Month: February 2014

How hackers used a fridge to conduct a cyber crime campaign

It’s clear that an increasing number of the things we use every day can and will be connected to the ‘net. However, the same connectivity that allows us to turn down our thermostat or click off the TV while we’re away from home also leaves room for hackers to attack.

Their efforts are keeping them far more than a step ahead of your average business, and one of the newest tactics is taking advantage of the “Internet of Things” – our connected DVRs, televisions, routers, and, in a recent incident uncovered by security experts at Proofpoint, Inc., even a refrigerator, to power nefarious online activity:

The attack that Proofpoint observed and profiled occurred between December 23, 2013 and January 6, 2014, and featured waves of malicious email, typically sent in bursts of 100,000, three times per day, targeting Enterprises and individuals worldwide. More than 25 percent of the volume was sent by things that were not conventional laptops, desktop computers or mobile devices; instead, the emails were sent by everyday consumer gadgets such as compromised home-networking routers, connected multi-media centers, televisions and at least one refrigerator. No more than 10 emails were initiated from any single IP address, making the attack difficult to block based on location — and in many cases, the devices had not been subject to a sophisticated compromise; instead, misconfiguration and the use of default passwords left the devices completely exposed on public networks, available for takeover and use.

Cyber crime is a profitable business, a fact which motivates hackers to constantly explore new avenues of attack, but, as with many other aspects of crisis management, many organizations fail to see the costs associated with not preparing before they’re paying dearly to recover.

At this point it’s safe to assume you will be hacked at some point. Whether it’s through your fridge, a phishing email, or just someone with a silver tongue and some knowledge of social engineering, the difference between a troublesome situation and one that costs you big time in terms of lost trust, reputation, business and time will be how much you cared beforehand.

——————————-
For more resources, see the Free Management Library topic: Crisis Management
——————————-

[Jonathan Bernstein is president of Bernstein Crisis Management, Inc., an international crisis management consultancy, author of Manager’s Guide to Crisis Management and Keeping the Wolves at Bay – Media Training. Erik Bernstein is Social Media Manager for the firm, and also editor of its newsletter, Crisis Manager]

What are major sponsors like Coke and McDonald’s doing to prepare for trouble related to the Games?

This year’s Sochi Games are the most tense in many years for reasons related to everything from human rights violations in Russia to the frighteningly real chance of a terrorist attack. Our own Jonathan Bernstein sat down with CCTV America’s Michelle Makori to discuss the crisis management plans they have (or at least should have) in place:

——————————-
For more resources, see the Free Management Library topic: Crisis Management
——————————-

[Jonathan Bernstein is president of Bernstein Crisis Management, Inc., an international crisis management consultancy, author of Manager’s Guide to Crisis Management and Keeping the Wolves at Bay – Media Training. Erik Bernstein is Social Media Manager for the firm, and also editor of its newsletter, Crisis Manager]

VP Jay Rossiter’s message to stakeholders was missing something important…

Late last month, Yahoo joined the ranks of organizations to have been hit by hackers in 2014. Never good at any time, the fact that the company has already been under fire about an extensive downtime for its Mail service in December, as well as a Flickr outage that left users floundering, means this incident brought an extra dose of reputation damage.

While Yahoo is staying mum on exactly how many were affected, here’s what senior VP Jay Rossiter had to say about the situation in a blog post:

Security attacks are unfortunately becoming a more regular occurrence. Recently, we identified a coordinated effort to gain unauthorized access to Yahoo Mail accounts. Upon discovery, we took immediate action to protect our users, prompting them to reset passwords on impacted accounts.

Based on our current findings, the list of usernames and passwords that were used to execute the attack was likely collected from a third-party database compromise. We have no evidence that they were obtained directly from Yahoo’s systems. Our ongoing investigation shows that malicious computer software used the list of usernames and passwords to access Yahoo Mail accounts. The information sought in the attack seems to be names and email addresses from the affected accounts’ most recent sent emails.

What we’re doing to protect our users

We are resetting passwords on impacted accounts and we are using second sign-in verification to allow users to re-secure their accounts. Impacted users will be prompted (if not, already) to change their password and may receive an email notification or an SMS text if they have added a mobile number to their account.

We are working with federal law enforcement to find and prosecute the perpetrators responsible for this attack.

We have implemented additional measures to block attacks against Yahoo’s systems.

What you can do to help keep your accounts secure

In addition to adopting better password practices by changing your password regularly and using different variations of symbols and characters, users should never use the same password on multiple sites or services. Using the same password on multiple sites or services makes users particularly vulnerable to these types of attacks.

We regret this has happened and want to assure our users that we take the security of their data very seriously.

For more information, please check our Customer Care help page.

By Jay Rossiter, SVP, Platforms and Personalization Products

While the explanation of steps taken and the re-securing process are easy to follow for even the average user, can you spot the missing ingredient in Yahoo’s crisis communications?

If you said compassion, you’re on the ball. Not once did Rossiter express compassion for the stress, concern and confusion that affected users undoubtedly experienced. He came close with the “regret” statement, but fell short of actually commiserating with his constituents, a mistake that undoubtedly hurt Yahoo’s overall crisis management efforts.

——————————-
For more resources, see the Free Management Library topic: Crisis Management
——————————-

[Jonathan Bernstein is president of Bernstein Crisis Management, Inc., an international crisis management consultancy, author of Manager’s Guide to Crisis Management and Keeping the Wolves at Bay – Media Training. Erik Bernstein is Social Media Manager for the firm, and also editor of its newsletter, Crisis Manager]

The social media giant may need crisis management if latest lawsuit brings on the privacy hounds

Privacy is a hot-button issue in the online world these days, making the latest lawsuit to be filed against Facebook a potential doozy. According to the plaintiffs, Facebook has been violating the Electronic Communications Privacy Act by scanning the URLs found in private messages sent via the service.

This isn’t just a tin-foil-hat theory either, at least according to Swiss information security firm High-Tech Bridge, who found that Facebook robots accessed URLs sent within a private message, even when specifically restricted by backend coding on the destination page.

The plaintiffs not only allege that Facebook invades the privacy of “private” messages, but that it uses the information it finds there for profit.

Here’s a sample from the criminal complaint, filed December 30 in a California court:

“(The scanning) is a mechanism for Facebook to surreptitiously gather data in an effort to improve its marketing algorithms and increase its ability to profit from data about Facebook users”

Considering many experts claim the exodus from Facebook, especially among the younger generation, is due to privacy concerns, this case looks particularly bad for the social media giant’s reputation, and bottom line.

While Facebook is currently dismissing the claims as “without merit”, it should be interesting to see what crisis management strategies it employs should the case attract more public interest.

——————————-
For more resources, see the Free Management Library topic: Crisis Management
——————————-

[Erik Bernstein is Social Media Manager for Bernstein Crisis Management, Inc., an international crisis management consultancy, and also editor of its newsletter, Crisis Manager]