In the last year we have seen the world ravaged by COVID 19 killing well over 2 Million people.  Modern medical solutions have been stretched to their breaking point nearly everywhere during the pandemic.  Something which has helped those on the medical front lines is technology.  Tele-medicine has allowed millions to converse with their doctor via a video call thus reducing risk for all the patients as well as health care providers. Digital prescriptions allow the doctor to directly contact a pharmacy so the patient can just walk in or drive up to and receive their prescription once again reducing COVID risk. The new frontier in medicine is technology.

Today I’ll speak to the connected medical world in which we live and potential risks that you can try to mitigate with planning and vigilance.  In many articles I have written I have spoken about Internet of Things (IoT), which are all those connected devices in your household.  They make life so much simpler and easier but there are risks, but you can mitigate risk with your connected household devices. See my article on Home cybersecurity risks here: https://ericcrichardson.com/2021/01/28/home-the-cybersecurity-dangers-within/amp/

Just like in home devices we have a class of connected devices which can help you manage your medical needs; these are called the Internet of Medical Things (IoMT). These range from more simple devices like pedometers (step trackers) to sports bands or watches up to much more complex devise which could monitor something like fall detection devices. The more complicated devices will generally need FDA approval in the US or other similar organizations in different countries such as Health Canada.  The good news is the federal agencies such as the FDA/Health Canada/Ministry of Health all are evolving and increasing their guidance on cybersecurity before a device even launches and then after it launches.

But there are always things which can be improved. Think about devices you may have in the home that serve medical purposes which a Doctor can read data on and possibly make updates. Things like implantable hart pacemakers or external insulin pumps come to mind. Some of these devices have Bluetooth connections which then communicates with a smartphone and then back to the doctor.  Some devices like CPAP machines use 3G technology to wirelessly connect to a mobile phone network to send data, these can also have Bluetooth connections to allow for configuring. 

Any time you have a connection you have risk, that is what you need to remember.  There have been documented cases of devices being hacked, just do a web search for “Insulin Pump Hack” and you will read about guidance from the US FDA on risks.  The risk is not super high but it’s very real.  If you have a concern the best way of course is to stay at home- why? Bluetooth only has a 30 foot/10 Meter range.

If you are overly concerned and must travel, there are some things you can do–you can purchase “RFID Blocking” clothing, to protect any implantable devices. these garments are designed to stop reading of RFID chips (Radio-frequency Identification) which is a technology to track tags which is a cheap sticker with a special metal on one side forming a small radio transponder. When you check into a hotel often the keycard you get uses an RFID, it is ‘scanned’ at the door.  Well RFID can be scanned at a longer distance depending on how it is configured so if you have anything with RFDI you can block it with these clothes.  RFID blocking apparel has a metallic material in it to block radio signals- it also means you will not be ab le to connect to whatever device you have implanted while you have the garment on but it’s a tradeoff. You can read about  tips you can consider while traveling being a Cyber Secure Traveler here: https://ericcrichardson.com/2021/01/18/the-cyber-secure-traveler/amp/

I’d recommend taking general IoT safety steps first which should help ensure you are already being safe with your connected devices. With a bit of work and planning you can reduce your risk profile quite a bit.

@ericcrichardson

ericcrichardson@gmail.com

In 2015 and 2016 Target Corporation reached settlements of around $50 Million for customers and financial institutions due to an enormous data breach which occurred in 2013.  This breach affected 110 million individuals where the bad guys received Names, phone numbers, physical addresses, and E-mails of customers. This caused a massive follow-on wave of identity theft and bad actors impersonating other people for ill gotten gains.   Target later claimed that they suffered a total loss of nearly $300 Million due to this breach due to lost business, lawsuits, and compensation they had to pay.

How was so much damage done? In simple terms, the bad guys got in through the air conditioner! Technically it was an attack on the HVAC (Heating Venting and Air Conditioning) Units on the buildings to keep their temperatures comfortable, not an attack avenue you considered, did you?

What makes the internet amazing is how billions of devices are interconnected, what makes the internet extremely dangerous is that billions of devices are interconnected.  It is obvious your phone or computer are connected but there are classes of devices you would never think about.  In this case the big HVAC units which sit on the top of buildings are also commonly connected to the Internet, often via the standard network of the facility where they are.  This is so the devices can communicate diagnostic data with the manufacturer, which makes total cost of ownership far less as you can have a technician looking at data from potentially hundreds of units a day to diagnose what is going on versus sending people out to each location.  Better service which is less expensive. The problem is if it is not set up properly you have vendors with access to your network, that means they need to have a user ID and a password. If they do not secure your network login information, then your network isn’t safe.

