An Irish cyber-thief has been jailed for his part in a SIM-swap conspiracy that robbed victims of their life savings.

Conor Freeman was identified by US Homeland Security as a member of a criminal group that stole over $2m worth of cryptocurrency from multiple victims in 2018.

Freeman, of Dun Laoghaire, Dublin, pleaded guilty to stealing cryptocurrency, dishonestly operating a computer to make a gain, and knowingly engaging in the possession of the proceeds of crime.

The 21-year-old handed over a virtual wallet containing 142.75682712 Bitcoin—now worth over $2m—to the gardaí­ at the time of his arrest. 

Together with at least five co-conspirators based in the US, Freeman used a SIM-swap scam to steal cryptocurrency worth $100,000 from Darran Marble on May 15, 2018. The next day, the group targeted Seth Shapiro, making off with $1,921,335 in virtual money. 

Two days later, the cyber-criminals used the same technique to illegally relieve Micheal Templeman of cryptocurrencies with an approximate value of $167,622.22.

Passing sentencing in Dublin Circuit Criminal Court on Tuesday, Judge Martin Nolan noted that Shapiro lost the proceeds of the sale of his house and his entire life savings to Freeman and his co-conspirators.

Although Nolan deemed it unlikely that Freeman would reoffend, he gave the Dubliner a custodial sentence of three years for crimes that involved “guile and deception.” 

The court heard that Freeman met his co-conspirators online. Together, the group combed social media for targets that might have access to large amounts of cryptocurrency. 

After choosing a victim, the group would scour the internet until they found the target’s email address and phone number. Contacts who worked in telecommunications transferred the phone numbers of potential victims onto SIM cards bought by the group. 

By initiating protocols set up to assist people who forget their passwords, the group managed to gain access to victims’ online accounts. Freeman’s role was to sift through victims’ emails to identify sources of cryptocurrencies they possessed. 

Defending Freeman, Paul O’Carroll SC described his client as “very much a loner” who started hacking the accounts of other gamers for a thrill while he was in his teens.

Freeman’s five co-conspirators are before the courts in the United States.

Americans are planning to do more of their holiday shopping online this year despite being concerned that they might fall victim to cyber-scams.

Research by global computer security software company McAfee found that 36% of American consumers are planning on buying gifts online this year despite 60% feeling that cyber-scams become more prevalent during the holiday season.

The findings were included in McAfee’s “2020 Holiday Season: State of Today’s Digital e-Shopper” survey that was published yesterday. McAfee commissioned 3Gem to conduct a survey of 1,000 adults over the age of 18 in the United States between October 8 and October 13, 2020.

During last year’s Black Friday to Cyber Monday holiday weekend, more than 124 million consumers chose to make their purchases in-store. In 2020, as the world grapples with COVID-19, consumers have shifted direction, shopping more and buying what they need through their devices. 

The survey revealed that 49% of Americans said they are buying online more since the global pandemic struck. Nearly one in five consumers (18%) said that shopping online is a daily activity, while one in three (34%) make purchases via the internet 3 to 5 days a week.

Over a quarter (27%) of respondents ages 18 to 24 said that they checked the authenticity of discounts and deals sent to them via email and text message. Overall, fewer than half (43%) said that they would be checking to see if Black Friday or Cyber Monday emails and text messages sent are trustworthy and genuine.

Researchers noticed a difference in concern over cybercrime across generational age groups. While 79% of those aged 65 or older believe there is a greater cyber-risk due to COVID-19, this view was shared by only (70%) of those aged 18 to 24.

“Many are wondering what this year’s holiday season will look like as consumer shopping behaviors continue to evolve and adapt to the challenges faced throughout 2020,” said Judith Bitterli, vice president of consumer marketing.

“With results showing the growing prevalence of online shopping, consumers need to be aware of how cyber-criminals are looking to take advantage and take the necessary steps to protect themselves—and their loved ones—this holiday season.”

Social media giant Twitter has created a new head of security position and hired a world-famous hacker to fill it.

The appointment of 49-year-old American Peiter Zatko, known online by his hacking handle “Mudge,” was announced by Twitter on November 16. 

