THe CYBeR SeCuRiTY JouRNeY...

[cyber-kia]

Conversations with Friends

Lately when my friends ask me what I am going to do after graduation, and I start talking about IT I get the same questions. 

What is Ethical Hacking? What is a security analyst do? Etc. Etc

More specifically, when I get to talking about securing Medical Data online. I actually had one ‘friend’ say, “why would a hacker want to hack into your information just to see if you have back problems or a urinary tract infection? That doesn’t seem very lucrative”

(Insert Mental Eye Roll Here)

So when we think about your personal medical information, lets use the exciting scandal example first. (Everyone loves a scandal.) What if the child that isn’t your husbands child, has a DNA test in their medical file listing a father that is not the same as what is on its birth certificate. What if this family scandal ruins the entire family structure, leading to divorce, counseling and a whole mess of emotional problems? -Because you couldn’t pay the “ransom” that the hackers were requesting to keep that quiet? 

Or a more realistic example. Your medical files have literally everything a hacker would want to know. Your social and birthday for one. Then if the information is being stolen to be able to actually assume the victims identity (that is often sold to the highest bidder) then they have any kind of verifying details that someone would need. Conditions, location, family members, children, occupation, etc. It is all right there for the taking. And this is why we have HIPPA laws and CI companies that help to prevent this from happening to you. 

A good true crime story about ID theft is one called “Identity Theft: The Michelle Brown Story” (They even did a lifetime remake of the story too) It’s super interesting because of the REAL solid example of what ID theft really IS. Not the little 2 bit hustle the drug addicts and criminals use today to get a “fast buck”. Like real, true Identity Theft. This is a link to her testimony.

https://www.privacyrights.org/written-testimony-michelle-brown

It’s a tough job being in IT. And I say that only because it is frustrating how much of the world really just doesn’t have any idea. Which then makes them victims because they have no safeguards in place, because they don’t know to look for them. At what point do we REALLY get the word out there? In a perfect world you should have to have a license to operate a computer or be on the internet. Just like a drivers license. :-) 

Stay tuned for more on this journey! My class stops here but the information doesn’t. 

Be well and stay safe. <3

[cyber-kia]

Cyber War is Here

“• 72% believe nation-states should have the right to “hack back” by targeting cyber criminals who level attacks on their infrastructure. • 58% believe private organisations have the right to “hack back.” Currently, the Computer Fraud and Abuse Act prohibits many retaliatory cyber defense methods, including accessing an attackers computer without authorization.”

We see them daily. We get notices in our inboxes. We see things on the news. We are told things by our friends and families. Every day there is a new headline or notice of a threat, breech or vulnerability. Hackers are on the move, because of the ease at which they are able to stay anonymous. 

“It’s clear that security professionals feel under siege,” said Kevin Bocek, vice president of security strategy and threat intelligence at Venafi. “With the increasing sophistication and frequency of cyber attacks targeting businesses, everyone is involved in cyber war.”

While “hacking back” is very much the first thought, it is the first thought wrong. Just like physical violence this type of response only builds the mounting pile of illegal things that are happening and the victim list grows larger. But I do agree in one aspect, that there HAS to be something that can be done... But on a larger scale, as physical crime is limited to “it happens where it happens”, and that is where you get your charges. When a hacker is over seas, say, in Australia, stealing my identity where identity theft is not considered theft at all. So until we are unified all across the world, I only seeing things getting worse. 

https://www.information-age.com/cyber-war-security-professionals-123480950/

[cyber-kia]

“MoMo”. Real or Fake?

With all the MoMo craze going around, and mass hysteria over it, I thought I would write about the underlying issue to it. 

Here is the tech side of things. To get a video to stop and play something besides what it was originally posted for, then you have to alter the embedded code where the video is posted. (In the momo case, it was YouTube that was targeted) And let me tell you. I am a networking & securities major. CODE IS VERY HARD. LOL!! So for a hacker to alter embedded code, by hacking into YouTube (who I am SURE monitors their networks, lol) just for amusement, is unlikely. Most hackers are after the money. :-) 

So what WAS this centered around? TOO MANY KIDS DISCONNECTING FROM REAL LIFE. Technology is cool. It IS what the world is shaping to be. But too many kids are NOT being monitored online, and their safety IS at risk, and more parents DO need to be more involved with what their kids are doing. The article I found in WIRED says 

“The result, experts say, is that while the Momo scare didn’t start out real, the attention it’s receiving can actually have the opposite effect of what’s intended: All these warnings can raise the risk that teens or young children would learn about the challenge and take it seriously—or at least be freaked out by the scary image of Momo itself.”  “Hoaxes like this are created by people with an agenda. And that agenda is virality and panic. The moment you share, you are playing right into their hands.”

