New Phishing Technique Puts Gmail Accounts at Risk

Published with Permission by:
Lint, James R., “New Phishing Technique Puts Gmail Accounts at Risk”, In Cyber Defense, 17 Jan. 2017, Web, http://incyberdefense.com/news/phishing-technique-gmail-accounts-risk/

By James R. Lint
Faculty Member, School of Business, American Military University
Senior Editor for
In Cyber Defense

Cyber attackers have found a new, highly effective phishing technique targeting Gmail and other services, according to a recent article on Wordfence.

Author Mark Maunder writes “an attacker will send an email to your Gmail account. That email may come from someone you know who has had their account hacked using this technique. It may also include something that looks like an image of an attachment you recognize from the sender.

You click on the image, expecting Gmail to give you a preview of the attachment. Instead, a new tab opens up and you are prompted by Gmail to sign in again….Once you complete sign-in, your account has been compromised.”

Maunder surmises that the attackers must be on hand and ready to exploit your account because of the speed with which they respond. They sign into your account and send emails with your attachments using your subject lines from previous emails to people in your address book.

This is a very effective phishing technique to use against the people who trust you. The hacking crew is large enough to spread across several time zones and exploit your English-language email account. More analysis of this phishing technique might reveal what other languages are being used for this phishing method and help locate the attackers by their unique skill sets.

Using Gmail Single Sign-On Services Is Risky for Your Account

The comfort of Single Sign-On services for your Gmail credentials creates a security risk for your account. As we get more comfortable using these services and customers ask for more ease of operation, we will have to consider the impact of risk that comes with the ease of operation.

The Wordfence article shows a “data URI” (Uniform Resource Identifier) with the complete file in the browser location bar. This data URI provides a method to include in-line data in web pages as if they were normal external resources.

The data:text link line in the browser bar is actually a disguised script. This script opens a fake Gmail login page. When you log in, it sends your real credentials to an attacker. Ideally, you should review the whole browser address window and ensure there is not a script hiding further inside the window.

Always Check Your Browser’s Location Bar

The Wordfence article, US-CERT best practices and other experts say it is best to check the location bar in your browser to determine if you are clicking on the correct website. Just because you click on something that states: “We will make you rich, click link” does not mean it is the correct link.

In fact, here is a safe example. Click on this link: “We will make you rich.

The link will NOT make you rich, but it sends you to the US-CERT Best Practices Page. Be sure to check your links before you click on them to see whether they match.

A reader comment from Google suggests that most any HTTP or HTTPS could have phishing code. The reader says the address bar in a browser window remains one of the few trustworthy components in a browser program.

To say that the browser address bar is highly trusted is inviting the next skilled hacker to show his capability. We do not know what the future will hold in terms of security and hacker attackers. However, I would not bet on the safety of any material you wish to keep private.

It is wiser to remain up to date with your security software and to study new cyberattacks when you hear about them to keep your computers and mobile devices protected.

About the Author

James R. Lint recently retired as the (GG-15) civilian director for intelligence and security, G2, U.S. Army Communications Electronics Command. He is an adjunct professor at AMU. James has been involved in cyberespionage events from just after the turn of the century in South Korea supporting 1st Signal Brigade to the DHS Office of Intelligence and Analysis as the first government cyber intelligence analyst. He has 38 years of experience in military intelligence with the U.S. Marine Corps, U.S. Army, government contracting and civil service.

Additionally, James started the Lint Center for National Security Studies, a nonprofit charity that recently awarded its 43rd scholarship for national security students and professionals. James was also elected as the 2015 national vice president for the Military Intelligence Corps Association. He has also served in the Department of Energy’s S&S Security Office after his active military career in the Marine Corps for seven years and also served 14 years in the Army. His military assignments include South Korea, Germany and Cuba in addition to numerous CONUS locations. James has authored a book published in 2013, “Leadership and Management Lessons Learned,” and a new book in 2016 “8 Eyes on Korea, A Travel Perspective of Seoul, Korea.”

