TMCnet News
Analysis After cryptolocker, how do we make data safe?(Guardian (UK) Via Acquire Media NewsEdge) Consumers will continue to be the victims of cybersecurity crises unless businesses take more steps to protect the personal information of users, Christopher Graham, the information commissioner, warned yesterday. Graham said he was worried that the UK was not sufficiently alert to the security concerns of the 21st century. "This sort of thing is going to go on and on and on until businesses wake up and realise that personal information is not their plaything; it's our information and it needs to be protected," he said. High-profile attacks, vulnerabilities and malicious software have created a string of troubling headlines in recent weeks, from the heartbleed flaw which undermined the security of hundreds of thousands of web internet servers, to what has been described as the biggest ever hack against eBay, which forced 145 million users to change their passwords. Last Friday, a joint operation led by the FBI, Interpol, and the UK's National Crime Agency, led to the closure of a criminal network that was using the cryptolocker malware, a "virus" that infects computers, encrypts files and demands a ransom (usually of about pounds 400) to decrypt files. People have been tricked into paying after ransom messages accusing them of illegal activity. "Cybercrime is real, hacking is real. Watch out there's a data thief about," Graham told the BBC. "As individuals we need to be very careful." Despite the rare success of a coordinated attempt to bring down a prolific network of malicious software, experts believe it will be only a matter of weeks before criminals adapt and relaunch the virus. "There are more cybercriminals on the internet than ever before and their tools are increasingly sophisticated, but the weakest link in the chain is still the bit between the chair and keyboard - we need to patch the human," warned David Emm, a security researcher from the internet security firm Kaspersky Lab. "Cybercrime is as old as the internet, and that means we've had time to study it. We are now familiar with it and can often deal with it." The security and safety of computers used on a daily basis is serious as a range of activities, from banking and tax returns, to shopping and private messages, relies on the internet. Use of security measures and software updates can help protect stored data, but in the past week some large companies have come under attack by criminals online. "There have been some very doomsday headlines recently and people are starting to suffer from notification fatigue," said Rik Ferguson, global vice president of security research at the security software firm Trend Micro. "We've had eBay first, then Spotify, [and the shoe retailer] Office - all within a week of each other as well as the heartbleed bug from April." The eBay break-in affected 145 million people, while heartbleed put most of the internet-using public at risk of data theft through a bug in the technology responsible for securing internet connections (commonly denoted by the padlock symbol in the address bar). Each of the break-ins has led to data being stolen. While for the most part that does not include financial information such as credit card numbers, it has included personal information which can be valuable to criminals. "We have to take care of our data, but in many circumstances if we want to use a service we have no choice but to surrender data, stuff that is very difficult to change," said Ferguson. Personal information such as usernames, passwords, postal addresses, birth dates, phone numbers and email addresses, are often used to verify identity. Once that information is no longer private, verification checks become easier to fake, leaving people at risk of identity theft and phishing attacks where they are tricked into revealing financial information. "All data that is shared should be done so in the knowledge that it absolutely is at risk from targeted attack," said Ferguson. "All of that data has financial value to the attacker, and they will continue to go after it." The eBay and Office attacks highlighted the lack of protection big companies have applied to user data beyond financial information, leading many security experts to call for companies to encrypt all user data as standard. "It is inexcusable for a company the size of eBay with the amount of data it holds to not encrypt all personal information held and to not constantly be at the forefront of security technology," said Ferguson. Giving out personal information to companies is often unavoidable - a postal address must be given to online stores for deliveries, for instance - but some companies ask for information that is not crucial. Experts suggest the best protection is not to hand over the information in the first place. People, they say, should also use complex passwords unique to each service to avoid one online break-in affecting all the services used. "None of us are taking this seriously enough, none of us are as good as we should be about passwords - changing them regularly and using credible, hard, passwords that aren't just the name of your cat or your mother-in-law," said Graham. Ferguson said: "The quickest, easiest and in many cases free way, to help protect yourself is to use a password manager." Password managers safely store passwords for users so that they do not have to remember them. "They mean that you can at least confine risks to individual accounts with unique passwords when they are breached," said Ferguson. As long as computers were "cleaned" and updated automatically, anti-virus software was updated and the online world was treated with the same scepticism as the real world, users could "go about their business as normal and not worry about it too much", Ferguson suggested. Consumers are being encouraged to update anti-virus software on their computers, make sure their PC is running a current version of Windows such as Windows 7 or 8 (not the unsupported Windows XP) and enable the automatic updates in the settings, which will make sure the system is as up-to-date and protected as possible. The other solution is to keep up-to-date backups of files on the computer, which would prevent a cryptolocker attack becoming an issue. Cybercrime affects 556 million people around the world every year, including 600,000 Facebook accounts, and is estimated to cost $100bn annually, according to the security firm Norton. Russia is by far the biggest source of cyber attacks, contributing to 39.4% of all cyber crime, while the US accounts for 19.7%. Nearly 40% of attacks relate to crime and stealing or defrauding victims of money or personal information, while 50% are protest hacks, 7% cyber espionage between corporations, and 3% cyberwarfare between nation states. Viruses, malware and trojans account for 50% of all attacks. Captions: A hack against eBay forced 145 million users of the site to change passwords (c) 2014 Guardian Newspapers Limited. |