tag:theconversation.com,2011:/id/topics/hack-93689/articleshack – The Conversation2024-01-18T03:32:12Ztag:theconversation.com,2011:article/2214012024-01-18T03:32:12Z2024-01-18T03:32:12ZWhat is credential stuffing and how can I protect myself? A cybersecurity researcher explains<figure><img src="https://images.theconversation.com/files/569990/original/file-20240118-23-wz0bip.jpg?ixlib=rb-1.1.0&rect=0%2C16%2C3748%2C1888&q=45&auto=format&w=496&fit=clip" /><figcaption><span class="caption">
</span> <span class="attribution"><a class="source" href="https://www.shutterstock.com/image-photo/password-box-internet-browser-on-computer-127894811">kpatyhka/Shutterstock</a></span></figcaption></figure><p>Cyber-skulduggery is becoming the bane of modern life. Australia’s prime minister has called it a “<a href="https://www.news.com.au/finance/work/leaders/prime-minister-calls-major-hack-a-scourge-after-guzman-y-gomez-binge-targeted-in-coordinated-cyber-hack/news-story/d4853d70755478a1f72acb1197a7e287">scourge</a>”, and he is correct. In 2022–23, nearly 94,000 cyber crimes were <a href="https://www.cyber.gov.au/about-us/reports-and-statistics/asd-cyber-threat-report-july-2022-june-2023">reported</a> in Australia, up 23% on the previous year.</p>
<p>In the latest high-profile <a href="https://www.cyberdaily.au/security/10038-customers-of-guzman-y-gomez-dan-murphys-and-more-affected-in-credential-stuffing-campaign">attack</a>, around 15,000 customers of alcohol retailer Dan Murphy, Mexican restaurant chain Guzman y Gomez, Event Cinemas, and home shopping network TVSN had their login credentials and credit card details used fraudulently to buy goods and services in what is known as a “<a href="https://owasp.org/www-community/attacks/Credential_stuffing#">credential stuffing</a>” attack.</p>
<p>So what is credential stuffing – and how can you reduce the risk of it happening to you?</p>
<figure class="align-center zoomable">
<a href="https://images.theconversation.com/files/569988/original/file-20240118-15-jqdixp.jpg?ixlib=rb-1.1.0&q=45&auto=format&w=1000&fit=clip"><img alt="A Dan Murphy's liquor store sign reflects golden sunlight." src="https://images.theconversation.com/files/569988/original/file-20240118-15-jqdixp.jpg?ixlib=rb-1.1.0&q=45&auto=format&w=754&fit=clip" srcset="https://images.theconversation.com/files/569988/original/file-20240118-15-jqdixp.jpg?ixlib=rb-1.1.0&q=45&auto=format&w=600&h=450&fit=crop&dpr=1 600w, https://images.theconversation.com/files/569988/original/file-20240118-15-jqdixp.jpg?ixlib=rb-1.1.0&q=30&auto=format&w=600&h=450&fit=crop&dpr=2 1200w, https://images.theconversation.com/files/569988/original/file-20240118-15-jqdixp.jpg?ixlib=rb-1.1.0&q=15&auto=format&w=600&h=450&fit=crop&dpr=3 1800w, https://images.theconversation.com/files/569988/original/file-20240118-15-jqdixp.jpg?ixlib=rb-1.1.0&q=45&auto=format&w=754&h=566&fit=crop&dpr=1 754w, https://images.theconversation.com/files/569988/original/file-20240118-15-jqdixp.jpg?ixlib=rb-1.1.0&q=30&auto=format&w=754&h=566&fit=crop&dpr=2 1508w, https://images.theconversation.com/files/569988/original/file-20240118-15-jqdixp.jpg?ixlib=rb-1.1.0&q=15&auto=format&w=754&h=566&fit=crop&dpr=3 2262w" sizes="(min-width: 1466px) 754px, (max-width: 599px) 100vw, (min-width: 600px) 600px, 237px"></a>
<figcaption>
<span class="caption">Many customers of alcohol retailer Dan Murphy are among those hit by the latest round of credential stuffing cyber attacks.</span>
<span class="attribution"><a class="source" href="https://www.shutterstock.com/image-photo/sydney-australia-on-february-7-2018-1019906509">ArliftAtoz2205/Shutterstock</a></span>
</figcaption>
</figure>
<hr>
<p>
<em>
<strong>
Read more:
<a href="https://theconversation.com/an-expert-reviews-the-governments-7-year-plan-to-boost-australias-cyber-security-here-are-the-key-takeaways-218117">An expert reviews the government’s 7-year plan to boost Australia’s cyber security. Here are the key takeaways</a>
</strong>
</em>
</p>
<hr>
<h2>Re-using the same login details</h2>
<p>Credential stuffing is a type of cyber attack where hackers use stolen usernames and passwords to gain unauthorised access to other online accounts.</p>
<p>In other words, they steal a set of login details for one site, and try it on another site to see if it works there too.</p>
<p>This is possible because many people use the same username and password combination across multiple websites.</p>
<p>It is common for people to use the <a href="https://us.norton.com/blog/privacy/password-statistics#:%7E:text=More%20than%2080%25%20of%20confirmed,to%20their%20accounts%20or%20devices.">same password</a> for multiple accounts (even though this is very risky).</p>
<p>Some even use the same password for all their accounts. This means if one account is compromised, hackers can potentially access many (or all) their other accounts with the same credentials.</p>
<h2>‘Brute force’ attacks</h2>
<p>Hackers purchase job lots of login credentials (obtained from earlier <a href="https://www.oaic.gov.au/privacy/notifiable-data-breaches/notifiable-data-breaches-publications/notifiable-data-breaches-report-january-to-june-2023#:%7E:text=Large%2Dscale%20data%20breaches,period%20%E2%80%93%20a%2045%25%20decrease.">data breaches</a>) on the “<a href="https://en.wikipedia.org/wiki/Dark_web">dark web</a>”. </p>
<p>They then use automated tools called “bots” to perform credential stuffing attacks. These tools can also be purchased on the dark web. </p>
<p>Bots are programs that perform tasks on the internet much faster and more efficiently than humans can. </p>
<p>In what is colourfully termed a “brute force” attack, hackers use bots to test millions of username and password combinations on different websites until they find a match. It’s easier and quicker than many people realise.</p>
<p>It is happening more often because the barrier to entry for would-be cybercriminals has never been lower. The dark web is readily accessible and the resources needed to launch attacks are available to anyone with cryptocurrency to spend and the will to cross over to the dark side. </p>
<h2>How can you protect yourself from credential stuffing?</h2>
<p>The best way is to <em>never</em> reuse passwords across multiple sites or apps. Always use a unique and strong password for each online account.</p>
<p>Choose a password or pass phrase that is at least 12 characters long, is complex, and hard to guess. It should include a mix of uppercase and lowercase letters, numbers, and symbols. Don’t use pet names, birthdays or anything else that can be found on social media. </p>
<p>You can use a <a href="https://www.forbes.com/advisor/business/are-password-managers-safe/">password manager</a> to generate unique passwords for all your accounts and store them securely. These use strong encryption and are generally regarded as pretty safe.</p>
<p>Another way to protect yourself from credential stuffing is to enable two-factor authentication (2FA) for your online accounts. </p>
<p>Two-factor authentication is a security feature that requires you to enter a code or use a device in addition to your password when you log in.</p>
<p>This adds an extra layer of protection in case your password is stolen. You can use an <a href="https://au.pcmag.com/security/86845/the-best-authenticator-apps">app</a>, a text message, or a <a href="https://www.nytimes.com/wirecutter/reviews/best-security-keys/">hardware device</a> (such as a little “key” you plug into a computer) to receive your two-factor authentication code.</p>
<p>Monitor your online accounts regularly to look for any suspicious activity. You can also check if your email or password has been exposed in a data breach by using the website <a href="https://haveibeenpwned.com/">Have I Been Pwned</a>. </p>
