Most Americans have stopped keeping count but this will be the fifth or sixth data breach for T-Mobile, the second largest mobile service network in the United States. In case you’ve forgotten or gotten it confused with the 12 other breaches you may have been a part of recently, the previous T-Mobile breach included PII such as addresses and phone numbers as well as your billing data, but not credit cards or Social Security numbers. This time around, according to the hackers who are attempting to sell the database via the dark web, they have names, addresses, Social Security numbers, drivers licenses, and IMEI numbers of over 100M T-Mobile customers. T-Mobile and independent investigators are attempting to determine if this is true, but according to Motherboard, who first broke the story, the sample data they were provided as proof appeared to be legitimate.
What this means for you
You don’t need to be a security expert to understand how bad this is, but in case you want my hot take, if I had to rate this on a scale from one to ten of “bad”, this pins the needle at a solid ten, if only for the fact that having IMEI numbers exposed opens the possibility for wide-scale phone cloning which could then result in completely undermining any security provided via SMS-based two-factor authentication. In case parsing that last sentence was tough, the reason you implemented two-factor was because the second factor was you getting a text message to your phone that no one else could see…unless your phone was cloned.
As of this writing T-Mobile hasn’t verified that all 100M or so customer records were breached, but from various proofs provided by the hackers, as well as the fact that they are selling a subset of 30M records for $275k, seems to indicate that they indeed have the goods and you can bet this data is as good as sold, even at such a high price. For comparison’s sake, the previous breaches T-Mobile admitted to were 1M and 2M records 2 of the previous incidents.
This news is still developing, but keep your eyes and ears wide open, especially if you are a T-Mobile customer. If you see sudden two-factor prompts that you did not request, be prepared to act quickly to secure the account. If possible and it’s offered by a two-factor protected service, switching to an app-based two-factor method to secure account will remove this particular danger of a cloned phone, but only if you get it done before the hackers get you in their crosshairs. Keep in mind that the hacker will need to know your password (the first factor in a two-factor scenario) in order to trigger the second factor, so as long as that password wasn’t revealed in a previous breach, you will probably be fine. You used a unique, strong password for every service, right?
For the dwindling few of my clients who had any energy left to be outraged at something, a recent article from Forbes highlighting Google’s rather blatant disregard for user privacy energized at least a handful of them to delete the Gmail app from their iPhones. For the rest of you who haven’t encountered this story yet, it’s actually not something new that has occurred, but rather something that has been going on for awhile now, that is only coming to light in an understandable way thanks to Apple’s new privacy policy and its ongoing battle with Facebook. Up until now, Google has been letting Facebook take the brunt of the media attention on this issue, but it was only a matter of time before their equally egregious data harvesting practices came to light.
What this means for you
Let me be 100% transparent with you. I send out an email newsletter weekly via a platform called Mailchimp, and I’m using their “Free” tier of service in exchange for allowing them to use a portion of my email to advertise their service. I’m also quite certain they are gathering metadata from every email I send out, aggregating this data across all their other clients (paid or not!) and then reselling that information to various advertisers and market research firms. As we’ve been repeatedly told even well before the birth of the internet, there’s no such thing as a free lunch. Google’s Gmail service, for something that is free, is actually one of the best email platforms in existence, but, as you should already know, comes at a price.
If there is something I’ve gleaned from working with people and technology for over 30 years now, it’s that we all have a calculus we perform internally that measures convenience and cost against privacy and security. For some of us, that teeter-totter tips heavily on the privacy and security side, and for others much less so, especially if the convenience means that we are able to invest effort into other things that matter more. Regardless of how your inner-seesaw is tilted, privacy and security are not balanced or elevated without significant effort, and more is being required everyday. The longer companies like Google, Facebook, and yes, even Apple sit on one end of the teeter-totter gorging themselves on your data, the harder they will be to lift or even dislodge so that you can properly enjoy the ride with someone who doesn’t always tip the scales in their favor.
Don’t expect any company, especially a for-profit one, to stand up for your privacy regardless of what they tweet or tout in their advertisements, and the same can be said for many politicians who plainly have their pockets lined by big corporations. Whether we want to admit it or not, many of us are using services that may or may not be worth the privacy we give in exchange. Your privacy is valuable, so don’t give it up so easily. You’ll definitely miss it when it’s gone.
