Let me ask you a question: Do you remember where you were on 5
October 2021? That was the day when all Facebook services went down. Suddenly,
we couldn't receive Whatsapp messages, we couldn't upload that photo to Instagram...
and in some areas of the world, the internet didn't work at all.
So you may remember that Monday when you made more phone calls than on New Year's
Eve. For many that was Black Monday and I’m not talking about the one in 1987.
The fact is that the crash was attributed
to human error. From then on there was a chain of errors and of course, a quick fix.
It's like when you drop a roll of toilet paper and you try to fix it by rerolling it.
It never turns out the same. Well, it took up to six hours of hard work in Palo Alto
to get everything working again. Then finally 2.7 billion people breathed a sigh of relief
and got back to their lives as normal. But here on VisualPolitik we got to thinking about this:
(Cyberattacks surge in the first half of 2021,
ransomware attacks dominate, report finds. The Hindu)
We'll talk about this in more detail later, but the question is out there: What would happen if
one day a cyber-attack occurred that left us without the internet? Imagine 24 hours without
connection. I'm sure many of you already do all your transactions with a banking app.
And a lot of online shopping. The internet is essential for many jobs: emails,
servers... imagine if all that collapsed for days. Are you scared already? Well, you should be.
However, it seems that no politicians seem concerned. Think about it this way: if you
look at any election manifesto, you will see that politicians promise investments in citizen safety,
road safety, infrastructure but... Who bothers to talk about this other
infrastructure? The internet today is as important as any motorway.
So the question is: How many cyberattacks are there these days,
and are we really prepared to deal with them? And more importantly,
are our politicians addressing the issue of cybersecurity with the seriousness it deserves?
Today we are going to answer these questions. But first, let's look at a bit of history.
(LETTER OF MARQUE)
Today we are going to travel back in time a few centuries.
By the year 1600, the Caribbean was far from being an idyllic place to spend a nice holiday.
And not because its paradisiacal beaches were not as wonderful as they are today.
But mostly because of the small fact that by then, its waters were infested with all
kinds of pirates, buccaneers and filibusters that sailed the seas in search of victims to plunder.
These days there are very amusing movies about these pilfering friends. But the
sixteenth century VisualPolitik would tell you how pirates were a real problem for navigation,
the transport of goods and, ultimately, trade. In addition there is another small detail that is
often swept under the carpet: that is that many of these pirates were in the pay of some governments.
A privateer's patent was a license to steal and pillage that was explicitly
granted to a pirate by the king or another ruler.
England's Henry VIII was the first monarch to issue privateer's patents.
But his daughter Elizabeth I turned it into a business by granting the patents
in exchange for a share of the booty for the British Crown. Sir Francis Drake was the most
famous privateer of all. But the French and the Dutch were not far behind either.
It was a textbook case of win-win. Not only did you get these criminals off your shores,
but you also launched them directly at your enemies. The idea was clear:
the State took advantage of the abilities of certain people to live outside the law.
An approach that has survived to the present day. The 20th
century is considered the Golden Age of espionage.
Of course there's James Bond. But then there are the real spies of the Cold War. Incredible
stories like those of the Cambridge Five. Or the infiltrators who led a double life
in the West and drip-fed information to the KGB. They went decades to supply
thousands of pages of classified material. Today things have changed quite a bit.
The ability to steal secrets has multiplied exponentially. Chinese
hackers who broke into the US Office of Personnel
Management in 2014 gained access to the records of 21.5 million people in a single stroke.
A single attack was enough to obtain an amount of information that,
if printed, would fill an entire fleet of trucks.
More recently there was the attack on SolarWinds, a software manufacturer. Last year the United
States discovered a hacking campaign of gargantuan proportions. A campaign that had been able to
penetrate a few government agencies such as the Department of Justice and the Treasury for months.
And it didn't stop there: there was talk of spying on NATO, the European Parliament
and even AstraZeneca. Yes, that’s right, AstraZeneca, one of the pharmaceutical
companies that developed a vaccine against the coronavirus. Well, they've been spied on too.
