All posts by Paul Stradling

News

Sustainability : 27 Per Cent Increase In Clean Energy Investment In 2021

BloombergNEF’s reports of a record-breaking 27 per cent year-on-year increase in global investment in clean energy technologies and infrastructure could point to real progress being made towards hitting climate-change goals.

$755bn Increase – Asia Focus

Energy strategic research provider BloombergNEF’s annual investment report, Energy Transition Investment Trends 2022, has highlighted a record-breaking 27 per cent rise in clean energy investment, which equates to an increase of $755bn. BloombergNEF reports that almost half of all investment occurred in Asia.

Most Investment In Clean Power & Electrification

BloombergNEF reports that, together, clean power and electrification (renewables, nuclear, energy storage, electrified transport, and electrified heat) accounted for the majority of the investment ($731 billion), and hydrogen, carbon capture and storage and sustainable materials made up the remaining investment ($24 billion.)

The report showed that renewable energy (wind, solar and other renewables) attracted a record-breaking $366 billion investment in 2021, and electrified transport (electric vehicles and associated infrastructure) was the second-largest sector with $273 billion invested. The electric vehicle sales sector, for example, grew by an incredible 77 per cent in 2021!

Investment Despite Commodities Crunch

As Albert Cheung, Head of Analysis at BloombergNEF, pointed out in the report there was a 27 per cent increase in energy transition investment in 2021, despite a global commodities crunch creating input cots challenges for key clean energy technologies. This could be a sign of a real low-carbon transition by investors, governments, and businesses. Asia is reported to have made the biggest investment in clean energy technologies last year, but it is also very promising to hear that China, often reported as being climate change laggard, made the biggest transition Investment.

Clean Energy, But Not Clean Rivers

Clean energy investment, particularly in Asia, may be at a high but sadly, it seems that same concern for the environment may not have been shown by the UK’s environment agency in recent times. For example, following news last summer that sewerage has been discharged regularly into UK waterways by some water companies leaving almost one-third (32 per cent) of rivers failing to meet tests for good ecological status, recent reports show pressure from the top for a cover-up. Last week, for example, it was reported that Environment Agency Chief executive James Bevan attempted to deal with criticism about failures to protect waterways by sending a memo to staff threatening sanctions or dismissal for anyone making derogatory statements about the organisation inside or outside work. This apparent attempt to cover-up the pollution follows news that, last November, it was reported that staff were told to shut down and stop investigating low level pollution events (level 3 and 4 incidents), thereby axing important core pollution detection work.

What Does This Mean For Your Organisation?

International Energy Agency (IEA) figures show that electricity and heat generation correspond to over 40 per cent of global CO2 emissions from fuel combustion, with 70 per cent of the associated emissions coming from coal plants. This highlights how important it is to make the change to clean energy sources. The record-breaking 27 per cent year-on-year increase in global investment in clean energy technologies and infrastructure in 2021 highlighted in BloombergNEF’s report is, therefore, a very promising sign. It is also promising that China, for example, made biggest transition investment, which some would say it needed to do to start to bring about positive environmental change. With transport also being such a big polluter, its also promising news that electrified transport, which includes spending on electric vehicles and associated infrastructure, was shown to be the second-largest sector with $273 billion invested in 2021.The report makes positive reading but the job now is accelerate the rates and scale of change and investment if the world is serious about hitting its net zero by 2050 target.

News

Tech News : 30% Rise In Crypto-Laundering

A report by blockchain data platform ‘Chainalysis’ has shown a 30 per cent increase in cryptocurrency being used for money laundering in 2021 compared to the previous year.

$8.6 Billion

The 2022 Crypto Crime Report noted how cybercriminals laundered a massive $8.6 billion worth of cryptocurrency in 2021. The figure was arrived at by compiling the amount of cryptocurrency being moved from illicit addresses to addresses hosted by services.

Only A Measure Of Online, Not Offline

If $8.6 billion seems like a very large amount, the report also notes that this doesn’t even take into account the amount from offline crime (e.g., traditional drug trafficking) that is converted into cryptocurrency to be laundered.