So while the underlying beginning images of Momo were real, the whole “challenge” is just another “Tide-Pod challenge situation”. A “challenge” created by people to see how far it will go and how many people will play into the whole idea that the whole thing is real and they need to do it too...

But my question here is WHY. Why create something that will potentially mess a kid up? Why put SUCH hysteria into the world for what? Ok. We get it. Technology is rotting our kids brains. But next time you sit down to play your favorite Netflix show, or check your account balance, pay your bills, or book your family vacation online - from your smartphone, remember how much you “hate” technology.....  :-) 

The point I am making here, is don’t fall for mindless stuff like momo. People are SO quick to pull YouTube from their homes, yet they have ZERO cares in the world that they just checked their bank account over Starbucks public WiFi and currently ALL their personal information is being stolen by a hacker sitting 10 feet away from them..... 

HOW NOT TO FALL FOR VIRAL SCARES: 

https://www.wired.com/story/momo-hoax-viral-scares-advice/

[cyber-kia]

Self-Checkouts. :-(

It’s 2019 folks. Self Checkouts are happening. And those of us that flat out say, NOPE, not using them, the foreseeable future says that eventually, you will. 

So what does this have to do with us “tech” people? :-) 

Personal opinion? Self-Checkouts are not awesome. Good in a super time crunch, when there is a long line to check out and you only have 2 items. Scan, process card, out the door. No human interaction at all. 

Self Checkouts need to be looked at with as much security as anything else online. A self checkout is a point of sale system. It has internet access, is assigned a network, and has certain PCI requirements, etc, etc, etc. 

But with anything, nothing is 100% exempt from attack. An article on kiosk marketplace, has an article that says “There is also inherent danger on the software side of the equation. For example, a white paper by McAfee mentions how hackers can attempt to access the control panel through the help and support center to change sensitive settings and possibly steal information.” (Bradley Cooper)

So with everything that we talk about that is keeping your information safe, and preventing the theft of your card information and pin numbers, how the heck do you stop this from happening and how would you know if the self checkout lane you are in has been compromised? I would be interested in observing and speaking to the IT departments or the companies that make the self checkout terminals.... (lol. More to come on this topic!)

Kiosk security: Preventing key threats, Bradley Cooper

https://www.kioskmarketplace.com/articles/kiosk-security-preventing-key-threats/

[cyber-kia]

Social Media. Friend or Foe?

Here is the scene:

You’re surfing Facebook. Scrolling down your timeline, and you come across what looks like a fun little quiz. “What Disney character are you?” You answer a few inherently ridiculous questions and there it is. “You are Jasmine, from Aladdin!” then you share to all of your friends on Facebook with a link for them to take the quiz too!

Innocent enough right?

So what’s REALLY happening? 

You click on the link. It takes you to a site that looks very much like a fun little quiz taking site. You enter personal information into their site. Your Facebook login (as you are prompted to “sign in” before you start your quiz) and password, which alarming studies show people use the same passwords for everything. So you have now given hackers any personal info that is on your page. Where you live, where you grew up, phone numbers, emails, messages, payment info if you use Facebook payment services, you name it. And if in fact you are one of those people that has the same login and password for everything you do online.... 

Think about what they now can access. Your bank account... (Thanks to the payment information stored in your Facebook account, they know where you bank at, so they simply try your email/password combination, and BAM. They are IN. And you are broke. 

Emails!!! How much information do you think a hacker can gain if they have access to your email??? Password reset links, identity verification links, personal identifiable information in saved folders, copies of tax returns. (With your social security number on it) What do YOU save in your email? :-)

Investment accounts, Mortgages, Health Information. All is at risk to being exposed. ALLLLLLL because you wanted to know what DISNEY character you are. Or what animal you would come back to life as? Or who your “squad” is... 

Your online safety is JUST (if not MORE) as important as your physical safety. Do you lock your doors at night? Do you look both ways when crossing the street? Do you wear your seat belt? Well, what makes your online safety any less important? If a hacker gets a hold of your Personal Information, it isn’t fixed with a simple password change. Once someone has your social security number, they can assume your entire identity and put you in financial and legal ruin. Sometimes the clean up of ID theft can take YEARS. 

