How Stuxnet Took Down an Iranian Nuclear Facility
0
Dan Gavin
How Stuxnet Took Down an Iranian Nuclear Facility

Back around the beginning of the century, way out in the middle of the Iranian desert there was this irrigation facility (or so the Iranians called it). But there was something oddly suspicious about it. Not that there was an irrigation facility in the desert, but that it seemed to be misplaced. There appeared to be no farms served by it. And it had significant air defenses. 

In reality, it had nothing to do with irrigation, or agriculture. 

The name of the facility was the “Natanz Fuel Enrichment Plant”. Enrichment? Yes, but not agricultural enrichment. Instead, it was a uranium enrichment facility. Like for nuclear fuel; or weapons. The enrichment facility housed centrifuges. 

To enrich uranium, the centrifuges have a large tube running down the center. The tube spins – at 63,000 revolutions per minute (RPM). But it spins off-center. So yes, that would make it unstable. So much so that the straight tube will bend in the middle and take on a banana shape. Because of this design, the speed HAS TO BE tightly controlled. Too fast and it will blow apart. The rate of spin is controlled by a small, embedded computer called a Programmable Logic Controller (PLC). 

PLCs aren’t only found in uranium enrichment. They are in every industrial application on the planet. You find them anywhere robotics are used. Like manufacturing and warehousing; water, gas, oil, and electric distribution; etc. And they are INCREDIBLY vulnerable to viruses. Like the one discovered in 2010. 

Back in 2010 some antivirus researchers found this malware. It was unlike anything they had ever seen. They named it Stuxnet. On this website “Wilders Security Forum” a researcher named Sergey Ulasen disclosed that he had found this virus on 17 June 2010. He had looked through the extensive code and found much that was atypical of run of the mill viruses. For one, there were no bugs. It seems normal viruses are riddled with them. Lack of quality control, I guess. But Stuxnet was entirely bug free. Weird. According to the researchers, only a Nation State would have this level of QC. 

The Stuxnet virus (way before 2010) had found its way (or was specifically targeting) the Natanz plant. It was designed to spend the first 13 days recording normal centrifuge operations. Then when it attacked, it simply played back the normal recordings to the operators. To the operators, everything looked normal. In reality, the centrifuges were spinning at about 80,000 RPM. Until BOOM. The centrifuges began to blow apart. 

The International Atomic Energy inspectors noticed these centrifuges were suddenly and quietly removed. Certain people working at the facility were just gone. 

Researchers found that the virus was designed so that on January 11, 2009 at 3:25 PM the heartbeat of Stuxnet came to a grinding stop. Coincidentally just a few days before President Obama’s inauguration. There was a kill date in the code. Ostensibly because the Bush administration couldn’t have an attack of this magnitude crossing administrative boundaries. It would need to be reauthorized by the new President of the United States. And it was. 

The accusation it seems, was that the code was written by the National Security Agency (NSA). They were authorized to so by Title 10 (operations for the US military) Computer Network Operations (CNO) under USCYBERCOM direction and legal authority and had a budget of 52.6 Billion dollars. Mostly for offensive cyber operations. 

But the NSA wasn’t alone. They had built the code for the Israeli Intelligence. Mossad. When Stuxnet (the NSA didn’t call it that, by the way. They called it “Olympic Games”) was released to Mossad, it was stealthy. It was surgical. A little too much it seems for Mossad. Remember, the earlier code had a kill switch. This was an updated version under the Obama administration. And in 2010 Mossad changed the code. 

It was noisier. It as less surgical. And it escaped. Once in the wild, it flooded the earth. For the last decade or so it has been altered by Russia, China, North Korea, Iran, and anyone else with the technical capability. And then it was sent to the US. To our infrastructure. 

A few months ago we informed you here that our critical national infrastructure was infiltrated by enemy nation states. It is quite probable that this is how it happened. 

It’s like the old Cold War days of Mutually Assured Destruction. But this time it’s a silent killer. There won’t be any bombs. There will just be … nothing. The power one day might just turn off. And never turn back on. 

The original article was published in the Sierra Vista Herald and can be found here.

Change Healthcare Hack Sparks New Cybersecurity Regulations 
0
Dan Gavin
Change Healthcare Hack Sparks New Cybersecurity Regulations 

On February 12, 2024, hackers from the ransomware group ALPHV used credentials found on the dark web to log in remotely to the Change Healthcare network servers. Because the company did not require multi-factor authentication, the hackers gained full access to one of its key servers and, after a week, dropped ransomware, shutting down much of the network. 

