Threats Without Borders - Issue 122
Matt's Cyber-Financial Crime Newsletter, week ending March 19, 2023
In previous issues, I expressed a less-than-hopeful outlook on the government's efforts to address cybercrime. Brian, a longtime subscriber, sent me this message:
"Matt, I share your pessimistic outlook of Government but I think maybe cyber might be different, CISA has been doing fantastic work and the FBI seems to be making a difference in the fight against ransomware."
I accept that.
CISA is doing really impactful work. I have watched Jen Easterly speak several times and I rather like her - for what that's worth from a guy who writes a two-bit newsletter on the Internet.
And then it’s back to reality as Dan Goodin comes in from the top rope with the dandy revelation that two agencies of the federal government were hacked through a known exploit that they didn't patch...for over 4 years!
Dan explains it better than I can: https://arstechnica.com/information-technology/2023/03/federal-agency-hacked-by-2-groups-thanks-to-flaw-that-went-unpatched-for-4-years/
Maybe I should change the name of the newsletter to “Threats to Ourselves”. Or more appropriately, “Running With Scissors, Point Up, With Our Shoes Untied”.
The Internet Crime Complaint Center (IC3) released the 2022 Internet Crime Report. I briefly skimmed it, but haven’t had time to really dig deep into the data. I plan to be offering more insight in Issue 123. Take a look for yourself. https://www.ic3.gov/Media/PDF/AnnualReport/2022_IC3Report.pdf
FCC attempts to smash smishing
The Federal Communications Commission adopted new regulations designed to tackle the significant increase in scam text messages. The agency claims “robotext” complaints skyrocketed from 3300 in 2015 to 18,900 complains in 2022. The new regulations require communication providers to block text messages from phone numbers that are “unlikely to transmit text messages”. This seems awkward at first, but it just means phone numbers such as landline numbers, invalid numbers, and unallocated numbers. Makes sense, I hope it works. https://www.fcc.gov/document/fcc-adopts-its-first-rules-focused-scam-texting
Say it with me…
A Pennsylvania woman has been arrested for stealing over $50,000 from a music boosters club in which she was the treasurer. Police say “Brown had written checks to herself, made ATM withdrawals, and purchased items from various businesses, none of which were documented by the club or served a specific purpose. She also changed the United Music Booster’s Club’s address to her home address”. Say it all together now… where were the controls???? https://www.psp.pa.gov/PIRRs/Indiana%20Press%20Releases/A_INDA_14MAR2023_1230.pdf
IPFS said what?
If you have no idea what the Interplanetary File System (IPFS) is then you probably aren’t aware that cybercriminals are keen at abusing it. IPFS is a distributed file storage system for peer-to-peer (P2P) networks. Cofense does a nice job explaining and providing some samples of in-the-wild phishing messages targeting users. https://cofense.com/blog/ipfs-abuse-continues-as-attackers-mix-and-match-techniques/
Fraud is Fraud
This report shows that fraud is fraud no matter where in the world it occurs and the Internet is the great facilitator. The report compares how the recessions has impacted fraud in the United States and compares it to that of the United Kingdom. https://seon.io/resources/global-recession-fraud/
Browser are not for passwords
But are password managers? I used to speak forcefully against using the “remember this password” function of a web browser while encouraging the use of a dedicated password manager. I have been tiptoeing around the issue after the recent troubles of Lastpass, Keepass, and Bitwarden. This post on the Black Hills Infosec blog gets us all back on track demonstrating that a web browser should not be a password manager. Even if a password manager shouldn’t be either. https://www.blackhillsinfosec.com/your-browser-is-not-a-safe-space/
The Rest…
Human error will probably be the reason your organization is breached. But it doesn’t have to be. https://www.spiceworks.com/tech/it-careers-skills/guest-article/human-error-management/
Study shows humans still better at writing phishing emails than AI. Just give Skynet a few minutes to reboot. https://www.techrepublic.com/article/phishing-emails-humans-better-creating-than-ai/
International law enforcement takes down the ChipMixer crypto-laundering service connected to FTX. https://techcrunch.com/2023/03/15/police-shut-down-dark-web-crypto-laundering-service-linked-to-ftx-hack/
Cool Tools
Desktop app removes the background from any photo - https://bgremover.realbrain.cc/
Check that shortened link before you click it. https://tools.digitalmethods.net/beta/expandTinyUrls/
Cool Jobs
Financial Crimes Investigation Manager - North American Bankcard. https://nabancard.wd1.myworkdayjobs.com/en-US/NAB/details/Financial-Crimes-Investigation-Manager_JR100208?q=crime&redirect=/NAB/job/US---Remote/Financial-Crimes-Investigation-Manager_JR100208/apply
Irrelevant
This guy does not like the Federal Reserve. Or bankers for that matter. https://www.city-journal.org/investigate-the-bank-failures
Thank You for reading this weeks issue.
Matt
“FORTUNE FAVORS THE PREPARED MIND” - someone with better planning skills than me.
Legal: I am not compensated by any entity for writing this newsletter. Obviously, anything written in this space is my own nonsensical opinions and doesn’t represent the official viewpoint of my employer or any associated organization. Blame me, not them.