Privacy Extortion - This privacy sensitivity occurred innocently in the physical world on a beautiful avenue. But, privacy sensitivity can be even more critical in the virtual world.

Privacy Extortion

A new type of cyber-crime: From kindergarteners to adulterers

A year ago I was walking on a sunny day with my daughter in Frankfurt near the Alte Oper. We saw a group of kindergarten kids walking hand in hand with their teacher. They were lovely. We couldn’t take our eyes off of them, and my daughter couldn’t resist taking their picture. She instinctively raised her smartphone to photograph them, but the teacher immediately waived her hands, and in a firm tone said: “You are not allowed to breach these kids’ privacy. Please do not take any pictures.”

This privacy sensitivity occurred innocently in the physical world on a beautiful avenue. But, privacy sensitivity can be even more critical in the virtual world. The cyber world, in a way, knows more about our inner life, desires, passions, relationships and challenges than we perhaps know ourselves. Revealing this information about an individual can cause enormous damage to his or her professional and personal well-being. As we all have seen, the cyber world, unlike my daughter with the kindergarteners, is also less respectful with an individual’s sensitive information.

Uncovering the Dirt

Millions of Ashley Madison members certainly felt a breach into their private lives recently. I’ll bet they panicked when they found out that the entire Ashley Madison database was stolen, perhaps to be publicly revealed.

Unfortunately, stealing confidential data is not new to us. Bigger services have suffered from data theft before, and while stealing credit card data is harmful, the damage is basically repairable. The potential fallout from the breach to the Ashley Madison online adultery service is quite different. Brought to light, Ashley Madison membership reflects in a profoundly negative fashion on the individual, painting their reputation starkly in black, and risking everything from their family relationships to their social status and even their career.

Because the Ashley Madison site facilitates adultery, the security breach has mostly caused a titillated public to react with a combination of moral judgment and humorous quips. But, this breach is a cyber-security crime that requires us all to take notice. The personal details and other juicy descriptions identified in the Ashley Madison breach create a new kind of cyber security threat: the potential for massive blackmail. According to the attackers themselves, the Ashley Madison hack is targeted at the service provider. It also heralds a new, very dangerous and troubling form of cyber-crime: the disclosure of personal secrets, which comes with all kinds of other risks, such as extortion.

For the hackers, this is an outrageously lucrative business model. Most (probably all) of the Ashley Madison customers would be happy to pay a reasonable price to avoid having their online profile made public. Even if the price were $50 to keep member profiles private, it would turn the hackers into multimillionaires.

Storing Personal Information

Of course, Ashley Madison is not the only site storing sensitive personal information. It doesn’t take long to consider other sites where the registered users wouldn’t want their private lives to be exposed: medical records and social chatting, to start.

All of us are subject to a “dark secret” in our inner life that we wouldn’t want to fall into the hands of bad guys. No longer is this just about big corporations and credit card theft; this is deeply personal with a Pandora’s Box aura as once the information is public, it remains so. This is a wake-up call for service providers to improve the security of their services in the interest of protecting their users’ secrets.

Security strategies have traditionally revolved around protecting the endpoints and the network. However, hackers are increasingly targeting service providers’ databases that reside within the data center. Databases and web applications in the data center are open to new attack methods that require a better approach for protection. For example, web applications, designed to be open and used by anyone from anywhere, are by definition openly accessible.

Protecting a user’s highly-private information calls for strong encryption as well as secure cryptographic keys. Today, cryptographic keys are kept on servers that can be easily breached, and once breached, the keys can be stolen and the user’s secrets exposed. By overlooking the utmost protection of users’ privacy, including protecting the keys that encrypt users’ private information, the service provider runs the risks of putting their users in harm’s way and losing their own businesses. This far-reaching threat has the dubious distinction of giving the kindergarteners and the adulterers a common cause.

This article originally appeared in the November 2015 issue of Security Today.

Featured

  • Meeting Modern Demands

    Door hardware and access control continue to be at the forefront of innovation within the security industry, continuously evolving to meet the dynamic needs of commercial spaces. Read Now

  • Leveraging IoT and Open Platform VMS for a Connected Future

    The evolution of urban environments is being reshaped by the convergence of Internet of Things (IoT) technology and open platform VMS. As cities worldwide grapple with growing populations and increasing operational complexities, these integrated technologies are emerging as powerful tools for creating more livable, efficient, and secure urban spaces. Read Now

  • Securing the Future

    Two security experts sit down with Security Today’s editor in chief Ralph C. Jensen to discuss what they see emerging and changing over the next several years along with how security stakeholders can harness these innovations into opportunities. Read Now

  • Collaboration Made Easy Using a Work Management Platform

    Effective collaboration between security operators, teams and other departments is critical to the smooth functioning of organizations. Yet, as organizations grow in complexity, it becomes more difficult for teams to coordinate with each other. This is compounded by staffing shortages, turnover and ineffective collaboration tools. Read Now

  • Creating a Safer World

    Managing and supporting locks and door hardware within a facility is a big responsibility. A building’s security needs to change over time as occupancy and use demands evolve, which can make it even more challenging. Read Now

New Products

  • Luma x20

    Luma x20

    Snap One has announced its popular Luma x20 family of surveillance products now offers even greater security and privacy for home and business owners across the globe by giving them full control over integrators’ system access to view live and recorded video. According to Snap One Product Manager Derek Webb, the new “customer handoff” feature provides enhanced user control after initial installation, allowing the owners to have total privacy while also making it easy to reinstate integrator access when maintenance or assistance is required. This new feature is now available to all Luma x20 users globally. “The Luma x20 family of surveillance solutions provides excellent image and audio capture, and with the new customer handoff feature, it now offers absolute privacy for camera feeds and recordings,” Webb said. “With notifications and integrator access controlled through the powerful OvrC remote system management platform, it’s easy for integrators to give their clients full control of their footage and then to get temporary access from the client for any troubleshooting needs.”

  • FEP GameChanger

    FEP GameChanger

    Paige Datacom Solutions Introduces Important and Innovative Cabling Products GameChanger Cable, a proven and patented solution that significantly exceeds the reach of traditional category cable will now have a FEP/FEP construction.

  • Unified VMS

    AxxonSoft introduces version 2.0 of the Axxon One VMS. The new release features integrations with various physical security systems, making Axxon One a unified VMS. Other enhancements include new AI video analytics and intelligent search functions, hardened cybersecurity, usability and performance improvements, and expanded cloud capabilities