Business Email Compromise (BEC) , Cybercrime as-a-service , Data Breach

In the wake of Equifax and other major breaches, sophisticated fraudsters are finding success as never before. Al Pascual of Javelin Strategy and Research discusses how identity impersonation is manifesting.

See Also: Live Webinar | Levers of Human Deception: The Science and Methodology Behind Social Engineering

In a video interview at Information Security Media Group's recent Breach Prevention Summit in Washington, Pascual discusses:

Pascual leads Javelin's Advisory Services and Custom Research businesses. He provides clients actionable insights on a variety of fraud and security issues, acts as a partner in developing strategies for managing risk, and identifies and raises awareness of future threats and solutions.

Blockchain & Cryptocurrency , Cybercrime , Fraud Management & Cybercrime

Mark Karpeles, the head of the former Mt. Gox bitcoin exchange in Tokyo, has continued to maintain his innocence during the closing arguments in an embezzlement trial against him, Japanese broadcaster NHK reports.

See Also: Cybercrime 2.0: A New Era for the Identity and Authentication Challenge

Karpeles, a 33-year-old French national, has been under investigation in Japan after the Mt. Gox cryptocurrency exchange, of which he was CEO, went bust in 2014.

Karpeles has blamed a hack attack for the loss of 850,000 bitcoins, then worth about $500 million, as well as $28 million in cash that was stolen from the company's bank accounts. After halting trading in February 2014, Mt. Gox - then the world's largest cryptocurrency exchange - declared bankruptcy, blaming the missing bitcoins.

Subsequently, Karpeles said that he'd recovered 200,000 bitcoins from a cold wallet, meaning a storage device disconnected from the internet (see Bitcoin Trading Website Goes Dark).

Separate to the hack attack, however, Japanese authorities have accused Karpeles of embezzling 340 million yen ($3.1 million), tampering with Mt. Gox systems to inflate account balances and failing to honor users' requests for their missing funds to be returned.

In July 2017, a trial against Karpeles began in Tokyo District Court. "I swear to God I am not guilty," Karpeles told the court in a statement he read in Japanese on the first day of his trial, The Japan Times reported.

On Thursday, the trial concluded, with the former CEO continuing to maintain his innocence, denying all of the charges leveled against him. He has also apologized for having failed to prevent the hack attack.

Prosecutors are seeking a 10-year prison sentence for Karpeles. They argued in court that his alleged acts "were extremely vicious, as they completely undermined confidence in trading," NHK has reported.

The court is set to issue its verdict on the case on March 15, 2019.

As a result of the Mt. Gox meltdown, Japan became one of the first countries to regulate cryptocurrency exchanges at a national level to better protect investors.

Embezzlement Charges

Karpeles was first arrested in August 2015 on charges that he'd stolen funds from exchange users from 2011 to 2013 and moved the funds to his own accounts.

Later that year, Karpeles was rearrested and charged with embezzlement. Prosecutors accused him of transferring about $3.1 million in users' cryptocurrency to accounts that he controlled, between September and December 2013. They also accused him of using embezzled funds to invest in a software development startup, purchase luxury goods as well as hire prostitutes, cryptocurrency news site CCN has reported.

Karpeles, however, said the transferred money was a loan, although later said it was profits generated by his cryptocurrency exchange.

Karpeles was released on bail on the condition that he not leave Japan, Coindesk reported.

In June 2017, a Tokyo court halted the Mt. Gox bankruptcy proceedings and ordered that civil rehabilitation proceedings begin, which would allow the company's existing management team to draft a court-led reconstruction plan.

Earlier this year, Karpeles became the CTO for London Trust Media, a VPN service provider.

Hack Attack

Separate to the embezzlement charges, more details about how Mt. Gox appeared to have been hacked have emerged.

Police in Greece last year arrested Russian national Alexander Vinnik for allegedly running a massive money laundering operation that processed $4 billion in bitcoins, some of which were apparently stolen from Mt. Gox.

