FFT news digest — 5 August 2022
FFT news digest — 5 August 2022
Ransomware
We should accept that ransomware will never be eliminated, so combatting it requires concrete measures. That’s according to an Atlantic Council report based on interviews with policymakers, technologists and law enforcement. Behind the Rise of Ransomware reckons there needs to be a crackdown on the use of cryptocurrency schemes to enable profits to be realised from ransomware attacks. It also suggests that incentives are required to help small and medium-sized organisations (SMBs) improve their information security. The report is focused on the US but its recommendations have wide applicability. There are three key themes; - Since the majority of attacks target SMBs which can’t afford expensive cybersecurity programs, there should be tax reliefs designed to encourage them to implement security best practices. - SMBs should also be offered tax credits in return for hiring or retaining cybersecurity employees. - It should be mandatory to report all ransomware incidents. Ransomware continues to be a ridiculously widespread issue. Recent victims include a European missile manufacturer , a German chipmaker , a Luxembourg energy company , the Toronto Symphony Orchestra and a UK secondary school . But the European cybersecurity agency, ENISA, says publicly reported incidents are “only the tip of the iceberg.” The complete picture “is impossible to capture since too many organisations still do not make their incidents public or do not report on them to the relevant authorities,” it adds. Its report urges organisations to take basic precautions, including having an effective backup policy, using security and monitoring software and restricting administrative privileges. The UK cybersecurity centre has detailed guidance here .
Threats
Countdown : A nasty phishing attack uses a timer and tells victims their account will be deleted when it reaches zero unless they enter their username and password. Cofense Texts : Phishing attacks using SMS (short message service) are on the rise. In the US, some reports estimate consumers received over 12 billion “robotexts” in June. Federal Communications Commission PayPal : Great example of highly persuasive scam masquerading as a warning about an “unlawful” $1,000 PayPal charge. One of the reasons it’s so persuasive is that it exploits PayPal’s business invoicing feature so the scam email not only looks like it comes from PayPal, it actually does. Play Store : The latest episode in our ’Don’t Trust the Play Store” series; Google has removed 17 malicious apps designed to steal financial information. It really is essential to be careful about what apps you install because it’s clear Google can’t keep bad stuff out of its store. Trend Micro Extensions : The same warning applies to browser extensions. North Korean hackers have been spotted using malicious extensions to spy on Chromium-based browsers. Volexity On display : Cameras are ubiquitous, so if a password is stuck on a wall or a display, sooner or later it will turn up in a photo or video. The latest example comes courtesy of the BBC’s Countryfile programme but it’s OK, it was only on a computer display at the UK’s nuclear site at Sellafield. Simon Grundy
Spying
The head of Greece’s intelligence service has admitted using surveillance software to spy on the cellphone of a financial journalist working for CNN Greece. The admission, reported by Reuters, came at a closed-door parliamentary committee hearing that was set up after an opposition party leader complained an attempt had also been made to use spyware against him. The Greek government has denied deploying spyware, but there’s increasing evidence of widespread use of such tools in Europe. The journalist at the centre of the Greek case has worked on investigative reports but says he’s baffled as to why he was targeted. We’d suggest it may be because of who he knows, not what he knows.
Bypassing MFA
Criminals are increasingly using sophisticated techniques to defeat common forms of multi-factor authentication. The so-called adversary-in-the-middle (AitM) technique works by hijacking the authentication process in a way that’s invisible to the user. Last month, Microsoft warned about a similar campaign that had targeted over 10,000 organisations since last September. Now, Zscaler says another set of attacks that began in June is sending emails containing fake invoices designed to obtain user credentials. Hardware security keys are immune to this type of attack but the most important defence is for users to be wary of emails that connect to a page asking for credentials.
In brief
Crypto : A cryptocurrency bridge called Nomad was hacked and lost $200 million, amounting to almost all of its funds (a bridge enables crypto tokens to be traded between different platforms). Even worse, a recent security audit of the bridge identified 40 issues, and one of them may have been involved in the attack. Security Week Child porn: Hacked social media accounts are being used to post “indecent images of children,” according to the UK cybercrime centre, Action Fraud . Another very good reason to ensure accounts are protected with multiple-factor authentication whenever possible. Twitter : Governments around the world have made a record number of demands for access to Twitter content, the company says . “We’re seeing governments become more aggressive in how they try to use legal tactics to unmask the people using our service,” it said. Managing devices : A salutary warning from one Twitter user whose company issued a MacBook to an employee who was then made redundant and refused to unlock the device. Mobile Device Management is your friend.