Latest / DEEP INSIGHT / There's a data breach at Canadian schools. What do we know_

Transcript

There's a data breach at Canadian schools. What do we know_ · DEEP INSIGHT

• 0:00
  Speaker 1: Multiple Canadian universities are dealing with a data breach. Hackers
• 0:04
  Speaker 1: targeted the Canvas program. It's used to manage grades and
• 0:08
  Speaker 1: assignments for thousands of schools in North America. Now Post
• 0:12
  Speaker 1: earlier this month indicated that some identifying information of Canvas users,
• 0:16
  Speaker 1: such as names, email addresses, student ideas and messages, may
• 0:19
  Speaker 1: have been impacted. The hackers are threatening to leak the
• 0:23
  Speaker 1: data unless the schools pay a ransom. So how significant
• 0:28
  Speaker 1: is this and what needs to be done to prevent
• 0:30
  Speaker 1: these attacks from happening in the future. For more on that,
• 0:33
  Speaker 1: we've now reached Luke Connolly in Ottawa. He is a
• 0:36
  Speaker 1: threat intelligence analyst at mcsoft to cybersecurity Company. Thanks so
• 0:40
  Speaker 1: much for making time for us today.
• 0:43
  Speaker 2: My pleasure.
• 0:44
  Speaker 1: When we talk about the types of information that could
• 0:46
  Speaker 1: be impacted here, names, emails, student numbers, messages. How concerning
• 0:51
  Speaker 1: is that?
• 0:54
  Speaker 2: Well, very concerning, because the information can be used by
• 0:58
  Speaker 2: criminals to extort individuals. They can take the information and
• 1:01
  Speaker 2: make it available on the web for other criminals to
• 1:05
  Speaker 2: take advantage of, and it can be used for, for example,
• 1:09
  Speaker 2: fraudulent creation of credit accounts of individuals. So there's all
• 1:12
  Speaker 2: sorts of ways that the information can be put to
• 1:15
  Speaker 2: bad use.
• 1:17
  Speaker 1: When we talk about the security systems that are in
• 1:19
  Speaker 1: place at multiple schools that we're talking about here, including
• 1:23
  Speaker 1: some in Canada, I mean, where's the weak link here?
• 1:27
  Speaker 1: Was the security simply not tight enough?
• 1:31
  Speaker 2: Yeah? In this case, it appears that there is a
• 1:33
  Speaker 2: weakness with the software which is being used by multiple schools.
• 1:38
  Speaker 2: So the software is Canvas, It's from a company called Instructure,
• 1:42
  Speaker 2: and it's used by thousands of schools globally, and there
• 1:46
  Speaker 2: appears to have been a weakness in that software as
• 1:51
  Speaker 2: a service offering and the thread actors, the criminals, were
• 1:54
  Speaker 2: able to gain access to the software provider and in
• 1:58
  Speaker 2: doing so, gained access to all of their school customers,
• 2:01
  Speaker 2: including schools across Canada and the US and worldwide, as
• 2:05
  Speaker 2: well as universities.
• 2:07
  Speaker 1: What do we know so far about who's behind this attack?
• 2:11
  Speaker 2: So a claim was made by a group called Shiny Hunters.
• 2:16
  Speaker 2: They're generally acknowledged to be a group of teenagers and
• 2:19
  Speaker 2: young adults based in the United Kingdom and the United States,
• 2:23
  Speaker 2: and they have a site on the Dark Web where
• 2:26
  Speaker 2: they post which victims they claim to have breached in
• 2:32
  Speaker 2: order to try to pressure the victims to pay a
• 2:35
  Speaker 2: ransom to promise not to release the data which was stolen.
• 2:39
  Speaker 2: So Shiny Hunters, on their dark website as recently as
• 2:43
  Speaker 2: yesterday had two statements regarding the Canva breach and they
• 2:48
  Speaker 2: were threatening to release the data originally on May the seventh,
• 2:54
  Speaker 2: and they revised that to May the twelfth, and that
• 2:57
  Speaker 2: those revisions took place yesterday, and as of this morning,
• 3:01
  Speaker 2: the post is no longer on their dark website, so
• 3:04
  Speaker 2: they've removed it.
• 3:06
  Speaker 1: When we talk about these ransoms, of course, their demands
• 3:09
  Speaker 1: to pay in order to not have that sensitive information
• 3:12
  Speaker 1: leaked out, I mean, how frequently are ransoms paid in
• 3:16
  Speaker 1: order to keep the information private? Just how lucrative is
• 3:20
  Speaker 1: this sort of a crime for the people who might
• 3:21
  Speaker 1: be behind it.
• 3:24
  Speaker 2: Well, I think I hope that they're being paid. The
• 3:27
  Speaker 2: ransoms are being paid increasingly infrequently, the reason being, and
