Privacy Extortion - This privacy sensitivity occurred innocently in the physical world on a beautiful avenue. But, privacy sensitivity can be even more critical in the virtual world.

Privacy Extortion

A new type of cyber-crime: From kindergarteners to adulterers

A year ago I was walking on a sunny day with my daughter in Frankfurt near the Alte Oper. We saw a group of kindergarten kids walking hand in hand with their teacher. They were lovely. We couldn’t take our eyes off of them, and my daughter couldn’t resist taking their picture. She instinctively raised her smartphone to photograph them, but the teacher immediately waived her hands, and in a firm tone said: “You are not allowed to breach these kids’ privacy. Please do not take any pictures.”

This privacy sensitivity occurred innocently in the physical world on a beautiful avenue. But, privacy sensitivity can be even more critical in the virtual world. The cyber world, in a way, knows more about our inner life, desires, passions, relationships and challenges than we perhaps know ourselves. Revealing this information about an individual can cause enormous damage to his or her professional and personal well-being. As we all have seen, the cyber world, unlike my daughter with the kindergarteners, is also less respectful with an individual’s sensitive information.

Uncovering the Dirt

Millions of Ashley Madison members certainly felt a breach into their private lives recently. I’ll bet they panicked when they found out that the entire Ashley Madison database was stolen, perhaps to be publicly revealed.

Unfortunately, stealing confidential data is not new to us. Bigger services have suffered from data theft before, and while stealing credit card data is harmful, the damage is basically repairable. The potential fallout from the breach to the Ashley Madison online adultery service is quite different. Brought to light, Ashley Madison membership reflects in a profoundly negative fashion on the individual, painting their reputation starkly in black, and risking everything from their family relationships to their social status and even their career.

Because the Ashley Madison site facilitates adultery, the security breach has mostly caused a titillated public to react with a combination of moral judgment and humorous quips. But, this breach is a cyber-security crime that requires us all to take notice. The personal details and other juicy descriptions identified in the Ashley Madison breach create a new kind of cyber security threat: the potential for massive blackmail. According to the attackers themselves, the Ashley Madison hack is targeted at the service provider. It also heralds a new, very dangerous and troubling form of cyber-crime: the disclosure of personal secrets, which comes with all kinds of other risks, such as extortion.

For the hackers, this is an outrageously lucrative business model. Most (probably all) of the Ashley Madison customers would be happy to pay a reasonable price to avoid having their online profile made public. Even if the price were $50 to keep member profiles private, it would turn the hackers into multimillionaires.

Storing Personal Information

Of course, Ashley Madison is not the only site storing sensitive personal information. It doesn’t take long to consider other sites where the registered users wouldn’t want their private lives to be exposed: medical records and social chatting, to start.

All of us are subject to a “dark secret” in our inner life that we wouldn’t want to fall into the hands of bad guys. No longer is this just about big corporations and credit card theft; this is deeply personal with a Pandora’s Box aura as once the information is public, it remains so. This is a wake-up call for service providers to improve the security of their services in the interest of protecting their users’ secrets.

Security strategies have traditionally revolved around protecting the endpoints and the network. However, hackers are increasingly targeting service providers’ databases that reside within the data center. Databases and web applications in the data center are open to new attack methods that require a better approach for protection. For example, web applications, designed to be open and used by anyone from anywhere, are by definition openly accessible.

Protecting a user’s highly-private information calls for strong encryption as well as secure cryptographic keys. Today, cryptographic keys are kept on servers that can be easily breached, and once breached, the keys can be stolen and the user’s secrets exposed. By overlooking the utmost protection of users’ privacy, including protecting the keys that encrypt users’ private information, the service provider runs the risks of putting their users in harm’s way and losing their own businesses. This far-reaching threat has the dubious distinction of giving the kindergarteners and the adulterers a common cause.

This article originally appeared in the November 2015 issue of Security Today.

Featured

  • ASIS International and SIA Release “Complexities in the Global Security Market: 2024 Through 2026”

    ASIS International and the Security Industry Association (SIA) – the leading security associations for the security industry – have released ”Complexities in the Global Security Market: 2024 Through 2026”, a new research report that provides insights into the equipment, technologies, and employment of the global security industry, including regional market breakouts. SIA and ASIS partnered with global analytics and advisory firm Omdia to complete the research. Read Now

  • President Biden Issues Executive Order to Bolster U.S Port Cybersecurity

    On Wednesday, President Biden issued an Executive Order to bolster the security of the nation’s ports, alongside a series of additional actions that will strengthen maritime cybersecurity and more Read Now

  • Report: 15 Percent of All Emails Sent in 2023 Were Malicious

    VIPRE Security Group recently released its report titled “Email Security in 2024: An Expert Look at Email-Based Threats”. The 2024 predictions for email security in this report are based on an analysis of over 7 billion emails processed by VIPRE worldwide during 2023. This equates to almost one email for everyone on the planet. Of those, roughly 1 billion (or 15%) were malicious. Read Now

  • ASIS Announces ANSI-Approved Cannabis Security Standard

    ASIS International, a leading authority in security standards and guidelines, proudly announces the release of a pioneering American National Standards Institute (ANSI)-approved standard dedicated to cannabis security. This best-in-class standard, meticulously developed by industry experts, sets a new benchmark by providing comprehensive requirements and guidance for the design, implementation, monitoring, evaluation, and maintenance of a cannabis security program. Read Now

Featured Cybersecurity

Whitepapers

New Products

  • AC Nio

    AC Nio

    Aiphone, a leading international manufacturer of intercom, access control, and emergency communication products, has introduced the AC Nio, its access control management software, an important addition to its new line of access control solutions. 3

  • PE80 Series

    PE80 Series by SARGENT / ED4000/PED5000 Series by Corbin Russwin

    ASSA ABLOY, a global leader in access solutions, has announced the launch of two next generation exit devices from long-standing leaders in the premium exit device market: the PE80 Series by SARGENT and the PED4000/PED5000 Series by Corbin Russwin. These new exit devices boast industry-first features that are specifically designed to provide enhanced safety, security and convenience, setting new standards for exit solutions. The SARGENT PE80 and Corbin Russwin PED4000/PED5000 Series exit devices are engineered to meet the ever-evolving needs of modern buildings. Featuring the high strength, security and durability that ASSA ABLOY is known for, the new exit devices deliver several innovative, industry-first features in addition to elegant design finishes for every opening. 3

  • EasyGate SPT and SPD

    EasyGate SPT SPD

    Security solutions do not have to be ordinary, let alone unattractive. Having renewed their best-selling speed gates, Cominfo has once again demonstrated their Art of Security philosophy in practice — and confirmed their position as an industry-leading manufacturers of premium speed gates and turnstiles. 3