Corporate Cyber Security

Microsoft Finds Russian Hackers Attacking Corporate IoT Devices

2019-08-07 by Michelle Dvorak

Microsofts Threat Intelligence Center Reports APT28 aka Fancy Bear is Hacking Common IoT Devices to Breach Corporate IT Networks

Microsoft’s Threat Intelligence Center (MSTIC) reported that Russia’s GRU Military Intelligence Service is using poorly secured Internet of Things (IoT) devices as an entry point to compromise corporate IT networks. The breaches are attributed to a Russian state-sponsored hacking group, APT28. The Advanced Persistent Threat group, also known as Fancy Bear or Strontium, is the hacking group responsible for VPN Filter malware.

The hacking group attempts to compromise and communicate with IoT devices. Three insecure devices, voice-over-IP phones, office printers, and video decoder hardware were successfully hacked at multiple corporate locations. Once access was gained through these low-level devices, APT28 dropped malware that seeks out higher-level access on the network they are connected to.

In the past year, MSTIC sent almost 1400 notifications to companies that were targeted or compromised by Fancy Bear during state-sponsored cyber attacks. Twenty percent of the attacks targeted non-governmental organizations like think tanks and politically affiliated organizations. Eighty percent of Strontium’s attacks targeted governmental organizations, the IT industry, militaries, defense companies, medical sector, educational institutions, and engineering firms. Strontium’s even attacked Olympic organizing committees, anti-doping agencies, and the hospitality industry.

The compromised IoT devices are used to breach corporate networks and seek high-value data or access. Once network access is gained through an insecure device, hackers can scan for other insecure devices and sub-networks. The goal of the attacks is most likely access to higher-level corporate networks, corporate emails, privileged admin accounts, or sensitive data.

According to Microsoft, “After gaining access to each of the IoT devices, the actor ran tcpdump to sniff network traffic on local subnets. They were also seen enumerating administrative groups to attempt further exploitation. As the actor moved from one device to another, they would drop a simple shell script to establish persistence on the network which allowed extended access to continue hunting. Analysis of network traffic showed the devices were also communicating with an external command and control (C2) server.”

What are IoT Devices?

The phrase Internet of Things, called IoT for short, refers to any internet connected device like printers, smartTVs, connected vehicles, printers, appliances, and lighting systems. Basically, IoT devices that make our lives easier or get things done for us. IoT devices are by design, easy to connect to the internet which is also what makes them an appealing target for hackers. Many corporate IT admins may not even know which devices have been brought in by employees and connected to their networks.

The Microsoft post cites that there will be an estimated 50 billion IoT devices in the world by the year 2020. Even now, the number of IoT devices online exceeds the number of personal computers and smartphones combined.

Poorly Secured Devices Make It Easy for Hackers

At least two of the cyber attacks were successful because the device owner did not change the manufacturer’s default password after connecting the device to the internet. A third device was not kept updated with the latest security patches.

Some IoT devices communicate basic telemetry back to the manufacturer or have a connection that allows it to receive software updates. Therefore they maintained, and monitored for suspicious activity.

How to Secure IoT Devices

IoT devices are intentionally easy to connect to networks, making them especially vulnerable to hackers. Often, corporate sysAdmins are unaware a device has been connected to their network by an employee. Advanced Persistent Threat Groups and other hackers can take advantage of vulnerable electronic devices to gain higher-level access to a corporate network.

Require approval to connect all IoT devices to a corporate network
Record the presence of all devices
Limit exposure to critical networks by isolating IoT device access to the internet
Isolate IoT device access to public internet
Use a separate corporate network for connected devices
Monitor IoT device for abnormal activity or communications
Change the manufacturer’s default username and password
Maintain all electronic devices, smartphones, laptops, printers, etc… by keeping them updated with security patches. When possible, allow them to accept security patches automatically

See more cyber security tips on the Microsoft post about Strontium cyber attacks.

