Don’t Blame the Victim, Blame the Game: The OFAC’s Misstep in Fining Ransomware Payers

Young male frustrated by ransomware attack on desktop screen.

Ransomware attacks have always been a large issue in the cybersecurity world. The victims of ransomware attacks may also be blamed along with hackers.

The Treasury Department’s Office of Foreign Assets Control (OFAC) recently came out with an advisory stating that those who pay the ransom of a ransomware attack may themselves be subject to fines. While this may sound good on paper, in practice this black-and-white approach to a growing cybersecurity problem can be detrimental to all involved.

Popular in many an action movie, the “we don’t negotiate with terrorists” mantra may be thought of as appropriate dogma to cyberattacks. If one pays a bad actor the demanded ransom, then it incentivizes future attacks on others. If everyone refused to pay these ransoms, the method of attack would no longer be a profitable one, and they would move on to another cybercrime. Of course, in the movies, Harrison Ford always gets his plane back and the girl; companies who are unprepared victims of ransomware are seldom that lucky.

What makes ransomware such an effective method of attack is precisely why paying that ransom is not always a bad idea. For most attacks, the ransom is pennies on the dollar compared to what the cost of a recovery would be. For all the ethical debate about rewarding someone for their crime, the reality is that not doing so may cause the most possible damage to the company or individual attacked. The city of Atlanta is an excellent example.

Atlanta was the victim of the SamSam Ransomware in January of 2018. The requested ransom for this attack was $6,800 to unlock a single computer or $51,000 for all the decrypt keys needed to restore the city’s entire system. This attack was the largest successful cyber attack on a U.S. city in history. The attack affected around six million people, interrupting activities such as paying bills and fines, some court-related processing, as well as several internal systems for the city itself. Atlanta decided not to pay the $6,800 or the $51,000 ransom. They did not reward the bad actors for their bad actions and decided to take on the recovery themselves. To do this, Atlanta initially put in $2.7 million to recover everything, but once their systems were finally set back into place, the actual costs to the city were nearly $10 million. Atlanta didn’t let the bad guys win, but at what cost?

$10 million suddenly stripped from a city’s budget does not just mean the problem was fixed, it meant that they were now short of $10 million originally set for other things like salaries, school budgets, road repairs, etc. What could have been a negligible expense ended up costing millions and impacting the city for years to come. The question is what impact does the OFAC advisory really have on protecting U.S. cities and companies from these types of ransom attacks?

The answer unfortunately is, not much. For one thing, this advisory punishes the victim of the attacks. Instead of having to consider the cost of paying the ransom versus the cost of not, they now have to factor in the ransom plus the fine. This makes for some very fuzzy math. Either the fine is so high that it costs a company more to go through a very expensive recovery phase or the fine plus ransom is still less than the cost of recovery.

If the cost of the fine plus ransom is greater than the cost of recovery, under the government’s guidance all ransomware attacks would be exponentially more expensive for the victims. In many cases, it may actually shut down a company that is unable to pay thousands or millions of dollars to recover.

If the cost of the fine and ransom ends up being less than the cost of recovery, then the government is essentially profiting from ransomware attacks. The fiscally responsible move will still be to pay the ransom, but now the government will get a little cut of every attack. Under this model what is the government’s motive to end such attacks?

In both scenarios, the only party to actually suffer is the victim. The government either profits or keeps the status quo, the hacker either gets paid or doesn’t, same as today. The victim is either forced out of business or put in a financially vulnerable spot by the government or simply must pay a “victim’s tax” for being targeted. This would make for a terrible action movie.

If the OFAC advisory isn’t really an effective way of protecting U.S. businesses and cities from ransomware attacks, then what should the government be doing? The answer is in education.

Being a victim of a ransomware attack isn’t an inevitability. Being put into a situation of having to decide whether to pay is not absolute. With the right internal policies, procedures, and technology in place, being the victim of a ransomware attack is entirely avoidable. But you need to know what policies and procedures to have in place. You need to know what tech is available to protect you. The government should expand itself as a resource to help businesses and cities become aware.

