Authentication , Endpoint Security , Fraud Management & Cybercrime

Never ascribe to advanced hackers that which can be adequately explained by the anger of a young man who turns poor password choices to his advantage.

See Also: Live Webinar | Sunset of Windows Server 2008: Migrate with Docker

That's one obvious takeaway from the "hackerangriff" - hacker attack - that resulted in the leak of personal contact details and other information for 1,000 German politicians, celebrities and journalists (see: German Police Identify Suspect Behind Massive Data Leak).

The dox - data leak - included private mobile phone numbers for some of the country's top political figures, as well as copies of sensitive chat messages and photographs of children, among other sensitive material.

The culprit appears to be what so many information security experts predicted: Not an "advanced persistent threat" - APT - hacker crew working from Russia or another nation-state, but rather the functional equivalent of an "advanced persistent teenager."

Indeed, police say that a 20-year-old man that they arrested on Sunday confessed to the crimes on Monday. Due to the suspect's age, he's set to be tried in juvenile court, where he faces a maximum three-year prison sentence (see: Germany's Mega-Leak Takeaway: Noisy Young Hacker Got Caught).

Give credit to German police for quickly identifying a suspect, as well as declining to guess about who might have been involved before they did so. That's a far cry from the anonymous government sources who in other countries remain so ready to ascribe every new bank hack to Russia and every mass data theft to China (see: Reports: China Suspected in Marriott Database Breach).

"There are enough security challenges in our industry without incidents being overhyped in order to gain media attention or sales leads," Brian Honan, who heads Dublin-based cybersecurity consultancy BH Consulting, tells me.

Breached: Email, Cloud, Social Media

Germany's interior ministry last week said that the attacker likely acquired the data by breaching victims' email and social media accounts and cloud services, says Thomas Rid, a professor of strategic studies at Johns Hopkins University, via Twitter.

An unnamed investigator told German weekly news magazine Der Spiegel that the suspect apparently didn't understand the impact that his actions might have.

If so, the 20-year-old student is hardly the first would-be hacker to seemingly not comprehend the potential impact of his crimes (see: Satori Botnet's Alleged Developer Rearrested).

Reminder: Pick Strong Passwords

SplashData's "worst passwords of 2018," based on its review of 5 million passwords that leaked on the internet last year, compared to their prevalence in 2017 data dumps

This incident should remind everyone - public figure or not - that if they don't take cybersecurity seriously, they may pay a data security cost, potentially at the hands of an angry 20-year-old.

"Bad passwords were one of the reasons he had it so easy," Minister of the Interior Horst Seehofer told reporters on Tuesday, the Guardian reported. "I was shocked at how simple most passwords were: 'ILoveYou', '1,2,3.' A whole array of really simple things."

In an ideal world, people wouldn't have to rely on passwords anymore to secure their information. But this is 2019, and that's not the world we live in (see: Why Are We *Still* So Stupid About Passwords?).

"Victim blaming is pointless; human behavior should be central to security design, and as humans we all do the same things that can be exploited by hackers," says Alan Woodward, a professor of computer science at the University of Surrey. "Our worst sin is that we are all slightly lazy with regard to security because we think it will never happen to us."

Industry Failure

Honan, who founded Ireland's first computer emergency response team and advises the EU's law enforcement intelligence agency Europol, says he's not surprised that many of the German victims appeared to have picked poor passwords.

"Many people do not see their email or social media accounts as high-value assets, and as a result may practice poor security hygiene," he tells me. "We as an industry have failed to provide users with the user experience and tools to make and maintain their online personas in a secure manner. As an industry we need to provide more secure means, both technical and educational, for people to secure their accounts and systems."

Secure More, Remember Less

Woodward says one essential resource for anyone who uses a password or who programs systems that require them is the "spot on" password guidance issued by the National Cyber Security Center, the public-facing component of U.K. intelligence agency GCHQ (see: Successful Security? Stop Blaming Users).

One thing anyone who wants to avoid becoming a victim of these types of attacks should do is ensure they always use a unique, relatively complex password for every online service. Once picked, it need never be changed, unless the site or service gets breached.

"I also personally recommend using a password manager - it means you can have truly strong passwords that you'll never remember, which are always the best passwords," Woodward tells me.

"Yes, password managers can be a single point of failure, but choose a really strong password for that and you have to remember only the one," he adds. "And yes if the provider were breached we'd all be in the poo; but you have to do due diligence and pick one you trust."

Cybersecurity , Governance , Legislation & Litigation

On Wednesday, just days after a new "cybersecurity" law took effect, Vietnam alleged that Facebook has violated the law by allowing users to post anti-government comments on the platform, according to news reports.

