OVERVIEW
The Internet of Things – A “Security Time Bomb”
With the arrival of the IoT and billions of new Internet-connected machines, appliances, sensors, “things,” robots, and devices, wirelessly trafficking data to and from the Cloud, cyber attacks are on the rise. In fact, according to the The World Economic Forum’s Global Risks Report 2018, cyber security is the third greatest global risk of 2018 topped only by natural disasters and extreme weather events.
ZDNet reports, “The economic costs of a large cyber-attack could be as large as the impact of a major natural disaster.
An Economic Times article titled, All of us are sitting on a ticking time bomb called the internet explains:
“The more connected the world gets, the more vulnerable it becomes.”
Referring to the Global Risk Reports 2018, reporter Tom Ball writes:
“The report warns that the world is on the brink of an exponential increase in attack targets, driven by the growth of the IoT market.
According to the Wall Street Journal, the FBI sent a note to private companies warning,
“The exploitation of the ‘Internet of Things’ (IoT) to conduct small-to-large scale attacks on the private industry will very likely continue.”
Cyber vulnerability cannot be detected until there is an actual attack. First an IoT machine or “thing” is built. Then (potentially) comes a cyber attack. And last, the “patch,” aka, the fix. Due to the ingenuity of hackers, the ever-evolving nature of digital technology, and the fact that many systems cannot be shut down to enable a patch, we will at best be perpetually in a reactive stance – responding as breaches occur. As explained by reporter Danny Palmer in a recent article about IoT security,
Retrofitting updates via the use of patches might work for a PC, a laptop or even a smartphone, but there are huge swathes of devices — and even whole internet-connected industrial or urban facilities — for which being shutdown in order to install an update is impossible.
Beyond the increase in hacking enabled by the IoT, the nature of the attacks has also changed. Before the IoT, attacks involved mostly stolen data, such as personal identifying information, credit cards, and so forth. In an IoT world, attacks become far more impactful and devastating. Bruce Schneier explains,
With the advent of the Internet of Things and cyber-physical systems in general, we’ve given the Internet hands and feet: the ability to directly affect the physical world. What used to be attacks against data and information have become attacks against flesh, steel, and concrete.”
Schneier goes on to say:
Today’s threats include hackers crashing airplanes by hacking into computer networks, and remotely disabling cars, either when they’re turned off and parked or while they’re speeding down the highway. We’re worried about manipulated counts from electronic voting machines, frozen water pipes through hacked thermostats, and remote murder through hacked medical devices. The possibilities are pretty literally endless. The Internet of Things will allow for attacks we can’t even imagine.
One rather innovative form of domestic abuse now becoming more common is the use of IoT “things” as tools to torment.
For more about how cyber physical systems of the IoT will likely cause real world cyber attacks, please see The Internet of Things Will Cause the First Ever Large Scale Internet disaster.
Schneier explains that we will not be able to prevent cyber attacks, so the aim must be to build resilient systems so that little failures don’t “cascade to big failures.”Schneier predicts,
“We’re not gonna make the system safe, but we can stem the catastrophes. We can make them fail securely.”
As things stand now in the IoT-wild west – our 21st century gold rush – no one is ensuring that our software-embedded technologies are secure. Start-up companies lack resources, motivation, or personnel to properly secure software-embedded technologies, and our government is asleep at the wheel.
By far the best way protect yourself from cyber attack is to not buy into the Internet of Things.
For statistics on cyber security attacks in 2019, please see TechJury’s infographic. https://techjury.net/stats-about/cyber-security/
Please also see the following New Yorker article on privacy, cyber security and 5g.
The Terrifying Potential of the 5G Network April 26th, 2019 | Sue Halpern | The New Yorker
The future of wireless technology holds the promise of total connectivity. But it will also be especially susceptible to cyberattacks and surveillance.
“What is existential to democracy is allowing totalitarian regimes—or any government—full knowledge of everything you do at all times, Because the tendency is always going to be to want to regulate how you think, how you act, what you do. The problem is that most people don’t think very hard about what that world would look like.” Robert Spalding as quoted in article.
https://www.newyorker.com/news/annals-of-communications/the-terrifying-potential-of-the-5g-network
OVERVIEW
The Internet of Things – A “Security Time Bomb”
With the arrival of the IoT and billions of new Internet-connected machines, appliances, sensors, “things,” robots, and devices, wirelessly trafficking data to and from the Cloud, cyber attacks are on the rise. In fact, according to the The World Economic Forum’s Global Risks Report 2018, cyber security is the third greatest global risk of 2018 topped only by natural disasters and extreme weather events.
