Josh Moulin: Cyberattacks And How To Protect Your Computer and Data – Part 3

The following was originally posted to the blog site of author L.A. Sartor. She and Josh were kind enough to allow me to share this extremely cool bit of knowledge with you. By the way, many of you will remember Josh from his wonderful cybercrime presentations at the Writers’ Police Academy, and from his fascinating articles here on The Graveyard Shift.

So, without further ado, I’ll ask L.A. Sartor to introduce today’s guest blogger …

 

Author L.A. Sartor

“This is the final installment of Josh’s 3-part series.  I hope you’ve found it as scary and as useful as I have.  Thanks, Josh, for your time and your expertise.”  

 

 

 

 

If you have been following this blog series, you know that the first blog discussed the cyberattack kill chain and how hackers target individuals and systems and the second blog covered common cyberattacks and how they are perpetrated and identified. In this final post, I am going to discuss what users can do to harden their systems against attack.

Typically, criminals are lazy and take the path of least resistance. Just like locking your doors and having an alarm system will deter the majority of home burglars, there are preventative steps a computer user can take to cause a criminal to move on to someone else who is easier to compromise. The major caveat to this is if you happen to be specifically targeted by the attacker, who may not be easily deterred by basic preventative measures.

Cybersecurity is a fine balance between convenience and security; users and businesses must make an informed risk-based decision when determining the level of security that should be applied to systems and applications. Too much convenience and your systems are wide open to attacks. Too much security and work is inhibited

In no particular order, here are my suggestions and opinions on how to keep yourself cybersafe:

Multifactor Authentication

I have an entire blog post dedicated to Multifactor Authentication (MFA). If you want the details, please read it – but to summarize here, use MFA for everything that you possible can. Can it be a hassle to always have your phone with you? Yes. Does it make it nearly impossible for someone to access your online information without your phone? Yes. Use MFA like Google Authenticator or text messaging for banks, Dropbox, iCloud, Google, etc. If you are wondering what sites and services offer MFA, look at this website.

Physical Security

Equally as important as having good cybersecurity, you must protect your devices. Once an attacker has physical access to your phone, tablet, computer, etc. it is game over. Use strong passwords, use screen savers that require a password once they come on, don’t share your password with others, and don’t leave your devices unattended.

Never, ever, connect your phone or device to charging stations in public places or to a rental vehicle via USB cables. Studies have shown that in some cases, data is collected within rental car computers and in charging stations and malware can be implanted on the connected device. If you must charge, use power plugs or cigarette lighter chargers and never directly connect a USB cable to a hub. The only exception is if you buy a USB cable that has had the data wire removed or use a data blocking device in line like this one.

Password Manager

I have already mentioned in my second blog post what the dangers are of reusing the same password for everything, but it is impossible to remember multiple passwords. I have a few recommendations when it comes to passwords and it involves another risk-based decision. For instance, if you have enabled MFA on your accounts, then you have greatly reduced the risk of unauthorized access, so the complexity of your passwords is not as important as it would be if you didn’t have MFA (the convenience – security balance). Even reusing passwords on accounts with MFA is more tolerable because the one time password (OTP) used with your app or text message provides the extra security.

For me, I use a password manager to maintain all of my passwords. I don’t like having my browser save my passwords because if my system or browser is compromised, those passwords will most likely get stolen. I also don’t trust cloud password managers because if the cloud provider is compromised, my passwords may also be compromised (this has happened).

I recommend standalone databases that are installed on your system and encrypted themselves. I like KeePass and a lot of security research has been done on this program. It uses excellent encryption and you can place the database in a shared location if you want (such as a home network attached storage (NAS) device) and it is usable on mobile devices. It’s not stored in the cloud and allows you to maintain usernames, URLs, passwords, and other secure notes. It also has a password generator, which allows you to create very complex passwords immediately.

I actually do not know most passwords to websites, I use KeePass to generate hugely complex passwords for sites that don’t utilize MFA and just store them within KeePass. If I need to access the site I copy/paste the complex password into the browser and never see it.

Make sure you are using PINs, fingerprints, or complex passwords to access your mobile devices. There are pros and cons to using different methods, but make sure you are at least using something and preferably more than just a four-digit PIN.

Patch, Patch, Patch

Make sure that your Operating System (OS) (i.e., Windows, Mac OS X, iOS, Android, Linux) is setup to automatically download and install updates. Frequent patching is one of the best ways to prevent cyberattacks that leverage known vulnerabilities. In addition to patching the OS, make sure to patch all other third party software installed on your devices. This is relatively simple with iPhones for example because it will automatically update the OS as well as apps installed on the device.

This becomes more complex with computers because although the OS may update, other software like Java, Adobe, Office, Chrome, Firefox, etc. usually don’t. Mac is generally better at third party app management than Windows, but Windows is getting there with Windows 10. There are apps available to help keep your Windows third party software updated, look at https://ninite.com/ for example.

Install and Maintain Security Software

Just as malware has come a long way, so has security software. Today’s (good) security software really does a lot more than the old antivirus software (hence calling it security software instead of just antivirus). Because of the sharing of common information and malware, the market for specialized security software is much different than it used to be and in fact many great products are completely free. Windows Defender for example is actually a decent security software tool and built in to Windows. The nice thing about Defender is that it updates as Windows updates and you don’t have to worry about an incompatibility with your security software anytime you upgrade your OS (used to be a common issue).

Although there are many myths around Macs being more secure than Windows computers, they face many of the same vulnerabilities as PCs. The difference really is that because Windows systems has the greatest market share and are more common in businesses, most malware is written and directed at PCs. There is plenty of Mac malware though and running a Mac without security software is no longer an option.

There is a mix of commercial and open source security software tools available and they range in price from free to an annual subscription of around $50 to $60. Ideally, look for a software that provides anti-malware, firewall, intrusion prevention, web protection, and crypto-attack detection. Here are a few examples of security software tools I would consider (these are my own personal opinions and I’m not endorsing any particular vendor, but have personal knowledge of the tools below).

If you really want to compare different security software vendors, check out this site.

Use Encryption

Encryption has come a very long way and is now built-in to devices and free to use. Encryption essentially scrambles the data on your device and without the key (a password in most cases) the data cannot be descrambled and read. Any Windows device and especially those that travel like tablets and laptops should be encrypted with BitLocker. Don’t discount your home computers though, because if they are stolen in a burglary you don’t want your data in the hands of someone else.

For Mac computers, use the built-in FileVault 2 encryption option. I would caution against having the key stored within Apple’s cloud though. Apple offers to store the key online as a backup (because if you forget your password, you will never get to your data), but this creates a vulnerability. Another option is to take a screenshot of the emergency backup key, print it, and maintain it somewhere like a safe deposit box (same is true for BitLocker and storing the key with Microsoft).

While no one wants a device stolen, if your device is stolen and you have ensured that it is always password protected (including auto-locking after 15 minutes of no use) and it is encrypted, you can rest assured no one will be looking through your data.

Maintain Backups

There are two primary reasons to have backups; one is for the accidental file deletion that you need to restore, and the other is for full disaster recovery. Backup software has also come a long way and both Windows 10 and Mac OS X have built-in backup solutions. My recommendation is to always have frequent incremental backups occurring at least once a day, if not hourly. These backups can be to a connected drive (such as a USB hard drive), or wirelessly to a device like a NAS. Windows and Macs both carve out a portion of the system’s hard drive for incremental backups too, for those times when something is accidentally deleted and just needs to be recovered immediately.

