The $100 Million Phone Call – Tale of the MGM Hack
0
Dan Gavin
The $100 Million Phone Call – Tale of the MGM Hack

In 2008, an Australian man received a $147,000 phone bill while traveling in Europe. It appeared his 12-year-old son was playing a game of “Tap, Tap, Revenge” on his iPhone the whole time. That was quite a bill, but it is peanuts compared to the 10-minute phone call to technical support that cost MGM Resorts close to $100 Million.  

In September of 2023, a group of cyber hackers from the US and UK, ranging in age from 19-22 called Scattered Spider, used social engineering to take down many of the operations of the almost $34 Billion gambling giant. Cyber criminals went to the Linked-In social media page to find an employee that works in IT for MGM Resorts. A member of the State sponsored group named Scattered Spider called the MGM tech support team impersonating a hard-working IT employee that needed a password reset. After 10 minutes on the phone, the hackers owned that account. This was the cornerstone of the operation. If tech support verified who they were talking to prior to resetting the password, this attack may have been less damaging. The helpful tech support worker had an amygdala hijacking. The urgency to help took over the logical part of the brain that would have verified the caller.  

Once in the network, they escalated their privileges (gained admin rights) and found their way into the most valuable computers. The computers were responsible for the hospitality applications used to run the hotels and casinos. The hacking group loaded ransomware on over 100 servers. One by one the ransomware encrypted the systems and the applications crashed. Hotel keys no longer worked. Slot machines were unavailable. Point-of-Sales systems (credit cards) were unable to take payments. Guests were not able to reserve rooms and check in or out. MGM saw operations in eight states affected by the intrusion.  

Because MGM did not immediately pay the ransom, their systems were in a state of upheaval for 10 days. The losses from the disabled slot machines alone cost MGM an estimate of $5 Million a day. Some estimate a total loss of $8.4 Million per day. MGM Resorts International claimed the disruption in service caused a $100 Million loss in the third quarter results. Additionally, they spent another $10 Million on legal fees and technical consulting. As a result of the attack, their stock dropped $850 Million in market value. They have since recovered that loss. However, their biggest loss might be the damage to their reputation.  

Just a week before, another casino giant, Caesars Entertainment, suffered a ransomware attack. In contrast they immediately negotiated the ransom from $30 to $15 Million and saw only minimal disruption. The bright side (if there was one) for both corporations was that they both carried excellent cybersecurity insurance policies which covered the cost.  

There may be legitimate business reasons to pay the ransom, but it comes with an additional ethical price. The ransom you pay funds other elicit criminal activities like drug smuggling and human trafficking. We will save that discussion for another day.  

Don’t think this only happens to huge corporations, it happens to small and medium sized companies every day in America. Employees need cybersecurity training, so they don’t fall for the kind of trick played on MGM. You need to have company policies in place to protect against impersonation. You need business plans such as Incident Response Plans and Contingency of Operation plans developed and ready in case of an attack or disaster.

Keep all that in mind for your business the next time you receive an unexpected call. What will this phone call really cost? 

Original article in the Sierra Vista Herald found here:

Scammed! How Hackers Hijack Your Amygdala
0
Dan Gavin
Scammed! How Hackers Hijack Your Amygdala

Last week an elderly friend called me. He had been scammed out of $13,000 … almost. RIGHT before he finalized sending the money, he had a lucid moment and thought “this is probably a scam”. He ended the call and phoned his bank. All ended well.

So, what can we do to help our elderly friends and family? They are easy pickins for professional scammers. These scams work because they incite a cognitive response in the mind of the potential victim that causes them to jettison all logic. They simply fall prey to an ancient brain-part — the amygdala. Chris Hadnagy (professional white hat social engineer) references the term “amygdala hijacking”. It’s a term coined by Dr. Daniel Goleman. Hadnagy states scammers use techniques that hijack the amygdala which shuts off the logic center of your brain. The tragic result is that in less than 30 minutes your elderly loved one will transfer tens of thousands of dollars to a person they’ve never met.

According to Hadnagy, there are 4 vectors of social engineering attacks: 1. Phishing. 2. Vishing. 3. SMiShing. 4. Impersonation. I’m sure we could add to or subdivide these categories, but this is enough for now.