Most Money Laundering Doesn’t Involve Cryptocurrency

To put the numbers into perspective, it’s worth noting that between $800 billion and $2 trillion of fiat currency (government-issued currency) is laundered each year, which represents as much as 5 per cent of global GDP. By contrast however, only 0.05 per cent of all cryptocurrency transaction volume was laundered in 2021, meaning that cryptocurrency is by no means the preferred method for money laundering yet.

Blockchain More Transparent Says Chainalysis

Chainalyis, the report’s author, says that the reason why there is a big difference between fiat and cryptocurrency-based money laundering is that the transparency of blockchains means that it’s easier to trace how criminals move cryptocurrency between wallets and services to try and convert it into cash.

Thieves Use DeFi Platforms & Scammers Use Centralised Exchanges

The report highlights how those involved in theft tend to use DeFi Platforms (with DeFi protocols) whereas scammers tend to prefer centralised exchanges for their money laundering. The report says that this is because:

– DeFi /open finance platforms have no middleman (no bank or credit card issuer as an intermediary in financial transactions) and, therefore, offer greater anonymity, which may be why they received 17 per cent of all funds sent from illicit wallets in 2021 (up from 2 per cent!). Chainalysis noted in its report that addresses associated with theft sent just under half of their stolen funds to DeFi platforms (around $750 million worth of cryptocurrency in total).

– Scammers tend to lack technical sophistication and, therefore, prefer to send the majority of their funds to addresses at centralized exchanges.

Looking For Patterns & Using Compliance Checks

The report accepts that because some criminals use cryptocurrency to launder funds from crimes that happen offline, it is not easy to track all money laundering activity. However, looking for patterns that suggest users may be trying to avoid compliance screens, and introducing compliance checks can help uncover more illegal activity.

What Does This Mean For Your Business?

As the report points out, using cryptocurrency to launder money is becoming increasingly popular, but is still nowhere near as big a problem as fiat-based money laundering, perhaps due to the transparency risks of blockchain (with increased checks) and the complexities of using cryptocurrencies not being widely understood. In fact, even most genuine investors and traders don’t fully understand cryptocurrencies. For example, a Cardify report (March 2021) showed that only 16.9 per cent of investors who have bought cryptocurrency don’t fully understand its value and potential, and 33.5 per cent of buyers have either little or zero knowledge about cryptocurrencies.

Nevertheless, criminals using cryptocurrency for money laundering is clearly a growing problem. One important measure that could be taken to help tackle the problem is making sure that those tasked with investigating it have a good understanding and are trained in cryptocurrency and blockchain analysis and/or have expert help. Also, more attention needs to be paid to how DeFi transactions can be analysed, and to enlisting the help of the teams behind DeFi protocols to screen wallets for suspicious activity and patterns e.g., prior transactions with known illicit addresses.

News

Featured Article : Study Shows No-One Is Immune From Phishing

A new report from F-Secure has revealed that the most technically competent staff are just as likely (if not more likely) to fail a phishing test exercise.

Phishing

Phishing attacks typically involve sending emails that appear to come from a legitimate company/organisation (e.g., a bank) in order to gain an individual’s confidence, so that the recipient will follow a link in the email. Clicking on a link in a phishing email, however, means having malicious software loaded onto the recipient’s device that can allow cybercriminals to take control of a computer, log keystrokes, gain access to your personal information and financial data (for theft and identity theft), or simply be directed to a phishing page / payment page where sensitive information and/or money is taken. Compromising one person’s computer and accounts can also provide a way into wider company systems. It should also be noted that phishing links can be inserted into malicious advertisements, and even direct messages on chat apps.

The Study

The results of a recent test by F-Secure, published in the report ‘To Click or Not to Click: What we Learned from Phishing 80,000 People’, highlighted a comparison of how personnel working in IT or Development Operations (DevOps) responded to (test) phishing emails. The results showed that not only do phishing emails mimicking HR announcements or asking for help with invoicing get the most clicks from recipients but, crucially, people working in ‘technical’ roles seem equally susceptible to phishing attempts (or even more so) than the general population.

Why?

Matthew Connor, F-Secure’s Service Delivery Manager explained why people working in ‘technical’ roles seemed equally or more susceptible to phishing attempts than the general population by saying that: “The privileged access that technical personnel have to an organisation’s infrastructure can lead to them being actively targeted by adversaries.”

