Happy Friday folks!
If you are in the United States, then you should know we are on our 23rd day of a government shutdown. While it is considered a “partial” shutdown, there are still plenty of government workers who are not being paid or have been sent home, furloughed.
Last week, TechCrunch posted a concerning story about the shutdown and most importantly, they covered the reporting of NetCraft, a U.K. internet service company, about how numerous US government websites are now inaccessible due to expired security certificates.
This is going to be a quick post to help explain what happened and more importantly, how cyber criminals will use this situation to their advantage.
We aren’t going to dig deep into how security certificates work for websites, but the gist is that every vendor, organization, etc. that uses a website (at least these days), require a security certificate for anyone to access their website with some trust. Today, a few browsers, like Chrome, require these certificates before they even let users access the websites. You can recognize when a website uses a valid security certificate, usually by a green lock on the URL bar.
The certificate confirms that the website you are communicating with is legitimate and its identity is confirmed because of the certificate it uses. In addition to that, these certificates make it possible for users to establish a secure connection with the web server hosting the site, which is incredibly important when sending financial or personal information to these sites.
As mentioned before, many browsers out there won’t even let users visit a website if it doens’t have a valid signature and in this case, we’ve got a lot of users who can’t access government websites because the certificates had expired.
Why did they expire?
So, if a security certificate lasted forever, what would be the assurance that it hasn’t been stolen by a criminal who will then be able to use it on their own malicious websites? Because of this reason, and probably some other ones, certificates do expire and it requires the organization that owns the website to purchase and deploy a new certificate that is up to date. Think of it like yearly fees to renew your car tags.
The reason these certificates were allowed to lapse is because there is nobody renewing them. Apparently, most US organization websites maintain their own certificates. This is why not ALL U.S. gov websites are down, just a few of them (at least right now). With the government partial shutdown, the people in charge of making sure citizens can access their websites by keeping these certificates up to date are unable to do their jobs, which eventually leads to users being unable to access these sites at all.
Okay, so obviously not being able to access some government websites is a pain, but it isn’t anything that your regular person needs to worry about, as long as they aren’t frequent visitors to these gov sites. However, with any opportunity, you can bet that cyber criminals are going to take advantage.
That is why we want to make sure that we share some vital warnings about how this shutdown may help cyber-criminals. Please, share this with everyone you know, at least until the shutdown is over.
Cyber criminals frequently utilize real world events in order to trick users into clicking on a link, downloading or sharing something. You can look back at a couple of instances where events in Syria directly influenced the actions of cyber criminals, be it state sponsored or otherwise. In another case, the Boston bombing from a few years back was used to try and scam people.
Fake YouTube page setup to infect Syrian rebels.
With that being said, you can expect that users who are looking for government websites, especially if they offer some kind of service or require some kind of personal information or login to access, is going to be copied by cyber criminals and likely be presented as an alternative way to access the same website.
Fake Singapore Government Website – From Gov.SG
While most users are likely not going to be affected by this very much, those that rely on social services and likely older folks will be looking for a way to access these sites, for whatever reason. When they go to search for the site, their first link might take them to a dead end, since the security certificate had expired, however the second or third link might work and take the user to a page that looks exactly where they want to go. Classic phishing attack.
What to do about it?
The best thing to do right now is share this information with those close to you so they don’t make a mistake and give away valuable personal info just because the government has issues keeping itself open. Also, be vigilant moving forward, not just for this case but for others, any bit of sensational news needs to be investigated outside of a link telling you to click.
The bad guys know human behavior and they know that people can’t help clicking on things that are either convenient or scandalous and sensational. Prove them wrong.
Stay safe and safe surfing!
The post Government shutdown puts Americans in danger appeared first on Malwarebytes Labs.
Powered by WPeMatico