For disaster recovery though, I recommend having a completely separate portable hard drive that you do full backups on. You must decide how frequently you want these backups done (weekly, monthly, quarterly, etc.) and the question you must ask yourself is how much data are you willing to lose if something happens (this is called the Recovery Point Objective in IT-speak). For example, if I decide to do full backups monthly, am I willing to potentially lose a month’s worth of work, photos, etc. if my computer was stolen or destroyed? Remember that the disaster recovery disk is for those situations where you cannot access the original computer for some reason like a fire, flood, or theft. You may also do ad-hoc backups if you just completed some important work and you don’t want to wait until the next month to backup. Just put a recurring appointment on your calendar for full backups and make sure to stick with it.

There are two very important items to remember with your backups. First, the backup disk must also be encrypted. If your backup data is unencrypted and your home is burglarized, the criminals will just get your data off of the backup drive instead of the computer. Both Mac and Windows will allow you to encrypt external drives with FileVault 2 or BitLocker, respectively. Or, you can purchase hardware encrypted drives, such as an Aegis drive (https://www.apricorn.com/).

Second, the disaster recovery backup needs to be stored offsite. Local backup drives are for convenience, but disaster recovery backups are used in the event the original data or system is unavailable. If your disaster recovery drive and computer are in the same place and they are both destroyed, you are completely out of luck. Some people may store an encrypted hard drive at their office, at a friend or family member’s home, in a safe deposit box, or somewhere else they have access to.

Some people may choose to back up to the cloud, which is certainly more convenient but may be less secure. There are ways to encrypt data within the cloud so only you can access it, but this takes additional steps and some advanced knowledge.

Do Not Ignore or Disable Security Settings

Read security warnings that pop up and don’t disable security settings are that designed to keep you safe. For example, automatic software downloads and installation, or user access control (UAC) may be frustrating, but they are extremely important. Also make sure your computer’s built-in firewall is turned on. Windows 10 and Mac OS X both have good firewalls.

Never Use an Administrative Account for Normal Use

This is called the rule of least privilege. Always use the least privileges on a computer necessary to do your work. Your computer should have at least two accounts on it and every user should have their own account (especially kids). One is a full administrator account that you can use to change settings, install software, do maintenance, etc. This admin account should have a password that is unique and hard to guess and should never be used for normal tasks such as web surfing or checking email. If a computer is attacked while logged in as the admin, the likelihood of malware being able to execute and install is much greater. The subsequent accounts should be normal user accounts and not have admin privileges. This is where you conduct the majority of your work such as email, web surfing, etc. If you need to install something under your normal account, you will be prompted to temporarily provide your admin username and password. This is good, as it causes you to think and make sure what is being done is something you requested and not malicious.

To make sure I am never logged in to the wrong account, I make the desktop background of my admin account a bright red solid color. Then, just by looking at my desktop, I know that I should not be doing anything online.

About The Author:

Josh Moulin serves as a trusted advisor to federal government IT and cybersecurity executives. Previously, Moulin was the Chief Information Officer for the Nevada National Security Site, part of the U.S. Department of Energy’s Nuclear Weapons Complex and before that spent 11 years in law enforcement including 7 years as the commander of a cybercrimes task force.

Moulin has a Master’s Degree in Information Security and Assurance and has over a dozen certifications in law enforcement, digital forensics, and cybersecurity including as a Certified Ethical Hacker. For more information, visit JoshMoulin.com or connect with him on LinkedIn or Twitter.

L.A. Sartor

If you love stories filled with suspense, adventure, fighting against all odds and winning love, then please click here to visit the website of author L.A. Sartor. You’ll be glad you did!

/by
,

Josh Moulin: Cyberattacks And How To Protect Your Computer and Data – Part 2

The following was originally posted to the blog site of author L.A. Sartor. She and Josh were kind enough to allow me to share this extremely cool bit of knowledge with you. By the way, many of you will remember Josh from his wonderful cybercrime presentations at the Writers’ Police Academy, and from his fascinating articles here on The Graveyard Shift.

So, without further ado, I’ll ask L.A. Sartor to introduce today’s guest blogger …

Author L.A. Sartor


“I’m incredibly honored that Josh Moulin, who was my cyber expert for Forever Yours This New Year’s Night, responded with a “yes” when I asked him to do a series on what is a cyberattack, how to recognize them, and how to protect yourself.

Take it away, Josh.”

 

In my first blog, I discussed the cyber kill chain and how hackers move through predictable steps to launch an attack against a target. In that blog, I used the example of an author who was targeted because of their controversial writings and the author’s system was compromised with ransomware. In this second post, I am going to discuss the most common cyberattacks and how computer users can become savvy to detect potentially malicious activity. While there are many kinds of attacks, I’m going to highlight some of the most common attacks that I see. Additionally, while the technical execution of many of these attacks are different, the methods for detection and prevention are similar if not identical.

Phishing Attacks
The most common way that computers and networks are compromised is through phishing attacks. In my scenario in the first post, the author was tricked into clicking a link within an email that caused the author’s system to reach out to a server and download malicious code. Phishing is a very easy attack to create and is more of a social engineering attack than anything technical.

Sometimes these messages are clearly phishing attacks; the message contains grammatical and spelling errors, it is sent by an organization you never do business with, or it is sent by a prince in Nigeria or the U.K. lottery asking you to claim your winnings. Clever hackers though take time in crafting their message and even if it is blasted to millions of email accounts, all they need is to steal the credit card information of just a few people to make a huge return on their investment.

Below is an actual phishing email that came to me. As you can see, the message looks legitimate and there are no obvious signs of it being malicious. Remember, the rule is to never click any links until and unless you are positive the message is legitimate.

When I hovered over the links within the email, none of them went to the Amazon.com domain. Instead the links all pointed to hxxp[://]greatdeals.gungh.top/system/9d011840a8b905ba79667fa20d0a0936. This URL has since been taken down as malicious, but had I actually clicked the link when the URL was still active, my system very well may have become infected.

In some cases of phishing, instead of getting a link to click, the attacker will send a specially crafted attachment. PDFs and Office documents (e.g., Word, PowerPoint, Excel, etc.) can be embedded with malicious code and once a user opens the document the code may be able to execute. This is why in the latest version of Microsoft Office, documents are opened in safe mode and in order to edit or print, users must click a button. This safe mode prevents the document from running any macros or other code that may compromise the computer.

If you are ever unsure of a URL or a file, there are several free online resources to help. For instance, URLQuery.net allows you to enter a URL and scan it for malware, complaints, or other warnings. It also tells you the country it is hosted in and gives a screenshot of the website you looked up. Another site, VirusTotal.com, is owned by Google and allows both URLs and files to be scanned for malware. If you receive a file from someone and you want it scanned before you double click it, upload it to VirusTotal to see if it’s malicious first.

Drive-By or Watering Hole Attacks

As organizations and individuals have become more adept at identifying phishing emails, attackers have had to change their modus operandi. One such example of this evolution is changing phishing emails so instead of sending an attachment within an email that is compromised or a link that begins the download of a piece of malware, the email (or Facebook post, or Tweet, etc.) sends the user to a website. The website is most likely legitimate and the user’s system would not detect anything suspicious at this point because nothing is attempting to download.

In the background however, the attacker has compromised the website, hosting malware on the site itself. Once the victim’s browser begins to read the contents on the website, it delivers a payload of malware to the system. This may come in the form of a download where the user is prompted to run something, or it may be a piece of JavaScript that when the browser sees the code, it automatically runs it without user interaction.

These attacks are called “drive-by” attacks because they can indiscriminately target anyone who browses the site, or watering hole attacks because the malicious activity is just sitting in the site, waiting for people to stop by. There have been some very popular websites compromised and embedded with malware such as CNN and Forbes so this kind of attack can be extremely widespread.

How do you spot this attack? Well, this one is tricky and there is a possibility that nothing on your system will notify you that an attack is taking place. Some more advanced anti-malware software may catch it, or if you notice strange things happening on your computer (website crashes, or your computer begins running slow with high CPU or memory utilization), or being prompted to download and run something may all be indications of a problem.

