Government and the tech industry must cooperate to encourage encryption and protect society

Given the string of high-profile and costly cyberattacks that have taken place over the last couple of years, you’d think everyone would see urgency in encouraging security measures like encryption. After all, everyone loses when credit scores and bank accounts get hacked.

And yet, the U.S. government has raised legitimate concerns regarding encryption. As Reuters reports:

“U.S. Deputy Attorney General Rod Rosenstein on Tuesday sharply criticized technology companies that have built strongly encrypted products, suggesting Silicon Valley is more willing to comply with foreign government demands for data than those made by their home country.

While echoing many arguments made by previous senior U.S. law enforcement officials, Rosenstein struck a harder line than his predecessors who led the Obama Justice Department, dismissing attempts to negotiate with the tech sector as a waste of time and accusing companies of putting sales over stopping crime.

“Company leaders may be willing to meet, but often they respond by criticizing the government and promising stronger encryption,” Rosenstein said during a speech at the U.S. Naval Academy in Maryland, according to a copy of his remarks. “Of course they do. They are in the business of selling products and making money. … We are in the business of preventing crime and saving lives.”

Rosenstein’s first lengthy comments on encryption signaled a desire for Congress to write legislation mandating that companies provide access to encrypted products when a law enforcement agency obtains a court order.

Tech companies and many cyber security experts say requiring law enforcement access to encrypted products will broadly weaken cyber security for everyone. U.S. officials have countered that default encryption settings hinder their ability to collect evidence needed to pursue criminals.

Previous officials have urged such an approach, but Rosenstein more directly criticized Silicon Valley. He cited a series of media reports to suggest U.S.-based companies are more willing to accede to demands for data from foreign governments than they are from the United States.

The remarks were quickly denounced by supporters of strong encryption.”

At Evizone, we believe in the need to cooperate with law enforcement with appropriate due process. There should not be an open license for government to access any data they desire without safeguards; yet there are many compelling arguments that law enforcement must have access to data in order to keep society safe and functioning. There are just as many compelling arguments that data must be protected by encryption to keep society safe and functioning.

We call upon governments and the tech industry to engage in a broad dialogue to strike the right balance. At Evizone we strike the balance between high security and compliance with regulations every day. Give us a call to find out how we do it!

Yahoo hack worse than expected – again

Exactly a year ago this month, Yahoo made a stunning revelation.

They had already announced in September that 500 million email accounts had been hacked in 2014. But then in October they announced that over 1 billion email accounts had also been breached in 2013. This gave the tech company the honour of being victim to the two largest attacks on an email service.

It can’t get much worse than that, can it?

Well, it turns out the 1 billion accounts was actually 3 billion.

Every single Yahoo account in existence was hacked.

As the New York Times reports:

“Digital thieves made off with names, birth dates, phone numbers and passwords of users that were encrypted with security that was easy to crack.

The intruders also obtained the security questions and backup email addresses used to reset lost passwords — valuable information for someone trying to break into other accounts owned by the same user, and particularly useful to a hacker seeking to break into government computers around the world.

No one knows exactly what happened to the data after it was stolen in 2013. But last August, a hacking collective based in Eastern Europe quietly began offering Yahoo’s information for sale, according to intelligence gathered by InfoArmor, an Arizona cybersecurity company that monitors the darker corners of the web.

Since then, at least three buyers — two known “spammers” and an entity that appeared more interested in using the stolen Yahoo data for espionage — paid about $300,000 each for a complete copy of Yahoo’s stolen database, InfoArmor said after Yahoo first disclosed the breach.

Cybersecurity professionals warned that because many of the three billion Yahoo accounts belong to people who use the same passwords for different sites and services, there is likely to be an escalation of email fraud and account takeovers. They added that anyone who had used Yahoo should be diligent about monitoring their personal accounts.

With the stolen data, fraudsters have a higher chance of gaining access to the victims’ bank accounts, said Frances Zelazny, the vice president of marketing at BioCatch, a security start-up. “Most people reuse passwords or make multiple versions of the same passwords that are easy to hack,” she said.”

It’s common these days for victims of cyberattacks to underestimate the damage caused. The escalating Equifax hack is one example.

