August 2024 – CyberEye

Six ways to harden your digital profile

Dan Gavin 19, Aug, 2024

Blog

Six ways to harden your digital profile

“Kevin” was very frugal. He flossed daily, washed his hands often, wore deodorant, and never ate at McDonalds. He always came to a complete stop, separated his recyclables, ate more veggies than meat, and turned off the lights when he left the room. He also used a credit card responsibly; always paying it off every month. He had another card he used rarely and paid off just as quickly so his debt-to-credit ratio would benefit his credit score.

One day Kevin’s 12-year-old clunker broke down for the last time. He needed a new car. The excitement was actually kind of cool. He researched the options and decided to go for sporty rather than practical this time. The test drive was thrilling. The smell of “new car” instead of “old tube socks filled with fries and candy” was a surprise. A welcome one. But right around the corner was another surprise. A very unwelcome one. Kevin’s credit score. Even though Kevin was ultra responsible in other areas of life, he was not used to checking his credit records regularly. He wasn’t even aware this was a thing. Someone had stolen his identity – and ruined it.

I have bad news. There is a very high probability your personal information (not just your name and address) is on the dark web. Your social security number, your birth date, your address. Most of what an online criminal will need to steal your identity. I mention this because 2.9 billion records were recently hacked from National Public Data consisting of these items.

You’re probably so tired of hearing this. You might even think, “what’s the use?” While this news is dire, it is actually worse than you think. With the exposed personal data (like SSN) combined with other information easily accessible on social media profiles, a criminal can build a detailed profile of a victim. Armed with the data, the criminal can port a cell phone number to a phone they control, intercept the one-time code sent from the victim’s bank account and wipe out the victim’s life savings. They can drain other investment accounts, open new lines of credit, purchase property on credit, etc. Anything you can do with your personal information; a criminal can do just as easily.

This is going to take some time. Really you can significantly strengthen your digital life within less than 2 hours. While this is not intended to be a technical tutorial, and we cannot give legal advice here, you can do the following:

Use a password manager like Bitwarden

Enable 2 factor authentication on all your critical accounts (banking, investment, email social media, cell phone provider)

Create a free login and freeze your credit reporting account at Experian, Equifax, and Transunion.

Use good credential hygiene as we have always advocated here.

Remember, if you get an email, text message or phone call requesting you to unfreeze your credit and you didn’t initiate it, it’s probably a scam

If you receive a contact you did not initiate AND the person claims you are in trouble in any way AND it makes you feel anxious AT ALL, it’s probably a scam. Stop the communication and contact the purporting organization using a known-good number.

Moving forward the world is going to be less trustworthy. You need to adopt a posture of zero trust. Be suspicious of everyone and everything. It could save you.

The original article was posted to the Sierra Vista Herald and can be found here.

Driving Under Surveillance: Your Car’s Silent Betrayal

Dan Gavin 16, Aug, 2024

Blog

Driving Under Surveillance: Your Car’s Silent Betrayal

Previously, we discussed the fact that your mobile phone vendors are providing your location information (and more) to data brokers who, in turn, sell that information to advertisers. I have some alarming news for you, that is not the only way that you are being surveilled by today’s technology. Basically, if your device has a connection to the internet, there’s probably a way to spy on you whether that device is a phone, tablet, baby monitor, or your car.

In the United States, your privacy is NOT protected. There is no settled law on what is or is not allowed to be collected from you electronically. Although law enforcement cannot collect the information without a warrant, they can purchase the information that is in the public domain. Almost all End User License Agreements (EULA) that are required before using your digital applications (like a browser), have a stipulation that you allow them to collect and even sell your data. This is all legal and very lucrative in the U.S.

Unlike the U.S., the European Union (EU) has a law that protects the privacy of their citizens called the General Data Protection Regulation (GDPR). This law dictates that the personal data should only be stored as long as necessary with safe and secure processing. Two of the key rights included in the GDPR are: 1. The right to know what data is being collected and how it is used. 2. The right to have your data deleted from the databases.

