Online Crime Bytes

Breaking Backbones: My new cyber thriller book

The first two books in Deb Radcliff's Breaking Backbones hacker trilogy are available at Amazon, Archway Publishing, Barns and Noble, and every other bookseller. Book 1 placed as a top finalist in the Writer's Digest Indie Writers Excellence Awards for Action and Adventure, 2022. An Amazon reviewer wrote of book 1, "In her novel, Breaking Backbones: Information is Power, Deb Radcliff builds on her extensive experience as a cybercrime journalist to imagine a practical dystopian society that may represent a natural progression of existing trends - while also, building an intricate fiction of how a future society may fight back. As such, I put Breaking Backbones in a must-read category."

Book 2, Breaking Backbones: Information Should be Free, was just released September 22 and is awaiting reviews. Be the first to review it, and check out both books here: 

https://www.amazon.com/Deb-Radcliff/e/B092KFMG5B/ref=aufs_dp_fta_dsk

 

We're all OWNED technologically

In a globally-connected world, measures like trying to stop Chinese from spying through their home-built networking gear is too little, too late. I cover some of this in book 3 of my hacker thriller series (which is out for peer review and will publish in Spring 2023). Every Apple device I own was "assembled in China." Cisco sends manufacturing to China, was doing so even as their fraud department had red pins in China manufacturing locations - I saw them when I was writing my award-winning story on fake networking gear in the LEGITIMATE SUPPLY CHAIN *aka not sold off eBay but by Gold certified Cisco distributors.) I could go on, but the fact is, we're already totally owned. Consumers, businesses, government agencies really have no recourse but to replace and rebuild with 100% US-made products, which I know nobody is going to do. Zero trust? Ha ha ha. Tell me how that works when our components are built overseas in countries like China and other monitoring societies?

And yet, the feds hope to stop all of this. See article here.

Deep Fakes on Zoom Calls: True Story

(From my latest article in CSO)
In August, Patrick Hillman, chief communications officer of blockchain ecosystem Binance, knew something was off when he was scrolling through his full inbox and found six messages from clients about recent video calls with investors in which he had allegedly participated. “Thanks for the investment opportunity,” one of them said. “I have some concerns about your investment advice,” another wrote. Others complained the video quality wasn’t very good, and one even asked outright: “Can you confirm the Zoom call we had on Thursday was you?”

With a sinking feeling in his stomach, Hillman realized that someone had deepfaked his image and voice well enough to hold 20-minute “investment” Zoom calls trying to convince his company’s clients to turn over their Bitcoin for scammy investments. “The clients I was able to connect with shared with me links to faked LinkedIn and Telegram profiles claiming to be me inviting them to various meetings to talk about different listing opportunities. Then the criminals used a convincing-looking holograph of me in Zoom calls to try and scam several representatives of legitimate cryptocurrency projects,” he says.

As the world’s largest crypto exchange with $25 billion in volume at the time of this writing, Binance deals with its share of fake investment frauds that try to capitalize on its brand and steal people’s crypto. “This was a first for us,” Hillman says. “I see it as a harbinger of what we think is the future of AI-generated deepfakes used in business scams, but it is already here.”

Read the rest of the article here: https://www.csoonline.com/article/3674151/the-deepfake-danger-when-it-wasn-t-you-on-that-zoom-call.html 

Warning: Blockchain Phishing Scam

This phish almost got me. I had just opened new iPhone account and for a second, thought, hmmm, was there a blockchain in my new phone I needed to activate? I searched the email's return link and it looked legit. Then I hovered my mouse over the activation link and it is totally shady, resolving to a blockchain like name with dashes and numbers in it (a fake address):

 

"nft-blockchain-2365 ..." which is a web app that already has my name set in its URL.

 

Needless, I am warning everyone. If it looks legit, hover your cursor over sender's email address, and the links that they want you to click for a second and it will show you where it really resolves to. (Do not click the links, though.) Although in this case, the email return address does appear go to

"[email protected]," and that has me puzzled on how they could spoof that. (I'd check the DNS registrar if I had time but I don't.)

