‘Tis the season for tax scams here in the UK, and it’s no surprise to learn that scammers are spamming out fraudulent messages posing as HMRC.
Thankfully, at least some accountants are warning their clients about the danger of falling for a phish.
Bunnie Huang has created a Plausibly Deniable Database.
Most security schemes facilitate the coercive processes of an attacker because they disclose metadata about the secret data, such as the name and size of encrypted files. This allows specific and enforceable demands to be made: “Give us the passwords for these three encrypted files with names A, B and C, or else…”. In other words, security often focuses on protecting the confidentiality of data, but lacks deniability.
A scheme with deniability would make even the existence of secret files difficult to prove. This makes it difficult for an attacker to formulate a coherent demand: “There’s no evidence of undisclosed data. Should we even bother to make threats?” A lack of evidence makes it more difficult to make specific and enforceable demands.
[…]
Precursor is a device we designed to keep secrets, such as passwords, wallets, authentication tokens, contacts and text messages. We also want it to offer plausible deniability in the face of an attacker that has unlimited access to a physical device, including its root keys, and a set of “broadly known to exist” passwords, such as the screen unlock password and the update signing password. We further assume that an attacker can take a full, low-level snapshot of the entire contents of the FLASH memory, including memory marked as reserved or erased. Finally, we assume that a device, in the worst case, may be subject to repeated, intrusive inspections of this nature.
We created the PDDB (Plausibly Deniable DataBase) to address this threat scenario. The PDDB aims to offer users a real option to plausibly deny the existence of secret data on a Precursor device. This option is strongest in the case of a single inspection. If a device is expected to withstand repeated inspections by the same attacker, then the user has to make a choice between performance and deniability. A “small” set of secrets (relative to the entire disk size, on Precursor that would be 8MiB out of 100MiB total size) can be deniable without a performance impact, but if larger (e.g. 80MiB out of 100MiB total size) sets of secrets must be kept, then archived data needs to be turned over frequently, to foil ciphertext comparison attacks between disk imaging events.
I have been thinking about this sort of thing for many, many years. (Here’s my analysis of one such system.) I have come to realize that the threat model isn’t as simple as Bunnie describes. The goal is to prevent “rubber-hose cryptanalysis,” simply beating the encryption key out of someone. But while a deniable database or file system allows the person to plausibly say that there are no more keys to beat out of them, the perpetrators can never be sure. The value of a normal, undeniable encryption system is that the perpetrators will know when they can stop beating the person — the person can undeniably say that there are no more keys left to reveal.
Bridge cryptocurrency hack follows bridge cryptocurrency hack follows bridge cryptocurrency hack.
The evolution of cyber threats and the confluence of new systems and legacy systems are biggest challenges, according to a panel of CISOs
This blog was written by an independent guest blogger.
Cybersecurity is among the most critical issues facing financial institutions today. Cyberthreats have been on the rise over recent years at the same time digital banking has gained popularity among consumers. Banks that want to meet demand without compromising safety must overcome several key security challenges.
Since the onset of the COVID-19 pandemic in 2020, remote work is no longer the exception but the rule. While many financial institutions had to move to remote work arrangements out of necessity, employees are staying home out of preference. Surveys from late 2021 indicate that 37% of people want to continue working fully remote even after the pandemic. Another 54% said they want a hybrid arrangement, split between remote work and office hours.
Banks need to consider their employees’ needs and best interests, but remote work does require some extra cybersecurity measures. People working from home, coffee shops or elsewhere lack the protection of an office’s physical cybersecurity defenses.
Phishing attacks have been a favorite tool for cybercriminals recently. Mobile phishing attacks surged by a shocking 161% from 2020 to 2021. They use disguised emails or domains to trick individuals into downloading malware or giving away personal information, which is known as credential phishing.
Employees and customers are at risk of phishing when it comes to digital banking. Cybercriminals may send emails disguised as official bank correspondence to customers, which can prove effective for stealing financial information. Likewise, employees must be on the lookout for phishing that seeks login credentials to access customer information.
Malware and ransomware have been among the most dangerous threats across all industries over the last couple of years. In-depth studies by INTERPOL found that the COVID-19 pandemic sparked a 36% increase in malware and ransomware attacks, a surge second only to that of phishing. These attacks are becoming more common and advanced. During the pandemic, the percentage of cyberattacks using previously unseen tactics has increased from 20%-35%.