Wireless Attacks / Man in the Middle (MiTM) Attacks

While it has long been known that Wi-Fi, Bluetooth, and other wireless technologies are vulnerable to attacks, it is still a common and successful attack because people continue to connect to open access points out of convenience or to save their data consumption. Many people do not configure their home wireless access points correctly either, leaving them vulnerable to attacks by people in the area.

When I was in law enforcement, I remember a case where an Internet Protocol (IP) address was identified as downloading hundreds of images of child sexual abuse. My team wrote a search warrant and executed it, only to find that the home we went to had nothing to do with the crime. Our investigation later revealed that a neighbor about three homes down was a registered sex offender and had been using this neighbor’s Wi-Fi to commit their crimes. It was a huge inconvenience (not to mention a traumatic event) to not secure their Wi-Fi network and it all could have been easily prevented by taking some basic security steps.

Beyond securing your personal network, you must be extremely careful with the networks you allow your devices to connect. If you are connected to an unsecure wireless network (e.g. Starbucks) anything that your device transmits or receives that isn’t otherwise encrypted is fair game for someone also connected to that same wireless network. Wireless networks acts as a hub, meaning that anyone else connected to that network can see all the traffic, not just the traffic between their own device and the wireless router. Because of this, I can setup my device on the Starbucks network to promiscuously listen to all traffic and capture it, allowing me to compile it and view anything you typed, downloaded, uploaded, etc. as long as you were doing it unencrypted (http instead of https for example). If you navigate to a website that is not using encryption like http[://}yoursite.com and enter a username and password, I can sniff that out of the air and later use it.

It is true that more and more sites, especially sites that involve finance or healthcare use encryption because it’s mandated, there are still many sites that do not. The other danger is that most people reuse passwords, so even if your bank uses encryption (i.e., https[://]yourbank.com) but your favorite news site does not and you use the same password between the two, once I get the unencrypted username and password and see in your traffic you navigated to US Bank’s website, I can try your username and password on that site to see if it works. This is another huge reason to always use multifactor authentication on everything (more on this in the next post).

Another wireless attack is called the Man-in-the-Middle or MiTM attack. This kind of attack, which can also be carried out with cellular devices using devices like the Stingray can be very dangerous. In this kind of attack, the criminal creates a rogue access point (AP) and advertises it for users to connect to. On one side of the rogue AP are the victim devices and the other side is a path to the Internet. This allows the attacker to capture, decrypt, and record all of the traffic between the victim device and the Internet. It also allows the attacker to inject malicious traffic or redirect websites using the Domain Name Service (DNS).

To illustrate an MiTM attack, imagine you are seated at the airport and see a variety of wireless APs available to connect to. One has the name of “Free WiFi” and the other says “Free High Speed WiFi.” The “Free WiFi” is the legitimate Internet connection offered by the airport, but the “Free High Speed WiFi” is a malicious AP. An attacker sitting in your general proximity has created an AP using free software on his laptop. As your device scans for open APs it locates the High Speed AP and since anyone would want high speed over standard speed, you click to connect to the high speed AP. Once you click to connect, your device associates itself with the attacker’s laptop.

Now that you are connected to the attacker’s laptop, he essentially owns your device and the communications between your device and the Internet. Since the attacker is routing your traffic through to the Internet, as a user nothing seems out of the ordinary. In fact, the attacker is probably leveraging the airport’s free Wi-Fi to get your device out to the Internet. However, the attacker is now capturing all of the traffic coming into and out of your device and as we have already learned, anything typed in the clear (unencrypted) is recorded by the attacker in plaintext.

The attacker could make things even more interesting by using his laptop as a proxy between your device and the Internet and decrypting your encrypted traffic between your device and wherever you are browsing. Essentially what happens is your device connects to the attacker’s laptop where he breaks your connection to your bank or Facebook account, or whatever it is you are navigating to and decrypts your traffic, then re-encrypts it between his laptop and the destination (we’ll use your bank in this situation). Now the attacker can record even encrypted traffic such as usernames and passwords in plaintext. This attack however, will prompt the user’s device with an error message that the encryption certificate that you are using to visit your bank does not match the domain name of the bank and will require the user’s interaction to continue. If you’re interested in the technical details of encryption, certificates, etc. send me a note and I’ll be glad to discuss it.

Suffice it to say that if you get an error message about mismatched certificates (as shown below) on any device there is a high likelihood that the certificate has been compromised or you are the victim of a MiTM attack. No matter the reason, if you get this error, stop browsing, try connecting later from a different access point or from your cellular data to see if you get the same error, or contact the institution you are trying to access.

An error message generated by Safari showing there is a problem with the website encryption certificate

The same website visited in Firefox; notice the alert over the padlock


An example of Firefox showing a correctly implemented website encryption certificate

As mentioned above, the attacker can also inject malicious traffic into your session or redirect your computer. For example, if you type google[.]com into your browser, the attacker can create DNS entries that says if a user types google[.]com, actually send them to duckduckgo[.]com. In an even more sinister scenario, the attacker could create a rule that if you type wellsfargo[.]com, send the computer to wellsfargoamerica[.]com which might be a fake website that looks exactly like the real Wells Fargo (see Pharming attacks below).

How do you spot this attack? First, don’t connect to free Wi-Fi hotspots. If you absolutely must, then make sure you are using a Virtual Private Network (VPN) connection (either through your employer or use some of the VPN services available) which creates an encrypted tunnel between you and the VPN service before you navigate the Internet. Spotting a simple MiTM rogue AP may be nearly impossible. Spotting a rogue AP acting as a proxy will give you the browser certificate error messages shown above.

Pharming and Illegitimate Websites


Pharming, like it’s sister Phishing, is an attack that socially engineers a user. Instead of sending a message out, pharming is more like the watering hole attack where it waits for victims to stop by. Pharming is usually done by an attacker when they create a fake website but make it look legitimate and trick users to visit the site and enter their sensitive information (like credentials). Take this scenario: an attacker knows that because of a recent disaster, many users will be donating money to the American Red Cross on the legitimate website redcross[.]org. So, the attacker uses a free tool to “scrape” the actual Red Cross website, purchases the domain name of redcross[.]info, and then uploads the copy of the real Red Cross website to a server being hosted with Amazon Web Services (AWS). The attacker then begins a massive spam campaign for people to donate and provides the link of redcross[.]info and as people go to that site, it looks completely legit just like the real site. Users begin to donate millions of dollars to the PayPal account, which all goes to the attacker’s bank account.

This kind of attack can also be used by taking advantage of common misspellings or known letter combinations that people may not notice in the URL bar of their browser.

How do you spot this type of attack? This one may be difficult or impossible. Since nothing malicious is actually running on your computer (unless the attacker is combining Pharming with another attack) and you are just entering information into a website, there may be no signs or alerts at all. The best way to prevent this type of attack is by being very careful what you type into the URL address bar of your device, using known good bookmarks instead of relying on searches each time, and if you are given a link to click, make sure it matches the known website. Sometimes if I get a link from someone to follow, instead of clicking the link I will Google the organization and go to it that way, or at least confirm that what was in the link matches what is in Google.

In all of these attacks the bottom line is to pay attention, don’t click links that you don’t absolutely trust, actually read error messages that pop up on your screen before just clicking “OK”, don’t connect to public Wi-Fi APs, and make sure the certificate of an encrypted website you are visiting matches the domain name. In the last post of this series I will discuss the preventative strategies you can take to help harden your systems from attack and some proactive steps you can take to reduce the likelihood of being compromised.

About the author:

Josh Moulin serves as a trusted advisor to federal government IT and cybersecurity executives with the world’s leading IT advisory and research firm. Previously, Moulin was the Chief Information Officer for the Nevada National Security Site, part of the U.S. Department of Energy’s Nuclear Weapons Complex and before that spent 11 years in law enforcement including 7 years as the commander of a cybercrimes task force.