 

If an email still looks real and you think you need to respond, just go to the site the way you normally would by typing it into your browser window manually.

 

Here is the phish email that I received:

 

Your Blockchain wallet will be suspended!

Dear Blockchain customer,

 

Our system has shown that your Blockchain Wallet has not yet been KYC verified. This verification can be done easily online with the below displayed connection

Due to the recently update of NFT's, all unverified accounts will be suspended on: Friday, April 16, 2022. We're sorry for any inconvenience we might cause with this.

 

Visit our website to start the security procedure: (I removed lin but it said it went to block chain wallet identification it was really the bad link)

 

 

Please keep in mind that our intention is to keep our customers safe, secured and happy.

 

Thank you for your understanding.

The Blockchain Team

 

 

Hacking Google Voice

Recently, the Federal Bureau of Investigation released a report on how criminals are using a Google form of this type of telephone verification system to take over a victim’s gmail account and set up fraudulent Google Voice accounts in their victim’s names and phone numbers.

According to the FBI press release, the scammers target people who post things in online marketplaces, such as a couch for sale or reward for a lost dog (Fluffy).

“The scammer contacts you via text or email. He is really interested in buying that couch or thinks he found Fluffy. He says he just needs to make sure you are legitimate so he doesn’t get scammed. He says he will send you an authentication code from Google to confirm that you are a real person and not a bot. You will receive that authentication code in the form of a voice call or a text message. He asks you to repeat that number to him.

What he is really doing is setting up a Google Voice account in your name using your real phone number as verification. Once set up, he can use that Google Voice account to conduct any number of scams against other victims that won’t come back directly to him. He can also use that code to gain access to, and take over, your Gmail account.”

Google Voice allows users to set up a virtual phone number to use for calls and texts. But in this hack, the victim doesn’t need to have a Google Voice account to fall victim. The FBI offers this advice:

1. Watch out for warning signs. Most scammers use a sense of urgency to pressure you into making a snap decision. Pause ask yourself why you’re feeling this way and who’s behind it.
2. Don’t share your Google Verification code with others.
3. Don’t give your email address to anyone reaching you on the phone.

And perhaps the best advice I can offer is don’t use the same password for all your different online accounts.

Cyberwar is Real and Happening Now

There's a lot going in in cyber right now as it relates to books 2 and 3 of my cyber thriller series. Supply chain attacks on the software infrastructure, misinformation campaigns over social media, ransomware gangs halting critical infrastructure operations, and other state-sanctioned subterfuge coning from China, Russia, Iran and other countries and criminal gangs that want to cause disruption and gain world dominance.

Think, for a moment, how interconnected we are with countries that want to harm us. Chinese tech is ubiquitous and even if it's a US based product, their components are made or assembled in China. For example, Cisco routers sends parts development to China. I know: I've been in the fraud department at Cisco and have seen the red pins all over their maps of China. That was fifteen years ago and things are much worse today. The new laptop I just opened up said "assembled in China," and so on. 

We are also letting strangers on social media dictate what we think and division has never been worse in our country. The Russian trolls are doing their jobs expertly, posting fake news that people believe is patriotic enough to fight over, and even influencing our election cycles. 

Can we rip out our infrastructure and start over? No way, says everyone in the tech industry who laughs me out of the room (as usual, when I ask tough questions, they just laugh at me). But these questions need to be raised and addressed before it's too late to change anything.

It's probably already too late because the cost of replacing all forms of tech developed in countries that want to do us harm, is unfathomable. Where will be in 40 years? That's what I address in my cyber thriller series, Breaking Backbones.

The first book, Breaking Backbones: Information is Power, is available on Amazon and all book outlets. You can buy it here: https://www.amazon.com/Breaking-Backbones-Information-Hacker-Trilogy/dp/1665701080/

 

Don’t Blame the User (And Don’t Count on Them Either)

By Deb Radcliff

Security naiveté among employees was a top reason for the growth in ransomware in 2020, according to 43% of more than 1200 IT decisions makers to take the Mimecast State of Email Security.

