As a journalist, I’m often at the forefront of covering major news stories, whether it be a court case or a tornado. The proliferation of “fake news” however, has become a significant issue to the reporting profession. Not only has the term “fake news” taken on a political meaning, but it also has cybersecurity implications, and that is what I will dive into here today.

As we head into the USA’s autumn election season, MSPs need to be especially vigilant of the extra churn of “news” that can contain malware, or much worse. Everyone needs to be on guard, and, with MSPs, it begins and ends with education.

A study out this month by Neustar International Security Council underscores the jitters that fake news is giving cybersecurity professionals. Some key findings:

    • Almost half (48 percent) of cybersecurity professionals regard fake news and misinformation as a threat to their enterprise
    • The other half (49 percent) rank the danger they pose as very significant.

The report cites issues like bad actors using social engineering to spread misleading news, falsified evidence, and incorrect advice as being top concerns. Another finding of the report is the “erosion of trust” caused by misinformation that poses ethical, social, and technological challenges to organizations. Lastly, the study says only a fraction of executives are confident their business is up to the task of combatting the cybersecurity aspects of misinformation, pointing to opportunity for MSPs to market and sell their services.

I spoke to an MSP owner in Tennessee who experienced several recent issues with clients who had employees unwittingly unleash malware into systems by opening links they shouldn’t have. In each case, the links were associated with COVID or the upcoming Presidential election in the United States.

Over the next couple of months, businesses should be prepared for a flood of stories, spin, and passionate responses around the election that could cause employees to fall for carefully crafted social engineering phishing attempts that include posing as a journalist.

For me, this is one of the more disturbing trends. Hackers have been caught on multiple occasions posing as journalists in very targeted spear-phishing campaigns. Like most journalists I know, I take my job very seriously, and someone posing as a journalist undermines journalism.

One example came this week from Hacker News:

An Iranian cyberespionage group known for targeting government, defense technology, military, and diplomacy sectors is now impersonating journalists to approach targets via LinkedIn and WhatsApp and infect their devices with malware.

In other words, hackers are now using a blend of conventional journalism tools, along with phone calls and instant messaging to convince unwitting employees in defense and military entities to open a malicious link.

As a journalist, for example, I frequently use WhatsApp, Linkedin, PitchWhiz, and other forums to communicate with sources. If hackers start espousing them under the guise of legitimate journalism, that will make my job even more difficult. And the use of these tools is just one of the many egregious ways in which hackers are trying to hijack journalism. Often, the methods are geared not towards impersonation but piggybacking on a major story with social engineered phishing.

In addition to the usual suite of cybersecurity tools you use to keep these systems safe, here are some other steps to keep in mind during this age of misinformation:

Education

The MSP owner in Tennessee whom I spoke with, and who didn’t want me to print his name (he didn’t want to publicize that had some issues with fake news attachments), said that after his clients’ systems were breached and they traced the origin, all clients were video-conferenced into a tutorial about the dangers of getting caught up in the news cycle.

“Since that conference in early July everyone seems much more aware, but if your article can bring awareness to others and save them the headaches and lost revenue we experienced, than you’re doing a good service. Sometimes people just need a reminder,” he said.

And when another story dominates the news cycle – and one will – whether it is a war, natural disaster, political incident, or something heartwarmingly great (like when the Thai boys were rescued from a cave), a reminder to clients of the cybersecurity implications are in order.

Phone calls

I shuddered the other day when I saw a call come to my phone from a Russian number. Not because I have anything against Russia or any country, but I don’t do any business in Russia and a call from there seemed odd. I occasionally work with journalism partners in the UK or France, so a call from those areas wouldn’t arouse my suspicions.

But a call from Russia, where hackers are known to operate, unnerved me, so I didn’t answer it. If there was an important enough reason to call, the caller could leave a message that would allow me to vet it. They didn’t leave a message. But sometimes it is very easy not to make a connection between a phone call, which seems so last century, and cybersecurity, which is very much the 21st century. Sometimes hackers will try the old-fashioned way in and everyone needs to be alert.

Attachments

A journalist who wants you to click on a link or open an attachment as part of a routine story interview should raise red flags. Most journalists are seeking information from you, not the other way around. I have interviewed thousands of people for hundreds of articles throughout my career, and I cannot recall one time that I have needed to send a person an email with an attachment (plenty of occasions I need to receive, but not send).

Between a pandemic, racial justice marches, and now an election, now is the time for MSPs to be extra vigilant for hackers trying to slip in through the spinning news door.

Photo: r.classen / Shutterstock

Kevin Williams

Posted by Kevin Williams

Kevin Williams is a journalist based in Ohio. Williams has written for a variety of publications including the Washington Post, New York Times, USA Today, Wall Street Journal, National Geographic and others. He first wrote about the online world in its nascent stages for the now defunct “Online Access” Magazine in the mid-90s.

Leave a reply

Your email address will not be published. Required fields are marked *