Business is booming for cyberextortionists.
DarkSide, the hacking group that shut down a key US oil pipeline earlier this month, has collected more than US$90 million in hard-to-trace bitcoin from 47 victims, blockchain analytics firm Elliptic has said.
The pipeline hack ended only after Colonial Pipeline Co paid nearly US$5 million in ransom to regain control of computer systems needed to supply gasoline to much of the eastern US, and was widely dubbed a “wake-up call” to batten down loose digital hatches.
Photo: AP
Following the subsequent release of US President Joe Biden’s new “Executive Order on Improving the Nation’s Cybersecurity,” the US Department of Homeland Security is moving to regulate cybersecurity in the pipeline industry. The US Transportation Security Administration (TSA) is expected to issue mandatory rules and reporting requirements for safeguarding pipelines against cyberattacks.
However, there are key gaps. In all the recent reporting on cyberattacks, there is been scant coverage of how they actually occur. You would almost think that bad guys are breaking into corporate data centers in the dead of night armed with sinister thumb drives, or sneaking lines of malevolent code past snoozing information security officers. It is as if malware materializes spontaneously on a server, then worms its way in to seize control of operational assets.
Companies are reluctant to correct the misimpressions by discussing the details of a breach, because it makes for terrible press and inevitably reveals some sloppy security. The absence of information creates a sense of bystander apathy, leaving many in the industry unprepared for the next attack.
In real life, corporate servers are often breached through remote login services as employees connect to the office from compromised home networks. Once an attacker has gained initial access to an enterprise network, other hacking tools can be used to exploit software flaws and infiltrate critical control systems. The rise of remote work during the COVID-19 pandemic has drastically increased these attack surfaces.
Most people do not think of their personal computers as vectors for infectious malware, but that is what they are. Laptops are thought of as places to store private photographs and files, and manufacturers tend to downplay the vulnerabilities. It came as a surprise last week when Apple Inc senior vice president of software engineering Craig Federighi admitted that Mac has a malware problem.
According to Federighi, there have been 130 types of Mac malware in the past year, one of which infected 300,000 systems.
All this is coming from a company that historically advertised its machines as a more secure alternative to Microsoft Windows.
Brutal honesty could encourage greater consumer vigilance. In 2016, the comedian John Oliver featured a satirical clip of Apple engineers scrambling to put out fires and patch software vulnerabilities while a malicious hacker steals intimate photos from user devices. It is a fairly accurate depiction of the challenges of information security, where a few engineers must hold off potential hackers in 24 different time zones.
The lack of transparency is not just the fault of corporate public relations. Software vulnerabilities are often kept secret for national security purposes. Nobody likes to talk about it, but the US government exploits security flaws all the time for intelligence-gathering and counterterrorism measures.
The US National Security Agency (NSA) and the CIA notoriously stockpile hacking tools, many of which have fallen into the wrong hands. In 2019, hackers used a leaked NSA exploit to disrupt government services in Baltimore, Maryland.
Biden’s executive order addresses part of the problem by envisioning the movement of government data and services to the cloud from local servers. A reputable cloud-hosting provider has full-time staff monitoring the infrastructure and staying on top of security updates, so newly disclosed vulnerabilities can be patched immediately.
This might be sensible for government agencies, but perhaps not the private companies operating critical infrastructure. The cloud computing market is dominated by three players: Google Cloud, Microsoft Azure and Amazon Web Services.
Greater dependence on tech giants would make the Internet more susceptible to catastrophic failure by reducing the number of prime hacking targets. A distributed communications system, by contrast, should be able to survive a nuclear strike; now, malfunctions at major cloud-storage providers can disable service for the entire country.
Also, people concerned about the increasing monopoly power of big tech would have their own reasons to object.
The TSA’s new cybersecurity rules would probably draw from the Cybersecurity Framework maintained by the US Department of Commerce’s National Institute of Standards and Technology. The framework was prompted by an executive order signed by then-US president Barack Obama in 2013 and establishes industry best practices for cyber-risk management, but adherence has been limited because implementation requires a huge investment.
Security measures are easy to undervalue because the consequences of sloppiness are unknowable. Laziness is a competitive advantage until the day the bad guys strike.
Even with TSA-enforced security standards, the industry would benefit from greater transparency about breaches and software vulnerabilities. Cybersecurity ultimately comes down to human behavior, and people are prone to cut corners when they underestimate risk. The worst outcome would be for cybersecurity to turn into a checkbox-ticking exercise like the pointless ritual that we suffer at the airport.
Elaine Ou is a Bloomberg Opinion columnist. She is a blockchain engineer at Global Financial Access in San Francisco. Previously she was a lecturer in the electrical and information engineering department at the University of Sydney.
This column does not necessarily reflect the opinion of the editorial board or Bloomberg LP and its owners.
TRADE WAR: Tariffs should also apply to any goods that pass through the new Beijing-funded port in Chancay, Peru, an adviser to US president-elect Donald Trump said A veteran adviser to US president-elect Donald Trump is proposing that the 60 percent tariffs that Trump vowed to impose on Chinese goods also apply to goods from any country that pass through a new port that Beijing has built in Peru. The duties should apply to goods from China or countries in South America that pass through the new deep-water port Chancay, a town 60km north of Lima, said Mauricio Claver-Carone, an adviser to the Trump transition team who served as senior director for the western hemisphere on the White House National Security Council in his first administration. “Any product going
STRUGGLING BUSINESS: South Korea’s biggest company and semiconductor manufacturer’s buyback fuels concerns that it could be missing out on the AI boom Samsung Electronics Co plans to buy back about 10 trillion won (US$7.2 billion) of its own stock over the next year, putting in motion one of the larger shareholder return programs in its history. South Korea’s biggest company would repurchase the stock in stages over the coming 12 months, it said in a regulatory filing on Friday. As a first step, it would buy back about 3 trillion won of paper starting today up until February next year, all of which it would cancel. The board would deliberate on how best to effect the remaining 7 trillion won of buybacks. The move
China’s Huawei Technologies Co (華為) plans to start mass-producing its most advanced artificial intelligence (AI) chip in the first quarter of next year, even as it struggles to make enough chips due to US restrictions, two people familiar with the matter said. The telecoms conglomerate has sent samples of the Ascend 910C — its newest chip, meant to rival those made by US chipmaker Nvidia Corp — to some technology firms and started taking orders, the sources told Reuters. The 910C is being made by top Chinese contract chipmaker Semiconductor Manufacturing International Corp (SMIC, 中芯) on its N+2 process, but a lack
NVIDIA PLATFORM: Hon Hai’s Mexican facility is to begin production early next year and a Taiwan site is to enter production next month, Nvidia wrote on its blog Hon Hai Precision Industry Co (鴻海精密), the world’s biggest electronics manufacturer, yesterday said it is expanding production capacity of artificial intelligence (AI) servers based on Nvidia Corp’s Blackwell chips in Taiwan, the US and Mexico to cope with rising demand. Hon Hai’s new AI-enabled factories are to use Nvidia’s Omnivores platform to create 3D digital twins to plan and simulate automated production lines at a factory in Hsinchu, the company said in a statement. Nvidia’s Omnivores platform is for developing industrial AI simulation applications and helps bring facilities online faster. Hon Hai’s Mexican facility is to begin production early next year and the
RSS