• 3:33
  Speaker 2: the demands can be anywhere from tens of thousands of
• 3:35
  Speaker 2: dollars to millions of dollars, depending on the organization and
• 3:39
  Speaker 2: the size of the organization. The reason that I say
• 3:42
  Speaker 2: I hope that they're not paid is that number one,
• 3:45
  Speaker 2: it encourages the criminals to continue to look for new victims,
• 3:49
  Speaker 2: and number two, the payments actually fund their development of
• 3:53
  Speaker 2: new techniques which are used to exploit new victims. So
• 3:57
  Speaker 2: it's a sort of a a cascading set of events
• 4:02
  Speaker 2: that increasingly puts new individuals and companies at risk.
• 4:08
  Speaker 1: When we talk about just how sophisticated these criminals are,
• 4:11
  Speaker 1: I mean, how challenging is that then for law enforcement
• 4:14
  Speaker 1: to stay on top of this for there to actually
• 4:17
  Speaker 1: be arrests or charges or prosecution when we're talking about
• 4:20
  Speaker 1: this sort of thing.
• 4:22
  Speaker 2: So there's two different aspects there. The sophistication is one question,
• 4:27
  Speaker 2: and the sophistication of their attack is often this group
• 4:32
  Speaker 2: in particular, their attacks are based on largely social engineering.
• 4:37
  Speaker 2: So what that means is they pretend that they's someone
• 4:41
  Speaker 2: they're not. They'll call up a company or the help
• 4:44
  Speaker 2: desk of a company, and they will try to convince
• 4:47
  Speaker 2: the person on the other end of the phone that
• 4:49
  Speaker 2: they're an employee who's lost access to their account, and
• 4:52
  Speaker 2: thereby they'll try to convince the help center, the call
• 4:56
  Speaker 2: center to grant them access, and then once they're inside,
• 4:59
  Speaker 2: they'll start to do their undertake their criminal activity and
• 5:02
  Speaker 2: steal data. The other aspect to the sophistication is how
• 5:06
  Speaker 2: do they stop law enforcement from identifying them? And that's
• 5:09
  Speaker 2: really a question of how effective is their operational security.
• 5:13
  Speaker 2: How do they make sure that they don't leave a
• 5:17
  Speaker 2: very obvious set of breadcrumbs which lead back to them
• 5:22
  Speaker 2: and Shiny Hunters being a loose affiliation of individuals. There
• 5:27
  Speaker 2: have been some individuals have been identified and taken to justice,
• 5:34
  Speaker 2: but they're obviously still more out there and they to
• 5:36
  Speaker 2: this point, they've been fairly effective at maintaining their anonymity.
• 5:40
  Speaker 1: Very Finally, I wanted to ask you, Luke, I mean,
• 5:42
  Speaker 1: what can individuals do to protect themselves from becoming a
• 5:47
  Speaker 1: victim to this sort of a crime.
• 5:50
  Speaker 2: Well, from a social engineering perspective, if you're being asked
• 5:56
  Speaker 2: to provide something some personal information, count information, anything like
• 6:01
  Speaker 2: that over the phone, you have to be really suspicious
• 6:04
  Speaker 2: that whoever you're speaking with is who they say they are.
• 6:08
  Speaker 2: Number one, number two in terms of account protection, there
• 6:14
  Speaker 2: are many, many, many instances of account credentials being stolen
• 6:19
  Speaker 2: and made available on the dark web, and to protect
• 6:22
  Speaker 2: against that, it's really necessary to make sure that all
• 6:26
  Speaker 2: accounts have multi factor authentication as well as a strong password.
• 6:30
  Speaker 2: So multi factor authentication is that technology that requires you
• 6:34
  Speaker 2: when you're trying to sign into an account, whether it's
• 6:38
  Speaker 2: Facebook or Google or Canvas, it requires you to not
• 6:42
  Speaker 2: only enter your user name and password, but also you'll
• 6:46
  Speaker 2: get a notification on your phone or you'll have to
• 6:48
  Speaker 2: use your phone to enter a specific sequence of digits
• 6:53
  Speaker 2: in order to confirm your login. So multi factor authentication
• 6:58
  Speaker 2: is a really key way that you and ensure that
• 7:02
  Speaker 2: unauthorized access is not gained to your account.
• 7:05
  Speaker 1: Some good information there for folks. Thanks so much for
• 7:08
  Speaker 1: this conversation, Luke. We appreciate your time.
• 7:11
  Speaker 2: Thank you very much.
• 7:12
  Speaker 1: Luke Connelly is a threat intelligence analyst for mcsoft. He
• 7:15
  Speaker 1: joined us from Ottawa. Thanks again,