Malware as a service: what do your eld's tell criminals about you?

Malware as a Service (MaaS) is a relatively new phenomenon in the world of cybercrime.  This type of service is a method where criminals provide software or a platform for other individuals or groups to deploy malware on their behalf, usually for a fee. MaaS allows even those with limited technical knowledge to launch sophisticated cyber attacks.  They even have a term for them.  They're called script kiddies.  A script kiddie is an unskilled individual who uses scripts or programs developed by others for often times malicious purposes. 

One of the most vulnerable areas in terms of MaaS is the electronic logging device (ELD) system. ELDs are used in the transportation industry to track and monitor vehicles' movement, speed, and other important metrics. This system is designed to ensure compliance with regulations and safety standards, but it has also become a target for cybercriminals.

The problem is that ELDs are vulnerable to cyber attacks. Hackers can gain access to the ELD system and manipulate the data recorded by the device. For example, they can change the number of hours the vehicle has been in use, falsify the driver's logs, or even disable the device entirely.  But that's a relatively small concern compared to what they can actually do with access to these devices.

One of the ways that hackers can exploit Electronic Logging Devices (ELDs) is by using the data recorded by the device to track the movements of trucks and steal cargo. ELDs record a wide range of data, including the location of the truck, the speed at which it is traveling, and the amount of time the truck has been on the road. Hackers can use this data to map out the truck's route and identify vulnerable locations where they can steal the cargo.  This is called meta data.  And when you gather enough of it, it can't paint a crystal clear picture of what's going on and what will happen in the future.

Here's how it can happen:

Tracking the Truck: Hackers can use the location data recorded by the ELD to track the truck's movements in real-time. They can use this information to monitor the truck's progress, identify potential rest stops or other vulnerable locations, and plan their attack accordingly.

Identifying the Cargo: Once hackers have identified a vulnerable location, they can use the information recorded by the ELD to identify the type of cargo that the truck is carrying. This information can be valuable, as certain types of cargo are more valuable than others, and require different methods of theft.

Planning the Theft: Armed with this information, hackers can plan their theft carefully. They can identify the best time to strike, the most effective method of theft, and the best route to escape without getting caught.

Stealing the Cargo: With a well-planned strategy, hackers can carry out the theft quickly and efficiently. They can use a variety of methods, such as hijacking the truck, breaking into the trailer, or disabling the security systems on the truck.

Here's how they do it:

Brute Force Attacks: Hackers can use software to generate a large number of possible combinations of login credentials until they find the correct one. This method is called a brute force attack and can be effective if the login credentials are weak or not properly secured.  The way to prevent this is to use passwords that aren't found in the dictionary.  Use multiple symbols, letters, number, uppercase.  And don't change them.  Studies have shown the more times a company requires you to change your password the more likely you are to default to your regularly used passwords.  A proper security measure is to have a password greater than 12 characters made up of a wide variety of symbols.

Phishing Attacks: Hackers can use phishing attacks to trick drivers or other personnel into revealing their login credentials. This method involves sending fraudulent emails or messages that appear to be from a legitimate source, such as the ELD provider or the company's IT department.  Poorly planned fishing attacks are fairly easy to spot.  We've all seen them.  But the more sophisticated ones, not so much.

Server and client certificates can help prevent phishing attacks by providing a means of verifying the authenticity of a website or online service. Phishing attacks often rely on creating fake websites or email addresses that look identical to legitimate ones, in order to trick users into divulging their sensitive information.

Here's how server and client certificates work to prevent phishing attacks:

Server Certificates: Server certificates are used to verify the identity of a website's server. When a user visits a website, their web browser will check the website's server certificate to ensure that it has been issued by a trusted certificate authority (CA). If the certificate is valid, the web browser will establish a secure connection to the website, and the user can be confident that they are communicating with the legitimate website.

Client Certificates: Client certificates are used to verify the identity of a user. When a user logs in to an online service, they may be required to present a client certificate to the server to prove their identity. This helps prevent phishing attacks, as the attacker would need to possess the client certificate in order to successfully impersonate the user.

By using server and client certificates, online services can help prevent phishing attacks by providing a means of verifying the authenticity of both the server and the user. This makes it much more difficult for attackers to impersonate legitimate websites or users and steal sensitive information.  Avoid clicking on links in suspicious emails or messages, and using two-factor authentication when available. By working together, online services and users can help prevent phishing attacks and ensure the safety of their sensitive information.  But beware, even these can be manipulated by man in the middle attacks.

Malware Attacks: Hackers can use malware to infect the ELD system and gain access to sensitive data. Malware can be delivered through email attachments, malicious websites, or other methods. Once the malware is installed, it can give the hacker complete control over the ELD system.  Cryptocurrency is one the technologies where hackers like to deploy malicious code because cryptocurrency is so addictive.  It's like the stock market but instead of trusting long standing corporate entities, we trust some guy in a basement somewhere and call it decentralized.  As if "open source" was somehow synonymous with ethical behavior.  That's not to say the technology behind cryptocurrency, or cryptocurrency itself is inherently bad, it's just new and uncharted territory is a breeding ground for unscrupulous actors.

Social Engineering: Hackers can use social engineering techniques to trick drivers or other personnel into revealing sensitive information. This method involves using psychological manipulation to gain the trust of the victim and persuade them to reveal their login credentials or other sensitive information.  It's often said that they greatest vulnerability in any cyber defense is the person behind the keyboard.  That means you, reader.  And that means me, the writer.

Raleigh Bartlett Insurance is the only insurance agency that I've ever heard of that not only indemnifies losses (if you have cyber liability insurance in this case.) but provides ways to help mitigate these risks.