Previously we discussed how the applications on your devices gather your data and sell that to data brokers who sell advertisements. Do you realize that your car may be gathering data about you? In a typical new car these days, data can be gathered from your navigation system, Bluetooth, the Tire Pressure Monitoring System, cameras, and your infotainment system. Anyone can put a radio receiver at travel choke points and follow specific cars as they travel around.

Did you know that car companies, like Kia, Nissan, GM, and many more, glean personal information about drivers after they pair their smartphones with a vehicle’s connected services? They can take that information and sell it to vendors and insurance companies. You don’t have to sign up to be tracked by GPS by your insurance company for them to know your driving habits. Just last week someone relayed a story about their friend whose insurance company cancelled his insurance through data the insurance company bought from the vendor. The company claimed that driver accelerated too fast and broke too hard for them to continue to insure him. They do not need to ask you how you drive; the insurance companies already know.

LexisNexis Risk Solutions and Verisk are consumer reporting agencies that use driver data to create a risk score that they share with insurance companies. A report can show a driver’s individual journeys, showing information like trip durations, distances, instances of speeding or abrupt driving maneuvers. If you have OnStar in your car, you likely consented to sharing this data when you bought the car perhaps without realizing it. There are multiple class action lawsuits against GM, OnStar and LexisNexis ongoing at the time of this writing claiming that their data was collected and used against them without their consent.

If you are curious to see what data is being collected from LexisNexis, you can go to their website and request a report at https://consumer.risk.lexisnexis.com/request. Your auto makers all have similar request forms. Some states (not Arizona) have laws allowing consumers to opt out of having their information sold to third-parties.

This is just the tip of the iceberg with respect to how you are being tracked on the internet. We can cover more in later articles. If you would like your data protected similar to what the EU does with the GDPR for their citizens, contact your state and federal representatives.

Cyber-attacks on voting infrastructure. Is there a backup plan?

Dan Gavin 16, Aug, 2024

Blog

Cyber-attacks on voting infrastructure. Is there a backup plan?

Imagine that during this upcoming election in November if no results were available until days after the election. On July 31^st the Cybersecurity and Infrastructure Security Agency (CISA), in conjunction with the Federal Bureau of Investigation (FBI) released a public service announcement stating that there is potential for a Distributed Denial of Service (DDOS) attack on election infrastructure and adjacent infrastructure that supports operations.

To better understand the situation, here is some background information. CISA was established in November 2018 to enhance the security, resilience, and reliability of the nation’s critical infrastructure. CISA is at the heart of mobilizing a collective defense to understand and manage risk to our critical infrastructure and associated National Critical Functions. Basically, CISA is charged with protecting US cyberspace as well as the nation’s critical infrastructure such as power, water, and even our elections.

A DDoS attack is a malicious attempt to disrupt the normal traffic of a targeted server, service, or network by overwhelming it with a flood of internet traffic. Hackers do this by using many compromised computer systems as a source of attack traffic. It is like a mob of people rushing to a store to block legitimate customers from shopping. Imagine tens of thousands of computers that have been loaded with malware without the users’ knowledge. Now imagine all those computers running a program at the same time against specific sites making continuous requests against the election infrastructure.

Now back to the announcement from CISA:

“With Election Day less than 100 days away, it is important to help put into context some of the incidents the American public may see during the election cycle that, while potentially causing some minor disruptions, will not fundamentally impact the security or integrity of the democratic process,” said CISA Senior Advisor Cait Conley. “DDoS attacks are one example of a tactic that we have seen used against election infrastructure in the past and will likely see again in the future, but they will NOT affect the security or integrity of the actual election.”

CISA’s intent is to assure the public that the elections will not be affected even though there may be disruptions that may prevent the public from receiving timely information. However, if they know that adversaries may target the elections, how do they know that the elections will be safe and secure? How do they know that a DDoS against the voting tabulation network won’t block results from being collated. How do they keep a breach from occurring in the voting infrastructure? What happens if there is a major regional power outage due to cyber-attack? As we know from the CrowdStrike outage where Maricopa County’s Dominion voting machines got the blue screen of death update (see article from 2 weeks ago for more details), voting machines are on the network. Why would it just be periphery report structure and not the actual voting? As a cybersecurity professional the joint FBI and CISA statement provides more questions than answers.