<p>You may be surprised by what you see. If you do discover your login details on there, use this as a timely warning to change your passwords as soon as possible.</p>
<figure class="align-center zoomable">
<a href="https://images.theconversation.com/files/569989/original/file-20240118-17-qxptsb.jpg?ixlib=rb-1.1.0&q=45&auto=format&w=1000&fit=clip"><img alt="" src="https://images.theconversation.com/files/569989/original/file-20240118-17-qxptsb.jpg?ixlib=rb-1.1.0&q=45&auto=format&w=754&fit=clip" srcset="https://images.theconversation.com/files/569989/original/file-20240118-17-qxptsb.jpg?ixlib=rb-1.1.0&q=45&auto=format&w=600&h=400&fit=crop&dpr=1 600w, https://images.theconversation.com/files/569989/original/file-20240118-17-qxptsb.jpg?ixlib=rb-1.1.0&q=30&auto=format&w=600&h=400&fit=crop&dpr=2 1200w, https://images.theconversation.com/files/569989/original/file-20240118-17-qxptsb.jpg?ixlib=rb-1.1.0&q=15&auto=format&w=600&h=400&fit=crop&dpr=3 1800w, https://images.theconversation.com/files/569989/original/file-20240118-17-qxptsb.jpg?ixlib=rb-1.1.0&q=45&auto=format&w=754&h=503&fit=crop&dpr=1 754w, https://images.theconversation.com/files/569989/original/file-20240118-17-qxptsb.jpg?ixlib=rb-1.1.0&q=30&auto=format&w=754&h=503&fit=crop&dpr=2 1508w, https://images.theconversation.com/files/569989/original/file-20240118-17-qxptsb.jpg?ixlib=rb-1.1.0&q=15&auto=format&w=754&h=503&fit=crop&dpr=3 2262w" sizes="(min-width: 1466px) 754px, (max-width: 599px) 100vw, (min-width: 600px) 600px, 237px"></a>
<figcaption>
<span class="caption">Have your passwords and login details been exposed in a data breach?</span>
<span class="attribution"><a class="source" href="https://www.shutterstock.com/image-photo/portland-usa-apr-19-2023-closeup-2291663313">Tada Images/Shutterstock</a></span>
</figcaption>
</figure>
<hr>
<p>
<em>
<strong>
Read more:
<a href="https://theconversation.com/what-is-lockbit-the-cybercrime-gang-hacking-some-of-the-worlds-largest-organisations-217679">What is LockBit, the cybercrime gang hacking some of the world's largest organisations?</a>
</strong>
</em>
</p>
<hr>
<h2>Eternal vigilance</h2>
<p>In today’s world of rising cyber crime, your best defence against credential stuffing and other forms of hacking is vigilance. Be proactive, not complacent about online security.</p>
<p>Use unique passwords and a password manager, enable two-factor authentication, monitor your accounts, and check breach notification sites (like Have I Been Pwned). </p>
<p>Remember, the recent attacks on Dan Murphy, Guzman y Gomez and others show how readily our online lives can be disrupted. Don’t let your credentials become another statistic. As you are reading this, the criminals are thinking up new ways to exploit our vulnerabilities. </p>
<p>By adopting good digital hygiene and effective security measures, we can take back control of our online identities.</p>
<hr>
<p>
<em>
<strong>
Read more:
<a href="https://theconversation.com/an-ai-driven-influence-operation-is-spreading-pro-china-propaganda-across-youtube-219962">An AI-driven influence operation is spreading pro-China propaganda across YouTube</a>
</strong>
</em>
</p>
<hr>
<img src="https://counter.theconversation.com/content/221401/count.gif" alt="The Conversation" width="1" height="1" />
<p class="fine-print"><em><span>David Tuffley is affiliated with the Australian Computer Society (MACS).</span></em></p>In what is colourfully termed a ‘brute force’ attack, hackers use bots to test millions of username and password combinations on different websites – until they find a match.David Tuffley, Senior Lecturer in Applied Ethics & CyberSecurity, Griffith UniversityLicensed as Creative Commons – attribution, no derivatives.tag:theconversation.com,2011:article/2051312023-05-08T01:40:32Z2023-05-08T01:40:32ZA cancer centre is the latest victim of cyber attacks. Why health data hacks keep happening<figure><img src="https://images.theconversation.com/files/524796/original/file-20230508-197326-bn7rm5.jpg?ixlib=rb-1.1.0&rect=160%2C311%2C6548%2C4154&q=45&auto=format&w=496&fit=clip" /><figcaption><span class="caption">
</span> <span class="attribution"><a class="source" href="https://www.shutterstock.com/image-photo/nurse-on-duty-working-computer-reception-2174397955">Shutterstock</a></span></figcaption></figure><p>It seems hardly a day goes by without another report of a cyber crime incident. With Medibank still fresh in our minds, the <a href="https://www.abc.net.au/news/2023-05-04/crown-princess-mary-cancer-centre-being-hacked/102305996">latest attack</a> is on a Sydney-based cancer treatment facility, Crown Princess Mary Cancer Centre in Westmead Hospital. </p>
<p>The cyber criminal group Medusa claims to have stolen thousands of files and is holding them to ransom.</p>
<figure class="align-center zoomable">
<a href="https://images.theconversation.com/files/524764/original/file-20230507-19-cjmogq.png?ixlib=rb-1.1.0&q=45&auto=format&w=1000&fit=clip"><img alt="Screenshot of Medusa Blog from Dark Web Site" src="https://images.theconversation.com/files/524764/original/file-20230507-19-cjmogq.png?ixlib=rb-1.1.0&q=45&auto=format&w=754&fit=clip" srcset="https://images.theconversation.com/files/524764/original/file-20230507-19-cjmogq.png?ixlib=rb-1.1.0&q=45&auto=format&w=600&h=565&fit=crop&dpr=1 600w, https://images.theconversation.com/files/524764/original/file-20230507-19-cjmogq.png?ixlib=rb-1.1.0&q=30&auto=format&w=600&h=565&fit=crop&dpr=2 1200w, https://images.theconversation.com/files/524764/original/file-20230507-19-cjmogq.png?ixlib=rb-1.1.0&q=15&auto=format&w=600&h=565&fit=crop&dpr=3 1800w, https://images.theconversation.com/files/524764/original/file-20230507-19-cjmogq.png?ixlib=rb-1.1.0&q=45&auto=format&w=754&h=710&fit=crop&dpr=1 754w, https://images.theconversation.com/files/524764/original/file-20230507-19-cjmogq.png?ixlib=rb-1.1.0&q=30&auto=format&w=754&h=710&fit=crop&dpr=2 1508w, https://images.theconversation.com/files/524764/original/file-20230507-19-cjmogq.png?ixlib=rb-1.1.0&q=15&auto=format&w=754&h=710&fit=crop&dpr=3 2262w" sizes="(min-width: 1466px) 754px, (max-width: 599px) 100vw, (min-width: 600px) 600px, 237px"></a>
<figcaption>
<span class="caption">Screenshot of Medusa Blog from Dark Web Site.</span>
<span class="attribution"><span class="source">Author provided</span></span>
</figcaption>
</figure>
<p>In what has become a common practice, the criminal gang seems to be using double extortion. In such scenarios, criminals typically demand a fee to “release” the data back to the organisation – often with a “sample” made available to verify their claims.</p>
<p>The gangs then double-down with threats to publicise the data via their websites if payment isn’t made – in this case, a deadline of seven days. </p>
<p>Medusa is offering a range of options to delay the public release of data by 24 hours (US$10,000), to download and/or delete the data from the gang for US$100,000.</p>
<p>It’s currently unclear what will happen on Friday morning if the ransom is not paid. However, the Medusa Blog offers free access to data stolen from previous victims who did not pay the ransom by the deadline.</p>
<figure class="align-center zoomable">