ZDNet reports, “The economic costs of a large cyber-attack could be as large as the impact of a major natural disaster.
An Economic Times article titled, All of us are sitting on a ticking time bomb called the internet explains:
“The more connected the world gets, the more vulnerable it becomes.”
Referring to the Global Risk Reports 2018, reporter Tom Ball writes:
“The report warns that the world is on the brink of an exponential increase in attack targets, driven by the growth of the IoT market.
According to the Wall Street Journal, the FBI sent a note to private companies warning,
“The exploitation of the ‘Internet of Things’ (IoT) to conduct small-to-large scale attacks on the private industry will very likely continue.”
Cyber vulnerability cannot be detected until there is an actual attack. First an IoT machine or “thing” is built. Then (potentially) comes a cyber attack. And last, the “patch,” aka, the fix. Due to the ingenuity of hackers, the ever-evolving nature of digital technology, and the fact that many systems cannot be shut down to enable a patch, we will at best be perpetually in a reactive stance – responding as breaches occur. As explained by reporter Danny Palmer in a recent article about IoT security,
Retrofitting updates via the use of patches might work for a PC, a laptop or even a smartphone, but there are huge swathes of devices — and even whole internet-connected industrial or urban facilities — for which being shutdown in order to install an update is impossible.
Beyond the increase in hacking enabled by the IoT, the nature of the attacks has also changed. Before the IoT, attacks involved mostly stolen data, such as personal identifying information, credit cards, and so forth. In an IoT world, attacks become far more impactful and devastating. Bruce Schneier explains,
With the advent of the Internet of Things and cyber-physical systems in general, we’ve given the Internet hands and feet: the ability to directly affect the physical world. What used to be attacks against data and information have become attacks against flesh, steel, and concrete.”
Schneier goes on to say:
Today’s threats include hackers crashing airplanes by hacking into computer networks, and remotely disabling cars, either when they’re turned off and parked or while they’re speeding down the highway. We’re worried about manipulated counts from electronic voting machines, frozen water pipes through hacked thermostats, and remote murder through hacked medical devices. The possibilities are pretty literally endless. The Internet of Things will allow for attacks we can’t even imagine.
One rather innovative form of domestic abuse now becoming more common is the use of IoT “things” as tools to torment.
For more about how cyber physical systems of the IoT will likely cause real world cyber attacks, please see The Internet of Things Will Cause the First Ever Large Scale Internet disaster.
Schneier explains that we will not be able to prevent cyber attacks, so the aim must be to build resilient systems so that little failures don’t “cascade to big failures.”Schneier predicts,
“We’re not gonna make the system safe, but we can stem the catastrophes. We can make them fail securely.”
As things stand now in the IoT-wild west – our 21st century gold rush – no one is ensuring that our software-embedded technologies are secure. Start-up companies lack resources, motivation, or personnel to properly secure software-embedded technologies, and our government is asleep at the wheel.
By far the best way protect yourself from cyber attack is to not buy into the Internet of Things.
For statistics on cyber security attacks in 2019, please see TechJury’s infographic. https://techjury.net/stats-about/cyber-security/
Please also see the following New Yorker article on privacy, cyber security and 5g.
The Terrifying Potential of the 5G Network April 26th, 2019 | Sue Halpern | The New Yorker
The future of wireless technology holds the promise of total connectivity. But it will also be especially susceptible to cyberattacks and surveillance.
“What is existential to democracy is allowing totalitarian regimes—or any government—full knowledge of everything you do at all times, Because the tendency is always going to be to want to regulate how you think, how you act, what you do. The problem is that most people don’t think very hard about what that world would look like.” Robert Spalding as quoted in article.
https://www.newyorker.com/news/annals-of-communications/the-terrifying-potential-of-the-5g-network
SPEED OF DEPLOYMENT
In the US, government and industry are hell-bent on “leading the world” in 5G and have no intention of letting regulations get in their way. In his June 20, 2016 talk, The Future of Wireless: A Vision for U.S. Leadership in a 5G World, former FCC Chair Tom Wheeler boasted,
“If the Commission approves my proposal next month, the United States will be the first country in the world to open up high-band spectrum for 5G networks and applications. And that’s damn important because it means U.S. companies will be first out of the gate.”
