Lessons Learned from the CISA Red Team Hack 
0
Dan Gavin
Lessons Learned from the CISA Red Team Hack 

Dmitri’s fingers flew over the keyboard as he searched for an access window to the network at Metropolitan Utilities: the biggest electricity service provider in the tri-state area. Using a password he’d retrieved from the dark web, he connected to an employee computer, then moved silently through the network, scanning for a computer with better privileges. Through this, he hoped to access the systems controlling the power grid. He called over his shoulder, “Natalya, mne nuzhno nebol’shaya pomosch’. Would you build me a fake login webpage that matches theirs? If I send it to all the company’s staff, I might trick an administrator into handing over their username and password.”  

His partner nodded and emailed a link to the entire IT department under the pretext that there was a failed login attempt that needed investigating. Jason, a junior-level administrator, took the bait. What followed was a chain of events culminating in the effective barring of all administrators from the power grid. 

 “Bingo,” said Dmitri under his breath.  

And at this point the exercise concluded. “Krasnaya komanda! Krasnaya komanda!” (red team) laughed Natalya as Dmitri contacted the blue team, a.k.a, the IT and cybersecurity department of Metropolitan Utilities.  

Here is your problem . . . 

Three weeks before, the department had contracted Dmitri and Natalya’s cyber company to run a red team test on the network. Red teaming is a simulated cyberattack conducted by a group of ethical “white-hat” hackers. They use real-world techniques to breach an organization and identify any vulnerabilities that might prevent it from detecting an actual threat. In this case, the red team’s victory was the result of several basic security mistakes.  

The US government has classified electrical, natural gas, water distribution and several other industries as “critical infrastructure”: infrastructure vital to the survival of the nation. Attacks on such industries can be particularly damaging. Recently, the United States Cybersecurity and Infrastructure Security Agency (CISA) conducted a red team assessment resembling the fictitious example above at the request of a real-world critical infrastructure organization. No details about this organization were disclosed except the type of infrastructure—a utility company 

The red team was able to breeze through the company computers at blinding speed. During the simulated attack, the organization did actually discover the presence of the red team but lacked essential layers of protection—what we call “Defense in Depth”—which would have allowed for a prompter response. Instead, they relied on fancy antivirus software that could not sense the network traffic. Furthermore, their staff lacked appropriate network-protection training. It should have been provided to each employee in small, frequent bites. The company had previously contracted third-party providers for red team exercises, and its leaders had been made aware of these vulnerabilities. But they had underestimated the risk. Nothing had been done. 

The company had previously contracted with third party providers for red team exercises. But the leadership at the organization deprioritized fixing the previously discovered vulnerabilities.  They miscalculated the potential impact and likelihood of those vulnerabilities being used against them one day.   

CISA had several key recommendations, which included regular software updates and cleanses, as well as the use of multi-factor authentication (MFA) and segmented networks. MFA just means requiring more than a password for login. Authenticator apps like Duo and Microsoft Authenticator are designed for this, but there are simpler and less secure methods—for instance, receiving a text or email code. Segmented networks are also fairly self-explanatory. Consider the way a house is partitioned with walls. A network engineer can do the same to your network using firewalls, switches and routers, or through software installed on each computer (which is how your Cochise County Cyber Guys do it).   

Lastly, CISA recommended a shift from legacy system and network architecture to a modern Zero-Trust architecture. Zero-Trust, in the context of computers and networks, is something akin to home security. Doors are locked by default, and only close friends and family are allowed in. This is called, “Deny by Default, Allow by Exception.” 

If you’re a business owner and want to understand how to implement Zero-Trust in your organization, contact the Cyber Guys below. The threat is real, and it is growing. Fortunately, it is also preventable. In the case of Metropolitan Utilities, its first “attackers” had no malicious intent. Provided the blue team heeds Dmitri’s advice, they’ll be prepared in the event that a true black-hat team tries to take down the grid. Are our local utility companies up for the challenge? 

