Just three well known breeches in recent years resulted in the personal data of 247 million Americans being made available for the taking …
- Equifax breach in 2017 – 145.5 million Americans exposed
- Federal Office of Personnel Management breach in 2015 – 22 million Americans exposed
- Anthem Insurance hack in 2015 – 80 million Americans exposed
If big numbers alone aren’t enough to send a chill up your spine, consider that there are only about 325 million people in the U.S.
Bitcoin and its sibling cryptocurrencies are putting a new spin on many of the same old tricks cybercriminals have used for years, while at the same time making once obscure ransomware attacks ever more common. Some companies have even begun stockpiling Bitcoin as a standard part of their business continuity planning to ensure they’re prepared to pay ransom demands should an attack occur.
Some types of hacks are always going to be around. The confidence tricks and social engineering cracks made famous by Kevin Mitnick back in the ‘80s are still in play and aren’t going anywhere. They’re just being re-tooled to take advantage of the greater anonymity cryptocurrencies provide.
Erich Kron, former manager for the US Army Western Hemisphere Cyber Center and one of the most prolific speakers on the subject of cybersecurity has something to say about all this, and his prognostications are grim. As the harbinger of things to come in the world of information assurance, the man is in high demand on the speaker circuit, addressing security and IT conferences on a weekly basis. His 20 years of experience in the industry helped land him a place on the KnowBe4 team, a project headed by the infamous Mitnick himself, the company’s Chief Hacking Officer.
Even as Blockchain is being lauded for bringing a nearly-impenetrable layer of security to cryptocurrencies, Kron filled us in on what he sees as the inevitable: Cybercriminals using the growing popularity of anonymous, untraceable, extra-governmental cryptocurrencies to their advantage.
“Oops, Your Files Have Been Encrypted!”
On the morning of May 2017, the ominous phrase, “oops, your files have been encrypted” appeared on the computer screens of banks, healthcare systems, universities, and transportation systems across the world. They had fallen victim to what would later become known as the WannaCry Ransomware Attack. Next to the chilling message was a countdown clock and a link where users could pay the ransom to save their vital data from annihilation – $300 in Bitcoin.
Kron says this kind of attack has exploded on the scene in recent years and caught a lot of cyber security people off guard. Prized for the anonymity they allow, criminals quickly learned that cryptocurrencies like Bitcoin effectively eliminate the risk of being caught. “Where the bad guys usually get busted is on the exchange of money for the items,” Kron told us. “That’s always a risky place… By leveraging cryptocurrency, that’s pretty much dropped off as far as a risk goes, or dropped very, very low.”
And Kron says encryption attacks like WannaCry aren’t the only types of ransomware that we’re going to be seeing more of. Another type involves stealing a company’s proprietary information and threatening to release it publicly unless a ransom is paid. “If the bad guys were able to get a hold of the 11 herbs and spices for KFC, what would that be worth for KFC to pay for? Hackers have this mindset now. And they have a way to monetize that without a lot of risk.”
Old Attacks Revamped with the Rise of Cryptocurrencies
As cryptocurrencies have vastly increased the utility of ransomware attacks, Kron points out that other tried-and-true methods of hacking are also going to be reborn to take advantage of them.
Phishing and spear-phishing attacks are one example. Kron explains how cybercriminals can use even a little bit of personal information pilfered in a data breech or bought on the dark web. “I know you bank at Citibank, therefore when I send you a phishing email I’m going to make it look like it came from Citibank and you’re going to be much more liable to open that email if we can put the last four digits of the card number in the right-hand side of the email and say, ‘here’s your card number.’ It lets people put their guard down. These sorts of targeted attacks to get into organizations, to get you to launch malware, to get you to put in your credentials; those sorts of attacks are on the rise and they’re going to continue to be on the rise for quite some time.”
Once hackers are in they can go after the most juicy bits of personal or proprietary information and then use it to blackmail businesses and individuals into paying a ransom. Thanks to the intractability intrinsic to cryptocurrencies, these types of attacks are going to be favored over riskier break-in style attacks that might have only granted a hacker short-term access to someone’s bank account.
We’re also going to see zero-day attacks revamped for cryptocurrencies. These kinds of attacks exploit flaws and unpatched vulnerabilities discovered in a piece of code, whether in commonly used operating systems or simple internet connected devices. In fact, the virus used in the WannaCry ransomware attack made it’s way on to computers around the world through a zero-day exploit. Perhaps most troubling, the virus was actually based on an exploit developed by the NSA… and allegedly stolen by hackers.
Was Bitcoin Created by US Intelligence?
It is worth noting several facts about the origins of Bitcoin:
- The supposed creator of Bitcoin is Satoshi Nakamoto. “He” has since disappeared and many believe this was never an actual individual but rather a group who designed Bitcoin.
- When translated from Japanese, Satoshi Nakamoto can mean “central intelligence.”
- In 1997, more than a decade before Bitcoin was launched, the NSA published an essay in the American University Law Review that outlined how a currency like Bitcoin could be created. It was called, “How to Make a Mint: The Cryptography of Anonymous Electronic Cash.”
Kron obviously couldn’t address questions like this because of the classified nature of his work with the Department of Defense. He never gave us the old, ‘I could tell you but then I’d have to kill you,’ line, but what he did say was, “A lot of those sorts of things I can’t really talk about – the really interesting ones.”