In this same talk, Wheeler rallies the wireless industry to
“Lead the world in spectrum availability, encourage and protect innovation-driving competition, and stay out of the way of technological development. [Emphasis added]”
and assures industry that,
“Turning innovators loose is far preferable to expecting committees and regulators to define the future.”
Wheeler recently changed his tune as can be seen in his Jan. 2019 NY Times Op Ed piece where he decries Trumps’ FCC for neglecting to better regulate 5G and the Internet of Things. Wheeler writes:
Last January, the brightest technical minds in the intelligence community, working with the White House National Security Council (N.S.C.), warned of the 5G cybersecurity threat. When the proposed solutions included security through a federally-owned network backbone, the wireless industry screamed in protest. The chairman of the Trump F.C.C. quickly echoed the industry line that “the market, not government, is best positioned to drive innovation and leadership.” Government ownership may not be practicable, but the concerns in the N.S.C. report have been dismissed too readily.
Whereas other countries, such as New Zealand and India, are now conducting studies to ensure public safety, the US – in its mad rush – has chosen profit over safety. But unfortunately, our security experts cannot keep up with this race to the top. Joshua Corman, Director of the Cyber Statecraft Initiative for the Atlantic Council, and cofounder of I am the Cavalry, writes in Welcome to the Privacy Hell, Also Known as the Internet of Things,
“With IoT manufacturers far outweighing cyber security researchers, how will privacy and safety safeguards keep up?”
For a more in depth discussion please see: “IoT Growing Faster than the Ability to Defend it.”
Another reason for our government’s reticence to secure the IoT is that a difficult-to-hack IoT would also prevent law enforcement and government agencies from accessing data they feel is necessary to “keep our country safe.”
HOW TECHNOLOGIES IMPACT ONE ANOTHER
Even if a company were to build cybersecurity into the software of a particular machine, appliance, “thing,” or application, no one can predict how that particular technology will impact other technologies. What might seem fine in one system, when combined with other systems, can prove devastating. Bruce Schneier offers a few examples:
Already we’ve seen Gmail accounts compromised through vulnerabilities in Samsung smart refrigerators, hospital IT networks compromised through vulnerabilities in medical devices, and Target Corporation hacked through a vulnerability in its HVAC system. Systems are filled with externalities that affect other systems in unforeseen and potentially harmful ways . . . Vulnerabilities on one system cascade into other systems, and the result is vulnerability that no one saw coming and no one bears responsibility for fixing.
Companies are also not motivated to secure their products and prefer to hide vulnerabilities. in a recent Motherboard article, The Internet of Things Will Turn Large-Scale Hacks into Real World Disasters, Schneier states,
“The risks and solutions are too technical for most people and organizations to understand; companies are motivated to hide the insecurity of their own systems from their customers, their users, and the public.”
SO WHO IS OVERSEEING IOT CYBER SECURITY?
Government and industry are hell-bent on “leading the world” in 5G and have no intention of letting regulations get in the way. Former FCC Chair, Tom Wheeler stated, “Turning innovators loose is far preferable to expecting committees and regulators to define the future.”
In How to Keep the Internet of Things From Killing Us All, Schneier tells us,”It always takes government stepping in to say, ‘You must do this; you can’t do that; if you do these things, we’re allowed to sue.’”
Yet this is not so simple when policy makers have little will to step in, and even if they did, would have great difficulty grasping the intricacies involved in securing the IoT. In The Internet of Things Will Cause The first Ever Large Scale Internet Disaster, Schneier tells us that “The risks and solutions are too technical for most people and organizations to understand; companies are motivated to hide the insecurity of their own systems from their customers, their users, and the public.”
Moreover, the Internet of Things is “growing faster than the ability to defend it” according to Larry Greenemeier from Scientific American and other experts. Basically, government oversight and regulation cannot keep pace with the exceedingly fast rate of change in technology.
The bottom line is that neither government nor industry is securing the IoT. Foreseeing as early as 2013 the dangers the IoT would present, Joshua Corman and fellow researchers set out to discover who the IoT “thinkers and planners” were, and what was being done to prevent hacking or catastrophic cyber attacks. But they soon realized there was no one even attempting to protect the public. As Corman put it:
“We got to the adults in the room and realized there were no adults.”
