Beware: a new scam using key elements of phishing and shame hacking

Posted on by Shawn E. Tuma

Cybercriminals are using yet another new twist on the old email phishing attack: they email people claiming to have infected porn sites with malware that allowed them to take over the recipient’s webcam and record them sitting at their computer watching porn and if they don’t pay up, the video is going public. I discuss this new method of attack in the video above.

For people who know they have never watched porn on their computers, this probably isn’t too effective. For everyone else, this threat of public shaming can be a powerful motivation to comply with the extortion demand.

This is another example of what I have often described as shame hacking, the use, or threatened use, of purportedly hacked data for embarrassing or extorting people by threatening to expose such compromising data if they do not comply with the demands made of them.

Shame hacking is one more way that cyber criminals have learned to monetize the fruits of their criminal actions and represents an increasing trend for how hacked information can and will be used for many ways. I have blogged about other cases where hackers have relied on shame hacking for profit.

Dallas / Fort Worth CBS News station in Dallas / Fort Worth did a story about this latest attack and invited Shawn Tuma on to explain more about it. See story here

Why do you need a cyber attorney? Shawn Tuma explains in Ethical Boardroom

Posted on by Shawn E. Tuma

spring2018In my latest article in Ethical Boardroom article, I explain some of the not-so-obvious reasons why you need an experienced cyber attorney on your team: Why you need a cyber attorney (Spring 2018)

Here are other Ethical Boardroom (@EthicalBoard) articles that I have written or contributed to that are also available for free:

______________________

Shawn Tuma (@shawnetuma) is a business lawyer with an internationally recognized reputation in cybersecurity, computer fraud, and data privacy law. He is a Cybersecurity & Data Privacy Partner at Scheef & Stone, LLP, a full-service commercial law firm in Texas that represents businesses of all sizes throughout the United States and, through its Mackrell International network, around the world.

GDPR, snooping tech, and data privacy — what does this all mean? Shawn Tuma explains

Posted on by Shawn E. Tuma

The EU’s GDPR, devices and services snooping on our privacy, and data privacy law – what does this all mean?

Shawn Tuma explains to CW33’s Morning Dose why the EU’s General Data Protection Regulation (GDPR) can be a positive step in the long run for simplifying data security and data privacy when compared to the multitude of different federal, state, and local laws in the United States.

Shawn Tuma discusses on The Michelle Mendoza Show on Seattle’s 820 AM, The Word

 

The EU’s GDPR, attorney Shawn Tuma discusses on the Steve Gruber Show

 

See also: INTEGRATING AMAZON’S “REKOGNITION” TOOL WITH POLICE BODY CAMERAS — SHAWN TUMA DISCUSSES ON CW33 MORNING DOSE

______________________

Shawn Tuma (@shawnetuma) is an attorney with an internationally recognized reputation in cybersecurity, computer fraud, and data privacy law. He is a Cybersecurity & Data Privacy Attorney at Scheef & Stone, LLP, a full-service commercial law firm in Texas that represents businesses of all sizes throughout the United States and, through its Mackrell International network, around the world.

Integrating Amazon’s “Rekognition” Tool with Police Body Cameras — Shawn Tuma Discusses on CW33 Morning Dose

Posted on by Shawn E. Tuma

There has been an outcry over law enforcement using Amazon’s “Rekognition” facial recognition tool and integrating it with their body cameras for nearly real-time identification capabilities. CW33’s Morning Dose had cybersecurity and data privacy attorney Shawn Tuma on as a guest to discuss this issue, as seen on this video:

 

Here is another story with additional commentary by Tuma (2:01 mark):

 

See also:  The EU’s GDPR, devices and services snooping on our privacy, and data privacy law – what does this all mean? Shawn Tuma discusses on The Michelle Mendoza Show on Seattle’s 820 AM, The Word

 

______________________

Shawn Tuma (@shawnetuma) is an attorney with an internationally recognized reputation in cybersecurity, computer fraud, and data privacy law. He is a Cybersecurity & Data Privacy Attorney at Scheef & Stone, LLP, a full-service commercial law firm in Texas that represents businesses of all sizes throughout the United States and, through its Mackrell International network, around the world.

Facebook Suspends 200 Apps for Data Privacy Concerns — What Does This Really Mean?

Posted on by Shawn E. Tuma

Facebook suspended 200 apps due to data privacy concerns, which it revealed earlier this week. Shawn Tuma explains some of the key points about this in the following television and radio interviews:

CW33 Morning Dose talks to cybersecurity lawyer, Shawn Tuma, about Facebook suspending 200 apps

Facebook suspends 200 apps following Cambridge Analytica revelations, what does this mean? Shawn Tuma discusses on 710 KURV in McAllen, Texas

See also: Cell phone carriers are sharing your real-time location with private companies, what does this mean? Shawn Tuma discusses on The Steve Gruber Show

 

What does it mean to “hack back” and is it a good idea?