See Also: Key Drivers to Enable Digital Transformation in Financial Services

The so-called cybersecurity law actually speaks little about IT security measures and instead focuses on various prohibited acts, such as spreading information that opposes the government of the Socialist Republic of Vietnam.

The law is expected to give sweeping power to the government to take down any content it deems misfit to its thought process.

It appears to cover all enterprises that provide services on telecommunication networks and the internet in Vietnam. It requires these companies to authenticate users upon registration and keep their information confidential, according to a report by Baker Mckenzie, a multinational law firm.

Under the new law, companies also must grant the government access to their information systems when there is "a serious breach of law or action causing serious loss to the public order and safety," the report says.

Other Requirements

Vietnam already has two regulations that place similar obligations on companies.

Decree 72, issued in 2013 to regulate internet businesses, imposes similar prohibitions and obligations on internet service providers, according to a report by the law firm Duane Morris.

In addition, Circular 38, issued in 2016 by the Ministry of Information and Communications, sets out a process by which offshore internet-based service providers must cooperate with the government to combat "bad" and 'toxic" content on the internet, the law firm explains.

According to a Google transparency report, since 2009, Google has received 67 requests from the Vietnam government for removal of material from Google's platforms and a number of requests for providing user data to the government. Google reports that it has accepted some requests and declined others.

The new law is expected to lead to government actions designed to force companies to comply with its requests. But the terms of the law lack details on what sort of action could be taken.

Another provision of the new law is a data localization requirement. It states that companies that collect, exploit, analyze or process personal information, information created by users in Vietnam and data on the relationship of the users must store all data locally for a period of time. But the law does not spell out whether companies need to have their own local servers.

The Right Steps

Cleary, Vietnam's new law compromises privacy and free speech in the name of national security.

Governments worldwide are struggling to balance privacy vs. security. But no government is justified in ignoring internet freedom and clamping down on all content that it finds objectionable.

On the other hand, social media companies and others do have a role to play in protecting against cyber threats and terrorism.

Vietnam and other nations need cybersecurity laws that actually focus on cybersecurity best practices, spelling out standards that companies need to meet. Cracking down on what the government labels as "propaganda" accomplishes nothing.

Breach Preparedness , Cybercrime , Cybersecurity

Police in Germany say a 20-year-old student has confessed to leaking personal details - including private mobile phone numbers, children's pictures and chat discussions - stolen from 1,000 German politicians, celebrities and journalists, including Chancellor Angela Merkel (see: German Police Identify Suspect Behind Massive Data Leak).

See Also: Key Drivers to Enable Digital Transformation in Financial Services

But any senior executives breathing easier or planning to slash their cybersecurity budget - because they see this case as a sign that all hackers wear hoodies and live in their parents' basement, committing relatively minor infractions by gaming people's bad password choices - need to think again.

"This [case] plays to so many stereotypes, I fear it will simply reinforce the public's view that nation-states are not a threat, but instead we should be worried about youths closeted in their parents' basement," says Alan Woodward, a professor of computer science at the University of Surrey.

"My concern is that the less informed, who don't want to spend money on what they see as ethereal defense, will use such examples to downplay the threat from organized crime gangs and nation-states," Woodward tells me. "The point is that this one got caught - the others tend not to. It's a case of real news contributing to confirmation bias for decision makers and legislators who do not really understand the threat landscape that is evolving."

Indeed, more advanced attackers - as in, ones who work to avoid detection by practicing better operational security - can exploit the same types of flaws allegedly targeted by the 20-year-old suspect for more malicious ends.

Young Hacker Problem: OPSEC Deficit

Compared to nation-state attackers or organized crime gangs operating online, security experts say young hackers are more likely to get caught.

In this case, a 20-year-old German national who's being tried in juvenile court and who has not been named by police confessed to the crime on Monday, saying he leaked the data via accounts using the handles "G0d" and "0rbit."

Police are being assisted by a 19-year-old German witness to whom the suspect reportedly bragged about his data leaks via the encrypted messaging app Telegram. Some news reports have said the suspect had used his own phone number to register for Telegram, making it child's play for police to identify him.

At a Tuesday press conference, Holger Münch, chief of Germany's Federal Criminal Police Office, the BKA, said the attacker had principally targeted victims' "bad passwords," German weekly news magazine Stern reported.

The suspect said he was self-taught and working alone, police say. They have also noted that he was a suspect in another data theft case two years ago, for which he was never charged.

Litmus Test

Think of this case as a litmus case for being able to stop what is often the least advanced type of attacker on the planet: a teenager who has sufficient time, inclination and sometimes, lack of moral judgment, to hammer away at an online target until they succeed.