If that wasn’t bad enough, in April, ALPHV executed a double-extortion attack by hitting Change with a second round of ransomware. They claimed to have 4TB (a huge amount) of the company’s data containing personally identifiable information belonging to active US military personnel and other patients: medical records, payment information, etc. ALPHV warned that they would sell the data to the highest bidder if the ransom was not paid within twelve days. Change admitted to paying the $22M ransom. 

The hacks caused serious cashflow issues for small and medium-size healthcare providers and delays in processing claims. (Change Healthcare, a subsidiary of UnitedHealth Group, is one of the world’s largest health payment processing companies. It is a clearing house for 15 billion claims yearly, accounting for 40% of national claims.) The government stepped in to offer short-term loans until the claims could be processed. 

Although Change reacted quickly to avoid spreading the ransomware to the UnitedHealth network, they failed to notify customers and vendors as required by the Health Insurance Portability and Accountability Act (HIPAA) . In May, more than 100 medical associations banded together to urge federal regulators to hold Change responsible. In June, notifications went out to patients, providers, and vendors. 

Three months later, after two hearings on the matter, the Senate Committee on Finance decided to draft a law called the Health Infrastructure Security and Accountability Act (HISAA) to work in conjunction with HIPAA. According to the FBI, the healthcare sector is the #1 target of ransomware. They claim that the hacks are entirely preventable and are a direct result of lax cybersecurity practices by healthcare providers. They add that healthcare has some of the weakest cybersecurity rules of any federally regulated industry. 

If passed, HISAA will establish newer, stronger, stricter security requirements applicable to HIPAA-covered entities and business associates. That includes large and small organizations alike. The Cybersecurity and Infrastructure Agency will decide minimum requirements; annual risk assessments involving disaster planning, recovery planning, and incident handling must be developed by an independent auditor; organizational leadership will be required to sign a document affirming their compliance. And thanks in large part to Change Healthcare’s lateness in notifying the public of the ALPHV security breach, transparency requirements will also tighten up tremendously. HHS must be notified within 24 hours. Affected individuals must be notified within 48, and if the breach affects more than 500 people, the media must be notified within 72.  

The bill has teeth due to its heavy penalties and fines for non-compliance. HISAA would establish tiered monetary penalties up to $5000 per day for failure to meet the new minimum and enhanced security requirements. 

HISAA has not yet been signed into law. It promises to provide the oversight and enforcement structure that was largely missing from HIPAA. This may cause additional burdens that local healthcare providers will have to bear. They can thank Change Healthcare for the increased scrutiny. If you are a local healthcare provider, you are not alone. Your friendly neighborhood Cyber Guys can help guide you along the path to solid cybersecurity defenses and compliance with any new cyber laws. 

The original article was published in the Sierra Vista Herald and can be found here.

Short Memories, Flat Roofs, and Christmas Scams 
0
Dan Gavin
Short Memories, Flat Roofs, and Christmas Scams 

I remember the winter of 1980. Each time it snowed, we kids took advantage, building snow forts, snow caves, snowmen. It was magic . . . for about fifty minutes, at which point the melted slush would begin to soak through my canvas Keds and K-Mart blue jeans, freezing my toes. Even magic has a shelf life. Of course, if someone asks me to recall that winter, frozen toes and sopping jeans aren’t what come to mind. Kids tend to have short memories. They remember the joy of Christmas: the abundant snowfall, the hours of ensuing glee (usually minus the then-ensuing frostbite). Snow filtered through the lens of nostalgia becomes a magical white powder. But ask me to examine those memories further; ask me whether snow has a dark side. It does. Certainly, it’s capable of infiltrating shoes and freezing children’s toes. It’s also capable of collapsing roofs if you aren’t careful.  

My best friend’s dad—Tabby, we called him—was careful. He spent hours that year shoveling snow off the flat roof of his house. (Why anyone builds flat-roof houses in cities north of the Sun Belt remains a mystery to me.) He had heard reports that other flat-roofers had been forced to shovel snow from their homes after their ceilings had collapsed beneath the weight. Tabby was determined to beat the odds—determined, but also lucky. Lucky to have heard those reports in advance. Lucky to recognize the dark side of snow. Not all had that luxury.  

