Attacking Through Emails


Email Scams





ch 3 - scam






ch 3 - linked in




ch 3 - boa




ch 3 - chase








Spear Phishing



Increasingly, the board of directors is the target.22








Spear Phishing for a Fund Transfer Scam










Attacking Through the Internet of Things (IoT)


Video Cameras






Cell phone Fingerprint Reader



1) Use the fingerprint reader AND a login for access.

Medical Sensors















Threat Vectors – Part I – Internal



Insider Threat

  • Sale of credentials
  • Planted malware
  • Theft of Data, IP etc.
  • Scams

User Error

  • Click on Bad Link
  • Phishing
  • Downloading infected apps
  • Installing plug-ins/modules that have malware
  • Accidental transmission of data/msg to the wrong target

Bad Device

  • BYOD
  • USB

Physical Theft/Loss


Insider Threat








User Error







Bad Device




Physical Theft/Loss





Why do I Care about Cyber Security?

Good cyber security is tedious and expensive.  The alternative is loss of customer goodwill and potential closing of the business. On the personal side, the inconvenience of identity theft, data loss, invasion of privacy etc. exact a toll both financially and time wise.   The result is an unfair burden on small businesses and individuals.  It is important to recognize this is the way it is, the world we live in, and accept a personal, even if limited, role in being a good data steward and protector.  To that end, this post discusses a select few of the cyber security incidents of the last couple of years in various categories.

By being aware of the targets, attacks, and defensive tools you have, you can diminish the hacker’s perceived relative gain for the time spent.  For example, if a hacker determined that he/she was only making a few cents/hour for the time spent, they would find something more lucrative to do. In time, this will reduce the sheer number of hackers and attacks, and make it easier to track down and defend against the remaining bad guys.


Ransomware is the software that encrypts all the contents of a hard drive and then extorts payment, usually in bitcoins in order to get the unlock code.  Some ransomware will also encrypt any attached backup drives.  Ransomware can and has happened to many individuals and recently to several hospitals.  This a very lucrative area for the bad actors.  Some bad actors (bad guys/gals) even run ransomware help desks.   To pay or not to pay, that will be the dilemma when ransomware strikes you or your company.  Recently Atlanta, Georgia in the US chose not to pay.  The cost of recovery was over $2 million dollars.

Medical Records

Medical records are worth about 10x what credit card numbers are on the black market.  This is because the medical records can be used to file fraudulent claims. It takes much longer to realize your medical records have been compromised than for credit card numbers.  Combine this with the relatively poor cyber security of hospitals and hackers have a very lucrative market.

Note that medical records fall under HIPAA.  HIPPA is the Healthcare Information Privacy Protection Act and you probably signed a form at your doctor’s office acknowledging their collection of data about you.  Health providers are legally obligated to take reasonable steps to protect your healthcare information. Penalties are based on the level of negligence and can range from $100 to $50,000 per violation.  This is capped at $1.5 million per year for violations of each HIPAA provision.

HR Records

The largest HR records breach (break in with theft/manipulation of data) in history occurred in 2015 at the US government Office of Personnel Management or OPM for short.  This involved the theft of 21.5 million records along with 5.6 million fingerprint records.  It is rumored that the Chinese are using the information from these records to put together a “Facebook” of US government and military personnel that can be used to put pressure against them or co-opt them.  Keep in mind that these records contained the contents of the SF-86 which include information about more than the applicant, and include information about their extended families and neighbors.

This was a classic case of risk versus reward.  Enough golden eggs (records) existed in one place with the potential for enough damage that they were highly sought after and justified the expenditure of almost any effort to obtain them.

Access was obtained through a breach of a contractor, with less security, who had access.  Our side failed to encrypt the records, disperse the records, keep non-current records offline, and failed to detect the intrusion for a long period of time.

Customer Records

Target, the major retailer, was hacked on Black Friday in 2013.  Over 40 million debit card accounts were scooped up.  The data was not encrypted.  Groups of target customers filed suit claiming that “Target failed to implement and maintain reasonable security procedures and practices”.  Roll forward to 2015 and Target paid out $10 million to customers as a result of lawsuits.  This does not include the costs to notify, legal costs, and loss of good will among existing customers and their reputation in the marketplace.