Phishing is typically an email delivery. That’s how my friend was targeted. He received an email informing him his Norton antivirus subscription had just been renewed for $250. He was kindly informed to “call this number if you’d like to cancel.” Panic set in. The amygdala hijack was on. He completely ignored the fact he NEVER had a Norton antivirus account.

Vishing uses the same content essentially as a phishing email but delivered over a phone call. SMiShing is the same – except over text message. Impersonation is an in-person visit from someone pretending to be someone like phoneline repair or a plumber.

In almost all these cases the scam works because the content of the message causes the victim to immediately panic. The anger, fear, or excitement they feel disables all the logic which they would normally use to make informed decisions. This is where the amygdala takes center stage. Logic takes a lunch break.

It’s here that the scammer handholds the victim all the way through the scam. They promise to fully refund the victim’s money. This makes the amygdala happy. The scammers convince the victim to let them remote connect to their computer. Next, they do some confusingly technical looking things to build false trust. But it’s all a ruse. The scammer is counting on the good heart and trusting character of the victim. Trust and honesty make them the perfect victim.

To protect yourself and your loved ones, here are a few rules:

1. Trust no one.

2. If you get any kind of communication you didn’t expect, pay attention to your feelings. Does it make you anxious in any way? Then it’s a scam.

3. If the message you received claims your bank account or credit card have been charged, close the message and contact your bank using a known-good number.

4. If the message appears to come from a government agency, close the message and contact the agency using a known good number.

5. Every organization that deals with your money has a fraud department. Contact them. They can help you get things straightened out.

6. Contact the Cyber Guys at CyberEye.

Original Article appeared in the Sierra Vista Herald here

The Cyber Guys: Are we going to have a catastrophic cyber event in 2024?
0
Tom Jewkes
The Cyber Guys: Are we going to have a catastrophic cyber event in 2024?

What would happen to the country if most of the internet went down for a day? 

In January 2023, the World Economic Forum released a cybersecurity report that found 93% of cyber leaders, and 86% of cyber business leaders believe geopolitical instability makes a catastrophic cyber event likely in the next two years.  Nation states may focus on cyber warfare to accomplish their objectives rather than kinetic alternatives.

With major wars going on in Gaza and Ukraine, that could look like an attack on critical infrastructure as a response to American policy in either region.  On a small scale, this has already happened.  In November the federal Cybersecurity and Infrastructure Security Agency revealed hackers had breached computers at “less than 10” water facilities in different parts of the United States. U.S. and Israeli authorities issued an advisory confirming that hackers had “accessed multiple U.S.-based” water facilities that operate Israeli-made equipment, likely by breaking into internet-connected devices with default passwords.

The U.S. and Israeli government agencies blamed hackers affiliated with the Islamic Revolutionary Guard Corps, a military branch of the Iranian government, for the activity.

In December the Jerusalem Post reported a significant cyberattack that impacted Israeli emergency services. Cyberattacks on critical infrastructure, such as emergency services, can result in response time delays, compromised communication systems, and even the loss of sensitive data. These attacks not only put lives at risk but also have far-reaching societal and economic implications.

The hacking goes both ways.  A hacking group previously linked to Israel, known as “Gonjeshke Darande” or “predatory sparrow,” claims it took down 70% of the gas stations in Iran by gaining access to the payment systems.

But geopolitical instability is not the only threat in cyberspace. The WEF conducted cybersecurity scenario simulations in 2020 and 2021 called Cyber Polygon. In the 2020 exercise, it predicted the world would experience a “digital pandemic.” There could be a virus that mass-infects internet-connected devices similar to how the coronavirus mass-infected the physical world.  In the case of a “digital pandemic,” the infection would spread so much faster the only answer might be to remove devices from the internet so they don’t get infected — effectively shutting down the internet for a time.  

The 2021 Cyber Polygon exercise focused on an attack on third-party supply chains where major organizations were “collateral damage” of the attack.  For example, in February 2022, a cyberattack on commercial satellite services in Ukraine caused electricity-generating wind farms to shut down across central Europe. In July 2021, supermarkets in Sweden were forced to close their doors after a cyberattack on IT services provider Kaseya, based in Florida.

