Whether you're an IT manager protecting employees and corporate systems or you're simply trying to keep your own personal data safe, these threats -- some rapidly growing, others still emerging -- pose a potential risk. Fortunately, there are some security procedures and tools available to help you win the fight against the bad guys.
1. Text-message malware
While smartphone viruses are still fairly rare, text-messaging attacks are becoming more common, according to Rodney Joffe, senior vice president and senior technologist at mobile messaging company Neustar and director of the Conficker Working Group coalition of security researchers. PCs are now fairly well protected, he says, so some black-hat hackers have moved on to mobile devices. Their incentive is mostly financial; text messaging provides a way for them to break in and make money.
Khoi Nguyen, group product manager for mobile security at Symantec, confirmed that text-message attacks aimed at smartphone operating systems are becoming more common as people rely more on mobile devices. It's not just consumers who are at risk from these attacks, he adds. Any employee who falls for a text-message ruse using a company smartphone can jeopardize the business's network and data, and perhaps cause a compliance violation.
"This is a similar type of attack as [is used on] a computer -- an SMS or MMS message that includes an attachment, disguised as a funny or sexy picture, which asks the user to open it," Nguyen explains. "Once they download the picture, it will install malware on the device. Once loaded, it would acquire access privileges, and it spreads through contacts on the phone, [who] would then get a message from that user."
In this way, says Joffe, hackers create botnets for sending text-message spam with links to a product the hacker is selling, usually charging you per message. In some cases, he adds, the malware even starts buying ring tones that are charged on your wireless bill, lining the pocketbook of the hacker selling the ring tones.
Another ruse, says Nguyen, is a text-message link to download an app that supposedly allows free Internet access but is actually a Trojan that sends hundreds of thousands of SMS messages (usually at "premium SMS" rates of $2 each) from the phone.
Wireless carriers say they do try to stave off the attacks. For instance, Verizon spokeswoman Brenda Raney says the company scans for known malware attacks and isolates them on the cellular network, and even engages with federal crime units to block attacks.
Still, as Joffe notes jokingly, there is "no defense against being stupid" or against employee errors. For example, he recounts that he and other security professionals training corporate employees one-on-one about cell phone dangers would send them messages with a fake worm. And right after the training session, he says, many employees would still click the link.
To keep such malware off users' phones, Joffe recommends that businesses institute strict corporate policies limiting whom employees can text using company networks and phones, and what kind of work can be done via text. Another option is a policy that disallows text messaging entirely, at least until the industry figures out how to deal with the threats.
For consumers, common sense is the best defense. Avoid clicking on text-message links or attachments from anyone you don't know, and use extreme caution even with messages from known contacts, who might unwittingly be part of a botnet.
2. Hacking into smart grids
A common misconception is that only an open network -- say, your corporate wireless LAN for visitor access -- is hackable. Not true, says Justin Morehouse, a principal consultant at Stratum Security who spoke about network security at last year's DefCon security conference. Morehouse says it's actually not that difficult to find an access point into a so-called closed system.
For example, the Stuxnet worm last year infected tens of thousands of Windows PCs running Siemens SCADA systems in manufacturing and utility companies, most notably in Iran, and it was largely spread via infected USB flash drives. Even some nuclear plants and power grids have wireless networks for employees to use.
"Stuxnet proved that it is relatively simple to cause potentially catastrophic damage" to an industrial control network, says Neustar's Joffe.
According to Morehouse, another new attack point will be smart grids, which use electronic metering to streamline power management. Utility companies around the world have begun testing and rolling out smart meters to customers' homes and businesses. The technology, which can send data to and receive it from a central system, can also be very helpful for IT: You can open a console to see the power usage for one section of a building, for example.
But smart grids might be vulnerable to attacks that would allow nefarious hackers to cut off electricity to homes and businesses and create other kinds of havoc. One possible attack vector is a smart grid's communications infrastructure. For example, Morehouse says, a German utility company called Yello Strom uses a consumer smart grid system that works like a home automation kit -- the sensors report energy usage back to the central server via the user's home Wi-Fi network.
Because of this, Morehouse says, it is possible for end users to tap into their own networks and gain access to the substation used for delivering power. "Often it's the case that these types of networks are not properly segmented or protected," he says. "Once in, the attacker may be treated as a trusted user and have access to other areas. Is there the potential that they could disrupt the substation or city? Absolutely. They may plant a back door that could allow the grid to be powered down at a particular time."
