The Destruction of Tyre and the Security of Cloud Applications 
0
Dan Gavin
The Destruction of Tyre and the Security of Cloud Applications 

The city island of Tyre was a beautiful, powerful, and strategic Phoenician trading city in the eastern part of the Mediterranean Sea.  Its defenses were so great that it survived a 13-year siege from the great Babylonian conqueror, Nebuchadnezzar starting in 586BC.  The people were proud of how impenetrable they were.  That’s why when Alexander the Great came along in 332BC, they did not negotiate with him.  So, Alexander’s army razed Old Tyre which was on the mainland next to the great island city of Tyre.  The army used the rubble of Old Tyre to create a land bridge to the island of Tyre where they laid siege to the city for 7 months when they utterly destroyed the city and the people.  

That story comes to mind when I hear businesses say they don’t need cybersecurity protection because their data is in the cloud.  It is safe and sound and no one can hack it because it is not on site.  It’s hiding in the cloud.  Here are three reasons why they are wrong: Keyloggers, Stealers, and RATs.  

A keylogger is malware designed to record the keystrokes made on a computer or mobile device. A keylogger captures everything you type, including emails, passwords, messages, and search queries. This information is then sent to a third party.    

On a typical morning for a cloud-centric business, an employee would start work by opening email.  On an infected system, the keylogger has access to your business email to either spy or use the account for financial gains. The attacker is hoping your multi-factor authentication is sent to compromised email account.  Next the employee logs into the business apps that are in the cloud.  This could be a healthcare system, logistics system, or financial system – whatever makes that business move forward. Perhaps an administrator pays an invoice with bank account information or username and password to the bank.  Maybe they use a credit card to pay the invoice instead.    That’s right!  All that information is now in the hands of the hacker thanks to the keylogger.  

Stealer malware or infostealer malware targets user credentials, browser data, cryptocurrency wallets, and any other personal data on your device.  Not only can it take the usernames and passwords saved in your browser, but it can also steal the credentials from certain applications and accounts that are not run on the browser.  Some stealers have been able to access cypto-wallets such as Phantom, Binance, Coinbase, and more.  Stealers gather similar information compared to keyloggers, but they don’t have to wait for anyone to login and start typing.  They search your device for the information that is already available. 

A Remote Access Trojan (RAT) is a type of malware that allows hackers to gain remote control over an infected computer or device. It allows the hacker to use a limited set of commands providing access.  Sometimes they steal data. Other times they may install additional malware or spyware. They could reconfigure your local firewalls or shut down other security measures.  RATs are usually distributed through phishing or emails with an Adobe PDF attached.  The PDF calls an executable file to download the RAT.  

What can you do about all this, you ask?   First of all, do not fall for phishing and social engineering via email or text.  Do not click on a link from a user you don’t know.  Secondly, make sure you have set up multi-factor authentication everywhere possible especially anything dealing with money, but may also include social media, emails, and business applications. Making sure your anti-virus is up to date is a start, but that doesn’t stop zero day/ new malware.  Monitor your accounts.  If you run a business, you should have endpoint detection and response (EDR) installed on all your computers.  This is an application running on your computer that watches what is written and executes on your system and prevents unauthorized execution.  Talk to your local Cyber Guys for details.   

Just because all your applications and systems are in the cloud doesn’t make you bulletproof.  Don’t be like Tyre and find out too late that Alexander is building a land bridge in the front yard.   

SS7 SMS Attacks, a Throwback to the Phreaking of the 70s 
0
Dan Gavin
SS7 SMS Attacks, a Throwback to the Phreaking of the 70s 

This article will be hard for you to read. Not in the way all my other articles are hard to read. This one will be emotionally hard. And let me give you the call to action right now (in the government we call it the Bottom Line Up Front (BLUF)).  