According to Reuters, guitarist and Berklee College of Music graduate Zatko has been given a broad mandate to review the security structure and practices of the networking site and recommend changes. After a review period that will last up to 60 days, Zatko will report his findings and suggestions directly to Twitter’s CEO, Jack Dorsey. 

In an exclusive interview with Reuters, the new appointee said he will be digging deep into Twitter’s “information security, site integrity, physical security, platform integrity—which starts to touch on abuse and manipulation of the platform—and engineering.”

Previously, Zatko worked at electronic payments unicorn Stripe, where he oversaw security. Prior to that position, the network security expert was hired by Google to oversee the distribution of grants for projects relating to cybersecurity at the Pentagon’s Defense Advanced Research and Projects Agency (DARPA).

Dan Kaufman, who supervised Zatko during his time at DARPA, commented: “I don’t know if anyone can fix Twitter’s security, but he’d be at the top of my list.”

Hacker, writer, and open-source programmer Zatko began his career as a government contractor carrying out classified work while simultaneously leading hacking group Cult of the Dead Cow. The group gained notoriety for placing pressure on Microsoft to up its security game by releasing Windows hacking tools.

Zatko was also the most prominent member of hacker think tank L0pht Heavy Industries, a group known for pioneering responsible disclosure of vulnerabilities. Zatko was among seven L0pht members who claimed that they could shut down the internet in 30 minutes while giving testimony before the Congress of the United States in 1998 on national cybersecurity. 

Describing his new employer, Zatko said: “They are willing to take some risks. With the challenges of algorithms and algorithmic bias, they are not standing by and waiting until someone else solves the problem.”

Speaking during the virtual (ISC)² Security Congress Alex Haynes, CISO at CDL, explored the various pen-testing approaches available to organizations and outlined how companies can determine which is the best option for their business use cases.

“The problem with pen-testing in the market is that there’s an ‘alphabet soup’ of terminology and it is very easy to get confused when there are all these marketing terms being thrown around.”

Essentially, there are three key approaches to pen-testing that organizations can implement, Haynes said.

The first is traditional pen-testing, defined as a “snapshot of your security posture at a particular point in time.”

The pros of traditional pen-testing methods include cost efficiency, flexibility and standardization. However, there are important inadequacies to consider when it comes to traditional pen-testing approaches, Haynes warned. These include the fact that they are infrequent, time-limited, lack diversity in approach and can invoke pen-tester syndrome (a focus on theoretical vulnerabilities that make things appear worse than they actually are).

The second approach to pen-testing open to organizations is the crowdsourced security option, Haynes continued. This involves “having more than one tester who has no affiliation [with your systems] looking for bugs and vulnerabilities on your systems and applications.”

A crowdsourced security pen-testing strategy offers some key benefits that traditional pen-test methods cannot, including higher frequency rates, unlimited time-scales and a more cost-effective business model (in the short run) in which researchers are only paid per vulnerability rather than taking a full salary.

However, as with traditional pen-testing approaches, crowdsourced strategies have their own drawbacks to consider. These include web-heavy skillsets of researchers, potentially unethical behaviors and heavy network traffic .

The third and final approach to organizational pen-testing is automated pen-testing, Haynes said.

“This mimics the behavior of a human attacker by choosing the best kind of attack vector for a particular vulnerable system, at scale, without human intervention.”

Automated pen-testing can be run on a daily basis/continuously, generate reports on the fly and be configured to start from anywhere or only use certain vectors for testing certain attack scenarios, so they have clear benefits, Haynes explained.

At the same time, as with traditional and crowdsourced pen-testing, there are downsides to automated pen-testing such as the fact that they are only useful for pen-testing inside the network, have a lack of understanding regarding web applications and potentially high cost-per-asset expense for larger networks.

To conclude, Haynes said that deciding which pen-testing approach is best suited to any organization depends on various factors, but added that strategies are not mutually exclusive, always start with pen-testing to establish a baseline and, if your budget permits, can be layered with other approaches.

Consider using a strategy of quarantine when implementing a ransomware recovery strategy, as reinfection can easily occur.

Speaking as part of Druva’s Cloud Data Protection Summit, Charles Green, sales engineer at Druva, said the shift of data outside the company perimeter and firewalls led to an increase in ransomware payments, as well as more cyber insurance options to cover those payments.