But wait, there’s more! Cybercrime has become big business. Cybercrime is expected to grow from $3 trillion in 2015 to $10.5 trillion in 2025.  Crime ranges from phishing emails looking for $100 Amazon gift cards, to social engineering of crypto wallets producing millions, to ransomware that affects small town business and huge multinational businesses alike. 

As a business owner, what can you do to protect yourself?  Are you doomed?

Of course not, you can set up a defense-in-depth strategy to protect your data. Change the default passwords on all your devices.  Use good password hygiene.  Set up multi-factor authentication on your systems wherever you can. Back up your data. Implement application whitelisting that allows only approved applications to run. Train your employees how to identify malware and social engineering schemes.  Have a Business Associate agreement in place. Create an incident response plan in case of a cyber incident and develop a disaster recovery plan in case you lose access to all your data.

If a catastrophic event does occur in 2024, you can survive and thrive if you properly prepare. Want to learn how?  Ask the Cyber Guys from CyberEye.

https://www.myheraldreview.com/news/business/the-cyber-guys-are-we-going-to-have-a-catastrophic-cyber-event-in-2024/article_e02a9cc2-abf4-11ee-a175-8f398b7c9072.html

JOURNEY TOWARDS SECURITY
0
Tom Jewkes
JOURNEY TOWARDS SECURITY

Stay secure while preparing for the new year

The new year is upon us!
Whether you are posting pictures from the holidays on social media, creating a new year budget, or setting up that gifted smart TV, cybercriminals are finding ways to sneak their scams into these exciting times. As you take on whatever the new year throws at you, make sure your journey includes staying cyber secure.

There are many resources and programs online you can use to help accomplish fitness and health goals. When searching for gyms, workout plans, or healthy recipes, watch out for scams. Some of these scams are nothing more than misleading ads, while others result in no product being delivered at all. Be wary of any pills, diets, or programs that promise immediate results.

The new year is a great time to look at finances. With the rise of online shopping, it can be difficult to keep track of purchases. Set a routine to check your transactions on debit and credit cards and look for any suspicious charges you didn’t make. Many people are using budgeting apps. Make sure to read reviews and research the app before downloading or entering your personal information on it. Avoid entering your banking information on unknown apps.

Online surveys may seem like an easy way to make money, but it is important to do your research before participating. Many of these sites are scams. If the money offered seems too high or if a reward is offered just for signing up, it is likely a scam. Be careful with your personal information. Read the privacy policy and leave the survey immediately if the questions ask for sensitive information.

Costco or Walmart
0
Tom Jewkes
Costco or Walmart
Denied

Where do you prefer to shop? Walmart is easy to get in and out. Usually without even the slightest interaction. Costco on the other hand is different. You need to have a membership card first. No card, no access.

Your computer security is similar. Generally speaking the security you are using is either the Walmart model or the Costco model. If you chose Walmart, malware can get in and out without you ever knowing. Sadly though, you are never offered the option for the Costco security model. Except here at Cybereye. Give us a call so we can tell you how it works and so you can have the peace of mind our customers rave about.

Contact A CyberEye Cyber Guy
Protect Your Castle Like a Medieval Fortress
0
Tom Jewkes

In the year 1209 the Cathars were besieged at Carcassonne in southern France. The Cathars were a religious group branded heretical by the Pope. Within the heavily fortified city the Cathars were protected but vulnerable to a supply chain attack.

The Castle Comtal within the fortified city in France’s Aude department, stands as a monumental testament to medieval military architecture and strategy. One of the most distinctive features of this castle is its portcullis with two independently controlled gates. This engineering marvel serves as an apt metaphor for the need to separate your Information Technology (IT) and Cybersecurity teams.

The Portcullis at Carcassonne

The fortified city of Carcassonne has a complex defensive system that has stood the test of time. One of its remarkable features is the portcullis, a heavy grilled door that could be dropped or raised to secure the castle’s entrance. But what sets Carcassonne’s portcullis apart is its two independently controlled gates. This means that even if one gate were compromised, the other could remain secure, providing an additional layer of defense.