Please note that in the UK, IoT vulnerability is starting to be addressed. The Secure by Design Code has been introduced and is making its way through the legislative process. Smart devices would carry warning labels informing buyers how insecure the device is. The requirements for certification are very rudimentary, but at least the UK is addressing IoT vulnerability. Once again, the best way to avoid a hack is to not buy into the IoT, and use hard-wired connections whenever possible.
PREDICTIONS AND COST OF IOT CYBER SECURITY
Industry and government predict enormous economic growth from 5G and the IoT. But they forget to factor in the costs to try to secure all these IoT things and the mega financial losses in the wake of cyber attacks.
In 2016, we experienced the first large-scale cyber attack enabled by IoT connected devices, Mirai. Twitter, Reddit, Spotify, and Github were among the many websites and services that were taken down. Since then, there has been a parade of large scale cyber attacks. In 2017 alone there was WannaCry, Petya, Wikileaks CIA “Vault 7”, Cloudbleed, Voter records exposed, Macron Campaign Hack, to name a few. What can we expect in 2018? Many experts are predicting major cyber attacks in 2018.
Projections indicate cyber crime is on the rise and expected to cost $6 trillion annually by 2021. Steve Morgan from Cyber Security Ventures states,
“Cyberattacks are the fastest growing crime in the U.S., and they are increasing in size, sophistication and cost.”
With government watching from the sidelines as the world goes digital, the situation remains dire.
In We Need to Save the Internet from the Internet of Things, Bruce Schneier tells us,
“This is a market failure that can’t get fixed on its own.”
Furthermore, even if the US government were to attempt to secure the IoT, this would only affect the Internet in the US. But since the Internet is global, “Attackers can just as easily build a botnet out of IoT devices from Asia as from the United States,” Schneier explains.
Corman sums up the current state of affairs:
If it’s software, it’s hackable — If it’s connected, it’s exposed.
By far, the best way to protect ourselves from cyber attacks is to simply 1) not buy into the IoT, either figuratively or literally; 2) to hardwire devices wherever possible; and 3) to inform policy makers you do not support a tech-infested, Cloud-connected world.
ADDITIONAL RESOURCES ON IOT CYBER SECURITY
- Schneier on Security -- Website and Blog
- Internet of Things: Privacy and Security in a Connected WorldFTC Staff Report | Jan. 2015
- This Teen Hacked 150,000 Printers to Show How the Internet of Things Is ShitCHRISTOPHER MOYER
- Internet of Things security: What happens when every device is smart and you don't even know it?Danny Palmer | Mar. 20th. 2017 | When IoT devices are everywhere, the security headaches just get worse. Danny Palmer
- Researchers Uncover Ongoing Attacks Against IoT DevicesIlia Kolochenko | CEO High-Tech Bridge
- Back to Home Smart Cities? Not until those cyber weaknesses get sortedMay 4th, 2017 | Ellie Burns | Computer Business Review
- This 11 year old stuns experts by turning smart toys into weaponsMay 17th, 2017 | By AFP | The Indian Express
- Can the heart be hacked? Experts find 8,000 security flaws in pacemaker softwareMay 28th, 2017 | RT Question More
- FBI: 8 tips to secure IoT medical devices, wearables from cyberattackersOct. 23rd, 2017 | Jessica Kim Cohen | Health IT and CIO Review
- Why is no one raising a hand to regulate the internet of things?Derek B. Johnson | Mar. 16th, 2018 | FCW
- Targeting power grid is too easy, Energy Department saysMay 14th, 2018 | John Siciliano | Washington Examiner
- Top 5 cybersecurity facts, figures and statistics for 2018Jan. 23, 2018 | Steve Morgan | Cyber Security Business Report
- Cybercrime Damages $6 Trillion By 2021Oct. 16th, 2017 | Steve Morgan | Cyber Security Ventures
- Global Cost of Cybercrime Exceeded $600 Billion in 2017, Report EstimatesFeb. 23rd, 2018 | David Bisson | Security Intelligence
- Cloud computing: Why a major cyber-attack could be as costly as a hurricaneJan. 17th, 2018 | Danny Palmer | ZDNet
- Tweet RSS Feed Share There will be big cyber attacks in 2018, predicts expert
- Russian Hackers Reach U.S. Utility Control Rooms, Homeland Security Officials SayJuly 23rd, 2018 | Rebecca Smith | Wall Street Journal
- Thermostats, locks and lights: digital tools of domestic abuseJune 30th, 2018 | Nellie Bowles | SF Gate
- Internet Hacking Is About to Get Much Worse We can no longer leave online security to the market.Oct. 11th, 2018 | Bruce Schneier | NY Times OpEd
- House passes SMART IoT ActNov. 29th, 2018 | Matt Leonard | FCW
- Prepare Now for Next-Generation Cyber ThreatsApril 2nd, 2019 | Steve Durbin | CFO
- 300+ Terrifying Cybercrime and Cybersecurity Statistics & Trends [2019 EDITION]May 13th, 2019 (Updated) | Andra Zaharia | Comparitech
- On Smart Cities, Smart Energy, And Dumb SecurityDec. 30, 2016
- Your WiFi-connected thermostat can take down the whole Internet. We need new regulations.Washington Post | Bruce Schneider | Nov. 3, 2016 | The government has to get involved in the “Internet of Things."