Michelle Dvorak

Michelle writes about cyber security, data privacy focusing on social media privacy as well as how to protect your IoT devices. She has worked in internet technology for over 20 years and owns METRONY, LLC. Michelle earned a B.S. in Engineering from Rensselaer Polytechnic Institute. Michelle published a guide to Cyber Security for Business Travelers

www.metrony.com/

UK Opens Investigation into Russian Hacking of Government Communications

2019-07-09 by Michelle Dvorak

British Officials are Investigating Alleged Russian Hacking of Sensitive Diplomatic Communications

UK Suspects Russia Hacked Government Communications. The UK has opened an official investigation probing if Russian hackers are behind the theft of secret British diplomatic communications. The official inquiry into who leaked the cache of sensitive documents initially focused on senior UK politicians and officials but now has turned outward to Russian state-sponsored hackers. Espionage is considered a breach of the UK’s Official Secrets Act and an attempt to destabilize relations.

The hacked memos were written by Sir Kim Darroch, the UK ambassador in Washington. The large cache of stolen and very damaging UK government communications was published by a British journalist, Isabel Oakeshott. She denies that she received them from Russian contacts.

One particularly damaging memo sent by Sir Darroch to senior UK officials painted an unfavorable assessment of US President Donald Trump as his “dysfunctional” White House administration. After the initial investigation into British officials, it is thought that this is an attempt to damage relations between Britain and the United States. The investigation now focuses on Russian hacking attempts who may be motivated to disrupt relations between strong allies.

Britain’s Foreign and Commonwealth Office Permanent Secretary Sir Simon McDonald admitted that “there is clearly significant damage” from the leak and has handed over evidence to police aid in the foreign investigation. He admitted foreign hackers “will be in the scope of the leak inquiry.”

In response to the negative contents of the leaked memos Trump posted on Twitter that the United States will ” no longer deal” with Sir Darroch. The diplomat has been uninvited to an upcoming White House banquet hosted by the White House.

UK Government Hacked by Chinese in 2018

In December 2018 it as discovered that Chinese hackers had compromised the secure communications network of the European Union, known as COREU. Hackers were eavesdropping on sensitive diplomatic communications for several years before the spying was discovered. Cyber security researchers Area 1 discovered the breach and supplied over 1,100 cables were supplied to a news outlet as proof.

The hackers also compromised the communications networks of the United Nations, the American Federation of Labor and Congress of Industrial Organizations (AFL-CIO), ministries of foreign affairs and ministries of finance worldwide, and think tanks in Europe. The sensitive memorandums included conversations with world leaders.

Chinese hackers gained access by IT system belonging to the Ministry of Foreign Affairs of Cyprus. From there they breached COREU where they accessed diplomatic cables relating to a variety of sensitive international matters.

Advanced Persistent Threat Groups

Advanced Persistent Threat Groups (APT) are organized hackers who are highly skilled at compromising and stealing from government targets and large corporations. APT hacking groups are commonly state-sponsored and act on behalf of their government. APT groups are assigned numbers as they are discovered. APT28 and APT29 are Russian hacking groups. They are also given pseudonyms by cyber security researchers so as not to offend governments as researchers publish findings of their hacking work.

Russian APT groups are often given names with the word bear in them. APT28 is also called like Fancy Bear. The United State’s government APT group is referred to as the Equation Group.

Michelle Dvorak

www.metrony.com/

Traveler Photos Hacked in US Customs Data Breach

2019-06-11 by Michelle Dvorak

Traveler Photos Stolen by Hackers in US Customs and Border Protection Data Breach

U.S. Customs and Border Protection (CBP) announced yesterday that hackers stole traveler’s photos used when crossing US land borders from a contractor. The images included photographs of people’s faces. In addition to the personal photographs, vehicle license plate images are also part of the hacked data. U.S. Customs and Border Protection says photos of travelers were stolen when a federal contractor suffered a data breach. CBP did not name the contractor involved in the data breach. However, in the statement issued to news agencies, the subject line read “CBP Perceptics Public Statement.”

What Is Perceptics?