Separating IT and Cybersecurity Teams: A Modern-Day Portcullis

In modern organizations, the IT and Cybersecurity teams often have different mandates but overlapping responsibilities. The IT team is generally responsible for managing the hardware, software, and networks that keep the company running. In security terms this is called “Availability”. The Cybersecurity team, on the other hand, focuses mainly on protecting the “Confidentiality” (controlling who can see what), and the “Integrity” (who can change what).

Much like the dual gates of Carcassonne’s portcullis, these teams should operate independently but in tandem. A Change Board approves software installations and updates; The Cybersecurity team updates the allow policies and the IT team implements the changes.

Advantages of Separation

1. **Focused Expertise**: Specializing allows each team to become experts in their area, leading to better performance and problem-solving.

2. **Risk Mitigation**: Separating the approval and installation of software makes it almost impossible for a disgruntled employee to wreak havoc.

3. **Checks and Balances**: Independent operations allow for internal checks, reducing the likelihood of systemic failures and oversights.

The Harmony of Independence and Interdependence

While it’s crucial for these teams to operate independently, they should not work in silos. Much like the independent but harmoniously functioning gates of Carcassonne, IT and Cybersecurity teams should have protocols for secure communication and collaboration. For instance, while the IT team may be responsible for implementing a new software platform, the Cybersecurity team should be involved in assessing its security features and updating the allow policies.

Conclusion

The dual-gate portcullis at the Castle at Carcassonne serves as a timeless symbol of defense in depth. In a world where cyber threats are increasingly sophisticated, the need for separate but coordinated IT and Cybersecurity teams has never been greater. By learning from the past and applying its lessons to the present, your company can fortify your castle against the ever-evolving challenges facing you.

A Chicken Tale – A Cyber Parable
0
Dan Gavin
A Chicken Tale – A Cyber Parable

A Cyber Parable:  Imagine you are a chicken rancher. Your chicken are free-range, no antibiotics, and (most importantly) hypo-allergenic. So, people with egg allergies can use your eggs to make cookies and other goodies. If they ever inadvertently eat store bought eggs they would die. You can see the value in your eggs.  

You Are At Risk:  But who would even want to harm your business. You are small. You only serve a small geographic area. Imagine, you have a very elite clientele. Because your eggs are so unique, your clientele consists of some very influential and powerful people. If a criminal wanted to target a powerful person, they wouldn’t have to do it directly. All they have to do is gain access to your hen houses and plant store bought eggs. Then wait for you to deliver them to your clients. It doesn’t even matter to the criminal if they hurt others as well. Those would merely be collateral damage to the criminal. As long as their target was affected, their mission is complete.

Supply-Side Attacks:  This is pretty much how supply side software attacks happen. A legitimate software vendor with lackadaisical security on their software repository (the henhouse) gets infiltrated by a threat actor. A legitimate file (your precious eggs) gets infected with malware (store bought eggs), then the threat actor simply waits for the vendor to ship out the infected file. 

Does this happen? You bet it does. A few months ago, a huge software vendor named SolarWinds had this happen to them. It affected about 18,000 of their high value customers. 

Try This:  So now we find we can’t even trust the vendors to keep their software repositories (their hen houses) safe. But what can you do about it? Here’s what you can do. Before you install any new software or any update, you can upload the software to virustotal.com and have the file scanned for you at no cost. It’s not foolproof but will give you at least a small measure of assurance the file hasn’t been tampered with.

Some Cautionary Statements: There are two possible problems here. First, VirusTotal is a public website, so don’t upload any sensitive files. Second, VirusTotal will only report a file as malicious if: 1. VirusTotal has seen it before AND 2. The antivirus engines it uses to scan the file has verified the file is malicious. What this means to you is, if the good eggs were just switched out for bad eggs this morning,  VirusTotal will not know it’s bad. And you will install malicious software. So, with this technique, your mileage may vary.

Other Options:   There are other options for your protection that we have discussed in other articles like application whitelisting and ring fencing that can provide more protection.  Ask us or your local cyber team about it. 

You Are Being Stalked
0
Dan Gavin
You Are Being Stalked

Somebody Is Watching You:  Imagine that there is someone following behind you day and night, watching and writing everything you do into his notebook.  Now, imagine that his cohort is doing the same thing to your spouse.  But it doesn’t stop there, they are also following your children.  They take their information and report it to their boss.  Seems pretty creepy, right?  Because it is.

