Do you know that, if you care to, you can log on to Amazon and, in addition to purchasing your groceries, you can obtain: “The Hacker Playbook—A Practical Guide to Penetration”. Then I stumbled onto an article that described an incredible, worldwide cyber-attack, and realized I know minus zero about cyberspace security or even hacking. I can tell you what hacking causes because almost everyone I know has had their e-mail hacked at one time or another.
How awkward and uncomfortable I felt writing a security-bent Commentary, as I was preparing to purchase a new computer and moving at the same time. My learning curve took a dramatic turn that brought me to a slew of wonderful articles and reports that opened a new world of understanding and, above all else, caution and continuing concern.
In one extensive report, I learned that last year (2017) there was cyberattack on a power grid in the United States, and even though it was horrific in scope and import, it drifted by unnoticed by most of the people I know. It has been claimed that there are those who beyond mere curiosity but with criminal intent, have the ability to shut down all our generated power and throw us into total darkness. And by that I do not mean just the lights in your home but to affect our all aspects of our being from individual and national finance to healthcare and cooking dinner to our basic forms of daily transportation.
The scope of the breach, first reported by the cybersecurity company Symantec in September 2017, revealed much about the way these attacks work. So much was revealed in its report, that the U.S. government turned it into a high valued investigation that produced a 16 page document. A team of cyber specialists from the Department of Homeland Security and Federal Bureau of Investigation placed the hackers’ tradecraft under its investigatory microscope and then disseminated its findings in the hope that the information would help prevent similar attacks – and keep this one attack from generating further chaos.
Experts say cyberspace communication is at a crucially vulnerable time in an age when hackers, whether motivated by disruption or bent on conducting wide scale cyber warfare, are constantly finding ways to infiltrate, corrupt and weaponize whatever touches the internet – often bit by bit. As I type this page I suddenly wonder is there someone looking-in that I am unaware of and what will they do with the information learned.
“It’s important to raise awareness,” said Mark Orlando, chief technology officer for cyber services at Raytheon. “…. details, if taken by themselves, might not seem that impactful. When presented with the entire story, we can see it was part of a larger, sustained campaign, potentially causing a lot of damage.”
The prospective for that type of damage is sweeping, said Constance Douris, who studies cybersecurity for the Lexington Institute, a Washington, D.C. think tank that focuses on defense. She said hacking the power grid is essentially a newer way of attacking a traditional military target. Understand that a power grid is not merely a power vehicle for our individual and business life but constitutes a prime military target by any adversary.
“Everyone understands cyber is important, but they don’t quite understand why it needs to be protected,” she said. “Hospitals, banks, pipelines, military bases – all of these cannot operate without electricity. Protecting the grid from cyberattacks should not be neglected by any means.” Clearly, this is an understatement. Our cyberspace integrity is “crucial” to our national and individual wellbeing. It can be utilized as a silent massive attack against the United States. It is not as dramatic as three planes flying into well-known buildings but clearly and potentially more deadly.
Here’s how the cyber experts broke down the “work” of the hacker – and how businesses and by extension, individuals can protect themselves.
Hackers have the learned that the shortest distance between two points is not necessarily a straight line—thus instead of attacking the largest target (who are, by necessity and self-preservation on the alert) the hacker works his or her way through the “smaller, less secure companies” and networks. Jumping from one network to another and moving to larger networks one at a time. One of the attackers’ main strategies is to divide targets into groups. As one security expert put it: each of us must “manager our own systems and being as vigilant as you can.” And we have read in the press that the hacker can use misleading emails that will deliver malware right into your computer. Be careful of what mail you open, especially if you do not recognize the sender. The hacker knows who they are targeting by collecting as much information and intelligence that is available, so that the email received by the target is both reasonable and believable and therefore more likely to be opened. I recieve emails all the time from institutions with whom I have some business or professional relationship asking me to update information that they should not be requesting. I don’t open those messages. I receive telephone calls from people with far-east accents who tell me that I am having a problem with my computer and they can rectify the issue with a small payment and to allow them access to my computer.
Another method of crawling into your computer with malware is to corrupt a site that you visit often. When you log into that site which has been “altered to contain and reference malicious content,” the government investigation found that you will then be infected with the planted malware. Some refer to these sites as “watering-holes” where the malicious malware codes at planted. Common places are the information sites you generally turn to on a regular basis. As one person said to me: “You can catch a lot of fish that way.” Another method is by stealing the identity of an important member/employee of a target including their usernames and passwords. Here again that is usually accomplished through tricking that person with a false login page of an often utilized site.
The Department of Homeland Security and FBI uncovered yet another method of invading your computer: The hacker sends a document to its target, but it is sent in a manner in which it cannot be downloaded. The bait is to then to inform the target: “if you are having problems downloading this document”, to click “having trouble” — which takes the target to the program that contains the malware. Cleaver and destructive.
If your i-pad and i-phone are connected to your computer they are all invitations to the hacker to invade your world. Cancel those “invitations” with heightened awareness that “anyone” could be a target—anyone. And the results of those invitations can be catastrophic.
Richard Allan,
The Editor