The BLUF is this. You will need to do two things. First, you will need to log into all your bank, other financial accounts, and your email accounts. Set the security to Multi Factor Authentication turned on and make sure you ARE NOT using SMS or text message for delivery of the One Time Passcode. The second thing you will need to do if you are in a relationship where you do not trust your partner, is to either reset your phone to factory settings, or dispose of the phone and buy a new one. Then ensure they NEVER have access to your phone unlocked. Ever.  

Now, the reason for all this. The technical parts that follow are necessarily grossly oversimplified. In 1975, the telecommunications industry developed a security protocol to reduce the impact of “phreaking”. Phreaking was a way to trick the telecom network into allowing long distance calls for free. The protocol was not secure. It hasn’t really been updated. And it is all over your cell phone. It’s called SS7. By abusing it, anyone can intercept your phone connection from anywhere in the world and access your text messages and phone calls, without installing any malware. And you will never know.  

So, if you use text messages (SMS) for that One Time Passcode from your bank, all an attacker needs are your phone number, username, and password.  They can render you penniless. Your financial accounts and your email accounts are probably the most important part of your digital life. Treat their logins with the utmost care. 

That’s the first part. The second is this. If you are now, or have ever been, in an abusive or otherwise untrustworthy relationship what follows might sound familiar. Bob, (names have been changed for privacy) met Jane, the girl of his dreams. He thought it was cute when Jane insisted that they share their phone PIN codes. The cuteness ended there. Eventually Jane began to insist on more and more control over Bob’s life. Without reciprocating. Eventually, Bob found all the contacts in his phone had been deleted. All the female contacts. And Jane had changed her PIN. 

It’s just a PIN code. You don’t have anything to hide is your initial thought. But this sweet new addition to your life may have a dark side. This adorable partner could (with as little as $175) install spyware on your phone. Or buy a phone for you with the spyware already installed. The spyware literally gives them access to everything. Including both cameras and the microphone.  

People make a huge fuss over the need to keep Social Security Numbers (SSN) private. But did you ever think the secrecy of your phone number would be more important than your SSN? When it comes to your phone number, in the words of Gandalf, “Keep it secret. Keep it safe.” Fortunately, unlike your SSN, you can get a new phone number. 

In addition to factory resetting the phone, setting up non-SMS-based MFA for your online accounts, you should SERIOUSLY consider using the Signal app for all your communications. For the SS7 hack, it will help by encrypting all your communications (voice and video calls, and text messages) so eavesdroppers can’t eavesdrop. 

There are many more details. I’m more than happy to chat about it if you want to email me. Just no phone calls.  

Sale of the Eiffel Tower and Election Phishing 
0
Dan Gavin
Sale of the Eiffel Tower and Election Phishing 

In 1925, the Eiffel Tower was in a serious state of disrepair and there were rumors that it would be dismantled.  Not to let a good rumor go to waste, con artist, Victor Lustig, posed as a government official and invited several scrap metal dealers to a confidential meeting, claiming that the government wanted to sell the Eiffel Tower for scrap. Five dealers responded to his request for a meeting and one dealer, Andre Poisson, made the highest bid for the 15,000-beam structure.  Two days later the deal was closed for an undisclosed amount.   By the time Poisson discovered he was scammed, Lustig was in Austria.   

Con men and scammers have been around for ages.  In this digital age, scammers are using technology to add credibility to their scams.   Through email and text messaging they can cast a broad net.  It is a good day for them even if they only reel in two victims out of one hundred emails or texts.    Phishing is a cybercrime in which a target or targets are contacted by email, telephone or text message by someone posing as a legitimate institution to lure individuals into providing sensitive data such as personally identifiable information, banking and credit card details, and passwords. Phishing is the number one entry point for ransomware. 

Hackers use whatever topics are current or in the news to entice someone to let their guard down so the victim clicks the link or gives up critical information.  As the election is less than two months away, election campaign phishing is on the rise. As I was reviewing dark web reports, I noticed an advertisement selling a phishing platform.  They had templated the faux campaign donation emails and would provide the mass email platform.  The dark web customer could choose to target either the Harris or Trump voters, or both.  Nowadays, criminals don’t have to be technically proficient, they can outsource their evil.  