Perceptics, a government contractor purported to be the sole provider of license plate reader technology at U.S. land borders, was hacked. Traveler’s location, license plate images, business documents, and other photos were found on the dark web for anyone to download. Perceptics sells license plate readers, license plate recognition systems, and vehicle identification products to local state, and federal government agencies as well as foreign governments. Its technology is used to monitor privately owned vehicles as they cross into and out of the United States. The company’s technology is installed at all land border crossing lanes between the United States and Canada. It also has license plate readers at border crossings between the United States and Mexico at 43 U.S. Border Patrol checkpoints in California, New Mexico, Arizona, and Texas. Hacked traveler data includes license plate numbers, images, and locations was found on the dark web.

The CBP announcement stated, “Initial information indicates that the subcontractor violated mandatory security and privacy protocols outlined in their contract.” A US official speaking anonymously said that Perceptics was trying to use the photos to refine its algorithms. The goal is to match license plates with the car’s occupants. The data involved travelers crossing the Canadian border. This is not within CBP’s contractual use.

The traveler’s photos were downloaded to a subcontractor’s company network and later hacked in a cyber attack. CBP learned of the breach on May 31. No passport or other travel document photos were compromised. No CBP systems were compromised. The photographs are images taken of people in their vehicles as they entered and exited the United States over land borders and bridges. The number of photographs hacked is believed to be more limited than the rest of the hacked data. This is the second data privacy breach for the federal government this year. In March, the Federal Emergency Management Agency transferred addresses and banking information of over two million U.S. disaster victims with a contractor.

Sen. Ron Wyden (D-Ore.) called for U.S. Customs and Border Protection to notify anyone who was affected by the data breach.

What is Facial Recognition?

Facial recognition is a form of biometrics. Human facial features, like bone structure, are analyzed to real-time scanned image to databases of known persons. Other forms of biometric surveillance include fingerprinting and iris scans. Since it is not practical to surveil large crowd with either, facial recognition is commonly used by governments to identify people quickly.

Facial Recognition Privacy Concerns

Amazon stockholders recently voted to move forward with selling their facial recognition technology, called Amazon Rekognition, to law enforcement and governmental agencies. Both Google and Microsoft have declined to work with facial recognition technology for certain government agencies. Microsoft is in favor of increased government regulation of facial recognition use citing a potential for abuse.

CBP uses cameras and video recordings at airports and land border crossings to capture images of people and vehicles to track people entering and exiting the United States. The Government Accountability Office told the House Committee on Oversight and Reform at a hearing last week that the Federal Bureau of Investigations (FBI) has a database of over 640 million photos from passports and driver’s licenses that it uses for criminal investigations.

CBP has been expanding its use of facial recognition technology and tracking the behaviors of people exiting and entering the United States. Recently it was announced that people requesting a Visa for the United States would have to surrender their social media accounts, previous addresses, and phone number on their Visa applications.

The first facial recognition airport terminal was opened at Hartsfield-Jackson Atlanta International Airport in Atlanta in 2018. International passengers departing from a special Delta airlines terminal could use facial recognition for all security checkpoints after initial check-in was complete. The airport terminal is the first fully biometric airport terminal to operate in the United States. Delta airlines was hit by a data breach in March 2018. In this data privacy breach, a third-party vendor that provides customer service chats was hacked. Credit cards of Delta Airlines customers were stolen. No passport, government IDs, or Delta SkyMiles information was hacked.

The Department of Homeland Security intends to use facial recognition to identify 97% of departing commercial air passengers by 2020. There are no laws preventing it from doing so.