Moulin has a Master’s Degree in Information Security and Assurance and has over a dozen certifications in law enforcement, digital forensics, and cybersecurity including as a Certified Ethical Hacker. For more information, visit JoshMoulin.com or connect with him on LinkedInor Twitter.

L.A. Sartor

If you love stories filled with suspense, adventure, fighting against all odds and winning love, then please click here to visit the website of author L.A. Sartor. You’ll be glad you did!

/by

Josh Moulin: Cyberattacks And How To Protect Your Computer and Data – Part 1

The following was originally posted to the blog site of author L.A. Sartor. She and Josh were kind enough to allow me to share this extremely cool bit of knowledge with you. By the way, many of you will remember Josh from his wonderful cybercrime presentations at the Writers’ Police Academy, and from his fascinating articles here on The Graveyard Shift.

So, without further ado, I’ll ask L.A. Sartor to introduce today’s guest blogger …

Author L.A. Sartor


I’m incredibly honored that Josh Moulin, who was my cyber expert for Forever Yours This New Year’s Night, responded with a “yes” when I asked him to do a series on what is a cyberattack, how to recognize them, and how to protect yourself.

Take it away, Josh.

Cyberattacks and data breaches are unfortunately commonplace in the daily news cycle. Many of us have had our personal, healthcare, and financial data breached so much that we are used to receiving letters notifying us of unauthorized disclosures or getting signed up for yet another credit monitoring service. Cybercrime is out of control and the most infuriating part is that most of the attacks are not sophisticated or require an expert hacker. Indeed, most of the successful attacks use the same modus operandi that they have for a decade.

The fact that the majority of attacks are not sophisticated is as troublesome as it is helpful. Since we know what most attackers do, it makes the identification and prevention of these attacks easier. Individuals and small to medium businesses often assume (incorrectly) that if the United States Federal Government or massive corporations such as Home Depot, Anthem, Yahoo!, Target, and Equifax, who spend millions of dollars each year in cybersecurity can’t keep hackers out, then there is no possible way they can defend themselves.

It is true that many cyberattacks are easily preventable and only effective because mistakes have been made which create vulnerabilities. However, it is also true that this world has nation-state military units and sophisticated hackers which target government agencies, universities, corporations, and high-value individuals. When a skilled attacker has set their sights on a victim and has the means, opportunity, and intent to launch a cyberattack against that victim, these attacks may use techniques, tactics, and procedures that are highly complex and extremely difficult to detect. For the purposes of this article, I am not discussing these advanced attacks.

In this first blog post of a three-part series, I am going to focus on the cyberattack kill chain and lay the foundation for how cyberattacks happen. The focus audience of this post is individuals who are trying to protect their personal devices and data from cyberattacks. The next blog post will discuss the most common attacks and how to spot them, and finally I will discuss preventative strategies that people can take including security software, configurations, and backup strategies.

Cyberattack Kill Chain
Each cyberattack goes through a series of steps to accomplish its mission. Depending on the target, mission objectives, and abilities of the attacker this kill chain may happen very quickly or may take months to years to accomplish. Sometimes an attack is to simply disrupt a business competitor or political adversary. Attacks like this are generally carried out through Distributed Denial of Service (DDoS) attacks or website defacement. Other attacks are performed with the intent of gaining intelligence about a competitor or government agency, and yet others are to steal intellectual property, harass someone, or to support a political ideology (hacktivism).

The attack kill chain is comprised of the following steps:
1. The target is defined: This may simply be a target of opportunity (e.g., a person in close proximity to a hacker that has a vulnerable mobile device) or could be targeted due to the person’s position, the value of their data, etc

2. Reconnaissance: The attacker begins to research the target. What information is available via public open source intelligence (OSINT) such as Facebook, LinkedIn, Google, public databases, etc. What IP addresses are assigned to the target, what operating systems do they use, and are there any known vulnerabilities for the target’s Internet connected systems?

3. Weaponization: The attacker develops their weaponized attack, which is generally malware (malicious software) such as a Trojan horse, virus, ransomware, worm, etc. or may utilize a previously unpublished exploit known as a zero-day (0-day). The weapon must be able to exploit a vulnerability, which is what the attacker discovers during the recon stage.

  1. Delivery: The attacker delivers the payload to the victim. This may be done in a variety of ways such as via an email attachment or embedded link (phishing), through a chat session, uploading a file to a server on the Internet, compromising a website and then sending the victim to the compromised website (also called drive-by attacks), or several other methods.5. Exploitation: Once the payload has been delivered, the malicious code must execute to exploit the system. Malicious code can be executed by the attacker, by the system itself, or frequently by a user who clicks something and executes the malware.

    6. Installation: After the vulnerability is exploited the malware is installed on the system. Most attackers want one thing: persistence. They want to get on a system and stay on a system, having the ability to do internal recon now that they are inside the network and laterally move to other systems to stay within the network and spread their attack. Some advanced malware only lives in RAM and never actually “installs” on a hard drive, making post-mortem examinations of systems difficult.

    7. Command & Control: Once the malware is installed it generally opens up the system to receive commands from the attacker (known as Command & Control, or C2). Malware may “phone home” occasionally asking for any new commands from the C2 which may tell the malware to perform functions such as copy and send data from the computer to the attacker’s system, activate the system’s webcam, or any number of other things.

    8. Exfiltration: Generally the main goal, this is the step where the attacker gets access to data and begins sending (exfiltrating) the data from the system to the attacker.

Source ~ Event Tracker

There are several ways to make yourself less susceptible to a cyberattack, such as reducing the attack surface, target hardening, and learning how to identify potentially dangerous situations online or in emails.

A Practical Scenario

An author is putting their finishing touches on their latest work in preparation of sending it off for review. This author is somewhat controversial and critics are anticipating the release of the new book, posting negative comments all across the Internet. A hacker decides to make a statement by attempting to hack this author’s computer and disrupt the author’s ability to publish the book as well as steal a copy of the book before it is released. Step 1, target acquisition is complete.

The hacker begins by finding out as much as possible about the author through social media, Internet posts, interviews, and any other source of OSINT. The hacker is able to determine through social media that the author has a daughter in the fourth grade and because of geotagged photos posted of the author’s daughter, the hacker determines what school the daughter attends. The hacker now downloads the logo of the elementary school as well as an offline copy of the school’s website. Step 2, reconnaissance is complete.

The hacker obtains a variant of ransomware from a hacker website and places the malicious code on a server controlled by the hacker and sitting inside of Amazon Web Services (AWS). The malicious code is just waiting to be downloaded and executed by anyone who visits the server. Step 3, weaponization is complete.

Next, the hacker drafts an email using the same logo, colors, and “look and feel” of the elementary school’s website. The hacker addresses the email to the author’s email address (which was obtained via Google) and sends an email to the author during school hours that there has been an active shooter incident at the school. Included in the email is a link that tells the author to click for further details.

As any parent would, the author clicks the link of the email. When the author clicks the link, they are directed to a webpage that looks exactly like the school’s site. They receive some bothersome pop-up that the don’t read because they are terrified about their child’s safety and just click “ok” to close the window and see what is going on at the school. In reality, when the author clicked the link they navigated to a fake site hosted by the attacker and their computer downloaded the ransomware code. When the code attempted to execute, a pop-up appeared asking for administrative privileges to execute the code. When the author clicked “ok” they just executed the ransomware on their computer. Steps 4, 5, and 6 (delivery, exploitation, and installation) are complete.

The ransomware on the author’s computer begins immediately encrypting data on the hard drive and searches the drive for any .doc or .docx files, compresses them, and exfiltrates them to the attackers C2 server located in AWS. The author has now lost their latest manuscript and cannot access any files on their computer due to the ransomware encryption. Steps 7 and 8 (C2 and exfiltration) are complete.

