Cyber-Attack

Weiss Rating Firm Rates Bitcoin and gets Hacked

2018-01-25 by Max

Weiss Ratings decided to rate crypto currencies today, which ended up backfiring on them spectacularly. Weiss Ratings gave Bitcoin a “fair C+ due to the high transaction costs, and network bottlenecks causing lengthy delays.” They also rated Ethereum, giving it a solid “B, because it is more easily upgradable and and maintains a higher transaction speed.” Weiss Ratings went on to rate dozens of other crypto currencies, but none of them scored the “A” grade, and only two managed to even score a “B.” Those two crypto currencies were Ethereum and EOS, everything else scored a “C” or less. Weiss is a notoriously hard grader however, and they rarely hand out any kind of “A” grade regardless of what they’re looking at. This may be due to the fact that Weiss doesn’t accept compensation for their grades, so they have no incentive to lie about what they think of an investment option.

In a public statement Weiss noted that leading up the release of their ratings that “The staff was up late last night fending off attacks from Korea.” These attacks were DDoS attacks, which seek to overwhelm a website with traffic. These attacks usually use botnets to generate the critical mass of devices to swamp a website so badly that it goes down for several hours. DDoS attacks are simplistic in their approach, but they can become very complicated and destructive. According to Weiss the DDoS attack was successful and from there the attackers successfully penetrated their website and stole the data that Weiss was planning to release. They didn’t destroy all of it however, though they did start pushing out altered data through Weiss social media channels and other news sites. Weiss stated that they believed these attacks were due to the possible negative ratings that they might have given, and that investors were afraid how those ratings would affect them. Crypto currency exchanges have reported similar DDoS attacks against them, as well as a general increase in traffic in the wake of the attack against Weiss. Whether or not this increase in traffic is explicitly an attack, or just investors trying to bail out, is unclear.

Weiss reportedly uses four metrics to judge a crypto currencies. “Risk, Reward, Technology, Fundamental Aspects of Adoption and Security.” These are good criteria to make an assessment on, and using them it becomes clearer why Bitcoin scored lower then Ethereum. Bitcoin exchanges are hacked into and stolen from frequently, because it possesses the most value. If a hacker can make it into an exchange, and only has a limited amount of time to act, they’re going to take the most expensive coins they can lay their hands on. Even after several crashes, Bitcoin is the most valuable crypto currency by far. Bitcoins volatility would lose it points in the risk and reward categories, because it is risky and its reward is becoming increasingly harder to see. Technologically speaking Bitcoin is struggling with the transaction fees that are required to use it.

Max

Max is a Data Privacy Coordinator at a major global law firm and a science fiction author residing in the Philadelphia area. He has been writing for https://www.askcybersecurity.com since early 2017.

partyfacepress.com/

North Korea Suspected in Bitcoin Hack

2017-12-27 by Michelle Dvorak

North Korea Suspected in Third Bitcoin Hack

North Korea is suspected in a Bitcoin hack according to the Wall Street Journal (WSJ) reports. On December 19, seventeen percent cryptocurrency exchange, Youbit’s digital currencies including some Bitcoin was stolen. Yapian Youbit is based in Seoul, and therefore South Korean law enforcement agency, Korea Internet & Security Agency the state agency is leading the investigation.

Cryptocurrency exchanges are online platforms where users can trade traditional currencies (like USD) for digital currencies like Bitcoin and Ethereum. Cryptocurrency hackers go after the exchanges and wallets (where currency holders store their money online). In hacks millions of untraceable coins are taken and never seen again. Because of the untraceable, decentralized nature of digital currencies, there is no regulation and no insurance. Per the usual worldwide governments have not caught up with regulations to deal with cryptos.

Not the First Cyber Attack for North Korea

North Korea was recently implicated in the 2017 WannaCry malware attack. WannaCry disabled over 300, 000 computers worldwide. WannaCry is a ransomware program that was written from code stolen from the US National Security Agency. The cyber attack primarily affected UK’s National Health System.

In 2017, North Korea is believed to have heisted almost $7 million USD in cryptocurrencies. North Korea is also responsible for cyber attacks against three other South Korean Cryptocurrency exchanges. South Korea accounts for 15 to 25 percent of world Bitcoin trading.

What Cryptocurrencies Exchanges Has North Korea Hacked?

Youbit is the third Bitcoin hack from South Korean cryptocurrency exchanges in 2017. Yapizon, a Bitcoin exchange and Youbit’s predecessor company, was hacked in April. In that theft 36% of Yapizon’s digital currency assets totaling 3816 BTC (worth about $5.3 million USD) was stolen from four its wallets. The Coinis Bitcoin Exchange was also hacked.

Why is North Korea Stealing Bitcoin?

