Cyber Hacking

2010  

Stuxnet 

Arguably one of the most important attacks in history – showing how bits and bytes could become physical, and how government-led cyberattacks could destroy physical systems and structures.  Similar tactics were used by Russia in 2015 against Ukraine when they shut down their power grid through a cyberattack.   But what did Stuxnet do?  This was an extremely sophisticated and targeted attack that specifically targeted an air-gapped network, meaning no connection to the outside internet. 

Source

2013 

Yahoo  

Three billion accounts compromised and the largest in the history of the internet.  It took Yahoo 3 years to notify the public and essentially ended the company's ability to compete as a search engine and email provider,  and with that, clearing the way for Google.  

2014 

Sony 

North Korea's attack against Sony showed their true abilities and placing themselves on the map as a legitimate threat actor.  The hack came shortly after the release of the controversial Seth Rogan film The Interview which showed North Korea in a bad light.  But what probably harmed Sony more is the millions of emails released.   

2015 

OPM 

21 million current and former government workers records released plus a separate database with six million fingerprints.   How do we think this could end poorly for say, undercover agents?  For targeting of senior leaders?

2016 

DNC  13

We had email leaks, we had hacks, we had nation states involved, how is this not a movie yet?  The email leak resulted in embarrassment for the DNC and a few resignations of top DNC staff.   Then the DNC's computer network got hacked, not once, but twice, by two separate Russian APTs, Cozy Bear and Fancy Bear, who, by the way, weren't working together. 

2017 

Shadow Brokers 

In 2016/2017, an unidentified group calling themselves the Shadow Brokers published a trove of NSA's most coveted hacking tools, some of which became some of the most significant hacks of the year such as NotPetya and Wannacry.  The NSA compromise began around 2013, which contained several exploits and tools targeting routers, mail servers, Microsoft Windows, and a working directory of an NSA analyst breaking into the SWIFT banking network.      

Equifax 

Not the largest hack, but significant since the data stolen contained the most sensitive of data (social security numbers, addresses, drivers' license numbers, credit card numbers, etc.).  And the fact that they were compromised from an unpatched Struts vulnerability, which could have been prevented with the most rudimentary of protection measures.   

2018 

Year of ransomware – Atlanta, GA; Wasaga Beach, Ontario; West Haven, Connecticut 

2019 

More ransomware - Jackson County, GA; Albany, NY; Augusta, Maine; Greenville, NC; Imperial County, CA; Baltimore, MD; Riviera Beach, FL 

But that's not all! 

What about cars?  I think most of us have probably heard about Jeeps getting hacked.  But I've also seen/heard of some other tools out there that will hack almost any vehicle out there from 2007 on.   

Or medical supplies?  In 2019, the FDA came out with concerns over internet-connected insulin pumps being vulnerable to hacking.   

What's next? 

It's not just data we need to protect, it's everything.  We live in the world of Internet of Things (IoT) where nearly anything in our lives can now be controlled or accessed via our phones or watches.  If you've seen Mr. Robot you see this when they take control of an executive's house through her IoT devices, altering the temperature in her house, the water temperature of her shower, the alarm system.  All enough to make her leave and stay at her other house.  It's not common, but it's possible.  And it's only the beginning.   

So what do we do? 

I'm going to sound like a broken record here, but patch, patch, patch.  Make sure your systems and devices are up to date, make sure you use two factor authentication on anything you can, have strong passwords.  It's all the same things I've been saying for a while now.

As seen on http://www.allymarie.net/cyber-hacking/