Wednesday, July 6, 2016

Moving Low and Slow In The Security Theatre.

As most of my regular readers know, I spent a bit of time over recent years fussing over my banks and Canada's financial institutions in general.  

For those that don't know what's going on, a quick recap...

Things started off with me gradually losing faith in my primary bank's ability to maintain a secure banking experience because of a series of events spanning a few years that highlighted to me that something was awfully awry, and things degraded slowly into more problems that were also spotted in my secondary bank.  Later, I found similar failures across many banks in Canada and eventually found the government at risk, too.  This culminated in the Spring of 2016, when I coordinated with one bank on the issue, and then successfully raised the alarm that basically most of the entire country of Canada was at risk and the RCMP leapt into action.   

Whilst all this was going on, I had to make sure to never do anything that amounted to, or could be construed as hacking.  This is actually very easy - and here's how it happened.

This is a Bentley convertible.  

(Click for bigger image)

I've never been in this particular car shown in the picture.  I can probably guess accurately that neither have you.  However, both you and I can probably agree that the roof is down on this car, and that if (hypothetically) we were in this car with this roof position and it started raining, we'd get wet.  The reason we know this without ever entering the car is simply because we understand what we're looking at.

Same applies to the banks and the Canadian government.  I can look at CIBC or ScotiaBank and without even logging into them, plainly see how they can be compromised because I understand what I'm looking at.  Same thing at the Canadian Government...

Often hackers are caught because having breached a system, they bang about inside, tripping monitors as they scan ports, probe and push systems trying to fumble about looking for the proverbial pot of gold.  

We see banks respond on social media about this type of threat, such as shown here:

The problem with this, as you can guess, is these measures only apply to hackers that break into a bank.  In my case, there was no hacking into any banks, no entry to any bank systems, and yet everyone at the law enforcement level is onboard with me because they understand what they're looking at.

Understanding technology like this is a variant of the "Low and Slow" method of hacking.  I say "variant" because whilst it shares all the traits of the "Low and Slow" method of hacking, there is no "hacking" here.

Additionally, it has to be pointed out that operating outside of a bank or government in this manner shows up something else; It's not security. It's "theatre". If you watch the show long enough, you start to see the props and the set moving about.  That needs to change.

I'll leave you with one last thought:  I'm just one guy who only wants his bank to not put him at risk, and with limited time on my hands, I figured out something that affects the entire country.  There are likely cadres of criminals out there figuring this out on a daily basis and, logically, they must go undetected as the banks cannot see them.