Where young attackers are concerned, no matter how many get arrested, there will always be more (see: Teen Hacker Sentenced Over 'Titanium Stresser' Attacks).

But teens aren't unique: All attackers typically pursue the path of least resistance, whether they're stealing personal data out of alleged anger at politicians and public figures, conducting corporate espionage, gathering dirt on rivals or engaging in nation-state intelligence-gathering.

For criminals, time is money. So they typically opt for the simplest tool that will get the job done. And for intelligence services, using commonly seen attacks provides better untraceability and deniability (see: Nation-State Spear Phishing Attacks Remain Alive and Well).

Advanced Attackers Make Less Noise

How bad is the cybercrime problem? Last year, McAfee and the Center for Strategic and International Studies estimated "that cybercrime may now cost the world almost $600 billion, or 0.8 percent of global GDP."

Trying to quantify computer crime, however, suffers from this paradox: No one knows just how bad it is. Authorities say only a fraction of victims - individuals or businesses - report such crime to authorities (see: FBI to DDoS Victims: Please Come Forward).

Hence online crime defies easy quantification. While the FBI can count the number of bank robberies, likely very accurately, it relies on U.S. businesses that lose data or money due to hack attacks to self-report many such incidents, including the particulars of the crime. And that assumes that the business in question has even spotted the crime.

Lessons to Learn

Individuals and organizations would do well to treat the German personal data mega-leak as a cautionary tale (see: Ransomware School: Learn Lessons From How Others Fail).

Here's the right question for all public figures, politicians or celebrities to be asking right now: "Could I fall victim to any attacker who used the same tactics, and how do I protect myself?"

If so, the obvious next question is: "What should I do now to solve it?"

Authorities in Germany say they're crafting guidelines for their country's politicians in the wake of last month's mega-leaks.

Arguably, Germany's cybersecurity agency is already well behind the curve. "Why are standards agencies only now telling politicians and others how to protect their ID?" Woodward asks, noting that in the U.K., the National Cyber Security Center has long provided information security advice to lawmakers.

On the other hand, "I'm not entirely sure politicians listen to that advice, or even read it," he says.

But it should be brutally obvious to everyone that all types of attackers may come gunning for any and all online accounts used by politicians (see: British Parliament Targeted by Brute-Force Email Hackers).

Likewise, the 2014 dump of celebrities' nude photos, stolen from iOS device backups to iCloud should have served as a wake-up call to anyone with a public profile that any and all information they store in the cloud is at risk.

At least for politicians, "maybe the time has come to enforce 2FA," Woodward says, referring to two-factor authentication, which can block outright many types of account takeovers - even if users pick weak passwords - regardless of whether the attacker might be wearing a hoodie.

Because at the end of the day, it's never about your attacker's age, motivation or sartorial choices, but rather the strength of your defenses.

Five months after he was found guilty of orchestrating a distributed denial-of-service attack against US healthcare providers, the self-styled Anonymous hacker Martin Gottesfeld has been sentenced to 121 months in prison.

In 2014, Gottesfeld knocked Boston Children's Hospital and the Wayside Youth & Family Support Network offline and disrupted computer systems for days, all to draw attention to a messy custody battle over Connecticut teenager Justina Pelletier. She was staying at Wayside at the time.

The teen was diagnosed with a rare disease at Tufts Medical Center, however, doctors at Boston Children's Hospital believed it was psychological, and accused the parents of medical child abuse. With a judge's permission, the docs took custody of her in Massachusetts, taking her away from her friends and family. She was eventually released to her parents 16 months later, by order of the courts.

After the FBI tracked down the Anon miscreant and raided his home, Gottesfeld and his wife attempted to flee capture in a sailboat, but neither of them were up to the task of navigating the Caribbean. First, he was blown off course, then rescued by a Disney cruise ship and handed over to the Feds in Florida.

Last August, the computer engineer was found guilty of conspiring to damage computers by a Massachusetts jury. In sentencing this week, District Judge Nathaniel Gorton described Gottesfeld's crime as “contemptible, invidious and loathsome,” and in addition to the ten-year stretch in the clink, the judge ordered him to cough up $443,000 in restitution. Assistant US Attorney David D’Addio had described Gottesfeld as a "self-aggrandizing menace."

Excuse ... Gottesfeld's note to the court (click to enlarge)

In a handwritten letter to the court last May, it's clear Gottesfeld – who represented himself at trial – was convinced he was doing the right thing by attacking the hospital networks. The 34-year-old alleged that Justina's plight was a “crime against humanity” that was being covered up by federal prosecutors, and somehow associated the saga with the suicide of internet activist Aaron Swartz.

According to a Reuters report, Gottesfeld plans to appeal, and said he had no regrets. ®