<a href="https://images.theconversation.com/files/524765/original/file-20230507-17-o29hhg.png?ixlib=rb-1.1.0&q=45&auto=format&w=1000&fit=clip"><img alt="Victims data published on Medusa Blog" src="https://images.theconversation.com/files/524765/original/file-20230507-17-o29hhg.png?ixlib=rb-1.1.0&q=45&auto=format&w=754&fit=clip" srcset="https://images.theconversation.com/files/524765/original/file-20230507-17-o29hhg.png?ixlib=rb-1.1.0&q=45&auto=format&w=600&h=559&fit=crop&dpr=1 600w, https://images.theconversation.com/files/524765/original/file-20230507-17-o29hhg.png?ixlib=rb-1.1.0&q=30&auto=format&w=600&h=559&fit=crop&dpr=2 1200w, https://images.theconversation.com/files/524765/original/file-20230507-17-o29hhg.png?ixlib=rb-1.1.0&q=15&auto=format&w=600&h=559&fit=crop&dpr=3 1800w, https://images.theconversation.com/files/524765/original/file-20230507-17-o29hhg.png?ixlib=rb-1.1.0&q=45&auto=format&w=754&h=702&fit=crop&dpr=1 754w, https://images.theconversation.com/files/524765/original/file-20230507-17-o29hhg.png?ixlib=rb-1.1.0&q=30&auto=format&w=754&h=702&fit=crop&dpr=2 1508w, https://images.theconversation.com/files/524765/original/file-20230507-17-o29hhg.png?ixlib=rb-1.1.0&q=15&auto=format&w=754&h=702&fit=crop&dpr=3 2262w" sizes="(min-width: 1466px) 754px, (max-width: 599px) 100vw, (min-width: 600px) 600px, 237px"></a>
<figcaption>
<span class="caption">Victims data published on Medusa Blog.</span>
<span class="attribution"><span class="source">Author provided</span></span>
</figcaption>
</figure>
<p>According to <a href="https://www.cybersecurityconnect.com.au/critical-infrastructure/9016-nsw-cancer-treatment-centre-targeted-by-medusa-hackers">CyberCX</a>, Medusa is the “second-most active cyber extortion group in the Pacific”. Medusa has been <a href="https://www.bitdefender.com/blog/hotforsecurity/medusa-ransomware-gang-leaks-students-psychological-reports-and-abuse-allegations/">trying to compromise</a> organisations in Australia and New Zealand since the beginning of 2023.</p>
<hr>
<p>
<em>
<strong>
Read more:
<a href="https://theconversation.com/why-are-there-so-many-data-breaches-a-growing-industry-of-criminals-is-brokering-in-stolen-data-193015">Why are there so many data breaches? A growing industry of criminals is brokering in stolen data</a>
</strong>
</em>
</p>
<hr>
<h2>Why target health services?</h2>
<p>Any cyber attacks on the health sector are dangerous. While some cyber criminals have previously <a href="https://www.bitdefender.com/blog/hotforsecurity/ashamed-lockbit-ransomware-gang-apologises-to-hacked-school-offers-free-decryption-tool/">avoided schools</a> and <a href="https://www.bleepingcomputer.com/news/security/ransomware-gangs-to-stop-attacking-health-orgs-during-pandemic/">health-care organisations</a>, it seems these are now fair game.</p>
<p>Knowing the services and data held by these organisations are critical, it’s not surprising to see so many ransomware attacks are launched against critical health-care infrastructure. </p>
<p>Some notable incidents targeting the Australian health systems have included <a href="https://www.sbs.com.au/news/article/who-is-revil-the-russia-based-hacker-group-allegedly-behind-the-medibank-data-breach/b44xvb1ya">Medibank</a>, <a href="https://www.abc.net.au/news/2019-02-22/melbourne-heart-hack-cyber-criminals-my-health-record-risks/10834482">Melbourne Heart Group</a> and <a href="https://ia.acs.org.au/article/2021/victorian-hospitals-hit-by-cyber-attack.html">Eastern Health</a> which operates four hospitals in Melbourne’s east – an attack which resulted in elective surgeries needing to be postponed.</p>
<p>According to tech giant <a href="https://www.microsoft.com/en-us/security/business/microsoft-digital-defense-report-2022">Microsoft</a>, the health-care sector (and aligned industries) is one of the top targets for cyber criminals.</p>
<figure class="align-center ">
<img alt="" src="https://images.theconversation.com/files/524805/original/file-20230508-8275-n9z3o1.png?ixlib=rb-1.1.0&q=45&auto=format&w=754&fit=clip" srcset="https://images.theconversation.com/files/524805/original/file-20230508-8275-n9z3o1.png?ixlib=rb-1.1.0&q=45&auto=format&w=600&h=567&fit=crop&dpr=1 600w, https://images.theconversation.com/files/524805/original/file-20230508-8275-n9z3o1.png?ixlib=rb-1.1.0&q=30&auto=format&w=600&h=567&fit=crop&dpr=2 1200w, https://images.theconversation.com/files/524805/original/file-20230508-8275-n9z3o1.png?ixlib=rb-1.1.0&q=15&auto=format&w=600&h=567&fit=crop&dpr=3 1800w, https://images.theconversation.com/files/524805/original/file-20230508-8275-n9z3o1.png?ixlib=rb-1.1.0&q=45&auto=format&w=754&h=713&fit=crop&dpr=1 754w, https://images.theconversation.com/files/524805/original/file-20230508-8275-n9z3o1.png?ixlib=rb-1.1.0&q=30&auto=format&w=754&h=713&fit=crop&dpr=2 1508w, https://images.theconversation.com/files/524805/original/file-20230508-8275-n9z3o1.png?ixlib=rb-1.1.0&q=15&auto=format&w=754&h=713&fit=crop&dpr=3 2262w" sizes="(min-width: 1466px) 754px, (max-width: 599px) 100vw, (min-width: 600px) 600px, 237px">
<figcaption>
<span class="caption">Ransomware incident and recovery engagements by industry.</span>
<span class="attribution"><span class="source">Microsoft Digital Defense Report 2022</span></span>
</figcaption>
</figure>
<hr>
<p>
<em>
<strong>
Read more:
<a href="https://theconversation.com/australian-hospitals-are-under-constant-cyber-attack-the-consequences-could-be-deadly-150164">Australian hospitals are under constant cyber attack. The consequences could be deadly</a>
</strong>
</em>
</p>
<hr>
<h2>What are the impacts?</h2>
<p>The health sector deals with our most private data – none of us want this data in criminal hands. Apart from the privacy issues, the inability to continue regular activities in any health-care facility poses life-threatening risks.</p>
<p>A <a href="https://jamanetwork.com/journals/jama-health-forum/fullarticle/2799961">recent study</a> showed from 2016-2021, US health-care providers experienced 374 ransomware attacks that exposed the private health information of nearly 42 million patients. </p>
<p>Nearly half of these ransomware attacks disrupted the health-care services, with impacts including electronic system downtime, cancellations of scheduled care, and ambulance diversions.</p>
<p><div data-react-class="Tweet" data-react-props="{"tweetId":"1393090933361623042"}"></div></p>
<h2>Why do they keep happening?</h2>
<p>Technical advances in the health industries have undoubtedly improved treatment and overall patient care. While this growth in technology is a positive for health care, it exposes health systems to cyber criminals. </p>
<p>With each passing year there is increased connectivity between clinical systems and medical devices. The health-care sector needs to be <a href="https://www.forbes.com/sites/saibala/2022/08/26/the-healthcare-industry-is-crumbling-due-to-staffing-shortages/?sh=6a0b545d7d6e">more staffed</a> and heavily reliant on <a href="https://www.sciencedirect.com/science/article/abs/pii/S1570870521001475">internet-connected systems</a> also known as digital health. This inter-connectivity makes health systems <a href="https://www.hackread.com/vulnerable-infusion-pumps-remotely-accessed-to-change-dosages/">more complex and harder to secure</a>.</p>
<p>With the exception of state-sponsored groups, cyber criminals are primarily motivated by financial gain. Health care is undoubtedly one of the most promising targets as, if compromised, the organisations are more likely to pay the ransom – ultimately, because lives are at stake. </p>
<p>Cyber criminals capitalise on this and, even after good governance and enhanced cybersecurity within the sector, these incidents are likely to continue. </p>
<hr>
<p>
<em>
<strong>
Read more:
<a href="https://theconversation.com/is-australia-a-sitting-duck-for-ransomware-attacks-yes-and-the-danger-has-been-growing-for-30-years-161818">Is Australia a sitting duck for ransomware attacks? Yes, and the danger has been growing for 30 years</a>
</strong>
</em>
</p>
<hr>
<h2>Living with cyber criminals around us</h2>
<p>So far, reports about the Cancer Centre at Westmead have not indicated that operations have been significantly impacted. This may imply no computing devices have actually been compromised and locked – this could be seen as a positive. </p>