These days I am receiving several text messages a day asking me to donate to or vote for a particular candidate with a link at the end of the message. From the text, it is hard to determine if the message is legitimate.  If you are interested, research on the internet for the candidate’s site and learn more.  If you are not interested, delete the message and mark it as junk.  Whether it’s email or text, don’t click on any links.  

Scammers use the same techniques whether it is a text, email, or a phone call.  If you receive a phone call, be very careful if you choose to engage the caller. If there is a campaign or a charity that you are interested in supporting, thank the caller for their time and go to a known-good website for that organization.  Do not give the caller any financial information like credit card or bank account numbers.  

Before donating to any Political Action Committee (PAC), it is a great idea to verify that the organization is legitimate.  All PACs must register and report to the Federal Election Committee (FEC).  Check out this website from the FEC to verify the organization. www.fec.gov/data/reports/pac-party  

What does the sale of the Eiffel Tower and an election have in common?  They both have con men and scammers looking for ways to take advantage of unsuspecting victims. Just as Victor Lustig duped the scrap metal magnate, scammers are phishing to see who will take their bait. 

Don’t talk to strangers 
0
Dan Gavin
Don’t talk to strangers 

It was 1987. I was a junior in high school. And one of my best friends lived over an hour away. If I had owned a car that is. It was 1987 and I had no job and no car. But I really wanted to see my friend. So, I did what any other kid in high school in 1987 would do. I hitchhiked.  

For high school kids in the ’80s that wasn’t too big of a deal. It still wasn’t as safe as it had been during the 60’s and 70’s. But still the risk was low. It wouldn’t be the first time I’d hitchhiked either. I had been doing it for over a year. And I met some interesting people along the way.  

So not only did I talk to strangers, I got into their car with them. I heard their stories, and they heard mine. Then they dropped me off and we promptly forgot about each other. Now, I knew about stranger danger. Every kid who grew up in the 80’s and 90’s knew this. But that didn’t really seem to apply to me. And after all, it always turned out fine. Except for the time I got shot. With a fire extinguisher. From the passenger of a would-be free ride. 

These days the story is different. People mostly don’t hitchhike any more. But sadly, the warning to shun conversations with strangers is still ignored. Because we’re nice. 

If you have ever received a text message from a “wrong number” you’ve been had. They aren’t wrong numbers. They are shotgun blasting messages to thousands of potential good numbers and waiting for a response. So, let’s look at the anatomy of a “wrong number” text message. We’ll use the experience of a real victim but change the name for privacy’s sake.  

“Robert” receives a text message from a number not in his contact list. “Hi, did you enjoy the movie?” the message begins. “Who is this?” Robert replies. This is his first mistake. By responding, Robert has confirmed his number is valid. “This is Annie. Is this Frank?” Here is “Annies” first bait. By picking a random name, “she” is playing on Robert’s urge to correct her. So, he does, “no, this is Robert.” Now the scammer knows 2 things, the number is valid and that his name is Robert. At this point “Annie” can do a reverse lookup on the phone number and get Robert’s last name. With that she can look him up on social media. 

With the frightening amount of data, we willingly post to social media, “Annie” can get enough info to encourage Robert to continue the conversation. At some point, “Annie” will take the photos she gets from Robert’s social media account, alter them with Generative AI and potentially use them to blackmail Robert.  

It sounds far-fetched. But this happens thousands of times per day. All over the world. So, listen to your mother. Don’t talk to strangers. Set your phone to silence calls from those not in your contact list. Let the calls go to voicemail. And for texts, swipe left then select delete and block. Answering a call or text from a “wrong number” is like hitchhiking. Don’t do it. We don’t live in 1987 anymore. 