Michelle Dvorak

www.metrony.com/

PornHub and xHamster Cyber Security Penetrated

2017-10-10 by Max

PornHub and xHamster Cyber Security Attack

Porn is a huge industry, “The Internet is for Porn” and all that, but just how large is porn? It’s an industry worth $3 Billion dollars in the United States, and almost $5 Billion dollars worldwide. In 2016 PornHub reported that nearly 3,110 Petabytes of porn was viewed by their users. A Petabyte is a million gigabytes, so in 2016 the internet watched 3,110,000,000 Gigabytes of porn! Millions of people watch porn every day, so if you know somebody they probably watch porn. PornHub is one of the largest pornography websites, but its users were exposed to the Kovter malware via their paid for ads. This attack comes from the KovCoreG group, which is an organization that specializes in attacks that use the Kovter malware program for their attacks. This attack would inform users that they had to install an update to their computer and that landing page actually changed itself based on the user. The install was Kovter in disguise, obviously, and was then installed to the target’s device. If an ad from any website redirects you to a page that tells you to install something, never install it. It doesn’t matter where you are, don’t trust ads that push installs. Don’t trust ads in general if you really want to be safe.

Kovter is part of the ransomware family, one that forces itself into your registry. It’s usually delivered by spamware, email or ads. Knowing how to avoid a phishing attack is an important skill and one you should have if you want to remain safe. Kovter can also include a cover form of malware, where it pretends to be something else like a keystroke logger or something else. This is to help the ransomware code avoid detection and removal.

PornHub isn’t the only website whose users were the targets of a malware attack though, its competitor xHmaster suffered an attack of a different nature. Rather than implanting malware through ads, xHmaster had its user database cracked wide open. Nearly 400,000 users had their account details stolen, which while massive is only ~3% of the total user base. While xHamster claims that its users have no reason to fear because their data is encrypted, online sources are reporting that the encryption MD5 algorithm they use is easy to break open. This attack is similar to attacks that have taken apart other popular adult websites like Brazzers and Ashley Madison. The data that is stolen is then used to extort the websites uses, the attackers threaten to air their dirty laundry to the world.

The problem with hacks like this is that those that are affected may stay silent rather than risk their tastes come to light. Attacks like this can have serious consequences in the real world, the thought of someone going through your browser history is usually enough to give someone a heart attack. Make sure your passwords are strong, they’re your last line of defense against an attack.

Max

Max is a Data Privacy Coordinator at a major global law firm and a science fiction author residing in the Philadelphia area. He has been writing for https://www.askcybersecurity.com since early 2017.

partyfacepress.com/

How to Destroy a Hard Drive

2017-10-09 by Michelle Dvorak

How to Destroy a Hard Drive

Readers frequently search this website for information on how to destroy a hard drive. The destruction of computer hardware and data privacy are a major concern. With recent cyber attacks on Equifax and Yahoo, many online users wonder if it is even possible to protect your own data. They also may wonder if taking precautions to protect personally identifiable data is with the effort. It’s not just a matter of time if you are going to be hacked, but when and how many times each year!

However, regardless of the worrisome and sometimes hopeless statistics on cyber security and hackers, it is still important to do whatever you can to guard your own data. This includes the destruction of hard drives, flash drives, storage devices, and all computer equipment. Computer equipment is a challenge to erase when it comes time for data destruction. There are environmental considerations since the machines can contain contaminants. Another very real question centers around how to REALLY erase the data and preventit from being recovered.

There are a few ways to destroy a hard drive before destroying the device physically, reusing it, selling it or sending it to a recycling center:

Erasing the data with software
Erasing data with magnets
Damaging the hardware in water
Burning the hard drive (we did it with a blowtorch)
Exposing the platters to the air for a period of time
Damaging the hard drive with excessive heat
Drilling into the hardware and the platters
Sanding the surfaces of the data platters
Grinding the surfaces of the data platters
Pound nails into the platters

There are many ways to destroy a hard drive, but one must be sure the data is gone and gone forever. Simply reformatting a hard drive does not guarantee that the data is gone forever. Reformatting just reassigns the data blocks and marks them as available” to the machine. So, an empty data block is not empty at all, it is merely open to overwriting with new data. Until the new data is written over the “erased
data, anything can be recovered.

Software programs are available to destroy data on hard drives too. Many times, these apps reformat the drive, then overwrote the unwanted data with new, random data until the hard drive is full. Some subpar hard drive wiping apps may only rewrite the file directory on the drive. The file directory contains a catalog of the data stored on the platters. It instructs the machine where each block of data is stored. By destroying the onboard directory, the data is uncategorized and “lost.” However, the reality is, any hacker or someone with some inexpensive recovery software can recover the drive and its data.