The same holds true now, in the digital age. Adults aren’t much better at recognizing dark sides than kids, and unlike the magic of snow, computers are something of a novelty. So, the dangers are, perhaps, lesser known. That doesn’t mean they aren’t real. In other contexts, we understand that trust is a privilege. We laugh to think back on the days when kids would hitchhike, buy cigarettes for their dads, bike alone after dark—the days when moms would leave their babies parked in buggies outside the grocery store. We joke offhand about people who neglect to lock their doors at night, who neglect to shovel their flat roofs. And it’s with a degree of hypocrisy that we do; too many people neglect to protect their digital assets the way they protect their physical ones. 

The most effective computer security defense today is called “Zero Trust”. All that means is that access permissions must be proven before access is granted. Think of it like the front door to your house. You don’t want to come home tonight and find a stranger making a sandwich, right? So, you lock the door, right? If so, you’re practicing a version of Zero Trust.  

What throws us about computers, I think, is the lack of a physical barrier. We see our front doors every day and understand that intruders can walk through them. Or, in the case of snow, we come across buildings with flat roofs and understand that snow can weigh them down. In both cases, the risk is omnipresent. We have visible reminders to prepare for the worst. But a computer’s connection to the internet is invisible, provided you don’t know where to find it. There are baddies in the world who do know. But you, hypothetical reader, do not, so you ignore the risk, or fail to notice it. And the baddies find your virtual door, and they walk right into your virtual kitchen and eat your virtual lunch. The only way you’ll know is if they tell you. Sometimes they leave a note. “I ate your lunch.” (Actually, they’ll tell you they encrypted all your files. They’ll give them back . . . for a small fee. Merry Christmas.) 

And if ransomware isn’t enough to chill you to the bone, we have Christmastime scams. According to Google, there’s been a massive surge in scams this year via email. Three of the biggest types include celebrity scams, invoice scams, and extortion scams. It stands to reason, then, that the latter two would pack quite a punch during a season that emphasizes gift purchases and avoidance of naughtiness. Yesterday I received an email from a frantic client; his scammer claimed to have installed malware on his phone and recorded him doing things Santa wouldn’t condone. Not to fear; there’s no stocking coal at the end of this story. Just a lot of hot air.  

In closing, your Cochise County Cyber Guys from CyberEye are here for you. Have a merry Christmas. (If only there was some snow to go with it. But then, we have a lot of flat-roof buildings around here. Perhaps an absence of snow is one security miracle we ought to be grateful for.) 

The original article appeared in the Sierra Vista Herald and can be found here.

Change Healthcare Hack Sparks New Cybersecurity Regulations 
0
Dan Gavin
Change Healthcare Hack Sparks New Cybersecurity Regulations 

On February 12, 2024, hackers from the ransomware group ALPHV used credentials found on the dark web to log in remotely to the Change Healthcare network servers. Because the company did not require multi-factor authentication, the hackers gained full access to one of its key servers and, after a week, dropped ransomware, shutting down much of the network. 

If that wasn’t bad enough, in April, ALPHV executed a double-extortion attack by hitting Change with a second round of ransomware. They claimed to have 4TB (a huge amount) of the company’s data containing personally identifiable information belonging to active US military personnel and other patients: medical records, payment information, etc. ALPHV warned that they would sell the data to the highest bidder if the ransom was not paid within twelve days. Change admitted to paying the $22M ransom. 

The hacks caused serious cashflow issues for small and medium-size healthcare providers and delays in processing claims. (Change Healthcare, a subsidiary of UnitedHealth Group, is one of the world’s largest health payment processing companies. It is a clearing house for 15 billion claims yearly, accounting for 40% of national claims.) The government stepped in to offer short-term loans until the claims could be processed. 

Although Change reacted quickly to avoid spreading the ransomware to the UnitedHealth network, they failed to notify customers and vendors as required by the Health Insurance Portability and Accountability Act (HIPAA) . In May, more than 100 medical associations banded together to urge federal regulators to hold Change responsible. In June, notifications went out to patients, providers, and vendors. 

Three months later, after two hearings on the matter, the Senate Committee on Finance decided to draft a law called the Health Infrastructure Security and Accountability Act (HISAA) to work in conjunction with HIPAA. According to the FBI, the healthcare sector is the #1 target of ransomware. They claim that the hacks are entirely preventable and are a direct result of lax cybersecurity practices by healthcare providers. They add that healthcare has some of the weakest cybersecurity rules of any federally regulated industry. 

