# data[].attributes.body
Ransomware:
Ransomware attacks have become one of the most notorious cyber threats. In this attack, a hacker uses malware to encrypt data that may be required for business operations. An attacker will decrypt critical data only after receiving a ransom.

# data[].attributes.attachment_link.readable_text
History of ransomware

Ransomware, a type of malware that holds data for ransom, has been around for years. In 1991, a biologist spread PC Cyborg, the first ransomware, by sending floppy disks via surface mail to other AIDS researchers, for instance. In the mid '00s Archiveus was the first ransomware to use encryption, though it's long ago been defeated and you can find its password on its Wikipedia page. In the early 2010s, a series of "police" ransomware packages appeared, so called because they purported to be warnings from law enforcement about the victims' illicit activities and demanded payment of "fines"; they began to exploit the new generation of anonymous payment services to better harvest payments without getting caught.

In the 2010s, a new ransomware trend emerged: the use of cryptocurrencies as the ransom payment method of choice by cybercriminals. The appeal to the extortionists is obvious, as cryptocurrencies are specifically designed to provide an untraceable, anonymous payment method. Most ransomware gangs demanded payment in bitcoin, the most high-profile cryptocurrency, although some began shifting their demands to other currencies as bitcoin's popularity made its value more volatile.

Attacks shot up in the middle of the 2010s to crisis levels. But by 2018, the ransomware boom seemed to be on its way out, in favor of another illicit way to snag bitcoin that didn't require victims to figure out what a bitcoin wallet was: cryptojacking. Cryptojackers follow the script that spammers and DDoS attackers have been using for years: surreptitiously gaining control of computers without their owners knowing. In the case of cryptojacking, the compromised machines become bitcoin mining rigs, quietly generating cryptocurrency in the background and eating up idle computing cycles while the victim is none the wiser. Ransomware attacks declined over the course of 2018, while cryptojacking attacks shot up by 450 percent.

Ransomware attacks today

# data[].attributes.attachment_link.title
Recent ransomware attacks define the malware's new age

# data[].attributes.attachment_link.description
Ransomware, a type of malware that holds data for ransom, has been around for years. In 1991, a biologist spread PC Cyborg, the first ransomware, by sending floppy disks via surface mail to other AIDS researchers, for instance.

# data[].attributes.body
Advanced persistent threats:
Advanced persistent threats (APTs) are a major security concern for various organizations. An advanced persistent threat is a targeted cyber attack, where an intruder gains illegal access to a network and stays undetected for a prolonged period of time. Attackers aim to monitor network activity and steal crucial data using advanced persistent threats. Such cyber attacks are difficult to prevent, detect, or mitigate.

# data[].attributes.attachment_link.title
You searched for advanced persistent threats deter - Edge

# data[].attributes.attachment_link.description
Counterinsurgency: How a 2006 Manual Influenced Our Military

# data[].attributes.body
Botnets:
Mirai botnet has displayed how dangerous IoT security threats can be. The Mirai botnet has infected an estimated 2.5 million devices, including routers, printers, and smart cameras. Attackers used the botnet to launch distributed denial of service attacks on several IoT devices.

# data[].attributes.attachment_link.title
The Mirai botnet explained: How IoT devices almost brought down the internet

# data[].attributes.attachment_link.description
Mirai took advantage of insecure IoT devices in a simple but clever way. It scanned big blocks of the internet for open Telnet ports, then attempted to log in default passwords. In this way, it was able to amass a botnet army.

# data[].attributes.body
Identity and data theft:

Multiple data breaches made headlines in 2018 for compromising the data of millions of people. Confidential information such as personal details, credit and debit card credentials, and email addresses were stolen in these data breaches. Hackers can now attack IoT devices such as smart watches, smart meters, and smart home devices to gain additional data about several users and organizations. By collecting such data, attackers can execute more sophisticated and detailed identity theft.

# data[].attributes.attachment_link.description
Justin Sullivan/Getty ImagesFacebook CEO Mark Zuckerberg.Data breaches in 2018 compromised the personal information of millions of people around the world.Here

# data[].attributes.body
Remote recording:
Documents released by WikiLeaks have shown that intelligence agencies know about the existence of zero-day exploits in IoT devices, smartphones, and laptops. These documents imply that security agencies were planning to record public conversations secretly. These zero-day exploits can also be used by cybercriminals to record conversations of IoT users. For instance, a hacker can attack a smart camera in an organization and record video footage of everyday business activities. With this approach, cybercriminals can acquire confidential business information secretly. Such IoT security threats will also lead to major privacy violations.

# data[].attributes.attachment_link.readable_text
The CIA has declined to comment. But according to the WikiLeaks dump, the agency has collected dozens of "zero-day exploits." These are security flaws in software operating programs such as Apple iOS, Android, and Microsoft Windows that let an intruder illicity seize control of a digital device. "Zero-day" is tech-speak for a flaw that no one else knows about. Spies love zero-days because they can infiltrate a system for days, weeks, or months before being detected.

WikiLeaks claims the CIA, in cooperation with the United Kingdom's spy agency MI5, developed an attack that secretly activates the microphone on Samsung Corp.'s smart TV sets, allowing agents to remotely record conversations in hotel suites or conference rooms.

Other zero-day bugs allow spies to intercept text messages and voice calls sent on Apple or Android phones. It doesn't matter if the user has an app like Signal or Telegram that encrypts traffic; the bug captures the data before it becomes encrypted.