Managing Multiple Generations: Issues, Problems and Language

Published with Permission by:
Lint, James R., “Managing Multiple Generations: Issues, Problems and Language”, In Cyber Defense, 24 Jan. 2017, Web, http://incyberdefense.com/news/managing-multiple-generations/

By James R. Lint
Faculty Member, School of Business, American Military University
Senior Editor for 
In Cyber Defense and Contributor, In Homeland Security

In the world of cyber defenders, we often see multiple generations working in the same office. We see the Millennials, GenXers and Baby Boomers who have seniority and management skills. However, has the world changed when it comes to managing a multiple-generation organization?

Dan Coates is an authority on marketing and research about youth and the millennial market. At the recent 2017 SHOT Show’s Executive Management Seminar, he discussed how various generations view management.

His ideas can help improve management skills in many areas. The need for better management is critical as the government tries to hire more cyber security personnel.

What Makes Generations Unique?

Coates looked at what makes the generations unique. What made Millennials unique was technology. It was their top concern, twice as important as that of Gen Xers. Millennials want IT upgrades and better hardware and software.

Boomers rated the work ethic as the number one concern among those factors that made their generation unique. After all, who are today’s managers?

Coates’ research found Millennials’ second top focus was music and culture. For Gen Xers, it was work ethics, while Boomers cited respect.

With this diversity of focus among different generations, there is the potential for workplace issues. That focus could cause Millennials to perceive older workers as too much like “stuffed shirts,” while Millennials are seen as undisciplined by Gen Xers and Baby Boomers.

Managers should give consideration to each generation’s unique qualities as they deal with different generations in the workplace. Training and managing expectations might calm workplace issues before they become problems that interfere with productivity.

Each Generation Has Its Own World Views

Coates explained that each generation has a unique experience and point of view. Their generational characteristics shape the way they view the world.

To effectively communicate with employees, managers should consider the generation they address. Thinking of generation communications as three different languages could help improve workplace communication.

Tips for Working with Generation Xers

  • Show how the discourse affects them. What is the impact on them?
  • Focus on skills development. Explain how they can develop and grow.
  • Show proof of what you’re discussing. Give examples of improvements that can be made and provide websites.
  • Keep it concise. Make the bottom line simple, straightforward and to the point.

Tips for Working with Millennials

  • Emphasize “the cause” first; they want to make an impact on the world. The military calls this “mission focus.”
  • Be highly visual. Millennials are a visually driven group and prefer images over text.
  • Think online and offline. Digital natives need digital points in addition to in-person reinforcement, because they live online and offline simultaneously.
  • Use peer influence. Give examples of peer successes.

Examine the Possible Solutions

Many of these tips and comments have been raised in executive management seminars and MBA courses, but Dan Coates separates them into generational targeting. If your office is having personnel issues, check to see if they are multi-generational in nature and try some of these tips. The solution of workplace problems may lie in dissecting the players by generation and looking for the solution as a targeted segment.

About the Author

James R. Lint recently retired as the (GG-15) civilian director for intelligence and security, G2, U.S. Army Communications Electronics Command. He is an adjunct professor at AMU. James has been involved in cyberespionage events from just after the turn of the century in South Korea supporting 1st Signal Brigade to the DHS Office of Intelligence and Analysis as the first government cyber intelligence analyst. He has 38 years of experience in military intelligence with the U.S. Marine Corps, U.S. Army, government contracting and civil service.

Additionally, James started the Lint Center for National Security Studies, a nonprofit charity that recently awarded its 43rd scholarship for national security students and professionals. James was also elected as the 2015 national vice president for the Military Intelligence Corps Association. He has also served in the Department of Energy’s S&S Security Office after his active military career in the Marine Corps for seven years and also served 14 years in the Army. His military assignments include South Korea, Germany and Cuba, in addition to numerous CONUS locations. James has authored a book published in 2013, “Leadership and Management Lessons Learned,” and a new book in 2016 “8 Eyes on Korea, A Travel Perspective of Seoul, Korea.”

