I have a short talk where I pull my Google Take-Out and show the information the company has collected over the years to profile me. The talk covers everything from geolocation tracking, to search history, to activity while using Youtube. One of the most shocking moments is when I play a clip of my voice asking Google for directions to an event venue. Yes, they are even saving voice clips. As the talk progresses, I can usually tell who is using an Android phone by the looks on their faces.
Inevitably, the question is asked, "Don't you think Apple is doing the same thing?"
Yes. Absolutely. But I believe the difference is in business models. Apple makes its money through the sales of hardware. Google makes its money by brokering your information and personal interests. Their main product is YOU.
This article on the Visual Capitalist website seems to support my theory.
The June 2022 quarterly income statement for Apple shows the company brought in 83 billion dollars. 63 billion dollars (76%) was from the sales of hardware devices.
By contrast, the same quarterly statement for Alphabet, the parent company of Google, shows the company made 69.7 billion dollars. 56.3 billion dollars (80%) was made from ad revenue.
Do you know where ad revenue comes from? The sale of your profile to advertisers and targeted ads based on your personal interests.
https://www.visualcapitalist.com/cp/big-tech-revenue-profit-by-company/
To pay or not to pay…
It is completely understandable why any business leader chooses to pay the ransom payment. In most cases, they are out of options and desperate. Obviously, they wouldn’t pay thousands or hundreds of thousands of dollars if they had some alternative choice. But they don’t, so there they are.
In some cases, an insurance company is in the driver’s seat and they have analyzed the options down to an actuarial decimal point. The decision is calculated on a cost to benefit analysis based on dollars and cents not right or wrong, or what is best for the business or society.
In this Verge article, Clearwater Compliance CEO Steve Cagle explains why you should “never” pay the ransom. https://www.theverge.com/23410990/cybersecurity-ransomware-healthcare-data-hipaa-hospitals
Like a broken record
We could start a newsletter just publishing a weekly rundown of attacks carried by organizational insiders. Every week I bang my malicious insider drum. The “hacker” who changed New York Post headlines this week to be racist, misogynist and extremist, actually worked at the paper. The Post issued a statement “the unauthorized conduct was committed by an employee who has now been fired”. https://www.pennlive.com/nation-world/2022/10/new-york-post-hack-was-caused-by-rogue-employee-paper-says.html
Mandiant has a piece in their blog this week about insider threats that is worth the few minutes to read. https://www.mandiant.com/resources/blog/insider-threat-dangers-within
Drizly gets drilled
Drizly is an online market place for alcoholic beverages where the purchases are delivered by Uber drivers. They failed to act on information received from security vendors that their network was vulnerable to attack. Yep, the attackers let themselves in resulting in the loss of personal data for 2.5 million customers. The Federal Trade Commission filed suit against the company and its CEO for failing to even try. Seriously, they didn’t even try to fix the problems. https://www.ftc.gov/news-events/news/press-releases/2022/10/ftc-takes-action-against-drizly-its-ceo-james-cory-rellas-security-failures-exposed-data-25-million
Are you a victim of the Raccoon
The US DOJ recently charged a Ukrainian national with running the Raccoon Infostealer campaign from 2018 through 2022. The malicious software infected computers and stole the users personal information including email addresses, ID numbers, bank information, and cryptocurrency account data. The group used the stolen data to victimize thousands. Unfortunately, many of the victims have no idea their information is still compromised. The DOJ has a website where you can check to see if the group collected your data. https://raccoon.ic3.gov/home
Importance of AML due diligence
The US Attorney for the Southern District of New York announced a New Jersey man has been sentenced to 78 months in prison for laundering millions of dollars stolen from a series of Business Email Compromise attacks and romance scams. The subject used a used car dealership as a front to move the money. Yes, a used car lot was used for money launders. Please, take a break to collect yourself and come back. The key of the press release is the claim, “From 2016 through 2021, CELVIN controlled more than eight bank accounts that had deposits that totaled over $5.7 million during that time period. The vast majority of those deposits consisted of large wire transfers and check or cash deposits from U.S.-based individuals”. AML operations are the key to identify these bad actors. https://www.justice.gov/usao-sdny/pr/new-jersey-man-sentenced-78-months-laundering-millions-fraud-schemes-perpetrated-ghana
The Rest…
Don’t get butchered. Proofpoint examines “pig butchering” scams. https://www.proofpoint.com/us/blog/threat-insight/broken-dreams-and-piggy-banks-pig-butchering-crypto-fraud-growing-online
Human resources and security managers need to collaborate to get a handle on the cybersecurity staffing shortages. https://www.hrdive.com/news/if-hr-and-hiring-managers-dont-collaborate-cybersecurity-staffing-shortag/634441/
The Apple security team has a new web resource. https://security.apple.com/
Google claims to have a new tool to help protect your privacy and online presence. Ahhh, excuse me, say what now? https://blog.google/products/search/a-new-search-tool-to-help-control-your-online-presence/
Cool Tools
Monitoring a specific website as part of an investigation? Put it on auto-pilot. https://visualping.io/
An extension for chromium based browsers to help organize your tabs. https://www.tabbrew.com/
Cool Job
Information Security Program Manager - Major League Soccer. https://careers-mlssoccer.icims.com/jobs/1811/job
The Law of Exclamation – “The more exclamation points used in an email (or other posting), the more likely it is a complete lie. This is also true for excessive capital letters.”
Thank you opening this weeks email and making it to the bottom of the issue. Please considering sharing the newsletter with colleagues, or an enemy.
Thanks,
Matt
“You can’t go back and change the beginning, but you can start where you are and change the ending”