A recent report has revealed that hackers are obtaining compromising material and then holding it hostage until their demands are met. IHAB MOAWAD sheds some light on this new tactic that many are calling “sextortion.”|A recent report has revealed that hackers are obtaining compromising material and then holding it hostage until their demands are met. IHAB MOAWAD sheds some light on this new tactic that many are calling “sextortion.”
In April Trend Micro released a research paper about sextortion: the means through which cybercriminals obtain compromising personal images or videos of Internet users – which they then hold hostage until their demands have been met. Fast forward to July and we have seen the hack of controversial adultery/dating site, Ashley Madison. Cybercriminals wreaked havoc as they threatened to slowly leak the data of the adulterers using the site, until it and its companion site, “Established Men”, shut down.
An article on time.com calls this tactic “hacking 2.0”, stating that this new hacking method is not about the data, but the context. Making money from stolen data, like credit cards, is a lot of work and cybercriminals have latched onto the fact that they have a larger pay cheque to gain from those that stand to lose more than just money. Hence, a hack like Ashley Madison’s that could – and has – destroyed reputations and families is a gold mine for the team responsible for the hack (The Impact Team).
Now, moral opinions about Ashley Madison aside, I’m sure that no one appreciates any of their personal information being kidnapped and held for ransom. But cybercriminals are cunning and they know that if they keep the sums low enough, people that stand to lose more than money would rather pay up. In this case, the Ashley Madison hackers offered users the ultimatum of paying $19 to have all their information wiped off the site or having it leaked. But there is of course, no guarantee that you can trust a cybercriminal.
How does data kidnapping affect my business?
According to time.com, there is a new reality that’s making matters worse for corporate security teams and it’s that in recent years, there has been heavy investment in protecting financial data – spending money to fortify the most valuable data. So while credit cards may be protected, email servers may have been left in the lurch, but this will slowly change as personal data of different contexts becomes a bargaining chip for cybercriminals.
Ashley Madison is just one example of an enterprise that has been targeted in this manner. Another example is the malware Cryptolocker which forced victims to pay a sum to unscramble their data and subsequently made $27 million in just the first two months from small home owners and businesses. And then there was the Sony hack in December 2014, in which cybercriminals stole corporate emails and embarrassed the company. In hacking 2.0 cybercriminals don’t need to steal your money, all they need is any data that is valuable to you.
This means that executives should be working tirelessly to do an honest assessment about what their enterprise’s valuable data really is. Then wise investments need to be made in protecting data that might seem inconsequential if stolen in one context, but a disaster if stolen in another. The bottom line? Every company will now have to plan for ransom and extortion scenarios.
So what now?
In addition to a stealthy security policy, companies now need a data kidnapping and extortion policy in order to properly protect themselves. This is on top of robust business security solutions. Employees, and in turn the business, for example, could benefit from having Trend Micro Security 10 on the mobile devices of employees. Trend Micro Security 10 is a recently launched security and privacy tool that’s fully compatible with Windows 10.
The new version’s security features are simple-to-use, yet provide state-of-the-art protection for employees’ data, delivered with optimal performance. This allows users to securely connect and engage safely online – on the company network – while protected from today’s evolving threat environment. The software will feature protection from exposing private information or becoming susceptible to data-theft and other malicious online threats on both personal and business devices.
Trend Micro Deep Discovery is also an option for business as is detects, analyses and responds to today’s stealthy targeted attacks in real time and then Deep Security delivers automated and highly scalable cloud security. But really, what you should do is speak to a Trend Micro professional about a customised security solution for all your business’s security needs. As is the case with any form of cybercrime, prevention is better than cure, and you don’t want to wait until you’ve had data kidnapped to react to hacking 2.0.
* Ihab Moawad, Vice President MMEA and CIS at Trend Micro
Password managers don’t protect you from hackers
Using a password manager to protect yourself online? Research reveals serious weaknesses…
Top password manager products have fundamental flaws that expose the data they are designed to protect, rendering them no more secure than saving passwords in a text file, according to a new study by researchers at Independent Security Evaluators (ISE).
“100 percent of the products that ISE analyzed failed to provide the security to safeguard a user’s passwords as advertised,” says ISE CEO Stephen Bono. “Although password managers provide some utility for storing login/passwords and limit password reuse, these applications are a vulnerable target for the mass collection of this data through malicious hacking campaigns.”
In the new report titled “Under the Hood of Secrets Management,” ISE researchers revealed serious weaknesses with top password managers: 1Password, Dashlane, KeePass and LastPass. ISE examined the underlying functionality of these products on Windows 10 to understand how users’ secrets are stored even when the password manager is locked. More than 60 million individuals 93,000 businesses worldwide rely on password managers. Click here for a copy of the report.
Password managers are marketed as a solution to eliminate the security risks of storing passwords or secrets for applications and browsers in plain text documents. Having previously examined these and other password managers, ISE researchers expected an improved level of security standards preventing malicious credential extraction. Instead ISE found just the opposite.
Click here to read the findings from the report.
MWC: Next generation of inflight connectivity to be unveiled
Next week at Mobile World Congress, the Seamless Air Alliance will reveal progress on its mission towards enabling the next generation of inflight connectivity. This follows a significant start for the Alliance, which has seen membership increase five-fold since the first meeting in June of last year. The Alliance has a new research laboratory setup and continues progress through its three working groups, writing specifications for the technology, requirements, and operations.
These developments represent a huge leap towards the goal of making connectivity as easy and enjoyable in the skies as it is on the ground. Appearing as part of the Airbus stand (Hall 6, stand 6G34), the Seamless Air Alliance will reveal specification topics that have been completed and published to its membership.
“The passenger experience with inflight connectivity remains one of the great technology challenges. From Day One we have been determined to deliver on our mission to bring industries and technologies together to make the inflight internet experience simple to access and a delight to use,” said the Alliance’s Chief Executive Officer, Jack Mandala.
“I have been tremendously encouraged by the enthusiastic and committed response we have seen and the widening areas of expertise we can call upon as more and more companies and organisations continue to join us,” he added.
Announced during MWC 2018, the Seamless Air Alliance has since grown to twenty-three membercompanies with more than one-hundred key personnel from across the membership participating in its three working groups, with numbers continuing to increase.
The Seamless Air Alliance was created by founding members Airbus, Airtel, Delta Air Lines, OneWeb and Sprint, and quickly joined by Air France KLM, Aeromexico, and GOL Linhas Aereas Inteligentes and global technology leaders including Astronics, Collins Aerospace, Comtech, Cyient, iDirect, Inmarsat, Intelsat, Latecoere, Nokia, and Panasonic.
Today, the Alliance is pleased to announce five additional new members: Adaptive Channel, Etihad Airways, GlobalReach Technology, Safran, and SITAONAIR.
“We are extremely pleased to have these companies join and be a part of the companies driving the next generation of connectivity.” said Mr Mandala.
The Seamless Air Alliance will enable travelers boarding any flight, on any airline, anywhere in the world, to use their own devices to automatically connect to the Internet with no complicated login process nor paywall to scramble over.
The Alliance is also announcing the release of a new research study on the economic benefit of standardization on the inflight connectivity market at Mobile World Congress. This report is available for download at https://www.seamlessalliance.com/publications/
The Alliance is moving rapidly towards an expected demonstration of the technology later in 2019 and anticipates massive interest in Barcelona from the whole communications eco-system.