QR Codes, Tattoos, and Quishing 
0
Dan Gavin
QR Codes, Tattoos, and Quishing 

It was October 2011, and Tony, a 26-year-old web developer and gamer, scrolled through Google Images in search of tattoo inspiration as he made his way down the street to his apartment. He had just stood in line for four hours to get the new iPhone 4S, which had come out that very morning. He was excited about the eight-megapixel camera and the addition of a new personal assistant called Siri that responded to voice commands. All this he would have to try later; Tony loved few things more than pursuing the bleeding edge of technology, acquiring all the latest devices so that he could be among the first to use them. But one thing at a time, he thought. 

None of the tattoo ideas piqued his interest. Then suddenly it struck him: he could get a QR code of his website tattooed onto his forearm to show potential clients. At the time, QR code-scanning wasn’t a native feature in iPhone cameras (and wouldn’t be until 2017), but anyone with a scanning app could scan Tony’s forearm and see his website. It was an awesome sales tactic and a prime use of a technology that, while not exactly new, was on the rise in non-industrial settings. He generated the QR code and printed it for his tattoo artist, who meticulously inked his arm to match the printout exactly. 

Satisfied with its appearance, Tony showed the tattoo to his best friend, Joe. After Joe scanned Tony’s arm, he literally fell over laughing. The QR code tattoo hadn’t directed him to Tony’s website. Instead, it had shown him a YouTube video of a cat playing piano. 

A QR (Quick Response) code is a two-dimensional bar code that can be interpreted either horizontally or vertically and that contains encoded data. The codes were originally developed in 1994 to track products in a manufacturing plant but now have a wide range of uses, including marketing, making payments, connecting to Wi-Fi, accessing restaurant menus, providing directions, and many more. Generating QR codes is very easy, and there are free resources on the internet. I used www.qr-code-generator.com to generate the QR code for this article. 

Cyber hackers are also using QR codes. Except, they use them to fool users into downloading malicious code or password stealing.  Using QR codes for a phishing attack is called “quishing.”  Last summer, the cybersecurity company, Sophos, was targeted by a group of hackers.  The hackers sent an email to all employees that appeared to be related to employee benefits and retirement plans.  The email contained an Adobe PDF document that displayed a QR code.  Once the employee scanned the code with his phone, he was taken to a fake Microsoft 365 login form.  Once the employee entered their username and password, the hackers had his company credentials.   

Now, employees who’ve kept up to date on all our cybersecurity articles will understand what a phony link looks like and show caution. But in the case of a QR code scanned on a phone, the link is only up for a short time or is not shown in full, which makes it harder to scrutinize. Hackers may also use redirection techniques that cloak the final destination of a link. 

Sophos says they have observed an increasing number of quishing attempts over the past few months, and these attacks are growing more sophisticated. Andrew Brandt says, “Quishing documents now appear more polished than those we initially saw, with header and footer text customized to embed the name of the targeted individual (or at least . . . the username for their email account) and/or the targeted organization where they work inside the PDF.” 

Criminal organizations, perpetually fixed on business opportunity, now provide quishing services to the less talented hackers out there, and it is highly effective. To protect yourself, be wary of random QR codes from unknown sources. Be cautious of what turns up in your email inbox. If you’re on a computer, try reading the full link with Google Lens. Use your cybersecurity skills (courtesy of your favorite Cyber Guys) to alert yourself if something doesn’t seem right. Know your source before scanning. 

It never pays to be inattentive, but luckily for Tony, his problem stemmed from a harmless typo he made when he generated his QR code. He went back to the studio the following afternoon to get the QR code to his actual website tattooed on his other forearm. Lesson learned. 

This Midnight Blizzard brings an avalanche of trouble 
0
Dan Gavin
This Midnight Blizzard brings an avalanche of trouble 

The wind howled; the snow swirled. It had been like this all day. (Why had Karen left Phoenix again? … Never mind.) She knew she should have been home hours ago. Now it was well after dark, approaching midnight, and the streets hadn’t been plowed. Driving home would be dangerous. She sighed. More from habit than necessity, she opened the door to the car, sat, reached for her phone, and checked her email. 

“What? Again?”  