<p>However, those who have examined the samples of data published on the Medusa Blog have <a href="https://www.databreaches.net/medusa-ransomware-group-starts-leaking-data-from-crown-princess-mary-cancer-centre-threatens-to-leak-more/">suggested it seems genuine</a>. </p>
<p>As Robert Mueller, former Director of the FBI, famously said:</p>
<blockquote>
<p>There are only two types of companies: those that have been hacked and those that will be hacked.</p>
</blockquote>
<p>Cyber crime has become a global industry with estimates predicting the impact at <a href="https://cybersecurityventures.com/cybercrime-to-cost-the-world-8-trillion-annually-in-2023/">more than US$8 trillion in 2023</a>. With such potentially lucrative benefits, we have to accept we will be sharing cyberspace with criminals for the foreseeable future.</p>
<p>There are, of course, actions that can improve our cybersecurity preparedness, regardless of the sector. While nothing will completely eliminate the risk, making ourselves a less attractive target helps to reduce the likelihood of being a victim. So it’s important to:
</p><ul>
<li><strong>protect your systems:</strong> apply patches to all devices (including mobile phones); educate users to segregate personal and business activities; use strong and unique passwords for all systems/services</li><p></p>
<p></p><li><strong>include all systems:</strong> don’t forget the internet of things and operational technology (all the devices and software we use that connect to the internet); check default settings (changing any default passwords); and plan the disposal of old systems</li><p></p>
<p></p><li><strong>protect your data:</strong> data collected from all sources need to be kept in appropriate locations; think about how long you will keep data; and ensure data is protected from creation to destruction.</li><p></p>
<p></p><li><strong>protect your people:</strong> educate all staff on basic cyber hygiene; vet new staff; and think about your off-boarding practices</li><p></p>
<p></p><li><strong>seek advice:</strong> when things go wrong bring in the experts and liaise with law enforcement or other government agencies as appropriate.</li>
</ul><p></p>
<p>And, finally, do not pay the ransom – it may be a difficult decision, but it only encourages the criminals behind the ransomware campaigns to keep going.</p>
<hr>
<p>
<em>
<strong>
Read more:
<a href="https://theconversation.com/medibank-wont-pay-hackers-ransom-is-it-the-right-choice-194162">Medibank won't pay hackers ransom. Is it the right choice?</a>
</strong>
</em>
</p>
<hr>
<img src="https://counter.theconversation.com/content/205131/count.gif" alt="The Conversation" width="1" height="1" />
<p class="fine-print"><em><span>The authors do not work for, consult, own shares in or receive funding from any company or organisation that would benefit from this article, and have disclosed no relevant affiliations beyond their academic appointment.</span></em></p>While some cyber criminals have previously avoided schools and health-care organisations, it seems these are now fair game.Mohiuddin Ahmed, Senior Lecturer of Computing and Security, Edith Cowan UniversityPaul Haskell-Dowland, Professor of Cyber Security Practice, Edith Cowan UniversityLicensed as Creative Commons – attribution, no derivatives.tag:theconversation.com,2011:article/1584172021-04-06T05:22:36Z2021-04-06T05:22:36ZFacebook data breach: what happened and why it’s hard to know if your data was leaked<figure><img src="https://images.theconversation.com/files/393503/original/file-20210406-23-j7rkr1.png?ixlib=rb-1.1.0&rect=86%2C13%2C887%2C639&q=45&auto=format&w=496&fit=clip" /><figcaption><span class="caption">
</span> <span class="attribution"><a class="source" href="https://twitter.com/UnderTheBreach/status/1349671417625931778">Alon Gal/Twitter</a></span></figcaption></figure><p>Over the long weekend <a href="https://www.businessinsider.com.au/stolen-data-of-533-million-facebook-users-leaked-online-2021-4?r=US&IR=T">reports</a> emerged of an alleged data breach, impacting half a billion Facebook users from 106 countries. </p>
<p>And while this figure is staggering, there’s more to the story than 533 million sets of data. This breach once again highlights how many of the systems we use aren’t designed to adequately protect our information from cyber criminals. </p>
<p>Nor is it always straightforward to figure out whether your data have been compromised in a breach or not.</p>
<p><div data-react-class="Tweet" data-react-props="{"tweetId":"1349671417625931778"}"></div></p>
<h2>What happened?</h2>
<p>More than <a href="https://www.theguardian.com/technology/2021/apr/05/facebook-data-leak-2021-breach-check-australia-users">500 million Facebook users’ details</a> were published online on an underground website used by cyber criminals.</p>
<p>It quickly became clear this was not a new data breach, but an older one which had come back to haunt Facebook and the millions of users whose data are now available to purchase online. </p>
<p>The data breach is believed to relate to a vulnerability which Facebook reportedly <a href="https://www.businessinsider.com.au/stolen-data-of-533-million-facebook-users-leaked-online-2021-4?">fixed in August of 2019</a>. While the exact source of the data can’t be verified, it was likely acquired through the misuse of <a href="https://edition.cnn.com/2019/09/04/tech/facebook-phone-numbers-exposed">legitimate functions in the Facebook systems</a>. </p>
<p>Such misuses can occur when a seemingly innocent feature of a website is used for an unexpected purpose by attackers, as was the case with a PayID attack in 2019.</p>
<figure class="align-center zoomable">
<a href="https://images.theconversation.com/files/393502/original/file-20210406-23-1m3m37p.png?ixlib=rb-1.1.0&q=45&auto=format&w=1000&fit=clip"><img alt="" src="https://images.theconversation.com/files/393502/original/file-20210406-23-1m3m37p.png?ixlib=rb-1.1.0&q=45&auto=format&w=754&fit=clip" srcset="https://images.theconversation.com/files/393502/original/file-20210406-23-1m3m37p.png?ixlib=rb-1.1.0&q=45&auto=format&w=600&h=116&fit=crop&dpr=1 600w, https://images.theconversation.com/files/393502/original/file-20210406-23-1m3m37p.png?ixlib=rb-1.1.0&q=30&auto=format&w=600&h=116&fit=crop&dpr=2 1200w, https://images.theconversation.com/files/393502/original/file-20210406-23-1m3m37p.png?ixlib=rb-1.1.0&q=15&auto=format&w=600&h=116&fit=crop&dpr=3 1800w, https://images.theconversation.com/files/393502/original/file-20210406-23-1m3m37p.png?ixlib=rb-1.1.0&q=45&auto=format&w=754&h=146&fit=crop&dpr=1 754w, https://images.theconversation.com/files/393502/original/file-20210406-23-1m3m37p.png?ixlib=rb-1.1.0&q=30&auto=format&w=754&h=146&fit=crop&dpr=2 1508w, https://images.theconversation.com/files/393502/original/file-20210406-23-1m3m37p.png?ixlib=rb-1.1.0&q=15&auto=format&w=754&h=146&fit=crop&dpr=3 2262w" sizes="(min-width: 1466px) 754px, (max-width: 599px) 100vw, (min-width: 600px) 600px, 237px"></a>
<figcaption>
<span class="caption">Chief technology officer of cybercrime intelligence firm Hudson Rock, Alon Gal, discovered the leaked database, posting screenshots on Twitter.</span>
<span class="attribution"><span class="source">Twitter</span></span>
</figcaption>
</figure>
<hr>
<p>
<em>
<strong>
Read more:
<a href="https://theconversation.com/payid-data-breaches-show-australias-banks-need-to-be-more-vigilant-to-hacking-123529">PayID data breaches show Australia's banks need to be more vigilant to hacking</a>
</strong>
</em>
</p>
<hr>
<p>In the case of Facebook, criminals can mine Facebook’s systems for users’ personal information by using techniques which automate the process of harvesting data.</p>