Clicked Despite Higher Level Of Awareness

One big concern raised by the study is that despite IT personnel being more aware of previous phishing attempts and knowing more about the threat than others (as evidenced by post-study surveys) they still clicked as often (or more often) on the phishing links.

Speed Of Reporting and Ease Of Reporting Crucial For Security

The study also found that both the IT and DevOps groups were no better at reporting phishing attempts than others (coming 3rd and 6th out of 9 departments) and that IT came 15th out of 17 in terms of reporting the phishing emails. Also, the study highlighted how reporting the phishing emails became more common as time went on, and how different processes at different organisations played a key role in the level of reporting e.g., 47 per cent who had a dedicated button to flag suspicious emails used it to instantly report phishing emails during the study compared to much lower levels of reporting where there was no button.

Clearly, rapid reporting of phishing emails could help businesses to tighten security and raise awareness, but the study highlights how important having a simple, fast, easy-to-use reporting process (a button) in place is.

How To Spot Phishing Emails

Many phishing emails have giveaways that you can spot if you know what you’re looking for. Examples of ways in which you can identify a phishing email include:

– Online requests for personal and financial information e.g., from government agencies, are very unlikely to be sent via email from legitimate sources.

– Generic greetings. Scammers are less likely to use your name to personalise the email greeting and title.

– Mistakes in spelling and grammar can be signs of scam emails.

– Checking the email address by hovering your mouse (without clicking!) over the link in the email. This can quickly reveal if the email is genuine.

– Beware of heavy emotional appeals that urge you to act immediately. These are signs of scam emails that hope to bypass your critical-thinking and tap into an emotional response.

What Does This Mean For Your Business?

As the study’s report pointed out, advanced or even average susceptibility to phishing is a concern and, on the surface, IT staff who should have a higher awareness of phishing, click more often than other staff on phishing links is a worry. However, as highlighted by F-Secure, one explanation may be that IT staff with privileged access to systems may be more actively targeted by adversaries. One really valuable insight uncovered by the study is that providing a fast, easy reporting process for phishing emails can provide a way for security personnel and other teams to work together and improve an organisation’s resilience against phishing, which could mean earlier detection in future, thereby really helping strengthen company security going forward. Cyber security training and awareness efforts are also important in keeping all staff up to date with the nature of threats and how to respond to them in a way that protects the organisation and enables vital feedback.

News

Tech News : Google Changes Stance Over Legacy G Suite Account

Google has offered new alternative options to free Legacy G Suite account holders who it had previously said would have to upgrade to a paid subscription by 1 July.

What Is A Legacy G Suite Account?

Google’s free edition of G Suite, known as Workspace, was first made available to businesses, organisations, and schools from 2006 to December 6, 2012, with Google Apps. Users of this free edition of G Suite—also known as the legacy free edition could host Google accounts on custom domains for multiple users. However, this free version gave users a much-reduced set of business features.

Move To Paid Subscription

Recently however, Google informed users, who had been allowed to keep their free accounts for 10 years, that they needed to either upgrade to a paid Google Workspace subscription service to keep their services by July 1, 2022, or export their data using Google’s Takeout tool.

Backtrack – New Option

Last week, however, Google emailed users with details of a new option (also now shown on Google’s Support pages). The main new alternative is that users who don’t want to upgrade to a paid subscription will be offered a better data transfer option “in the coming months.” This new option will enable users to move their non-Google Workspace paid content and most of their data to a no-cost option. The new option won’t include premium features like custom email or multi-account management, and users will be able to evaluate the option prior to July 1, 2022, and prior to account suspension.

Another Lifeline

Google also appears to be offering another lifeline to those who have a G Suite legacy free edition account that’s purely for personal use and who don’t want to upgrade to a Google Workspace subscription. Google has invited these account holders (with ten users or less) to use a feedback form to provide more information. Google says that if they don’t want to upgrade to Google Workspace, they will still be allowed to keep their access to additional Google services (YouTube, Photos, Maps, Pay, Books etc) and any paid content purchased through non-Google Workspace services made with their legacy account e.g., any movies purchased on Google Play.

What Does This Mean For Your Business?