Karen was sick of receiving these cybersecurity training reminders from IT. They were obviously unaware that she had an important and fast-approaching deadline. If she missed it, she would lose her biggest account and Christmas bonus. Her children were counting on this bonus. They had planned a cruise during spring break. She didn’t have time to waste. 

On closer inspection, though, the email had nothing to do with training this time. Channeling all the security knowledge she had previously acquired through IT, Karen checked the sender address. 

“It’s good. It actually is from IT. It’s just for verification of my username and password. This one should be quick,” she thought. 

Oh no. Karen’s about to be the victim of a classic phishing-email-sender-verification oversight. And I’ll bet you’re thinking, “Tom, she checked the sender. She verified it really was from IT.” Yep. Most of our readers will notice from the start that Karen was astute. But it’s midnight. She’s tired and cupcake-drunk (ask me later), and she’s pushing up against a terrifying deadline. So, she did the only thing her amygdala would allow her to do: find the shortest path to safety. 

In this case, “safety” meant getting the annoying email out of the way so she could finish her report before the deadline. What she missed was context. IT never asks for a user to verify credentials in response to an email. Actually, she was instructed during on-boarding never to respond to an email requesting credential verification. The sender address was spoofed—a.k.a., faked. Yes, that’s a thing. 

The attack we’re scrutinizing this week is currently in use by a Russian attacker that Microsoft calls “Midnight Blizzard” (for real). The attack goes like this: thousands of emails are sent to users at various target companies. Attached to these emails is a file with a “.rdp” at the end of the name. This file will connect your computer with a server on the internet controlled by Midnight Blizzard. 

Always remember, whether it’s the IT department asking for password verification, the IRS notifying you of an audit, or a Nigerian prince asking for a loan, the rule is the same: never respond to any communication asking you to verify anything. Never trust any information you receive in an email, phone call, or text. When in doubt, hang up the call, close the email or text, and make contact using a phone number you know is good. 

Even if Karen had chosen to remain in Phoenix, it would have served her to be wary of a blizzard. And it will serve you, too, whether in the blistering heat storms of Arizona or far beyond. 

Darkness Rising 
0
Dan Gavin
Darkness Rising 

In the darkness the stranger dragged Frodo’s little frame banging each creaky stair along the way. After ducking through the narrow doorway he deposited his charge onto a scratchy straw mattress. “Are you afraid?” was the first thing the sweaty stranger uttered as his heavy boots thundered across the worn planks. His heart pounding in his throat, the only words Frodo could squeak out were, “A little”. As the looming figure swept hastily through the dank air dousing each candle with his filthy fingers, he scolded Frodo, “Not frightened enough! I know what hunts you.” 

The hunters from the Tolkien world of Middle Earth may have once been fiction. Then and there, it was a world of sinister forces bent on destroying most, and dominating the rest. Driven by a delusional Dark Lord, the seeping despair of Mordor seemed inevitable. Here and now, the veneer of fiction is worn precariously thin. Like butter scraped across too much bread. Sinister, dominating, and delusional forces are wreaking actual havoc. Frodo timidly lurks inside each of us as we naively peer through the computer monitor into the depths of Mordor itself.  

Before anyone in Middle Earth feared the rise of the Dark Lord Sauron, there was a shadow in the east. But too many were too busy being normal in the light to fear the abnormal darkness they couldn’t see. Like the people of Middle Earth, there is a darkness looming. Lurking. Creeping. No, Mordor is not the Dark Web. Mordor isn’t even distant. Mordor isn’t rising. It has risen. It is here. Mordor is your email. Or your favorite website. Mordor is a text message, or even a phone call from your son or daughter.  

You see, back in the 1900s when the internet was born, security wasn’t an afterthought. Nor was it a forethought. In the 1900’s when the internet was shiny like a new penny, when people planted gardens and helped a stranger. Work was where you went. And home was where work didn’t dare go.  

Now the new millennium has dawned. Work has invaded home. People don’t help strangers, or plant gardens. The internet has a patina. Or a mold. Or a fungus. Or a crust. And internet security is still mostly unthought. It’s sad that the millennial dawn did not bring the hope, or relief as promised. Dawn brought chaos. The Internet brought chaos.  