And many of you will ask, but who on earth was behind the attack on SolarWinds, one of the
biggest hacks in history? Well, the White House has no doubts: the Nobelium group. And who is the
Nobelium group? Well, supposedly, we're talking about a body of hackers in the pay of Russia.
This is how clearly Dick Durbin, one of the most prominent senators of the Democratic Party,
spoke about this issue. But hold on a minute, because
Russia is not the only country paying hackers. On VisualPolitik we have already told you about
North Korean and Chinese hackers. And no, we're not talking about any rumors here. Listen up.
(North Koreans
charged in $1.3bn cyber-hack spree. FT) And I know what many of you are going to say
Oh [host]! Always picking on the same countries. Is the United States really
blameless? Not really. As you can imagine, this is war. And in war, everyone attacks. Check it out.
(A Trickbot Assault Shows US Military Hackers' Growing Reach. Wired)
We are talking about Cyber Command, a Pentagon command that conducts cyber
operations to neutralize new threats. As you can see, there is a war going on in
cyberspace that we are virtually unaware of but in which States are involved.
These are shadowy movements that remind me a lot of the Warlord movie. And many of you
will be thinking, ok [host], tell me more. What have been the major coups of these modern-day
secret agents and criminal gangs? What tools do they use? Let’s take a look at that now.
(ALL ABOARD!)
If you want to rob banks, you have to go one by one. If you want to hack online,
you can try to launch thousands of cyberattacks at the same time.
For example, some techniques such as the so-called Jackpotting have served to turn
some people into gold. Jackpotting consists of manipulating ATMs so that they start
spitting out banknotes as if it were the Central Bank of Venezuela. And believe me,
there have been cases. Look at what happened three years ago to Cosmos Bank, a bank in India.
(Cosmos Bank loses $13.5 million
in cyber attack. Reuters) To make this hacking possible,
the hackers organized multiple cash withdrawals with local mafias across 28 countries. We're
talking 15,000 transactions in just two hours. Not bad, huh? Well, that's nothing compared to what is
considered the biggest cyber heist in history: the assault on the central bank of Bangladesh.
In 2016, hackers gained access to the Bangladesh Central Bank's SWIFT instructions. SWIFT is the
system banks use for international transfers. The goal? To make fraudulent transfers worth
$1 billion from an account the Bangladesh central bank held at the Federal Reserve
Bank of New York to various banks in Asia. In the end they stole
$81 million and their trail went cold in the casinos of the Philippines.
It is believed that the North Korean Lazarus group is behind these cyber attacks. And some
will say OK, but this is happening in Bangladesh! Surely in the West there is much tighter security.
Okay, first of all let me remind you that I'm only talking about the major
hits of the last few years. And then let me point out that the cyber threat exists for
all financial institutions. This was made clear by Citigroup CEO Jane Fraser when she
was asked about cyberattacks in an online appearance before the US Senate in May.
But wait a minute! Because it's not just banks that are being targeted by cybercriminals.
Other companies and public institutions are also being targeted by ransomware attacks:
that is, data hijacking. We are talking about cyberattacks in which the victim's
files are blocked until a ransom is paid, almost always in cryptocurrencies,
for the hackers to provide the decryption key needed to restore the files. And what can I say:
you have to admit that the pandemic has been a perfect fit for them.
It is estimated that hackers took around $350 million in cryptocurrency payments
in 2020. This is four times more than the previous year. The growth of teleworking
has made ransomware attacks easier, giving criminals many more opportunities to work
their way into corporate networks. In addition, as backups become prevalent,
ransoms are now demanded to prevent hijacked information from becoming public.
But what is the outcome of all these cyber-attacks? Well, on the one hand,
we are talking about significant economic damage. The Danish shipping company, Maersk,
estimated the losses suffered after a cyberattack in 2017 at $300 million dollars.
But there is more. For example, hackers made industrial secrets of a Taiwanese
manufacturer that works for Apple public on the internet. Apple refused to pay
a $50 million ransom, so the hackers kept the diagrams of the Macbook Pro.
In the case of the cyber-attack on Irish hospitals, it was a complete disaster.