- We Need to Save the Internet from the Internet of ThingsMotherboard | Written by Bruce Schneier | Oct. 2016
- How a Bunch of Hacked DVR Machines Took Down Twitter and Reddit … and Spotify, and Github, and The New York TimesThe Atlantic | By Robinson Meyer | Oct. 2016
- After cyber attacks, Internet of Things wrestles with making smart devices saferReuters Technology News | By Jeremy Wagstaff and J.R. Wu | Nov. 2016
- Welcome to Privacy Hell, also Known as the Internet of ThingsFast Company | By Lauren Zanolli | March 2015
- Smart refrigerator hack exposes Gmail login credentialsA bonus feature on a smart home product becomes a security liability.
- Medjacking: How Hackers Use Medical Devices To Launch Cyber AttacksMed Device Online | By Jof Enriquez | June 2015
- The Internet of Things Will Turn Large-Scale Hacks into Real World DisastersMotherboard | By Bruce Schneier | July 2016
- I Am The Cavalry Cyber Safety Outreach
- IoT Growing Faster Than the Ability to Defend ItScientific American | By Larry Greememeier | Oct. 2016
- Cyberattacks on Utah's secure government networks up dramaticallyDesert News Utah | By Shara Park | Feb. 2013
- FBI Warns Internet Online Attacks on Private Industry Will ContinueThe Wall Street Journal | By Lee Hawkins | Nov. 2016
- How the Internet of Things will affect security & privacyBusiness Insider |By Andrew Meola | Aug. 2016
- The Internet of Things Will Be the World's Biggest RobotSchneier on Security | Feb. 2016
- Hacking AirplanesSchneier on Security | April 2015
- Hackers Remotely Kill a Jeep on the Highway - With Me In ItWired | By Andy Greenberg | July 2015
- Source Code for IoT Botnet ‘Mirai’ ReleasedKrebs on Security | Oct. 2016
- Hacking Vulnerable Medical Equipment Puts Millions at RiskInformationWeek | By Liviu Arsene | April 2015
- The Value of EncryptionBruce Schneier
- Krebs on SecurityIn-depth security news and investigation | Brian Krebs Blog
- Schneier on Security -- Website and Blog
- Internet of Things: Privacy and Security in a Connected WorldFTC Staff Report | Jan. 2015
- This Teen Hacked 150,000 Printers to Show How the Internet of Things Is ShitCHRISTOPHER MOYER
- Internet of Things security: What happens when every device is smart and you don't even know it?Danny Palmer | Mar. 20th. 2017 | When IoT devices are everywhere, the security headaches just get worse. Danny Palmer
- Researchers Uncover Ongoing Attacks Against IoT DevicesIlia Kolochenko | CEO High-Tech Bridge
- Back to Home Smart Cities? Not until those cyber weaknesses get sortedMay 4th, 2017 | Ellie Burns | Computer Business Review
- This 11 year old stuns experts by turning smart toys into weaponsMay 17th, 2017 | By AFP | The Indian Express
- Can the heart be hacked? Experts find 8,000 security flaws in pacemaker softwareMay 28th, 2017 | RT Question More
- FBI: 8 tips to secure IoT medical devices, wearables from cyberattackersOct. 23rd, 2017 | Jessica Kim Cohen | Health IT and CIO Review
- Why is no one raising a hand to regulate the internet of things?Derek B. Johnson | Mar. 16th, 2018 | FCW
- Targeting power grid is too easy, Energy Department saysMay 14th, 2018 | John Siciliano | Washington Examiner
- Top 5 cybersecurity facts, figures and statistics for 2018Jan. 23, 2018 | Steve Morgan | Cyber Security Business Report
