May 24, 2017

Be a Cynic

I typically try to be open-minded, and give people the benefit of the doubt. Seriously, I could be wrong, right? I get that. But when it comes to companies that have been hacked, and I’m listening to the story I’m being spoon-fed by their PR department; I’m a cynic. I imagine I always will be, actually.

This comes up because of the recent JP Morgan Chase hack, where a purported 76 million households have had their information compromised. The story starts to fall apart each time the company says anything else about the incident, and how widespread the impact is for this hack. In a statement to the media, Chase’s PR department stated that they have closed the original vulnerability that resulted in the hack, and that they haven’t seen any further activity on the network, by the hackers.

Interestingly, it quickly becomes apparent that a) the company doesn’t truly understand how attackers operate, or b) they think their clients don’t. This is because most hackers will find a way into the network, gain elevated privileges, move laterally to another machine, and sit still until they’re certain the smoke has cleared. Consider this, if you’re trying to compromise an organization, and use a vulnerability to get a foot hold on a computer system, are you going to stay there? What happens when they find you, and close the hole? Do you lose your access? Moving laterally, quickly, allows an attacker to create a new backdoor into the network, and address the risk of losing access.

But this gets even worse. In what could be the largest information disclosure in recorded history, four other large banks, including Citibank, have been discovered to have been targeted. What we don’t know yet, is, who is doing the attacking, and why. This has become a criminal investigation, and includes departments like the FBI and Secret Service. Right now, there are a lot more questions than there are answers. But one thing is certain: If the attackers can’t use the information they’ve obtained, themselves, then certainly they’ll be able to find someone worth paying for it.

Keep an eye on your credit card records, watch the transactions. If you’re not tracking transactions on your cards, you’re likely putting too much trust in the credit companies. You can rest assured the credit companies are in this business because of the money, and if a compromise this size can be contained, then profits can be maintained. Be a cynic, too.  It’s in your best interest.

Check out the attached video for more details.

Happy Hacking.

-Russ

Leave A Comment