It’s become abundantly clear from how we handled the pandemic that humans, as a general rule, aren’t very good at planning for, and dealing with, unexpected scenarios, especially if it is something that they don’t believe can happen to them. Life insurance agents will tell you this, and as a guy who’s spent the past 30+ years working in technology, I can also say that regardless of how long you’ve been using a computer for whatever reason, most of you aren’t planning for when it breaks. Some of my clients do actually plan for failure, and even they are caught off guard sometimes. If there’s one thing that you can count on with technology, failures won’t go as planned.
Not the kind of exit you might be thinking
We don’t want fires to happen in buildings, but when they do, it’s of paramount importance that we know how to get to safety. While I can easily list plenty of failure scenarios for your technology, I can’t tell you when they are going to happen. But there are plenty of things I can help you plan for because our use of technology is fairly predictable, and if we prepare accordingly, we can react effectively when failure rears its ugly head. Here are some examples and some ways to approach common internet problems:
“Our internet just went down.”
This happens all the time, and is always at the worst possible time. You should always know (a) who to call when it goes down, and (b) know where to go to get internet when (a) tells you that the outage is being worked on but there is no ETA at the moment. Do you know how to fire up a hotspot on your mobile phone? Do you know where the nearest free WIFI source may be? Do you know how to reboot your router? Is it just WIFI that is down, or your internet connection, or everyone’s internet connection?
“My computer just stopped working.”
Windows is going through a rough time at the moment – their QA is absolutely crap lately, but not applying updates is almost as bad as applying them, so have an idea of how you can get your important work done without your primary computer. What can be done via another device, platform or even someone else? Do you know how to access your email via the web or on your phone? Could you pull that important file off a cloud backup and work on it on another computer, or even your phone?
“Know where your data resides.”
In the end, for those of us who need technology to perform our work, it is as fundamentally important as know where your data is as it is know how to safely get out of a building in an emergency. If the thing you need to do isn’t accessed via the internet, then the internet being down isn’t (necessarily) a problem. If the thing you need to do can be done on another computer, then your computer being down is just an inconvenience that can be worked around. As long as you know where your data resides and you understand how to access it, the technology you use to get there is just a means to an end. Just as most of us aren’t meant to fight fires in buildings – we just need to know how to get out quick, fixing broken technology should not be your focus – instead plan and learn how to work around those eventualities.
Image by Alex Fox from Pixabay
Hot on the heels of a moderate backlash on their Sidewalk initiative, Amazon has decided that maybe Ring doorbells should be a little more considerate of your privacy. Up until today, if you had subscribe to the Ring Protect Plan which provided a means for you to store history of your Ring camera’s footage in the cloud, that video – in theory – could be viewed by Amazon and local law enforcement depending on the partnerships they have set up with various jurisdictions. There has been much debate about whether doorbell camera videos should be considered private, but once you account for all the various uses and placements of the devices, especially backyards and sideyards, the video footage really shouldn’t be considered “public space.”
Make your Ring truly private
Assuming you are using one of the 13 models that are compatible with the service, you can add device-specific encryption to your videos which essentially makes them only viewable on your mobile device with the Ring app. Previous to this new feature rollout, law enforcement could send out bulk-requests to users in a geographic area to “share” their video footage. Now, if you opt-in to the E2EE version of the Ring app, law enforcement must request access via warrant, and supposedly neither Ring nor Amazon can see this footage without requesting it from the specific user. Keep in mind that you have to OPT IN to this feature and it will break certain accessibility, such as viewing on Alexa devices or Shared User access. If privacy is more important to you than accessibility, you should enable this feature immediately:
https://account.ring.com/account/control-center/video-encryption/advanced-settings/end-to-end
Image by Tumisu from Pixabay
Reports are now popping up in my technology news feed that a database containing information from over 700 million LinkedIn members is now available for purchase on the dark web. Unlike some of the other information dumps that have made headlines recently, this one doesn’t contain passwords or other sensitive information, but it does contain the information that LinkedIn members typical put in their profiles, including phone numbers, addresses (mail and email), job and education history as well as whether or not a particular member might be looking for a job. According to LinkedIn and which other sources seem to corroborate, this isn’t actually a data breach, but what is known as an “information scrape” which is shorthand for a database built by reading and indexing information that is readily available on the web. Keep in mind, “readily available” does not necessarily mean authorized use, especially when it is gathered and put on sale by someone not LinkedIn.