Organizations have begun using next-gen cybersecurity tactics to defend against these advanced threats. Behavioral analysis, AI and machine learning are becoming increasingly common cybersecurity tools. Digital banking must also evolve, incorporating cutting-edge technologies to stay ahead of cyber criminals’ innovations.
Customer behavior can put data at risk just as much as employee behavior can, if not more. Poor cybersecurity practices from digital banking customers can compromise their information in seconds. Everything from reusing passwords to opening suspicious emails can quickly result in losing sensitive financial data. In fact, one of the biggest challenges in digital banking today is implementing cybersecurity at scale, covering millions of phones, tablets and computers.
There are a few ways digital banking organizations can prevent breaches due to customer errors. They can use well-designed mobile apps with a streamlined user experience and built-in security functions. A user might utilize the fingerprint scanner on their phone or another multifactor authentication method to access their account. Sending out regular correspondence on the importance of good security practices is another way to encourage customers to be careful with their banking data.
Spoofing is similar to phishing but often more complex. There are a few main types of spoofing attacks, all utilizing some form of impersonation. Domain spoofing consists of creating a fraudulent version of an actual domain meant to trick users into giving away login credentials and personal information. This tactic bets on the likelihood that people will not look closely if a website appears to be legitimate.
Similarly, a hacker could “spoof” a financial institution’s phone number to call or text customers. The bank’s correct caller ID will show up on the customer’s phone, making it difficult for customers to tell if it is a legitimate message or not. Even if people do not fall for spoofing attacks, digital banking organizations need to keep an eye out for them since they can decrease customer trust.
Fraud and identity theft has skyrocketed over recent years. The Federal Trade Commission received nearly 1.4 million reports of identity theft in 2020, which was approximately a 213% increase from 2019. These attacks are not new to financial institutions, but they are evolving with cybercrime. Now fraud and identity theft can be conducted through other cyberattack channels, and digital tactics may make it more difficult to detect.
Digital banking organizations must implement cybersecurity strategies that actively search for suspicious account activity to fight these attacks on the virtual front. This is one of the surest ways to catch fraud attempts. For example, a user attempting to buy something from an unusual location could indicate their information has been stolen, and a cybercriminal is utilizing it.
Cyberattacks are becoming more common and sophisticated every year. More consumers are turning to the internet for everything from shopping to paying their bills, so digital banking organizations must take their security to the next level. Protecting customers is no longer as simple as complex passwords. Financial institutions need to remain at the forefront of cybersecurity innovations in today’s digital banking environment. That way, they can stay ahead of cybercrime and stop breaches before they happen.
Who’s wearing the pyjamas while they take down North Korea’s internet? Is it a case of cop or cosplay in Oregon? And what’s to fear about the metaverse?
All this and much more is discussed in the latest edition of the award-winning “Smashing Security” podcast by computer security veterans Graham Cluley and Carole Theriault, joined this week by The Cyberwire’s Dave Bittner.
I had a lovely chat with one of my favorite CISOs the other day, helping them think through the security metrics that they report upwards. Front and center, as I see in almost every security metrics presentation, was a pair of my least favorite monthly measurements: average age of open vulnerabilities, and total open vulnerabilities.
I don’t hate a lot of things—okay, actually, I might actually hate a lot of things, but very few things top the professional hatred I have for vulnerability metrics reporting. At best, they are a measurement of activity, not of effectiveness. They remind me of the old firewall reports (“Look at how many port scans we stopped!”), which I’ll admit I had a special loathing for because security teams would block their web teams from using a content delivery network (CDN) simply because they would lose this report. [Disclosure: I used to be CISO at Akamai.]
The sentencing of Haiteng Wu on February 2, 2022, for his participation in a three-plus-year conspiracy to defraud Apple out of just over $1.5 million shines the light on criminals who operate in the margins of warranty fulfillment of consumer products, such as the iPhone. All in, the criminals were able to garner 2,500 new iPhones for subsequent resale and had attempted to acquire 600 more but failed due to Apple quality control rejecting the warranty submission.
Wu graduated from the master’s program at Virginia Tech in 2015. He secured a position as an architectural engineer shortly thereafter. He also embarked on creating, evolving and growing a criminal enterprise that netted him $987,000, allowing him to pay cash for two condos (McLean and Arlington, Virginia).