Big Tech Advertising:  That scenario is played out every time you browse the internet, shop online, or use social media.   Your activity is being monitored and tracked by the big tech companies like Google and Facebook.   Have you ever wondered how Google could afford to give you free email when 20 years ago it was expensive?  Or how Facebook can provide their platform for free?   They can afford to do that because you, the user, are the product.  They are selling your information for targeted advertising.  They are getting rich by selling the browsing habits of their users or by tracking what you like or don’t like on social media or the types of videos you watch.

Eye Opening Ted Talk:  In recent years, there has been increasingly louder outcries from the public once the digital stalking has been made public.  In his TED Talk, Gary Kovacs used a tool in his FireFox browser called Collusion that creates a map of the different organizations that are tracking your activity.  After hitting only four websites, there were 25 different trackers.  On a typical day this number grew above 150.  There is a plugin for Chrome and Edge called Ghostery that alerts you of the number of trackers attached to your session for each site. It also allows you to block them.  Social media sites are known for having more trackers associated as compared to other sites.

Cookie Replacement:  There is a push to remove these tracking files called cookies to give users more privacy.  Advertisers were concerned about possibly losing this venue for targeted marketing.   Google, however, has stepped in to create a new anonymous online identifier to replace cookies called Federated Learning of Cohorts (FLoC).   FLoC uses your browsing history from the past week to assign you to a group, a FLoC ID, with other “similar” people around the world.  Google sells access to these FLoC IDs   as long as the advertisers agree to basic guidelines, which would aim to deliver users greater privacy and control over how they browse the web. This methods still contains many of the same privacy and possible discrimination issues that cookies have. 

Defensive Tools:  You are not alone or defenseless in this attack against your privacy.  The Electronic Frontier Foundation (EFF) is a privacy advocate for the people.   They have created a browser extension called Privacy Badger that works on FireFox and Chrome. It monitors third parties and ad networks that try to track you through cookies and digital fingerprinting and can even auto-block them.  Another thing you can do to protect your privacy is to change your search engine.  Google, Yahoo, and Bing all collect your information to “personalize” your experience.  Instead use search engines designed for privacy in mind like DuckDuckGo, Qwant, and Startpage.  If you want to go all out, you can use a relatively new browser called Brave that blocks ads and trackers.   For complete privacy with end-to-end encryption for your messaging and phone calls, we recommend an application for both phones and computers called Signal. 

Regain Your Privacy:  It is time to get that stalker off of your back and regain your privacy.  Check out Ghostery, Privacy Badger, DuckDuckGo and Brave while enjoying your online experience without being tracked.

Time to Put a Light on the Shadows
0
Dan Gavin
Time to Put a Light on the Shadows

Missile Controls: During the Cold War, there were hundreds of top-secret nuclear missile silos around the United States and allied countries.  An example of the silo can be seen here in Arizona at the Titan Missile Museum.  Many of the silos are still in use today.  They are guarded with service members with extremely high- level security clearances where the details of the location and security procedures if exposed could give the enemy the upper hand.

National Security Issue: Understanding the importance to national security, what if I told you that for the last seven years, details of operations of nuclear weapons in Europe have been on the internet, freely available to anyone through flashcard-learning applications.  Since 2013, flashcard applications like Quizzlet, Cheg, and Cram were created by service members at six European bases to help them memorize security protocols about US nuclear weapons and the bases.  Details included the location of the exact shelters and “hot” vaults that contain the nuclear weapons.  Camera positions, frequency of patrols, and unique identifiers for restricted area badges were part of the package.  In addition, secret duress words that signal when a guard is being threatened were exposed. 

Security Breach: A journalist from Bellingcat looked up terms associated with nuclear weapons bases, like Weapons Storage and Security Systems (WS3), associated with air bases, and the flashcard apps showed up.  This was a huge security breach, and it went on for more than seven years! 

Shadow IT: This is a perfect example of the risks of Shadow Information Technology (Shadow IT).  Shadow IT is any technology that employees uses without approval or support from their IT department. Examples of Shadow IT include using personal emails, music streaming services, collaboration tools, and storage and sharing applications that have not been approved for use. 