But there is something particularly troubling about the Yahoo breach. That every account was compromised means the company took no precautionary steps to protect their data by segmenting it. As we wrote in October 2016, “If Yahoo ever attempted to include basic security measures in their email platform, you would never know it.”

It’s time to ditch traditional email services and move on to Evizone, the secure communications platform of the future.

Global firm offering cybersecurity advice gets hacked

A major global accounting firm, offers their clients a slew of services. One of them is the development of cybersecurity strategies.

According to their website, they help “organizations prevent cyberattacks and protect valuable assets.” They “focus on establishing effective controls around the organization’s most sensitive assets and balancing the need to reduce risk, while enabling productivity, business growth and cost optimization objectives.”

It’s an attractive proposition for their clients, but recent news shows even cybersecurity experts cannot make e mail safe for electronic communications. Bloomberg reports:

Following record results that flagged the growth of its cyber security business, [Big Accounting Firm] LLP has revealed that it has been successfully targeted by a cyberattack that let hackers access data from an internal email platform.

The auditing and consulting firm said in a statement Monday that it’s currently informing the clients affected and has notified governmental authorities after it became aware of the incident.

The firm said “very few” clients were impacted, and has drafted outside help to review its security. The hack was first reported by The Guardian.

The email platform was stored on Microsoft’s Azure cloud platform, according to The Guardian. A spokeswoman from Microsoft declined to comment.

It’s a problem we’ve seen before. No matter how well a company protects their servers or their data, the use of email creates a serious chink in the armor, even for experts. Once a hacker has access to a messaging platform like Microsoft’s Azure, the whole network risks being exposed.

It’s time for companies to move beyond email and join the twenty-first century.

Evizone offers a closed communication system with next generation security. To test out Evizone Secure Communications (ESC), visit us at http://evizone.com/free-trial/. ESC provides the strongest commercially available system for the secure exchange of electronic communications. Don’t wait until it’s too late!

Government doesn’t pay nearly enough attention to cybersecurity

The government doesn’t pay nearly enough attention to cybersecurity, according to some very good sources.

Fortune Magazine reports that last month, a quarter of the members of U.S. President Donald Trump’s National Infrastructure Advisory Council resigned, citing “specific shortfalls in the administration’s approach to cybersecurity”. The article continues:

“The resigning advisors also said the Administration was not “adequately attentive to the pressing national security matters within the NIAC’s purview, or responsive to sound advice received from experts and advisors.” The letter also zeroed in on “insufficient attention to the growing threats to the cybersecurity of the critical systems upon which all Americans depend,” including election systems.

While he has ordered better security for government networks, Trump has shown little understanding or seriousness when it comes to the broader issues surrounding, in his words, “the cyber.” Most notably, he has refused to accept the U.S. intelligence community’s conclusion that Russia engineered a hacking and propaganda campaign meant to subvert the 2016 presidential election, and even floated the idea of forming a cybersecurity task force with Russia. The administration also missed a self-imposed deadline for presenting a comprehensive cybersecurity plan.

In a report issued just after the mass resignations, the NIAC issued a report saying that dramatic steps were required to prevent a possible “9/11-level cyberattack.””

It’s worrying that those most suited to deal with issues of cybersecurity in government chose to quit rather than work with a difficult administration. The mass exodus does not bode well for the country, or for the data the federal government holds in its possession.

However, it’s a good reminder to companies and individuals that the government is not equipped to help you if you become a victim of a cyberattack. This is a message we have repeated countless times – your own security is in your hands.

Don’t wait to become the next Sony. Protect your data and communications today with the help of Evizone. Try it free for 30-days by visiting us at http://evizone.com/free-trial/.

Hackers stole your social security number – and 143 million others

Equifax is the largest consumer credit reporting agency in the United States and collects sensitive information on nearly a billion people worldwide. It’s a publicly traded company with annual revenue of over $3 billion and it has been in business for over a century.

With its experience and responsibility, it would be a sensible assumption that Equifax takes every measure possible to protect the data they hold.

