A Covid Consequence? Cybercriminals Grow in Sophistication, Organization
December 23, 2021
Prompted by a recent report, an article at BetaNews draws a conclusion that seems like old news to us: “Identity Fraud Gets More Sophisticated, Pointing to Organized Crime Involvement.” Writer Ian Barker tells us:
“In the last year, 47 percent of all identity document fraud was classed as ‘medium’ sophisticated, a 57 percent increase over the previous 12 months. A report from identity verification and authentication company Onfido says this points to organized groups attempting to create ‘verified’ accounts with fake documents before using them to embark on other types of fraud.”
See the write-up for more numbers that show identity theft expanding during the pandemic. But yes, much online crime is well organized. In fact, as ThreatPost reports, they even have their own justice system: “When Scammers Get Scammed, They Take It to Cybercrime Court.” When one bad actor breaks a contract or fails to pay another bad actor, the complainant can appeal to a justice system built into any number of underground forums. Instead of time served, those found guilty of wrongdoing pay with their reputations. And fines, hefty fines—as much as $20 million. Reporter Becky Bracken cites a recent report from cybersecurity firm Analyst1 as she writes:
“‘The plaintiff will submit qualified evidence, including any chat logs, screenshots, crypto currency transactions, and similar relevant information,’ the report explained. The defendant then can present their side of the claim, followed by a ‘cross examination’ by the assigned arbiter, who is typically one of the forum operators or administrators, Analyst1 added. ‘Like in real litigation processes, the trial can end with different verdicts,’ the report said. ‘In a case that the defendant is innocent or there is not enough material for a hearing, the case will be closed with no money or currency exchanging hands.’ Failure to comply with the verdict will lead to the cybercriminal getting banned from the forum, the researchers said.”
The article goes on to detail a few noteworthy cases, so navigate there for those details. To be sure, organized online crime is “organized” much like the Godfather films explain.
Cynthia Murrell, December 23, 2021
DarkCyber for December 14, 2021, Now Available
December 14, 2021
The December 14, 2021, Dark Cyber video news program is now available on the Beyond Search Web log and YouTube at this link.
Program number 25 for 2021 includes five stories.
The first is that a list of companies engaged in surveillance technology and specialized software for law enforcement and intelligence professionals is available without charge. The list is not comprehensive, but it is one of the first open source documents which identifies companies operating “off the radar” of many analysts, law enforcement professionals, private detectives, and would-be investigative journalists.
The second story adds another chapter to the chronicle of missteps by a company doing business as NSO Group. The Israel company develops and licenses specialized software to government agencies. However, the use of that software has become problematic. This edition of Dark Cyber reports about the alleged use of the Pegasus mobile phone data collection system to obtain information from US diplomats’ mobile devices. The consequences of MBA thinking have roiled the specialized services market worldwide.
The third story extracts pricing information made public by the Brennan Center. The documents obtained via a FOIA request to California were prepared by the Los Angeles Police Department. Although redacted, the documents contained what appears to be trade secret pricing information about the Voyager Labs’ surveillance data analytics system marketed worldwide. The Dark Cyber story reveals how to download the document
collection and additional details about a very low profile company’s technology and methods.
The fourth story describes new digital cameras which are the size of a grain of salt. Dark Cyber then reveals that
a small roll up drone has been developed. The form factor is similar to a seed which spins as it floats to the
ground. Combining the miniature cameras with the seed-like phone factor creates opportunities for a new approach to video surveillance.
The final story announces a new Dark Cyber service. The weekly Instagram post will provide specific information about Web sites now used by law enforcement, analysts, and intelligence professionals to gather data about persons of interests, the social media activities, their location, and other high-value facts. The new service goes live in January 2022.
Dark Cyber is produced by Stephen E Arnold, who publishes the Web log called Beyond Search and available at this link.
Kenny Toth, December 14, 2021
Rising Cyber Crimes Mean High Prevention Costs
December 13, 2021
The COVID-19 pandemic forced organizations to institute remote work. Many organizations were not prepared, because they lacked secure networks and other necessary security measures to prevent cyber crimes. It is not surprising when Read Write explains in “Lessons Learned From The Skyrocketing Cost Of Cyber Crime” are loss of revenue, obvious preventable issues, and that cyber security and cyber crimes are burgeoning industries.
The pandemic spurred a rise in cyber crime, especially in ransomware, phishing, malware, island hopping, and hyper-targeted nation state attacks. (Does spreading of misinformation count as a cyber crime?). Cloud computing company Iomart recorded that data breaches rose by 273% in the first quarter of 2020 compared to 2019. Cyber crime cost the US an estimated $3.5 billion and the UK $1.8 billion, but it could be more as many crimes are unnoticed.
The cost of cyber crimes are projected to rise exponentially and cause more economic damage than natural disasters. It is important that organizations take preventative measures:
“With all the realistic threats that lurk in the digital space, it’s imperative for companies to deploy best practices in cybersecurity to protect their data and other digital assets. Plus, companies need to do everything they can to avoid the burdensome financial costs associated with cybercrime. While we can’t always prevent cyber attacks, we can learn from them and apply tangible steps to protect ourselves and our businesses.”
