Welcome back to the monthly TCE Strategy newsletter! From A.I. lies to USB ports infecting your phone to 20 arrest warrants for a huge ransomware gang, May has not disappointed to keep the cybersecurity world on its toes. Let’s see how this month’s cybersecurity news can help us make better decisions about what is Secure Enough for us, the companies we work for, and our families.


Airports and USB chargers

The irony is not lost on me that as I type this from a lounge in the Las Vegas International airport, there are literally 50 USB charging ports within 100 feet of me. It has long been known that USB ports can be specially programmed to try to steal data from your phone or to infect it with a virus, to the point where some cybersecurity companies offer “data diodes” as giveaways at conferences that go in between your phone and a charger. The “data diode” allows your battery to charge, but no data to be transferred. I’d always considered this to be an unusual threat, so while I do not use USB chargers in airports, I haven’t recommended to my clients that they steer clear of them. Turns out I was wrong. The TSA has sent out a formal warning against using USB chargers in airports, as well as avoiding airport Wi-Fi systems. This is an interesting alert, as there are literally billions of dollars of infrastructure for those technologies in airports around the globe, but apparently the budget to ensure the security of those devices is an opportunity for improvement. The TSA did not elaborate on what triggered this alert, nor the number of incidents that they are aware of, but that is common in the world of cybersecurity alerts, regrettably.

Takeaway: If the TSA is sending out warnings about USB ports and airport public Wi-Fi systems, they likely know something that we don’t about the frequency of these attacks. Use a “data diode” or a portable battery to charge your smart phones and tablets. Use your phone as a Wi-Fi hotspot instead of connecting via a public Wi-Fi system. Stay vigilant.


AI lies and concerns, part 1:

AI “hallucinations” are a well-known (although not well understood) phenomena. I’ve had it happen several times myself: I ask ChatGPT a question. It gives me an answer. I tell it to cite 3 sources that support its answer. It ignores my request and doubles down on the answer it originally gave. I demand that I need 3 sources supporting that answer or I will consider this answer to be invalid. ChatGPT then reverses course and takes back everything it said and includes sources that contradict its original answer. This is a hallucination, and they happen with enough frequency that EVERYTHING you hear from an AI engine should be taken with a grain of salt, exactly the way that this news reporter didn’t. This was a pretty innocent mistake, in that this was concerning a summer reading list that was published in the Sunday's Chicago Sun-Times and The Philadelphia Inquirer. Some of the books on the list simply didn’t exist – they were a figment of an AI bot’s imagination. Regrettably, some AI mistakes are much more serious. I’ve had AI tell me that a certain cybersecurity attack vector is a very real issue and needs to be remediated, when in reality, there is no such attack vector. It just invented links in an attack chain that never existed.

Takeaway: AI does a lot of things well and is very useful, but it’s like a 4-year-old child: it doesn’t really understand the world that it lives in yet. Do not take AI answers as facts. Think of them as mild suggestions. That being said, I have had AI give me some terrific food recipes, so I trust it more in the kitchen than I do in my office. :-)


AI lies and hallucinations, part 2:

To continue on the 4-year-old analogy, AI engines are ingesting new data all the time to try to give better answers going forward, and this training often goes on without any awareness for the users, nor the millions of websites being scanned by AI. In fact, the website issue has become so significant that Cloudflare has introduced a new feature of their Website Application Firewall (WAF) that is specifically designed to fight this type of unauthorized scanning. They are also proposing that AI bots be required to authenticate themselves to websites before being allowed to scan them. The problem here is twofold: first, websites can publish anything the author wants to. There is no fact checking or “source of truth” on most Internet sites. Therefore, AI bots are certain to fall victim to the “garbage in, garbage out” computer issue that has existed for decades. Second, the data that we type into AI engines is being analyzed by the AI engine to turn its answers for future responses, often without our knowledge or consent. The privacy and cybersecurity implications here are huge (thank you Robert Whelan for sending me this article). CISA has released guidance on how to secure data used to train AI systems, so best practices in this area are available.

Takeaway: Don’t type anything into an AI engine that you wouldn’t openly tell your friends, family, or even complete strangers. Think of AI as an untrusted stranger, and be careful what you tell it.


Cybersecurity as a war machine disruptor

It was common in WWII to attack the supply lines of your enemy as opposed to your enemy directly, as without food, ammunition, weapons, etc., their ability to fight is greatly diminished. This playbook has not changed, although the methods used to implement it are vastly different in the Internet age. US Intelligence has announced that Russia is targeting private companies that are involved in supplying Ukraine’s war effort with cyberattacks. This isn’t a new tactic, as the “Sunburst” Solarwinds Orion breach from a few years ago so famously demonstrated, but the scope of this appears to be far more widespread.

Takeaway: Cybersecurity is about measuring and mitigating risk. For any company that is even peripherally involved in the Ukraine war effort, consider yourself on the cybersecurity front lines of a war zone. According to the USA, UK, and Australian governments, you are.


Finally, some good news!

Supply chain attacks can cut both ways: In an impressively coordinated takedown, a Europol cybercrime policing effort called “Operation Endgame” took down 300 servers and 650 website domains that were being used as part of ransomware attacks, along with issuing arrest warrants for 20 individuals. Almost $4 million in cryptocurrency was also recovered. While those numbers represent a drop in the bucket to cybercrime activities overall, every bit helps. Congratulations to the Europol team that made this a reality.


Until next month, stay safe!

TCE Strategy in the News

Thank you to Gordon Severson, KARE 11 and NBC for the opportunity to partner on a story about a $2.4 million dollar cryptocurrency heist in Anoka County, Minnesota.

Interesting Articles