Category: IT News

You’ll have probably read the Forbes 2019 predictions, or the Symantec predictions, or the Malwarebytes, or Webroot, or FireEye… but which ones are the most likely? Which ones are going to cause you and your business the most pain and downtime? We’ve published below a list of what we believe to be the most likely issues a business will face in terms of Cyber Security in 2019.

Remember: there’s no magic mirror or crystal ball we can use to determine what’s going to happen. The best course of action you can take is still preventative. Maintain a secure and regularly patched network, protect your endpoints as well as your perimeter, and make sure you put in some time to train your staff on best practices. Lastly, back your sh*t up. Don’t just save it to “the cloud”. Put a comprehensive Disaster Recovery Plan into action.

Your Disaster Recovery plan should include what you do to replicate your business data, how you recover your business data, how long it takes, and where you’re recovering to. You should test it at least once every few months (if not more). Understand the cost of downtime to your business. If your online backup platform is going to take you 7 days to download the business data and rebuild your server, is that acceptable to you? You already know the answer to that one.

Anyway, we digress! On to our predictions!

High-profile businesses are going to be compromised more regularly

The most recent high-profile company to fall to its knees on their Cyber cleanliness is Marriott and Starwood. But it didn’t stop there. Saks, Lord & Taylor had 5 million records breached. PumpUp lost 6 million records. Sacramento Bee lost 19.5 million. Ticketfly, 27 million. Facebook lost over 87 million (and probably a hell of a lot more) records. 92 million records disappeared out of MyHeritage’s systems, followed by Under Armour losing 150 million records.

Notice a trend? It’s not that there are more records being lost (although, that’s the case and if we were playing Only Connect, I’d have to give a point). It’s that these breaches are happening more and more regularly to business that should be doing a better job at keeping their network secure.

Disaster Recovery is going to become a necessity, not a differentiator

British Airways learned the hard way when its systems fell flat on its arse when a technician allegedly disconnected a power supply at one of their data centres and when reconnected caused a power surge that wiped out their critical infrastructure for over 75,000 passengers.

So keeping in mind human error being at play, what lessons were learned?

• Human error happens regularly
• It can cause widespread issues
• It’s not the only factor that could bring your business down
• You must have a plan of action that lets you recover quickly to avoid your clients walking to your competitor

Some of our clients have already noticed the Disaster Recovery questions working their way into their Client “Supplier Approval Questionnaire” sheets. They’re being made to prove they have DR facilities in place. Not just data backups, but a full blown documented procedure for what to do (and in some cases where to go!).

IoT botnets are coming to an incident near you

We saw a massive increase in MicroTik routers being hacked to work at the behest of coin miners. Without their owners knowledge or permission these miners were able to passively use the resources of the routers to mine coins. Don’t think for a second these hackers are manually looking for devices to compromise. They’re automating it. They’re running a scan on the internet and with minimal effort on their side taking over these devices and using them for their own desires.

The above is simply one example of an Internet of Things device being compromised, and it’s just a slither of what’s to come in the new year. As more hardware goes online, more hardware is left un-patched, and more automated attacks will compromise them.

Hackers have seen the value in avoiding detection

WannaCry and the likes of similar ransomware attacks took advantage of letting the user know they’d been hit, and demanded action from them. The new wave of attacks are going to stay hidden, like that pen at the bottom of your handbag you just know is there.

Crypto-miners can be deployed, data can be sold easily, and hackers know that by lying low on your network over a long time, they’ll get much higher Return on Investment (so to speak).

And don’t get us started on hackers gaining access to your Amazon Alexa or your Google audio devices.

2-Factor-Authentication will finally be deployed ‘as standard’

For the love of all that is IT, please deploy 2FA. Are you running Google Apps? Office 365? Xero? Or any other online service that supports 2FA? Please go and deploy it now. If your IT Support company hasn’t already suggested a plan to deploy it, go and chase them up.

2FA is the easiest way to secure your systems with the most minimal effort but maximum gain. Lost your password? Using your password elsewhere? Yeah, it’s not great, but at least 2FA stops that immediate breach and should hopefully alert you (or you’ll have someone auditing your logs for that kind of thing, right?).

Over the past 48 hours Consider IT have seen numerous reports of a new scam demanding cryptocurrency. Unlike some similar scams which tend to focus on extorting individuals, this new scam advises there is a bomb in your building and to pay $20,000 by the end of the day for it not to explode!

 

Understandably this has caused some concern and waste of emergency services time. The typical content of the email appears as follows – with a unique bitcoin address per email.

 

“There is the explosive device (Hexogen) in the building where your company is located. My recruited person constructed the bomb under my direction. It can be hidden anywhere because of its small size, it can not destroy the structure of the building, but in the case of its detonation there will be many victims.