Perhaps to properly secure the election system, we need to employ the same cybersecurity strategies that businesses use in case of emergencies. There should be contingency plans ready in case of a cybersecurity event. Precincts, counties and states should be ready to manually count the votes for all the races in case of a regional or national cyber-attack. The people required to perform the required functions – counters, watchers, recorders should be prepared and ready. Knowing the risks, should manual counting of paper ballots at the precinct level be the primary method with machine backup?

It seems CISA and the FBI are placating the public and telling us not to worry. Maybe they should spend more resources into hardening the infrastructure and working with the local resources on contingency planning in case of emergency.

This article was originally published in the Sierra Vista Herald found here.

Congress Just Made It Easier for You to Get Scammed

Dan Gavin 5, Aug, 2024

Blog

Congress Just Made It Easier for You to Get Scammed

I hope you like jail food. Because if you own a small business or you have your assets protected by a trust, you might be eating a lot of it next year. But I wouldn’t expect you to know this. Unless you have the habit of visiting US Government websites like congress.gov, or the press release site for the US Department of the Treasury.

OK. I’m abusing my hyperbole permissions … a little. Truth is that most people still haven’t heard of the “Beneficial Ownership Information Reporting Rule and Beneficial Ownership Information Access and Safeguards Rule” (BOI). These are new rules imposed by the Financial Crimes and Enforcement Network (FINCEN). You see, as it turns out, Congress “exceed[ed] the Constitution’s limits on [their] power” (AGAIN). Those aren’t my words by the way. That’s a direct quote from the FINCEN website.

The rule we are now required to comply with (or suffer the consequences) is in connection with the Corporate Transparency Act. According to the US Government, “Corrupt actors frequently use opaque legal structures—such as shell companies—to hide and launder the proceeds of their crimes. In the U.S. anti-money laundering (AML) regime, the lack of timely access to adequate, accurate, and current beneficial ownership information has been identified as a gap.” And as you may have now guessed, you and I get to bridge that gap. They even kindly helped us by making it a felony if you fail to do your part.

You might be thinking, there you go again Tom, making your baseless accusations. But I’m just the reporter here. On the fincen.gov site, they provided a synopsis of a recent court ruling in Alabama that the US Congress exceeded their constitutional limits with this one.

“On March 1, 2024, in the case of National Small Business United v. Yellen, No. 5:22-cv-01448 (N.D. Ala.), a federal district court in the Northern District of Alabama, Northeastern Division, entered a final declaratory judgment, concluding that the Corporate Transparency Act exceeds the Constitution’s limits on Congress’s power and enjoining the Department of the Treasury and FinCEN from enforcing the Corporate Transparency Act against the plaintiffs.”

The plaintiffs in this case are members of the National Small Business Association (NCBA). As a result of the court ruling, FINCEN will not require the members of the NCBA to file the BOI. The rest of us do. So, my question is, if it is unconstitutional for them, isn’t it also unconstitutional for the rest of us? In the suit, the plaintiffs allege that “the CTA’s disclosure requirements exceed Congress’s authority under Article I of the Constitution and violate the First, Fourth, Fifth, Ninth, and Tenth Amendments” (corpgov.law.harvard.edu).

Additionally, according to law.harvard.edu, “the court determined that the CTA is not authorized under Congress’s taxing powers because, although the collection of beneficial ownership information under the CTA can help the IRS with tax collection, simply being useful to tax collection is not sufficient to invoke tax powers.” There it is. This is really nothing more than an easier way for the IRS to decide who to audit. For auditing must be efficient. Oh, and by the way, banks are already required to provide your businesses information to FINCEN making this redundant.

There are many reasons a small business owner (including trustees of trusts) should be concerned. But from an information security perspective, this will be another federal government mismanaged database containing vital Personally Identifiable Information (PII) which when it is stolen (and it will be for sure), the threat actors will have you name, address, birthdate, driver’s license number, and the s-corp, LLC, or trust for which you are the owner. The consequences are dire enough that you need to have your attorney help you report. If you do it wrong, you will face fines of $500 per day and up to 2 years in jail. Congratulations. Another tax you never agreed to.