Hidden Vulnerabilities: Why Cybercriminals Target Small Town Businesses 
0
Dan Gavin
Hidden Vulnerabilities: Why Cybercriminals Target Small Town Businesses 

Week after week, we write about the latest breach or how hackers use social engineering to get into corporate and government systems, but as you read this in Cochise County you think these types of things only happen to big corporations in big cities.  You may think: “My small business is not worth the hackers’ efforts.”  I’ve got news for you; your small or medium-size business is worth their effort.  Why?  Because some businesses make it so easy for them. As we do forensic investigations locally in Cochise County, we have met some of the victims.  Sometimes healthcare providers post a banner on their web pages discussing their breach and compromised data. 

One of the most common way hackers get unauthorized access to local business systems is to scan for open ports on public facing servers. A port is simply a door into your network. The port in particular that they love is the one used for remote access.  In this case think of this port as the magic wardrobe that the children found to enter Narnia. During COVID when many switched from working at the office to working at home, the local IT guru opened that famous port so that users could remote into their server or desktop using Microsoft Remote Desktop.  It was a great solution because it is easy, and it works.  Unfortunately for many, it is not at all secure and is a favorite target for our worldwide hackers.   

It’s possible to scan the entire internet in hours. In 2019, a researcher named Robert Graham scanned the entire IPv4 address space for the remote desktop port and found around 3 million exposed servers. That’s exactly what the bad actors do.   Once they find the open port, the first tactic they try is to determine the type of server and use the default usernames and passwords from the manufacturers.  Many people never remove and reset these.  The next thing hackers will attempt a password cracking technique.  Some techniques are sophisticated like the credential stuffing attack, where hackers look on the dark web for actual cracked passwords for the business which was hacked.  They are hoping that people will reuse their passwords.  Another technique is to run a dictionary attack where common usernames and passwords are automatically attempted.  We see this occur locally where the port is opened for maintenance and within an hour there are failed login attempts from North Korea, China, Russia, and Iran. It really happens here in Cochise County. 

Many business owners believe that they are safe from cyber-attacks because their IT person assured the owners that they have the best firewall the world has ever seen along with the latest and greatest anti-virus.  This is a good start, but the bad news is unless you block internet and email traffic on the firewall, it won’t stop phishing emails.  Your anti-virus won’t stop brand new malware.  According to Verizon’s 2023 Data Breach Report, around 90% of breaches are linked to phishing emails. The others are related to downloading malware through internet browsing.   

Some business owners might say they are safe and don’t need cyber security because their software is cloud-based.  In that case, what happens when an employee downloads a key-logger program that was on a link in their email?   The hacker has access to all company data and if that employee had administrative privileges, the hacker has total control.   

If a breach or ransomware attack could shut down your business for more than a day or if a breach would make you liable to your clients, your business needs solid cybersecurity.  We recommend a defense-in-depth strategy where there are multiple layers of defense.  Start with the basics of up-to-date firewalls and anti-virus, then add endpoint detection response that stops malware from executing, then get some monitoring and user training.  You follow that up with solid security policies. 

Don’t be an easy target.  Harden your business with a defense-in-depth strategy to thrive in the digital world.  Get a cyber risk assessment done to make sure that you are not low hanging fruit for the lazy hacker. 

How the World Ends 
0
Dan Gavin
How the World Ends 

In today’s vernacular you might say you’ve been “click-baited”. Or maybe not. I’ll let you be the judge. I guess it will all come down to how you interpreted “World” and “Ends”. If you immediately pictured the metaphorical “world” or the global context of “world” and if your definition of “ends” means “completion of current state and transformation to something better,” then this most likely will not be what you expected. My intent is to reveal something more sinister and far more depressing. But I beg you to hear me out. After all, it’s only about 5 minutes of your time. 