It appears Google’s first announcement of a deadline to either start paying by July or export your data out may have ruffled a few feathers and highlighted some of the different needs of Legacy G Suite account holders who may require a bit more help, including the fact that some people have content they’ve purchased through Google that they don’t want to lose. Although Legacy G Suite account holders are likely to appreciate that they enjoyed 10 years for free, they may also have assumed that Google would continue to take the same generous approach when the time for change approached rather than essentially being emailed with a deadline. For Google, it’s at least been a way to get the attention of account holders and help funnel users towards Google’s aim of ramping up its ‘Workspace’ to create something that Google hopes will seriously challenge Microsoft’s Office/365 dominance.

News

Security Stop-Press : Businesses Warned To Prepare For Threats From Russia

A leaked bulletin from the US Department of Homeland Security (DHS) has warned that, in light of the situation on Ukraine’s border, destructive cyber-attacks from Russia-backed advanced persistent threat (APT) actors look likely to be launched soon. The Russian state is thought to have been behind a massive cyber-attack that targeted 70 Ukrainian government websites, and the National Cyber Security Centre (NCSC) has urged British businesses and organisations to make sure they are prepared for any threats by reading the latest guidance published on its website entitled: “Actions to take when the cyber threat is heightened.” https://www.ncsc.gov.uk/guidance/actions-to-take-when-the-cyber-threat-is-heightened

News

Tech Tip – An Easy Way To Transcribe Your YouTube Videos

If you’d like an easy way to get a text transcript of your YouTube videos, try using YouTube’s built-in transcript tool, here’s how:

– Log in to YouTube and go to YouTube Studio.

– Select Subtitles from the sidebar (left).

– Select a video, choose the language, and click on ‘Confirm’.

– To edit the text transcript that appears on the screen, select ‘DUPLICATE AND EDIT’ (right-hand side).

– Edit the transcription in the dialog box and click on the ‘PUBLISH’ button.

– The transcript will be lowercase and lacking punctuation so this will need to edited and amended manually.

News

Sustainability : Removing CO2 Via Direct Air Capture Technology

With some climate commentators suggesting that current action and targets to reduce global warming may not be enough, we look at how Direct Air Capture Technology (DAC) could help.

The Challenges

The world’s governments have set targets to reduce the amount of CO2 produced by human activities in order to at least slow and, hopefully, make headway in trying reverse the effects of global warming. However, some of the challenges include:

– Simply ending emissions may not even be enough to stabilise the climate.

– The world’s energy consumption is growing at round 2 per cent per year anyway.

– Not all CO2 emissions are from large, controllable sources e.g., power plants where CO2 can be captured as it comes out.

(DAC) Technologies

Direct air capture (DAC) technologies can be used to extract CO2 directly from the atmosphere using liquid and solid DAC systems. Liquid systems pass the air through chemicals (e.g., a hydroxide solution) to remove the CO2, whereas solid DAC technology uses ‘solid sorbent’ filters that chemically bind with CO2. Heating the filters and placing them under a vacuum then releases the concentrated CO2 so it can be captured and stored.

Technology Used At Carbon Capture Facilities

There are already 20 direct air capture (DAC) plants operating worldwide, capturing more than 0.01 Mt CO2/year. New advanced versions may able to capture even more. For example, the DAC 1 facility at Permian Basin in the US is due to go live in 2024 when it will become the world’s largest direct air capture (DAC) facility being able to eventually capture to 1.0 MtCO2 (0ne million tonnes)/year.

The Advantages

Some of the advantages of setting up plants/facilities that use DAC to remove CO2 from the air include:

– They can help tackle the less controllable sources of CO2 emissions e.g., cars, planes, and household emissions.

– CO2 removal plants can be set up close to where the CO2 needs to be stored.

– CO2 mixes quickly in the air so it doesn’t matter where in the world the CO2 is removed – the removal has the same impact.

– DAC helps to close the ’carbon loop’ i.e., CO2 is repeatedly captured and reused to avoid producing more.

Issues

Although DAC looks like being a helpful addition in the fight to stabilise the earth’s climate, some of the current issues in scaling it up include:

– The high cost of building CO2 removal facilities.

– The potential high energy usage by the facilities themselves.

Hope, Breakthroughs, and Alternatives

Despite the issues, progress is being made to address them, and alternative ideas for carbon removal and storage are surfacing regularly. For example:

– Arizona State University Professor Klaus Lackner’s use of ‘mechanical trees’/vertical columns of discs coated with a special chemical resin and the use of moisture in the process could reduce the energy requirements of CO2 removal at scale.