Utilities in the U.S. tend to use their own proprietary wired or wireless connections to sensors, but Morehouse is concerned that some may follow Yello Strom's example and use home networks instead.
Another concern is vulnerabilities in the smart meters themselves -- a problem that affects corporate smart grids as well. Researchers from Seattle-based security services vendor IOActive, for instance, discovered several bugs in smart grid devices that criminal hackers could exploit to access the smart grid network and cut power to customers.
"Hackers use press releases to find out the technologies [used in corporate smart grids] and go back to the infrastructure and find vulnerabilities. So, for example, if Wal-Mart announces a smart grid using Siemens technology, a hacker suddenly has many of the answers they need to find that controller and break in," Morehouse says.
The most effective preventive measure, says Morehouse, is rigid isolation -- a smart grid should not touch any other network, ever. He says there is an urgent need for penetration testing and making sure the firewall in a closed network is secure because of the possible dangers of gaining access to the power grid. He advises using tools such as Core Impact and Metasploit.
The "rigid isolation" rule applies to home users as well. "Consumers should never bridge smart grid networks with their home networks," says Morehouse. He also advises home users to become familiar with their smart meters so they can recognize whether they have been tampered with, and to ask their utility providers what security measures are in place to protect the meters and network.
3. Social network account spoofing
Many of us use Facebook, LinkedIn and other social networks to connect with friends, family and colleagues -- which leaves us vulnerable to a new technique called social network account spoofing. The idea is that a scammer poses as either someone you know or a friend of a friend to get close to you and fool you into revealing personal information. He then uses that information to gain access to your other accounts and eventually steal your identity.
In a typical exploit, says Joffe, someone contacts you on a service like Facebook or LinkedIn, posing as a friend of a friend or a co-worker of someone you trust. Then, the new "friend" contacts you directly, usually through text message or email. It might seem surprising to have this "friend" contact you outside the social network, but he seems legitimate because you believe he has a connection with someone you trust.
In another scenario, a scammer might impersonate someone you already know -- claiming to be an old friend from high school, for instance. Spoofers can find out your connections by following your public feeds or looking up the names of co-workers on sites like LinkedIn where you have posted your work info.
Once the scammer has established a connection with you, he uses devious means to steal personal data, such as chatting to find out the names of family members, favorite bands, hobbies and other seemingly innocuous information -- then trying those as passwords or answers to security questions at banking sites, webmail accounts or other sites.
As Joffe points out, the idea behind social network account spoofing is "thousands of years old." Conning you out of your personal information is an age-old trick. Today's social networks just provide a new avenue for con artists and criminals to get close to you. The trick works because there is often no way to know whether someone you've come to trust online is actually who he says he is.
"The problem with communication by Facebook or LinkedIn is that you are stuck in a Web interface -- you can't check the IP address or header information. Everything is in a nice friendly world," Joffe says.
Stratum Security's Morehouse says criminals are becoming increasingly crafty on social networks: They first identify a target, then do the research -- what is this person like, whom do they follow, what do they like to do?
What's more, social network attacks are sometimes combined with email and website spoofing, Morehouse says. You might develop a friendship on LinkedIn and then get an email from that person that looks like it was sent via LinkedIn but is actually a fake. When you click the link to reply to the message, you're taken to a fake LinkedIn site; logging in there reveals your LinkedIn username and password to the spoofer.
Another type of attack Morehouse describes targets companies as well as individuals. The spoofer might set up a Facebook page pretending to be the official company page for, say, a retailer like office supply giant Staples. To make it seem credible, the spoofer might claim that the page is a formal method to contact the company or register complaints.
The page might offer free (but fake) coupons to entice people to join, and it soon goes viral as people share it with their network of friends. Once hundreds or thousands of users have joined the page, says Morehouse, the owner tricks them into giving out personal information, perhaps by signing up to receive additional coupons or special offers.
This is a double attack: Consumers are damaged because their personal data is compromised, and the company is damaged because its customers associate the fake Facebook page with the real company -- and decide not to buy from that company anymore.
As with text-message attacks, individuals' best defense against spoofing attacks is to use common sense, Joffe says -- criminals usually do not do a good job of impersonating a person or company, and they tend to send links and phishing scams to con you. They might try to mimic a friend but rarely manage to accurately convey their personality. In some cases, the attacks are traceable through e-mail headers or IP addresses, and most attacks are too general and untargeted to be believable to anyone who's careful.