This scenario is exactly the kind of targeted social engineering attacks that occur on a daily basis and are extremely easy to perpetrate. In future blog posts I will discuss how to recognize attacks and how to harden your systems to try and prevent malicious activity.

About the author:

Josh Moulin serves as a trusted advisor to federal government IT and cybersecurity executives with the world’s leading IT advisory and research firm. Previously, Moulin was the Chief Information Officer for the Nevada National Security Site, part of the U.S. Department of Energy’s Nuclear Weapons Complex and before that spent 11 years in law enforcement including 7 years as the commander of a cybercrimes task force.

Moulin has a Master’s Degree in Information Security and Assurance and has over a dozen certifications in law enforcement, digital forensics, and cybersecurity including as a Certified Ethical Hacker. For more information, visit JoshMoulin.com or connect with him on LinkedIn or Twitter.

L.A. Sartor

If you love stories filled with suspense, adventure, fighting against all odds and winning love, then please click here to visit the website of author L.A. Sartor. You’ll be glad you did!

/by

Josh Moulin: Who Are You Allowing in Your House at Night?

Josh Moulin

If I were to ask you to install an exterior door in your child’s bedroom and told you that this door could not have any locks, alarms, or other security, how would you react?  Most people would be uncomfortable with an unlocked door anywhere in their house and especially in their child’s room.  How could a parent properly protect their child if strangers on the outside could walk right in?  How would parents get alerted if someone had entered the child’s bedroom?  This scenario might seem crazy or even rise to the level of negligence.  The risks to the child could be anywhere from a simple burglary to physical assault, sexual assault, kidnap, and even murder and could extend beyond the child to any other occupants of the house.

Internet Safety for Children

The thought of this is disturbing and it is hard to imagine any parent would be this careless.  Unfortunately though, there are homes in nearly every neighborhood in our country with unlocked and unmonitored doors.  These doors are not your traditional doors though, these are virtual doors disguised as computers, tablets, smartphones, smart TVs, and a host of other gadgets referred to as the Internet of Things (IoT).

Most parents teach their children common safety messages to keep them safe: look both ways before you cross the street, don’t go anywhere with a stranger, don’t touch the stove because it could be hot, etc.  But what do many parents teach their kids about Facebook, Snapchat, Kik, instant messaging, texting, or web surfing?  In my experience as a career technologist and former law enforcement investigator of cybercrime, parents rarely have this kind of dialog with their kids.  Stranger abductions of children are incredibly rare (less than 1% of all kidnappings), yet parents spend a great deal of time talking about stranger-danger with their kids and completely miss the much bigger and more common risk of online predators.

Picture 2

I cringe when I hear parents ask what kind of smartphone they should buy their tween, or I see kids walking to the local elementary school staring at their smart devices along the way.  In a recent study, it was found that 21% of kids in kindergarten to second grade have cell phones!  I completely understand the need for parents to contact their children, but does that really need to include a data plan and 12 megapixel camera?  Any of these Internet capable devices are a portal to the world and kids who do not yet understand the consequences of their actions can quickly make fatal errors.  The social impacts and long-term exposure to this technology aside, kids don’t need $800 smartphones to remain in contact or to use during an emergency.  Believe it or not, cell phone providers do still make basic phones especially for kids.

Child Predators Use the Internet

The risks associated with kids and technology are not born from my paranoia or hypothetical scenarios I have dreamt up over the years.  During my career I have seen firsthand the devastation brought to children and families from having an unlocked virtual door to a child’s bedroom.  In one such case, an adult man lured an autistic 14-year-old girl over the Internet.  This man used online gaming as his method of choice.  Over the course of a few weeks he established a rapport with her and kept her distracted with the game (World of Warcraft), while he asked seemingly innocuous questions spread over time to not be obvious.  Questions like what her parents did for work, what their schedules were, where she lived, and what school she went to were asked of her.  The suspect recorded these answers within the dossier he was building on this girl.  As the two communicated via voice chat in the game, she thought she had found a great friend.  What she did not realize was that this man had no interest in World of Warcraft or being her friend.  That realization became apparent the day he showed up at her front door when she was home alone.  This man arrived from out of state when he knew her parents would be at work and he kidnapped her.

When the police was notified of her kidnapping they began searching and luckily found the vehicle several hours later in a different state as it was traveling on the freeway.  I remember getting a phone call on a weekend about this case and was asked to assist the agency that stopped the suspect’s vehicle.  They had taken the male suspect into custody and the girl was safely with child welfare.  I conducted a forensic analysis of the suspect’s multiple computers he had in his truck as well as searched the truck itself.  In the back of this truck was rope, knives, sex toys, and a mattress.  I have always believed that if this man would not have been stopped, that young girl would have been raped, tortured, and killed.

In another case I investigated, an adult man was searching for young boys in chatrooms and other online venues.  He knew exactly the type of boys to target and could quickly establish rapports with them.  After having sexually explicit chats with these boys, he would ask them to send nude images of themselves to him.  If the boys refused, the suspect told them that he was a police officer and had already traced their Internet connection back to their physical address.  The suspect told them that if they did not send the pictures, he would show up to their home and tell their parents that they were homosexual. Out of fear of embarrassment, almost every boy was coerced into send the images to this man.  In many cases, he continued the blackmail and had young boys travel to his home where he would sexually abuse them.  He often would send money to these boys to facilitate getting them to his home.

These two examples drive home my point, but unfortunately I have many more stories; some of which have worse outcomes.  On so many occasions parents would tell me they had no idea that their kids were on the Internet, or that they couldn’t keep up with all the technology.  I argue that parents have a duty and obligation to protect their children from danger and simply saying they don’t understand technology does not suffice.  Parents either need to learn the technology or not allow their children to use it.  Before parents allow technology to be introduced to their child or home, they should understand what the device is capable of and how to secure it.

Internet Safety Precautions

If you are interested in protecting your own family or help someone else with their children, here are some high level suggestions that you can take:

  1. Limit Access: No computers, laptops, tablets, iPhones, smartphones, Xboxes, or other Internet capable devices are allowed in kids rooms, period.
  2. Have Oversight: Computers are located in a common area of the home that can easily be seen by adults at a moment’s notice.
  3. Least Privileged Access: Kids have a separate non-administrative account on computers so they cannot change settings or install software.
  4. Protect Passwords: Kids do not know parent’s passwords.  Change your passwords and PINs occasionally.
  5. Start the Dialog: Parents need to have real and frank conversations with their kids about Internet safety and what kind of sexual predators exist in the world. Most kids do not tell their parents when something makes them feel uncomfortable online because the kids are embarrassed, don’t want to get in trouble, or don’t think their parents will understand the technical pieces of what happened.  Parents must build trust and have these discussions often.
  6. Know Their “Friends”: If children are allowed on social media, parents should have full access to the profiles and ensure that any “friend” is someone they actually know in real life.  A 14-year-old probably doesn’t have 750 real friends.  It should not be thought of as a popularity contest.
  7. No Cameras Allowed: 22% of girls have posted nude images of themselves online or sent them to another person.  Having kids and cameras together is an exceptionally bad combination.  I have investigated cases of girls as young as 10 taking nude images of themselves and sending them to adult males.
  8. Use Parental Controls: Both Mac and PCs have excellent parental controls.  Lock down what websites kids can go to, what times they are allowed online, and who they can communicate with.  Make sure kids can’t sneak devices into their room at night, or go out to the family PC while everyone is asleep.
  9. Review their Browsing Habits: 90% of children ages 8-16 have viewed online pornography, the largest group of Internet pornography consumers are ages 12-17, and 70% of kids ages 7-18 have accidentally encountered pornography while searching for unrelated material.  Know what kids are looking for and looking at.  Examine Internet history on browsers to see where kids are going.  If Internet history is being deleted, ask why.  There are other ways to capture Internet history at the home router level too, which kids would should not have access to or be able to manipulate those logs.
  10. Use Internet Filtering Solutions: Implement technical controls both on the device (e.g., parental controls) but also on the home Internet connection.  OpenDNS is an awesome way to do this, see this blog post for more:  http://www.joshmoulin.com/protecting-your-family-against-inappropriate-internet-content/  This can prevent children from accidentally coming across inappropriate content and block intentional access to sites.
  11. Thing About All Sites: Think YouTube and Flickr are educational and should be OK for your kids to have access to?  Think again, these sites are full of nudity, sexual content, violence, and many other categories of inappropriate content.  If there are videos that your child needs access to, give them access to just the URL of that video in YouTube and block everything else.
  12. Internet Rules are for Everywhere: The rules established about appropriate Internet behavior must be for the Internet, not just within a home.  Many kids find themselves in trouble while at a friend’s house or somewhere outside of the home.  Make sure they understand the family acceptable use policy applies anywhere.
  13. Parents get Full Access: Frequently review their social media pages, posts, pictures, and sites.  Ensure there is nothing that could be considered cyberbullying or that a sexual predator could use to find out where the child goes to school, lives, or works.  Limit personal information such as birthdays and phone numbers and check the background of images and videos to make sure there are no hints that could lead a predator to the child.  Also consider Exif data in images that may lead someone directly to the front door (for more on this, see this blog post: http://www.joshmoulin.com/how-digital-pictures-and-videos-can-be-a-threat-to-privacy/)
  14. Understand the Technology: Ignorance is no longer a viable option.  There are many resources for parents to learn about technology and how to protect their child, some of which are provided in this post.  A simple Google search for protecting kids online would be a great start.
  15. Consider Internet Monitoring Software: There are software products on the market that are designed to covertly monitor kids’ activity online and provide reports.  These programs can be helpful and range from free software to paid commercial products.
  16. Ensure Profiles are set to Private: Utilize privacy settings on social media and make sure all privacy settings made available are enabled.

Picture3

While apps and websites may change names, the principles and mitigating controls are the same. If parents teach kids how to use technology responsibly, have frequent communication with their kids, and follow the steps outlined above, the virtual door can be closed.  Technology can be amazing and kids must know how to use it properly to be successful as they grow older and prepare for college and their careers.  By taking the time to implement what is suggested here and balancing the convenience of technology access with the security controls to make it safe, kids can have a healthy relationship with the Internet and devices.

 

~

Picture4Josh Moulin is the Chief Information Officer (CIO) for the Nevada National Security Site (NNSS), part of the U.S. Department of Energy/National Nuclear Security Administration’s nuclear weapons complex.  The NNSS is a 1360 square-mile remote and highly secure area outside of Las Vegas, NV that provides arms control, emergency response, counterterrorism, weapons testing, nuclear nonproliferation, nuclear stockpile stewardship, and special technology development among other national security significant missions.  Josh and his team of 140 IT and cybersecurity experts support and protect some of the nation’s most critical assets with classified and unclassified networks that span the country.  Josh has a Master’s Degree in Information Security and Assurance, holds multiple industry certifications, and has a Top Secret security clearance.  Prior to joining the NNSS in 2012, Josh spent 11 years in law enforcement with his last assignment as a police lieutenant and commander of a FBI cybercrime task force.  The views expressed here belong to Josh Moulin alone and do not necessarily reflect the views of his employer.

Website: https://JoshMoulin.com

LinkedIn: https://www.linkedin.com/in/joshmoulin

Twitter: https://twitter.com/joshmoulin

position: absolute; opacity: 1; z-index: 8675309; display: none; cursor: pointer; top: 36px; left: 20px;”>Save

/by

Josh Moulin: Who Are You Allowing in Your House at Night?

Josh Moulin

 

If I were to ask you to install an exterior door in your child’s bedroom and told you that this door could not have any locks, alarms, or other security, how would you react?  Most people would be uncomfortable with an unlocked door anywhere in their house and especially in their child’s room.  How could a parent properly protect their child if strangers on the outside could walk right in?  How would parents get alerted if someone had entered the child’s bedroom?  This scenario might seem crazy or even rise to the level of negligence.  The risks to the child could be anywhere from a simple burglary to physical assault, sexual assault, kidnap, and even murder and could extend beyond the child to any other occupants of the house.

The thought of this is disturbing and it is hard to imagine any parent would be this careless.  Unfortunately though, there are homes in nearly every neighborhood in our country with unlocked and unmonitored doors.  These doors are not your traditional doors though, these are virtual doors disguised as computers, tablets, smartphones, smart TVs, and a host of other gadgets referred to as the Internet of Things (IoT).

Most parents teach their children common safety messages to keep them safe: look both ways before you cross the street, don’t go anywhere with a stranger, don’t touch the stove because it could be hot, etc.  But what do many parents teach their kids about Facebook, Snapchat, Kik, instant messaging, texting, or web surfing?  In my experience as a career technologist and former law enforcement investigator of cybercrime, parents rarely have this kind of dialog with their kids.  Stranger abductions of children are incredibly rare (less than 1% of all kidnappings), yet parents spend a great deal of time talking about stranger-danger with their kids and completely miss the much bigger and more common risk of online predators.

24

I cringe when I hear parents ask what kind of smartphone they should buy their tween, or I see kids walking to the local elementary school staring at their smart devices along the way.  In a recent study, it was found that 21% of kids in kindergarten to second grade have cell phones!  I completely understand the need for parents to contact their children, but does that really need to include a data plan and 12 megapixel camera?  Any of these Internet capable devices are a portal to the world and kids who do not yet understand the consequences of their actions can quickly make fatal errors.  The social impacts and long-term exposure to this technology aside, kids don’t need $800 smartphones to remain in contact or to use during an emergency.  Believe it or not, cell phone providers do still make basic phones especially for kids.

The risks associated with kids and technology are not born from my paranoia or hypothetical scenarios I have dreamt up over the years.  During my career I have seen firsthand the devastation brought to children and families from having an unlocked virtual door to a child’s bedroom.  In one such case, an adult man lured an autistic 14-year-old girl over the Internet.  This man used online gaming as his method of choice.  Over the course of a few weeks he established a rapport with her and kept her distracted with the game (World of Warcraft), while he asked seemingly innocuous questions spread over time to not be obvious.  Questions like what her parents did for work, what their schedules were, where she lived, and what school she went to were asked of her.  The suspect recorded these answers within the dossier he was building on this girl.  As the two communicated via voice chat in the game, she thought she had found a great friend.  What she did not realize was that this man had no interest in World of Warcraft or being her friend.  That realization became apparent the day he showed up at her front door when she was home alone.  This man arrived from out of state when he knew her parents would be at work and he kidnapped her.

When the police was notified of her kidnapping they began searching and luckily found the vehicle several hours later in a different state as it was traveling on the freeway.  I remember getting a phone call on a weekend about this case and was asked to assist the agency that stopped the suspect’s vehicle.  They had taken the male suspect into custody and the girl was safely with child welfare.  I conducted a forensic analysis of the suspect’s multiple computers he had in his truck as well as searched the truck itself.  In the back of this truck was rope, knives, sex toys, and a mattress.  I have always believed that if this man would not have been stopped, that young girl would have been raped, tortured, and killed.

In another case I investigated, an adult man was searching for young boys in chatrooms and other online venues.  He knew exactly the type of boys to target and could quickly establish rapports with them.  After having sexually explicit chats with these boys, he would ask them to send nude images of themselves to him.  If the boys refused, the suspect told them that he was a police officer and had already traced their Internet connection back to their physical address.  The suspect told them that if they did not send the pictures, he would show up to their home and tell their parents that they were homosexual. Out of fear of embarrassment, almost every boy was coerced into send the images to this man.  In many cases, he continued the blackmail and had young boys travel to his home where he would sexually abuse them.  He often would send money to these boys to facilitate getting them to his home.

