Only days into the Winter Olympics and reports of cyber attacks are making headlines. Officials have confirmed that a cyber attack is to blame for an internet and Wi-Fi shutdown during the opening ceremony.
Noncritical systems were impacted – including the official Olympics website, which according to reports, went offline when organizers shut down servers to address the attack. Wi-Fi service also stopped working.
This follows the Department of Homeland Security’s recent warning that the 2018 Winter Olympics will be a hotbed of cybercriminal activity. While the warning was extended to those in attendance, you don’t have to be sitting in the stands to become an unwitting target.
Whether they’re part of a criminal syndicate or part of a nation-state attack group, cyber attackers love to use high-profile public events as a cover for their malicious activity. Even the most security conscious person can let their guard down when they’re caught up in the spectacle and excitement of something like the Olympics.
With that in mind, here are a few techniques and approaches that we believe attackers will use during the Olympics, both to target spectators on-site and those watching and reading about the Olympics at home or from the office.
Cryptomining
Cryptomining attacks are quickly replacing ransomware as the attacks du jour. Attackers will infect websites that are commonly used to view Olympic activity, stream events or provide news on what’s happening at the games.
By visiting an infected site, users unwittingly donate their computing power resource to mine cryptocurrency on behalf of the attacker – all without users knowing they were part of the process.
These attacks don’t require malware to run on the user’s endpoint. The only indication of the attack may be that your computer runs slower due to loss of computing power.
High Value Targets: Olympic viewers back home or in the office
Spear Phishing Campaigns
This is one of the most common methods attackers use to gain a foothold on an endpoint or in an organisation. Attackers use peoples’ information to specifically target them with a malicious email, in hopes that they’ll click a link and unleash the payload it’s carrying.
There are already reports that attackers have been targeting Olympic officials for months. Whether you’re watching the games from home or attending, be wary of any email that contains links or attachments to information about events, times and websites to watch the games. Vigilance is the best defense against phishing attacks.
High Value Targets: Olympic athletes, Olympic officials, country delegations and government representatives, viewers/fans
IoT and Mobile Payment Attacks
Mobile payments and IoT promises to be a big part of the 2018 Winter Olympics. Internet-connected devices have been a favourite target of attackers of the past year, primarily because of the incredibly poor security of most IoT devices. We can expect attackers to test device defenses used during the Olympics – whether it’s cameras, wearables or any other device that will be gathering data on athletes, attendees and officials.
While mobile payments make life much easier for the consumer, the platforms have historically had poor security and represent a real threat to consumer security. Some of the more prevalent mobile payment attacks include spoofed mobile wallets, or malware on the phone itself, which will collect all of your data, passwords and other sensitive information.
High Value Targets: Fans/attendees, Olympic athletes, Olympic officials
Public Wi-Fi-Related Attacks
Public Wi-Fi-related attacks are an oldie and attacker favourite – something that has manifested in previous Olympics (or any public event where free Wi-Fi is provided).
These types of attacks are incredibly common – free Wi-Fi is typically poorly secured. It’s fairly easy for attackers to use Wi-Fi sniffing software to ferret out the data transmitted over the network. This becomes worrisome when you use pubic Wi-Fi for sensitive transactions like banking or even entering passwords to websites.
If you’re at the games, be extra careful about what network you’re connecting to and try to avoid accessing websites where you need to enter your passwords, sensitive information (like SS numbers) or banking/financial websites.
In addition to these recommendations, visitors should also consider using a mobile hotspot for Wi-Fi access.