<p>This may sound familiar. In 2018 Facebook was reeling from the <a href="https://www.theguardian.com/news/series/cambridge-analytica-files">Cambridge Analytica scandal</a>. This too was not a <a href="https://www.abc.net.au/news/2018-03-22/facebook-mark-zuckerberg-admits-mistakes-in-protecting-data/9574778"><em>hacking</em> incident</a>, but a misuse of a perfectly legitimate function of the Facebook platform. </p>
<p>While the data were initially obtained legitimately — as least, as far as Facebook’s rules were concerned — it was then passed on to a third party <a href="https://about.fb.com/news/2018/03/suspending-cambridge-analytica/">without the appropriate consent</a> from users.</p>
<hr>
<p>
<em>
<strong>
Read more:
<a href="https://theconversation.com/we-need-to-talk-about-the-data-we-give-freely-of-ourselves-online-and-why-its-useful-93734">We need to talk about the data we give freely of ourselves online and why it's useful</a>
</strong>
</em>
</p>
<hr>
<h2>Were you targeted?</h2>
<p>There’s no easy way to determine if your details were breached in the recent leak. If the website concerned is acting in your best interest, you should at least receive a notification. But this <a href="https://www.theguardian.com/technology/2021/apr/08/facebook-2019-breach-users">isn’t guaranteed</a>. </p>
<p>Even a tech-savvy user would be limited to hunting for the leaked data themselves on underground websites.</p>
<p>The data being sold online contain plenty of key information. <a href="https://haveibeenpwned.com/PwnedWebsites#Facebook">According to</a> haveibeenpwned.com, most of the records include names and genders, with many also including dates of birth, location, relationship status and employer.</p>
<p>Although, it has been <a href="https://www.theverge.com/2021/4/4/22366822/facebook-personal-data-533-million-leaks-online-email-phone-numbers">reported</a> only a small proportion of the stolen data contained a valid email address (about 2.5 million records).</p>
<p>This is important since a user’s data are less valuable without the corresponding email address. It’s the combination of date of birth, name, phone number and email which provides a useful starting point for <a href="https://www.theguardian.com/technology/2021/apr/05/facebook-data-leak-2021-breach-check-australia-users">identity theft and exploitation</a>. </p>
<p>If you’re not sure why these details would be valuable to a criminal, think about how you confirm your identity over the phone with your bank, or how you last reset a password on a website.</p>
<p>Haveibeenpwned.com creator and web security expert Troy Hunt has said a secondary use for the data could be to enhance phishing and SMS-based spam attacks.</p>
<p><div data-react-class="Tweet" data-react-props="{"tweetId":"1378485540425670657"}"></div></p>
<h2>How to protect yourself</h2>
<p>Given the nature of the leak, there is very little Facebook users could have done proactively to protect themselves from this breach. As the attack targeted Facebook’s systems, the responsibility for securing the data lies entirely with Facebook.</p>
<p>On an individual level, while you can opt to withdraw from the platform, for many this isn’t a simple option. That said, there are certain changes you can make to your social media behaviours to help reduce your risk from data breaches.</p>
<p>1) <strong>Ask yourself if you need to share all your <a href="https://www.theguardian.com/technology/askjack/2019/mar/07/is-there-a-way-to-use-facebook-without-giving-up-my-privacy">information with Facebook</a></strong></p>
<p>There are some bits of information we inevitably have to forfeit in exchange for using Facebook, including mobile numbers for new accounts (as a security measure, ironically). But there are plenty of <a href="https://theconversation.com/dont-be-phish-food-tips-to-avoid-sharing-your-personal-information-online-138613">details you can withhold</a> to retain a modicum of control over your data.</p>
<p>2) <strong>Think about what you share</strong> </p>
<p>Apart from the leak being reported, there are plenty of other ways to harvest user data from Facebook. If you use a fake birth date on your account, you should also avoid posting birthday party photos on the real day. Even our <a href="https://www.smh.com.au/technology/why-you-shouldn-t-post-a-picture-of-your-boarding-pass-on-social-media-20200918-p55wvf.html">seemingly innocent photos</a> can reveal sensitive information.</p>
<p>3) <strong>Avoid using Facebook to sign in to other websites</strong></p>
<p>Although the “sign-in with Facebook” feature is potentially time-saving (and reduces the number of accounts you have to maintain), it also increases <a href="https://threatpost.com/sneaky-phishing-scam-facebook/141869/">potential risk</a> to you — especially if the site you’re signing into isn’t a trusted one. If your Facebook account is compromised, the attacker will have automatic access to all the linked websites.</p>
<p>4) <strong>Use unique passwords</strong></p>
<p>Always use a different password for each online account, even if it is a pain. Installing a password manager will help with this (and this is how I have more than 400 different passwords). While it won’t stop your data from ever being stolen, if your password for a site is leaked it will only work for that <em>one</em> site.</p>
<p>If you really want a scare, you can always download a copy of all the <a href="https://www.facebook.com/help/212802592074644">data Facebook has on you</a>. This is useful if you’re considering leaving the platform and want a copy of your data before closing your account.</p>
<hr>
<p>
<em>
<strong>
Read more:
<a href="https://theconversation.com/new-evidence-shows-half-of-australians-have-ditched-social-media-at-some-point-but-millennials-lag-behind-156128">New evidence shows half of Australians have ditched social media at some point, but millennials lag behind</a>
</strong>
</em>
</p>
<hr>
<img src="https://counter.theconversation.com/content/158417/count.gif" alt="The Conversation" width="1" height="1" />
<p class="fine-print"><em><span>Paul Haskell-Dowland does not work for, consult, own shares in or receive funding from any company or organisation that would benefit from this article, and has disclosed no relevant affiliations beyond their academic appointment.</span></em></p>More than 500 million people’s details were compromised. The records include various combinations of name, email, gender, date of birth, location, relationship status and employer.Paul Haskell-Dowland, Associate Dean (Computing and Security), Edith Cowan UniversityLicensed as Creative Commons – attribution, no derivatives.tag:theconversation.com,2011:article/1524442020-12-29T14:17:19Z2020-12-29T14:17:19ZThe Sunburst hack was massive and devastating – 5 observations from a cybersecurity expert<figure><img src="https://images.theconversation.com/files/376591/original/file-20201223-23-11m8mdo.jpg?ixlib=rb-1.1.0&rect=0%2C0%2C5674%2C3772&q=45&auto=format&w=496&fit=clip" /><figcaption><span class="caption">Federal government agencies, from the Treasury Department to the National Nuclear Security Administration, have been compromised by the attack.</span> <span class="attribution"><a class="source" href="https://www.gettyimages.com/detail/news-photo/the-morning-sun-rises-over-the-white-house-on-march-24-2019-news-photo/1137951124?adppopup=true">Tasos Katopodis/Getty Images</a></span></figcaption></figure><p>So much remains unknown about what is now being called the Sunburst hack, the cyberattack against U.S. government agencies and corporations. U.S. officials <a href="https://www.washingtonpost.com/national-security/russian-government-spies-are-behind-a-broad-hacking-campaign-that-has-breached-us-agencies-and-a-top-cyber-firm/2020/12/13/d5a53b88-3d7d-11eb-9453-fc36ba051781_story.html">widely believe</a> that Russian state-sponsored hackers are responsible.</p>