New Medical Technology and Data Privacy

Published with Permission by:
Lint, James R., “New Medical Technology and Data Privacy”, In Cyber Defense, 18 Jan. 2017, Web, http://incyberdefense.com/news/new-medical-technology-data-privacy/

By James R. Lint
Faculty Member, School of Business, American Military University
Senior Editor for
In Cyber Defense

As we grow older, we should be thankful for the growth of medical technology. New devices on the market expand healthcare providers’ capability to treat patients. These new products range from insulin pumps and home safety equipment to blood pressure rings.

Airbags for Humans

At the CES show in 2017, ActiveProtective debuted an innovative belt with built-in airbags that deploy when the belt detects that the wearer is falling. The concept is similar to a car airbag by providing protection before impact and preventing injury. This airbag product is especially useful for hip replacement patients.

However, there might be data privacy issues with this product later. The company plans to increase the belt’s communication ability as time goes on. In the future, the belt may include the option to send information via email to doctors or other caregivers using a Wi-Fi/Bluetooth system or cellular phone.

Should Other Fall Devices Communicate Private Data?

All medical device users face the conundrum of deciding whether privacy or immediate treatment of an injury is more important. For instance, many fall monitoring devices on the market immediately communicate to other people when the wearer falls. Other monitoring devices, such as Life Alert, require the patient to press a button and call for help. Both types of monitoring devices are helpful, but again there are privacy concerns.

Often, a patient’s primary focus is on immediate treatment and health recovery. The patient would rather call an ambulance than worry about privacy invasions from patient data these devices might transmit.

While these monitoring devices may only send alert information regarding someone’s fall-related injuries, this information may not be encrypted. This lack of security becomes a worrisome issue if a thief is scanning radio waves or wardriving in order to find Wi-Fi networks.

With the alert message sent from someone’s home, a criminal may intercept the message and attempt a home invasion before first responders can arrive. Both versions of an alert compromised in transmission could invite someone to empty your home of valuables.

Cybersecurity Experts Are Critical for Solving Privacy Issues

It will be up to cyber defenders to think of these privacy issues and provide solutions. The problems are not easy. There needs to be a way to securely transmit private health information without the fear of a garbled message and without using encryption that renders an emergency message unreadable by the patient’s family or friends.

If radio transmissions are used to communicate health data, a device’s ability to transmit information could be limited due to the use of powerful encryption in hand-held radios. However, a patient in pain would be more interested in making contact with first responders than about risks to data security.

Inside a hospital, it’s easier to control data signals and encryption due to HIPAA regulations. However, people who are at home with chronic medical problems will need more careful monitoring. The criticality of quality medical information given to medical personnel will become an issue of data protection as the field of medical equipment continues to evolve.

Do Medical Devices Have Potential for Security Attacks?

After Vice President Dick Cheney received a pacemaker, he and the U.S. Secret Service worried about the potential for assassination via a hacked pacemaker. There have not been any reports of assassination by medical device…yet.

Security researchers have explored a few specific devices to improve multiple devices that communicate medical information.

New medical devices are being developed regularly. Over time, confidence in health monitoring technology will increase in importance. So with today’s advances in technology, it’s a better time to be a patient than ever before.

About the Author

James R. Lint recently retired as the (GG-15) civilian director for intelligence and security, G2, U.S. Army Communications Electronics Command. He is an adjunct professor at AMU. James has been involved in cyberespionage events from just after the turn of the century in South Korea supporting 1st Signal Brigade to the DHS Office of Intelligence and Analysis as the first government cyber intelligence analyst. He has 38 years of experience in military intelligence with the U.S. Marine Corps, U.S. Army, government contracting and civil service.