Since the internet was raised without rules or boundaries, like the Dark Lord Sauron, it is we who must change if we hope to defeat it. Our insistence that we can continue to do things the same way day after day is like carelessly giving a lift to a hitchhiker. Maybe it’s like thinking there will always be toilet paper at the store. Or that store-bought tomatoes are as good as those you used to grow in the back yard.  

At the end of Frodo’s story, the darkness of Mordor actually arrived at the shire. In the story of your world, you can’t really see the darkness. But the darkness can see you. In Frodo’s world, the antagonist was the aggressor. It’s usually the aggressor who has the upper hand. Oh, Frodo eventually won. But because he started too late there was a lot of pain between his home under the hill, the Mount called Doom, and back again. 

Even the Experts Can Be Fooled
0
Dan Gavin
Even the Experts Can Be Fooled

When even experts in social engineering can be fooled, it is important to ensure a defense in depth strategy for your business’ information security.  KnowBe4, one of the country’s largest providers of cybersecurity and social engineering training, got fooled by a North Korean IT worker intent upon loading their network with malware. 

KnowBe4 had a job opening. They were looking for someone for their internal Artificial Intelligence (AI) team.  What they received instead was a valuable training lesson in advanced social engineering. They were fooled. But unlike many companies, they disclosed the failure. Their experience might save others from a similar fate. 

Fortunately, they caught the imposter early enough so there was no breach or illegal access to the company’s systems.  They stopped him before he could do any damage.  Here is how it happened, how they stopped it, and some lessons learned. 

The human resources team did their jobs.  Background checks came back clean because the imposter was using a valid but stolen US-based identity.  They conducted 4 video conference-based interviews validating that the person matched the photo on the application.   The imposter took a stock photo and used AI to merge his features to the photo.  HR even verified his references. 

Once hired, the imposter asked to have his laptop sent to a farm. Not the kind you’re thinking of. It was “an IT mule laptop farm.”  The laptop farm is like an office filled with laptops and computers hackers use. They connect remotely from North Korea to the laptop farm. It was a good thing KnowBe4 restricted new employee access and didn’t allow access to the production systems. 

Once the imposter had been successfully hired and his laptop had been delivered, it was time for him to embed his malware onto the company network.  He downloaded and attempted to execute malware.  He then used some technical trickery to cover his tracks. 

The good news is the company security operations center (SOC) was alerted to potentially dangerous behavior and called the imposter.  The imposter claimed criminals must have compromised his router.  The SOC team quickly isolated his computer from the rest of the network preventing his access to valuable systems and data.  The imposter was unresponsive once he figured out that he was caught.  

Here are some lessons learned.  When a company uses remote workers with remote computers, the company should have a way to scan the device ensuring there are no other connections on the device.  When hiring workers, don’t rely simply on email references.  Do not ship laptops to locations that don’t match the applicant’s address.  Make sure applicants are not using Voice over IP (VOIP) phone numbers.  Lastly, watch for discrepancies in address and date of birth.  

With all the process failures, KnowBe4 did not suffer a breach.  They understood defense in depth.  They had multiple lines of defense in case one (the employee screening process) was breached.  All their laptops had endpoint detection and response (EDR) software loaded and they had a SOC watching over their network.  The EDR stopped the malware from executing and alerted the SOC. The SOC team isolated the computer right away and escalated the issue.   

When it comes to protecting your business, you cannot rely on the minimal protections.   Firewalls and anti-virus are useful, but they do not stop a hacker from entering through your email or your browser.  Technology, like EDRs and SOCs, may save the day, but must be backed up with tried-and-true policies and training.   Although KnowBe4 is an expert in social engineering, they got scammed due to lax hiring policies.  They have since updated their hiring policies.  Remember, a fool may learn from his own mistakes, but a wise man learns from the mistakes of others.   Be the wise man. 