– Mineral sequestration is a method that uses calcium-rich minerals, of which there are large areas around the world, to permanently store large quantities of CO2.

– Underground saline aquifers are being used to store CO2.

– Rewards are now being offered to incentivise innovation in CO2 capture technology. For example, in February 2021, billionaire Tesla founder and SpaceX boss, Elon Musk, pledged to give a $100 (£73 million) prize to whomever comes up with the best technology to remove carbon dioxide (which is produced from fossil fuels) from the air.

What Does This Mean For Your Organisation?

Global warming and the greenhouse gas emissions, such as large quantities of CO2, which are causing the warming are everyone’s problem. It is likely to be the case that not enough is being done to reduce levels quickly enough so, if DAC and similar technologies can be shown to make a real difference, it makes sense that efforts and investments are fed into setting up CO2 extraction and storage plants. Progress is already being made in increasing their effectiveness e.g., the US plant that may be able to capture 0ne million tonnes per year when it goes live in 2024. These technologies should be viewed as one of many tools to be used and measures to be taken to dramatically reduce the amount of CO2 we produce globally, and we may still have some way to go towards motivating some of the biggest CO2 producing countries to take serious steps to cut emissions which is a vital step in the overall strategy of which DAC can also play a role.

News

Tech News : UK Government ‘Help to Grow’ Scheme : Software And Free Business Advice

The UK government has just announced the launch of its ‘Help to Grow’ digital scheme which offers discounted software and free advice to small businesses.

Applications Open Now

The Help to Grow scheme is designed to support smaller businesses in adopting digital technologies to help them to grow. Applications for the scheme opened on 20 January.

Free Advice and Online Support

The scheme offers access to free, impartial online support and advice about how digital technology can boost a business’s performance. The support and advice can be accessed via Help to Grow’s online platform here: https://helptogrow.campaign.gov.uk/

Discounted Software

Eligible business in any business sector can also access a discount of up to 50 per cent towards the costs of buying approved software (from a group of approved suppliers), worth up to £5,000.

The 4 criteria for eligibility for the discount are:

  1. Businesses must be based in the UK and registered with Companies House or be a registered society on the Financial Conduct Authorities Mutuals Register.
  2. Employing between 5 and 249 people.
  3. Actively trading for more than 12 months and having an incorporation date of at least 365 days prior to application.
  4. Businesses must be purchasing the approved software for the first time.

Currently Just For CRM And Digital Accounting Software

Each eligible business can receive only one financial discount towards the purchase of one approved software product up to a maximum of £5,000 (not including VAT) in the Customer Relationship Management (CRM) and Digital Accounting software product categories. The government says that other software product categories will be available with the discount soon, including e-commerce software. The discount will cover 12 months’ worth of approved software product core costs, exclusive of VAT.

What Approved Software?

At this opening stage of the scheme, the approved CRM software suppliers whose products the discount applies to are Capsule CRM, Zymplify, Livepoint Software Solutions Ltd, Gold-Vision CRM, and Deskpro Ltd. The suppliers of the digital accounting software that the discount applies to are Sage, Intuit Ltd, and Crunch.

FSB and CBI

Mike Cherry, National Chair at the Federation of Small Businesses, said of the scheme: “For those small firms who are eligible, providing the means to make improvements through projects like this will make a real difference for those that are keen to expand their knowledge and skills.”

“We’re encouraging as many eligible small firms to apply and make the most of this new scheme.”

Also, Lord Karan Bilimoria, President of the CBI, said: “The launch of Help to Grow digital will help thousands of SME businesses invest in technologies. Supporting businesses on their digital transformation journey is fundamental to unlocking economic growth, boosting productivity, and creating a more resilient future for firms.”

Help to Grow: Management Scheme

The government already offers a ‘Help to Grow: Management’ scheme launched in 2021 as part of the wider government effort to back businesses and ‘level up’ the economy.

