Author: armour

We read in the New York Times just this week that thousands of the EU’s diplomatic messages have been intercepted over the course of a concerted three year attack.  https://www.nytimes.com/2018/12/18/us/politics/european-diplomats-cables-hacked.html According to Computing the hackers accessed the European network known as COREU or CORTESY.

COREU is a comms network of the European Union for the communication of the Council of the European Union.  It is the European equivalent of the American Secret Internet Protocol Router Network (SIPRNet, also known as Intelink-S).

The original system was set up in the early 70s and was telex based.  It was replaced in the 90s by CORTESY (COREU Terminal Equipment System), so despite using encryption for messages it is still very old technology.

One crumb of comfort is that information marked as CONFIDENTIAL or SECRET was not affected.

However, this does highlight that even what on the face of it may be mundane, day to day communications are of interest and therefore of value to someone – in this case, the suspected perpetrators are the Chinese military.

Protect your Intellectual Property

While your organisation may not be of interest to the Chinese military, there will be someone out there who probably would like to know a bit more about your business.  Competitors that want to target your customers, or access trade secrets (product information, formulae, recipes, etc.), or hackers and criminals looking to steal your identity or the contents of your bank account!

My point is that your information doesn’t need to be what you would naturally think of as confidential or secret.  Everyday messages about clients, products, product recalls, meetings, office gossip can all be valuable for profiling and piecing together information about who you are dealing with, the nature of those dealings, and information about individuals that could be used for commercial leverage or identity theft.

Mobile devices – the new End Point

With our almost universal reliance on computers, industrial espionage has become a lot more about hacking skills.  Hugely valuable information is accessed by workers from their mobiles and with GDPR many organisations are beginning to understand that the new end-point is mobile phones and the consumer grade apps that staff use to communicate.

As we’ve said on numerous occasions, don’t be lulled into a false sense of security by the word ‘encryption’.  Encryption is never the weakest point that hackers will target.  It is usually a weakness in the system; in the case of the EU it was old technology.  Even if you are using relatively new technology in the form of messaging apps, you still need to consider the security of your whole mobile comms system, including where data is held (i.e. is your service provided by a multi-national social media company that needs to monetize its members’ data to make revenue?), exactly who might have access to it, and any weak points within the system.

Here are a few of our recent blogs that explain the pitfalls in more detail:

The dangers of relying on SMS based two factor authentication:

https://www.armourcomms.com/2018/08/16/avoid-sms-based-two-factor-authentication/?cat-slug=10

Chat apps that have spread through corporate networks by stealth are the most hacked type of app, and the most widely banned:

https://www.armourcomms.com/2018/07/31/free-apps-you-might-get-more-than-you-bargained-for/?cat-slug=10

Avoiding shady Wi-Fi hotspots:

https://www.armourcomms.com/2018/07/05/world-cup-fever-or-holiday-wi-fi-nightmare/?cat-slug=10

Staff mobile phones are also covered by GDPR, here’s what you need to do:

https://www.armourcomms.com/2018/05/24/gdpr-is-here-dont-forget-your-mobile-comms-need-securing-too/ 

If you fear that your mobile comms could be vulnerable to eavesdroppers, competitors or criminals, contact us today to discuss a solution.

A lesson from the world’s most famous hacker!

Kevin Mitnick is the keynote speaker at Cyber Incursion, on 22 November, 12.30 to 19.30 at The Honourable Artillery Company (HAC), an event that will see our own Andy Lilly on the panel for the debate about the dangers of Social Engineering and the Insider Threat.

Learning to think like a hacker is a good strategy for improving your cyber security and many of the best security experts who now wear white hats started out as script kiddies.

As the cyber security threat landscape evolves, we are finding that it is not just government and military type organisations that are under siege. Increasingly we are working with private sector companies that are keen to protect their trade secrets and keep intellectual property secure.

Your intellectual property is highly valuable

Cyber Incursion is aimed at companies that are beginning to understand just how valuable their intellectual property and sensitive customer information is.  Whether it is a takeover or merger that could have implications on stock valuations should the news leak too soon, contract negotiations that you wouldn’t want your competitors to see or even know about, or you need to protect customer information to comply with GDPR, most organisations have some IP that they wouldn’t want to lose or see fall into the wrong hands.

You are the weakest link – the dangers of social engineering

These days, hackers are very clever, or should I say, even cleverer.  They will always go for the weakest link, which is us humans, and their approach will often involve some element of social engineering.  When people are out of the office, working via their mobile devices, they are away from their typical work environment; this may lead them to let their guard down, and this is often a good time to strike.  We’ve all been there – a quick call to a colleague to get a vital piece of information to finish off the contract or document we are working on, or to finalise the date and time for a sensitive meeting. The information exchanged could be very valuable to someone else, but it’s only a quick call – what can go wrong?  Well, plenty!