Ransomware Shuts Down Municipalities; How To Protect Our Cities
0
Dan Gavin
Ransomware Shuts Down Municipalities; How To Protect Our Cities

On June 9, 2024, the city of Cleveland, Ohio uncovered a “cyber incident” which was later determined to be a ransomware attack. Since the attack, city hall has been closed to the public for over a week.  Citizen facing services have been offline as well. To contain the damage of the ransomware, the city shut down the affected systems until they could restore them safely.  On a positive note, emergency services, works, utilities and healthcare were not impacted. 

Details about the attack have been kept close-hold as the investigation continues.   Some employees were allowed back to work on the 12th, but many issues remained.  They could not process building permits and birth/death certificates.  After over a week, the mayor’s office still has not disclosed what information was exposed.  The city did say that they were not negotiating with the hackers and will not pay the ransom.

This is not the first major city in the U.S. to get hit with ransomware.  In 2019, the city of Baltimore, MD was hit with a devastating attack that crippled their municipal services for weeks.  The cleanup cost the city over $18M.  In May of 2023, Dallas, TX was hit with ransomware that disrupted the city’s 911 emergency services. New Orleans, Knoxville, and Las Vegas also have joined the Ransomware Victim Club. 

Don’t think that this only happens in faraway places in different states.  The city of Kingman, AZ experienced a significant cyberattack where the city’s computer system was compromised.  The breach included social security and driver’s license numbers mostly affecting employees. 

There are several reasons why hackers target city governments.  For one, cities have valuable data.  This includes sensitive information such as personal records and financial data.  Secondly, hackers assume that municipalities are a soft target.  Municipalities often lack the necessary funding and skilled personnel to address technology challenges.  Often the IT infrastructure is outdated, making them vulnerable to attack.  Lastly, municipalities provide critical services.  Hackers think that if they take down critical services, the city will gladly pay the ransom.  

Many of these municipalities had cybersecurity services which monitored their systems.  So, how did the hacker install the ransomware?  The problem with this method is that the hacker must be actively inside the network before the threat can be identified, and sometimes that is too late. New malware (zero-day attack) is not in the antivirus databases and is not automatically stopped.  

The solution to this problem is “application whitelisting” or “application allow listing.” With this method only applications which have been validated previously can run on the computer.  Even if an employee clicked a malicious link, when the software tried to run on the local system, it would fail. It is not on the allow list.  There is upfront friction with this implementation where users cannot load anything they want whenever they want.  They submit a request for their new software to be put on the allow list.  The cybersecurity personnel validate the software in their testing environment looking for unusual behavior.  If it checks out, the software is approved for use.  

Another cybersecurity aspect which is often neglected by municipalities is continuous cybersecurity training.  The one-time annual cyber classes are not effective. However, if the training is kept short, about three minutes per week every week, delivered to user’s email box, the results are exponentially better. Cybersecurity is top of mind. 

The lesson to be learned is that every government municipality is a target, not just big cities.  The data is valuable to hackers.  If they can take down emergency services, the hackers expect a fast payment.  Does your local government have the proper cybersecurity measures in place, such as application whitelisting and continuous training, to avoid the disaster that Cleveland is experiencing?

The original article was published in the Sierra Vista Herald and can be found here.

The Rising Importance of Cybersecurity in Our Digital Age
0
Dan Gavin
The Rising Importance of Cybersecurity in Our Digital Age

Tom and Dan were camping deep in the woods one night when Dan runs into the tent and says “There’s a bear attacking our site, we have to go!” Tom is confused when Dan stops to put his shoes on. Tom says, “What are you doing that for, you can’t outrun a bear?” Dan says, “I don’t have to outrun a bear, just you.” That’s how it is in the cyber world. In general, hackers are lazy. If it’s too hard, they move along to an easier target. 

Cybersecurity is crucial to our very survival. As technology continues to advance, so too do the threats that lurk in the deep recesses of the World Wide Web. From individuals to businesses and governments, everyone is a potential target for cybercriminals who seek to exploit vulnerabilities for their gain. 