Three ways the government can help with ransomware education are:

  • PSA videos – Create short and informative videos that can be incorporated into any HR department’s cybersecurity employee training program. Videos like these can highlight what to look for to identify a phishing scam, how to keep your personal information safe from being a phishing target, and steps to take the moment an attack is apparent.
  • Cyber training classes – The best way to prevent a ransomware attack is to ensure everyone within a network, be it a municipality or a corporation, is aware of all the suggested cybersecurity policies and best practices, as well as how to identify any potential point of attack. Building off the basic information that can be shared through a PSA, these classes presented by the government could go into much greater detail and provide employees with everything they need.
  • Cybersecurity education in schools – Ransomware and other such malicious cyber attacks will always be a threat. It is the nature of a constantly changing digital world. While keeping employees up to date on the latest threats with PSA Videos and Cyber Training classes is vitality important, we need to address these threats at the root. The best way to achieve this is to instill from a young age the threats and dangers of cyberattacks. Teach students how to look at phishing scams or behavioral vulnerabilities with a focused mind, so that as the next generation of workers enters their various fields, they are less likely to fall prey.

The government’s role is to protect its citizens and companies. Punishing the victim should not be one of its tactics to do so. Though it may be counter-intuitive, sometimes paying off a ransom is the best move to make. The best way to prevent these types of attacks is proper education and actions before they occur. With the government’s support of a comprehensive cybersecurity education program that works with today’s generation of workers as well as the next, it will have much greater success in decreasing successful ransomware attacks in the short and long term.

https://www.cpomagazine.com/cyber-security/dont-blame-the-victim-blame-the-game-the-ofacs-misstep-in-fining-ransomware-payers/

How to Protect Your Supply Chain from Cyberattacks

Chains made of zeros and ones intersect.

Cyberattacks can happen anywhere at any time. Due to the pandemic, the number of cyberattacks companies have been faced with has soared. Hackers are attacking large e-commerce companies since they have been in high demand due to the COVID-19 lockdown.

Supply chains have been stretched to their limits by COVID-19 lockdowns, border closures, and sudden shifts in consumer demands. Now, they’re facing a growing threat from hackers. According to the FBI, cyberattacks have surged by 400% during the pandemic. One of the top targets: supply chains. In 2019, there were around 300 major hacks on supply chains and 2020 is almost certain to exceed that. In a single week this fall, cybercriminals took out shipping giant CMA CGM’s e-commerce systems and hit the International Maritime Organisation with an attack that affected crucial databases.

The fastest-growing threat is ransomware, which encrypts a company’s data until a ransom is paid to the hackers to decode it. In the third quarter of 2020, companies paid an average of $233,817 in ransoms, a 31% increase from the previous quarter, according to security firm Coveware. Supply chains are uniquely vulnerable to cyberattacks because each link in the chain is a potential entry point for hackers. Corporations like Walmart can have 100,000 suppliers, and interact with each to manage orders, delivery schedules, invoices and payments. When a single click on a malicious email link can open the door to a cyberattack, policing such a complex system is an enormous challenge. So, what can be done? Here’s how to keep your supply chain safe and secure.

ASSUME THE WORST

Your organization or suppliers will inevitably be the target of a cyberattack, so plan accordingly. If your company doesn’t have a comprehensive strategy for mitigating threats and dealing with any breaches, creating one must be a priority. The threat from hackers is ubiquitous so your strategy must encompass not only your organization but the suppliers and vendors you deal with. It should run the gamut from the technologies used for endpoint protection, to standards for accessing and handling data, and plans for recovering in the event of a successful attack. The National Institute of Standards and Technology has created standards for supply chain cybersecurity that are an excellent starting point.

FIND OUT WHERE YOUR RISKS ARE

You can’t defend against risks you don’t know about. Conduct a comprehensive audit of each third-party vendor in your supply chain. It’s not enough to look into their software and hardware, you need to know about their information security protocols, processes for patching and updating their systems, how they control physical access to their facilities and digital access to their systems, and what background checks they perform on their employees. Group vendors by their risk level, and prioritize working with the riskiest to secure systems and train staff. Particularly vulnerable equipment may have to be air-gapped from other systems. This is frequently the case for manufacturers that have expensive or difficult-to-replace machinery still operating on outdated systems such as Windows XP.

