Category: Announcements / News

May 02, 2019

“BERN” App Divulges 150 Million Voter Records

The future of community organizing or the latest flagrant violation of online privacy? That’s the debate currently raging over the Bernie Sanders presidential campaign’s roll-out of its new “BERN” application. The campaign positions it as a new organizing tool that assists volunteers in tracking potential supporters – permitting them to log the name and background of anyone they talk to: from friends and family members to complete strangers on the street. But skeptics argue that the database of personal information could open non-supporters up to harassment. While a sizable proportion of the data the app requests is publicly available for savvy political operatives who know where to look, critics say that having the data neatly compiled — while not giving people a way to opt out of it — presents online and offline safety concerns. So how did this hotly debated application expose private information of up to 150,000,000 American voters? It seems that an error in the app’s source code caused personal voter identification numbers to be exposed for several hours before ultimately being corrected. Visitors to the website could simply use the F12 Developer Tools shortcut to inspect HTML elements, displaying results like this: (personal information redacted to protect user privacy) Defenders of the application note that information like this has long been accessible by campaigns through the use of CRM tools like NGP VAN and others. However, opponents argue that there are some important caveats. Traditionally, campaign staff using the above tools are limited to data about the precincts they work in, data packets are coded, and personnel are monitored – the BERN app contained no such restrictions. Publishing voter files online is illegal in every state – and for good reason. In some states, voter ID numbers are identical to other identifying numbers like those found on Driver’s Licenses or Social Security cards. This is deeply troubling as hackers and criminals could use these legitimate records to make counterfeit IDs and subsequently use them to open bank accounts and commit other types of fraud. Setting aside critical identifiers like Social Security numbers, the exposed information such as a user’s age, residence, gender, zip code and other “banal” data can be cross-referenced with personal records already compromised on the Dark Web. For example, a cybercriminal typically purchases stolen credit card information on the Dark Web for less than $10 per record. To carry out an online purchase, a hacker would have to know your address and ZIP code – and thanks to the BERN leak, this information is already out there. For in-store purchases, a hacker could simply clone your credit card and, in the rare case that a store associate asks for a photo ID, use the Driver’s License number found on BERN to create a convincing and scannable counterfeit ID. (sample Dark Web advertisement for stolen credit card information) So how do you protect yourself from becoming a victim of identity theft? Organizations have proved time and time again that they are unable to ensure complete security of your personal information; therefore, it would benefit private citizens to enroll in an Identity Monitoring service. By enlisting the help of a trusted provider, online users can monitor their credit cards, driver’s license, Social Security number, medical records and even their passwords – and be alerted when they are for sale on the Dark Web, the world’s largest marketplace for stolen information. ID Agent provides a robust suite of services to address the risks faced by MSPs and that of their SMB clients. BullPhish ID™ delivers security awareness training and phishing simulations created specifically to help employees recognize and avoid phishing traps. Dark Web ID™ monitors the dark web for employee and supply chain credential exposure, which most often results from using those credentials on third-party websites. SpotLight ID™ provides comprehensive personal identity protection and restoration services for employees and customers, mitigating risk and providing peace of mind.