In 1942 concentration camp victims created massive amounts of counterfeit British pounds in an effort to collapse the British economy. This wasn’t the first use of currency counterfeiting in war though. The technique has been around a long time. The British attempted it during the Revolutionary War; Napoleon used it against the Italians; even during the 15th century Italy employed it.  

Why would one country counterfeit the currency of its enemy? Were they intending to go on a shopping spree after invading their foe? Oh no, that’s not it. it’s more nefarious than that. 

See, here’s a dirty little secret. And it’s one that the Federal Reserve Bank and other central banks around the world would rather you not find out. Counterfeiting leads to hyperinflation. The effect isn’t immediate. It takes some time to get all the money out into circulation. But once it does, the effect can be horrific on the economy.  

Hyperinflation manifests itself in rising prices. At the grocery store, at the gas pump, at the movie theater. Everywhere regular people do their daily transacting. When prices rise everywhere at about the same time, this is the effect of inflating the money supply. It’s not a collusion among all the grocers. It’s more a collusion among Central Bankers. It’s not rich farmers gouging you at the store. It’s the ultra-wealthy oligarchs who control everything. 

By flooding your enemy’s economy with counterfeit bills, you dilute the value of the currency until it becomes worthless. It’s pretty easy as the British found out at the end of World War II. The counterfeited bills were so good, they couldn’t tell the fake from the real bills. The only thing they could do was to stop printing the legitimate pounds and wait for the money to dissipate naturally.  

In the US we’ve been experiencing inflation for some time. Actually, the Fed has a target of 2% per year. It’s intentional. This time, it just got out of hand. Not from counterfeiting, but from legitimate money creation.  

Take a look at the St. Louis Fed website. Just do an internet search for “M2 money supply”. In 2020 the money supply exploded. Not counterfeit. It was Legal Tender. Because of the lag time from currency flooding the economy and inflation we are now feeling the effects. Thank you, US Congress. 

If you have been wondering maybe the US Congress doesn’t always have our best interest at heart, perhaps you are onto something. Think about this. Like you, I live in Sierra Vista. I also own a small business. It’s nothing of significance but I like to think I make a difference in the lives of the people I serve. It’s my small way of pursuing happiness in my life.  

In 2021 Congress passed the Corporate Transparency Act (CTA). As a result, small businesses have to disclose all the details of their business ownership. We have to upload our business details into a government database. You know, the kind of database that is a major target of cyber criminals. The kind of database our government bureaucrats should protect but don’t. From a cybersecurity perspective, the data they require for compliance can easily be used in a social engineering attack to get YOUR information and to scam YOU. Even if you aren’t the small business owner. 

The funny thing about the CTA is that it affects only small businesses that almost exclusively do business locally. Corporations with over $5 million in annual revenue are exempt. The reason Congress claims they passed this legislation is to eliminate elicit money laundering. It’s supposed to be a way to financially suffocate terrorist cells. Most money laundering happens in companies handling greater than $5 million. The exemption is in the wrong direction. It will achieve the stated intent. It’s a shell game.  

Small businesses have little or no budget to hire cybersecurity professionals to protect their computers, networks and sensitive business data. They are the most vulnerable to cyber attacks like ransomware. so in reality what this Act will do is provide a convenient database containing millions of small businesses who characteristically have little or no cyber security controls protecting their data. All neatly packaged for any moderately skilled threat actor.  

Maybe it’s not the end of the world. Or maybe it is the end of the world as we have become accustomed to it. 

Even the Experts Can Be Fooled
0
Dan Gavin
Even the Experts Can Be Fooled

When even experts in social engineering can be fooled, it is important to ensure a defense in depth strategy for your business’ information security.  KnowBe4, one of the country’s largest providers of cybersecurity and social engineering training, got fooled by a North Korean IT worker intent upon loading their network with malware. 

KnowBe4 had a job opening. They were looking for someone for their internal Artificial Intelligence (AI) team.  What they received instead was a valuable training lesson in advanced social engineering. They were fooled. But unlike many companies, they disclosed the failure. Their experience might save others from a similar fate. 