EMBED CYBERSECURITY THROUGHOUT YOUR BUSINESS

The complexity of supply chains creates an enormous attack surface for hackers. The risks are increasing with greater use of IoT technologies throughout the system. Even WiFi routers, connected thermostats or smart lighting systems in warehouses could present a risk. IT departments lead the charge on ensuring networks are up-to-date with antivirus and malware detection software, and staying current with system patches. But that work can be undone by a careless worker who invites hackers in by falling for a phishing attack. Supply chains are prime targets for phishing scams, which often involve phony invoices that contain viruses or fake wire transfer requests that appear to come from a trusted source. Embedding a culture of cybersecurity awareness throughout your supply chain and regularly training all staff to be vigilant to the threat is essential to keeping systems secure.

Ransomware and other cyberattacks represent real and growing threats to companies throughout the supply chain. Attacks are inevitable, but by putting the correct technologies and procedures in place, companies can mitigate their risks and reduce their chances of costly downtime from a successful hack.

https://www.inboundlogistics.com/cms/article/How-to-Protect-Your-Supply-Chain-from-Cyberattacks/

Uncategorized

Phishing Scam With Fake Invoices Spreads Across US and UK

A malware called Emotet is spreading through the US and UK, specifically targeting banks and financial sectors according to a report published by Menlo Security. Cybercriminals have implemented a malware campaign that spreads via phishing emails, with the attachment of a malicious Microsoft Word document attachment. The email is made to look official through mention of financial topics such as invoices or banking details in the subject line, attracting victims to click on the file. 

Emotet malware use was on the decline back in December 2019, yet began to pick up momentum again early into the new year as cybercriminals use it for new malicious purposes. 

These targeted attacks are meant to disrupt multiple sectors including media/entertainment, transportation, and food/beverage in locations such as the US, UK, Philippines, Spain, and India. Emotet attacks have largely been focused on the financial services sector, with half of these campaign attacks affecting the US and a quarter affecting the UK. 

After a user clicks to download the infected Word file and presses on “enable editing”, embedded macros are deployed onto the victim’s computer, which then successfully transfers the Emotet malware. Once transferred over to the user’s device, Emotet not only steals sensitive information, but can also facilitate the spread of more malware to other computers that use a shared network.  

Emotet can’t be traced to just one source of administration, since its function as a botnet infects Windows computers globally, which then spreads further through those infected devices. 

As Emotet continues to wreak havoc, business employees should take precautionary measures in avoiding any suspicious emails that arrive in their inbox, as documents or any links attached could very well be infected with malware. Users should be cautious of those emails that ask to “enable macros”. Keeping computer operating systems up-to-date is also an important step to take in order to stay safe.

Father’s Day Tech Gift Guide 2019

Finding the perfect gift for Dad this Father’s Day doesn’t have to be a challenge. Our 2019 Father’s Day Tech Gift Guide can help you make the right gift choice he’ll surely appreciate! We’ve compiled a list of tech tools from headphones to smart gadgets Dad will love to use at home or on-the-go!

Check out these cool tech products below! Each product has been linked to make ordering Dad’s gift a breeze. 

Image Source: Amazon

ANKER PowerWave Wireless Charger

Price: $22.79

Does Dad need a power up for his phone? Why not get him the ANKER Wireless Charger stand? With this gift, he can recharge his phone while making sure his phone screen is in clear sight so he’s not missing a message from you.

Image Source: Amazon

DJI Spark Portable Mini Drone

Price: $335.00

Who wouldn’t want to fly a drone? This cool DJI Spark Portable mini drone will allow Dad to take aerial photos and videos and get creative using the products app!

Image Source: Amazon

Sony Alpha a6000 Mirrorless Digital Camera

Price: $498.00

Want to help Dad capture memorable moments? Get him the Sony Alpha Mirrorless Digital Camera to take photos in high resolution and full HD quality.

