Tag Archive for: Data Integrity

Data Integrity Attacks: How Cybercriminals Manipulate Rather Than Steal Your Info

You’re rushed to the hospital after a serious car accident. Doing her job, the admitting physician verifies your blood type prior to giving you a life-saving transfusion. But no one knows the hospital’s medical records have been hacked — but not stolen. In this case, your records have been changed, reflecting a blood type that if transfused, would likely kill or seriously harm you. Welcome to the age of data manipulation.

Manipulating data is the latest trend in cybercrime, and it’s on the rise. The most recent study by Ponemon Institute and Accenture warned that attacking data integrity is the “next frontier.” To understand how we got to this point, we need to take a look at the evolution of cybercrime over the past two decades and how hackers seek a variety of hacking outcomes.

An approximate cybercrime timeline

Early on, cybercriminals were mostly looking to restrict access to your data availability, using malware to launch Denial of Service attacks, where legitimate users are kept from accessing a network, information or devices. Their motivation was twofold: to test their hacking tools for larger campaigns and to disrupt business operations of predetermined targets. 

Next, hackers expanded their exploits to steal data out of large databases — such as the Equifax breach that compromised the personal information of 143 million Americans — and sell it for a profit on the dark web. The cybercriminals’ primary motivation was good old fashioned greed. 

Simultaneously, cybercrime expanded into espionage, using malware and other methods to obtain secret files from U.S. defense contractors, including plans for the F-35 jet from Lockheed Martin. 

Then came cyberextortion, like when Sony Pictures was hacked just before it released the anti–Kim Jong-un movie, “The Interview.” At the time, the FBI said North Korea was responsible for the attack, but five years later questions about the perpetrators and motives remain, which just goes to show how hard it is to identify cybercriminals. 

On the heels of cyberextortion came disinformation and influence campaigns, like those used with Brexit and the 2016 U.S. presidential election. 

The point of this brief history lesson is to demonstrate how quickly sinister actors migrate time-tested tools of crime (fraud, extortion, disinformation, etc.) into cyberspace.

Data manipulation is mostly unique to cyberspace

The old fashioned alteration of checks, IDs and airplane tickets aside, data manipulation is a crime that grew exponentially in cyberspace. Former U.S. Cyber Command and NSA head admiral Michael Rogers said his worst-case attack scenario would involve data manipulation “on a massive scale.” 

Despite Rogers’ warning, the U.S. government continues to drag its feet on combating cybercrime, including data manipulation, which is now being discovered only after the fact by security teams. And I’m expecting that data alteration attacks will quickly become one of the most pernicious and undetectable threats for nation-states and corporations around the world. 

To expand on my previous example, it’s no longer just your blood type at risk. It’s the blood type, address and information on the family members of every soldier, spy and diplomat serving the United States. The potential to inflict great harm is enormous.  

Cybercrime is like a virus altering your DNA

Data manipulation is unique among cybercrimes because it’s not about taking the information — it’s about altering the data. The information generally never leaves the owner’s servers, so the criminal raises no red flags that something is amiss. This makes it much harder to catch, and it can be much more destructive. Think maliciously altering flight plans with air traffic controllers, altering bank account balances, or appending your criminal record with fictitious arrests. 

Think of data manipulation as a virus that invades the body and alters its fundamental DNA. The damage is done quietly, and you may never know it happened.

The integrity of our data is at stake

In 2017, a Michigan man hacked the IT system of the Washtenaw County Jail and altered the release date of a friend who was serving a sentence there. The hacker used a social engineering campaign to trick workers at the jail into downloading malware on their computers and was then able to access and change the data. Luckily, staff noticed something was amiss and used paper records to verify the sentence But the scheme cost Washtenaw more than $230,000, and the criminal got access to the personal information of over 1,600 people.

Getting a friend out of jail is one creative use of data manipulation, but there are far more nefarious uses, such as altering operating procedures on nuclear facility instruction manuals, modifying software code in driverless vehicles, and changing the temperature threshold on refrigeration equipment or power turbines. And of course, as we’ve already experienced, altering votes or voter eligibility.

The stock market is another place that’s ripe for data manipulation. As the Wall Street Journal reported last year, 85% of stock market trades happen “on autopilot — controlled by machines, models, or passive investing formulas.” Consequently, if the underlying data that feeds the algorithms is altered by hackers, it could create widespread chaos in the markets and ultimately destabilize the global economy.

The biggest threat may be to the healthcare industry, which has become a prime target in ransomware attacks, and where the effects of data manipulation can be deadly. To underscore this point, researchers in Israel created malware that can add realistic but fake malignant growths to CT or MRI scans before they’re reviewed by doctors or radiologists. Likewise, the malware can remove cancerous nodules or lesions from patients’ scans. 

In April, The Washington Post reported on the malware and revealed that a blind study conducted by researchers at Ben-Gurion University Cyber Security Research Center had devastating results. “In the case of scans with fabricated cancerous nodules, the radiologists diagnosed cancer 99 percent of the time. In cases where the malware removed real cancerous nodules from scans, the radiologists said those patients were healthy 94 percent of the time.”

When it comes to cybercrime, the best defense is a good offense

Because the defense of data integrity is in its early stages, there is very little that organizations can do to defend against manipulation once the cybercriminals have cracked into critical databases. Few organizations possess the tools to accurately detect and eliminate data manipulation, and those tools are more than a year away. 

In the meantime, your solution is to keep criminals out of your data in the first place, using the tools that I talk about in every one of my presentations. When it comes to data integrity, prevention beats recovery every time.