All appointments were frozen, doctors had no access to patients' medical records,
threats were made to disclose the stolen confidential data if $20 million was not
paid... a chaos that forced the Irish healthcare system to go back to pen and paper for a while.
It took several weeks to recover. But wait a minute, because the cyber-attack on the
local police in Washington was even worse. (Ransomware Hackers Claim To Leak 250GB Of
Washington, D.C., Police Data After Cops Don't Pay $4 Million Ransom. Forbes)
Imagine everything that would come to light: personal data of agents, identities of informants,
data of police informants... In short, ransomware is proving to be one of the
main threats of digitization. It even threatens vital infrastructures for the energy sector.
For example, in May 2021, hackers paralyzed the Colonial pipeline: the most important pipeline
for the East Coast of the United States. They got a ransom of over $4 million. And many of you are
thinking. Okay [host], this is how they attack us. So, how are we defending ourselves? Watch this.
(A FEW GOOD WHITE HATS AND A FISTFUL OF DOLLARS)
Cyber risk has tripled since 2013, expanding the activities and industries that have become
vulnerable. And we need to think long and hard about this. Fundamentally because
if one thing has been proven, it's that nothing is beyond the reach of hackers.
Recently it was an oil pipeline, but who knows what could be next? Control over
air traffic? The reactor of a nuclear power plant?
Any incident of any severity could paralyse much of the economic activity. But wait a minute,
because this could get worse in the near future. More and more devices are becoming connected:
household appliances, homes, cars.... It is the so-called Internet of Things.
This is what 5G has been developed for. And of course, the question is,
what will happen if a hacker takes control of our car or our house? Beware of that.
Fortunately, as you can see, for the moment hackers prefer
to dedicate themselves to extorting banks and multinationals. And one of
the most commonly used formulas to protect themselves is the one offered by white hats.
This is how ethical hackers are known in the hacking world, and they are dedicated
to testing the defenses of their own systems. In addition, companies are taking these threats
more and more seriously. That's why they are investing more and more money in cybersecurity.
Even so, the results are not entirely satisfactory:
(Billions Spent on U.S. Defenses Failed to Detect Giant Russian Hack. New York Times)
The truth is that something is not working. Microsoft estimates that annual spending on
antivirus software, firewalls and the like was around $124 billion in 2020. That's 64%
more than five years ago. And yet attacks are multiplying year on year.
So what can we do then? Well, ever since they crippled the Colonial pipeline,
the US is taking cyber attacks as a national security threat.
In his last meeting with Putin, US President Biden listed 16 types of
infrastructure that he didn't want to see more cyber attacks against.
And then Cyber Command is going on the attack. Remember REvil? That's the group
of Russian hackers who were demanding 50 million euros from Apple and were
doing a lot of data hijacking... well they've been taken care of.
(US, allied nations force REvil ransomware group offline: report. The Hill)
There are different approaches outside the United States.
France is another of the countries hardest hit by ransomware attacks.
And there they are putting the role of insurers at the center of the debate.
Many companies are looking to cover their backs and are taking
out insurance. According to Germany's Munich Re,
the global cyber insurance market is worth $7 billion and could reach $20 billion by 2025.
This is precisely the problem. It is easier for insurers to pay a ransom than to cover losses due
to data hijacking. In France, therefore, they see a "pull effect" that they want to nip in the bud.
In an appearance before the French Senate, Johanna Brousse,
the public prosecutor responsible for the fight against cybercrime,
called on companies and insurers to change their approach to ransom payments.
This discourse has already garnered positive responses. AXA, France's leading insurance company
and one of the world's largest, has stopped issuing cyber insurance policies for the French
market that reimburse customers for ransomware ransom payments. It is still too early to say
whether this decision will produce results. But it has always been said that you don't negotiate with
terrorists, that you don't accept blackmail, so why should cyberattacks be treated differently?
And now the question is over to you: Do you think this stance of not paying ransom that the French
authorities are promoting is the correct one, or do you think that the work of elite units like
the Cyber Command will yield more results? You can leave your answer in the comments.
And of course, don't forget that we have new videos every week. So subscribe to
the channel so you don't miss any of our updates. If you liked this video,
LIKE it and we'll see you in the next one, see you soon!