Fortunately, they caught the imposter early enough so there was no breach or illegal access to the company’s systems.  They stopped him before he could do any damage.  Here is how it happened, how they stopped it, and some lessons learned. 

The human resources team did their jobs.  Background checks came back clean because the imposter was using a valid but stolen US-based identity.  They conducted 4 video conference-based interviews validating that the person matched the photo on the application.   The imposter took a stock photo and used AI to merge his features to the photo.  HR even verified his references. 

Once hired, the imposter asked to have his laptop sent to a farm. Not the kind you’re thinking of. It was “an IT mule laptop farm.”  The laptop farm is like an office filled with laptops and computers hackers use. They connect remotely from North Korea to the laptop farm. It was a good thing KnowBe4 restricted new employee access and didn’t allow access to the production systems. 

Once the imposter had been successfully hired and his laptop had been delivered, it was time for him to embed his malware onto the company network.  He downloaded and attempted to execute malware.  He then used some technical trickery to cover his tracks. 

The good news is the company security operations center (SOC) was alerted to potentially dangerous behavior and called the imposter.  The imposter claimed criminals must have compromised his router.  The SOC team quickly isolated his computer from the rest of the network preventing his access to valuable systems and data.  The imposter was unresponsive once he figured out that he was caught.  

Here are some lessons learned.  When a company uses remote workers with remote computers, the company should have a way to scan the device ensuring there are no other connections on the device.  When hiring workers, don’t rely simply on email references.  Do not ship laptops to locations that don’t match the applicant’s address.  Make sure applicants are not using Voice over IP (VOIP) phone numbers.  Lastly, watch for discrepancies in address and date of birth.  

With all the process failures, KnowBe4 did not suffer a breach.  They understood defense in depth.  They had multiple lines of defense in case one (the employee screening process) was breached.  All their laptops had endpoint detection and response (EDR) software loaded and they had a SOC watching over their network.  The EDR stopped the malware from executing and alerted the SOC. The SOC team isolated the computer right away and escalated the issue.   

When it comes to protecting your business, you cannot rely on the minimal protections.   Firewalls and anti-virus are useful, but they do not stop a hacker from entering through your email or your browser.  Technology, like EDRs and SOCs, may save the day, but must be backed up with tried-and-true policies and training.   Although KnowBe4 is an expert in social engineering, they got scammed due to lax hiring policies.  They have since updated their hiring policies.  Remember, a fool may learn from his own mistakes, but a wise man learns from the mistakes of others.   Be the wise man. 

Six ways to harden your digital profile 
0
Dan Gavin
Six ways to harden your digital profile 

“Kevin” was very frugal. He flossed daily, washed his hands often, wore deodorant, and never ate at McDonalds. He always came to a complete stop, separated his recyclables, ate more veggies than meat, and turned off the lights when he left the room. He also used a credit card responsibly; always paying it off every month. He had another card he used rarely and paid off just as quickly so his debt-to-credit ratio would benefit his credit score.  

One day Kevin’s 12-year-old clunker broke down for the last time. He needed a new car. The excitement was actually kind of cool. He researched the options and decided to go for sporty rather than practical this time. The test drive was thrilling. The smell of “new car” instead of “old tube socks filled with fries and candy” was a surprise. A welcome one. But right around the corner was another surprise. A very unwelcome one. Kevin’s credit score. Even though Kevin was ultra responsible in other areas of life, he was not used to checking his credit records regularly. He wasn’t even aware this was a thing. Someone had stolen his identity – and ruined it. 

I have bad news. There is a very high probability your personal information (not just your name and address) is on the dark web. Your social security number, your birth date, your address. Most of what an online criminal will need to steal your identity.  I mention this because 2.9 billion records were recently hacked from National Public Data consisting of these items.   