John Sileo is the founder and CEO of The Sileo Group, a cybersecurity think tank, in Lakewood, Colorado, and an award-winning author, keynote speaker and expert on data integrity, cybersecurity and tech/life balance.

Top Cybersecurity Trends 2020 & the Perils of Prediction

 

(i.e., Cybercriminals read the same articles as cybersecurity experts)

Oh how we love to predict the future. Who will win the next Super Bowl, Presidential Election, or Best in Show Pooch-a-thon following the Macy’s Day Parade? I’m frequently asked as a cybersecurity expert to peer into my somewhat cloudy crystal ball and give opinions on what cybersecurity trends the criminals have in store for us. It’s so common at this time of year that I’m thinking of setting up a Fantasy Hacker League to take advantage of our love of betting on things that haven’t yet happened. 

Ironically, cybercriminals read the same predictive articles that we do, but they take notes. And then, innovative as they are, run in the complete opposite direction. Here’s a peek into the cheeto-soaked (that’s a false stereotype by the way – these criminals have PHDs) and highly brilliant minds of organized cybercriminals: “If a CEO is reading this same predictive article on how bad Ransomware is going to be in 2020, and that advice serves as the basis for her decision to over-fund anti-ransomware countermeasures, I, smart hacker that I am, will trade my pick on Ransomware in 2020 and browse the “Insider Theft” section of the cybercrime-gamblers catalog.” 

Unlike football (or dog shows), where the outcome is not influenced by predictions, cyberthreats often become trends because no one has predicted them yet. And by the time they do, the smart criminals have moved onto something new. 

But this isn’t always true, and we still do need to prepare for what is coming, which is why, in the spirit of the season, I can predict with almost perfect accuracy, the Top Cybersecurity Trends for 2020 that will affect the average organization. 

Top Cybersecurity Trends 2020 – The average organization will CONTINUE to…

  • Treat cyber risk as an overwhelming tech puzzle rather than a solvable business issue
  • Fail to budget appropriate funds to train the humans that misuse the technology
  • Give hackers easy access to the crown jewels by allowing pet names as passwords (see graphic)
  • Shut down for weeks or pay the ransom due to system backups that “just won’t restore”
  • Spend inordinate amounts of cash to protect “all the data” instead of “the right data”
  • Lose more data to incompetence, human error and malicious insiders than to hackers
  • Live in a Fantasy League where “something like this” can’t happen to “someone like them”

Why can I predict these and other trends so accurately? Because they have been trending for the past ten years and show no signs of stopping. The good news is that everything in this list is eminently solvable if you dedicate the appropriate time, budget and leadership focus. While you are taking action on the above items, don’t forget to consider the Top 2020 Cybersecurity Trends, Part II.

Top Cybersecurity Trends 2020 (What You Were Actually Looking For)

The Internet of Things and Ransomware Will Get Married. Instead of just freezing an organizations’ computers, ransomware will burrow it’s way into WiFi-connected refrigerators, industrial control systems, operational sensors and monitors, pace-makers, emergency room equipment, traffic lights and anything connected to the internet. It will then freeze the operation of the device and ultimately will demand that you pay a sizeable ransom to (maybe) get your nuclear power plant back online. 

Leading Organizations Will Discover a Centuries-Old Cybersecurity Tool: Going Analog Once information or operational systems are digitized, they are vulnerable to attack by remote forces—including hostile nation states, organized crime and malicious competitors. In other words, when the only method of controlling a system is digital, hackers have a way to assume 100% control. Going analog—introducing human and physical “backstops” into your security supply chain—provides the best defense against network-based remote control takeover. We will see traditional analog systems (paper ballots) increase security in the 2020 Presidential Election, better protect the electric grid (manual on/off switches) and decrease the chance of hacked naval navigation (sextants). 

Data Manipulation Will Challenge Financial Gain For Top Cybercrime Honors 

Data manipulation is unique among cybercrimes because it’s not about taking the information — it’s about altering the data. The information generally never leaves the owner’s servers, so the criminal raises no red flags that something is amiss. This makes it much harder to catch, and it can be much more destructive. Think maliciously altering flight plans with air traffic controllers, altering bank account balances, or appending your criminal record with fictitious arrests. Every one of us takes data integrity for granted, except for cybercriminals, who will use that bias against us. Think of data manipulation as a virus that invades the body and alters its fundamental DNA. The damage is done quietly, and you may never know it happened.

A.I. Won’t Take Over the World, But it Will Follow Malicious Instructions Like a Robot

Right now, artificial intelligence is more human than we think. From my experience peering under the hood of AI-enabled technology like smart TVs, digital assistants and end-point cybersecurity products, I’m constantly amazed by how much human input and monitoring is necessary to make them “smart.” But that is changing as machine learning progresses. We tend to focus on AI taking over the world (thanks to the movies), but it’s not that we need to fear. It’s AI in the hands of would-be dictators and cybercriminals. Fathom, for a moment, Darth Vader, Hitler or a cyberterrorist in charge of an army of robots that always obey their leader’s command. As always, there is the positive side of the technology, and AI will be used to detect malicious attacks and defend the data on which our economy runs. 

To help you get ahead of these topics, I will be writing at length and speaking on all of the above trends (and more) in 2020. Please check back here often, or connect with me to get our latest news on Facebook, Twitter or YouTube. In the meantime, resist the trend to let fear paralyze you in taking action on cybersecurity.  

 


About Cybersecurity Keynote Speaker John Sileo

John Sileo is the founder and CEO of The Sileo Group, a cybersecurity think tank, in Lakewood, Colorado, and an award-winning author, keynote speaker and expert on intentional technology, cybersecurity and data privacy.