- Cybercrime Damages $6 Trillion By 2021Oct. 16th, 2017 | Steve Morgan | Cyber Security Ventures
- Global Cost of Cybercrime Exceeded $600 Billion in 2017, Report EstimatesFeb. 23rd, 2018 | David Bisson | Security Intelligence
- Cloud computing: Why a major cyber-attack could be as costly as a hurricaneJan. 17th, 2018 | Danny Palmer | ZDNet
- Tweet RSS Feed Share There will be big cyber attacks in 2018, predicts expert
- Russian Hackers Reach U.S. Utility Control Rooms, Homeland Security Officials SayJuly 23rd, 2018 | Rebecca Smith | Wall Street Journal
- Thermostats, locks and lights: digital tools of domestic abuseJune 30th, 2018 | Nellie Bowles | SF Gate
- Internet Hacking Is About to Get Much Worse We can no longer leave online security to the market.Oct. 11th, 2018 | Bruce Schneier | NY Times OpEd
- House passes SMART IoT ActNov. 29th, 2018 | Matt Leonard | FCW
- Prepare Now for Next-Generation Cyber ThreatsApril 2nd, 2019 | Steve Durbin | CFO
- 300+ Terrifying Cybercrime and Cybersecurity Statistics & Trends [2019 EDITION]May 13th, 2019 (Updated) | Andra Zaharia | Comparitech
- On Smart Cities, Smart Energy, And Dumb SecurityDec. 30, 2016
- Your WiFi-connected thermostat can take down the whole Internet. We need new regulations.Washington Post | Bruce Schneider | Nov. 3, 2016 | The government has to get involved in the “Internet of Things."
- We Need to Save the Internet from the Internet of ThingsMotherboard | Written by Bruce Schneier | Oct. 2016
- How a Bunch of Hacked DVR Machines Took Down Twitter and Reddit … and Spotify, and Github, and The New York TimesThe Atlantic | By Robinson Meyer | Oct. 2016
- After cyber attacks, Internet of Things wrestles with making smart devices saferReuters Technology News | By Jeremy Wagstaff and J.R. Wu | Nov. 2016
- Welcome to Privacy Hell, also Known as the Internet of ThingsFast Company | By Lauren Zanolli | March 2015
- Smart refrigerator hack exposes Gmail login credentialsA bonus feature on a smart home product becomes a security liability.
- Medjacking: How Hackers Use Medical Devices To Launch Cyber AttacksMed Device Online | By Jof Enriquez | June 2015
- The Internet of Things Will Turn Large-Scale Hacks into Real World DisastersMotherboard | By Bruce Schneier | July 2016
- I Am The Cavalry Cyber Safety Outreach
- IoT Growing Faster Than the Ability to Defend ItScientific American | By Larry Greememeier | Oct. 2016
- Cyberattacks on Utah's secure government networks up dramaticallyDesert News Utah | By Shara Park | Feb. 2013
- FBI Warns Internet Online Attacks on Private Industry Will ContinueThe Wall Street Journal | By Lee Hawkins | Nov. 2016
- How the Internet of Things will affect security & privacyBusiness Insider |By Andrew Meola | Aug. 2016
- The Internet of Things Will Be the World's Biggest RobotSchneier on Security | Feb. 2016
- Hacking AirplanesSchneier on Security | April 2015
- Hackers Remotely Kill a Jeep on the Highway - With Me In ItWired | By Andy Greenberg | July 2015
- Source Code for IoT Botnet ‘Mirai’ ReleasedKrebs on Security | Oct. 2016
- Hacking Vulnerable Medical Equipment Puts Millions at RiskInformationWeek | By Liviu Arsene | April 2015
- The Value of EncryptionBruce Schneier
- Krebs on SecurityIn-depth security news and investigation | Brian Krebs Blog