<p>The attack gave the perpetrators access to numerous key American business and government organizations. The immediate effects will be difficult to judge, and a complete accounting of the damage is unlikely. However, the nature of the affected organizations alone makes it clear that this is perhaps the most consequential cyberattack against the U.S. to date.</p>
<p>An act of cyberwar is usually not like a bomb, which causes immediate, well-understood damage. Rather, it is more like a cancer – it’s slow to detect, difficult to eradicate, and it causes ongoing and significant damage over a long period of time. Here are five points that cybersecurity experts – the oncologists in the cancer analogy – can make with what’s known so far.</p>
<h2>1. The victims were tough nuts to crack</h2>
<p>From top-tier cybersecurity firm FireEye to the U.S. Treasury, Microsoft, Intel and many other organizations, the victims of the attack are for the most part firms with comprehensive cybersecurity practices. The list of <a href="https://www.businessinsider.com/list-of-companies-agencies-at-risk-after-solarwinds-hack-2020-12?op=1">organizations that use the compromised software</a> includes firms like MasterCard, Lockheed Martin and PricewaterhouseCoopers. SolarWinds estimates about <a href="https://www.zdnet.com/article/sec-filings-solarwinds-says-18000-customers-are-impacted-by-recent-hack/">18,000 firms</a> were affected.</p>
<p>As CEO of cybersecurity firm Cyber Reconnaissance Inc. and an <a href="https://scholar.google.com/citations?user=OUAMn6oAAAAJ&hl=en">associate professor of computer science</a> at Arizona State University, I have met security professionals from many of the targeted organizations. Many of the organizations have world-class cybersecurity teams. These are some of the hardest targets to hit in corporate America. The victims of Sunburst were specifically targeted, likely with a primary focus on intelligence gathering.</p>
<h2>2. This was almost certainly the work of a nation – not criminals</h2>
<p>Criminal hackers focus on near-term financial gain. They use techniques like ransomware to extort money from their victims, steal financial information, and harvest computing resources for activities like sending spam emails or mining for cryptocurrency. </p>
<p>Criminal hackers exploit well-known security vulnerabilities that, had the victims been more thorough in their security, could have been prevented. The hackers typically target organizations with weaker security, like health care systems, universities and municipal governments. University networks are notoriously decentralized, difficult to secure, and often underfund cybersecurity. Medical systems tend to use specialty medical devices that run older, vulnerable software that is difficult to upgrade. </p>
<p>Hackers associated with national governments, on the other hand, have entirely different motives. They look for long-term access to critical infrastructure, gather intelligence and develop the means to disable certain industries. They also steal intellectual property – especially intellectual property that is expensive to develop in fields like high technology, medicine, defense and agriculture.</p>
<figure class="align-center zoomable">
<a href="https://images.theconversation.com/files/376596/original/file-20201223-49872-i98bca.jpg?ixlib=rb-1.1.0&q=45&auto=format&w=1000&fit=clip"><img alt="A smart phone displaying the FireEye logo" src="https://images.theconversation.com/files/376596/original/file-20201223-49872-i98bca.jpg?ixlib=rb-1.1.0&q=45&auto=format&w=754&fit=clip" srcset="https://images.theconversation.com/files/376596/original/file-20201223-49872-i98bca.jpg?ixlib=rb-1.1.0&q=45&auto=format&w=600&h=400&fit=crop&dpr=1 600w, https://images.theconversation.com/files/376596/original/file-20201223-49872-i98bca.jpg?ixlib=rb-1.1.0&q=30&auto=format&w=600&h=400&fit=crop&dpr=2 1200w, https://images.theconversation.com/files/376596/original/file-20201223-49872-i98bca.jpg?ixlib=rb-1.1.0&q=15&auto=format&w=600&h=400&fit=crop&dpr=3 1800w, https://images.theconversation.com/files/376596/original/file-20201223-49872-i98bca.jpg?ixlib=rb-1.1.0&q=45&auto=format&w=754&h=503&fit=crop&dpr=1 754w, https://images.theconversation.com/files/376596/original/file-20201223-49872-i98bca.jpg?ixlib=rb-1.1.0&q=30&auto=format&w=754&h=503&fit=crop&dpr=2 1508w, https://images.theconversation.com/files/376596/original/file-20201223-49872-i98bca.jpg?ixlib=rb-1.1.0&q=15&auto=format&w=754&h=503&fit=crop&dpr=3 2262w" sizes="(min-width: 1466px) 754px, (max-width: 599px) 100vw, (min-width: 600px) 600px, 237px"></a>
<figcaption>
<span class="caption">One of the targeted organizations, cybersecurity firm FireEye, would be a poor choice for cybercriminals but highly desirable for the Russian government or other adversaries of the U.S.</span>
<span class="attribution"><a class="source" href="https://www.gettyimages.com/detail/news-photo/in-this-photo-illustration-a-fireeye-cyber-security-company-news-photo/1230182459?adppopup=true">SOPA Images/LightRocket via Getty Images</a></span>
</figcaption>
</figure>
<p>The sheer amount of effort to infiltrate one of the Sunburst victim firms is also a telling sign that this was not a mere criminal hack. For example, a firm like FireEye is an inherently bad target for a criminal attacker. It has fewer than 4,000 employees yet has computer security on par with the world’s top defense and financial businesses. </p>
<h2>3. The attack exploited trusted third-party software</h2>
<p>The hackers gained access by slipping their malware into software updates of SolarWinds’ Orion software, which is widely used to manage large organizational networks. The Sunburst attack relied on a trusted relationship between the targeted organization and SolarWinds. When users of Orion updated their systems in the spring of 2020, they unwittingly invited a Trojan horse into their computer networks.</p>
<p>Aside from <a href="https://www.bloomberg.com/news/articles/2020-12-21/solarwinds-adviser-warned-of-lax-security-years-before-hack">a report about lax security</a> at SolarWinds, very little is known about how the hackers gained initial access to SolarWinds. However, the Russians have used the tactic of compromising a third-party software update process before, in 2017. This was during the infamous <a href="https://medium.com/@PauloShak/learning-from-notpetya-43f2fea8994c">NotPetya</a> attack, which was considered the most financially <a href="https://www.wired.com/story/notpetya-cyberattack-ukraine-russia-code-crashed-the-world/">damaging cyberattack in history</a>. </p>
<h2>4. The extent of the damage is unknown</h2>
<p>It will take time to uncover the extent of the damage. The investigation is complicated because the attackers gained access to most of the victims in the spring of 2020, which gave the hackers time to expand and hide their access and control of the victims’ systems. For example, <a href="https://krebsonsecurity.com/2020/12/vmware-flaw-a-vector-in-solarwinds-breach/">some experts believe</a> that a vulnerability in VMWare, software that is widely used in corporate networks, was also used to gain access to the victims’ systems, <a href="https://www.sdxcentral.com/articles/news/vmware-denies-its-software-used-in-solarwinds-hack/2020/12/">though the company denies it</a>.</p>
<figure class="align-center zoomable">