Don’t get caught out

Your call could be intercepted by an IMSI catcher, also known as a fake base station. Even entry level criminals or script kiddies can access this technology, that enables them to harvest your call and location metadata (who you spoke to or messaged, how long for, etc.), for just a few hundred pounds. Depending on the hack, the details of your conversation could be accessed by the attacker.  Alternatively, while the contents of your call might be encrypted, your metadata may not be protected, and sometimes knowing who you are communicating with, for example during a merger or acquisition, can be every bit as helpful to your competitors, or in the case of celebrities, paparazzi or tabloid journalists.

Cyber Incursion

As well as an opportunity to hear from the world’s most famous hacker, Kevin Mitnick (who was once on the FBI’s Most Wanted list because he hacked into 40 major corporations just for the challenge), Cyber Incursion has a packed agenda covering such topics as:

• AI
• Threat Intelligence
• Internet of Things
• Big Data and Forensics
• Social Engineering and the Insider Threat
• And how they can all have a very real impact on commercial business today!

 

Register today – there are limited spaces: https://www.cyberincursion.com/ 

Currently, mission critical push to talk services in the UK are run over a network called Airwave, which is based on Terrestrial Trunked Radio (TETRA) technology. Although effective for voice communication, the infrastructure required has become increasingly expensive to maintain and the needs of service users are beginning to surpass the capabilities of the technology.

Mission critical services in the digital age

Until now, mission critical users have largely relied on voice services alone, however this is no longer adequate for incident command, control and communications. The existing narrowband voice and data network cannot provide the data services such as video and internet access, which have higher bandwidth requirement. 4G LTE is a technology that delivers the point to point high bandwidth data services required for future needs.

The main benefits of migrating to 4G LTE for mission critical push to talk services is the amazing speed and functionality that it can deliver. Increased bandwidth leads to much faster data transfer speed which is especially advantageous in emergency situations where real-time data will allow officers and control room operators to enhance their assessments of incidents. Additionally, by migrating onto a modern platform, users will no longer have the costs of maintaining legacy infrastructure.

Emergency Services Network

The UK Government has been leading the change to LTE with the development of a new Emergency Services Network (ESN), which will use an existing commercial 4G network that is being expanded to ensure a 99% coverage rate for the UK. This will allow emergency services to access real-time information, send images and stream high resolution video. This level of visibility was not previously possible with the voice only descriptions that were available over the TETRA network.

The increase in digital information collection presents both an opportunity and a challenge for emergency services. Body worn camera footage, dash board cameras and real-time access to systems or CCTV images are valuable but rely on access to a reliable, high availability network. By embracing LTE as the global standard of critical communications, governments can provide an important foundation for new capabilities that increase response times, improve situational awareness and accelerate incident closure rates.

A unified global standard

The 2nd ETSI MCPTT Plugtest held in the spring of 2018 was a defining moment for LTE-based mission critical push-to-talk (MCPTT) technology. The capabilities of Mission Critical voice, video and data were put to the test with a 92 per cent interoperability success rate achieved.

The goal to provide one global standard for Mission Critical services offers huge opportunity for positive change. Governments around the globe have the chance to truly elevate their emergency service communications to world leading standards utilising leading edge technology that is fit for purpose.

Two factor authentication (2FA), a combination of two of something you know (a PIN), something you have (a token) and/or something you are (biometrics), has long been held up as best practice for login security.  And in fairness, more and more devices (Apple for example) and some websites, are making it mandatory. However, as was highlighted recently by the Reddit security breach, it may not be quite as fool proof as people might have hoped.  Read the details here:

https://www.theregister.co.uk/2018/08/01/reddit_hacked_sms_2fa/

https://krebsonsecurity.com/2018/08/reddit-breach-highlights-limits-of-sms-based-authentication/

The incident in question shows that employee accounts were hacked despite using SMS-based 2FA.

Although the exact nature of the hack has not been disclosed, the ability to intercept SMS messages via vulnerabilities in SS7 has been around for years but other mechanisms include getting control of someone’s phone account via SIM-swapping and is a topic that we have written about at length.

Using SMS as the second factor in 2FA is, strictly speaking, not a second factor at all because it is using the same delivery method as the first factor, i.e. in addition to typing your password into a login page, you also type the SMS code into the same web page.  It should really be called Two Step Authentication, and unfortunately can still be subverted by phishing, man-in-the-middle and credential replay attacks.

Using a third party security app like Armour Mobile protects against this type of attack, as not only is the message data encrypted but also the meta data and therefore, it is far harder for criminals to compromise the integrity of a mobile account to intercept messages.  So if you have employees that handle potentially sensitive information, whether that is customer information, or company intellectual property, or commercial secrets, and that could be all of your staff, you need to think about how well their mobile devices are really secured.

Could be time to take a look at Armour Mobile!

Contact us today – sales@armourcomms.com