Opportunistic agility is running rampant among hackers and scammers.
- McAfee's user base has been seeing an average of 375 new threats per minute during the pandemic.
- Once everyone got situated in their home offices and their company's security teams started taking the appropriate measures, how did the attackers adjust?
- Ransomware on cloud servers, hijack attempts on IoT gadgets and business email compromise (BEC) attacks increased in volume as well as sophistication over the course of Q3 2020.
Credit: McAfee<p>But beyond the many reports that cybercrime has surged, there's been proportionately little talk about how it's changed. Once everyone got situated in their home offices and their company's security teams <a href="https://bigthink.com/technology-innovation/work-from-home-cybersecurity" target="_self">started taking the appropriate measures</a>, how did the attackers adjust?</p> <p>Here are four ways that cybercrime has visibly adapted to the changing conditions of 2020. </p>
Deploying pandemic-related attack strategies<p>One of the notable ways that attacks were especially effective at the start of the pandemic was the manner in which they directly took advantage of the confusion caused by the situation. COVID-19 related phishing emails <a href="https://news.yahoo.com/hackers-cyber-attacks-now-evolving-faster-ever-subex-063924287.html" target="_blank" rel="noopener noreferrer">raised phishing attacks overall by 68 percent</a>. There was also a marked uptick in business email compromise (BEC) attacks, where the criminal masquerades as a legitimate company and attempts to convince the victim that the coronavirus chaos forced them to change their banking details. </p><p>Cybercriminals have adjusted their targeting and tactics to follow the spread of COVID-19, with the spike beginning in Asia before shifting to Europe and the U.S. Now, as people are returning to work, phishing emails and malware have switched gears. Instead of claiming to educate you about the virus, they are disguised as guides to helping workers return safely to the office. </p><p>"What's clear is that hackers are hoping to capitalize on public fear," <a href="https://www.techradar.com/news/how-cybercrime-has-changed-in-the-wake-of-covid-19" target="_blank" rel="noopener noreferrer">says Dr. Alex Tarter</a>, Chief Cyber Consultant and CTO at Thales. "As a global population we have proactively sought out as much information as we can find to help inform our day-to-day lives, but also make us feel safe. Many of instances of cybercrime in the wake of COVID-19 have been designed with this fear in mind." </p><p>In this vein, malware, mobile malware and fileless malware have skyrocketed, using pandemic-related topics to play on people's fears and lure them to malicious URLs. Tarter estimates that half of all COVID-19-related domain names created since December 2019 were set up with the purpose of injecting malware, with many of these domains spoofing content from genuine websites in order to mask their intent.</p>
Aiming at broader targets<p>Another distinct trend is the shift to a broader attack surface. As work moved out of "on-premises" network environments, bad actors have followed us onto the cloud, so cloud-related breaches have increased. Protecting your server isn't sufficient; you need to connect all the dots and cover every connected device, because your cloud-connected printer is the backdoor to your entire organization. </p><p>Cybercriminals have long since woken up to the fact that IoT devices are often the weakest links in any system. IoT-focused attacks have grown in number and in impact, with a <a href="https://news.yahoo.com/hackers-cyber-attacks-now-evolving-faster-ever-subex-063924287.html" target="_blank">46 percent rise</a> in the number of attacks on smart homes, smart enterprises, and control systems that are connected to critical infrastructure.</p>
Taking advantage of urgency and pressure<p>Cybercriminals are taking advantage of the pressure that organizations are under to remain operational by expanding ransomware attacks, which doubled from <a href="https://ciso.economictimes.indiatimes.com/news/cyberattacks-get-more-nuanced-as-covid-drags-on/77816357" target="_blank">200,000 in Q1 2020 to 400,000 in Q2</a>. Health centers are a popular target, because hackers know that they are overwhelmed with critical patients and can't afford the time it will take to resolve the attack, so they are more likely to give in and pay the ransom than struggle to combat and cure it.</p> <p>A few weeks ago in Germany, a patient was unable to receive care when a ransomware attack on Düsseldorf University Hospital disrupted the emergency care unit, forcing them to transfer her to another hospital to receive critical care. <a href="https://www.technologyreview.com/2020/09/18/1008582/a-patient-has-died-after-ransomware-hackers-hit-a-german-hospital/" target="_blank" rel="noopener noreferrer">The patient died</a> during the journey, a cybercrime first. </p>
Credit: Trend Micro<p>New ransomware families are emerging, using more sophisticated, phased attack strategies that are more difficult to rectify. Trend Micro has identified <a href="https://documents.trendmicro.com/assets/rpt/rpt-securing-the-pandemic-disrupted-workplace.pdf" target="_blank">a 36 percent jump</a> in new ransomware families, compared with the same period in 2019. Hackers know that IT and security teams are operating remotely, without access to their usual tools and processes and often without experience in dealing with an attack remotely, which handicaps their ability to resolve it quickly. </p>