In this case an attack focused on the HVAC vendor with what’s known as a Phishing attack, or an attack which usually comes disguised as an E-mail to an individual in said company or organization with a link or something to trick that individual to installing bad software (Malware) or to get them to divulge that information.   In this case they used a “Spear Phishing” attack where the bad guys send E-mails with links to malware to specific individuals in a company or organization.  The bad guys do their homework and you have to assume they are working very hard to take random success out of the equation and tie it to planning and execution. You can read up on attacks with regards to installing Malware here: https://ericcrichardson.com/2021/01/20/cyber-smart-the-malware-family-and-attacks/amp/

This information was then used to get access to the HVAC Vendor and they found, in their records, the logon information for Target.  Two hops later and the bad guys got access into the Target network and were able to drop sophisticated software which stole personal data from the registers which are also connected to the network.    For further reading about what you as an individual can do to react to or preventing being victimized see my article on Data Breaches  https://ericcrichardson.com/2021/01/21/planning-and-defending-against-data-breaches/amp/

Many of the more advanced, and therefore more potentially dangerous, attacks use a combination of attack styles and forms of possible malware.  But hackers are always  want more and more access and more and more data, it’s us vs them.

@ericcrichardson

Ericcrichardson@gmail.com

I bet most of the people reading this have at some point been asked to associate a mobile or cell phone number with an account, and for those of you who have you receive a text with a special Personal Identification Number (PIN) to be entered after you enter your user ID and Password.  Well, that is the hands-on part of a relatively new security feature called Multi Factor Authentication (MFA).

MFA is a process and technology which helps you take additional steps to ensure you are in fact you when logging onto a service, app, or website.  There are may forms which it comes in, but I’ll speak to the common types you might see.

-What you know: The notion of security for software and devices is based things a User Knows, that is usually the userID/Password combination. But of course, they can be stolen potentially so of course taking precautions is smart. See my article on Passwords here: https://ericcrichardson.com/2021/01/14/the-gist-of-passwords/amp/

-Who you Are: Security can be enhanced by adding layers to it, you will still need a user ID and Password, but you can add a fingerprint, retina scan, facial recognition etc. Windows/Android/Apple Operating systems all provide for one or multiple additional layers of security in addition to the

-What you Have: Almost everyone who is online has access to a smartphone, so a text can be sent to it to enter a website or service to add another layer of protection. Another example of this is the credit card CVV code- that three- or four-digit code printed on your credit card (Trivia check: “CVV” stands for “Card Verification Value”), that code is not part of your credit card number but can be verified with by a vendor.

–Where you are:  Interestingly most devices, even computers, can give location data. Phones have GPS receives built into them but even a desktop computer can give an estimate where it is based on the internet service provider used. It is also possible for a transaction to check where someone is before approving it.  Now you can use something like a VPN to get around this, in fact see my article on using a VPN here: https://ericcrichardson.com/2021/01/15/the-ins-and-outs-of-using-a-vpn/amp/

MFA is simply an additional layer of protection for you.  My adage is if it is secure that means it’s at least a bit painful sometimes and there are extra steps. Some systems such as Google makes it a bit easier where you sign onto google and just look at your phone and there will be a question pop up on your screen asking if you want to sign in, just click yes. There is a text message being sent to your phone in the background, but it feels much more seamless. This way you are entering a user ID, a Password and you are also having to show you have your phone with you.  Now you phone can go missing- yes, but that is why you always must have a code to unlock your phone and it needs to auto-lock, again security being a bit of a pain bit trust me it is well worth it.

@ericcrichardson

ericcrichardson@gmail.com

Cybersecurity is not all about technology, many times the human factor is the weak link.   Social engineering is all about deception on one level or another.  Interestingly it has quite a bit to do with tactics Spies have used for centuries, somehow gaining trust or at minimum not drawing into question something or someone who then can perform a potentially nefarious act. In many cases the bad guy never uses technology.  

In the physical world, an example is entering a work building from a side door where you scan in a cardkey for access, but a bad actor will follow someone in- this is called “tailgating” an so many people don’t even think to check to see if that person which is walking in behind them is actually supposed to be there.  Basically, the bad actor in this case is trying to look like they belong, they will be dressed like an employee with a backpack and maybe looking distracted by faking being on a phone call as they walk in the door.   Now you are in the building and you can look steal things or snoop around, maybe take some pictures of strategy printouts on the wall etc.

In Cybersecurity it specifically means to use human skills to somehow manipulate a target individual into allowing the bad guy to do something bad.   When combined with technology we see this rampant, scammers will use pop up advertisements which look like legitimate Windows, Android, or Apple Operating System error messages which state there is some kind of urgent issue with the machine but just call this toll-free number and someone can help. Then you are connected to a scammer who pretends to be from Microsoft or Apple, and they walk you through a process to steal information.   

Another approach is something you have likely experienced, a phone call that somehow states something is wrong and an agent will help you but only for a “limited time only” or something like that to shift you away from thinking about it being fishy.   It is much like a shell game; distraction is the key.