Image Source: Amazon

Sony Noise Cancelling Headphones WH1000XM3

Price: $298.00

Set aside the Beats and get Dad these Sony Noise Cancelling Headphones to make sure he doesn’t miss one one beat of his favorite music. These headphones are said to have a “virtually soundproof experience”.

Image Source: Amazon

Sennheiser Momentum True Wireless Bluetooth Earbuds

Price: $299.94

Want to get Dad something smaller but just as powerful for listening quality? Check out these Sennheiser Wireless earbuds that promise exceptional clarity in music sound.

Image Source: Amazon

VANKYO Leisure 3 Mini Projector

Price: $89.99

If Dad loves to watch is movies, this Vankyo Mini Projector is the right gift for him. This Father’s Day relax with Dad outdoors or indoors by easily connecting your device to this projector to play all his favorite films.

Image Source: Amazon

Fitbit Ionic Watch

Price: $199.95

If Dad loves to get fit and keep track of it, get him the Fitbit Ionic Watch! The Fitbit Ionic can track your heart rate, activity, and sleep patterns.

Image Source: Amazon

Pocketalk Language Translator Device

Price: $299.00

Does Dad do a lot of travelling? The Pocketalk can help him break down the language barrier. This onscreen device can translate up to 74 languages and offers real-time translation.

Image Source: Amazon

Logitech Keys-to-Go Ultra-Portable, Stand-Alone Keyboard

Price: $45.99

This keyboard is perfect if Dad needs to do a quick type-up with any of his iOS devices. This Bluetooth keyboard is both dirt resistant and portable.

Image Source: Amazon

Echo Show 5 – Compact Smart Display with Alexa

Price: $89.99

If Dad needs a screen assistant, why not get him the Echo Show 5? This device comes with smart home controls, can help Dad stay updated on the latest weather, news, and game reports, and video call you when he can.

Image Source: Amazon

Eufy Smart Scale

Price: $44.99

This scale does more than just measure weight – it can give Dad a full insight on his BMI, Muscle Mass, Bone Mass, and more! He can even keep track of things using Apple Health, Google Fit, or his Fitbit.

Image Source: Amazon

Apple iPad Pro (11-inch, 64GB)

Price: $749

Help Dad get creative with the latest iPad Pro from Apple. With complete Liquid Retina display and a device that allows for multitasking, Dad can get all his work done and still have time to catch the game with you.

Mother’s Day Tech Gift Guide 2019

Mother’s Day is just around the corner and there’s no time to waste in finding Mom that great gift!

Don’t know what to buy her? Don’t fret. We’ve put together a list of awesome tech gadgets your mom will surely love!

Apple AirPods 2

Image Source: Apple

Price: $199

Give mom the gift of great audio quality with Apple’s upgraded AirPods – now faster and longer-lasting with 5 hours of listening time. The earphones come with their own charging case. If you want to make it personal, Apple offers free custom engraving online!

Fitbit Charge 3

Image Source: Fitbit

Price: $119.95

Does your mom like to stay active? Why not get her the Fitbit Charge 3 to track all her fitness activities and goals? The Fitbit Charge 3 comes with a heart rate tracker, swim tracker, GPS tracking with your phone, and guided breathing.

Apple Watch Series 4

Image Source: Apple

Price $349

The Apple Watch is the perfect, stylish gift to give Mom this Mother’s Day. Available in three colors, the Series 4 watch comes with a heart rate sensor that can track and notify its wearer of ian irregular heartbeat. This Apple Watch also comes with the “Hey Siri” feature that will allow Mom to ask for assistance by simply raising her wrist to speak.

Ninja Foodi Pressure Cooker

Image Source: Ninja

Price: $199.99

This air fryer and pressure cooker in one is a great kitchen appliance to surprise Mom with! This appliance allows for quick and easy pressure cooking while also giving a crispy finish with its Crisping Lid.

