Cloud

7/6/2017
10:30 AM
Connect Directly
LinkedIn
RSS
E-Mail vvv
50%
50%

The Growing Danger of IP Theft and Cyber Extortion

The recent hacks of Disney and Netflix show the jeopardy that intellectual property and company secrets are in, fueled by cheap hacking tools and cryptocurrencies.

Shortly after the latest Verizon Data Breach Incident Report warned of a rise in cyber-espionage attacks aimed at stealing intellectual property (IP) and company secrets, a real-life example hit the news. Entertainment juggernaut Disney was hacked, with attackers gaining access to Pirates of the Caribbean: Dead Man Tell No Tales, and threatening to release the movie in five-minute increments until a ransom of an undisclosed amount was paid. Disney has refused.

This follows on the heels of another high-profile entertainment theft; a hacker stole 10 unreleased episodes of Netflix's series Orange Is the New Black and threatened to dump them online unless the company paid a hefty ransom in Bitcoin. Netflix refused, and the episodes were posted on the Internet.

Yes, Your Company Should Worry About IP Theft
The Verizon report notes that cyber espionage is of particular concern in the manufacturing industry, where it accounts for 90% of cyber attacks. Most of these cyberspy operations are perpetrated by state actors who are stealing cutting-edge technology for use in their home countries.

However, as the Disney hack illustrates, companies don't have to be developing pest-resistant supercrops or gene therapy to become targets. Some businesses scoff at the notion of cyber extortion, thinking that they're too unimportant to attract the attention of hackers. As the Verizon report shows, industry and size don't matter: "if you have — or may be perceived to have — useful information, then you are a potential target" for IP theft.

These days, that applies to pretty much everyone: proprietary financial technology solutions, casino gaming software, secret recipes, mobile apps, even company secrets such as data on marketing strategy, employee recruitment, or research into new products. And, of course things such as unreleased books, movies, and television series are targets.

Furthermore, you no longer have to be a well-funded foreign spy — or even particularly technically inclined — to break into enterprise systems.

Cryptocurrencies and "Malware for Dummies" Lower the Bar for Hackers
Computer hacking used to require a high level of technical prowess. A would-be hacker had to have strong coding skills and understand operating systems, network architectures, and hardware. However, the Darknet has evolved to the point where Mr. Robot-level technical expertise isn't necessary. Inexpensive, easy-to-use, cloud-based "malware for dummies" can be purchased. At least one group of enterprising hackers even offers customer support in case you run into problems.

The rise of cryptocurrencies such as Bitcoin has also helped cyber extortion grow. Before Bitcoin, sending and receiving very large sums of money while maintaining secrecy and anonymity wasn't something just anyone could do. Now, anyone can sign up for a Bitcoin account and send, receive, and spend as much money as they want, without anyone knowing who or where they are.

Third-Party Vendors Can Put Large Enterprises at Risk
The Netflix hack shone a light on another problem with IP security: large companies are only as secure as their third-party business associates.

Generally, hackers used to target the payment systems or databases of large corporations in search of card data or sensitive personal data, such as Social Security numbers. Targeting a very small company wasn’t worth the effort. Now, with easy-to-use hacking tools, untraceable payment methods, and the fact that companies (including many third-party vendors) store millions of dollars' worth of intellectual property on their networks, cybercriminals are getting creative.

Black Hat USA returns to the fabulous Mandalay Bay in Las Vegas, Nevada, July 22-27, 2017. Click for information on the conference schedule and to register.

The intruders didn't have to penetrate Netflix itself; they hacked Netflix's third-party post-production vendor, Larson Studios. In a similar vein, criminals could hack into a clothing brand's textile vendor and steal all of their patterns for next season or hack into reality TV contestants' phones and reveal the winner of the current season before the finale airs.

In some cases, breaking into one small vendor can be more lucrative than breaching a multinational. Because Larson Studios sells post-production services to many television networks, it is likely that more extortion attempts are coming.

Combatting IP Cybertheft
Cyber insurers have noticed third-party vendor vulnerabilities for some time; some policies require that organizations ensure the security of their business associates' systems. That's easier said than done. While large companies like Disney can afford to implement Fort Knox-level security on their systems, such measures may break smaller firms' budgets. However, Disney and Netflix show that a large budget alone doesn't guarantee safety from intrusion.

One client-side solution is network segmentation, in which companies create an isolated system for the vendor to work on tasks with a standalone setup, minimal connection to the company's main system, and as small a digital footprint as possible. However, there are costs involved, and in some cases (likely in the Netflix case) the vendor may need highly specialized software and hardware to do its work, which makes creating such an isolated system impossible.