The negative term, ‘naïve’ used to describe the users bothers me. Blaming the users has been a peeve of mine since the mid-90’s, which is the main reason I became a cybercrime reporter back in 1996.

These ‘average Joe’ users were getting royally fleeced back then, and I regularly raised the issue to IT pros and white hats. They told me over and over that, ‘If the average user can’t stand the heat, he shouldn’t be on net.’ (Mind you, these are the same pros who can’t say for sure whether their business networks they’re charged with protecting are bullet proof...)

Sheep to the Slaughter

Users can’t be expected to detect threats on their computers that are increasingly disguised as work-related communications, just as they can’t be expected to work from home and provide their own security to protect their employers. It’s important to note also that 60% of respondents acknowledge that the attacks aimed at their employees are increasing in sophistication.

Once I read the report, I pinged Mimecast with my strong opinions and asked a few questions, starting with blaming the user.

“While IT security professionals know that employees shouldn’t be held responsible for the full scope of security, they do expect that employees practice habits such as strong passwords or an awareness of how impersonation of a CEO can happen,” says Jeremy Ventura, Senior Security Engineer at Mimecast.

And that’s another peeve: passwords suck.

Even with password managers and vaults, managing complex, system-issued passwords is nearly impossible across our many computers, pads, phones, Siri’s, security systems, tv’s and entertainment devices, etc. Until security is as ubiquitous as seatbelts as easy as checking the oil indicator gauge in a car dash, average users will be incapable of protecting the front line in email-based attacks.

Trust No One

This speaks not only to zero trust security models (trust nobody, not even authorized users), but also to precious user data that organizations are wasting—data that would help them protect the business environment from their own users. According to the Mimecast report:

• 55% of employers are not using employee data and reports to tune their security to user behaviors
• 45% don’t take feedback from employees
• 33% aren’t using metrics

Since they aren’t taking employee feedback or using their behavior data, it’s hard to believe that the majority of respondents utilizes metrics in a useful way.

Most Common Payload: Ransomware

With a 64% increase in email-based threats detected in the Mimecast threat center, the report also reveals that employees who work from home are being directly targeted, Ventura continues. And the payloads are most often in the form of ransomware, which has, in recent months, become more diabolical.

In the Mimecast survey, 34% of companies were unable to recover their data after paying ransoms. Does that mean the decrypt keys didn’t come through or that, with ransomware now also exfiltrating data, that the data wasn’t returned? Ventura says it’s a combination both “failing to recover their data, and also because their data was already exfiltrated to the dark web.”

“Once the hacker sees that the organization is willing to pay, instead of releasing the decryption key, the hacker will come back requesting a larger amount in hopes that the organization will pay again,” he continues. “In addition, double extortion has spiked in the last several months where hackers will charge one ransom for the decryption key and then another ransom not to sell the encrypted data.”

There we have it. Workers at home exposed to increasingly sophisticated attack methods are not equipped to hold the front line against ransomware gangs and other cyber attackers. And still, the consensus is that the end users just need more training.

“Reinforcing best practices and awareness will hopefully drive the 43% [of naïve users selected as the top security risk] to a lower number in 2021,” Ventura continues. However, he adds, “Security must lead by example and then end users should follow.” 

No Honor Among Thugs: Time to Stop Paying Ransomware Gangs

by Deb Radcliff  

In addition to crippling businesses by making their data inaccessible, ransomware gangs are now routinely copying sensitive data for additional leverage to blackmail victims into paying. When victims don’t pay the blackmail, the criminals leak the sensitive documents on ransomware shaming sites. A recent example: The Scottish Environmental Protection Agency who refused to pay a ransom to the Conti ransomware gang, which then posted 4,000 files (1.2 GB) from the agency.