The U.S. Department of Justice has accused Vinnik of operating the BTC-e cryptocurrency exchange as an unlicensed money service business that was used to launder funds for numerous cybercriminal enterprises (see Feds Indict Russian Over BTC-e Bitcoin Exchange).

At the time of his arrest in Greece, Vinnik was the "chief suspect for involvement in the Mt. Gox theft - or the laundering of the proceeds thereof," according to a Tokyo-based group of bitcoin security researchers who call themselves WizSec.

Karpeles blamed Mt. Gox's bitcoin loss on a security issue called transaction malleability.

But WizSec says that Mt. Gox's security troubles appear to have begun in September 2011, when "the Mt. Gox hot wallet private keys were stolen," and Vinnik allegedly began using the keys to transfer bitcoins from customers' wallets to wallets that he controlled.

WizSec says that the wallet abuse confused Mt. Gox's system "into mistakenly interpreting some of the thief's spending as deposits," thus leading to erroneous credits to some users' accounts.

The researchers accused Vinnik of ultimately handling - if not having taken them outright - about 670,000 bitcoins stolen from Mt. Gox.

WizSec says it traced 300,000 of the stolen Mt. Gox bitcoins to BTC-e, where they were "presumably sold off or laundered." It said that other stolen bitcoins were laundered via other exchanges, in some cases even via Mt. Gox.

Anti-Malware , Data Breach , Data Loss

South Korean officials say that personal information for 1,000 North Korean defectors has been stolen via a malware attack.

See Also: Third-Party Cyber Risk Management - A Data-Driven Approach

The Ministry of Unification, an executive department of the South Korean government aimed at promoting Korean reunification, says that the information was being stored by a privately run Hana Center in the province of Gyeongbuk, aka North Gyeongsang.

The leak exposed the names, birth dates and addresses of 997 defectors who live in that region, officials say. All of the affected individuals have been contacted, they add.

"Currently no harm or damage has been observed due to the leak," a Unification Ministry spokesman tells CNN.

Hana Centers were set up by the South Korea government in 2010 to help North Korea refugees integrate into and establish stable lives in the country by helping with counseling, resettlement costs, medical expenses, children's education and employment.

Today 25 centers support about 30,000 North Korean refugees living in South Korea.

A message on the Gyeongbuk Hana Center homepage says "it was confirmed to have been leaked around November 2018," reports South Korea's SBS News.

Officials say they suspect the loss of information traces to a center employee opening malware attached to an email. That raises the prospect that the centers may have been directly targeted via a phishing attack.

"Recognizing a possibility of one personal computer at the Hana Center in North Gyeongsang Province having been hacked, we carried out an onsite probe on Dec. 19 in cooperation with the provincial government and the center and confirmed the computer was infected with a malicious code," according to a statement issued by the Ministry of Unification, South Korea's Yonhap News reports.

"In that computer, there was a file containing personal information of North Korean defectors," it added. "The file was confirmed to have been leaked."

The leaked data does not appear to have been publicly released.

The ministry says this is the first known case of defectors' personal details leaking. It's launched a complete information security review of all Hana Centers, and plans to disconnect any system that stores sensitive data from the internet.

"We deeply apologize to the many escapees from North Korea who have been affected by the incident, and will take measures to ensure that private information is protected," the ministry says in a statement.

Police Investigation Continues

Officials say police continue to investigate the leak. They have named no suspects, but attention has naturally turned to hackers working for the Pyongyang-based regime of North Korean leader Kim Jong-Un.

North Korean refugees living in South Korea remain at unknown risk from North Korea, which is officially known as the Democratic People's Republic of Korea. It's also not clear if any of their relatives still living in North Korea might face reprisals, should the escapees' identities be confirmed.

What is known is that anyone who tries to escape from North Korea does so at considerable risk to themselves and their families.

Exiles from North Korea have reported that anyone caught trying to escape the country is treated as an enemy of the state and sent to political prison camps, Human Rights Watch reports.