If passed, HISAA will establish newer, stronger, stricter security requirements applicable to HIPAA-covered entities and business associates. That includes large and small organizations alike. The Cybersecurity and Infrastructure Agency will decide minimum requirements; annual risk assessments involving disaster planning, recovery planning, and incident handling must be developed by an independent auditor; organizational leadership will be required to sign a document affirming their compliance. And thanks in large part to Change Healthcare’s lateness in notifying the public of the ALPHV security breach, transparency requirements will also tighten up tremendously. HHS must be notified within 24 hours. Affected individuals must be notified within 48, and if the breach affects more than 500 people, the media must be notified within 72.  

The bill has teeth due to its heavy penalties and fines for non-compliance. HISAA would establish tiered monetary penalties up to $5000 per day for failure to meet the new minimum and enhanced security requirements. 

HISAA has not yet been signed into law. It promises to provide the oversight and enforcement structure that was largely missing from HIPAA. This may cause additional burdens that local healthcare providers will have to bear. They can thank Change Healthcare for the increased scrutiny. If you are a local healthcare provider, you are not alone. Your friendly neighborhood Cyber Guys can help guide you along the path to solid cybersecurity defenses and compliance with any new cyber laws. 

This article was originally published in the Sierra Vista Herald here.

Corporate Transparency Act Takes a Knock-Out punch
0
Dan Gavin
Corporate Transparency Act Takes a Knock-Out punch

The city might have appeared completely grey if not for the scattered, omnipresent flecks of color plastered over walls, over windows, on screens and billboards, and in the minds of the populace—Party-issued posters of a familiar man with a thick, bushy mustache, captioned, “BIG BROTHER IS WATCHING YOU.” George Orwell’s 1984 is, in essence, about control. The allegorical Party featured in the novel forces its followers into complete submission through surveillance and propaganda. Meanwhile, in the real world in 2024, the federal Corporate Transparency Act (CTA) has been described as Orwellian. It requires extensive disclosure of personal information about business owners, which some feel is an invasion of privacy and government overreach 

The CTA was enacted in January of 2021. It required over 32 million businesses with less than $5M in annual revenue to report beneficial ownership information to the Financial Crimes Enforcement Network (FinCEN). The deadline to report is January 1, 2025—or was, rather. But on December 3, 2024, a Texas district court issued a preliminary injunction, halting enforcement of the CTA nationwide. The plaintiffs argued that the CTA compels speech and association, infringing on First Amendment protections. They also raised concerns about privacy violations under the Fourth Amendment (unreasonable search and seizure).  

The presiding Judge Amos Mazzant wrote, “ . . . the government is unable to provide the court with any tenable theory that the CTA falls within Congress’s power. And even in the face of the deference that the court must give Congress, the CTA appears likely unconstitutional.” He added that corporate regulation has typically fallen under the states’ jurisdiction. 

At the time of the injunction, just over 8 million of the 32 million businesses had reported to FinCEN. Had the CTA not been put on hold, the remaining businesses would soon be subject to fines amounting up to $500 per day. The injunction is therefore critical to the livelihood of small businesses. The federal government has already appealed the case to the Fifth District Court. 

With the new administration beginning in January, it’s unclear what further steps may be taken to limit or halt enforcement of the CTA. Working jointly with Congress, the administration could revisit the actual contents of the law, amending transparency expectations or enforcement policies. They could deprioritize the funding of resources for enforcement. They might even manage to repeal the law altogether. 

If a chief goal of the CTA is, as FinCEN claims, to uncover money laundering schemes, the fact that one criterion for exemption is a prior year federal income tax reporting of over $5M seems odd. Any money-laundering company would need way more than $5M in revenue to conceal its crimes. Banks with revenue in the billions have been fined for money laundering in the past. In 2012, for instance, HSBC was fined $1.9B for laundering money for drug cartels and countries under sanctions. Later, in 2018, Dankse Bank was involved in a $230B money laundering scandal. And in 2020, Deutsche Bank was fined $150M for involvement in laundering activities related to Jeffrey Epstein.  

And it isn’t just banks. In my research, I still haven’t found one conviction for a business with less than $5M in revenue. The Unitech Group, a real estate firm, allegedly started and managed over 52 shell companies to launder money with a revenue of $36M. The Los Zetas Drug Cartel used an Oklahoma horse ranch and numerous shell companies to conceal and transfer millions of dollars of drug money to Mexico with revenues of over $13B. Other common businesses involved in money laundering include nightclubs and art dealers, again, with revenues well over $5M. 