And yet, this isn’t the case. As The Verge reported on September 7:

“Equifax announced today that 143 million US-based users had their personal information compromised this year. Attackers reportedly exploited a vulnerability on Equifax’s website to steal names, Social Security numbers, birthdates, addresses, and, in some cases, driver’s license numbers. Credit card numbers for approximately 209,000 people and certain dispute documents with personal identifying information for approximately 182,000 people were also accessed. Although Equifax operates in other countries, it didn’t detect any stolen personal information abroad.

The company says it discovered the breach on July 29th this year, and has since plugged the security hole. The company also set up a dedicated website — www.equifaxsecurity2017.com — for possible victims to sign up for credit file monitoring and identity theft protection.

Data breaches are fairly common, although those impacting Social Security and driver’s license numbers are rarer and more serious. The fact that Social Security numbers are included in the breach makes it likely that victims will be targeted for identity theft. Equifax says it’s working with both an independent cybersecurity firm and law enforcement to investigate.”

Yes, data breaches are fairly common, but they shouldn’t be. Many breaches start through failures in e mail security or best practices which allow access to corporate systems.

This type of cyberattack can be prevented with the use of Evizone. Through our proprietary software, users have access to the most secure electronic communications and compliance archiving platform commercially available.

Visit us at evizone.com to see how we do it.

Phishing dupes Canadian university out of $11.8 million

When private companies fall for the tricks of cybercriminals, it’s their investors who stand to lose the most and who must demand accountability.

Yet when public institutions like schools and hospitals are scammed, taxpayers are left picking up the bill.

The latest example happened at Alberta’s MacEwan University. CBC reports:

“An Edmonton university was defrauded of $11.8 million after staff failed to call one of its vendors to verify whether emails requesting a change in banking information were legitimate.

MacEwan University discovered the fraud on Aug. 23 after the legitimate vendor, a construction company, called to ask why it hadn’t been paid.

Three payments were made to the fraudulent account: one on Aug. 10 for $1.9 million; another on Aug. 17 for $22,000 and a third on Aug. 19 for $9.9 million.

Most of the money — more than $11.4 million — has been traced to accounts in Montreal and Hong Kong, the university said in a news release Thursday.

Those funds have now been frozen, the university said, adding it is working with legal counsel in Montreal, London and Hong Kong to pursue civil action to recover the money. The status of the rest of the missing money isn’t known.

University spokesperson David Beharry said the scammers sent emails that looked legitimate.

“A domain site with the authentic logo was sent,” Beharry told reporters. “The individual asked us to change banking information from the vendor. That information was changed.”

Advanced Education Minister Marlin Schmidt said in a statement he found it unacceptable that the university fell victim to this scam.

He’s asked the chair of MacEwan’s board of directors to report by Sept. 15 about how this could have happened.

“While I’m told that MacEwan has put improved internal financial controls to help prevent it from happening again, I expect post-secondary institutions to do better to protect public dollars against fraud,” Schmidt said in a statement.”

The Education Minister has the right attitude. With everything we know about cybersecurity today, there is no excuse for advanced education facilities to fall victim to such schemes.

There is hope for the University: the perpetrators of the attack were not sophisticated enough to funnel the money elsewhere, and with the funds now frozen, the cash will likely be recovered – at least in part. The next large-scale victim may not be so lucky.

If you’re reading this and concerned about the cybersecurity of your institution – whether it’s public or private, non-profit or for-profit – get in contact with us to learn more about our secure communications software. With Evizone, you never have to worry about anything malicious lurking within your messages.

Post-delivery modification: another nail in email’s coffin

The security firm Mimecast has discovered a new email security flaw that is truly terrifying. The threat – named ROPEMAKER – is not thought to have been used by cybercriminals to date. Yet its discovery alone means that any email you receive could harm your computer and files – even if the sender had no malicious intentions. As Mimecast explains:

“Most people live under the assumption that email is immutable once delivered, like a physical letter.  A new email exploit, dubbed ROPEMAKER by Mimecast’s research team, turns that assumption on its head, undermining the security and non-repudiation of email; even for those that use SMIME or PGP for signing.  Using the ROPEMAKER exploit a malicious actor can change the displayed content in an email at will. For example, a malicious actor could swap a benign URL with a malicious one in an email already delivered to your inbox, turn simple text into a malicious URL, or edit any text in the body of an email whenever they want. All of this can be done without direct access to the inbox.