Under the ‘Help to Grow: Management’ scheme, small businesses can access 12-weeks of learning designed to fit alongside work commitments. The scheme can help businesses to develop a bespoke business growth plan, access 1:1 support from a business mentor, and learn from peers and network with other businesses. The scheme is 90 per cent funded by the government and participating businesses only need to pay £750. More information is available here: https://smallbusinesscharter.org/help-to-grow-management/

What Does This Mean For Your Business?

The last two years have created an extremely tough business environment, particularly for small businesses and businesses from all sectors have been forced to undergo a rapid digital transformation and associated learning (and cost) curve. Tools like CRMs can be costly to small businesses, but their use can really improve efficiency and productivity. For example, Enterprise Research Centre (ERC) figures show that businesses who use CRMs see on average productivity boosts of 18 per cent, so a its possible to see how a big discount on (approved) CRM software could help with growth. Also, ERC figures show that businesses adopting digital accounting software can get an 11.8 per cent increase in employee sales over 3 years. Discounts on this type of software could also provide an extra means for small businesses to increase growth. Free help, such as that offered via the Help to Grow portal, as long as it has real value, is bound to be welcomed by small businesses at this time. The biggest help right now would, of course, be greater certainty and a real improvement globally in the COVID situation, but the government scheme is one of many small ways that eligible businesses could improve growth in the coming years. The relatively small choice of approved suppliers and software types in the current round of the scheme, however, may not suit many small businesses right now, meaning that they may need to wait longer for any value and benefit.

News

Tech News : Google Gives Upgrade Deadline For Legacy G Suite Accounts

Google has announced in an email that users with legacy (old) free G Suite accounts have until 1 July to upgrade to paid subscriptions or lose access to most services.

Ten Years Free

Google has said that legacy G Suite users i.e., those who have been able to use their custom domain accounts for free for ten years, must upgrade to a paid Google Workspace subscription to keep their services by July 1, 2022. The G Suite legacy free edition will no longer be available starting from that date.

Google also says on its support site that, even if users choose to wait, Google will begin upgrading subscriptions automatically on May 1, 2022. This will mean that an organisation’s account will be upgraded to a new Google Workspace subscription based on the features that the organisation currently uses.

Setting Up Billing Required

Google is, therefore, asking Legacy G Suite account holders to set up Google Workspace billing before July 1, 2022, or the Google Workspace subscription will be suspended until this is set up. If users still haven’t set up their billing account for Workspace after 60 days, Google says that those users will no longer have access to Google Workspace core services, such as Gmail, Calendar, and Meet.

What Is The Legacy Free G Suite Account?

Google’s free edition was first made available to businesses, organisations, and schools from 2006 to December 6, 2012, with Google Apps. The free edition of G Suite—also known as the legacy free edition of Google Apps— gave users a reduced set of business features.

What Is Google Workspace?

Google Workspace, introduced in 2020 as part of a new brand identity, is Google’s cloud-based, collaborative working platform. Workspace, Google’s answer to competing products like Microsoft 365 with its ‘Teams’ app (and competitors like Zoom), is where its productivity apps (Gmail, Calendar, Drive, Docs, Sheets, Slides, Meet, and more), and core communication and collaboration tools (chat, email, voice and video calling, content management) are grouped together. Workspace gained huge popularity during the pandemic lockdowns when demand surged for cloud-based platforms that enabled remote and hybrid working. Google Cloud claims that Workspace now has more than 3 billion active monthly users!

How Much Will It Cost To Upgrade To A Google Workspace Account?

The basic Business Starter subscription costs £4.60 per user per month (currently discounted to £4.14) and offers 30 GB of Drive storage, 99.9 per cent uptime guaranteed, and increased security. Users can also bolt-on extra subscriptions as required e.g., Google Voice to get a dedicated business phone number. Business Standard, and Business Plus packages are also available. The packages can be compared at https://workspace.google.com/intl/en_uk/pricing.html

What Does This Mean For Your Business?

Google’s argument for the need to upgrade appears to be that legacy suite account holders should be pleased that they had 10 years for free, and that the legacy version never offered benefits like the Workspace platform does anyway e.g., 24/7 support, 99.9 per cent uptime and more storage. For Google, the introduction of Workspace would be a way to seriously challenge Microsoft’s Office/365 dominance and, as Javier Soltero, the VP of Google Workspace claimed in late 2020, “This is the end of the ‘office’ as we know it.” Google reported “strong” revenue growth for Workspace in its third-quarter results (October) indicating that it is a popular subscription. For those users who have enjoyed the legacy, an upgrade is clearly an additional cost, but there may be additional valued benefits. Those who don’t want to upgrade “may” still be able to keep YouTube and Google Photos, but Google clearly wants to strongly encourage users to at least take up a basic subscription as soon as possible.