You would think, then, that such businesses would be the focus of any transparency acts designed to prevent money laundering. Why does there need to be another huge government database containing private information, which the government has proven they cannot guard safely? (Think back to April 2024, to the Social Security Administration hack. 2.9 billion records were breached.)  

Was Judge Mazzant correct to describe the law as quasi-Orwellian? Is Big Brother trying to track the small business owner, infringing on his First and Fourth Amendment rights? 

Original article published in the Sierra Vista Herald here.

A Whirlwind of Trouble as Salt Typhoon Hacks Cellular Wiretap Infrastructure 
0
Dan Gavin
A Whirlwind of Trouble as Salt Typhoon Hacks Cellular Wiretap Infrastructure 

The morning of December 4, 2024 was a cold one, with a high temperature of 46 degrees—the sort of weather people generally prefer to observe from the comfort of their heated homes. But US senators had just received news about a cyberattack of unprecedented scope, so instead they gathered in Washington, D.C. for a classified briefing. The attackers were a highly skilled group known as Salt Typhoon. As I write this article, their attack is still going on. In fact, if you use a phone, it’s likely affecting you right now. 

Way back in October 2024, the Wall Street Journal first reported the attack. They suggested a link between Salt Typhoon and the Chinese government. Of course, you might be thinking. It’s always that. This time, though, the motives behind the operation are more mysterious. 

You really only need to worry about this if you have a phone—specifically, a phone with a Verizon, AT&T, or T-Mobile plan. Those seem to be the provider networks infiltrated by Salt Typhoon. I say “seem” because reports have been inconsistent. T-Mobile claims they’ve seen no evidence of malicious presence in their infrastructure. Verizon, on the other hand, admits a command-and-control (C2) presence. But all the providers mentioned above participated in the briefing on December 4. If nothing else, this demonstrates their mutual concern.  

The question is, what specific data has Salt Typhoon accessed? And how could it affect you? The participating service providers claim the attack only affected the infrastructure used to wiretap specific targets. That said, we don’t know the extent to which these providers have been logging information. And whatever that extent is, Salt Typhoon has access to it as well. Under Section 702 of the Foreign Intelligence Surveillance Act (FISA), the FBI cannot target US citizens randomly. But if the infrastructure to tap is in place, and can be turned on for anyone the FBI decides to surveil, it’s quite possible that Salt Typhoon could do the same without FISA-based reservation. Meaning anyone could be a potential target. 

Regardless of your paranoia level, there is something you can (and probably should) do: namely, following the counsel of Jeff Greene, the Executive Assistant Director for Cybersecurity at the Cybersecurity and Infrastructure Security Agency (CISA). “Our suggestion, what we have told folks internally, is not new here,” he says. “Encryption is your friend, whether it’s on text messaging or if you have the capacity to use encrypted voice communication. Even if the adversary is able to intercept the data, if it is encrypted, it will make it impossible.” 

What your Cochise County Cyber Guys recommend is an app called Signal. You can get it on either iPhone or Android, and once you do get it, you can install the companion app on your PC or MacOS. With Signal, you can send and receive encrypted files, text chats, individual and group calls. You can even hold Zoom-style meetings with screen sharing. All this is end-to-end encrypted. That means even Salt Typhoon (and the FBI) won’t know what you’re up to. 

Having said all this, we don’t condone illegal activity. We just think you have a constitutional right to privacy. Everyone does. 

This article was originally published in the Sierra Vista Herald here.

Lessons Learned from the CISA Red Team Hack 
0
Dan Gavin
Lessons Learned from the CISA Red Team Hack 

Dmitri’s fingers flew over the keyboard as he searched for an access window to the network at Metropolitan Utilities: the biggest electricity service provider in the tri-state area. Using a password he’d retrieved from the dark web, he connected to an employee computer, then moved silently through the network, scanning for a computer with better privileges. Through this, he hoped to access the systems controlling the power grid. He called over his shoulder, “Natalya, mne nuzhno nebol’shaya pomosch’. Would you build me a fake login webpage that matches theirs? If I send it to all the company’s staff, I might trick an administrator into handing over their username and password.”  

His partner nodded and emailed a link to the entire IT department under the pretext that there was a failed login attempt that needed investigating. Jason, a junior-level administrator, took the bait. What followed was a chain of events culminating in the effective barring of all administrators from the power grid. 