US Infrastructure

The chief of the NSA (National Security Agency), Admiral Michael Rogers, said that it was a matter of when, not if a foreign nation-state launches a cyber attack on the US critical infrastructure.  This would include things like the electric grid, water, sewage, and traffic.  Even dams can be hacked.

In December, 2015 Ukraine suffered an electricity blackout of 225,000 customers.  It has been attributed to cyber attack via a Russian group.  In March, 2016 the US Justice Department indicted seven Iranian hackers.  Among their targets was a small dam, the Bowman Avenue Dam in New York.  If a gate had not been disconnected for maintenance, the hackers would have been able to manipulate it, dumping water downstream.

The US Power grid has been hit with an average of one cyber or physical attack every four days between fiscal 2011 and 2014.  The Pentagon estimates that a major cyber attack on the electric grid could take weeks to fix.

Is your business such that you need power from more than one utility?  Perhaps it would be wise to create another company location in another section of the power grid, unlikely to be affected by a regional disruption and able to take over the business should the need arise?


To the kid at the top who is yawning, hackers are stealing children identities because, based on age, they will be valid longer.  Better have your parents lock down your identity for you.  And, I hate to break this to you so early, but you are on the front line of the battle over cyber security — like it or not.



Hackers LOVE Social Media Posts

Suppose I asked you to provide this list of information on social media:

  1. Your Name
  2. Your pet’s names
  3. Your kid’s names and ages
  4. Where your kids go to school
  5. Where you went to school
  6. When your birthday is
  7. When your family member birthdays are
  8. Your gender
  9. Your family member genders
  10. Your race
  11. Your family member’s race
  12. Type of car you drive
  13. Type of car your spouse drives
  14. When you are on vacation
  15. Where you like to go when on vacation
  16. Where your kids catch the bus
  17. When your kids catch the bus
  18. What you like to buy
  19. What shows you like
  20. What books you like
  21. Who your friends are
  22. What type of political views you have
  23. What your house looks like inside
  24. What valuables you have in your house
  25. How old are you and each member of your home
  26. Your approximate household income
  27. Where you work
  28. Where your spouse works
  29. What music you like

Would you give it to me?  Or would you think me up to no good?  Sadly you have most likely given it away already or are in the process drip by drip.  Social Media can be a treasure trove of information for marketers but also hackers and other perps.  Let’s map the number above to actions you might take.

Unless you are up to no good, you probably set up an account using your real name. (1)  You probably also provided your birth date when you setup your account.  This is one piece needed for identity theft.

Let’s say that you post out photos of yourself (8,10).  Suppose a few were from when you are on vacation and you were smart enough to NOT post them until you returned home so as to not advertise you absence.  The GPS coordinates of each shot are imbedded in the photos so the perp knows each place you were while on vacation and when. (14, 15)

Your kids look so cute getting on the bus so you post a photo.  Again, the GPS information is in the photo so the perp knows the where and the when of waiting on a bus.  They can probably infer when they arrive from other posts you make. (16, 17)  From the time of arrival and the bus stop the perp can lookup bus routes and determine which school your kids go to.

You mention your car or post a photo of it while you are driving.  (12)  Eventually you post a shot of the front of you home and by elimination the perp can figure out which is your spouse’s car.

You are careful and never post your kid’s photos online but your family member’s aren’t and post photos of your whole family and then link the photo to you. (9, 11)

Post any photos taken inside your house?  Did you check what is showing in the background in the other room? (23, 24)  Did you post birthday photos of each child? (3, 25)  Don’t forget the pet, they are so cute! (2)

What do you post or share? (22)

Chat with friends from your high school or join a high school group? (5, 21)

Like to click on ads? (18)

From what you like to buy and photos inside your house and your cars and the house itself, your income can be inferred. (26)

To help people decide if they want to connect with you, you can display your favorite movies and books in your profile and even your favorite music. (19, 20, 29)

Every talk about your job or your spouse’s? (27, 28)

The hacker can now figure out how to answer your security questions and get your password.  The robber can now know when you aren’t home and if you have anything worth stealing and even where it is in your home.  The molester even knows how and when to get to your children.

