|
Welcome back to the monthly TCE Strategy newsletter! February may be the shortest month of the year, but there has been enough cybersecurity news to fill a book. From a bank heist of over $1 Billion dollars to people with certain last names not being able to function in today’s digital world, let’s see how this month’s cybersecurity news can help us make better decisions about what is Secure Enough for us, the companies we work for, and our families.
There hasn’t been a bank robbery this big in over 20 years
It was 2003 when Iraq dictator Saddam Hussein sent his son Qusay to withdraw approximately $1 Billion from the Iraq Central Bank, shortly before the USA-Iraq war began. After 22 years of inflation, this is approximately $1.7 Billion in 2025, and is the largest known bank robbery on the planet.
This month’s crypto heist didn’t quite top Saddam’s record, but it came close. Bybit is a large crypto exchange, and they keep a lot of their cryptocurrency in “online” storage so that it is easy for customers to trade it. Some of their cryptocurrency was kept in “cold” storage, which uses an offline storage device (sometimes called a wallet) to store the account keys to the cryptocurrency in question. On February 21st, Bybit lost $1.5 Billion in Etherium (ETH) cryptocurrency when they did a transfer from one of their cold-storage wallets to a warm wallet. The funds never made it to the intended warm wallet. Bybit stated that “this transaction was manipulated through a sophisticated attack that masked the signing interface, displaying the correct address while altering the underlying smart contract logic.” The North Korean government is being attributed as the attacker by multiple sources.
Takeaway: cryptocurrency is still in its infancy. It’s made some people very wealthy, and has caused great misfortune for many others. There is little recourse if someone gets into your (or your crypto exchange’s) wallet. As long as nation state actors are trying to steal crypto, defenses against crypto theft need to be strong enough to make it economically unattractive for governments like North Korea to steal crypto. That level of security will be difficult for private companies to employ. Be careful how much of your investments are in cryptocurrency.
What’s in a name?
Technology has changed how we function as a society in countless ways. Prior to railroads, each town had its own measurement of time based on when the sun was highest in the sky. If it was noon in Milwaukee, WI, it would be 11:54AM in Madison, WI, which is 50 miles West of Milwaukee. This became an issue when two trains coming from two different directions on the same track couldn’t agree on what time it really was, so they hit each other. Time zones were invented as a result, and the problem was resolved.
Fast forward to 2025, and we have a new problem. People’s names are becoming incompatible with today’s technical world. Sometimes it has to do with marketing decisions (I’m looking at you Amazon (Alexa) and Apple (Siri), but sometimes the issue is more fundamental than that. In the world of mathematics, the term “null” represents a group (also known as a set) that contains zero objects. That idea was adapted for the world of punch cards in the early/mid 20th century, and the concept of a “null” value meaning nothing (or undefined) quickly became the standard across most programming languages. That becomes an issue when people with a surname of Null try to function in today’s world, as databases everywhere see a value of “Null” to mean “empty” as opposed to a last name. There are details here where a field in a database can be defined as something called a “string”, which the database is NOT supposed to interpret the data in the field but rather take it at face value. If a database does not have the field for a person’s last name labeled as a string, the database will usually take a value of Null to mean “nothing” and chaos ensues shortly thereafter.
There are many real-world consequences to issues such as this. Getting a visa to some countries is challenging with a last name of Null. Applying for Federal Student Aid in the USA wasn’t possible for most of 2024 if your last name was Null. Communicating over email with a major bank is sometimes impossible if the word “null” is anywhere in the email address. On a more humorous note, there is a story of Joseph Tartaro who got a vanity license plate of “NULL” for his car, in the hopes that his plate would cause grief for any police system that tried to issue him a ticket. Instead, he receives hundreds of letters for other people’s traffic tickets, as some systems inject the word “null” into a database field that was left blank, meaning that if a police officer doesn’t fill in the license plate number on a ticket, the database may put “null” to that field instead. The word “null” in the computer world is a double-edged sword.
So what should a person with a last name of Null do? This issue did not come from anyone’s deliberate actions – the origins of the word come from the Latin nullus, meaning “nothing” or “none”. Programmers can help work around issues like this, but it’s hard to think of all edge-cases (although some have tried). Is this a problem bad enough that some people may consider changing their last name? Apparently it is.
Takeaway: Some people change their names to get into show business. Some people change their names to try to escape their past. Some people change their names so that they can function in the modern world. While I haven’t been in this situation personally, the struggle to live in a cyber world sometimes forces people to decide when to try to change the world to be more amenable to their situation vs when to change their situation to be more amenable to the world.
Until next month, stay safe!
|