 “Bingo,” said Dmitri under his breath.  

And at this point the exercise concluded. “Krasnaya komanda! Krasnaya komanda!” (red team) laughed Natalya as Dmitri contacted the blue team, a.k.a, the IT and cybersecurity department of Metropolitan Utilities.  

Here is your problem . . . 

Three weeks before, the department had contracted Dmitri and Natalya’s cyber company to run a red team test on the network. Red teaming is a simulated cyberattack conducted by a group of ethical “white-hat” hackers. They use real-world techniques to breach an organization and identify any vulnerabilities that might prevent it from detecting an actual threat. In this case, the red team’s victory was the result of several basic security mistakes.  

The US government has classified electrical, natural gas, water distribution and several other industries as “critical infrastructure”: infrastructure vital to the survival of the nation. Attacks on such industries can be particularly damaging. Recently, the United States Cybersecurity and Infrastructure Security Agency (CISA) conducted a red team assessment resembling the fictitious example above at the request of a real-world critical infrastructure organization. No details about this organization were disclosed except the type of infrastructure—a utility company 

The red team was able to breeze through the company computers at blinding speed. During the simulated attack, the organization did actually discover the presence of the red team but lacked essential layers of protection—what we call “Defense in Depth”—which would have allowed for a prompter response. Instead, they relied on fancy antivirus software that could not sense the network traffic. Furthermore, their staff lacked appropriate network-protection training. It should have been provided to each employee in small, frequent bites. The company had previously contracted third-party providers for red team exercises, and its leaders had been made aware of these vulnerabilities. But they had underestimated the risk. Nothing had been done. 

The company had previously contracted with third party providers for red team exercises. But the leadership at the organization deprioritized fixing the previously discovered vulnerabilities.  They miscalculated the potential impact and likelihood of those vulnerabilities being used against them one day.   

CISA had several key recommendations, which included regular software updates and cleanses, as well as the use of multi-factor authentication (MFA) and segmented networks. MFA just means requiring more than a password for login. Authenticator apps like Duo and Microsoft Authenticator are designed for this, but there are simpler and less secure methods—for instance, receiving a text or email code. Segmented networks are also fairly self-explanatory. Consider the way a house is partitioned with walls. A network engineer can do the same to your network using firewalls, switches and routers, or through software installed on each computer (which is how your Cochise County Cyber Guys do it).   

Lastly, CISA recommended a shift from legacy system and network architecture to a modern Zero-Trust architecture. Zero-Trust, in the context of computers and networks, is something akin to home security. Doors are locked by default, and only close friends and family are allowed in. This is called, “Deny by Default, Allow by Exception.” 

If you’re a business owner and want to understand how to implement Zero-Trust in your organization, contact the Cyber Guys below. The threat is real, and it is growing. Fortunately, it is also preventable. In the case of Metropolitan Utilities, its first “attackers” had no malicious intent. Provided the blue team heeds Dmitri’s advice, they’ll be prepared in the event that a true black-hat team tries to take down the grid. Are our local utility companies up for the challenge? 

Bike welds, spray paint, and cybersecurity 
0
Dan Gavin
Bike welds, spray paint, and cybersecurity 

On the corner of Fort Lane and Gentile Street, beside an aging strip mall with a drugstore, a five-and-dime and a Safeway, was an empty lot—empty except for the yellow, knee-high grass typical of August summers in my hometown. The whole field smelled drier than a canvas sack of wheat; some days the heat of the sun by itself was enough to burn it up. And there, along the trail, my old Huffster soared, leaning and squeaking all the way, with dust flying from its deflated tires. 

My best friend Tracy and I had been stress-testing our pedal bikes. His was a sparkling red Schwinn with a white stripe down the side, chrome fenders and all; mine was a weary old street bike Santa had picked up at the five-and-dime. It had started as a blue-and-yellow Huffy road bike with a banana seat, and in 1984, vintage road bikes weren’t super cool. BMX bikes were cool. So my 1977 Huffy had been rattle-can painted flat white. It now sported an orange saddle seat from my brother’s discarded ten-speed. The tires were balding and weather cracked, not BMX dirt-track style—road style. It was a Franken-bike. And it had spent way too many frigid winters leaning against the side of our trailer house. 