How Can I Be Sure My Hard Drive Data is Destroyed?

Water doesn’t do a lot of damage to a hard drive unless the platers are spinning. Even then, a quick dip in a bucket isn’t going to guarantee the data is wiped clean.

The best way to be sure the data is wiped clean off a hard drive is to ensure that the platters are not functioning anymore. That means, they cannot spin. If they cannot spin, then a computer cannot read them. One of the easiest ways to do this is to drive something through the hard drive and platters. Try a drill bit (in several places) or go cheap and pound a few nails though the case and platters. To make sure there is no hope, run strong magnets over the platters to get rid of anything left.

Michelle Dvorak

www.metrony.com/

Equifax Cyber Security Chiefs Out!

2017-09-15 by Michelle Dvorak

Equifax Cyber Security Chiefs Out! – Both CIO and CSO Retire

Equifax announced that its Chief Information Officer (CIO) and Chief Security Officer (CSO) have been replaced. Susan Mauldin, who served as Equifax CSO since 2013 and David Webb, who served as CIO since 2010, have both retired their cyber security roles at Equifax. Both retired and were replaced by interim replacements.

Last week, Equifax announced that they had been hacked and that the personal information of about 143 million US citizens had been stolen. One day later they announced that 400,000 UK residents’ personal information had also been stolen in the cyber attack.

The even more incredible news is that the cyber attack occurred over six weeks ago, from mid-May 2017 until the end of July. Cyber security representatives from the company discovered the hack on July 29. Company officials did not report the incident to the public until the first week of September 2017.

During the time from discovery to announcing, three executives sold almost $2 million dollars in Equifax stocks. The stock is trading near its 52-weel low and closed at $92.98 on September 15.

Equifax has a web page that supposedly allows consumers to check and determine if they have been the victim of a cyber security crime. According the TechCrunch the results seem to be arbitrary. Equifax is also offering credit monitoring. Initially signing up for the service automatically revoked a consumers’ right to sue. Now the language has been changed to require consumers to notify them within 300day if they intend to sue Equifax. Our blog post recommends steps to take to protect your credit after the Equifax data breach.

Michelle Dvorak

www.metrony.com/

Kaspersky Under Fire, Again

2017-08-25 by Max

Hacker Kaspersky Under Fire, Again

Kaspersky is once again in the news under the gun from the US Government in response to its ties to Russia. Kaspersky has a well documented history with Russia from the training of it’s staff and its services. They are a popular company that offers performs a variety of anti-hacking duties, including research into upcoming threats. The White House cyber security coordinator, Rob Joyce, has warned people away from using any Kaspersky products however. He went on to state that the US federal government will be not be using them at all, citing Kaspersky’s ties to the Kremlin.

The reasons given for his statement are that as a company based in Russia, they must be influenced by Russian political goals. These goals have been at ends with the United States, so using their products would be unsafe. This is actually not a bad train of thought, especially when it comes to cyber security. A proper virus protection program is very close to malware itself, and it has the ability to cripple any computer it’s installed on. Not trusting a company based in a foreign country is a smart way to shield your government files. Another way to put it would be like this: Your neighbor offer to install locks on all your doors, which is fine because you know him, but if you could install your own locks wouldn’t you rather do that?

Keeping critical cyber security issues like that close to the chest are the cornerstone of an effective defense against hackers and other malicious actors. The federal government has access to several extremely powerful cyber security groups all based in the United States, and it could even use the newly sanctioned USCYBERCOM to create and maintain its security infrastructure.

Adding a level of credibility to Mr. Royce’s statement is the fact that Kaspersky is registered with the FSB, a Russian intelligence agency. The founder, Eugene Kaspersky, worked for the Russian Department of Defense and went a school associated with Russian Intelligence services. The idea of Kaspersky putting a backdoor into their programs for remote access is not as far-fetched as it might sound. Anti-virus programs already have access to your computer’s files without your permission anyway. That’s how the scans and wipes work, the program is looking at every file and path on your machine. This is why you don’t install anti-virus programs from sources you don’t absolutely trust.