Circumventing the System: The flashcard-learning applications are cloud-based applications open to the public.  The service members did not have a similar technology to help them memorize all the protocols, so they went to the web and used a specific free tool that helped them learn much more efficiently.  The members created Shadow IT because the military did not provide a secure solution. Sometimes, Shadow IT exposes to management the tools required to perform the tasks to get the mission accomplished.  If leadership acknowledged the requirement and created a secure solution, that sensitive information would have been kept secret. 

Big Risks: Shadow IT is a security risk.  It is projected that one-third of successful cyber-attacks are on data located in Shadow IT resources.  That’s because, if the IT department does not know about it, they can’t secure it.  When left unchecked, businesses risk proprietary data or customer data.  If exposed, that means loss in the marketplace, downtime, fines, or damage to reputation. 

How to Avoid It: To protect your business, find out all the tools that are being used by your staff.  Provide amnesty to anyone using unauthorized apps. This provides insight into what is required for their tasks and gives you a chance to confer with your IT or cybersecurity professionals to determine a secure way forward.  Whitelisting application tools provides insight to management into what applications are used on the work network, and management can decide what is allowable.  There are no secrets when a whitelisting tool is used.  Shadow IT is exposed to the light.

Moral of the Story: Whether you are protecting nuclear warhead secrets, or your company’s process to beat the competition, Shadow IT can have a negative impact on your operations.  Discover what is out there and find a way to secure it. 

Friction Makes Us Stronger
0
Dan Gavin
Friction Makes Us Stronger

The Greatest: Many would argue Michael Jordan was the greatest basketball player who ever lived. But are you aware he didn’t win a championship for the first SIX YEARS he played professional ball? Michael Jordan was a great individual player. But he couldn’t have achieved all he did without the help of those around him.

Can’t Do It Alone: Obviously, Jordan couldn’t win championships by himself. He needed help. Enter Scotty Pippin. Pippin was a great compliment to Jordan’s aggressive style. But even then, the Bulls still couldn’t get past the Detroit Pistons. Slowly, the team added additional players and new head coach. And they beat the Pistons.

You need to surround yourself with helpers too.

Helpers or Rivals: Helpers don’t always appear as you would expect. Sometimes, they might even look like rivals. Rivals provide friction. And friction makes you stronger.

Len Bias: Lenny Bias was friction for a young Michael Jordan. When Jordan and Bias were in college, they were opponents. On February 19, 1984 their teams faced off for what would be their last game together. Bias playing for Maryland and Jordan for the Tarheels. Jordan was more experienced. But Bias was clearly getting better by the day.

We can only speculate that the presence of Bias playing against Jordan and the Tarheels was a significant motivator for Jordan. But given Jordan’s competitive nature it wouldn’t be a stretch.

Rivalry That Wasn’t: In a USA Today article about the rivalry that wasn’t I found this quote from Michael Wilbon,

“Those of us who had the pleasure of watching him believe Bias would have been to Jordan what [Larry] Bird was to Magic [Johnson] — a true natural, equally fierce rival, the singular decade long rival Jordan never had.”

Need Friction: In life sometimes the help we need to achieve greatness comes in the form of opposition, or friction. We achieve greatness, not from a “tensionless state” as Viktor Frankl said.

Cyber Slow Down: In terms of cybersecurity, slowing things down and creating a little controlled friction is necessary so we can review software changes before they are made. Moving too fast to update a server (for example) or installing a new application without running it in a test environment can lead to disaster.

Slow Down to Go Faster and Avoid Pain: Two CyberEye clients this week experienced something like this. One client requested a new program installed. After review we found it was installing other software in the background that might be malicious. We were able to avert potential disaster. Another customer installed an update to a critical server without testing it first (against our recommendation). That outcome wasn’t trouble free. A brief test beforehand would have saved hours of headache.

Yes, Test It: When your business depends on your computers, slow down and take time to test new software. Testing your software in a controlled environment first adds a little friction to your workflow. But it just might be the friction you need.

Copyright © 2024 CyberEye Call us at: ‪(520)224-8981