These two examples drive home my point, but unfortunately I have many more stories; some of which have worse outcomes.  On so many occasions parents would tell me they had no idea that their kids were on the Internet, or that they couldn’t keep up with all the technology.  I argue that parents have a duty and obligation to protect their children from danger and simply saying they don’t understand technology does not suffice.  Parents either need to learn the technology or not allow their children to use it.  Before parents allow technology to be introduced to their child or home, they should understand what the device is capable of and how to secure it.

If you are interested in protecting your own family or help someone else with their children, here are some high level suggestions that you can take:

  1. Limit Access: No computers, laptops, tablets, iPhones, smartphones, Xboxes, or other Internet capable devices are allowed in kids rooms, period.
  2. Have Oversight: Computers are located in a common area of the home that can easily be seen by adults at a moment’s notice.
  3. Least Privileged Access: Kids have a separate non-administrative account on computers so they cannot change settings or install software.
  4. Protect Passwords: Kids do not know parent’s passwords.  Change your passwords and PINs occasionally.
  5. Start the Dialog: Parents need to have real and frank conversations with their kids about Internet safety and what kind of sexual predators exist in the world. Most kids do not tell their parents when something makes them feel uncomfortable online because the kids are embarrassed, don’t want to get in trouble, or don’t think their parents will understand the technical pieces of what happened.  Parents must build trust and have these discussions often.
  6. Know Their “Friends”: If children are allowed on social media, parents should have full access to the profiles and ensure that any “friend” is someone they actually know in real life.  A 14-year-old probably doesn’t have 750 real friends.  It should not be thought of as a popularity contest.
  7. No Cameras Allowed: 22% of girls have posted nude images of themselves online or sent them to another person.  Having kids and cameras together is an exceptionally bad combination.  I have investigated cases of girls as young as 10 taking nude images of themselves and sending them to adult males.
  8. Use Parental Controls: Both Mac and PCs have excellent parental controls.  Lock down what websites kids can go to, what times they are allowed online, and who they can communicate with.  Make sure kids can’t sneak devices into their room at night, or go out to the family PC while everyone is asleep.
  9. Review their Browsing Habits: 90% of children ages 8-16 have viewed online pornography, the largest group of Internet pornography consumers are ages 12-17, and 70% of kids ages 7-18 have accidentally encountered pornography while searching for unrelated material.  Know what kids are looking for and looking at.  Examine Internet history on browsers to see where kids are going.  If Internet history is being deleted, ask why.  There are other ways to capture Internet history at the home router level too, which kids would should not have access to or be able to manipulate those logs.
  10. Use Internet Filtering Solutions: Implement technical controls both on the device (e.g., parental controls) but also on the home Internet connection.  OpenDNS is an awesome way to do this, see this blog post for more:  http://www.joshmoulin.com/protecting-your-family-against-inappropriate-internet-content/  This can prevent children from accidentally coming across inappropriate content and block intentional access to sites.
  11. Thing About All Sites: Think YouTube and Flickr are educational and should be OK for your kids to have access to?  Think again, these sites are full of nudity, sexual content, violence, and many other categories of inappropriate content.  If there are videos that your child needs access to, give them access to just the URL of that video in YouTube and block everything else.
  12. Internet Rules are for Everywhere: The rules established about appropriate Internet behavior must be for the Internet, not just within a home.  Many kids find themselves in trouble while at a friend’s house or somewhere outside of the home.  Make sure they understand the family acceptable use policy applies anywhere.
  13. Parents get Full Access: Frequently review their social media pages, posts, pictures, and sites.  Ensure there is nothing that could be considered cyberbullying or that a sexual predator could use to find out where the child goes to school, lives, or works.  Limit personal information such as birthdays and phone numbers and check the background of images and videos to make sure there are no hints that could lead a predator to the child.  Also consider Exif data in images that may lead someone directly to the front door (for more on this, see this blog post: http://www.joshmoulin.com/how-digital-pictures-and-videos-can-be-a-threat-to-privacy/)
  14. Understand the Technology: Ignorance is no longer a viable option.  There are many resources for parents to learn about technology and how to protect their child, some of which are provided in this post.  A simple Google search for protecting kids online would be a great start.
  15. Consider Internet Monitoring Software: There are software products on the market that are designed to covertly monitor kids’ activity online and provide reports.  These programs can be helpful and range from free software to paid commercial products.
  16. Ensure Profiles are set to Private: Utilize privacy settings on social media and make sure all privacy settings made available are enabled.

45

While apps and websites may change names, the principles and mitigating controls are the same. If parents teach kids how to use technology responsibly, have frequent communication with their kids, and follow the steps outlined above, the virtual door can be closed.  Technology can be amazing and kids must know how to use it properly to be successful as they grow older and prepare for college and their careers.  By taking the time to implement what is suggested here and balancing the convenience of technology access with the security controls to make it safe, kids can have a healthy relationship with the Internet and devices.

~

 64

Josh Moulin is a federal defense contractor and Chief Information Officer (CIO) of an agency with a national security mission, overseeing all classified and unclassified IT and cybersecurity functions for the agency that spans the country.  Josh has been recognized nationally and in courtrooms as an expert in the areas of digital forensics, cybercrime, and cybersecurity.  He spent 11 years in law enforcement with his last assignment as a police lieutenant and commander of an FBI cybercrimes task force, investigating hundreds of complex high-tech crimes.  Josh has a Master’s Degree in Information Security and Assurance and holds multiple certifications in law enforcement, forensics, hacking, and cybersecurity.

Website:  www.JoshMoulin.com

LinkedIn:  https://www.linkedin.com/in/joshmoulin

Twitter:  https://twitter.com/JoshMoulin

/by

Josh Moulin: Electronic Surveillance and Hacking with Drones

Josh Moulin: Electronic Surveillance

A few weeks ago I attended the Black Hat hacker conference in Las Vegas and one of the hot topics was the use of drones for electronic surveillance. Drones, also known as unmanned aerial vehicles (UAV) or unmanned aircraft systems (UAS) are being used for many purposes, some of which include cyber-attacks.

11
Drone equipped with a wireless “Pineapple” device designed to capture wireless traffic

One way that UAS’ are used for cyber-attacks is by equipping the UAS with equipment known as a wireless Pineapple. The Pineapple is designed to mimic a legitimate wireless access point and can even target specific mobile devices. When attached to a UAS, a cyber-criminal could hover over a home, business, or other location and have Internet capable devices begin to associate with it. The Pineapple device can perform what is called a “Man-in-the-Middle” (MiTM) attack against a mobile device, meaning that it can capture Internet traffic between the device and the Internet gateway and manipulate the traffic. This is just one of numerous attacks these devices can be used for.

A hacker can launch attacks such as IP redirection, DNS spoofing, injecting malicious code into a traffic stream, and other manipulation of data. For example, an iPhone user may connect to a Pineapple and type in www.google.com on their phone. When the iPhone passes that request to the Pineapple, an attacker could manipulate the Domain Name Service (DNS) response and instead of sending the iPhone to the real Google page, it sends the user to a fake Google page. When the iPhone user sees the Google page that is actually coming from a hacker’s server instead of Google, they believe it is real and begin to enter data into it. All of this data is collected by the hacker and could include any number of important details. While Google might be a benign example, an attacker could easily do this for financial websites, healthcare websites, and others, allowing an attacker to harvest user credentials. This is often called website scraping, DNS redirection attacks, and pharming.

12
Wireless Pineapple Device

Another troubling example of how a UAS equipped with a Pineapple device could be used against the government, businesses, or individuals is by dropping drones onto buildings and collecting wireless Internet traffic. Just imagine a hacker flying a UAS under the cover of darkness and landing it on the roof of an institution. When employees begin to arrive at work, they may have various personal and business systems associate with the Pineapple. Even if nothing associates with the Pineapple, it will still promiscuously sniff and record the wireless traffic in the area. When the hacker is done collecting information, the UAS takes off from the building at night again and returns to the hacker.