Kaspersky has gone on to state that they don’t work for anyone but themselves, and the idea that they’d ruin their credibility by selling out their clients to their own government is ridiculous. For now the US government will continues its ban at the State and Federal level on their software. Until tensions lower between Russia and the United States this level of distrust will continue to be the status quo.

Max

Max is a Data Privacy Coordinator at a major global law firm and a science fiction author residing in the Philadelphia area. He has been writing for https://www.askcybersecurity.com since early 2017.

partyfacepress.com/

Cyber Security News Update 8/22/2017

2017-08-21 by Max

The online world is constantly changing, so let’s dive right in without further a do.

Data Breaches are catastrophic events for all the involve parties. No one, except the attacker, walks away from a data breach smiling. Consumers are placed at risk when their private data is stolen, from outright identity theft to blackmail. Companies get to watch their credibility, customers base and income dwindle away as people abandon ship. This can be extremely disastrous for online only companies or companies whose business model is data security. While CareFirst isn’t an online only company, as a health insurance company they have a lot of critical data on file. The U.S. Court of Appeals for the District of Columbia overturned a lower court’s ruling, and allowed for a class action lawsuit to move forward for the 1 Million people whose data was stolen. This ruling, if it isn’t successfully challenged and overturned, would open up companies to expensive lawsuits from their customers. Previously companies were fairly immune to the financial fallout associated with data breaches, which is why this case is important to follow.
Source: Consumers Gain More Power to Seek Data Breach Damages

“Everyone has a plan until they get punched in the mouth.” Is a well known Mike Tyson quote, and an incredibly apt one for any part of life. It applies in cyber security, where your response plan is your only lifeline. Without rigorous testing you have no way of knowing if your security plan can actually stand up real world threats. Even if it your plan, framework and standards can technically withstand an attack you have to account for the staff who maintain those plans. Maybe someone forgot to initialize a firewall, close an outgoing port or cycle the monthly passwords. The best way to simulate an attack is to launch one against yourself, and this can be done at any level. You can have a purely hypothetical attack where managers and employees are called upon to perform their task under a strict time limit. You could hire a White Hat hacker group to test your security, with or without notifying your employees. Offer a bounty to employees who successfully manage to break the companies defenses in their off time. These sort of drills are what will keep your data safe when someone tries to knock your servers over for real.
Source: The War Room: Experiential Security Planning

The United States unified its special forces under USSOCOM (United States Special Operations COMmand) as a way to cut down on the sort of interdepartmental infighting that costs lives. Cyber security has been under the purview of the USAF (United States Air Force) but now a unified cyber security command is going to be established. Known as USCCOM (United States Cyber COMmand) it will integrate several different branches of cyber security and cyber warfare, including merging notionally civilian agencies such as the CIA and the NSA with combat groups like the USAF and the Department of Defense. This unified command will replace the current system of the NSA coordinating with other groups on projects, with the goal of increasing the effectiveness and efficiency of US cyber warfare.
Source: U.S. Military to Create Separate Unified Cyber Warfare Command

Check in this week for our article on Cyber Warfare: So You Want to be a Cyber Commando?

Max

Max is a Data Privacy Coordinator at a major global law firm and a science fiction author residing in the Philadelphia area. He has been writing for https://www.askcybersecurity.com since early 2017.

partyfacepress.com/

HBO Hacker News

2017-08-18 by Michelle Dvorak

HBO Hacker News Update

Hackers going by the name of “Mr. Smith” delivered a five-minute ransom video to HBO listing demands and repercussions

HBO hacker news continued through the first few weeks of August. HBO was hacked on July 31. Almost 1.5 terabytes of data were taken in a July cyber-attack. Initially, it was believed that the fourth episode of the seventh season Game of Thrones was leaked by the hackers. That report turned out to be false. The episode was not leaked but released prematurely by Star India, HBO’s distribution partner. Instead, the hacker took data that contained emails, employment agreements, and balance sheets, and unreleased scripts from Game of Thrones. The intellectual property theft also included The Deuce, Barry, Room 104, Ballers, Vice Principals and the Steven Spielberg documentary. Portions of the stolen information have been leaked on two separate occasions. A second partial data release occurred on August 8.