Sanctions against North Korea leader Pyongyang are taking their toll and Pyongyang needs a way to pay for the missile testing and his military. China has reduced their coal trade. The United Nations Security Council increased sanctions against North Korea further reducing oil supplies. With all the sanctions, and a starving population it makes sense that north Korea would train and sponsor hackers who work on behalf of the country. Difficult to trace or completely untraceable currencies, free from centralized government regulation make a good target.

Bitcoin, although unstable in price, is a good bet for North Korean state sponsored hackers. The 3816 BTC stolen back in April when they were valued at $5.3 million are now worth more than ten times that valuation, or about $58.5 million. That’s an incredible return for just eight months.

Youbit allowed its users to withdraw only 75% of their assets. The remainder of their assets may be returned at a later date after the bankruptcy is processed. The Yapian Youbit cryptocurrency exchange filed for bankruptcy

Michelle Dvorak

Michelle writes about cyber security, data privacy focusing on social media privacy as well as how to protect your IoT devices. She She has worked in internet technology for over 20 years and owns METRONY, LLC. Michelle earned a B.S. in Engineering from Rensselaer Polytechnic Institute. Michelle published a guide to Cyber Security for Business Travelers

www.metrony.com/

Deloitte Cyber Attack Affects Few

2017-09-27 by Michelle Dvorak

Deloitte Cyber Attack Affects Few Clients

Deloitte was the latest to announce they had been the victim of a cyber attack. So far, only six of Deloitte’s clients were affected by the hack. However, Deloitte declined to identify them by name or industry.

Deloitte is an accounting, auditing, and financial tax consultancy service firm registered I London but based in New York City. Deloitte also runs a cyber security line of business that investigates data breaches.

Like the recent Equifax breach, the hackers went unnoticed for a significant amount of time before the data breach was discovered. Also like Equifax’s cyber attach, Deloitte decided to announce the cyber attack months later. Deloitte claims the breach was announced only to senior executives due to the sensitivity of the data.

According to a report by the Guardian, Deloitte discovered the cyber attack in March 2017. The accounting firm suspects the cyber attack may have been going on since November 2016 however. It is unknown who the hackers are or who they were working for.

The hacker compromised the firm’s Azure cloud email service by using an administrator’s account. Theoretically, that admin access level allowed the hacker an all-access, unrestricted login to any data. Possible hacked data includes usernames, passwords, IP addresses, architectural diagrams for businesses, security, and design details, and health data. Approximately 5 million emails are on the cloud service and could have been compromised by the hackers.

The admin account required only a single password and did not have “two-step” verification enabled. Two-step verification is an additional layer of security for online account logins. This additional security requires to enter a code sent to a verified smartphone or respond to a verification email sent to a pre-approved email address.

Deloitte opened an internal investigation to try and reconstruct the hacker’s path and establish exactly what information hacker(s) actually accessed.

Michelle Dvorak

www.metrony.com/

HBO Hacked – Game of Thrones Not Part of Cyber Attack

2017-08-06 by Michelle Dvorak

HBO Hacked – Game of Thrones Not Part of Cyber Attack After All

On July 31, hackers took over 1.5 terabytes of data from Home Box Office (HBO) during a cyber attack. Episodes of Ballers and Room 104 were taken during the cyber attack. It was initially believed that an episode of Game of Thrones, the fourth episode of the seventh season, was also stolen. That information later proved to be false. A script of an unaired episode was, however, part of the theft. The FBI is investigating the incident.

HBO did confirm the cyber attack, however, the network did not state what content was taken by the hackers. Cyber security firm IP Echelon sent a notice to search engine Google.com. The notice requested that Google remove links to all leaked or stolen HBO property which includes “thousands of Home Box Office (HBO) internal company documents” and “masses of copyrighted items including documents, images, videos, and sound.” Only an estimated 300 megabytes of the 1.5 terabytes have made it to the Internet,

Other high-profile television network cyber attacks

2017 Netflix and episodes of Orange Is the New Black season five
2014 Sony Pictures lost 200 gigabytes of data including correspondence, and company records

Was Game of Thrones Hacked?

No. Although the fourth episode in season seven of Game of Thrones was indeed leaked online, it was not related to the cyber attack. Star India, HBO’s distribution partner, is responsible for the releasing the episode two days before its scheduled debut. The leaked copy was said to be a low-quality copy.

Photo Credit: HBO

Michelle Dvorak

www.metrony.com/

What Are Social Engineering Attacks?

2017-06-10 by Max

Social Engineering Cyber Attacks

We are all very familiar with the terms computer virus, hacker, and data breach, but there is another form of a cyber-attack, called social engineering. Social engineering in the context of information security is the use of deception to exploit people to acquire sensitive data from them. Another way to social engineer data is to gather it from online accounts such as social media profiles.

What are Social Engineering Cyber Attacks?

Phishing emails, spear phishing, and tailgating are all forms of a social engineering attack. Phishing emails are broad emails that attempt to get something – usually money – from the recipient. In the case of a social engineering phishing attack, the hacker is attempting to get some piece of personal information – like a password – that will be used to access even more accounts.

