email – CyberEye

How Bilbo Baggins Almost Hacked Your Email

Dan Gavin 19, Jul, 2024

Blog

How Bilbo Baggins Almost Hacked Your Email

In the story created by JRR Tolkein, “The Hobbit”, little Bilbo Baggins was just a hobbit. But he became a burglar. No one suspected that this little Shireling was capable of such great feats. Although he did have great feet. The least suspecting of all was the dragon Smaug. Smaug had a great treasure. You see dragons love gold. It turns out they love gold even more than dwarves.

But Bilbo was not after the gold. He was after something much more precious. The Arkenstone. With his special ring, Bilbo became the first hobbit burglar.

The next part of the story you are about to read is true. The names have been withheld to protect the victims.

I received a phone call recently from a client who had a concern about an email. In this case it was an email sent from their own account rather than the typical phishing email one would receive. The email was requesting an ACH wire transfer from my client. My client, I was informed, did not use ACH transfers. How could that be? This request was coming from their legitimate email account. What happened?

All the evidence points to a compromised email account. The burglar had created a rule in the account that moved very specific sent emails to a folder called RSS feeds. This folder is almost always added by default to your Outlook client. It’s a folder almost no one uses, and even fewer users look at it. Certain emails were redirected to the RSS folder so that the legitimate user had no knowledge that it existed. However, it was very easy for the threat actors to simply monitor this folder. As soon as a targeted message appeared, the burglars crafted a follow-on email requesting the ACH transfer. The legitimate email was simply asking if an invoice was payable, and the burglar asked for a transfer of funds to his account.

Fortunately, this story has a happy ending. Thanks to the diligence of a very astute employee, this discrepancy was caught and the theft was blocked. The resolution to this almost tragic episode was quite simple. Change the password to the email account. Make the password long and enable multi-factor authentication. Never re-use passwords. This is like putting a dragon at the gate.

Unlike Smaug, you don’t have an Arkenstone. But what you may not have thought about is your email. It is often the gateway to your gold. You must be as vigilant with it as if it were gold itself. You may want to consider having two email accounts. One account is for your entertainment, and a separate one is used to access and manage your financial accounts. And the latter? Protect that one with a dragon as if it were the Arkenstone itself.

This article was originally published in the Sierra Vista Herald here.

The Saga of Joe Public, A Social Media and Email Tragedy

Dan Gavin 21, Jun, 2024

Blog

The Saga of Joe Public, A Social Media and Email Tragedy

This is a story about Joe. Joe could be any one of us. During the day he is a nose-to-the-grindstone, focused, and hardworking employee. After work, however, he is careless and free, enjoying all that social media has to offer: posting photos, catching up with friends, reading the links his friends on social media post, and yes, he does enjoy the occasional cat video. He is active on his email account too.

Unfortunately, Joe is not really keen on cybersecurity hygiene. He clicks on any link he gets via email or social media without checking the URL first. He makes his life easy by using the same password for all his different accounts. Two-factor authentication is too much work and why would he need it anyway. Nobody would hack a regular guy. Since he is so friendly, his social media account is open to the public, so everyone knows everything about him. What he had for his birthday dinner last night; where he was born; his mother’s maiden name; and even the name of his first pet.

Although Joe seems to be the life of the party when it comes to social media, Joe was not ready for the party crasher. After work, as Joe was ready to relax and catch up on some email, he discovered he could not login – password failed. That’s strange. He had not changed the password to his email account. Ever. So, he decided to check his Facebook account to see if anyone else was having trouble with their email provider. And what do you think happened to his Facebook account? He was locked out of Facebook too. As he sat back to ponder what was happening, a friend from high school called. His friend asked why he was sending out emails pretending to be a Nigerian prince looking for money? He also noticed that Joe started posting advertisements on social media for the Pink Princess Palace. That’s when Joe figured out that he had been hacked! How could this have happened to him?

The hacker could have come in from many different attack vectors. After checking the website, https://haveibeenpwned, Joe noticed that his username and password were compromised in 17 different breaches. Since he used the same username and password for every site, it was easy for the hacker to take over his email and social media. Also, the hacker could have just used Joe’s username combined with all the information on Joe’s Facebook profile to answer the typical “security” questions many web applications use for password resets.