Cybersecurity is the practice of protecting systems, networks, and programs from digital attacks. These cyberattacks are aimed at accessing, changing, or destroying sensitive information, extorting money from users, or interrupting normal business processes. The internet is ubiquitous. The proliferation of connected devices means the scope and scale of these attacks have grown exponentially. Cybersecurity is no longer a concern solely for large corporations or government agencies. It is a critical issue for individuals and small businesses as well.

One of the most common types of cyberattacks is phishing. Phishing attacks involve sending fraudulent emails that appear to come from reputable sources, tricking recipients into revealing sensitive information like passwords or credit card numbers. Another prevalent threat is ransomware. It is a type of malware that encrypts a victim’s files and demands a ransom payment to restore access. Ransomware can have devastating consequences, leading to financial losses, reputational damage, and operational disruptions.

The increasing frequency and sophistication of cyberattacks highlight the need for robust cybersecurity measures. You must be vigilant about protecting your personal information online. Simple steps such as using strong, unique passwords for different accounts, enabling two-factor authentication, using an adblocker on all your browsers, and being cautious about clicking on links or downloading attachments from unknown sources can go a long way in preventing cyberattacks.

For businesses, cybersecurity must be a top priority. It is no longer a cost center. It is a revenue guarantee. Businesses need to implement comprehensive security policies, conduct regular security assessments, and provide continuous cyber education for employees. Small businesses are particularly vulnerable. They often lack the resources and expertise to defend against cyber threats. They can take advantage of various tools and services designed to enhance their cybersecurity posture. For instance, investing in a zero-trust provider can help protect sensitive data and prevent unauthorized access.

Businesses should develop and practice an incident response (IR) plan to quickly address and mitigate the impact of a cyberattack. The IR plan outlines steps taken in the event of a security incident, including notifying affected parties, containing the threat, and restoring normal operations. By being proactive and prepared, businesses can minimize the damage caused by cyber incidents and recover more swiftly.

Cybersecurity is an essential component of our digital world. As cyber threats continue to evolve, it is imperative for individuals and businesses to take proactive measures to protect themselves. By staying informed and implementing robust security practices, we can collectively enhance our resilience against cyberattacks and safeguard our digital future. The key to success is to make yourself a hard target so that the bear goes after the easy prey instead of you. 

The original article was published in the Sierra Vista Herald and can be found here.

The Saga of Joe Public, A Social Media and Email Tragedy
0
Dan Gavin
The Saga of Joe Public, A Social Media and Email Tragedy

This is a story about Joe. Joe could be any one of us. During the day he is a nose-to-the-grindstone, focused, and hardworking employee. After work, however, he is careless and free, enjoying all that social media has to offer: posting photos, catching up with friends, reading the links his friends on social media post, and yes, he does enjoy the occasional cat video. He is active on his email account too.

Unfortunately, Joe is not really keen on cybersecurity hygiene. He clicks on any link he gets via email or social media without checking the URL first. He makes his life easy by using the same password for all his different accounts. Two-factor authentication is too much work and why would he need it anyway. Nobody would hack a regular guy. Since he is so friendly, his social media account is open to the public, so everyone knows everything about him. What he had for his birthday dinner last night; where he was born; his mother’s maiden name; and even the name of his first pet. 

Although Joe seems to be the life of the party when it comes to social media, Joe was not ready for the party crasher. After work, as Joe was ready to relax and catch up on some email, he discovered he could not login – password failed. That’s strange. He had not changed the password to his email account. Ever. So, he decided to check his Facebook account to see if anyone else was having trouble with their email provider. And what do you think happened to his Facebook account? He was locked out of Facebook too. As he sat back to ponder what was happening, a friend from high school called. His friend asked why he was sending out emails pretending to be a Nigerian prince looking for money? He also noticed that Joe started posting advertisements on social media for the Pink Princess Palace. That’s when Joe figured out that he had been hacked! How could this have happened to him?

The hacker could have come in from many different attack vectors. After checking the website, https://haveibeenpwned, Joe noticed that his username and password were compromised in 17 different breaches. Since he used the same username and password for every site, it was easy for the hacker to take over his email and social media. Also, the hacker could have just used Joe’s username combined with all the information on Joe’s Facebook profile to answer the typical “security” questions many web applications use for password resets. 