An article in “The Hacker News” talks about this very issue and how it is becoming increasingly important to spread awareness about. A researcher by the name of Samm0uda recieved a $25,000 bug bounty for discovering this vulnerability.

“All the attacker needs to do is trick the victims into clicking a specially crafted Facebook URL, as mentioned on his blog, designed to perform various actions like posting anything on their timeline, change or delete their profile picture, and even trick users into deleting their entire Facebook accounts.”

"This is possible because of a vulnerable endpoint which takes another given Facebook endpoint selected by the attacker along with the parameters and makes a POST request to that endpoint after adding the fb_dtsg parameter,"  Samm0uda says on his blog. 

BUG BOUNTY WRITE UPS, by Samm0uda:   

https://ysamm.com/?p=185 

How to Hack Facebook Accounts? Just Ask Your Targets to Open a Link, The Hacker News:  

https://thehackernews.com/2019/02/hack-facebook-account-password.html?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+TheHackersNews+%28The+Hackers+News+-+Cyber+Security+Blog%29&_m=3n.009a.1929.iu0ao0drgi.16uk

[cyber-kia]

MAFIA BOY - The 'Bratty Kid' Who Took Down The Internet

“In 2000, a high school student named Michael Calce, who went by the online handle Mafiaboy, brought down the websites of Amazon, CNN, Dell, E*Trade, eBay, and Yahoo!. At the time, Yahoo! was the biggest search engine in the world.”

Mafia Boy, AKA Michael Calce, at the age of 15 launched a DDoS attack that took down all these companies and caused over 3 billion in losses. And he was only 15 years old! His reasoning is explained as 

"I was a pretty bratty kid. I come from a divorced family. My father had custody on the weekends and he wasn't exactly sure how to preoccupy me so he took a computer from his work and brought it home and was like 'Here, figure out what to do with it.' "

His motives were purely that of just “showing what he could do”

So many think, what a disturbed kid. No, not really. I think that this was a pretty solid thing he did for the future of cyber security. When all of this happened, it was the first recorded DDoS attack. So at the time, there was no safeguard or security policy to prevent this from happening. The article talks about how Mike thought he had a positive outcome as well. It goes on to further say that “Michael Calce, who went by the online name Mafiaboy when he launched a massive cyber attack at the age of 15, now works as a security consultant for companies trying to protect their online systems”

This touched me because this is the exact reason I chose cyber security as my “specialty”. I too did things in my past that I am not proud of. Things that took away MY freedom too. So now I am going back, to right my wrongs, and protect others from having the same things happen to them.... 

https://www.npr.org/sections/alltechconsidered/2015/02/07/384567322/meet-mafiaboy-the-bratty-kid-who-took-down-the-internet

[cyber-kia]

At what point is it the CONSUMERS responsibility??

In no way am I defending fraud. Nor am I saying that any person deserves to have their information stolen. 

What I am discussing right now, is Responsibility. 

Anyone can get a bank account. That is usually where it starts. Checks, debit card, and a balance. No explanation on consequences for irresponsible behavior. 18 years old you obtain credit cards.

For this particular thought, I am going to use the holidays as my focus. I personally do not shop on “Black-Friday” or “Cyber-Monday”. This is a personal choice. But every year, we see COUNTLESS news announcements, newspaper articles, magazine stories, and social media warnings telling us to BE CAREFUL. Do not click on strange links, ensure you are on the correct website, do not give out your personal information or credit card number over the phone, always verify shipping addresses. The list goes on. 

Yet EVERY YEAR. Millions of dollars are lost to credit card companies, banks, businesses, and individual sellers because of stolen credit card numbers....

Victims card information is stolen, because a “deal too good to be true” is what looks like a store holiday advertisement for Cyber-Monday. Consumer greed takes over. Irresponsibly the victim clicks the link that sends them to a website that APPEARS to be a legit store. Victim makes a purchase, entering in their credit card information, billing address, and any other information the criminal needs.  * Card information gets captured and stolen. Hacker maxes out all their card information, signs into email, obtains other information *  Victim calls card company, disputes charges, now card issuer is out hundreds of thousands of dollars. 

Who pays for that? Insurance premiums are increased, driving up the costs of services & interest which filters down to the consumers. 