He explained that there are a number of challenges when dealing with a ransomware event, and he said anything you can do “that could be automated should be automated,” including:

• Respond – quickly via automated or orchestrated response
• Prevent – download of infected snapshots
• Identify – last known good copy to recover from
• Recover – with confidence

That last point, he claimed, requires air gaps, as data protection is “a last line of defense when all your other preventative controls have failed.” He said that your data protection solution should be able to provide automated anomaly detection, especially where there is a large number of files added or deleted from a backup set. “This will all enable an administrator to identify a last known good copy that they can recover from,” he said.

“Also, while you’re working through your environment, you should be able to quarantine backups and prevent users from reinfecting the environment.”

He recommended using a more granular quarantine approach, rather than having to quarantine all data. If you are also able to quarantine by a specific date range, you will be able to restore from snapshots that are “known good” and you can continue to function as a business whilst this is going on.

Also, remote wipe devices, to prevent further malware spread. This he called “defensible deletion,” as it deletes from devices and backups, and is something that is very critical when you’re dealing with ransomware.

He said ransomware recovery tools, such as one provided by Druva, can be used “to quarantine snapshots, know where your data is being accessed from and also leverage things like our federated search and defensible deletion process” to deal with ransomware attacks.

Green said ransomware prevention is reliant on backup, which he said was critical, and should be “secure by design; it should not be an add on or an option.” He also said you should know that a backup set is protected “and to get more from your backup, look for things like detective controls and anomaly detection that will alert you to a challenge to your environment.” He concluded by saying this will help you recover successfully and securely.

Learning lessons from the COVID-19 pandemic is vital to growing resiliency in the cybersecurity industry, according to Juliette Kayyem, former assistant secretary at the Department of Homeland Security, speaking during a keynote session at the virtual (ISC)2 Security Congress.

She began by outlining the five stages of crises management, noting that COVID-19 bears many similarities with other crises. These consist of two prior to the “boom,” which are protection and prevention, and three after: response, adaptive recovery and resiliency.

What differentiates COVID-19 from other crises, however, is the sustained focus on “adaptive recovery” with minimized contact intensity set to be in place for the foreseeable future. This is opposed to other crises which generally allow life to return to normal quickly. “This period is going to exist until further notice,” said Kayyem.

This adaptive stage does provide a unique opportunity for lasting resiliency to be achieved. This means that through learning the lessons of the pandemic, in many ways, life will not simply return to normal. In the context of the workplace, she anticipated that the experiences of the pandemic will lead to numerous permanent changes including much more remote working, a greater focus on employee health, including the rise of the chief health officer and better protections for gig and contract workers.

Kayyem stated: “COVID-19 has laid bare some necessary conversations that we’ve only been whispering about in the last couple of years, and just like so many other major crises that have happened in our past, they open up an important conversation about what kind of nations and what kind of world we want to be.”

This new landscape is going to heavily affect the cybersecurity sector and industry leaders need to now plan ahead rather than constantly introduce patchwork solutions, according to Kayyem. “Do you accept that you need to think about what it’s like to manage a security team through to the end of 2021?” she asked.

This includes anticipating early investments needed in technology systems, the kinds of security threats that may exist going forward and ways of communicating in this “new normal.” To do so, she advised: “You need to set an implementation plan that gets you to the end of 2021 in terms of needs, employees, workforce development, hiring and budget, and you need to make that case loud and clear.”

Another area Kayyem highlighted the importance of is working out how security teams can maintain some form of physical contact, which is likely to be a challenge in the current adaptive phase. “What combination of your security team will need to meet, who within the security team, how will you on-board and how employees will learn what the corporate culture is” she outlined.

Ensuring security stays a key focus throughout their organization over the coming 18 months also must be a key focus of security leaders, with complacency easy to set in. Kayyem commented: “It may be that you need to build new resources, do retraining and remind people… you’ve got to reiterate those security needs.”

She concluded: “We are in a time in which we are going to have to adapt and learn to live in the now normal and that means protecting yourselves, your family and continuing to protect your employees, teams and institutions through 2021.”