Think you are safe because you only share with friends?  Think again.  Anything marketing firms can purchase, hacker and other perps can also purchase or steal.  I’m sure, you can come up with additional information not on this list that you have disclosed.  Don’t feel badly.  We have all done it.  Just think in the future what the information you provide might be used for.


Think your password is a good one?  We’ll see in this post.

Dictionary Attack

Lots of people use dictionary words for their password.  An example might be “nebraska” or “hamburger”.  These are easy for a computer to guess by running through the words in a dictionary and trying each rapidly as a password until a match is found.

Brute Force

Brute force is just that.  Think of it as instead of picking the lock, we smash through the door.  This is done by trying all possible passwords until a match is found.   Obviously the longer the password and the greater the possible characters to pick from, the harder it is to guess.  This is why a password that uses uppercase and lowercase letters and numbers and special characters is so hard to guess.


This is the use of cleverness in guessing the password.  Lots of times people use their birth date or their children’s birth date or their address as all or part of their password.   Even pet names are used. Or their social security number or part of it and so on.  This makes some passwords easy to guess.

Good and Bad Passwords

A good password is one that is hard to guess.  Without going into the math behind the permutations, suffice it to say, longer is harder to crack.  The more variety in characters, the harder as well.  For example, if each character of your password can only be lower case letters, then in America there would be 26 possible values for each character.  If you add capital letters, this goes to 52.  Add in numbers 0-9 and the possibilities are 62.  Add in special characters like: & * ( ) and the number of possible characters for each position in your password goes to 84.  This is why many places require you use an uppercase letter, a number and at least one special character in your password.

People often forget that their user name functions in a similar way to that of their password as most must be guessed.  Common user names are ‘admin’, the first initial and last name, the last name and first initial,, and guessable email addresses.

Smart Password Usage

Let’s assume your login/password is compromised, meaning a bad actor has it.  Did you use the same password for all your accounts?  Uh-oh, now they will run around trying it on all sorts of accounts where you might have left a credit card on file.  Bad Actor: “Let’s try Amazon and see if they have an account there with an active credit card, summer is coming up and I need some outdoor gear.”


  • 1) Use one password for all accounts that don’t have an associated credit card.
  • 2) Use a different password for each account with a credit card so, in case one is compromised, all aren’t.
  • 3) Use a strong password on the accounts with a credit card.
  • 4) Unless you use an account everyday to make purchases, consider not attaching a credit card and instead enter it at checkout.

Password Do’s and Don’ts

These are some rules to help you discover your passwords that are difficult for a hacker to determine:

  • Don’t use a family name / birthday as a password.
  • Don’t use the family pet name as a password.
  • Don’t use your banking PIN as a password.
  • Don’t use a password so complex that you have to keep it on a yellow sticky note on your screen.
  • Don’t use a dictionary word as your password.
  • Do use a password wallet like RoboFormTM.
  • Don’t share passwords.  If you must, change it afterwards.
  • Do change your password at least every 6 months or if you suspect or are notified of trouble with your account or a beach at the place where your account is.
  • Do use a password phrase you can remember like: snow7beach14!  Where your age is NOT 7 or 14.
  • Use a long password of at least 12 characters if you can.  (The one just above is 13 characters in length.)
  • If possible, don’t pick a user id associated with your name, address and so on.  Remember the user id works just like your password in that is too must be guessed.

RoboForm is a trademark of Siber Systems.


Football and Hacking

Think football.  The hackers are the other team.  The one wanting your data or to do damage to you.    They have different plays they run such as: denial of service (DDos) attacks, phishing / spear phishing, malware, social engineering, software / hardware flaws and/or insider threat.

You or your team (the home team, the good guys) need to stop the offensive or the bad guys win.  These are the things that can be done to prevent a cyber security breach.  They include: training/education, policies, law enforcement agreements, information sharing, threat intelligence, hardware/software, current patches and techniques to improve security, encrypted data and hard drives and phones, and counter intelligence.  Many of these will be covered in future posts. The reason defense is so hard is that the bad guys need to find a single opening while you have to defend hundreds or thousands of points in your network.

After an successful attack (post game), these are the things that must be addressed: forensics, legal, insurance (hopefully purchased before the attack), damage assessment, and target cleanup/validation.  In addition, one must examine policies and defenses to figure out what went wrong and how to do a better job next time.