With technology of course you can be attacked via text messages, direct messages on social media, E-mail, or phone calls.  There are many tips out there but some to keep in mind:

• Caller ID should not be trusted, bad guys can make their phone numbers appear to be anywhere (this is called “spoofing”)

• Training is huge If you are in business, ensure your teams are trained in security; if you are an individual read up on the attacks and be a bit wary

• “Too good to believe” don’t trust offers of bizarrely discounted software or services where you just need to “install this small app.”

• Know that tech support is not going to call you out of the blue, if you need tech support verify the number to call for a given company and use that number.

• If you are the subject of an attempted messaging or E-mail attack, take a moment and really look at the link they are sending you to—In just about all cases it’ll be a website you’ve never heard of.

• No one should ever ask you for your password.

• No one should ever ask you to download software onto your machine.

• In the workplace, be sure people ‘swipe’ their keycards to get access- it is fine to ask someone to is trying to tailgate to swipe in

May times social engineering is a way to get your to unwittingly install malware on your device, see my article on Malware here https://ericcrichardson.com/2021/01/20/cyber-smart-the-malware-family-and-attacks/amp/

Technology can be risky yes, but the human factor is so very often the tool of choice these bad actors use when attacking. Social engineering is often considered one of the very highest areas of risk to securing our technology.

@ericcrichardson

We know there are bad guys out there who write nefarious programs and attempt to get them on our computers and phones via wide ranging methods.  This bad code is known generally as “Malware”, “mal” literally meaning ‘Evil’ or ‘Bad’ in Latin- and is at the root of words like “Malicious”.  It is indeed just that, evil code.  We know Malware/Viruses equals bad, but there are many myths around them which you should really be aware of. Read on for just a few of the myths which you should keep in mind.

Malware, like taxes, is inevitable.

Only Windows- The most written about computer malware myth is that it is just a Windows problem.  The root of that falsehood is that about 65% of all computers run Windows and Microsoft is historically a widely attacked company.  The bad guys are smart, and they will go after the largest target, which is Windows.  Apple’s MacOS and iOS have been the subject of many attacks over the years but at about 25% of the computers out there it just does not make the news. As for the rest it is basically UNIX and Linux of which there is not just one official version, which both helps and hurts.  If you are running a well-supported version such as RedHat Linux bugs are likely to be addressed fast but lesser-known versions (aka Kernels) might not ever be patched.  So, the lesson is the same here- patch your systems, use whatever automatic updates which are available as all the major operating systems: Windows/ Apple based/ UNIX/LINUX.     

It is just a new problem- Another myth about malware is that it is a new thing. Would you believe the first noted virus is 50 years old?  The forerunner to today’s Internet was called ARPAnet which was a way to connect via networked research institutions across mostly North America in the mid 1960’s.  In 1971 a programmer named Bob Thomas wrote an innocuous little program that simply displayed “I’m the Creeper, catch me if you can!” on the terminals of users of ARPAnet.  While never intended to do any harm, it was annoying, and Thomas was sneaky insofar as he wrote it that it would make copies of itself to run on different machines thus the first virus was specifically a Worm which is a virus which makes copies on different machines thus making it harder and harder to squash.  Creeper then gave rise to “Reaper” which was in a sense the first anti-virus software as its tarted Reaper to delete copies found.  Clearly viruses are not a new dance in the tech world.   For those who read the Michael Crichton book Westworld (of which the HBO Series and movie from the 70’s came from), it names the bad code acting like a “Disease of machinery”- Michael Crichton was in fact an MD before becoming an author.   As a slight side note I re-read “Andromeda Strain” as COVID-19 started to grip the world last year, scary and on point!

My phone is fine- Only computers are at risk is another huge misconception.  Phones and tablets are the new target of opportunity. As they are effectively small computers using variations of the existing operating system their “large siblings” use they are at risk of many of the same or variants. Unlike where computers have Windows as the most used Operating System, in the world of phones Android is the big dog.  From many embarrassing issues in the past Microsoft learned how to define world class patching and both Google and Apple have adopted much of the rigor to keep software updated.  Having worked in big tech, I can absolutely say the number of engineers working on current operating systems is huge. Everyone wants to work on the next big thing but the whole nature of “sustained engineering” is critical. Again, use reputable anti-virus/anti-malware software to protect them. Other devices such as security cameras, baby monitors, doorbells, lights, refrigerators or even beds can be connected to the internet to allow you to get useful information from them. They also become attack surfaces for bad guys. These “Internet of Things” devices (or IoT) are more and more popular.

I am working on a campion article to this one, focusing on a summary of the different types of Malware and attacks to keep in mind as well as a deeper discussion of IoT risk.  As a reminder always keep passwords strong – see my post on Passwords here:     

https://ericcrichardson.com/2021/01/14/the-gist-of-passwords/amp/  The big takeaway here is to not assume too much, plan on everything that touches the internet being attacked and take precautions as you cannot be overly careful.

@Ericcrichardson