What does Joe do now to get back into his accounts and secure them? First, he should get in touch with his email and social media providers to let them know what happened to regain access to the account. This could even involve sending Facebook a copy of his Driver’s License to prove his identity. He will need to change his password to a nice long pass phrase – 16+ characters. He will also need to change his password on all his other accounts because the password has been compromised. Next, he should set up two factor authentication for all email and social media; and any other account he doesn’t want breached (like his bank and investment accounts). Two-factor authentication involves having the web service send a text with a one-time code. Even better, Joe would use a third-party application like Duo or Microsoft Authenticator. 

To do this on your Facebook account for example, you need to login to your account. Click the arrow icon in the top-right corner and select “Settings & Privacy” and click “Settings.” In the left-hand navigation bar, choose “Security and Login.” Scroll down to the “Two-Factor Authentication” section and click “Edit” next to “Use two-factor authentication.” Follow the instructions from there based on the way you choose to receive your notifications. All email and social media apps have this option. 

Now that Joe has so many usernames and passwords to remember, he decided to use a password manager to help him out so that he only needs to remember one long password. He downloaded Bitwarden to his computer and added the Bitwarden extension to all his browsers so that he has his secure passwords wherever he goes. 

Joe is so excited about securing his email and social media that he tells his brother, John Q, and the rest of his friends so that they don’t have to go through similar torture. Joe has since become the lead blogger for the Cybersecurity Evangelist.

This article was originally published in the Sierra Vista Herald and can be found here.

Bob’s Social Security Tale, Is Yours Safe 
0
Dan Gavin
Bob’s Social Security Tale, Is Yours Safe 

Social Security benefits are a lifeline for many retired Americans, providing essential income for daily needs and a comfortable retirement. The sad part is that it’s relatively easy to redirect your checks to a threat actor’s bank account. It really is a growing concern. Understanding how this can happen and how to protect yourself is crucial. 

Bob (names have been changed to protect the victim) is a 70-something retiree who had always been diligent about protecting his personal information. He kept his Social Security number safe and was cautious about sharing his personal details. Bob suddenly realized something was wrong when for the second month in a row his social security check hadn’t been deposited. The gnawing in his stomach was overwhelming. He contacted his bank and the Social Security Administration (SSA). He discovered his benefits had been redirected to an unknown bank account. Bob was a victim of a scam. 

Bob’s situation is, unfortunately, not uncommon. Scammers often use phone calls, emails, or even postal mail to impersonate SSA officials. They may ask for personal information, claiming there is an issue with your account or that you need to verify details to continue receiving benefits. Once they have your information, they can use it to change the bank account where your benefits are deposited. 

There are steps you can take to minimize the probability and the impact of this type of scam. First, guard your personal information like it was a pot of gold. Because it is. Never share your Social Security number, bank account details, or other personal information over the phone, email, or online. One way to ensure you survive a phishing attack is to contact the bank or other financial organization using a number you have called before. One you know for sure is the correct number.

Second, remember, the SSA will never call you and ask for personal information. If you receive a suspicious call, hang up immediately without uttering a word. Occasionally the scammer will ask questions designed to get you to say the word “yes”. Then they will manipulate the audio of the call and use it nefariously.

Third, regularly check your bank account and Social Security statements for any unusual activity. If you notice anything suspicious, report it immediately. 

Fourth, if you have created an online account at https://www.ssa.gov/myaccount enable the multifactor authentication to secure your benefits. Also, make sure the password you use here isn’t used anywhere else. Not even a permutation of the password. All the websites you use to manage your money should be secured with the strongest password the app allows, and absolutely enable multifactor authentication. 

Lastly, if you believe you are a victim of identity theft or fraud, contact the SSA and your bank immediately to report the issue and take steps to secure your accounts.

Bob’s story is a cautionary tale. It is a reminder to be vigilant and to trust no one. These simple steps will not guarantee you will never be a victim, but they WILL contribute to a more secure future. 