Additionally, James started the Lint Center for National Security Studies, a nonprofit charity that recently awarded its 43rd scholarship for national security students and professionals. James was also elected as the 2015 national vice president for the Military Intelligence Corps Association. He has also served in the Department of Energy’s S&S Security Office after his active military career in the Marine Corps for seven years and also served 14 years in the Army. His military assignments include South Korea, Germany and Cuba, in addition to numerous CONUS locations. James has authored a book published in 2013, “Leadership and Management Lessons Learned,” and a new book in 2016 “8 Eyes on Korea, A Travel Perspective of Seoul, Korea.”

OPSEC Precautions For This Site

Source: http://news.nationalpost.com/arts/movies/jason-bourne-proves-why-computers-are-the-worst-thing-to-happen-to-the-spy-thriller-since-no-more-day-to-day-formalwear

Things to keep in mind when interacting with The Lint Center, particularly when leaving comments or uploading photos:

  1. Defense conditions are classified secret, while force protection conditions are unclassified.
  2. Vulnerability of oconus installations to sabotage or penetration is classified secret if U.S. Intelligence information is made.
  3. The identity of units planned for deployment is confidential until an official announcement of the deployment is made.
  4. General geographic location of units deployed ( I.E. City, Country or Area) is unclassified.
  5. Specific geographic location of units deployed is confidential.
  6. Details of allied military participation in operations are secret.

The Global reach of the World Wide Web requires special precautions to be taken when posting information. The following types of information will not be posted publicly on WarriorLodge.com and will be taken down immediately:

  • Information that is for official use only (FOUO). This type of information would pose an unacceptable risk to the US Military, especially in electronically aggregated form. While records containing FOUO information will normally be marked at the time of their creation, records that do not bare such markings shall be assumed to contain FOUO information.
  • Analysis and recommendations concerning lessons learned which would reveal sensitive military operations, exercises or vulnerabilities.
  • Reference to unclassified information that would reveal sensitive movements of military assets or the location of units, installations, or personnel where uncertainty regarding location is an element of a military plan or program.
  • Personal information including compilations of names or personnel assigned overseas, sensitive, or routinely deployable units.
  • Names, locations, and specific identifying information about family members of military and government employees.
  • Highly technical information that can be used or be adapted for use to design, engineer, product, manufacture, operate, repair, overhaul, or reproduce any military or space equipment or technology concerning such equipment.
  • Unclassified information pertaining to classified programs. The clearance review procedures for unclassified information pertaining to classified programs proposed for posting to a publicly accessible web sites must take into account the likelihoods of classification compilation.

So, let’s review…

  1. Don’t discuss current or future deployment destinations.
  2. Don’t discuss current or future operations or missions.
  3. Don’t discuss current or future dates and times of when service members will be in deployed, in-port or conducting exercises.
  4. Don’t discuss readiness issues and numbers.
  5. Don’t discuss specific training equipment.
  6. Don’t discuss people’s names and billets in conjunction with operations.
  7. Don’t speculate about current or future operations.
  8. Don’t spread rumors about current, future, or past operations or movements.
  9. Don’t assume the enemy is not trying to collect information on you; they are… right now.  Seriously.
  10. Be smart, use your head, and always think OPSEC when using email, phone, chat rooms and message boards.

dia

Operations Security: 1. A systematic, proven process by which a government, organization, or individual can identify, control, and protect generally unclassified information about an operation/activity and, thus, deny or mitigate an adversary’s/competitor’s ability to compromise or interrupt said operation/activity (NSC 1988). 2. OPSEC is a process of identifying critical information and subsequently analyzing friendly actions attendant to military operations and other activities to (a) identify those actions that can be observed by adversary intelligence systems, (b) determine indicators adversary intelligence systems might obtain that could be interpreted or pieced together to derive critical information in time to be useful to adversaries, and select and execute measures that eliminate or reduce to an acceptable level the vulnerabilities of friendly actions to adversary exploitation (DOD JP 1994; JCS 1997).

Operations Security process: An analytical process that involves five components: identification of critical information, analysis of threats, analysis of vulnerabilities, assessment of risks, and application of appropriate countermeasures (NSC 1988).

Source: http://www.ioss.gov/glossary.html#o