(Above Screen Capture of Stolen Files Provided by Kurtis Minder)

Even when victims do pay the ransom, the stolen data often shows up on dark web ransomware trading and buying sites, says ransomware investigator and payment negotiator Kurtis Minder. In those cases, new criminals try blackmailing victims again, sometimes months after victims made their payments.

What this means is that ransomware has now become a regulatory issue because sensitive data has been stolen. This trend also begs the question: If paying the ransom doesn’t protect the data and stop further blackmail, why should victims pay ransom anymore?

Now a Regulatory Problem

Imagine, for example, a ransomware attack where the victim company cannot access its own systems and a clock is ticking on sensitive data being leaked to a shaming site. All the while, they are also under regulatory pressure to assess impacted data and report the breaches to the proper authorities.

“The victim business is trying to get back on its feet and now it’s dealing with potential regulatory and legal issues,” says privacy and cyberinsurance attorney, Judy Selby. “Responders to these types of ‘double whammy’ attacks need to know what information was exposed, along with the regulatory, legal and business partner obligations related to that exposure. Meeting these requirements is significantly more complicated in a ransomware situation.”

For example, in the Scottish EPA case uncovered on December 25, 2020, agency officials are still trying to uncover what data was stolen and the sensitivity of that data. All they knew at the time of reporting is that 4,000 files were removed.

Minder, founder and CEO of GroupSense, says every ransomware case he takes on these days involves some form of sensitive data theft, which criminals use to negotiate payouts. According to a recent report by Coveware, more than half of ransomware samples it collected in early 2020 involved sensitive data theft. Top ransomware groups including Sodinokibi, Maze, Netwalker, Mespinoza, and Conti routinely use data theft in their schemes. (For a larger list go here.)

Criminals Lie

Even when ransomware criminals show proof that they deleted the data once the ransomware is paid, Minder and his team still find data files dumped on the darkweb belonging to victims who’ve paid. Many times, he adds, ransomware gangs will return with new threats of exposing the data and re-encrypting their systems.

“Now, I bookend each ransomware negotiation project with, ‘If we decide to do a transaction and pay a ransom, just remember, we’re dealing with someone who has no honor or accountability,'” he adds.

So, since the blackmail won’t stop, then why pay the ransom? If victims and insurers refuse to pay ramsons like the Scottish EPA did, the fat profits (which amounted $20billion in 2020) will simply dry up and the criminals will move to other fertile grounds where making money is easier.

 

 

 

Innovate or Suffocate: Securing New Business Models in a Post Pandemic World

COVID-19 first crept into my scene back in February when I decided not to attend RSA for the first time in 20 years in order to avoid catching a horrific-sounding new virus emerging out of China. Even back then, it felt like this virus was going to dig in and that life would not go back to normal anytime soon—if at all.

Now, seven months later, the virus is still dominating the way people live, socialize, dine, worship, shop, work, learn, play, litigate, marry, entertain, tend to their health, do business, and interact with their governments. (That’s the short list.) And almost all of these changes involve technology.

What does this mean to us as cybersecurity professionals?

1. First, it means many security pros are getting laid off as businesses are negatively-affected by the economic downturn. Why? Because business models that worked in 2019 no longer work in today’s ‘new normal.’
2. So, if we haven’t already, we need to ask ourselves why our businesses are failing during this change and what we can do about it.
3. Then, we must get ahead of the curve through security innovation (and that means a lot more than just securing remote workers).

Turning to Tech

Consider that almost all these COVID-related changes are driving people, even our grandparents, to use new applications and platforms that they never used before, primarily to mimic some form of social gathering that can’t yet be replaced with the virtual experience.

The obvious example is video conferencing, which is now being used for instructing students, conversing with family and friends, talking to our doctors, holding remote meetings and conferences, and providing entertainment (such as SNL and American Idol did recently).

We are also ordering more groceries and takeout online, which is prompting innovation and growth in the area food delivery service, an area that is still lacking but trying to catch up. And more people also filing taxes and their unemployment claims, voting by mail, and using other government services online.