Exploiting remote work vulnerabilities<p>Hackers have been quick to respond to the sudden rush to remote working. In the urgency of the moment, many companies implemented <a href="https://neilpatel.com/blog/best-vpn-services/" target="_blank" rel="noopener noreferrer">trusted VPN services</a> for employees working from home, or set up a remote desktop, without configuring them properly, thereby opening the doors to hackers. In March, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) <a href="https://www.us-cert.gov/ncas/alerts/aa20-073a" target="_blank" rel="noopener noreferrer">alerted businesses</a> to elevated risks of VPN abuse.</p> <p>A number of cloud tools are poorly protected. Zoom, for example, has become a lifeline for businesses and schools, but it has serious security vulnerabilities. It's no coincidence that individuals and educational organizations have been the targets of so many cyber attacks during the pandemic; they are (rightly) perceived as the most vulnerable. </p> <p>Shadow IT use rose when employees sent home from the office had no choice but to use their personal laptops for sensitive work-related tasks, but these devices are rarely protected as well as an office computer. </p> <p>Phishing attacks rose in part because many employees switched to work remotely almost overnight, without any training to independently recognize phishing scams. The average employee isn't equipped to deal with them, and at home there's no security team on hand to immediately respond to questions and defuse the threat.</p>
Cybercrime adapted quickly to COVID-19 chaos<p>The coronavirus pandemic increased chaos in the world, and that presented a golden opportunity to malicious actors and hackers of all types. COVID-19 saw cybercrime shift to cynically exploit fears about the pandemic, take advantage of hasty shifts to remote working, attack overstretched critical infrastructure like health industries, and aim at broader targets across organizations. IT teams can't afford to fall behind as the ongoing struggle with cybercrime enters a new phase. </p>
Protect yourself and your personal information at all times on the internet.
- The internet is filled with scammers looking to steal your private information.
- The Better Business Bureau has shared important information on the scams that are currently trending and ways that internet users can avoid them.
- Every internet user should also consider investing in a VPN like Private Internet Access for added safety and security.
Kobe Bryant memorabilia<img type="lazy-image" data-runner-src="https://assets.rebelmouse.io/eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpbWFnZSI6Imh0dHBzOi8vYXNzZXRzLnJibC5tcy8yMjY1MzMyNi9vcmlnaW4uanBnIiwiZXhwaXJlc19hdCI6MTY0OTI3MTA5MX0.UcwY29IgSBGWiDEQ0Myv7zEoNcmwsdMy6-VM_JKO8EA/img.jpg?width=1245&coordinates=0%2C170%2C0%2C102&height=700" id="41fdb" class="rm-shortcode" data-rm-shortcode-id="22ee1af729e48b5baca24d26fb8eca5c" data-rm-shortcode-name="rebelmouse-image" alt="Kobe Bryant" />
Photo: Michael Wa on Flickr / CC BY-NC-SA 2.0<p>Following his untimely death in a helicopter accident in California on January 26, 2020, the Better Business Bureau <a href="https://www.bbb.org/central-georgia/news-events/news-releases/2020/watch-out-for-scams-following-kobe-bryant-tragedy/" target="_blank">issued a warning</a> for fans of NBA icon Kobe Bryant to not "let their mourning cloud their judgment." The BBB wrote that high-profile celebrity deaths often result in phishing scams, sales of fake memorabilia, and the use of clickbait to exploit people and steal their information. The bureau suggests checking the sender's email address before clicking on anything and hovering over all links first to see where they lead. When possible, internet users should do some homework before buying items and sharing account details.</p>
Internet puppies<img type="lazy-image" data-runner-src="https://assets.rebelmouse.io/eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpbWFnZSI6Imh0dHBzOi8vYXNzZXRzLnJibC5tcy8yMjY1MzMyMy9vcmlnaW4uanBnIiwiZXhwaXJlc19hdCI6MTY0ODcwMTQ3NX0.4hizXCy09hoCziEn2LwR3_57CRqEKugXSdD0Iy-2k08/img.jpg?width=980" id="d0fbc" class="rm-shortcode" data-rm-shortcode-id="15b50073d0046a1d10831b0fe4f06072" data-rm-shortcode-name="rebelmouse-image" alt="group of cute puppies" />
Census takers<img type="lazy-image" data-runner-src="https://assets.rebelmouse.io/eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpbWFnZSI6Imh0dHBzOi8vYXNzZXRzLnJibC5tcy8yMjY1MzM1OC9vcmlnaW4uanBnIiwiZXhwaXJlc19hdCI6MTYzMDM5MDEzM30.KiAwS10AxkpN5VO2ZEOy2kukR-VvkhnYtzl9V42khKU/img.jpg?width=1245&coordinates=0%2C415%2C0%2C-2&height=700" id="1a72e" class="rm-shortcode" data-rm-shortcode-id="e6b911b6370c4beb5e6088ffe68836a0" data-rm-shortcode-name="rebelmouse-image" alt="boy and girl looking at a clipboard" />
Gym memberships and weight-loss supplements<img type="lazy-image" data-runner-src="https://assets.rebelmouse.io/eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpbWFnZSI6Imh0dHBzOi8vYXNzZXRzLnJibC5tcy8yMjY1MzMxNC9vcmlnaW4uanBnIiwiZXhwaXJlc19hdCI6MTYzMDUxMTcxNH0.BBc-6u-IvuPobbwxM6WQauCMx2FgUwT7BJtw96z78KE/img.jpg?width=1245&coordinates=0%2C162%2C0%2C163&height=700" id="7bb4c" class="rm-shortcode" data-rm-shortcode-id="f1db11c0b11f8fc5491b05183d36e268" data-rm-shortcode-name="rebelmouse-image" alt="assorted pills and capsules" />
A new report from Bloomberg describes how Chinese subcontractors secretly inserted microchips into servers that wound up in data centers used by nearly 30 American companies.