At what point is it the CONSUMERS responsibility? Being aware of emails from people they do not know? Where it is their responsibility to follow best practices to keep their own information safe? You put priceless items in safety deposit boxes, and safes, why not do the same with your personal information? At what point do the companies and individuals get some relief and hold customers accountable for irresponsible behavior? With cyber crime continuing to grow at startling speeds, how does a company stay in business? 

[cyber-kia]

Government Shutdown??

“The partial government shutdown is hampering the FBI’s ability to investigate and prosecute cyber criminals and to combat digital national security threats” FBI agents say.

In an article I found in the Seattle Times, it talks about the government shut down and how it impacts cyber security.  Money to pay for wiretaps, subpoenas and other tools that form the bedrock of most digital investigations are at a halt because there is no access to funding at the moment. 

How does this impact US though, as “regular citizens”?

Well. Let’s start with your bank accounts for example. If your corporations accounts were seized in a ransomware attack, and no one could get paid, because the attackers locked out your access, and/or money was stolen, wouldn’t you have a great need for investigation, tools, and funds to be able to recover your accounts and pay the employees? 

“These delays slow down our work to combat criminal activity on the [internet] and protect the American people,” an FBI agent said, as quoted in the article.

Cyber crime is one of the most dangerous crimes because of the silent nature. Victims of a cyber security attack can suffer for months, or even years after an attack, cleaning up the messes that were left behind. Or companies have to shut down their businesses and close its doors to its employees because they can no longer pay them. With the shut down, FBI agents are working without pay currently, but without the funding to obtain the tools and things needed for investigation and prosecution, it’s like they are fighting crime without any weapons. And that never works out favorably for anyone but the criminals right? But sadly, when this thing ends, there is still going to be a huge mess to clean up...

“A longer shutdown could result in an even lengthier recovery time — and therefore greater exposure to threats at all levels of government,” said Ferrante, who now leads the cyber security practice at FTI Consulting.

So tell me. How fair is this, and without going all political, could there have been a better way? With billions of dollars spent on cyber security defense currently, just how serious could this really get? In my own opinion, our country need to get itself together, stop acting like nothing but a stupid wall matters, and look at the REAL issues here. A wall isn’t going to stop cyber criminals is it? :-)

- The Seattle Times (01-23-2019) “Shutdown hits FBI cyber investigations hard, agents say” Retrieved from:  https://www.seattletimes.com/nation-world/shutdown-hits-fbi-cyber-investigations-hard-agents-say/ 

[cyber-kia]

Let’s Talk MONEY... $$$

To start this journey of Cyber Security blogging, I thought that talking about some of the costs involved with a cyber security attack would be a good place to start. 

It is a well known consensus that a majority of cyber crime comes from careless end users, and/or lack of (or weak) security. The article that I chose talks about how the monetary losses of a cyber attack can total up to 1.67 million dollars PER attack! 

“Quantifiable monetary losses can be directly tied to the aftermath of cyber attacks in lost revenue, unexpected budget expenditures and drops in stock values,” according to the report. “Protracted repercussions are most likely to emerge as a result of negative customer experiences, damage to brand reputation and loss of customers.”

With a low average of 1 million per attack, I can’t imagine how some companies even recover from a loss that large. Because the article goes on to talk about how the businesses aren’t necessarily experiencing the theft of their physical dollars. 43 percent of a companies loss comes from negative customer experiences. The law states that companies who have suffered a cyber attack must notify their clients that such attack took place if any of their information was exposed or compromised. As a consumer, I would seek to find answers. I would lose any and all trust I had with the company and want to know if every measure had been taken to prevent an attack. The article goes on to say that in a survey that was given, 34 percent of companies reported that they don’t have a cyber security emergency response plan in place!! 

That is a very high percentage to me! And again my thoughts go back to all the damages that are non monetary that are a result of a cyber attack. Victims have been proven to need years of psychological help, because of all the work involved in restoring a persons stolen information. Hours upon hours of phone calls, collection letters, dispute processes, submission of “proof it was not me who committed that crime”, court dates and legal ramifications of a stolen identity, lawsuits, evictions, and countless other ramifications of having to prove ones innocence. It leads to a very exhausting and unfair journey for the victims. And once a victim BECOMES a victim, they are often “forgotten” about. How will one pay their rent if their credit cards are frozen and all the money has been drained from their accounts? And this begins the loop back to not using said companies services, as we all know word-of-mouth is the most powerful form of advertising! 

Article: “ThreatList: $1.7M is the Average Cost of a Cyber-Attack”    https://threatpost.com/threatlist-cost-cyber-attack/140870/