Described in more detail in a recently published security advisory, Mimecast has been able to add a defense against this exploit for our customers and also provide security recommendations that can be considered by non-customers to safeguard their email from this email exploit.

So what is ROPEMAKER?

The origin of ROPEMAKER lies at the intersection of email and Web technologies, more specifically Cascading Style Sheets (CSS) used with HTML.  While the use of these Web technologies has made email more visually attractive and dynamic relative to its purely text-based predecessor, this has also introduced an exploitable attack vector for email.

Clearly, giving attackers remote control over any aspect of ones’ applications or infrastructure is a bad thing.  As is described in more depth in the ROPEMAKER Security Advisory, this remote-control-ability could enable bad actors to direct unwitting users to malicious Web sites or cause other harmful consequences using a technique that could bypass common security controls and fool even the most security savvy users.  ROPEMAKER could be leveraged in ways that are limited only by the creativity of the threat actors, which experience tells us, is often unlimited.

As time goes on, it becomes clearer that email is not the communication tool of the future. It can be exploited by those who seek to compromise your data in too many clever ways. What is needed to maintain a secure network of communication in the coming years is a tool that provides end-to-end encryption within an environment closed off to third-party actors.

This is exactly what we offer at Evizone. With our Evizone Secure Communications (ESC) product, you can be sure that all communications are sent and received as they are intended.

Contact us to test the strongest commercially available system for the secure exchange of messages, documents and files today.

Could a cyberattack send your stock price crashing?

A 2015 Harvard Business Review article argued that data breeches at publicly traded companies don’t generally hurt stock prices. The argument went that the damage from hacks can be hard to quantify or understand, so shareholders only “react to breach news when it has direct impact on business operations” or “results in immediate changes to a company’s expected profitability.” A stock might drop when news of a cyberattack breaks, but the price recovers quickly.

However, things have changed since the article was published.

CIBC World Markets equity strategist Ian de Verteuil made public this week a report titled The Known Unknowns. He suggests “it is likely we will have a major cyber-crime issue at one or more large public Canadian companies over the next year or two” and that it will result in a more important impact on stock prices than we have seen in the past.

The Globe and Mail reports:

“Mr. de Verteuil looked at five major cyberattacks on large companies over the past several years and found that stock prices dropped an average of only 2.4 per cent following a significant breach. In some of the cases there were extenuating circumstances. With JPMorgan, for example, the company made it clear the stolen information did not contain confidential data, such as passwords or account numbers.

In other cases, the attacks were significantly more costly to shareholders than the 2.4-per-cent average price decline. In the month following the 2015 cyberattack on Target Corp., the company’s share price slid, underperforming the market by 400 basis points. When the 2013 and 2014 breaches at Yahoo Inc. were made public in 2016, the company was in acquisition talks with Verizon Communications Inc. “The acquisition price was adjusted lower by $350-million (U.S.) – representing a 7 per cent drop in value,” Mr. de Verteuil noted.

Still, the 2.4-per-cent average decline is significantly less than what Mr. de Verteuil said he would have otherwise expected. That doesn’t mean that investors should be lulled into a false sense of security. According to a 2017 survey by IBM Security and the Ponemon Institute, over the past four years, cybersecurity breaches cost Canadian companies an average of $4.56-million per breach.

“The impact is a long-term brand issue more than a short-term expense issue,” Mr. de Verteuil said in an interview. “That’s tougher for the market to evaluate.” He added that it’s hard to measure the impact of cyberattacks on share price because companies are measured relative to their sector, and a cyberattack on one company can hurt investor confidence in others like it.

“Whatever the evidence to date, we believe that the frequency and severity of cyber-attacks will increase over time,” Mr. de Verteuil wrote in the report. “Shrewd investors will need a series of questions that provide insight into how seriously the c-suite of a company takes cyber-risk.””

It’s no surprise that this would be the case. As cyber-protection tools have become more sophisticated, victims of cyberattacks are being scrutinized rather than pitied. It is shocking to think that companies in 2017 would not take steps to protect their proprietary data more carefully, or implement corporate policies to avoid having employees fall for phishing schemes. And yet as we know, this is all too often the case.