Hackers going by the name of “Mr. Smith” delivered a five-minute ransom video for HBO CEO Richard Plepler. The hackers demanded a ransom of $6 million in bitcoin in exchange for the unreleased data. HBO agreed to pay $250k in a show of good faith. This was a stall tactic, however, and HBO so far has paid nothing to recover the hacked data.

The video can be viewed in this Mashable post HBO hacker post

The Mr. Smith hackers end the video by with two possible mottos: “Winter is Coming — HBO is Falling,” or “Winter is Coming — HBO is standing & EverLasting!”

On August 17, HBO Twitter account was hacked along with social media accounts associated with top HBO shows. The responsible group, OurMine, does not appear to be related to the Mr. Smith hackers. OurMine tweeted to HBO’s corporate account, but that tweet was later removed apparently when HBO regained control of the account.

There is still quite a large amount of hacked data and it is not known if and when Mr.’s moth plans on dropping it.

Michelle Dvorak

www.metrony.com/

College ID – The Only Card a Hacker Needs

2017-08-15 by Michelle Dvorak

College ID – The Only Card a Hacker Needs

Like many families, I’m packing up my freshman daughter and sending her to a university this fall. We have been absolutely bombarded with mailings from the college she finally accepted, colleges she has not accepted, student credit card offers, to student loan terms. I swear that her college could lower tuition if they consolidated their mailings to once weekly, or moved say 80% to online notifications.

Another mailer showed up today. I have seen this one before except for a different campus, Temple University in Philadelphia and that campus’s onsite bank, PNC Bank. The mailer attempts to sell students on the merits of opening a bank account. In the case of Villanova, it is a Wells Fargo checking account. Fees waived for students! Yay! Villa students can choose to connect their student ID card, their Wildcard, to their bank account. The Wildcard student ID is used for all things a typical student ID Card is good for – events, building access, and dining hall services. According to the literature, the connected Wildcard can then be used for. This way they can use it as a debit card for PIN transactions. For Temple University students, they can open a PNC account and connect it to their campus student ID card, or “Owl Card.” The Owl Card can then be used at ATMs to withdraw cash.

I both cases, connecting the student ID to a campus bank account is an optional service. Both banks provide a service fee free account to all students.

Should I Connect a Student ID Card to a Campus Bank Account?

Both campus banks provide a free bank account to students and then offer some conveniences. PNC allows students to use an ATM for cash with their connected Owl Card. Villanova students have more options. A connected Wildcat card can be used on and off campus as well as for ATM withdrawals.

A while back I wrote about social engineering as a hacking method. Social engineering means using human interaction to gain pieces of personal data. The ultimate goal of social engineering is to gain access to some higher data, like bank account password or other login information. For example, I want to get to someone’s bank account access, one way is to start by working on access to an email account. Since it’s possible the email is one of the ways to reset the online banking password. Crafty hackers can gain access to an email account find finding your email address on social media accounts.

A campus ID hooked to a bank account affords a plethora of personal data that can be used in a social engineering attack. The student ID has a photo which is used to tell use gender. We can also guess at age based on the photo and the fact that the student is enrolled in college. Next, we know the bank name and student’s name. We can surf social media for the student’s name and get more information – date of birth, email address, hometown, pet’s name, etc… All of these are common password reset questions.

So why connect a bank account to an acceptable form of photo ID? Because it’s too easy to get to more information. Reading the “in case of loss” terms on Wells Fargo’s Wells Fargo web page, applicants can see that in the event of card loss, extra steps are needed. This is because the card is so connected. Students must contact their campus authorities and then contact the bank to get the account shut down.

Michelle Dvorak