National Cyber Security Centre's weekly review – 36/2024

Topics covered in this week’s review

1. From pinecone cows to Roblox – keep your ears open when your child is playing online (External link)
2. Don’t be part of a bot network (External link)
3. European cybersecurity certifications improve digital security (External link)
4. Recently reported scams (External link)

From pinecone cows to Roblox – keep your ears open when your child is playing online

Playing and games have become a popular hobby and a platform for keeping in touch for children and young people. However, playing involves risks that you should be aware of. To be able to play safely, children need to know how to look after their personal information, protect their game accounts and promote good game behaviour.

The first step to playing games safely is to protect the child's information and to learn about the security of game accounts. With help from adults, children learn important skills in protecting their information and operating online. It is advisable to teach children that personal information (name, address or school details) should not be shared on game platforms, not even between friends from the physical world. Parents should practice creating strong passwords and setting up multifactor authentication for game accounts together with the child.

Another important step is to teach the young player to identify the dangers involved in playing online. Many games have made it possible to donate things bought either with game currency or with real money to another player. In conversations during the game, items purchased with real money may be requested from a player or free benefits worth, for example, double the value of an item may be offered. Even the credentials for the player’s game account may be requested so that items can be given to the account free of charge. In these cases, the items or the player's account may be stolen by the fraudster – players should not share their items or their game account details with others.

Constant discussion should be maintained with children and young people about game behaviour and online bullying. Inappropriate behaviour takes place on game platforms as well. It should be emphasised to children that they should discuss inappropriate or frightening matters with an adult. Other players must also not be disturbed with denial-of-service attacks or by attempting to get their user details. By learning safe game practices and operating safely in game environments, children gain important skills for the future: protecting their personal information and the security of game accounts.

Generative AI was used as a chatmate and for sparring ideas when this article “From pinecone cows to Roblox” was drawn up.

Don’t be part of a bot network

Over the past week, the National Cyber Security Centre has observed increased activity by two different bot networks in Finland. The fairly new bot network Quad7  (External link)is taking control especially over Asus and TP-Link routers intended for home use. Observations of the Mirai  (External link)bot network, which has already been operating for several years, have also been made.

Bot networks are used both as part of distributed denial-of-service attacks and as proxies for malicious online traffic in cyberattacks. Yle  (External link)(link in Finnish) reported on the topic after having interviewed specialists from the Finnish Security and Intelligence Service and the National Cyber Security Centre.

Guidelines: Home network and router security (External link)

European cybersecurity certifications improve digital security

To harmonise cybersecurity certification, the European Union prepares union-wide cybersecurity certification systems.

The purpose of the cybersecurity certification systems is to make it possible to obtain an EU-wide cybersecurity certificate for an ICT product, service or process and to ensure that the cybersecurity requirements and assessment methods specified in the certifications are consistent in the EU as a whole.

Traficom is involved in the preparation of the cybersecurity certification systems

The European Union Agency for Cybersecurity ENISA launches the preparation of each certification system with the scope requested by the Commission. Traficom contributes to the content of the certification systems by participating in working groups and in the operation of the European Cybersecurity Certification Group (ECCG).

The first certification system to have been completed is the EUCC system (External link) concerning ICT products, for which the implementing regulation (External link) was published at the beginning of 2024. 

The other certification systems currently still under preparation are the EUCS, which covers cloud services, and the EU5G, which concerns 5G.

Recently reported scams

In this summary, we provide information about scams reported to NCSC-FI during the past week.