<a href="https://images.theconversation.com/files/376594/original/file-20201223-23-161id6c.jpg?ixlib=rb-1.1.0&q=45&auto=format&w=1000&fit=clip"><img alt="the Microsoft logo on the side of a building" src="https://images.theconversation.com/files/376594/original/file-20201223-23-161id6c.jpg?ixlib=rb-1.1.0&q=45&auto=format&w=754&fit=clip" srcset="https://images.theconversation.com/files/376594/original/file-20201223-23-161id6c.jpg?ixlib=rb-1.1.0&q=45&auto=format&w=600&h=338&fit=crop&dpr=1 600w, https://images.theconversation.com/files/376594/original/file-20201223-23-161id6c.jpg?ixlib=rb-1.1.0&q=30&auto=format&w=600&h=338&fit=crop&dpr=2 1200w, https://images.theconversation.com/files/376594/original/file-20201223-23-161id6c.jpg?ixlib=rb-1.1.0&q=15&auto=format&w=600&h=338&fit=crop&dpr=3 1800w, https://images.theconversation.com/files/376594/original/file-20201223-23-161id6c.jpg?ixlib=rb-1.1.0&q=45&auto=format&w=754&h=424&fit=crop&dpr=1 754w, https://images.theconversation.com/files/376594/original/file-20201223-23-161id6c.jpg?ixlib=rb-1.1.0&q=30&auto=format&w=754&h=424&fit=crop&dpr=2 1508w, https://images.theconversation.com/files/376594/original/file-20201223-23-161id6c.jpg?ixlib=rb-1.1.0&q=15&auto=format&w=754&h=424&fit=crop&dpr=3 2262w" sizes="(min-width: 1466px) 754px, (max-width: 599px) 100vw, (min-width: 600px) 600px, 237px"></a>
<figcaption>
<span class="caption">Some of the exposed organizations, like Microsoft, made limited use of the SolarWinds software, which appears to have contained the damage they suffered.</span>
<span class="attribution"><a class="source" href="https://images.app.goo.gl/at74GEFtP7Qac6ps7">Raimond Spekking</a>, <a class="license" href="http://creativecommons.org/licenses/by-sa/4.0/">CC BY-SA</a></span>
</figcaption>
</figure>
<p>I expect the damage to be spread unevenly among the victims. This will depend on various factors such as how extensively the organization used the SolarWinds software, how segmented its networks are, and the nature of their software maintenance cycle. For example, Microsoft <a href="https://www.bloomberg.com/news/articles/2020-12-18/microsoft-says-its-systems-were-exposed-in-solarwinds-hack">reportedly had limited deployments of Orion</a>, so the attack had limited impact on their systems. </p>
<p>In contrast, the bounty the hackers stole from FireEye included <a href="https://blog.cyr3con.ai/the-vulnerabilities-fireeye-hackers-will-start-to-use">penetration testing tools</a>, which were used to test the defenses of high-end FireEye clients. The theft of these tools was likely prized by hackers to both increase their capabilities in future attacks as well as gain insights into what FireEye clients are protecting against.</p>
<h2>5. The fallout could include real-world harm</h2>
<p>There is a very thin, often nonexistent line between gathering information and causing real-world harm. What may start as spying or espionage can easily escalate into warfare. </p>
<p>The presence of malware on a computer system that gives the attacker greater user privileges is dangerous. Hackers can use control of a computer system to destroy computer systems, as was the case in the <a href="https://phys.org/news/2012-10-iran-cyberattack-saudi-ex-official.html">Iranian cyberattacks against Saudi Aramco in 2012</a>, and harm physical infrastructure, as was the case <a href="https://www.wired.com/2014/11/countdown-to-zero-day-stuxnet/">Stuxnet attack against Iranian nuclear facilities in 2010</a>. </p>
<p>Further, real harm can be done to individuals with information alone. For example, the <a href="https://www.technologyreview.com/2020/02/10/349004/the-us-says-the-chinese-military-hacked-equifax-heres-how/">Chinese breach of Equifax</a> in 2017 has put detailed financial and personal information about millions of Americans in the hands of one of the U.S.’s greatest strategic competitors.</p>
<p>No one knows the full extent of the Sunburst attack, but the scope is large and the victims represent important pillars of the U.S. government, economy and critical infrastructure. Information stolen from those systems and malware the hackers have likely left on them can be used for follow-on attacks. I believe it is likely that the Sunburst attack will result in harm to Americans. </p>
<p>[<em>Get the best of The Conversation, every weekend.</em> <a href="https://theconversation.com/us/newsletters/weekly-highlights-61?utm_source=TCUS&utm_medium=inline-link&utm_campaign=newsletter-text&utm_content=weeklybest">Sign up for our weekly newsletter</a>.]</p><img src="https://counter.theconversation.com/content/152444/count.gif" alt="The Conversation" width="1" height="1" />
<p class="fine-print"><em><span>Paulo Shakarian works for/consults to/owns shares in Cyber Reconnaissance, Inc. (CYR3CON).</span></em></p>Cyberwarfare is more like cancer than bombs and bullets. Cybersecurity experts are just beginning to make their diagnosis of the Sunburst hack.Paulo Shakarian, Associate Professor of Computer Science, Arizona State UniversityLicensed as Creative Commons – attribution, no derivatives.tag:theconversation.com,2011:article/1470182020-09-30T04:37:28Z2020-09-30T04:37:28ZAirports, ATMs, hospitals: Microsoft Windows XP leak would be less of an issue, if so many didn’t use it<figure><img src="https://images.theconversation.com/files/360679/original/file-20200930-24-cu2eex.jpg?ixlib=rb-1.1.0&rect=0%2C0%2C5590%2C3640&q=45&auto=format&w=496&fit=clip" /><figcaption><span class="caption">
</span> <span class="attribution"><span class="source">Shutterstock</span></span></figcaption></figure><p>The source code of the Windows XP operating system is now circulating online as a huge <a href="https://www.pcgamesn.com/microsoft/windows-xp-source-code-leak">43GB mega-dump</a>. </p>
<p>Although the software is nearly two decades old, it’s still used by people, businesses and organisations around the world. This source code leak leaves it open to being scoured for bugs and weaknesses hackers can exploit.</p>
<p>The leaked torrent files, published on the bulletin board website 4chan, include the source code for Windows XP Service Pack 1, Windows Server 2003, MS DOS 3.30, MS DOS 6.0, Windows 2000, Windows CE 3, Windows CE 4, Windows CE 5, Windows Embedded 7, Windows Embedded CE, Windows NT 3.5 and Windows NT 4.</p>
<p><div data-react-class="Tweet" data-react-props="{"tweetId":"1309275918943301636"}"></div></p>
<p>Tech news site The Verge <a href="https://www.theverge.com/2020/9/25/21455655/microsoft-windows-xp-source-code-leak">claims</a> to have verified the material. And Microsoft said it was “investigating the matter”, <a href="https://www.thurrott.com/windows/241670/microsoft-is-investigating-windows-xp-source-code-leak">according to reports</a>. </p>
<p>The leak came with files containing bizarre misinformation related to Microsoft founder Bill Gates and various conspiracy theories. This is consistent with past leaks from <a href="https://www.mygc.com.au/university-of-tasmania-issue-security-alert-following-threat/">4chan</a>, a site often associated with extremist content and internet trolls. </p>
<p>Using the name “billgates3”, the leaker <a href="https://thehackernews.com/2020/09/windows-xp-source-code.html">reportedly</a> said: </p>
<blockquote>
<p>I created this torrent for the community, as I believe information should be free and available to everyone and hoarding information for oneself and keeping it secret is an evil act in my opinion.</p>
</blockquote>
<p>If the leak is genuine, this won’t be the first time a Microsoft operating system source code was released online. At least 1GB of Windows 10 source code was leaked <a href="https://www.theverge.com/2017/6/24/15867350/microsoft-windows-10-source-code-leak">a few years ago</a>, too.</p>
<h2>Vulnerabilities in the source code</h2>
<p>The source code is the “source” of a program. It’s essentially the list of instructions a computer programmer writes when they develop a program, which can then be understood by other programmers. </p>
<p>A leaked source code can make it easier for cyber criminals to find and exploit weaknesses and serious security flaws (such as bugs) in a program. It also makes it easier for them to craft <a href="https://support.microsoft.com/en-au/help/129972/how-to-prevent-and-remove-viruses-and-other-malware">malware</a> (software designed to cause harm).</p>
