Why Cybercrime Is So Hard to Investigate
Date: December 29, 2015Source: Techwire.net
By:
... abuse problems —of some 20 million federal applicants and contractors with top security clearances. The U.S. Office of Personnel Management breach is suspected to be the work of the Chinese in an attempt to gather sensitive details about government employees that could be useful to blackmail them or persuade them to become spies.
At least one San Diego government contractor whose personal information was breached has filed a federal lawsuit in the case, joining several others nationwide.
Hackers also hit an FBI portal that was used for federal and local law enforcement to share key intelligence on cases and suspects. The hack was believed to be perpetrated by the same intruders who got into CIA Director John Brennan’s AOL email account.
Cyber news site E-Commerce Times predicted hot hacker targets for 2016 include fantasy football sites and wearable devices collecting personal health information, such as Fitbit and Apple Watch. The news site also predicted an uptick in use of ransomware, when hackers scramble a company’s system and demand a ransom to unscramble it.
The Human Factor
How do we protect ourselves — and San Diego’s top targets — from cyber attacks, especially when the threat is a click away?
“Twenty to 30 years ago, the bad guy had to breach physical locations and get passwords,” Reed, the cyber squad supervisor, said. “... Now the threat is so passive. Everyday on your computer a new threat is coming at you from email right at your front door, and all you’re doing is clicking on a link and giving the bad guy complete access.”
And as the technology advances at light speed, so do the vulnerabilities.
The intense competition in the technology industry means developers are often trying to roll out new products faster than their competitors, getting it out on the market as quickly as possible — often times at the expense of strong security features, authorities said.
The answer, said security expert Cobb, often lies in tried and true basics.
“A lot of good security is not magic, it’s not rocket science in terms of cutting edge. There are well established practices that if followed incrementally, you increase protection,” he said. “Key elements are use of encryption, anti-malware, strong authentication, good backup and recovery capability and good employee education.”
But, as FBI supervisor Caruthers reminds: “It’s way more expensive for us to defend ourselves than the adversary to conduct the attack.”
“Humans are the weakest link,” Caruthers said.
One of the newest scams that has resulted in millions of dollars in losses to San Diego companies is a technique called “whaling.” It’s similar to “phishing” — trying to gain sensitive information by posing as a trusted source — but goes after the big fish, or top leaders, of a company.
The hacker will usually start by getting into the email account of someone who controls the purse strings in the company, such as a money manager. Then the hacker will do reconnaissance on the leadership, a CEO or top decision-maker.
A typical scenario might go something like this: The CEO posts on his Twitter or social media accounts that he is at a convention in Phoenix that week. He offers other personal information on the web that the hacker can then use to pretend to know him.
The hacker will then send an email through the money manager’s email account that might read like this: “Hi boss, I’m so sorry to bother you at your convention but our customer in Taiwan says they did not get payment and it is very late. Can you wire the payment to the following account so we can get it to them right away .....”
Authorities say it can be easy to fall for such sophisticated attacks, but also said that many businesses that did had failed to follow security protocols.
It’s why experts say it’s so crucial to train everyone in the company on cyber security, from the front desk person to the CEO, rather than just delegate the issue to a select few in the IT department.
Add comment
Email to a Friend