There is no excuse for this, and there is no reason to let your company become the next victim of the world’s cybercriminals. With the help of Evizone Secure Communications (ESC) and Evizone Communications Governance (ECG), you can be sure that your most sensitive files are protected by our state-of-the-art software.

A (cyber) war with North Korea has already been waged for years

For a country with notoriously limited internet access, North Korea has been surprisingly aggressive with their cyberattacks over the last couple of years. Although a geopolitical storm is brewing between the United States and the Hermit Kingdom, a digital battle has already been fought for some time. Western governments and companies should brace for this cyberwar to heat up even more as the verbal threats fly.

It was reported this week that individuals involved with U.S. defense contractors were baited by Lazarus, the infamous hacker group believed to work for the North Korean authorities. This is the same group responsible for the 2014 Sony hack, a retaliation for the production of The Interview, a comedy depicting the assassination of Kim Jong-Un.

The group is also thought to be behind the WannaCry ransomware attack earlier this year. WannaCry affected over 300,000 people in 150 countries, notably by crippling the computer system of Britain’s National Health Service (NHS), causing surgery delays and emergency room shutdowns. It was the largest ransomware scheme in history, affecting banks, telecommunications companies, and a host of players in other vital sectors.

The latest hack was announced by Palo Alto Networks on Monday. They reported that weaponized Microsoft Office Documents were posted online using the exact copy of publicly available job descriptions for U.S. defense contractors and hosted on compromised systems. While it is unclear how the documents were distributed to contractors and if any were fooled by the postings, the malware was clearly targeted to those who may hold in their networks very sensitive information about U.S. military secrets and other government information.

As we have repeated many times, anyone acting as a supplier to the government or major companies is at great risk of being targeted by cybercriminals.

With the situation in North Korea escalating, companies and contractors everywhere need to take a serious look at their digital weaknesses and assess how to strengthen their cybersecurity capabilities.

The best way to do this is to use Evizone Secure Communications (ESC) and Evizone Communications Governance (ECG). Sign up for a free trial of our software and see for yourself how our closed communication and data storage system can protect your most precious information from unwanted intrusions.

Will NAFTA 2.0 compromise your data?

The renegotiation of the North American Free Trade Agreement (NAFTA) is slated to begin on August 16, and it’s top of mind for government officials in the U.S., Canada, and Mexico.

U.S. President Donald Trump made the renegotiation a key plank of his campaign platform, though it now seems like his government intends to enter the talks with a scalpel rather than the promised axe. Changes to the trade of goods and services will likely resemble modernization rather than a protectionist scale-back, as many worried about.

Yet even small changes could have exponential consequences, as many have pointed out with the issue surrounding copyrights and patents. There are similar concerns around cybersecurity, an issue that wasn’t of great concern when NAFTA commenced in 1994.

As Motherboard reports, privacy experts are “concerned American law enforcement or spy agencies could get access to Canadians’ sensitive information.” This is because the United States has indicated “it wants to end any regulations that restrict cross-border data flow, arguing they prevent US-based cloud storage companies from doing their business there.”

Data stored on Canadian servers are subject to the Charter of Rights and Freedoms and other Canadian privacy laws, but it does not apply to Canadian data stored on foreign servers. Canadian data stored on U.S. servers don’t benefit from American protections.

As a result, both British Columbia and Nova Scotia have implemented rules requiring government agencies to store their data in Canada. The U.S. administration sees these rules as unfair.

Critics cited in the article point out that that Canadian officials already share way too much information with the United States, and that data might not be safer on either side of the border.

Under these conditions, can Canadians ever expect to keep their data safe from prying eyes?

With Evizone, the answer is yes.

All data trusted to us through Evizone Secure Communications (ESC) and Evizone Communications Governance (ECG) gets stored in certified high-security data centers. Our patented software is the strongest commercially available system for the secure exchange and compliance archiving of electronic communications, and all files are protected by our proprietary double layer military-grade encryption.

Do give us a call to learn more, or visit us at http://evizone.com/free-trial/ for a free trial of Evizone Secure Communications and Evizone Communications Governance.