Neutrogena Skin360™ Skin Scanner

Image Source: Neutrogena

Price: $59.99

Mom is always shining, no matter what she does, but why not help her stay radiant with a little help from the Neutrogena Skin Scanner? This device works by attaching to an iPhone and working with an app that will allow Mom to scan her skin in order to measure pores, fine lines/wrinkles, and skin moisture levels.

Beats Pill+ Portable Speaker

Image Source: Beats

Price: $113.99

Is Mom a music lover? Then the Beats Pill+ is the gift for her! Let pure quality sound fill the air as Mom pairs her device via Bluetooth to the Beats Pill+ .

iHome iCVA66 Vanity Mirror

Image Source: iHome

Price: $199.99

The iHome Vanity Mirror combines tech and beauty in one fabulous device. This mirror comes with built-in Alexa compatibility, bright LED light display, as well as a Bluetooth speaker to allow Mom to listen to her music while she grooms herself. It even comes with a USB port to charge a phone!

Amazon Kindle Paperwhite

Image Source: Amazon

Price: $89.99

Is Mom an avid reader? Why not get her the Amazon Kindle Paperwhite? This Kindle is waterproof, has a glare-resistant display, a built-in adjustable light, and can last weeks with a single battery charge.

Facebook Portal

Image Source: Amazon

Price: $99

The Facebook Portal is a great way to stay connected with your mother when you need to call her on the phone. This device works with a Smart Camera that keeps you in frame as you move around. The Facebook Portal also has Alexa built-in, allowing its user to ask a question, set a timer or reminder, and use the device for other smart-home tasks.

HP Sprocket Portable Photo Printer

Image Source: HP

Price: $99.95

Printing photos in an instant has never been so easy! Give the gift of creating memories with Mom by getting her the HP Sprocket Portable Photo Printer. Using Bluetooth connectivity, Mom can print her photos without hassle, customizing it with the HP app to add fun text, borders, and more.

Ember Temperature Control Ceramic Mug

Image Source: Ember

Price: $70.99

Tea and coffee drinkers rejoice. This Temperature Control mug from Ember allows Mom to remotely adjust the drink of her choice to the ideal temperature setting.

Bellabeat Leaf Urban Smart Jewelry

Image Source: Bellabeat

Price: $115.51

Mom will surely enjoy wearing this tech statement piece from Bellabeat. This necklace is a health tracker that can count the number of steps taken throughout a day, detect calories burned, track stress patterns and more. The necklace can easily be connected to Apple Health or Google Fit.

Philips Wake-Up Light Alarm Clock

Image Source: Philips

Price: $99.95

This light therapy lamp from Philips will help Mom get the beauty rest she deserves. This alarm clock comes with a colored sunrise simulation that can improve sleep and energy levels through its gradual wake light feature.

 

Secret Service Warns of Gas Pump Skimmers This Holiday

Are you planning to get away for the Fourth of July? U.S. Secret Service has warned the public to watch out when using your credit card at the gas stations this holiday.

According to AAA, it’s going to be the busiest and craziest Fourth of July holiday in history. That’s why Secret Service agents from all of their 36 offices will be locating and recovering skimming devices from gas stations in 21 states during the holiday.

Skimmers are devices that detect and retrieve credit card information for the purpose of fraudulent activities. Gas stations are the number one target on prime holidays.

“Because today’s gas pumps are typically unattended, developing suspects and making arrests in skimming cases is difficult – but not impossible,” the agency said in a statement.

The team has recovered more than 70 skimmers when they researched and ran a campaign for the memorial day this year.

Credit card thieves are getting smarter with their strategies, and even experts may be fooled. But there is still a way to catch them.

Read here for tips on how to stay safe this Fourth of July holiday.

Google Calendar Announces its New “Out of Office” Mode

Google calendar is one of the biggest google apps that try to improve for its users. The company announced its new “Out of Office” feature for customizable working hours, as users can now signal their unavailability to others and automatically decline any meetings on their behalf outside of business hours. For example, if you’re scheduling a date for a vacation, you can mark it as “Out Of Office,” and if someone tries to send you an invitation for an event, it will decline the sender’s invite without your involvement. Pretty cool!