On the surface, having this information in the hands of a terrorist might not seem like a big deal to you. But think about it like this, if a threat can derive monetary value for your company, they use it to decide whether to target you for data theft. Then they use the information they steal from you to target you and your customers with scams. In the old days, the proportion of bad people who had physical access to you was incredibly small, so your world was pretty safe. The internet has created an artificially high concentration of the worst people on the planet with immediate access to you.

The United States is a representative Republic. We are the governing body. The three branches of government answer to us. But if we don’t push back, they don’t feel that.

Airline And Emergency Services Halted Worldwide Thanks to A Simple Update

Dan Gavin 2, Aug, 2024

Blog

Airline And Emergency Services Halted Worldwide Thanks to A Simple Update

On Friday morning, Karen came to work for Delta Airlines at 4:30AM like she always did to help the early bird travelers check in and catch their flights. When she booted up her computer, she saw something she had not seen in 20 years. It was the “Blue Screen of Death.” She asked a co-worker, and her computer was showing the same thing. What was she going to do with all those travelers that can’t check in? By 10:00AM EDT, Delta had cancelled more than 600 flights. By Saturday, July 20^th, over 4,000 flights would be cancelled throughout the airline industry globally leaving passengers stranded or dealing with hours of delay.

What happened? Shortly after midnight, CrowdStrike, a security software provider, pushed out a single content update to its 24,000 customers worldwide. It was a small update designed to stop new attacks hackers have been using. On installation, the configuration update triggered a logic error that resulted in the famous Blue Screen of Death. CrowdStrike could not just back out the patch. The customer computers were inoperable. There is no automated way to back out the software. It required a “Safe Mode” boot which requires someone to be physically next to the device and enter a set of keystrokes during boot. Only then could the bogus file be removed allowing the computer to operate as normal.

The impact of this mistake was felt worldwide. Several states, including Arizona, experienced 911 service outages. By 3:00AM, the Federal Aviation Administration announced that all Delta, United, Allegiant, and American flights were grounded. Transportation services in the Northeast, including trains and buses were experiencing delays. Global banks reported services disruptions, from Australia, South Africa, Israel, and New Zealand. Hospitals in Germany and the UK were cancelling all non-urgent surgeries due to the event. Even locally, Maricopa County reported that their Dominion voting machines were malfunctioning due to the automatic update.

CrowdStrike is a leader in the cybersecurity space. Their Falcon Sensor product is an endpoint detection response tool. It goes onto each individual computer and searches and stops known malware from firing. The company was founded in 2011. Some may recall that CrowdStrike was called to investigate the alleged Democratic National Convention server hack in 2016. Since then, the small company has enjoyed tremendous growth and success. The company says its customers include 298 Fortune 500 companies, eight out of the top 10 financial services firms, seven out of the top 10 manufacturers, six of the top 10 healthcare providers and eight out of the top 10 food and beverage companies. With this many big names, you can see why the impact of this failed Falcon Sensor update caused such a huge problem.

It is appalling that any company, much less a global leader like this, would automatically push out software which they had not validated. There have been rumblings on the internet that this could have been done on purpose for some nefarious reason, but I disagree. CrowdStrike should have manually validate their software at the developer level and then again at an independent test and verification department level and then again at a pilot customer site before pushing anything out to the world.

As for the customers caught up in this, we would not recommend immediate auto-updates for anything. While working in the industry, we regularly waited a day to test the vendor updates and ran through a suite of tests before releasing it to our customers. The fact that there was no control at the customer level made this event that much worse.

This event shows us the need for every business to have disaster recovery and contingency plans. Whether it’s due to cyberattacks, technical issues, or natural disasters, having an effective plan is crucial for maintaining business continuity and minimizing downtime.

In a world where we are increasingly dependent on computers for our businesses to function, be ready to run the old school way as a backup – just in case.

The original article was published in the Sierra Vista Herald and can be found here.