What does this mean for you?
Even if you aren’t on LinkedIn, if you do any sort of business that requires to you interact with others via the internet, you should be aware of why these types of databases are still considered a significant security risk, and I can sum it up in one word: Phishing. One of the most common tactics in use now by phishers is leveraging data gathered in these databases to build and send fake emails that contain enough real information to trick even the most savvy email veteran. Especially vulnerable are the millions of job seekers who use LinkedIn everyday to contact plenty of people they don’t know directly, and have to rely on information found on the website. Cybercriminals are using this particular weakness to infect job seekers with trojans as part of a fake employment application, which can then lead to identity theft, extortion and a definite disruption in the job seeking process. In the end, there isn’t much you can do about this except the following:
- Set up 2-factor authentication on all your important accounts, especially email.
- Back up your important data. Cloud-based backups are best.
- Make sure you are running malware protection on your computer.
- Make sure your network (home and work) is protected by a proper firewall.
- Establish freezes on all your major credit reporting identities via these websites: Experian. TransUnion. EquiFax.
- Never trust an email link, especially one that seems to ask for a password right off the bat. Always call and verify.
Amazon announced its controversial “Sidewalk” platform nearly two years ago, but most of you probably missed the announcement and the uproar it caused as we were consequently distracted by the mother of all distractions in 2020. Now that we are all starting to stumble into the daylight like hermits emerging from a cave, Amazon is taking advantage of our befuddlement and online shopping addictions to roll out Sidewalk for realsies. On June 8th 2021, unless you specifically opt-out, your Amazon devices like Ring doorbells and security cameras, and the various smart-speaker/screen devices like Dot and Echo, will be automatically enrolled in Amazon’s ambitious effort to bring better network connectivity to your neighborhood. But what is it actually doing?
What is Sidewalk and why should you care?
In a nutshell, Amazon is leveraging the absolutely gigantic install base of Echos, Dots, Rings and Tiles to create what amounts to a vast mesh network. Depending on your training and professional interests, your reaction to this may vary from the “Awesome, maybe my Ring doorbell won’t keep falling off the internet,” (average homeowner reaction) to “This seems like a very bad idea,” (average security/technology consultant reaction). If you were concerned about Sidewalk bogarting your bandwidth, according their specs, it should be skimming a very small amount off the top which, unless you are on very constrained bandwidth (DSL is still the only choice in many neighborhoods believe it or not!), should not even be noticeable. From a security standpoint, Amazon seems to have its head on straight, again at least on paper, about how they are keeping the data transmissions encrypted and separate from your data. Huge caveat on this one – just because a bunch of engineers say something is safe now, does not make it so forever, as we have seen numerous network standards get dismantled and abandoned as dangerous flaws are discovered.
The big concern should be what else Amazon will be doing on the Sidewalk network. In case you hadn’t guessed it, they will be gathering data. An absolute monstrous amount of data on thousands and thousands of households, neighborhoods, camera feeds, pet walking routes, delivery times, recipe requests, song playlists, etc. All of it tagged with geolocation and numerous other telemetry points that give Amazon (and its data customers) an absolutely staggering market advantage. Depending on your leanings and privacy concerns, this may be of no big concern, or perhaps you’ve decided that Amazon gets enough of your dollars already and as such are not deserving of any more of your data than you’ve already sacrificed on the online shopping altar. If this is the case, then disabling Sidewalk is as simple as (wait for it) using your Alexa app to turn it off. Yes, this is like using the stones to destroy the stones. At least you can just delete the Alexa app after installing it to turn off Sidewalk. Until our government decides it’s time to regulate business use of our private data, it will be up to the average household to draw the line in the ongoing privacy war. Which side will you be on?
