Hackers in the Cloud

Posted by on Aug 6, 2013

Big business and the government have turned to the cloud in droves to take advantage of the technology’s cost savings and convenience. But as the money trails off to the cloud, hackers of all sorts have followed, exploiting weaknesses to make a point or a profit. From phishing attacks to data mining, hackers have found creative ways to get a hold of user identities and sensitive information including financial documents, health records, and personal addresses. However, with a private cloud service that offers both user anonymity and strong data encryption, enterprises and private users alike can still take advantage of the cloud’s convenience and cost savings without worrying about the threat of hacking, data mining, or leaks.

Hackers Could Be Lurking In Your Cloud

Image courtesy of lerablog.org

Recently Dropbox, a popular cloud storage service, suffered a breach by a Chinese cyber-spying team called Comment Crew. Through publicly shared folders, the Comment Crew were able the spread malware to political targets. According to Cyber Squared, “The attackers have simply registered for a free Dropbox account, uploaded the malicious content and then publicly shared it with their targeted users. The attackers could mask themselves behind the trusted Dropbox brand, increasing credibility and the likelihood of victim interaction with the malicious file from either personal or corporate Dropbox users.”

Comment Crew Attacks Around the World

Image courtesy of wired.com

Another way that hackers are utilizing cloud technology for their attacks is through the popular scam known as phishing. A phishing attack is when criminals target user information through fake emails that look legitimate, but are really meant to get users to give up sensitive data that could be used to access various online accounts. According to Lockheed Martin’s chief information security officer, Chandra McMahon, Lockheed’s employees must continually be wary about phishing attacks that purportedly stem from sites that employees visit regularly. McMahon said that common phishing attacks on Lockheed, “are compromised by adversaries because they are the perfect spot to put malware because a lot of the employees from the industry will go there.” Phishing attacks jeopardize company data and open up sensitive channels to security vulnerabilities. And unless an enterprise chooses to exclusively store sensitive data on a private cloud, safeguards from phishing are left in the hands of employees.

Common Phishing Categories

Image courtesy of commontouch.com

When it comes to healthcare providers, proactively guarding against hacking, data mining, and leaks is vital to patient privacy and HIPAA compliance. According to researchers Frank Pasquale and Tara Adams Ragone, “Patients are rightly concerned about critical health data being lost or inappropriately accessed.  On the one hand, cloud service providers may reduce those risks by deploying their unique expertise. On the other hand, the more entities access data, the more chances there are for something to go wrong. Risks along many dimensions—legal, reputational, medical, among others—need to be addressed.” In this case, healthcare providers should be wary of any cloud service that doesn’t provide true privacy and data encryption.

Currently, MIT students Xiangyao Yu, Ling Ren, and Christopher Fletcher, along with scientist Marten van Dijk, are working on a program that could address cloud security concerns in the future. The Ascend program shields cloud data by randomizing cloud connections, so that would-be hackers would have to solve the impossible task of remapping the data. Another way that enterprises can keep data safe in the meantime is to set up proxy servers or gateways to prohibit any connections that aren’t SSL. All uploads should be done over SSL and any sensitive data should be encrypted. And cloud service providers should have absolutely zero knowledge of uploaded data through encryption at the block level and user-hosted encryption keys.

Protect Yourself With the Private Cloud

For many enterprises, finding a truly protected third party cloud service can be a challenge as many “secure” services on the market have security gaps that leave private corporate and consumer data wide open to third party attacks and even governmental spying, in the light of the ongoing NSA PRISM program. One cloud storage and sync service that sets itself apart from the rest of the market is SpiderOak Blue. This service provides enterprises with fully private cloud storage and sync, featuring all of the benefits of the cloud along with 100% data privacy. SpiderOak Blue is available with onsite deployment and private servers or outsourced deployment through a private and secured public cloud server.

SpiderOak protects sensitive enterprise data with 256-bit AES encryption so that files and passwords stay private. Authorized accounts and network devices can store and sync sensitive data with complete privacy, because this cloud service has absolutely “zero-knowledge” of user passwords or data. And all plaintext encryption keys are exclusively stored on approved devices because SpiderOak never hosts any plaintext data. This way, even if programs like NSA’s PRISM continue to stand unchallenged, consumers can rest easy knowing that their data is truly protected and brands can gain diehard customer loyalty by publically securing consumer information. SpiderOak Blue’s cross-platform private cloud services are available for enterprises on Windows, Mac, and Linux platforms, along with Android and iOS mobile devices.

Leave a Reply