Another, less-expensive solution is for vendors to work entirely in the cloud, isolated from the larger company's system. Vendors shouldn't be able to download data onto their own networks, and the cloud solution should be secured with two-factor authentication with a key fob or app to avoid the usual security concerns concerning login credentials. This setup isn't foolproof, and it may require vendors to invest in faster connections or deal with slower speeds, but it would ease some of their financial burden.

Finally, organizations of all sizes should consider partnering with a managed security services provider (MSSP). (Note: Mosaic451 is an MSSP, but many other companies offer these services.) Using an MSSP is less expensive than performing cybersecurity functions in-house, especially since the organization doesn't have to make additional investments in security personnel, software, and hardware.

With so much intellectual property being stored digitally, IP theft and cyberextortion are likely to become as big a problem as ransomware. It's imperative for companies of all sizes to get out ahead of this threat, understand the risks, and implement proactive measures to prevent it.

Related Content:

Robert McFarlane is the Chief Revenue Officer of Mosaic451, a managed security services provider (MMSP) and consultancy. He has 20-plus years of business development in telecom, data networking, and cybersecurity. He has contributed to the growth, establishment, and expansion ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
robertmcfarlane
50%
50%
robertmcfarlane,
User Rank: Author
8/18/2017 | 10:58:04 AM
Re: Intellectual property theft
Kevin Kearns wrote a great article on this issue last year stating "Essentially, the cyber-theft of specialized trade secrets has created a perfect storm aimed at America's steel industry. Chinese firms are already able to produce steel cheaply, thanks to billions of dollars in direct energy and other state subsidies, weak or non-existent environmental regulation, and a slave-wage work force. Thanks to intellectual property (IP) theft, they're able to sell valuable steel products that were researched and designed by U.S. engineers. And now, when marketing this high-tech, American-designed steel to U.S. companies, they're able to price it so low that U.S. Steel Corp. can't compete against the very product it spent years (and millions of dollars) perfecting."  Follow the money and you will find examples of this market manipulation and IP theft in many other areas as well.  
smilingguy
50%
50%
smilingguy,
User Rank: Apprentice
7/12/2017 | 10:33:25 AM
Intellectual property theft
Intellectual property theft is trending the wrong way. Despite measures to prevent it, respond to it, and mitigate the effects of this type of costly and even dangerous crime, intellectual property theft is growing—all over the world. Globalization, in fact, is often the root of the problem.
WebAuthn, FIDO2 Infuse Browsers, Platforms with Strong Authentication
John Fontana, Standards & Identity Analyst, Yubico,  9/19/2018
Turn the NIST Cybersecurity Framework into Reality: 5 Steps
Mukul Kumar & Anupam Sahai, CISO & VP of Cyber Practice and VP Product Management, Cavirin Systems,  9/20/2018
NSS Labs Files Antitrust Suit Against Symantec, CrowdStrike, ESET, AMTSO
Kelly Jackson Higgins, Executive Editor at Dark Reading,  9/19/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: "I'm not sure I like this top down management approach!"
Current Issue
Flash Poll
The Risk Management Struggle
The Risk Management Struggle
The majority of organizations are struggling to implement a risk-based approach to security even though risk reduction has become the primary metric for measuring the effectiveness of enterprise security strategies. Read the report and get more details today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-17407
PUBLISHED: 2018-09-23
An issue was discovered in t1_check_unusual_charstring functions in writet1.c files in TeX Live before 2018-09-21. A buffer overflow in the handling of Type 1 fonts allows arbitrary code execution when a malicious font is loaded by one of the vulnerable tools: pdflatex, pdftex, dvips, or luatex.
CVE-2018-17358
PUBLISHED: 2018-09-23
An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.31. An invalid memory access exists in _bfd_stab_section_find_nearest_line in syms.c. Attackers could leverage this vulnerability to cause a denial of service (application crash) via a ...
CVE-2018-17359
PUBLISHED: 2018-09-23
An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.31. An invalid memory access exists in bfd_zalloc in opncls.c. Attackers could leverage this vulnerability to cause a denial of service (application crash) via a crafted ELF file.
CVE-2018-17360
PUBLISHED: 2018-09-23
An issue was discovered in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.31. a heap-based buffer over-read in bfd_getl32 in libbfd.c allows an attacker to cause a denial of service through a crafted PE file. This vulnerability can be triggered by the executa...
CVE-2018-17361
PUBLISHED: 2018-09-23
Multiple XSS vulnerabilities in WeaselCMS v0.3.6 allow remote attackers to inject arbitrary web script or HTML via the PATH_INFO to index.php because $_SERVER['PHP_SELF'] is mishandled.