Spear phishing emails are emails targeted at one or more people. They are like phishing emails but much more focused. The spear phishing appears to originate from a person the recipient knows.

Not all social engineering attacks are especially tech-savvy. Another example is accomplished with a simple phone call. A corporate website can be used to obtain the names and titles of employees. From there, a hacker can place a phone call to get the phone number of a department. In this example, we’ll say the hacker called into the internal IT support department of a major energy supplier. Pretending to be an executive locked out their email, the hacker successfully talked the first line tech support personnel into resetting an email password over the phone! From there, the hacker had email access to an executive. The emails contain information about other accounts the email is used to log into. A few more password resets can yield financial information and sensitive corporate data.

Social media sites like Facebook are easy places to social engineer data. Every Facebook user has an “about” page on their profile. Go to https://www.facebook.com/[USER NAME]/about to see anyone’s data (if they have left it exposed). Surf a few friends’ profiles and you’ll quickly see that some leave valuable information like their full birth date. Other common social data includes hometown, place of birth, and family connections. These are common passwords and hints.

Tailgating is when the hacker follows another person – either in person or online. This may mean the hacker follows a victim into a secure server room, using the same open door. Tailgating may also mean the hacker uses a public computer immediately after an unsuspecting person hoping to access an account that was left logged in.

What Can You Do to Defend Against Social Engineering?

Social data can be picked up in casual conversations, like two employees talking over coffee. With a little prompting, someone can accidentally give out seemingly innocent information like an email address or name.

Install an anti-virus application on your computer. McAfee and Norton AntiVirus are both good packages to try.
Keep computers updated. Be sure to install patches as soon as they are released. Last month’s WannaCry ransomware attack was preventable. Microsoft had already released an update that closed the security hole WannaCry exploited.
Train employees on information security best practices

Max

Max is a Data Privacy Coordinator at a major global law firm and a science fiction author residing in the Philadelphia area. He has been writing for https://www.askcybersecurity.com since early 2017.

partyfacepress.com/

Massive Cyber-Attack Hits Targets Across the Globe

2017-05-12 by Michelle Dvorak

Massive Cyber-Attack Hits Targets Across the Globe

A massive cyber-attack that started today with Britain’s National Health System (NHS) organization has now spread to 74 countries. Affected countries include the UK, US, China, Russia, Ukraine, Spain, Italy and Taiwan. The malware attack is a massive infection of Windows based personal computers. Once infected, the virus locks users out of their own computers. The malware demands $300 (£230) in Bitcoin to return access to the infected computer. The ransom doubles after three days and threatens to erase all data contained on each computer after ten days elapse.

Ransomware is a type of malware that disables computers and demands something –generally money – in exchange for control or access to an IT system. Ransomware does not typically involve data loss. Ransomware can affect individual computers or entire networks.

Malware, also known as a virus, can spread from computer to computer when a user opens an attachment or forwards an infected email. Access to the infected system is restored once the ransom is paid. In the case of Friday’s cyber-attack, the malware is capable of spreading on its own.

NHS reports that no patient data is lost, although no one can access data.

The ransomware has infected computers at European firms such as FedEx, Portugal Telecom, and Megafon, which is a Russian mobile phone network. Russian Interior Ministry computers were the most frequently hit with over 1,000 computers (1%) infected with the malware. Russia reports that they have contained the malware.

British Prime Minister, Theresa May stated, “This is not targeted at the NHS, it’s an international attack and a number of countries and organisations have been affected.”

Spain’s Cybersecurity National Institute (INCIBE) stated late Friday night, that many companies that had lost control of their computers had regained Access. INCIBE did not identify the affected companies.
France’s government cyber security agency, Agence nationale de la sécurité des systèmes d’information (ANSSI) reported that no French computers were infected.

The malware has not spread to the United States.

Windows is an operating system developed by the American company, Microsoft. A patch for the vulnerability was released by Microsoft in March 2017. For unpatched computers, the recommended course of action is to disconnect computers from the internet until patches are installed and the malware is removed.

Microsoft engineers added detection and protection against the malware today and noted that the March patch provides additional protections against the malware.

The perpetrators of the attack are a group known as the Shadow Brokers who have been releasing cyber-attack programs that were stolen from the American National Security Agency’s NSA. The ransomware, Wana Decrypt0r, also known as ‘WannaCryptor’ or ‘WCRY’ is a variant of malware WannaCry and based on the (NSA) hack tool known as Eternal Blue. Many of the NSA’s spyware and hacking tools were stolen by WikiLeaks and posted online in 2016 ago. The name of the Microsoft update that patches this vulnerability is named WannaCrypt.

The Shadow Brokers have been releasing other NSA developed cyber-attack programs for months via file sharing services.

*Image Source: Gillian Hann via Twitter

Michelle Dvorak