Good cyber security practices include implementing and enforcing identification, robust encryption policies, strong data hygiene, patch management programs, using blockchain and crypto currency solutions, and use traditional measures like firewalls, antivirus software, and anti-spyware.
Whitney Grace, December 13, 2021
Heads Up, Dark Overlord: Annoying the FBI May Not Be a Great Idea
November 19, 2021
Well this is embarrassing. The New York Post reports, “FBI Server Hacked, Spam Emails Sent to Over 100,000 People.” Writer Patrick Reilly tells us:
“The FBI’s email server was apparently hacked on Friday night to send threatening spam emails to over 100,000 people, the agency said. Authorities have not determined the sender or motive behind the rambling, incoherent emails, filled with technological nonsense. The emails warned receivers that their information may be under attack by Vinny Troia, famous hacker and owner of cybersecurity company Night Lion Security, in connection with notorious cybersecurity group TheDarkOverlord. The FBI confirmed the incident on Saturday, but said the hacked systems were ‘taken offline quickly,’ after it had been reported. ‘The FBI and CISA are aware of the incident this morning involving fake emails from an @ic.fbi.gov email account,’ the agency said in a statement. ‘This is an ongoing situation and we are not able to provide any additional information at this time. The impacted hardware was taken offline quickly upon discovery of the issue. We continue to encourage the public to be cautious of unknown senders and urge you to report suspicious activity ic3.gov or cisa.gov.’”
First reported by European nonprofit the Spamhaus Project, the emails came from an FBI server. Readers may recall TheDarkOverlord stole Netflix videos in 2017 and released them online as torrents after the streaming platform refused to pay the ransom. A year before that, the same outfit stole patient information (though, thankfully, not medical records) from three medical databases. Those groups also refused to give in to demands, so the hacker(s) sold the data from hundreds of thousands of patients on the Dark Web. If this attack is indeed the work of TheDarkOverlord, we wonder what the outfit expects will happen when annoying a quite capable entity. I have an anecdote for my lectures. That’s a plus for me.
Cynthia Murrell November 19, 2021
DarkCyber for November 16, 2021, Now Available
November 16, 2021
DarkCyber, Program 23, is now available at this link. The mid-November 2021 DarkCyber (Number 23 in the 2021 series) includes six stories.
There are two cyber “bytes”. The first reports about the legal pressure being applied to Signal, a maker of secure messaging software. The second explains that an international team of police arrested more than 100 people in Operation HunTor. Sixty-five of these bad actors resided in the United States.
Malware is tough to stamp out. In fact, Rootkits, a well-known method of compromising targets is returning, is regaining popularity. Plus, bad actors have begun placing malware in computer source code. The targets are unaware that their systems have been compromised. The program provides a link to a report about the Trojan Source method. the US government has blacklisted the NSO Group, a developer of specialized software and systems. What’s interesting is that three other firms have been blacklisted as well. One of the organizations responded to the US action with a sign and indifference. Amazon and Microsoft have learned that their customers/users have been subject to somewhat novel attacks. For Amazon, the Twitch “bit” reward system was used for money laundering. Google ads were used to distribute malware via a old-fashioned spoofed pages which looked legitimate but weren’t.
The drone news in this program reveals that Russia presented more than 200 war fighting technologies at a recent trade show in Lima, Peru. The point DarkCyber makes is that Russia perceives South America as a market ripe for sales. DarkCyber is produced every two weeks by Stephen E Arnold, publisher of the Beyond Search blog at www.arnoldit.com/wordpress and subject matter expert in some interesting technical specialties.
Kenny Toth, November 16, 2021
Encouragement for Bad Actors: Plenty of Targets Guaranteed
November 2, 2021
If the information in the Silicon Valley-esque business news service Venture Beat is accurate, 2022 is going to be a good year for bad actors. “Report: 55% of Execs Say That SolarWinds Hack Hasn’t Affected Software Purchases.” Now “purchase” is a misleading word. Vendors like users to subscribe, so the revenue projections are less fraught. Subscriptions can be tough to terminate, and paying that bill is like a bad habit, easy to fall into, tough to get out of.
The article states:
According to a recent study by Venalfi, more than half of executives (55%) with responsibility for both security and software development reported that the SolarWinds hack has had little or no impact on the concerns they consider when purchasing software products for their company. Additionally, 69% say their company has not increased the number of security questions they are asking software providers about the processes used to assure software security and verify code.
This statement translates to status quo-ism.
The Microsoft products are targets because Microsoft’s yummy software is widely used and is like a 1980s Toys-R-Us filled with new Teddy bears, battery powered trucks, and role-model dolls.
What’s the fix for escalating cyber attacks? Different business policies and more rigorous security procedures.
To sum up, a potentially big year for bad actors, some of whom practice their craft from prison with a contraband smartphone. The Fancy Bear types will be dancing and some of the APT kids will be wallowing in endless chocolate cake.
Digitally speaking, of course.