April 26, 2019

Game of Thrones: An SMB Cybersecurity Analogy

***SPOILER ALERT: this article contains some plot details up to Season 8, episode 2*** The epic struggle of Jon Snow, Daenerys Targaryen and their fragile coalition of allies against the looming undead army of White Walkers bears a striking resemblance to the growing specter of cyberthreats against small to medium sized businesses in recent years. So how do you make people care about cybersecurity as much as they care about who will reign supreme over Westeros? Simple – frame these threats in the fantastical terms they already understand from Sunday nights watching HBO. Westeros as an SMB Westeros, the fictional continent where much of the show’s action takes place, is an excellent metaphor for your organization’s IT environment. It has a clear perimeter as an island surrounded by water and contains significant assets – food, weapons, livestock, infrastructure and its citizens (just as a business owns personal data, payment information, intellectual property and other sensitive material). While there is some warring between the Lannisters, Starks and other houses, it’s helpful to think of them as various departments within the same organization – jockeying for resources, much as different business units might fight for limited budget. A united Seven Kingdoms allows us to recognize the true existential threat to the security and prosperity of Westeros’s inhabitants – the White Walkers. The most direct cybersecurity parallel to this horde of undead would be a malware botnet. A botnet is a collection of internet-connected devices such as computers, smartphones or IoT devices whose security has been breached and control ceded to a third party (the ice-cold third party being The Night King in this scenario). Much like The Night King is able to raise his victims from the dead to join his ranks, hackers are able to fool unsuspecting users by implanting and executing malware on their devices, oftentimes through advanced phishing attacks, to take control of them. This malware could restrict access to business-critical systems for a ransom and harvest user credentials to grant hackers access to financial resources — two techniques that could potentially bankrupt an SMB. The hacker can also use infected devices to carry out ever larger-scale attacks, such as Distributed Denial of Service (DDoS) attacks against your website. As we learned in the latest episode of Game of Thrones, The Night King is seeking to launch a DDoS attack on Westeros and beyond, with the goal of permanently shutting down the living. Another similarity that Game of Thrones superfans will appreciate: neither the White Walkers nor hacking tools were originally conceived with destructive purposes in mind. The White Walkers were originally human-like figures created with magic by the Children of the Forest to protect them from the First Men. They were defense weapons created with good intentions that eventually became so powerful, they threatened all of humanity. Similarly, cyberweapons like StuxNet were originally developed as tools of defense to limit the advances of Iran’s nuclear program, but have since fallen into the hands of third-party criminal groups, who continue to leverage the techniques that made StuxNet possible. Speaking of hacking tools that were previously only available to national governments but are now utilized by criminals, the White Walkers currently have access to more powerful resources than ever before – namely, a terrifying ice-fire-breathing dragon. This parallels the now widespread use of tools like those released by The Shadow Brokers in 2016. The exploit EternalBlue, developed by the NSA in the name of national security and leaked by The Shadow Brokers, was used in the infamous worldwide WannaCry attack that affected over 200,000 computers across 150 countries. Similar to the defense measures that many SMBs implement, Westeros has indeed taken steps to protect itself from the murderous throngs of ice zombies to their north. The most notable example of this would be The Wall. 300 miles long, 700 feet tall and fortified with ancient magic, this rock-solid ice wall could most easily (and ironically) be compared to a Firewall. It’s the first line of defense against intruders, and it takes a Night’s Watch of IT Administrators to maintain it, guard it and analyze for vulnerabilities. As any cybersecurity professional knows, a firewall is a significant defense but can be bypassed by a savvy hacker who knows how to exploit human error, compromised credentials and unpatched applications (or in GoT, by a savvy zombie sociopath with a seemingly unstoppable ice dragon). How to fight back So what can be done to keep your digital kingdom safe? First, you want to make sure your organization’s leadership isn’t like Cersei Lannister – Queen of the Seven Kingdoms who is unwilling to address the existential threat from the North. Much like the wise Maesters of the Citadel, you’ll need to educate decision-makers about the consequences of inaction. For example, 60% of SMBs go bankrupt within the first 6 months following a major cyber incident. Because the vast majority of data breaches are due to human vulnerability and compromised credentials, you’ll want to focus on cybersecurity best practices; these practices are your weapons forged from dragon-glass and Valyrian steel – the only ones proven to be effective against White Walkers. Just as Arya Stark is lethally trained by the Faceless Men, make sure your employees are trained to recognize phishing attempts that may contain malicious files or requests. You’ll also want your very own Three-Eyed Raven. That’s to say, you will want to implement a Dark Web Monitoring service to detect when your users’ credentials are compromised on the Dark Web. Leveraging visibility of your business’s weak spots will give you a *Stark* advantage against hackers (pun very much intended). Be sure to implement strong password phrases and modify them on a regular basis. Lastly, enlist the help of a dragon of your own. Managed Service Providers are a powerful resource for SMBs, armed with knowledge and experience in fighting off cybercriminals. A reputable MSP who focuses on the above techniques like Security Awareness Training and Dark Web Monitoring will be a fiery champion for your digital realm. ID Agent provides a robust suite of services to address the risks faced by MSPs and that of their SMB clients. BullPhish ID™ delivers security awareness training and phishing simulations created specifically to help employees recognize and avoid phishing traps. Dark Web ID™ monitors the dark web for employee and supply chain credential exposure, which most often results from using those credentials on third-party websites. SpotLight ID™ provides comprehensive personal identity protection and restoration services for employees and customers, mitigating risk and providing peace of mind. Send us a raven to schedule a demo today!

November 28, 2018

Winner Announced in Dark Web ID Contest!

We are excited to announce the winner of our “Tell Us Your Story” contest! Jeff Reiter of RWK IT Services in Frankfort, IL submitted our winning testimonial, as voted on by a committee of 10!

September 28, 2018

Update: Facebook Breach Information is Now For Sale on the Dark Web

Update, October 4, 2018: Our cybersecurity division has confirmed that the individual account information associated with the Facebook breach is now being sold on popular Dark Web markets for $3 to $12. In comparison, a database of 2 million users is typically sold on the Dark Web for about $30. This means the infamous hackers could see an unusual payday of $150 to $600 million.

April 26, 2018

A New Wave of Brute Force Attacks: Here’s What You Should Know

Last month, the United States Department of Justice indicted nine Iranian hackers for a wave of brute force attacks. These attacks resulted in the digital theft of more than 31 terabytes in information worth $3 billion in intellectual property.

March 27, 2018

ID Agent Is Experiencing Major Growth

ID Agent started small — a handful of Partners, a few team members, and a solution we really believed in. Since then, a few things have changed. We have a larger team now, and a lot more Partners. But, we still provide credential monitoring solutions that are helping MSPs all over the world grow. The first part of 2018 has come with a lot of excitement for ID Agent, and we know much of that excitement is thanks to our Partners. There are a few developments that we want to share in this article, and we hope to show our Partners and potential Partners how much of an impact our solutions can have on their businesses.

March 06, 2018

Dark Web ID’s New API and Integration Benefits

When you’re working hard to identify and address your customers’ security compromises, you probably wish there was a way to do so faster, easier, and more accurately. With ID Agent’s new API (application programming interface) for its Dark Web ID™ solution, this wish becomes a reality.

February 13, 2018

A Love Letter to the Channel

8 months ago, I had never heard the terms MSP, MRR, or even Managed Service Provider… and now I can’t image my life outside of this space. This is my story and love letter to the MSP space and the people who make up the community, and the channel we are committed to serve.

September 08, 2017

Equifax’s Giant Security Breach – Inside Job?

Equifax’s giant cybersecurity breach announced yesterday – one of the worst ever – compromised the personal information of almost half the U.S. – potentially 143 million Americans. Residents in the U.K. and Canada were also affected. Based on Equifax’s investigation, the unauthorized access occurred from mid-May through July 2017.

July 24, 2017

ID Agent Recognized in the 2017 Emerging Vendors List by CRN

ID Agent has been named on the 2017 Emerging Vendors list cultivated by CRN. Because this online magazine is dedicated to all things focused on the IT channel, suppliers and technology integrators, it is an honor to make this list. It identifies a group of businesses that provide the best IT and support elements for their partners and channel programs.

Please fill in the form below to subscribe to our blog

Country