Posted on by Shawn E. Tuma

There is more and more talk about companies hacking back against those who attack them in cyber space and whether allowing them to take such measures is a good idea. Right now, hacking back, or active defense, as it is often called, is illegal under the federal unauthorized access law, the Computer Fraud and Abuse Act. There are current federal efforts to change this, along with some woefully misguided rumblings by some state legislators (who do not seem to understand that the CFAA supersedes anything they pass to the contrary).

So, the question is whether hacking back a good idea or will it cause more harm than good? Shawn Tuma was a guest on the KLIF morning show to discuss this issue. Go here to listen to what he had to say about it.

What are your thoughts?

Regulator says May 25 is not doomsday #GDPR

Posted on by Shawn E. Tuma

The approach to data protection, and the enforcement of it, should and will be the same 36 days from now as it ever was: Following the rules is the way to go. But if you fail there, yeah, there are going to be some problems.

“The aim of our office is to prevent harm, and we place support and compliance at the heart of our regulatory action,” Denham said. “Voluntary compliance is still the preferred route, but we will back that up with tough action where it’s necessary. Hefty fines can and will be levied on those organizations that persistently, deliberately, negligently flout the law. Report to us, engage with us, show us your effective accountability measures, and if you do, that’s going to be a really important factor when we consider any regulatory action.”

— Read on iapp.org/news/a/icos-denham-may-25-is-not-doomsday/

Cyber Risk Management and Attorney-Client Privilege in Cybersecurity Discussed on Business Security Weekly

Posted on by Shawn E. Tuma

Business Security Weekly, Episode 81, featured Michael Santarcangelo (@catalyst) inviting Shawn Tuma to join as co-host and guest to discuss two topics that should be near and dear to everyone’s hearts:

  1. The legal case for why companies need cyber risk management programs and what experienced cybersecurity attorneys’ roles are in such programs; and
  2. The frequently cited but often misunderstood role of attorney-client privilege in cybersecurity.

Here are the show notes and here is the video:

______________________

Shawn Tuma (@shawnetuma) is an attorney with an internationally recognized reputation in cybersecurity, computer fraud, and data privacy law. He is a Cybersecurity & Data Privacy Attorney at Scheef & Stone, LLP, a full-service commercial law firm in Texas that represents businesses of all sizes throughout the United States and, through its Mackrell International network, around the world.

Data is the hot potato!

Posted on by Shawn E. Tuma

During a presentation yesterday, I was trying to make a point about the liability that comes with data and, therefore, the need for us to never forget that in cybersecurity our ultimate goal is protecting systems and data. I used the little line at the end of this quote:

Data equals risk. It is toxic because of the potential liability that goes with it. Data is the hot potato.

Despite how corny it sounds, I had several people approach me later to tell me how much “data is the hot potato” stuck with them (and, it could be because I had them join me in chanting it!). So, why not share it with you? Now join me in chanting,

Data is the hot potato!

Data is the hot potato!

Data is the hot potato!

Data is the hot potato!

Data is the hot potato!

______________________

Shawn Tuma (@shawnetuma) is an attorney with an internationally recognized reputation in cybersecurity, computer fraud, and data privacy law. He is a Cybersecurity & Data Privacy Attorney at Scheef & Stone, LLP, a full-service commercial law firm in Texas that represents businesses of all sizes throughout the United States and, through its Mackrell International network, around the world.

Can your company do business without its computer system? Let’s ask Atlanta!

Posted on by Shawn E. Tuma

Atlanta RansomwareIn the world of cybersecurity and data protection, we tend to think about most cyber incidents as being “data breaches” because that’s the term de jour that occupies news headlines. Because of this, far too many companies think that if they do not have valuable data that hackers would want to “breach,” so to speak, they do not need to be concerned about cybersecurity. While this is wrong on one level because all data has value to hackers, it is even more wrong on a much greater level.

There is a lot more to cybersecurity and data protection than just breaches of the confidentiality of data (i.e., “data breaches“). Hackers have shown a strong trend over the last couple of years of attacking the computer system itself and, as some call it, “bricking” company’s computers and/or data and demanding an extortion payment in exchange for their promise to honor their word and undo the damage (if they even can). This is the process underlying what is often called ransomware.

Do you see where I’m going with this? If not, let me see if I can simplify this process for you a bit with the question below: (1) If you still think your company does not have data that is valuable to hackers, and (2) You still think that means that your company does not need to focus on cybersecurity,

Can your company continue to do business if it is not able to use its computer system?

If you’ve seen the news today you see that the City of Atlanta has had many of its computer systems bricked by ransomware and those business operations that require the use of those systems are now shut down.

Now, let me ask you, “how many days can your company go without doing whatever it is that it does before it really begins to hurt?”

Still need more convincing? Ok, I addressed this issue in more detail in Chapter 5 of The #CyberAvengers Playbook (free to download) — go give it a read.

______________________

Shawn Tuma (@shawnetuma) is an attorney with an internationally recognized reputation in cybersecurity, computer fraud, and data privacy law. He is a Cybersecurity & Data Privacy Attorney at Scheef & Stone, LLP, a full-service commercial law firm in Texas that represents businesses of all sizes throughout the United States and, through its Mackrell International network, around the world.