Any communication, regardless of the form, that causes you to feel an emotional response (urgency, catastrophe, or promise of punishment or reward) is most likely tied to a scam in some way. So, talk to someone you trust face-to-face. This can help calm you down and ensure you take careful methodical measures to resolve an issue.

Beware: Phishing Attacks Enter the Deepfake Era 
0
Dan Gavin
Beware: Phishing Attacks Enter the Deepfake Era 

Bob’s boss was asking for something really weird. A wire transfer this big was never done. In all the years Bob worked for Alice, she had never asked for a transfer of this magnitude. But there she was in the zoom meeting, in the flesh (well, digital flesh anyway). How was Bob to know that wasn’t really Alice? 

In the digital dimension, threats to our life aren’t always the mortal kind. They also lurk behind screens, ready to exploit our human weaknesses. Those are the ones that we too often overlook. While phishing attacks are nothing new, they have evolved. Welcome to the Deepfake world. Oh, is that word new to you? Well, buckle up. You need to learn it… and fast. A deepfake is a video or audio of yourself or someone you know created by Artificial Intelligence (AI) out of parts and pieces of other audio or video. With deepfake voice and video capabilities, cybercriminals can now mimic your trusted contacts (like your boss) and authority figures (like your spouse) with alarming accuracy, aiming to deceive and manipulate you. If you use the internet to do banking or email, you are a target. You need to understand the risks and implement precautionary measures to safeguard your online identity and personal information. 

Deepfake technology uses AI to combine audio and video recordings, seamlessly grafting a person’s likeness onto another’s voice or image. This tool, once restricted to Mission Impossible, is real. And it has been weaponized by cybercriminals seeking to exploit your trust in familiar voices and faces. 

Imagine receiving a phone call. On the other end someone is demanding you confirm sensitive account information. The voice on the other end sounds EXACTLY like your boss, complete with the cadence and intonation you’ve come to recognize. Or perhaps you receive an email from your biggest client requesting urgent wire transfers, accompanied by a convincing video message imploring immediate action. In both scenarios, the other person isn’t a person at all. It’s an AI impostor, leveraging deepfake technology to deceive and manipulate you. 

The consequences of falling victim to a deepfake phishing attack can be dire – from financial fraud and identity theft to reputation damage and compromised personal data. The ramifications are deep. Being deceived by someone you trust, even if it was a fake someone, creates a psychological fissure that erodes your confidence in digital communications and exacerbates feelings of vulnerability and distrust. 

The threat posed by deepfake phishing attacks is unsettling. But there are proactive steps you can take to mitigate risks and bolster your defenses. 

Verify Identities: Before responding to any requests for sensitive information or financial transactions, independently verify the identity of the sender through alternative channels. Contact your bank or employer directly by phone using a number you know to be good to confirm the legitimacy of any requests. 

Exercise Caution: Whenever you receive unsolicited emails, phone calls, or messages treat them with profound skepticism. This is especially true if they contain urgent or unusual requests. Scrutinize the content for inconsistencies or irregularities. It may indicate a phishing attempt. 

Stay Informed: Find someone you trust to keep you informed about emerging cybersecurity threats and trends, including advancements in deepfake technology. Educate yourself and your loved ones about the risks posed by phishing attacks.  

Use Multi-Factor Authentication: Implement multi-factor authentication wherever possible to add an extra layer of security to your online accounts. This additional step can help thwart unauthorized access, even if your credentials are compromised. 

Report Suspicious Activity: If you encounter a suspected deepfake phishing attempt, report it to the relevant authorities, such as your IT department, cybersecurity agency, or the Federal Trade Commission. 

The emergence of deepfake technology underscores the evolving nature of cyber threats and the importance of proactive cybersecurity measures. By remaining vigilant, verifying identities, and staying informed, you can safeguard yourself against the perils of deepfake phishing attacks. Together, we can navigate the digital landscape with resilience and confidence, thwarting cybercriminals at every turn. 

The original article was publish in the Sierra Vista Herald and can be found here.

Copyright © 2024 CyberEye Call us at: ‪(520)224-8981