News

Tech Insight : What Is A ‘Watering Hole’ Attack?

In this tech insight, we look at what a watering hole attack is, some examples of such attacks, and how businesses can defend against this threat.

Poisoning The Water

A watering hole attack is a targeted, ‘supply chain,’ cyber-attack strategy, similar to spear phishing. With this strategy, the attacker identifies a website that’s frequented by users of a targeted organisation, or entire sector. The attacker then infects the website(s) with malware and identifies weaknesses in the main target’s cyber-security. The attacker then manipulates the ‘watering hole’ site to deliver that malware, such as a Remote Access Trojan (RAT), so that it can exploit these weaknesses.
When a member of the target organisation’s device becomes infected (like drinking from a poisoned watering hole, hence the name) in a way that the target will not notice (also known as ‘drive by’), the attacker can then gain access to the infected device. This can, in turn, enable the attacker to access the target organisation’s network

Stealing and Spying

The goal(s) of this strategy, as with other strategies is/are to steal personal information, banking details, and intellectual property, and/or to conduct espionage. Also, it can enable the attacker to access corporate systems and assets, and potentially gain further details for even more cyber-attacks.

Examples

Examples of watering hole attacks include:

– The VOHO multi-phase Campaign. Back in 2012, attackers compromised a local government website in Maryland and a regional bank in Massachusetts, along with other sites related to the promotion of democracy in oppressed regions. The targets were organisations related to financial services, government agencies, and the defence industry, and the attack involved the use of re-directs and infection by Gh0st RAT malware. The attack saw 32,000 visitors from 731 unique global organisations being re-directed to an exploit site where around 4,000 hosts are believed to have downloaded exploit files, leading to a staggering 12 percent success rate for the attackers.

– From 2017 to 2018, a country-level watering-hole attack was launched in China by the “LuckyMouse”/ “Iron Tiger” group. This espionage campaign was reported to have targeted a national data centre of an unnamed central Asian country. The attackers injected malicious JavaScript code into the official government websites.

– The 2019 ‘Holy Water’ attack targeted Asian religious and charity groups. The attackers used an Adobe Flash update prompt to trigger the malware download. Although the motive was unclear, the attack may have been used for espionage.

How To Protect Your Business From Watering Hole Attacks

Ways that you can protect your business from watering hole attacks include:

– Keep anti-virus and software patches up to date.

– Use browser-based security tools to inform users of bad sites (bad reputation) and extra malware protection.

– Have a good email protection solution and consider using a secure web gateway (SWG) to filter out suspect traffic.

– Regularly inspect and monitor websites that are most visited by employees with a focus on malware detection. Also, have a procedure in place to quickly inform employees not to visit sites that have been identified as compromised.

– Check traffic from all third party and external sites before allowing employee access.

– Assess, know, and control the full extent of your supply chain (a watering hole attack is a supply chain attack).

– Educate/inform and train employees about the nature of the threat and how to avoid it.

– Never click on unknown/suspect links in emails or websites and exercise caution at all times when browsing.

– Consider adopting a ‘zero trust ‘security approach for the business/organisation.

What Does This Mean For Your Business?

This is broadly a supply-chain related attack (web resources) where instead of actively hacking or sending phishing emails, the criminals set traps for unsuspecting victims to walk into. In this respect, it is less obvious for businesses to spot. The first step is recognising and raising awareness of the threat. Following normal security good practice is always helpful plus some additional measures in this case such as identifying, regularly inspecting and monitoring websites that are most visited by employees and focusing on what additional malware protection can be added to employees’ browsers and devices. With an increasing number of more complex and inventive attack methods, many businesses are shifting to a complete ‘Zero Trust’ approach for their IT security. A more a data-centred rather than ‘moat and castle’ view of IT security gives companies greater holistic control and reduces the potential for the kind of gaps that cyber criminals can exploit with strategies like watering hole attacks.