|
Welcome back to the monthly TCE Strategy newsletter! September has been another whirlwind in the world of cybersecurity. From new hacks on AI to a cyberattack that has taken down Jaguar Land Rover for an entire month, we have a lot to review. Let’s see how this month’s cybersecurity news can help us make better decisions about what is Secure Enough for us, the companies we work for, and our families.
New proof-of-concept on how to use AI to hack online storage (such as Google Drive)
In a very interesting article shared by Bruce Schneier in his monthly newsletter, a novel and easy-to-implement attack was presented at the Black Hat hacker conference recently. Here is how it works:
-
A user of ChatGPT allows the AI engine to have access to his/her Gmail account and/or Google Drive data. In fact ChatGPT literally prompted me asking me if I wanted to do this a few weeks ago (I said no).
-
A cybercriminal shares a Word document with a victim. It could have a name of “meeting minutes” or “list of favorite bands” or anything else. When the share occurs, the data is also shared with ChatGPT because of the link I described above.
-
The next time the victim goes to ChatGPT and gives any sort of command that asks ChatGPT to look at his/her files (something like “summarize any meeting notes from the last week” or “find my pictures from my Puerto Rico trip” or “where is my recipe for beef stew”, ChatGPT will go through the users files looking for the requested information.
-
The shared Word document the attacker sent is malicious, in that it has text in the document that is in a very small font and is the same color as the background of the document. That text asks ChatGPT to search for, say, encryption keys or bank account information or passwords or anything else in the victim’s Google Drive files, and the text also asks ChatGPT to send that information to the attacker’s email account.
-
ChatGPT does exactly what it is asked to do and sends the victim’s data to the attacker.
This is extremely bad. The victim never has to open the file. The victim’s antivirus is unlikely to ever see the malicious Word document, as it never existed on the victim’s computer. This is what is called a “zero-click” vulnerability, as it does not require action from the victim (although in this case, it does require that the victim ask ChatGPT to so something with his/her files, but it could be an instruction about almost anything that will get ChatGPT to access the victim’s files, so it’s almost zero-click)
Takeaway: Do NOT give an AI engine unfettered access to your email or your file shares. Consider some of Google’s security measures to reduce the risk of AI-based attacks.
Jaguar Land Rover breach halts operations for the entire month of September
There aren’t a lot of details on this one, but on August 31st, a cyberattack took place on Jaguar Land Rover’s critical IT systems. They have not confirmed that it was ransomware, but it sure smells like ransomware. Their 3 factories in the UK are all shuttered, and most of the 33,000 employees have been told to stay home. These factories normally produce roughly 1000 cars per day. They are currently producing zero cars. They are producing zero parts that are needed for cars at other plants. This is bad.
It often takes at least a week to start resurrecting systems after a major cyberattack. Sometimes system issues may require all systems to be unavailable into a 2nd week, but it’s very unusual to have no meaningful progress in recovering from an incident after a full two weeks. Well, as of this writing, all 3 factories remain shut down. The company has stated that they are shooting for an October 1st resumption of activities. That’s a long outage. The cybercriminal group “Scattered Spider” has claimed responsibility, but Jaguar Land Rover has not confirmed that.
Takeaway: Ransomware is a preventable crime. Offline data backups are your friend. Tested disaster response plans are very useful. CISA just released a best practices guide on how to recover from cyberattacks (and I agree with the vast majority of their recommendations), but a strong proactive cybersecurity posture is a MUCH better approach than a reactive one. Ransomware prevention is all about cybersecurity basics. Patching. Good passwords. Multi-factor authentication. Cybersecurity awareness training. Proactive vulnerability scans. Strong IT best practices where IT team members don’t log in with their domain administrator credentials for everyday work. Good antivirus that is monitored. These things matter. Just ask Jaguar Land Rover.
Follow-up on City of St. Paul breach last month
This newsletter covered the major breach of the City of St. Paul, MN, USA in our August issue. Recovery was surprisingly slow, but most services have been restored. The mayor announced on September 10th that the city is allocating $1 million toward improving the cybersecurity posture of the city. That is $1 million out of a total budget of $887 million. Will $1 million help if it’s spent correctly? Yes. Will it make the city reasonably secure from another major ransomware attack? To be honest, I seriously doubt it. One of the biggest issues in incident recovery is updating systems that are too old to be made secure against the threats of today. I’m talking about systems running operating systems that are no longer supported by their makers (nor any antivirus programs), applications that have known vulnerabilities but no patches are available. These are the equivalent of cars made before the invention of seat belts. Do they still work? Yes. Are they safe? No. Can they be made reasonably safe in a world filled with 70MPH highways? No. The City of St. Paul likely has systems that would take tens of millions of dollars to make ransomware resistant. A $1MM investment is a good start, but it’s likely a band aid in a situation where surgery is the only long-term solution.
Until next month, stay safe!
|