Repatriated North Koreans who have fled to China - where they are considered illegal aliens and often returned, whatever their asylum claims - may face "interrogation, torture, sexual abuse and forced labor," former North Korean officials have told Human Rights Watch.

Endpoint Security , Endpoint Security , Geo Focus: The United Kingdom

Steganography is the practice of hiding messages or information in plain sight, especially inside other data or images. And a new toolset, which debuted earlier this month at the Black Hat Europe conference in London, suggests steganography is going to get much more difficult to spot in the future.

See Also: Live Webinar | Levers of Human Deception: The Science and Methodology Behind Social Engineering

Digital steganography has already been put to use by bad actors. In 2013, for example, Russian security firm Kaspersky Lab and Budapest-based CrySyS Lab discovered an online espionage campaign that used attack code called MiniDuke, which looked to specified Twitter accounts to retrieve command-and-control instructions.

Trend Micro recently discovered that Twitter memes were being used to remotely control PCs infected with Berbomthum malware. (Source: Trend Micro)

More recently, security firm Trend Micro reported finding an attack campaign that used a meme drawn from the 1999 science fiction film "The Matrix" to send remote-control instructions for PCs infected with Berbomthum malware (see Twitter Sees Signs of State-Sponsored Attack).

Steganography, however, has also been used to help people operating in repressive regimes to more safely transport sensitive information; to protect journalists and their sources; to safeguard against industrial espionage when crossing borders; and for intelligence agencies undertaking deep-cover operations.

Speaking earlier this month at Black Hat Europe in London, Dominic Schaub, a researcher at a Canadian firm called Discrete Integration, noted that many types of digital steganography may be revealed if investigators look at a PC on which such tools are installed and find encryption tools.

Regardless of intentions, it looks like steganography is going to get more difficult to spot in the future. That's thanks to Schaub building a new approach to digital steganography, in the form of a "fast, stable and functional" toolset that he says functions as "a self-concealing, perfectly deniable encryption/steganography suite."

Russian Doll Steganography

The suite of tools he built creates a hidden, encrypted partition on a disk, while leaving no digital forensic traces, thus making so-called Russian doll steganography - hiding something inside something that looks whole - much easier.

"Deniable encryption and steganography nominally safeguard sensitive information against forced password disclosure by concealing its very existence," Schaub says in an overview of his research. "However, while the presence of sensitive information may be 'plausibly' denied, the possession of steganographic software - e.g. suspiciously configured VeraCrypt - is readily detected and regarded as a 'smoking gun' that invalidates such deniability."

VeraCrypt, for example, includes the ability to create hidden volumes with their own operating system.

But Schaub says there's a way to address that shortcoming, via what he calls self-concealing steganography, as The Daily Swig first reported.

"In this new paradigm, steganographic tools hide themselves in a self-recursive manner that renders them forensically invisible," he says. "Moreover, upon cryptographic activation by an authorized user, these hidden tools can bootstrap themselves into existence without generating any incriminating forensic evidence. Provided that requisite cryptographic conditions are met, such steganography can be considered 'perfectly deniable.'"

A bootstrap is the program that initializes an operating system during its startup.

'Bit-for-Bit' Normal Linux

Schaub says that his approach enables the creation of a decoy system that "appears bit-for-bit as a normal Linux system" that has been created using entirely out-of-the-box, default Ubuntu parameters.

Schaub says his tool spans about 30,000 lines of code, including a "main kernel module, userspace utilities - for installation, diagnostics, etc. - and various components of [the] bootstrap system."

Although the tool remains in development, he's also tested that it works well on various combinations of Arch and Ubuntu, and has confirmed that VirtualBox for Windows - a free, open source hypervisor - "works very well" on the hidden system.

Numerous Applications

The rise of digital steganographic tools that are tougher to spot is good news for people operating in repressive regimes, or others attempting to safeguard themselves against bad actors.