With the recent ransomware attacks on large US companies like fuel distribution company Colonial Pipeline and now JBS, one of the world’s largest beef and pork suppliers, some of you might be thinking, “Oh good, they are focusing on the big fish now,” which gives us smaller companies a little breathing room. While this may make sense from purely predatory “Animal Kingdom” point of view, size matters naught on the internet. The difference in effort and cost to target a big company versus a small one isn’t large enough to deter them from pursuing both. In fact, due to the continually widening dark web market of Ransomware-as-a-Service (RaaS), targeting small companies is just as cost-effective as large ones. After all, 50 ransoms of $1000 is the same as one $50,000 score.
What does this mean for you?
Businesses large and small are starting to understand that it’s no longer “if” you will be attacked, but “when”, and in addition to tightening up their technology, they are also getting insurance to cover potential cyberattacks and ransomware demands, like the ones that Colonial faced (they paid, by the way) and what JBS is facing now. Because claims on these types of policies are on the rise and show no signs of slowing, the insurance providers are now asking for their potential cyber policy holders to batten down their hatches in preparation for the coming storm. Here are the things they are looking for:
- Does your company use two-factor authentication for all of its critical infrastructure? Not only email, but VPN/Remote access and administrator credentials for your company’s network as well.
- Is your company’s critical data backed up to an encrypted, offsite location that is protected by two-factor authentication?
- Are you running up to date malware protection on all devices that access company data and networks? The big gotcha here are all the personally-owned computers people have pressed into service during the pandemic.
- Are all devices that contain sensitive data encrypted? This includes mobile devices, and again, personally-owned equipment.
- Is your network protected by enterprise-grade firewalls and protocols?
Additionally, insurance providers might also be looking for these advanced security implementations that normally were only deployed by larger companies with dedicated technology and security staff, including:
- Dedicated network intrusion detection and active countermeasures.
- An information security policy in place for your company that governs how your company retains, protects and disposes of critical, confidential data.
- Regularly scheduled penetration testing of your company’s data networks.
- Regularly scheduled security audits of all company technology.
- Designated security officer/manager responsible for the company’s security.
- Regular training of all company staff on information security policy and practices.
When shopping for a cybersecurity policy, or expanding your current coverage to include it, you will be asked about some, if not all, of the above items, and your answers may determine the cost of your premium, or whether the insurance provider will underwrite you at all.
Image by Free stock photos from www.rupixen.com from Pixabay
When the pandemic came crashing down on the US workforce last year there was a mad scramble by companies to figure out how to continue operating with a work force scattered to the four winds. On top of the realization that essential technologies like webcams and laptops were suddenly scarce, America’s newest telecommuters had to contend with historically crappy residential internet service, ancient Wifi routers and noisy, poorly furnished home office space shared with new office mates that were, let’s say, less than familiar with professional office etiquette. Even now, as the US eyes returning to some semblance of business normalcy, many companies are considering and even committing to keeping some or all of its employees working from home.
Does your company policy cover working from home?
One of the biggest gaps that companies should be reviewing is if their remote workers are using personally-owned equipment to telecommute. Thanks to tight budgets and stock shortages, many newly-remote workers were pressing family-owned equipment into service with the mindset of it not being a permanent solution. But now that many companies are considering making telecommuting a permanent part of their company, they need to account for the use of technology that isn’t owned or managed by the company itself. If employees are allowed to use their own personal machines to access work, are those machines properly secured, and if they can’t be made secure, what is the company’s responsibilities and what are the employee’s? Should they provide equipment, or some form of stipend, and if the latter, what’s the policy governing personal use of that equipment?
Working remotely also requires healthy, fast internet secured by a properly-maintained firewall. Should the company pay for that employee’s internet? What if that worker’s internet quality makes working from home difficult? What if that internet is shared by other household members who don’t work for said company? What if that firewall inhibits said household from properly enjoying other non-work activities? Most residential ISP’s make it difficult to set up separate internet circuits to the same address, and in many cases, the home’s wiring cannot accommodate it even if the ISP is willing to do so.
Is your company’s management prepared to evaluate the performance of a workforce that they cannot physically supervise? Does your company require the remote employees to keep rigid office hours like they did while in the office, or does your policy allow for more flexible schedules, or is it a mixture of both? What facets of their duties govern how that remote worker manages their time, and how much is that influenced by the company’s culture and management style?
At minimum, company management should review their existing employee policy to make sure that it is revised to cover a new type of working environment and new expectations for their remote workers. Many of the decisions will need to be reviewed with HR and legal counsel to make sure they fall within your localities labor laws, and of course, whoever manages your company’s technology.