World in Turmoil

Innovation is messy, according to Dave Cole, CEO of cloud-native discovery company, Open Raven, during a recent podcast with Ashwin Krishnan. In it, he explained how he tried holding company meetings in virtual reality, for example, which he said didn’t turn out so well because communication was difficult in the VR room. However, the opportunity is there, and maybe someday the tech will improve to meet the demand.

Innovation is also messy because the world we are innovating in seems to have gone crazy, creating risk scenarios we hadn’t planned for. For example, Zoom, the top video conference platform in use, comes from China—which is known for stealing IP to advance its economic advantage. China is also on the FBI’s list of the top three countries trying to influence the November elections.

These same adversaries are stoking political tensions, Black Lives Matter riots and deadly COVID nonsense over social media platforms that people around the world are turning to for information around on these issues. There are also criminal adversaries bent on inhibiting rsponse to the COVID crisis by getting ransomware into health care providers and ventilator manufacturers.

Butts in Gear

In a call to action, the World Economic Forum in May advised security professionals, particularly leaders, to think more strategically and take leadership during the crisis. Yet, it is easy to get caught up in just fixing the problems as they arise.

To innovate, we need to think five years ahead and anticipate problems arising as the result of political, social and economic trends, according to Ann Cleaveland, the Executive Director at UC Berkeley’s Center for Long-Term Cybersecurity (CLTC) during a webcast with Microsoft CTO Diana Kelley.

For example, she asked, as we move more of our lives online due to social distancing, will people eventually be involved in a social movement to protect themselves online?

Note, too, that the Industry is hurting for security workers even though it is also still laying off, with Cybersecurity Ventures predicting a shortage of 3.5 million cybersecurity professionals in 2021.

In particular, I believe hirers will be looking toward expertise that can understand the new threats that accompany technical innovation in this post-pandemic world, and can innovate security around these trends.

Let’s keep this discussion going and maybe formalize a forum around this topic! Please reach out here or on messenger if you’d like to share and talk.

"Your Account Has Been Hacked" is a SCAM!

Today, I received an alarming email to myself from myself that came with the subject line: Your Account Was Hacked!

This was a pretty good social engineering attempt and actually got me to open and read the email instead of just deleting it.

The “international group of hackers” who sent the email seemed to have collected an old password that is no longer active on my account. It said they hacked my email because I practiced bad security and went to porn and adult sites; and that they had all kinds of dirt on my web browsing, and the collected video captures from my camera that they’d share with my friends if I don't pay up.

So now the clock is ticking. I have 48 hours from the moment I first read the email to respond or they will send all my boring and mostly spam emails to all my friends and associates.  

Sorry “international hacking group,” but I’m not falling for it and I'm not sending you that $700 you’re demanding.

First of all, I don’t go to porn sites because that’s just stupid.

Secondly, my office where my computer lives is boring. Maybe I don’t have makeup on in some of the pix but that would be the worst worry I’d have about them.

The truth is, anybody can fake your email address and make it look like it’s coming from you. So if you get a note like the one below, DON’T click any link and DON’T reply to them. They are trying to scare and coerce us. Don’t fall for it.

And read the fine print for variations that seem untrue about your online habits.  Here’s the note they sent me verbatim (except I crossed out the old password they had):

Hello!
I'm a member of an international hacker group.

As you could probably have guessed, your account [email protected] was hacked, I sent message you from it.

Now I have access to you accounts! You still do not believe it? So, this is your password: ####, right? 

Within a period from July 5, 2018 to September 21, 2018, you were infected by the virus we've created, through an adult website you've visited.
So far, we have access to your messages, social media accounts, and messengers.
Moreover, we've gotten full damps of these data.

We are aware of your little and big secrets...yeah, you do have them. We saw and recorded your doings on porn websites. Your tastes are so weird, you know..

But the key thing is that sometimes we recorded you with your webcam, syncing the recordings with what you watched!
I think you are not interested show this video to your friends, relatives, and your intimate one...