You’re probably so tired of hearing this. You might even think, “what’s the use?” While this news is dire, it is actually worse than you think. With the exposed personal data (like SSN) combined with other information easily accessible on social media profiles, a criminal can build a detailed profile of a victim. Armed with the data, the criminal can port a cell phone number to a phone they control, intercept the one-time code sent from the victim’s bank account and wipe out the victim’s life savings. They can drain other investment accounts, open new lines of credit, purchase property on credit, etc. Anything you can do with your personal information; a criminal can do just as easily. 

This is going to take some time. Really you can significantly strengthen your digital life within less than 2 hours. While this is not intended to be a technical tutorial, and we cannot give legal advice here, you can do the following: 

  1. Use a password manager like Bitwarden 
  1. Enable 2 factor authentication on all your critical accounts (banking, investment, email social media, cell phone provider) 
  1. Create a free login and freeze your credit reporting account at Experian, Equifax, and Transunion. 
  1. Use good credential hygiene as we have always advocated here. 
  1. Remember, if you get an email, text message or phone call requesting you to unfreeze your credit and you didn’t initiate it, it’s probably a scam 
  1. If you receive a contact you did not initiate AND the person claims you are in trouble in any way AND it makes you feel anxious AT ALL, it’s probably a scam. Stop the communication and contact the purporting organization using a known-good number.  

Moving forward the world is going to be less trustworthy. You need to adopt a posture of zero trust. Be suspicious of everyone and everything. It could save you. 

The original article was posted to the Sierra Vista Herald and can be found here.

Driving Under Surveillance:  Your Car’s Silent Betrayal 
0
Dan Gavin
Driving Under Surveillance:  Your Car’s Silent Betrayal 

Previously, we discussed the fact that your mobile phone vendors are providing your location information (and more) to data brokers who, in turn, sell that information to advertisers. I have some alarming news for you, that is not the only way that you are being surveilled by today’s technology. Basically, if your device has a connection to the internet, there’s probably a way to spy on you whether that device is a phone, tablet, baby monitor, or your car. 

In the United States, your privacy is NOT protected. There is no settled law on what is or is not allowed to be collected from you electronically. Although law enforcement cannot collect the information without a warrant, they can purchase the information that is in the public domain. Almost all End User License Agreements (EULA) that are required before using your digital applications (like a browser), have a stipulation that you allow them to collect and even sell your data. This is all legal and very lucrative in the U.S. 

Unlike the U.S., the European Union (EU) has a law that protects the privacy of their citizens called the General Data Protection Regulation (GDPR). This law dictates that the personal data should only be stored as long as necessary with safe and secure processing. Two of the key rights included in the GDPR are: 1. The right to know what data is being collected and how it is used.  2. The right to have your data deleted from the databases. 

Previously we discussed how the applications on your devices gather your data and sell that to data brokers who sell advertisements. Do you realize that your car may be gathering data about you? In a typical new car these days, data can be gathered from your navigation system, Bluetooth, the Tire Pressure Monitoring System, cameras, and your infotainment system. Anyone can put a radio receiver at travel choke points and follow specific cars as they travel around. 

Did you know that car companies, like Kia, Nissan, GM, and many more, glean personal information about drivers after they pair their smartphones with a vehicle’s connected services? They can take that information and sell it to vendors and insurance companies. You don’t have to sign up to be tracked by GPS by your insurance company for them to know your driving habits. Just last week someone relayed a story about their friend whose insurance company cancelled his insurance through data the insurance company bought from the vendor. The company claimed that driver accelerated too fast and broke too hard for them to continue to insure him. They do not need to ask you how you drive; the insurance companies already know. 

LexisNexis Risk Solutions and Verisk are consumer reporting agencies that use driver data to create a risk score that they share with insurance companies. A report can show a driver’s individual journeys, showing information like trip durations, distances, instances of speeding or abrupt driving maneuvers. If you have OnStar in your car, you likely consented to sharing this data when you bought the car perhaps without realizing it. There are multiple class action lawsuits against GM, OnStar and LexisNexis ongoing at the time of this writing claiming that their data was collected and used against them without their consent. 