What does Joe do now to get back into his accounts and secure them? First, he should get in touch with his email and social media providers to let them know what happened to regain access to the account. This could even involve sending Facebook a copy of his Driver’s License to prove his identity. He will need to change his password to a nice long pass phrase – 16+ characters. He will also need to change his password on all his other accounts because the password has been compromised. Next, he should set up two factor authentication for all email and social media; and any other account he doesn’t want breached (like his bank and investment accounts). Two-factor authentication involves having the web service send a text with a one-time code. Even better, Joe would use a third-party application like Duo or Microsoft Authenticator.

To do this on your Facebook account for example, you need to login to your account. Click the arrow icon in the top-right corner and select “Settings & Privacy” and click “Settings.” In the left-hand navigation bar, choose “Security and Login.” Scroll down to the “Two-Factor Authentication” section and click “Edit” next to “Use two-factor authentication.” Follow the instructions from there based on the way you choose to receive your notifications. All email and social media apps have this option.

Now that Joe has so many usernames and passwords to remember, he decided to use a password manager to help him out so that he only needs to remember one long password. He downloaded Bitwarden to his computer and added the Bitwarden extension to all his browsers so that he has his secure passwords wherever he goes.

Joe is so excited about securing his email and social media that he tells his brother, John Q, and the rest of his friends so that they don’t have to go through similar torture. Joe has since become the lead blogger for the Cybersecurity Evangelist.

This article was originally published in the Sierra Vista Herald and can be found here.

The Dangers of Unencrypted Email

Dan Gavin 9, Jan, 2021

Blog

The Dangers of Unencrypted Email

Postcards from War: Recently, I was reading some of my grandfather’s faded postcards from World War I. I happened to read one in which he mentioned being released from quarantine: March 11, 1918, Fort Lewis, Washington – the Spanish Flu pandemic.

Then & Now: Postcards were how our grandparents sent brief messages over long distances. They are the antique analogs to modern email. The messages and attachments you send via email are every bit as private and secure as that dusty, old postcard.

Is This Normal: Recently, a close associate of mine, I’ll call him “John”, was required to take a defensive driving course. The business providing the service asked John to send a copy of his driver’s license. John promptly took a picture of his driver’s license in beautiful, high-definition color and attached it to an unsecure email. He didn’t even question it.

How It Works: Let’s look momentarily at a seemingly benign example to illustrate what happens when you hastily click the “send” button. Say you work for a medical practice and you send an email from your office to a patient. Here’s what happens:

The email leaves your computer.
It travels on your Internet Service Provider’s (ISP) network.
It arrives at your mail server – a server you probably don’t control.
Your hosted email provider then forwards a copy of the email to the patient’s mail server, probably webmail, like Gmail.
A copy of the email languishes on the mail provider’s server.
It then takes the last leg of the journey to land on the patient’s personal computer.

Everybody Sees It: As you can see, at any of those points, the email (like a postcard) can be read by anyone with access. That means, if any of those computers storing a copy of the emails is compromised, so are the emails. All of them.

Unsecure By Design: Email is by design, unsecure. That is why you should never, (let me repeat, EVER) include any important, private information in any email, not just the protected health information (PHI) of patients. Unencrypted email is simply the wrong medium for transmitting sensitive data.

From the hhs.gov website:

Patients may initiate communications with a provider using e-mail. If this situation occurs, the health care provider can assume (unless the patient has explicitly stated otherwise) that e-mail communications are acceptable to the individual.

For Healthcare: Now, I’m not a HIPAA lawyer, and this is not legal advice, but basically, if you are a medical practice, you know that much of your communication with patients is over email. In fact, many prefer it. So as long as you warn the patient that your email communication is over unsecure media, and the patient acknowledges, then you may be absolved of the consequences of a PHI breach … maybe. You can even get patient acknowledgment with (ironically) a simple email waiver form that the patient signs and returns to your office, over email.

Secure Options: If you only send PHI through your Electronic Medical Record’s application, it may take care of the encryption for you. But if not, there are email providers that will encrypt your emails. If you use Microsoft Office 365, there is a tier that will allow you to encrypt email. Other email providers like ProtonMail offer encryption capabilities. A Chrome extension even exists allowing you to encrypt Gmail. It can be a little inconvenient because you have to think up a strong password for each email, then you have to deliver the password to your patient by calling or texting them. If emails containing sensitive data are sent infrequently, the risk is lower. You decide whether you’d rather go through the effort or experience a breach.

You don’t have to protect sensitive data forever. Its value degrades over time. Conversely, that little postcard my grandfather hastily scrawled over 100 years ago is ever more precious to me.