My man keeps the territory under the control. If he notices any strange behavior, panic  or policemen the device will be exploded.

I can call off my mercenary if you make a transfer. $20’000 is the price for your safety and business. Tansfer it to me in BTC and I warrant that I will withdraw my mercenary and the bomb will not detonate. But do not try to deceive me- my assurance will become valid only after 3 confirms in blockchain network.

 

Here is my BTC address – xxxxxxxxxxxxxxx

 

You have to solve problems with the payment by the end of the workday. If you are late with the transaction the bomb will explode.

Nothing personal, if you don’t send me the bitcoin and a bomb detonates, next time other companies will pay me more bitcoins, because it is not a one-time action.

For security and anonymity ,  I will no longer enter this email account. I check my Bitcoin address every 20 minutes and after receiving the transaction I will order my man to leave your area.

 

If an explosive device blows up and the authorities see this email-

We arent terrorists and do not assume any  responsibility for acts of terrorism in other places.”

There are examples of minor changes in text, such as the material used in the bomb. The Register reports that several American police stations have already issued statements on the hoax – “Police in Chicago, Illinois, Montgomery County, Maryland, San Francisco, California, Los Angeles, California and Washington, DC, among others, have issued similar statements indicating the emailed threat has been distributed nationwide.”

As has the FBI

https://twitter.com/FBI/status/1073355671662456832/

Consider IT have yet to see this hoax sent to a company in the UK, though we expect it won’t be long before they start to surface.

 

On perhaps a lighter note – another recent email scam that has concerned a few of our clients is the ‘sextortion’ scam. In recent years many high profile websites have had their user’s login details leaked – including email and password. These databases became publicly available on the internet and can be used to enumerate authentication against websites, or in this case send mass emails to the leaked victims.

This attack leverages the assumption that people re-use their passwords across different websites and services.

The scammer sends a variation of the following email

“I do know [leaked password here] one of your pass word. Lets get straight to the purpose. You may not know me and you are probably wondering why you are getting this email? There is no one who has compensated me to check you.

 

actually, I placed a software on the adult videos (porno) site and you know what, you visited this web site to have fun (you know what I mean). When you were watching video clips, your internet browser initiated working as a Remote Desktop having a keylogger which provided me with accessibility to your display screen and cam. Right after that, my software collected every one of your contacts from your Messenger, social networks, as well as email . Next I made a video. First part displays the video you were viewing (you’ve got a fine taste rofl), and next part shows the view of your webcam, & its you.

 

You have got two different options. We should explore these types of options in particulars:

 

1st option is to disregard this email message. Consequently, I will send your very own video to every single one of your contacts and also visualize regarding the humiliation that you receive. And likewise in case you are in an affair, just how this will affect?

 

In the second place choice should be to give me $2000. Lets name it as a donation. Subsequently, I will straight away eliminate your videotape. You could carry on with your life like this never took place and you will never hear back again from me.

 

You’ll make the payment by Bitcoin (if you don’t know this, search “how to buy bitcoin” in Google).

 

BTC Address to send to:xxxxxxxxxxxxxxxxx

[CASE sensitive so copy and paste it]

 

In case you are making plans for going to the authorities, look, this email message cannot be traced back to me. I have covered my steps. I am just not looking to ask you for a whole lot, I just like to be compensated.

 

You have one day to pay. I have a special pixel within this e mail, and now I know that you have read through this email message. If I don’t get the BitCoins, I will certainly send your video to all of your contacts including friends and family, coworkers, and so on. Nonetheless, if I do get paid, I will erase the video immediately. If you want evidence, reply Yeah! then I definitely will send out your video recording to your 5 friends. This is the non-negotiable offer thus please do not waste my personal time and yours by replying to this mail.”

Clever, though some clients were understandably concerned upon receiving this email! If you want to check if your password has been leaked you can use Troy Hunt’s Have I been Pwnd? service to check your email address against the exposed databases. Another nice feature is you can also enter your companies domain name to receive a notification should anyone in your company have their password leaked.

 

Researchers say flaws they found in the equipment’s software meant they could create “master keys” that opened the rooms without leaving an activity log.

The F-Secure team said it had worked with the locks’ maker over the past year to create a fix.

The researchers’ attack involves using any ordinary electronic key to the target facility – even one that’s long expired, discarded, or used to access spaces such as a garage or closet. Using information on the key, the researchers are able to create a master key with privileges to open any room in the building. The attack can be performed without being noticed.

https://press.f-secure.com/2018/04/25/f-secure-researchers-master-keys-to-hotels-can-be-created-out-of-thin-air/