If you are curious to see what data is being collected from LexisNexis, you can go to their website and request a report at https://consumer.risk.lexisnexis.com/request.  Your auto makers all have similar request forms. Some states (not Arizona) have laws allowing consumers to opt out of having their information sold to third-parties. 

This is just the tip of the iceberg with respect to how you are being tracked on the internet. We can cover more in later articles. If you would like your data protected similar to what the EU does with the GDPR for their citizens, contact your state and federal representatives. 

Cyber-attacks on voting infrastructure. Is there a backup plan?
0
Dan Gavin
Cyber-attacks on voting infrastructure. Is there a backup plan?

Imagine that during this upcoming election in November if no results were available until days after the election. On July 31st the Cybersecurity and Infrastructure Security Agency (CISA), in conjunction with the Federal Bureau of Investigation (FBI) released a public service announcement stating that there is potential for a Distributed Denial of Service (DDOS) attack on election infrastructure and adjacent infrastructure that supports operations. 

To better understand the situation, here is some background information. CISA was established in November 2018 to enhance the security, resilience, and reliability of the nation’s critical infrastructure. CISA is at the heart of mobilizing a collective defense to understand and manage risk to our critical infrastructure and associated National Critical Functions. Basically, CISA is charged with protecting US cyberspace as well as the nation’s critical infrastructure such as power, water, and even our elections.

A DDoS attack is a malicious attempt to disrupt the normal traffic of a targeted server, service, or network by overwhelming it with a flood of internet traffic. Hackers do this by using many compromised computer systems as a source of attack traffic. It is like a mob of people rushing to a store to block legitimate customers from shopping. Imagine tens of thousands of computers that have been loaded with malware without the users’ knowledge. Now imagine all those computers running a program at the same time against specific sites making continuous requests against the election infrastructure.

Now back to the announcement from CISA: 

“With Election Day less than 100 days away, it is important to help put into context some of the incidents the American public may see during the election cycle that, while potentially causing some minor disruptions, will not fundamentally impact the security or integrity of the democratic process,” said CISA Senior Advisor Cait Conley. “DDoS attacks are one example of a tactic that we have seen used against election infrastructure in the past and will likely see again in the future, but they will NOT affect the security or integrity of the actual election.”

CISA’s intent is to assure the public that the elections will not be affected even though there may be disruptions that may prevent the public from receiving timely information. However, if they know that adversaries may target the elections, how do they know that the elections will be safe and secure? How do they know that a DDoS against the voting tabulation network won’t block results from being collated. How do they keep a breach from occurring in the voting infrastructure? What happens if there is a major regional power outage due to cyber-attack? As we know from the CrowdStrike outage where Maricopa County’s Dominion voting machines got the blue screen of death update (see article from 2 weeks ago for more details), voting machines are on the network. Why would it just be periphery report structure and not the actual voting? As a cybersecurity professional the joint FBI and CISA statement provides more questions than answers. 

Perhaps to properly secure the election system, we need to employ the same cybersecurity strategies that businesses use in case of emergencies. There should be contingency plans ready in case of a cybersecurity event. Precincts, counties and states should be ready to manually count the votes for all the races in case of a regional or national cyber-attack. The people required to perform the required functions – counters, watchers, recorders should be prepared and ready. Knowing the risks, should manual counting of paper ballots at the precinct level be the primary method with machine backup?

It seems CISA and the FBI are placating the public and telling us not to worry. Maybe they should spend more resources into hardening the infrastructure and working with the local resources on contingency planning in case of emergency. 

This article was originally published in the Sierra Vista Herald found here.

Copyright © 2024 CyberEye Call us at: ‪(520)224-8981