Before, users were only able to set working hours over the entire week,, but now–thanks to this new feature– you can have more control over working hours settings by customizing your hours day by day instead of setting it up to the usual 9 to 5.

Google Calendar will attempt to gather your working hours from your past emails and may provoke you to affirm them in the application’s Settings.

The progressions may seem small, but it is part of a bigger movement at Google to promote digital wellbeing across its platforms. The company has introduced a number of features that focus on helping people with time management and device-use cutback.

Google Calendar’s new features have had beneficial effects on the community as a whole. For example, the new time management controls for Android users have a set of screen time tools for parents to use with children. Google even came out with a tool to help YouTube users cut down the time they spend mindlessly watching videos.

Gmail and Google Photos, use machine learning and A.I. to decrease the time spent on our devices and apps by doing things like prioritizing the important mail or automatically editing your photos.

The new Google Calendar tools are taking off now to G Suite users, Google says. Most probably, it will be available for the users very soon. 

you can view the original article Here.

Uncategorized

Apple Bans Cryptocurrency Mining Apps on iOS to Protect Mobile Users

For a time in 2017, “Coinbase” was the #1 application available in the App Store, but Apple is now taking action to stop cryptocurrency on its devices for the sake of keeping users’ devices safe.

The company has set a few rules for developers at the WWDC which states that any apps, including third-party advertisements displayed within them, cannot run unrelated background processes, such as cryptocurrency mining.

Many still wonder if the decision Apple has made makes sense, so Martha Bennett–a principal analyst at Forrester Research–explains:


“Just like with all the cryptocurrency mining utilities you get for PCs (in the shape of apps or browser plug-ins, most of which are malware), they thrash your CPU, and if you’re running on battery, which you almost invariably are on a mobile device, they drain your battery,” Bennett said via email. “Plus, Apple won’t want to be associated with all the shady stuff that’s going on in relation to cryptocurrencies.”


The problem with malware is that siphons CPU is spreading from desktops and mobile devices for the purpose of cryptocurrency mining which is relatively new but has been growing quickly. For example, cryptocurrency mining service “Coinhive” has been known as one of the top spreading malware for its own purpose.

Coinhive” – Monero JavaScript Mining has the ability to hijack a portion of computer power or any device that is used to visit the site. Then, it unwittingly enlists a device to mine Monero cryptocurrency. The practice is known as “cryptojacking.”

A Trend Micro antivirus vendor said, “It’s no surprise that the rise of “Cryptomining” malware has been the reason the rate of cryptocurrency has gone up.”

According to the article, cryptocurrency mining has overtaken ransomware in Northern America in recent years.

“Cryptocurrencies are made through a procedure known as Proof of Work (PoW). PoW powers a PC to extend CPU capacity to solve complex cryptographic-based equations before they’re approved to add data to a blockchain-based, dispersed ledger; those computer nodes that complete the equations condition the fastest are compensated with a portion of digital coins, for example, bitcoin,” as Lucas Mearian of ComputerWorld explains.

Collecting significant cryptocurrencies has turned out to be so popular to the point that the majority of people, including large companies, have set up mining rigs and data centers with a large number of servers for the express motivation behind producing bitcoin or other kinds of cryptocurrencies.

The purchase price of Graphics Processing Units (GPUs) and Application Specific Integrated Circuits (ASICs) has gone up, and many cities have even banned all the mining operations because of the amount of electrical power it uses.

Apple is not the first tech company to take such action in regards to banning cryptocurrency mining. Last April, Google announced that it’ll no longer accept extensions like cryptocurrency mining on its Web Store.

It’s worth mentioning once again that this banning procedure is the best choice, as crypto mining on smartphones is a somewhat unproductive movement in any case; the preparing intensity of this device isn’t sufficient to complete the assignment fast enough to get enough of it. A user’s device would be continuously under load for up to zero rewards, so it is not by any means justified, despite all the trouble over the long haul. Indeed, even work area mining is fading as individuals are understanding that ASICs are the best way to mine proficiently. So it’s for the best that Apple has put a limitation on it so fewer individuals harm their devices.

To view the original article, please click here.