- A 2015 security test of a server sold by an American company found that someone in the supply chain had successfully embedded a tiny microchip on a motherboard.
- The company that manufactured the compromised motherboard provides servers to hundreds of international clients, including NASA and the Department of Homeland Security.
- U.S. officials linked the hardware attack to a People's Liberation Army unit, though it's unclear what, if anything, hackers have done or to what they have access.
Hardware vs. software attacks<img type="lazy-image" data-runner-src="https://assets.rebelmouse.io/eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpbWFnZSI6Imh0dHBzOi8vYXNzZXRzLnJibC5tcy8xODY5MTA2Ny9vcmlnaW4uanBnIiwiZXhwaXJlc19hdCI6MTYyMjA0NzU5OH0.0WPhdoBtJqiKm6MFdZZWNc2-K_1GZaCwXNTr9FiiTZE/img.jpg?width=980" id="9a81d" class="rm-shortcode" data-rm-shortcode-id="e423402a993b7c338d49bb1227679b9a" data-rm-shortcode-name="rebelmouse-image" />
The size of the implanted microchip.
Tracing the attack<p>The servers sold by Elemental Technologies were assembled by Super Micro Inc., or Supermicro, the world's leading supplier of server motherboards whose customers include NASA and the Department of Homeland Security. Supermicro is based in California but most of its motherboards are manufactured by contractors in China.</p><p>American officials traced the supply chain of the compromised motherboards and identified four Chinese subcontractors that had been building Supermicro motherboards for two years. After monitoring the subcontractors, the officials found that the microchips had been ordered, by bribe or threats, to be implanted on the motherboards by a specialized People's Liberation Army unit.</p><p>"We've been tracking these guys for longer than we'd like to admit," one official told <em>Bloomberg</em>.</p>
American companies deny knowledge of the attack<p>Amazon, Apple and Supermicro have all denied knowledge of the attack or of the investigation.</p><p>"It's untrue that AWS knew about a supply chain compromise, an issue with malicious chips, or hardware modifications when acquiring Elemental," Amazon wrote. Apple said that it's "never found malicious chips, 'hardware manipulations' or vulnerabilities purposely planted in any server." And, perhaps unsurprisingly, the Chinese government didn't acknowledge the attack, stating that "Supply chain safety in cyberspace is an issue of common concern, and China is also a victim."</p><p>Despite the denials, 17 U.S. intelligence officials and company insiders, all of whom remain anonymous, confirmed the attacks to <em>Bloomberg</em>. Read the full report <a href="https://www.bloomberg.com/news/features/2018-10-04/the-big-hack-how-china-used-a-tiny-chip-to-infiltrate-america-s-top-companies" target="_blank">here</a>. </p>
Getting your vote to where it matters can be harder and more corrupt than it should be. Could blockchain technology build a better system and rebuild people's trust?
Anyone who's walked into a voting booth and scratched their preference onto a piece of paper knows the same thing: the voting process suffers from a dire lack of technology. We put a man on the moon in 1969--why are we still voting on paper? Going digital isn't just a matter of convenience, but one of accountability—citizens the world over are increasingly losing trust in the democratic system, from miscounted votes, to denying eligible people the right to vote at all. So just how much can we digitize the act of voting? Perhaps blockchain—a public ledger technology where information is irreversibly recorded—can build a better system. Here, Internet pioneer Brian Behlendorf considers two aspects where blockchain can help, and one where it absolutely can't. Better tech can end voter discrimination at polling stations, and falsely reported totals at the state and national levels, but will we ever be able to vote on our mobile devices from the comfort of a blanket fort? Behlendorf delivers the bad news. Brian Behlendorf is the executive director of Hyperledger; for more info, visit hyperledger.org.
KGB-era "active measures" are still being used by Russian intelligence agencies today, according to experts.