These exploits represent extraordinary work by brilliant engineers, and frankly, it makes me proud to be an American. But it also poses a nasty problem. The same bugs that make these exploits possible could eventually be uncovered by America's enemies, or even by common criminals.

Shouldn't the intelligence community protect us by reporting the problems to the software makers?

"It's a real conundrum," said Stuart Madnick, cybersecurity expert and professor at the MIT Sloan School of Management. "Currently, the mission of the CIA and the NSA is to be spies," not to help secure domestic data networks, Madnick said. "Revealing the zero-days would not be an obvious part of their mission."

Except that in 2010 the Obama administration made it a policy that when intelligence agencies discover such bugs, they should help software makers find and fix them. The agencies can apply for an exception in special cases, but those must be approved by a review board made up of senior executives of several agencies, including the departments of Homeland Security and Commerce.

The Obama administration publicly acknowledged the tricky balance between disclosing vulnerabilities and exploiting them for intelligence advantage.

"Too little transparency and citizens can lose faith in their government and institutions, while exposing too much can make it impossible to collect the intelligence we need to protect the nation," Michael Daniel, Obama's cybersecurity coordinator, wrote in a post on the White House home page in 2014.

Yet the WikiLeaks report claims the CIA has 24 zero-day exploits for Android devices alone, as well as an unspecified number for Apple iOS devices.

In addition, the CIA allegedly has developed ways to compromise computers running the major operating systems, Apple's Mac OS X, Microsoft Windows, and Linux.

And the agency told nobody.

Kade Crockford, director of the Technology For Liberty project at the American Civil Liberties Union of Massachusetts, said the spy agency's decision not to warn about these bugs poses a major security problem for users of digital devices worldwide.

"The fact that these documents leaked is evidence that it's very, very hard to keep a lid on this stuff," Crockford said. "As soon as this information is leaked or stolen, millions and millions of people are at risk."

WikiLeaks says it's in possession of the actual software code - several hundred million lines of it. But the same organization that cheerfully subverted Hillary Clinton's presidential campaign through a series of leaked e-mails has decided it's too dangerous to publish the attack software - for now, at least.

"Once a single cyber 'weapon' is 'loose' it can spread around the world in seconds, to be used by rival states, cyber mafia, and teenage hackers alike," WikiLeaks warned.

For privacy absolutists there's an easy answer: Make it mandatory for spy agencies to report all zero-day bugs, so they can be fixed. That might cripple America's ability to spy on rival nations, or on terrorists. People in the intelligence community call this "going dark."

But Bruce Schneier, a security software developer and a fellow at Harvard University's Kennedy School of Government, said living with billions of easily hackable devices is far worse. "A dark world where nuclear power plants can't be hacked is safer than a bright world in which they can," Schneier said.

Maybe there's a middle path. Perhaps our spies could be given, say, one year to exploit each new bug. Then they'd be required to report it - no exceptions, no appeal. That would cut the risk to public safety and give the spies time to find new ways to raid our systems.

It's an imperfect solution, perhaps no solution at all. But there's no going back to the old ways. WikiLeaks has seen to that.

Hiawatha Bray can be reached at hiawatha.bray@globe.com. Follow him on Twitter @GlobeTechLab.

# data[].attributes.attachment_link.title
If the CIA can compromise our gadgets, can't others do the same? - The Boston Globe

# data[].attributes.attachment_link.description
The CIA has declined to comment. But according to the WikiLeaks dump, the agency has collected dozens of "zero-day exploits." These are security flaws in software operating programs such as Apple iOS, Android, and Microsoft Windows that let an intruder illicity seize control of a digital device.

# data[].attributes.headline
An explanation of IoT's impact on cybersecurity and inherent risks and vulnerabilities that it brings to the forefront

# data[].attributes.subject
An explanation of IoT's impact on cybersecurity and inherent risks and vulnerabilities that it brings to the forefront

# data[].attributes.body
In order to address some of the most serious issues and problems surrounding the technology, five major IoT issue areas are examined. These include security, privacy, interoperability, and standards.

Security:

Numerous IoT implementations' characteristics pose fresh and original security problems. It must be a top priority to address these issues and guarantee security in IoT goods and services. Inadequately protected data streams on IoT devices and services might act as potential entry points for cyber attacks and expose user data to theft. Because IoT devices are interconnected, every unsecure device that is connected to the Internet has the ability to influence the global security and resilience of the Internet. Other factors include the widespread deployment of uniform IoT devices, the capability of some devices to automatically link to other devices, and the possibility that these devices may be used in unsafe locations all contribute to the difficulty of this problem.

Privacy:

To ensure user trust and confidence in the Internet, connected devices, and related services, privacy rights and respect for user privacy expectations are essential.

# data[].attributes.body
The phrase "Internet of Things" commonly describes circumstances in which network connectivity and computing capabilities are extended to objects, sensors, and common household goods that are not typically thought of as computers, enabling these devices to generate, trade, and consume data with little to no human intervention.

It is important from a technical, social, and economic standpoint to pay attention to the Internet of Things. The combination of consumer goods, durable goods, vehicles, industrial and utility components, sensors, and other ordinary objects with Internet connectivity and potent data analytics capabilities has the potential to revolutionize the way we work, live, and play. IoT's predicted effects on the Internet and economy are astounding; some estimate that by 2025, there will be up to 100 billion linked IoT devices and a $11 trillion worldwide economic impact.