to constant scanning for devices by the botnet, vulnerable devices can become re-infected within a matter of minutes of going back online unless the default credentials are changed.

Symantec Security Response has the following tips to protect your IoT device from becoming infected with malware.

Research the capabilities and security features of an IoT device before purchase

Perform an audit of IoT devices used on your network

Change the default credentials on devices. Use strong and unique passwords for device accounts and Wi-Fi networks.

Use a strong encryption method when setting up Wi-Fi network access (WPA)

Disable features and services that are not required

Disable Telnet login and use SSH where possible

Disable Universal Plug and Play (UPnP) on routers unless absolutely necessary

Modify the default privacy and security settings of IoT devices according to your requirements and security policy

Disable or protect remote access to IoT devices when not needed

Use wired connections instead of wireless where possible

Regularly check the manufacturer’s website for firmware updates

Ensure that a hardware outage does not result in an unsecure state of the device

Gry HasselbalchCRUNCH NETWORK CONTRIBUTOR

Gry Hasselbalch is a founder of dataethics.euand an author of Data Ethics - The New Competitive Advantage.

How to join the network

Pernille TranbergCRUNCH NETWORK CONTRIBUTOR

Pernille Tranberg is a founder of dataethics.euand an author of Data Ethics - The New Competitive Advantage.

How to join the network

Editor’s note: The following is an abstract from Data Ethics — The New Competitive Advantage.

We are living in an era defined and shaped by data. Data makes the world go round. It is politics, it is culture, it is everyday life and it is business. Our data-flooded era is one of technological progress, with tides rising at a never seen before pace. Roles, rights and responsibilities are reorganized and new ethical questions posed. Data ethics must and will be a new compass to guide us.

Two decades ago, environmental reporting was something quite new, and many companies did not take being “green” very seriously. There was growing concern among good-intentioned citizens, but many didn’t know how to act on it. Today, those same worried individuals can sort their garbage, eat organic foods, take warm, solar-powered showers and drive electric cars.

Companies also take the environment seriously. Not only because those with a direct effect on the environment are required to report to the authorities, but because green business practices are sound business practices. Being eco-friendly has become an investor demand, a legal requirement, a thriving market and a clear competitive advantage. Data ethics will develop similarly — just much faster.

Data leaks, hacks, surveillance scandals and, especially, social media users’ “digital hangovers” have kick-started a movement. Individuals and consumers aren’t simply concerned about a lack of control over their personal data (their privacy), they’re starting to take action on it and react with protests, ad blockers and encrypted services. In Europe, a new data protection regulatory framework which encourages the development of a privacy by default infrastructure has been implemented. Across the globe, we’re seeing a data ethics paradigm shift take the shape of a social movement, a cultural shift and a technological and legal development that increasingly places humans at the center.

Businesses are starting to feel this shift. Not as an “either/or;” either we use data or we don’t, but rather they’re gaining awareness about data from an ethical perspective, gradually moving away from an overbearing focus on big data and embracing sustainable data use. Visionary companies are already positioning themselves within this movement and investments in companies with data ethics are on the rise. We’re seeing an increasing number of businesses take the development of privacy technology as a direct point of departure, along with the value of individual data control.

What is data ethics?

Ethical companies in today’s big data era are doing more than just complying with data protection legislation. They also follow the spirit and vision of the legislation by listening closely to their customers. They’re implementing credible and clear transparency policies for data management. They’re only processing necessary data and developing privacy-aware corporate cultures and organizational structures. Some are developing products and services using Privacy by Design.

We’re in an age of experimentation where laws, technology and, perhaps most importantly, our limits as individuals are tested and negotiated on a daily basis.

A data-ethical company sustains ethical values relating to data, asking: Is this something I myself would accept as a consumer? Is this something I want my children to grow up with? A company’s degree of “data ethics awareness” is not only crucial for survival in a market where consumers progressively set the bar, it’s also necessary for society as a whole. It plays a similar role as a company’s environmental conscience — essential for company survival, but also for the planet’s welfare. Yet there isn’t a one-size-fits-all solution, perfect for every ethical dilemma. We’re in an age of experimentation where laws, technology and, perhaps most importantly, our limits as individuals are tested and negotiated on a daily basis.

The Fourth Industrial Revolution

In the wake of today’s rapid technological development, human and ethical dilemmas emerge. Data is transforming society — some call it the Fourth Industrial Revolution. The first industrial revolution was based on water and steam, the next on electricity and the third on information and digitalization. In the fourth, the boundaries between the physical-biological and digital worlds are being eliminated — fueled by data.

Data, personal data included, can have many positive uses and outcomes, but there are also many risks in a data-driven business process. Gartner, Inc. has predicted that by 2018, 50 percent of business ethics violations will occur because of improper use of big data.

Global standards for data ethics

Data is an asset, but it’s also a risk. Today, the most prominent perils are data exhaust and unsustainable data practices, and a process to negotiate global standards, roles, rights and responsibilities to handle such risks has been initiated. This also means that tensions and clashes between laws and cultural values are amplified.

Throughout history, societies have always somehow managed to mitigate man-made risks produced by different periods of industrialization (e.g. pollution, atomic weapons and health hazards in food production) through new regulations, global standards, formal verification systems which consumers trust and slow but steady cultural adaptation — including new levels of awareness, education, literacy and ethics. Industry has had to adapt to these requirements not only with targeted risk assessment and management, but by innovating and evolving in new ways. It will have to do the same in a data-saturated environment, with data ethics as a guide.

50 cases with data ethical companies

Data Ethics — The New Competitive Advantage is an analysis of trends through which we map a new field by looking at a few constructive solutions. This also means we address the forces at play in general, that is: the societal power structures, interests and relationships underpinning the field. It’s fundamentally important to us to make the invisible visible and, as such, provide the right tools to build something new: data-ethical services, businesses and products based on a paradigm shift in the way we approach digital data.

The book combines broad trend analyses with more than 50 cases of companies that use data ethics to varying degrees, such as German toy maker Vai Kai, Australian personal data store Meeco, French insurance group AXA, the new Swiss privacy-focused ‘skype’ Wire, and the U.S. search engine DuckDuckGo. Most of the companies mentioned are still in a beta phase in the data ethics field, and not one has yet found the optimal solution. Every beginning takes time, just as it did with the products and companies that arose from the first inkling of environmental awareness.

                                                             source: TechCrunch