Image by StockSnap from Pixabay
Despite their semi-public presence, it seems that ransoming a company that provides fuel to most of the eastern seaboard drew a little too much heat for the Colonial Pipeline hackers. Cybercrime researchers Intel 471 are reporting that the ransomware group Darkside has essentially ceased operations after it appears its technology infrastructure was disrupted or dismantled and as much as $5M in crypto currency was seized by unnamed law enforcement entities.
Chalk one up for the “Good Guys”?
In a statement published in Russian to its “affiliates” Darkside wrote:
A couple of hours ago, we lost access to the public part of our infrastructure…
The hosting support service doesn’t provide any information except “at the request of law enforcement authorities.” In addition, a couple of hours after the seizure, funds from the payment server (belonging to us and our clients) were withdrawn to an unknown account.
In view of the above and due to the pressure from the US, the affiliate program is closed. Stay safe and good luck.
The landing page, servers, and other resources will be taken down within 48 hours.
The moral underground? Ransomware operators retreat⦠| Intel471.com
In case you missed it, Darkside was presenting themselves as a Software-as-a-Service (SaaS) company but instead of offering cloud-based email or data processing or point-of-sales, dark web shoppers could get access to a turn-key Ransomware platform they could turn loose on their own “customer base.” According to some estimates, Darkside netted nearly $90M in cryptocurrency fees paid by its clients over the course of its relatively short life, and it seems other outfits who shared a similar business model were also equally successful. Fortunately for the rest of us who are trying to make money without committing crimes, when the RaaS purveyors also adopted other more traditional trappings of the business world, namely centralized infrastructure and fee collection, they created a target that law enforcement could leverage to dismantle their operations.
While eliminating these highly-visible (relatively speaking) threats should be taken as a positive, you can bet that other operators are taking notes and learning lessons from their fallen brethren who have encouraged their successors to maybe avoid instead of seeking the limelight. As we all know, scaling in the business world definitely means more profits, but you’ve got to be ready for the scrutiny that comes with it. Selling software is an honest living, unless your software is used to extort millions, in which case an audit is the least of your worries.
Image by Gerd Altmann from Pixabay
Last week, a five-thousand mile fuel pipeline that spans the country from the Gulf Coast to New York was shut down by company operators because of a ransomware attack that had compromised parts of their technology infrastructure. According Colonial Pipeline Company, the pipeline wasn’t shutdown by the attack itself but enacted as a precautionary measure. Though some parts of the pipe system which normally delivered nearly half of the East Coast’s jet, diesel and gasoline fuel supply have been brought back online this week, Colonial is still limiting operations while it deals with its compromised technology infrastructure. Several researchers and news outlets have identified a relatively new APT group Darkside as the perpetrator of the attack, a self-proclaimed, Robin-Hood-style organization that has publicly stated it will not target certain types of organizations, like non-profits, hospitals, and who supposedly donates some of its ransom to charities.
I’m sorry, what?
In keeping with their own “branding,” Darkside published a statement on their darknet website that reads as a back-handed apology for attacking the pipeline:
We are apolitical, we do not participate in geopolitics, do not need to ties us with a defined goverment (sic) and look for other our motives. Our goals is to make money, and not creating problems for society. From today we introduce moderation and check each company that our partners want to encrypt to avoid social consequences in the future.
https://twitter.com/ddd1ms/status/1391741147001892869
While it might seem encouraging to think there may be hacking groups out there with a code of honor, you should not mistake them for being a champion of the poor, and they state it quite baldly that their goal is to make money. Their avoidance of political targets may be a shrewd attempt at sidestepping attention from governments, especially ones like the US which can afford to focus a lot of heat on groups like Darkside that appear to operate without nation-state backing. Or at least that is what they would have you believe. Is it a smokescreen, or just a front for another state-sponsored cyberattack from our geo-political rivals. Only a truly naΓ―ve group would think that targeting an fuel distribution company in an oil-dependent country like the US wouldn’t have significant social and political ramifications. Also, that semi-apology note didn’t include any decryption keys so, “Sorry, not sorry?”
Image by Pete Linforth from Pixabay