Other precautions might seem obvious but are often overlooked. If someone says he's a friend of a friend or co-worker, make sure you confirm his identity with your common connection. And it's a good idea to lock down your privacy settings at social networking sites so that your contact info, posts, photos and more aren't visible to everyone. In Facebook, for example, select Account --> Privacy Settings --> Custom and click the "Customize settings" link at the bottom to gain control over exactly what you want to share with everyone, friends of friends, friends only or no one.
For companies, it's a little trickier. Joffe says there is no way to prevent a criminal from setting up a fake Facebook page initially, but companies can use monitoring tools such as Social Mention to see how the company name is being used online. If an unauthorized page turns up, companies can ask the social network to remove the fake listing.
4. Cyberstalking
Social networks like Twitter and Facebook have changed the way we communicate in our personal and work lives, many would say for the better. Yet these useful portals also provide conduits that others can use to make our lives miserable.
A relatively new concept variously called cyberstalking, cyberharassment or cyberbullying involves an individual or a group making repeated personal attacks online, such as posting negative comments on every tweet you make or posting crude altered photos of you on a social network. The perpetrators may hide behind online aliases to hide their identities. By law, cyberbullying becomes a federal crime if a stalker makes any life-threatening comments.
Most of us have heard of a handful of well-publicized cases of cyberbullying among teens, but it's also on the rise for adults who connect to social networks from their place of employment, according to Kathleen Baty, a personal safety consultant and CEO of SafetyChick Enterprises. These workplace-related attacks might involve another employee, or someone trying to steal company information.
"Cyberstalking in the workplace has become more and more common and is tough to define because there are so many different forms to threaten or harass in this digital world and so many different motives behind the behavior. It can be anything from a personal/romantic relationship gone bad, to a co-worker/business conflict, to a competitor trying to wreak havoc on a company," says Baty.
To keep cyberstalkers off company networks, businesses should implement all the usual corporate security tools, such as firewalls and encryption, Baty says. Additionally, companies should institute a social media policy that outlines clear guidelines for what kinds of information employees should and should not post or discuss on public sites.
If you do become a victim of cyberstalking or cyberbullying, Baty advises you to report it immediately to local law-enforcement authorities; if it happens at work, report it to your HR department as well. Don't delete harmful posts or other electronic communications, she says, but instead retain all documentation of incidents, mainly as evidence but also because the headers for e-mail and forum postings can be used to track down the offender.
That said, the best defense is to protect your personal information as carefully as you can. For instance, never reveal online such details as where you live, and don't announce your movements, such as that you are on vacation or home sick and have left your workplace computer open to attack -- which rules out public "check-in" social networks such as Foursquare.
5. Hackers controlling your car
The age of the connected car is dawning. Vehicles like the Ford Edge now provide 3G network access, a Wi-Fi router in the car, and the ability to tap into your home Wi-Fi network (only while parked). In the next few years, more automakers will provide wireless access for Web browsing and streaming high-def movies. And by 2013, a new FCC-mandated wireless signal called DSRC (dedicated short-range communications) will run at 5.9GHz and provide a vehicle-to-vehicle communication network.
For anyone who follows network computing or computing in general, adding these new features to a moving vehicle should raise a red flag as yet another way criminal hackers can cause problems. Since these systems often tap into the car diagnostics and safety features, a hacker could potentially interfere with such systems and, for example, cause a car's engine to surge at just the wrong time, says Stephan Tarnutzer, chief operating officer at automotive control console manufacturer DGE.
While no real-world exploits are known to have happened, security researchers from the University of California, San Diego, and the University of Washington have hacked into the computers of several late-model cars and remotely disabled the brakes, altered the speedometer reading, turned off the engine, locked passengers into the car and more.
The research team's initial tests relied on plugging a laptop into the car's diagnostic system, but later tests identified other entry points for an attack, including the cars' Bluetooth and cellular connections. More wireless communications in future cars will create even more attack vectors.
The good news, Tarnutzer says, is that most of the forthcoming wireless technology for cars is for short-range communications -- say, from one lane to another or just as you pass through an intersection. That makes it difficult for hackers because they need to be in close proximity to the car.