Transfer $700 to our Bitcoin wallet: 1DzM9y4fRgWqpZZCsvf5Rx4HupbE5Q5r4y
I guarantee that after that, we'll erase all your "data" :D

A timer will start once you read this message. You have 48 hours to pay the above-mentioned amount.

Your data will be erased once the money are transferred.
If they are not, all your messages and videos recorded will be automatically sent to all your contacts found on your devices at the moment of infection.

You should always think about your security. We hope this case will teach you to keep secrets.
Take care of yourself.

My social media account has never been connected to my email address. I don’t go to porn or adult sites and I don’t have ‘weird’ tastes in those things (that I know of). I don’t use Messenger. And they had the wrong (albeit an old) password.

If I had the time and energy, I’d chase down that bitcoin wallet they want me to transfer the money to! (Maybe one of you brave readers will feel the urge to follow through, please do!)

The puzzle to me now is how they got that old password and from where??? So I’m going to change my passwords across all my accounts now just to be safe.

If you get an email like this that includes an old or even current password, do change your passwords like I am. Also don’t re-use old passwords. And do not share the same passwords with all of your accounts – because once the "international group of hackers" gets one password, they have access to all your accounts using that shared password. 

Back to the Basics: Black Hat 2018

LAS VEGAS, August 7-9 2018 – As nearly 19,000 of us from the hacker and research community descended upon Vegas for Black Hat, the outside temp hit 111 degrees, a record last set in 1994.

Fortunately, the power grid held, and we were kept comfortable (sometimes too cold) for the duration of the two-day security training event at the Mandalay Bay Hotel and Casino. However, some slot machines, elevators, and other embedded systems didn’t fare so well under hacker tinkering over the weekend at Black Hat sister conference, Def Con, as covered by Jack Morse, fellow member of the press.

These hotel hacks reported by Morse were simple demonstrations of software and hardware hacking into critical infrastructure systems (hey, elevators are critical). Demonstrations of grid hacking, car hacking and voting machine hacking were also urgently covered during sessions at both Black Hat and Def Con.

Everything Cyber is Hackable   

Risks from IoT, cloud-based computing, mobility, and lack of resources were topics well-covered by Parisa Tabriz, Google’s Director of Engineering and Project Zero Manager, during her conference kick off keynote, “Optimistic Dissatisfaction with the Status Quo: Steps we Must Take to Improve Security in Complex Landscapes.”

In it, she argued convincingly about going back to the basics – secure design, fast and accurate patching of vulnerabilities - and she told her personal story of challenging the status quo.

Improvement Takes Time

Tabriz used examples of long-term infrastructure improvements, like Chrome’s enforcement of encrypted browsing (HTTPS). Internet providers that use HTTP rather than HTTPS are labeled as insecure starting this past July.

Some businesses object to this ‘Migrate or face embarrassment’ move on Google’s part. Google countered by posting comprehensive help documents for businesses to make the migration.

She also described the time (nearly 7 years) and team commitment put into this upgrade that she called a “feat of engineering.” Myriad browser program interdependencies – from plug ins to the O/S – had to be considered (and no, none of them made it easier with a common language).

 “The message that it took years to make this change is incredibly important,” said Adam Shostack (author of Threat Modelling: Designing for Security) during an impromptu hallway interview shortly after the keynote. “Changes that really matter take time.”

Tabriz also used the keynote to showcase another long-term program developed by her team at Google, Project Zero, which, she says so far has identified 1,400 critical vulnerabilities across O/S, software, cloud-based and hardware systems while speeding up vendor patch times to 90 days or less.

In Support of DevOps

While these Google projects were long in the works, they specifically support today’s demand for faster development by providing more secure foundations and libraries for developers and vulnerability managers, Tabriz explained.

Investments, industry collaboration, and buy-in to infrastructure improvements like this, Tabriz said, take us one step closer to getting ahead of criminals rather than “playing whack-a-mole with our attackers.”