13
One of the classes at the Black Hat conference – Mandalay Bay in Las Vegas, 2015

The use of UAS for reconnaissance whether it is with high-definition video or sniffing wireless Internet traffic is a real threat. I think drones have many great use cases, but like any other technology, criminals quickly identify ways to exploit it.

*     *     *

66
Josh Moulin is a cyber security and digital forensics expert who leads a team of defense contractors that protect some of the nation’s most critical national security programs for a United States federal agency. Josh has a Master’s of Science in Information Security and Assurance and holds multiple digital forensics, cyber security, and law enforcement certifications. Prior to working with the federal government, Josh spent 11 years in law enforcement with his last assignment as a lieutenant and commander of a FBI cyber crimes task force.

Website: www.JoshMoulin.com
LinkedIn: https://www.linkedin.com/in/joshmoulin
Twitter: https://twitter.com/joshmoulin
Google+: https://plus.google.com/+JoshMoulin0

/by

Josh Moulin: The Night a Suspect Begged Me to Kill Him

Josh Moulin: Electronic Surveillance

It was a warm August night and I was one of two officers working the graveyard shift in the city. I decided to drive through the local truck stop parking lot while patrolling the city as it was normally a good place to find all sorts of interesting activity (which could be an entire blog post by itself) when I heard on my radio that the fire department was getting sent to a grass fire not too far from me. I made it a habit to always scan the fire and EMS channels because I would often get a head start on vehicle crashes, house fires, and other emergencies. It was fire season, but grass fires at 3:00 in the morning didn’t happen often. Something just didn’t sound right, so I decided to cruise over to the area and check things out.

11
Parking lot of the truck stop I was in when the fire call came in.

The fire was in one of the rural sections of my jurisdiction. My headlights lit the rural two-lane road ahead of me and I was several minutes ahead of the first arriving fire engine. There was no other traffic, so I did not turn on any of my emergency lights or siren. As I got closer to the address of the fire, I could begin to see a glow off to my left in what appeared to be the middle of nowhere. Several dirt roads left the highway in the general direction of the fire and I picked what I thought was the correct road.

The grass on either side of the dirt road was so tall that I could not see very far in either direction. As I continued down the dirt road it finally opened up in a parking area next to home. Just as I arrived, a female walked out of the house holding a cordless phone and she pointed to my left. As I looked over, I could now see flames and I realized I had paralleled the dirt road that led directly to the location of the fire. All I could see next to the flames was a pair of headlights and now my curiosity was peaked. The woman at the house told me that she had called 9-1-1 after hearing the car drive down the dirt road and seeing flames shortly thereafter. I thanked her and turned my patrol car around to get to the fire scene.

As my headlights panned across the fire I noticed the vehicle next to the fire was also turning around. I started traveling back up the pothole filled dirt road and through the grass I could now see headlights paralleling me and beginning to pass me. I notified dispatch of the situation and began to drive faster, keeping up with the mysterious headlights to my right.

12
Just as I got to the highway, I saw a large cloud of dust and a car turning onto the roadway in front of me. I turned on my emergency lights and immediately the chase was on. The car pulled away from me like I was standing still. I turned on my siren and pushed my Crown Victoria police car, getting to 90 MPH by the time I was at the driveway the car pulled out of. My mind was racing as fast as my car was as I told dispatch what was going on and that I was in pursuit. What was this person doing? What was on fire? Why are they running? How many people are in the car that I’m chasing?

I finally caught up to the speeding car and radioed my location to dispatch. We were getting into the city limits now, forcing the car to slow down and letting me take advantage of the streetlights. I could now see I was chasing a sedan and it appeared that there was only one occupant. The driver slowed for a stop sign at a “T” intersection and then made a right turn and an immediate left. The driver must have thought he was turning on another street, but unfortunately for him he had turned into a driveway.

I pulled my patrol car directly behind the suspect’s vehicle and got out of my car with my Glock in hand. I conducted a felony car stop, issuing orders to the driver of the vehicle to put his hands up and turn the vehicle off. The driver was unresponsive and suddenly the driver’s door flung open and the driver, a white male adult, jumped out of the car. I now had my gun trained on the suspect in the low-ready position. I continued yelling commands at the driver to get on the ground and he refused.

The driver started walking toward me as he reached into an inner pocket of his jacket. The suspect was yelling at me to shoot and kill him as he continued to get closer to me. What in reality took only seconds seemed to take minutes as my fight-or-flight response took over. My peripheral vision was narrowing and I was solely focused on the suspect’s hands. My training was beginning to flash through my mind as I felt my trigger finger leaving the outside of the trigger guard and moving onto the trigger. This is one of the few times in my career where my finger would be inside the trigger guard.

The suspect’s hand emerged from his jacket and it was empty. He was now to the hood of my car and closing in on me fast, still refusing all of my commands. I decided to holster my Glock and pull out my Oleoresin Capsicum (OC) spray. I sprayed the suspect with the 10% foam mixture OC directly in his face. The suspect wiped the foam from his face and continued toward my direction. I closed the driver’s door of my patrol car and ran around behind my car to the passenger’s door. I reached inside of my car and grabbed a M-26 Taser from my patrol bag (this was before the days of Taser’s being small enough to wear on an officer’s belt). The suspect was blinded by the OC, but had not yet stopped.

33
M26 Taser

As the suspect began to run into the street, I continued ordering him to stop. He refused, forcing me to use the Taser, stopping him from blindly running into a four-lane highway. The suspect fell to the ground as the five-second Taser shot continued. I radioed to dispatch letting them know of what was going and waited for the backup officer to arrive before taking the suspect in custody. As the fire engines passed us responding to the grass fire, the suspect began trying to get up. I had to pull the Taser trigger a total of three times keeping the suspect down until my backup arrived.

As soon as my cover officer arrived, we placed the suspect into custody and he began having a life threatening reaction to the OC spray. I grabbed the garden hose from the house we were in front of and began rinsing his face as I requested an ambulance respond to our scene. The suspect was transported to the hospital and eventually lodged in jail later in the afternoon.

The subsequent investigation revealed that the suspect had recently been released from jail. As the suspect walked from the jail he stole a truck from a local car dealership. He drove the stolen truck to a field near his house, walked home and got another car from his house and drove that to the field as well, driving it into a large ditch. He then stole another car from the area and drove that back to the field. He then lit the stolen truck on fire, left his other car in the ditch and was preparing to leave when I arrived. The suspect was ultimately convicted of his crimes.

44
Part of a local newspaper story about this case

Below is a link to the dispatch audio of this incident. My radio identifier was 6-paul-11, and you can hear me in a short vehicle and foot pursuit. The yelling in the background of one of my radio calls is the suspect being tased during the foot chase.

Moulin Radio Call

The local newspaper editor wrote an opinion piece about this case and how the outcome was much different than many suicide-by-cop cases.

55

                www.mailtribune.com/article/20040825/OPINION02/308259986

*     *     *

66
Josh Moulin is a cyber security and digital forensics expert who leads a team of defense contractors that protect some of the nation’s most critical national security programs for a United States federal agency. Josh has a Master’s of Science in Information Security and Assurance and holds multiple digital forensics, cyber security, and law enforcement certifications. Prior to working with the federal government, Josh spent 11 years in law enforcement with his last assignment as a lieutenant and commander of a FBI cyber crimes task force.

Website: www.JoshMoulin.com
LinkedIn: https://www.linkedin.com/in/joshmoulin
Twitter: https://twitter.com/joshmoulin
Google+: https://plus.google.com/+JoshMoulin0

/by