But of course, tools built for good often get repurposed for illicit purposes, and digital steganography looks set to make life more difficult for law enforcement agencies.

"Perfectly deniable steganographic disk encryption is going to be a nightmare when it comes to gathering digital evidence," says Alan Woodward, a professor of computer science at the University of Surrey, via Twitter.

Breach Preparedness , Data Breach , Endpoint Security

This was an eventful year for healthcare cybersecurity and privacy incidents and developments. But what's ahead for 2019? Here are eight predictions.

See Also: Live Webinar | Levers of Human Deception: The Science and Methodology Behind Social Engineering

1. The Department of Health and Human Services' Office for Civil Rights will release proposed updates for the HIPAA security and privacy rules. Based on continued pressure from local, state and federal government agencies, law enforcement, researchers and others to ease the sharing of patient and mental health data by removing the need to obtain patient consent, I expect to see OCR issue proposed HIPAA updates. That will result in significant backlash from privacy rights organizations, many technology businesses as well as significant portions of the general public.

2. The types of ransomware - and size of ransoms demanded - will grow. Just because there were fewer reported ransomware incidents in 2018 than in 2017 doesn't mean there actually were fewer ransomware incidents. Organizations are increasingly simply paying the ransoms and not reporting the ransomware attacks.

Cybercrooks are getting rich from the ransoms that organizations are paying. Too many healthcare executives are paying ransoms because they see this as the quickest way to get back to normal processing - largely because they lack a good business continuity plan.

The ransomware attacks will evolve to target individuals, such as top executives, along with the many new types of IoT devices. Ransomware will also disable medical devices and surgical devices, impacting patients' safety and health. And as more cybercrooks take copies of the patient data, they'll cause additional significant harm.

3. Unsecured medical devices will lead to patient harm.The security of medical devices has gotten worse, not better, throughout 2018. And now, with more remote access - including through mobile devices - those whose lives depend upon the medical devices are at greater risk. As a result, 2019 may be the year that the first death occurs through exploitation of medical device security vulnerabilities.

4. Increased use of IoT devices will lead to more security incidents and breaches. I've been surprised to see the quick adoption of IoT devices, such as digital assistants, by physicians and nurses in the provisioning of patient care. In addition to these, patients are using fitness trackers and many other types of devices. IoT devices, which generally lack security, often attach to Wi-Fi access points throughout healthcare facilities, creating pathways to internal networks and sensitive data. They also can become repositories for malware and potential homes for bots used to launch a coordinated botnet attack

All this could result in significant harm to patients, in addition to security incidents within healthcare provider organizations.

5. Insider incidents will increase. More insiders - not only employees but also business associates and other contracted third parties - will take advantage of their access to valuable data and healthcare systems and applications because they know there are few logs of their access to catch them or they see no one is reviewing the logs that do exist. Others will find situations where they are presented with large amounts of patient data and decide to use it for financial gain.

In addition to malicious actions, insiders will make mistakes or take actions that result in privacy breaches because they simply didn't get enough information security training.

6. Risks from legacy systems will widen. Legacy systems, often left unpatched and vulnerable, increasingly will be the targets of hacker attacks. Longstanding systems vulnerabilities will be exploited. And as the use of artificial intelligence tools that automatically leverage data from legacy systems grows, the risk of security and patient safety incidents will dramatically increase.

7. The inappropriate sale of patient data will continue lead to privacy violations. But more healthcare organizations that inappropriately sell or use patient data without obtaining the legally required patient consents and approvals will be caught in 2019. The push from marketers and executives to use patient data for more purposes is strong.

8. Privacy enforcement actions by state attorneys general offices will increase. Security incidents will result in huge - possibly business-ending - penalties, not only for HIPAA violations but also for violations of other laws, regulations, standards and contractual requirements. Some state AGs, including those in New York and New Jersey, took action in 2018. Expect even more state AG enforcement actions in the year ahead.