Stephen E Arnold, November 2, 2021
DarkCyber for November 2, 2021: Spies, Secrets, AI, and a Robot Dog with a Gun
November 2, 2021
The DarkCyber for November 2, 2021 is now available at this link. This program includes six cyber “bites”. These are short items about spies who hide secrets in peanut butter sandwiches, a drug lord who required 500 troops and 22 helicopters to arrest, where to get the Pandora Papers, a once classified document about autonomous killing policies, a US government Web site described as invasive, and a report about the National Security Agency’s contributions to computer science.
The feature in the cyber news program is a look at the Allen Institute’s Ask Delphi system. The smart software serves up answers to ethical questions. The outputs are interesting and provide an indication of the issues that bright AI engineers will have to address.
The final story provides information about a robot dog. The digital canine is equipped with a weapon which fires a cartridge the size of a hot dog at the World Series snack shop. That’s interesting information, but the “killer” feature is that the robot is its own master. Watch DarkCyber to learn the trick this machine can perform.
DarkCyber is produced by Stephen E Arnold. The video contains no advertising and the stories are not subsidized. The video is available at www.arnoldit.com/wordpress or at https://youtu.be/Y24vJetf5eY.
Kenny Toth, November 2, 2021
Rogue in Vogue: What Can Happen When Specialized Software Becomes Available
October 25, 2021
I read “New York Times Journalist Ben Hubbard Hacked with Pegasus after Reporting on Previous Hacking Attempts.” I have no idea if the story is true or recounted accurately. The main point strikes me that a person or group allegedly used the NSO Group tools to compromise the mobile of a journalist.
The article concludes:
Hubbard was repeatedly subjected to targeted hacking with NSO Group’s Pegasus spyware. The hacking took place after the very public reporting in 2020 by Hubbard and the Citizen Lab that he had been a target. The case starkly illustrates the dissonance between NSO Group’s stated concerns for human rights and oversight, and the reality: it appears that no effective steps were taken by the company to prevent the repeated targeting of a prominent American journalist’s phone.
The write up makes clear one point I have commented upon in the past; that is, making specialized software and systems available without meaningful controls creates opportunities for problematic activity.
When specialized technology is developed using expertise and sometimes money and staff of nation states, making these tools widely available means a loss of control.
As access and knowledge of specialized tool systems and methods diffuses, it becomes easier and easier to use specialized technology for purposes for which the innovations were not intended.
Now bad actors, introductory programming classes in many countries, individuals with agendas different from those of their employer, disgruntled software engineers, and probably a couple of old time programmers with a laptop in an elder care facility can:
- Engage in Crime as a Service
- Use a bot to poison data sources
- Access a target’s mobile device
- Conduct surveillance operations
- Embed obfuscated code in open source software components.
If the cited article is not accurate, it provides sufficient information to surface and publicize interesting ideas. If the write up is accurate, the control mechanisms in the countries actively developing and licensing specialized software are not effective in preventing misuse. For cloud services, the controls should be easier to apply.
Is every company, every nation, and every technology savvy individual a rogue? I hope not.
Stephen E Arnold, October 25, 2021
DarkCyber for October 19, 2021: DDoS Takedown, More NSO Group PR, VPN Shift, and Autonomous Kills
October 19, 2021
DarkCyber reports about cyber security, online services, and smart software. You can view this program at this url.
This edition of the program includes four stories:
- The US Department of Justice terminated 15 Internet domains involved in denial of service functions. These offered crime as a service and allowed customers to launch DDoS attacks with minimal technical expertise.
- The NSO Group captured headlines again. The result of revelations in a British legal proceeding resulted in the Israeli specialized services firm firing one of its Middle Eastern clients.
- Roll ups are popular among some financial experts. Aggregation means less competition and greater market reach. Consolidation is underway in the virtual private network sector. Will Kape Technology’s acquisition of Private Internet Access and Express VPN produce benefits for customers?
- The final story explores the most innovative facet of Israel’s alleged autonomous termination of a nuclear scientist. The smart software is just part of the story.
DarkCyber is produced by Stephen E Arnold, publisher of Beyond Search.
Kenny Toth, October 19, 2021
Key Words: Useful Things
October 7, 2021
In the middle of nowhere in the American southwest, lunch time conversation turned to surveillance. I mentioned a couple of characteristics of modern smartphones, butjec people put down their sandwiches. I changed the subject. Later, when a wispy LTE signal permitted, I read “Google Is Giving Data to Police Based on Search Keywords, Court Docs Show.” This is an example of information which I don’t think should be made public.
The write up states:
Court documents showed that Google provided the IP addresses of people who searched for the arson victim’s address, which investigators tied to a phone number belonging to Williams. Police then used the phone number records to pinpoint the location of Williams’ device near the arson, according to court documents.
I want to point out that any string could contain actionable information; to wit:
- The name or abbreviation of a chemical substance
- An address of an entity
- A slang term for a controlled substance
- A specific geographic area or a latitude and longitude designation on a Google map.
With data federation and cross correlation, some specialized software systems can knit together disparate items of information in a useful manner.
The data and the analytic tools are essential for some government activities. Careless release of such sensitive information has unanticipated downstream consequences. Old fashioned secrecy has some upsides in my opinion.
Stephen E Arnold, October 7, 2021
-
- Subscribe to Beyond Search
Feature archive
News archive
-