<p>One example would be “rogue” security software trying to make you think your computer is infected by a virus and prompting you to download, or buy, a product to “remove” it. Instead, the download or purchase introduces a virus to your computer.</p>
<p>According to a report from computer security company F-Secure, on average it takes about <a href="https://www.thenational.ae/arts-culture/microsoft-has-ended-its-support-for-windows-7-so-what-does-it-mean-for-users-1.964362">20 minutes for a Windows XP machine to be hacked</a> once it’s connected to the internet.</p>
<hr>
<p>
<em>
<strong>
Read more:
<a href="https://theconversation.com/australias-cybersecurity-strategy-cash-for-cyberpolice-and-training-but-the-devil-is-in-the-detail-144070">Australia’s cybersecurity strategy: cash for cyberpolice and training, but the devil is in the detail</a>
</strong>
</em>
</p>
<hr>
<h2>Is Windows XP still supported?</h2>
<p>Windows XP <a href="https://www.microsoft.com/en-us/microsoft-365/windows/end-of-windows-xp-support">hasn’t had</a> “official” support from Microsoft since 2014. This means there are currently no security updates or technical support options available for users of the operating system. </p>
<p>However, until as recently as <a href="https://www.wired.com/story/microsoft-windows-xp-patch-very-bad-sign/">last year</a>, Microsoft continued to release security fixes and virus preventive measures for it. </p>
<p>The most notable was an <a href="https://www.theverge.com/2017/5/13/15635006/microsoft-windows-xp-security-patch-wannacry-ransomware-attack">emergency patch</a> released in 2017, to prevent another incident like the massive WannaCry ransomware attack from happening again. This malware affected 75,000 computers in 99 countries – <a href="https://www.wsj.com/articles/english-hospitals-hit-by-suspected-cyberattack-1494603884">impacting</a> hospitals, Telefonica, FedEx and other major businesses.</p>
<p>Windows XP is <a href="https://www.forbes.com/sites/ajdellinger/2019/07/31/survey-finds-one-in-three-businesses-still-run-windows-xp/#5dfdb66357fc">still used</a> by people, <a href="https://japantoday.com/category/tech/skymark-airlines-still-using-windows-xp">airlines</a>, <a href="https://www.theregister.com/2018/06/25/indian_banks_on_notice_windows_xp_must_die/">banks</a>, organisations and in industrial environments the world over.</p>
<p>In 2016, the network which runs the Royal Melbourne Hospital, Melbourne Health, <a href="https://www.theage.com.au/national/victoria/royal-melbourne-hospital-attacked-by-damaging-computer-virus-20160118-gm8m3v.html">was infected</a> with a virus targeting computers using Windows XP. The attack forced staff to temporarily manually process blood, tissue and urine samples.</p>
<p>Online, users have posted photos of Windows XP being used at places such as Singapore’s <a href="https://twitter.com/Mami_AtTheDisco/status/1235467882307268609">Changi Airport</a>, Heathrow Airport and Zeventem Brussels Airport.</p>
<p><div data-react-class="Tweet" data-react-props="{"tweetId":"1222175279751233537"}"></div></p>
<p><div data-react-class="Tweet" data-react-props="{"tweetId":"1202131713561956352"}"></div></p>
<p>Although the exact figure isn’t known, <a href="https://www.techradar.com/au/news/if-you-can-believe-it-millions-of-people-are-still-using-windows-xp">one estimate</a> suggests the operating system was running on 1.26% of all laptops and desktops, as of last month.</p>
<h2>Is there still incentive for hackers to target Windows XP?</h2>
<p>The availability of the Windows XP source code opens access for cyber criminals to search for “<a href="https://securityaffairs.co/wordpress/108762/data-breach/windows-xp-server-2003-code-leaked.html">zero-day threats</a>” in the code that could be exploited. </p>
<p>These are discovered flaws in software, hardware or firmware that are unknown to the parties responsible for patching or “fixing” them – in this case, Microsoft.</p>
<p>Zero-day threats are often found in older ATM machines, for example, as these can’t be patch-managed remotely. This is because they have an embedded version of Windows XP with limited connectivity. </p>
<p>To upgrade in such cases, a bank’s IT professionals would have to visit the machines one by one, branch by branch, to <a href="https://hackernoon.com/do-atms-running-windows-xp-pose-a-security-risk-you-can-bank-on-it-1b7817902d61">apply security patches for the embedded systems</a>. One report suggests hackers can break through the defences and security features of these older style ATMs within <a href="https://www.itproportal.com/news/security-firms-warn-that-most-atms-still-run-windows-xp/">10-15 minutes</a>. </p>
<p>There’s no easy way to confirm whether ATMs in Australia are still running this 19-year-old software, but <a href="https://www.techradar.com/au/news/atm-security-still-running-windows-xp">past</a> <a href="https://www.zdnet.com/article/is-running-windows-xp-on-atms-stupid/">reports</a> indicate this could be the case. <em>The Conversation</em> has reached out to certain parties to obtain this information and is awaiting a response. </p>
<p><div data-react-class="Tweet" data-react-props="{"tweetId":"1296670913287671815"}"></div></p>
<h2>Possible defences</h2>
<p>Windows XP was left to its own defences back in 2014 when Microsoft stopped mainstream support for the operating system.</p>
<p>But as one of Microsoft’s <a href="https://screenrant.com/microsoft-windows-xp-source-code-leak-matters/">most widely-used operating systems</a>, it’s still being run and could be around for many <a href="https://windowsreport.com/keep-using-windows-xp/">years to come</a>.</p>
<p><a href="https://support.microsoft.com/en-us/help/14223/windows-xp-end-of-support">According to Microsoft Support</a>, since Windows XP is no longer supported, computers running it “will not be secure and will still be at <a href="https://www.abc.net.au/news/2019-07-08/microsoft-windows-vulnerability-bluekeep-and-cyber-security-risk/11277270">risk for infection</a>”.</p>
<p>Any antivirus software has limited effectiveness on computers that don’t have the latest security updates. The number of holes in software also increases as machines are left unpatched. </p>
<p>Luckily, most organisations have strategies (requiring money and human resources) to manage large-scale upgrades and isolate their most critical systems.</p>
<p>If your computers are still running on the extremely <a href="https://www.cio.com/article/2371858/windows-xp-turns-10--what-tech-was-like-in-2001.html">outdated Windows XP operating system</a>, you too should migrate to a more modern one. No one can force you, but it’s certainly a good idea.</p>
<hr>
<p>
<em>
<strong>
Read more:
<a href="https://theconversation.com/apple-iphones-could-have-been-hacked-for-years-heres-what-to-do-about-it-122860">Apple iPhones could have been hacked for years – here's what to do about it</a>
</strong>
</em>
</p>
<hr>
<img src="https://counter.theconversation.com/content/147018/count.gif" alt="The Conversation" width="1" height="1" />
<p class="fine-print"><em><span>The authors do not work for, consult, own shares in or receive funding from any company or organisation that would benefit from this article, and have disclosed no relevant affiliations beyond their academic appointment.</span></em></p>The outdated Microsoft operating system was recently dumped online in a huge leak. Hackers can now scour it for bugs to exploit.Brianna O'Shea, Lecturer, Ethical Hacking and Defense, Edith Cowan UniversityPaul Haskell-Dowland, Associate Dean (Computing and Security), Edith Cowan UniversityLicensed as Creative Commons – attribution, no derivatives.