The one thing my Franken-Huffy had going for it was its weight: not a lot of steel in my steed. It was a feather. (The Schwinn, in contrast, was a steel tank. It rode like a tank, and it jumped like . . . well, a tank. In that, and only that, Tracy was jealous of the Huffster.) But here amid the tall, drooping, grass and stifling August air, the glory days of my cracked-tire, rattle-can abomination came to a sudden end. 

Midway through the final jump of its dwindling life, the Huffster came unglued—not literally, but almost. The welds holding both tubes to the gooseneck released their grip, weakened by the cumulative stress of too many jumps and too much extreme weather. I landed on my feet in the dust, kicking up a cloud, which settled at last over the faded, white frame. Then I turned. The rusty handlebars, forks and front tire looked as they always had; the sad remains of the powertrain had collapsed. 

In 1984, the Huffster died. But the Internet was just emerging from its digital nursery. What Tracy and I could not have known then as we strolled sullenly from the yellow field (making a quick stop by the drugstore for a cold Coke) was just how the Internet would affect our world forty years later. Its users have been conditioned to think of computer and network security as the products of intentional design. Truth is, security’s an afterthought. It quite literally is not a requirement. The systems you think are baked into your shiny new laptop have actually been cobbled together and hastily bolted on, much like the structures of the Huffster. And the comfy reassurances and guarantees from its makers are little more than a superficial, flat-white veneer. 

We advocate not just for a single coat of illusory security paint, but for many solid layers, as well as a healthy dose of foundational stability. It’s called Defense in Depth. It means you have several layers of protection. And maybe more importantly, you use a dedicated security company like Cybereye in addition to your regular IT company. 

Several of our stalwart readers here in Cochise County have informed us that the knowledge they’ve received through this column has helped them to avoid being scammed. I can’t tell you how thrilled I am for that. We are very grateful to the Sierra Vista Herald for allowing us space to rant about cyber crime. You, our beloved readers, can help us. If you’ve found valuable information here, tell your friends to get the paper so they can benefit, too. (Quality cyber training rarely comes at such a low expense, after all.) Help us reach out to local businesses. The Cyber Guys have a cybersecurity consulting business (also insanely affordable) based in Cochise County. Essentially, we provide preventative treatment for the cancer of ransomware, as well as other kinds of malicious ware. But we need your help spreading the word 

Computer security is what holds our digital world together . . . until it doesn’t. But my poor Huffster with its ruined tires and unsteady, cobbled structure had little more than a film of white paint for reinforcement, and even knowing this, I abused it without a second thought. Don’t fall into that same trap. 

QR Codes, Tattoos, and Quishing 
0
Dan Gavin
QR Codes, Tattoos, and Quishing 

It was October 2011, and Tony, a 26-year-old web developer and gamer, scrolled through Google Images in search of tattoo inspiration as he made his way down the street to his apartment. He had just stood in line for four hours to get the new iPhone 4S, which had come out that very morning. He was excited about the eight-megapixel camera and the addition of a new personal assistant called Siri that responded to voice commands. All this he would have to try later; Tony loved few things more than pursuing the bleeding edge of technology, acquiring all the latest devices so that he could be among the first to use them. But one thing at a time, he thought. 

None of the tattoo ideas piqued his interest. Then suddenly it struck him: he could get a QR code of his website tattooed onto his forearm to show potential clients. At the time, QR code-scanning wasn’t a native feature in iPhone cameras (and wouldn’t be until 2017), but anyone with a scanning app could scan Tony’s forearm and see his website. It was an awesome sales tactic and a prime use of a technology that, while not exactly new, was on the rise in non-industrial settings. He generated the QR code and printed it for his tattoo artist, who meticulously inked his arm to match the printout exactly. 

Satisfied with its appearance, Tony showed the tattoo to his best friend, Joe. After Joe scanned Tony’s arm, he literally fell over laughing. The QR code tattoo hadn’t directed him to Tony’s website. Instead, it had shown him a YouTube video of a cat playing piano. 

A QR (Quick Response) code is a two-dimensional bar code that can be interpreted either horizontally or vertically and that contains encoded data. The codes were originally developed in 1994 to track products in a manufacturing plant but now have a wide range of uses, including marketing, making payments, connecting to Wi-Fi, accessing restaurant menus, providing directions, and many more. Generating QR codes is very easy, and there are free resources on the internet. I used www.qr-code-generator.com to generate the QR code for this article. 