Nevertheless, wireless connections in cars will undoubtedly make a tempting target for hackers. The answer, says Tarnutzer, is for the auto industry to use strong, hardware-based encryption technology.
For example, the OnStar communications and security service offers a theft-recovery feature that makes use of wireless signals. If your car is stolen, you can report the theft to the police, who then contact OnStar, which can transmit a signal over a 3G network to stop the accelerator from working in the stolen car. OnStar's transmissions are encrypted to thwart unauthorized attempts to tap into signals and interfere with vehicle operations.
Car companies are, of course, aware of the potential for hackers to disrupt in-car wireless services. Representatives from Ford and GM, for instance, said they are developing strong encryption standards for vehicle-to-vehicle and vehicle-to-back-end-infrastructure communications.
The technology for the connected car is for the most part still in a testing phase, says Tarnutzer. The DSRC network in particular will undergo thorough testing by both the car companies and the U.S. Department of Transportation to make sure it is hacker-resistant and uses strong encryption, he adds. "This is why it takes two to three years for an OEM to qualify a new vehicle, compared to six months for a new smartphone," he says.
6. GPS jamming and spoofing: Threat or nuisance?
Another emerging criminal tactic -- interfering with GPS signals -- has security experts divided on just how harmful it could become.
Jamming a GPS signal at the source is next to impossible, says Phil Lieberman, founder of enterprise security vendor Lieberman Software. Blocking the radio signals broadcast from orbiting GPS satellites would require a massive counter-transmission. And because the satellites are operated by the U.S. military, jamming them would be considered an act of war and a federal crime, says Lieberman.
However, it is easy to jam GPS receivers with a low-cost jamming device like one sold by Brando. The devices jam the GPS reception by overloading it with a similar signal -- the receiver becomes confused because it can't find a steady satellite transmission.
Lieberman says this kind of jamming is usually more of an annoyance than a major security threat. A nefarious hacker could, for instance, set up a jammer in an intersection and temporarily disable the GPS in passing vehicles. These attacks are relatively rare, says Lieberman: "It is usually just sociopaths doing this kind of thing."
Lieberman doesn't give much credence to fears about jammers disrupting airplanes or air traffic control systems, because those networks use a completely different GPS signal from the one we use in cars and handheld devices. Jamming could, however, be a potentially dangerous issue when it comes to financial records, he says, because GPS devices are used in the banking industry to add a timestamp to financial transactions. Although completely blocking transactions would be difficult, Lieberman said, an industrious hacker could theoretically disrupt transactions and cause headaches for banks.
Security expert Roger Johnston, a systems engineer at the Argonne National Laboratory in Chicago, says spoofing GPS signals is the greater danger, explaining that GPS receivers are low-power devices that latch on to any strong signal. In tests, he has set up a GPS spoofing signal, operated out of a passenger car, that sends erroneous GPS information to nearby receivers. "You don't have to know anything about electronics or GPS to set these up; they are very user-friendly," says Johnston.
Johnston says spoofing could be used for serious crimes -- transmitting information to a delivery truck that routes it into a dark alley where criminals are waiting, changing the timestamps on financial transactions, delaying emergency vehicles from finding their routes. There have been no reported cases of GPS spoofing to commit a criminal act, but Johnston warns that government and business should work to deter the attacks.
Typically, he says, the security industry is reactionary: "We wait until there is a catastrophic exploit until we do anything about it." With about $15 worth of parts, today's GPS devices could be retrofitted to detect GPS spoofing and notify the user that an attack is underway, Johnston says, "but because almost nobody is interested in GPS spoofing, this is not a project we have pursued."
In the end, as Lieberman explains, there isn't a lot individuals can do to prevent GPS jamming or spoofing. If someone transmits competing signals as you drive in a car or use a handheld, the receiver will fail or be fooled -- but keep in mind that your GPS device will begin working properly again as soon as you move out of range of the jamming or spoofing device. However, it is worth noting that GPS jamming is illegal in the U.S. and violates FCC regulations. If you suspect jamming or see someone using a GPS jammer, report it to the police.
For all the other threats we've covered in this story, taking some extra precautions -- using strong encryption technology, engaging only with trusted friends on social networks, and using penetration testing software on corporate networks -- can help alleviate some fears, even if the bad guys keep coming up with new ways to make us nervous.
No comments:
Post a Comment