Cyber hackers are also using QR codes. Except, they use them to fool users into downloading malicious code or password stealing.  Using QR codes for a phishing attack is called “quishing.”  Last summer, the cybersecurity company, Sophos, was targeted by a group of hackers.  The hackers sent an email to all employees that appeared to be related to employee benefits and retirement plans.  The email contained an Adobe PDF document that displayed a QR code.  Once the employee scanned the code with his phone, he was taken to a fake Microsoft 365 login form.  Once the employee entered their username and password, the hackers had his company credentials.   

Now, employees who’ve kept up to date on all our cybersecurity articles will understand what a phony link looks like and show caution. But in the case of a QR code scanned on a phone, the link is only up for a short time or is not shown in full, which makes it harder to scrutinize. Hackers may also use redirection techniques that cloak the final destination of a link. 

Sophos says they have observed an increasing number of quishing attempts over the past few months, and these attacks are growing more sophisticated. Andrew Brandt says, “Quishing documents now appear more polished than those we initially saw, with header and footer text customized to embed the name of the targeted individual (or at least . . . the username for their email account) and/or the targeted organization where they work inside the PDF.” 

Criminal organizations, perpetually fixed on business opportunity, now provide quishing services to the less talented hackers out there, and it is highly effective. To protect yourself, be wary of random QR codes from unknown sources. Be cautious of what turns up in your email inbox. If you’re on a computer, try reading the full link with Google Lens. Use your cybersecurity skills (courtesy of your favorite Cyber Guys) to alert yourself if something doesn’t seem right. Know your source before scanning. 

It never pays to be inattentive, but luckily for Tony, his problem stemmed from a harmless typo he made when he generated his QR code. He went back to the studio the following afternoon to get the QR code to his actual website tattooed on his other forearm. Lesson learned. 

This Midnight Blizzard brings an avalanche of trouble 
0
Dan Gavin
This Midnight Blizzard brings an avalanche of trouble 

The wind howled; the snow swirled. It had been like this all day. (Why had Karen left Phoenix again? … Never mind.) She knew she should have been home hours ago. Now it was well after dark, approaching midnight, and the streets hadn’t been plowed. Driving home would be dangerous. She sighed. More from habit than necessity, she opened the door to the car, sat, reached for her phone, and checked her email. 

“What? Again?”  

Karen was sick of receiving these cybersecurity training reminders from IT. They were obviously unaware that she had an important and fast-approaching deadline. If she missed it, she would lose her biggest account and Christmas bonus. Her children were counting on this bonus. They had planned a cruise during spring break. She didn’t have time to waste. 

On closer inspection, though, the email had nothing to do with training this time. Channeling all the security knowledge she had previously acquired through IT, Karen checked the sender address. 

“It’s good. It actually is from IT. It’s just for verification of my username and password. This one should be quick,” she thought. 

Oh no. Karen’s about to be the victim of a classic phishing-email-sender-verification oversight. And I’ll bet you’re thinking, “Tom, she checked the sender. She verified it really was from IT.” Yep. Most of our readers will notice from the start that Karen was astute. But it’s midnight. She’s tired and cupcake-drunk (ask me later), and she’s pushing up against a terrifying deadline. So, she did the only thing her amygdala would allow her to do: find the shortest path to safety. 

In this case, “safety” meant getting the annoying email out of the way so she could finish her report before the deadline. What she missed was context. IT never asks for a user to verify credentials in response to an email. Actually, she was instructed during on-boarding never to respond to an email requesting credential verification. The sender address was spoofed—a.k.a., faked. Yes, that’s a thing. 

The attack we’re scrutinizing this week is currently in use by a Russian attacker that Microsoft calls “Midnight Blizzard” (for real). The attack goes like this: thousands of emails are sent to users at various target companies. Attached to these emails is a file with a “.rdp” at the end of the name. This file will connect your computer with a server on the internet controlled by Midnight Blizzard. 

Always remember, whether it’s the IT department asking for password verification, the IRS notifying you of an audit, or a Nigerian prince asking for a loan, the rule is the same: never respond to any communication asking you to verify anything. Never trust any information you receive in an email, phone call, or text. When in doubt, hang up the call, close the email or text, and make contact using a phone number you know is good. 

Even if Karen had chosen to remain in Phoenix, it would have served her to be wary of a blizzard. And it will serve you, too, whether in the blistering heat storms of Arizona or far beyond. 

Copyright © 2025 CyberEye Call us at: ‪(520)224-8981