Media & Victims Find Common Ground Against Hackers

In a panel at Black Hat 2024, journalists and investigators explain their differing goals when a victim organization is breached.

BLACK HAT USA - Las Vegas – Wednesday, Aug. 9 –
When threat actors breach an organization and steal data, perhaps the worst thing imaginable to victims is the extortion attempts they face from the criminals behind the breach. These days, there is an added threat that hackers like to hang over their victims heads: going to the press.
In a Black Hat panel titled
How Hackers Changed the Media (and the Media Changed the Hackers),
Lorenzo Franceschi-Bicchierai, senior writer and editor of cybersecurity at TechCrunch; Robert McMillan, reporter at The Wall Street Journal; and Sadia Mirza, partner at Troutman Pepper, joined Sherri Davidoff, CEO of LMG Security, to discuss the new ways hackers are trying to gain the attention of journalists and shape the narrative of the media when a breach occurs.
Security incidents typically begin with a criminal group of hackers stealing data from an organization and demanding payment. Whether it be $500,000 or millions of dollars, if a criminal entity is virtually unknown, it’s likely they know few will take them seriously.
The groups desire to build a name and reputation for themselves prompts what McMillan describes as the professionalization of these criminal groups, where they attempt to gain credibility — and get victims to fear or respect them. These groups are eager for media attention and will use the threat of going to the press against victims to urge them pay up. They often reach out to journalists themselves or to pages on media websites after a breach occurs.
But just because a hacker reaches out to the media about a breach doesnt mean a journalist is immediately inclined to write about it.
Sometimes they reach out and they are not telling the whole truth, or sometimes they’re making it up, said Franceschi-Bicchierai, who noted that while his publication aims to write several stories each week, if an incident is not 100% verifiable, it is fine to skip it or wait until more is known. He emphasized how important it is for journalists to verify claims that are being made — one source, especially one as dubious as a criminal hacker, does not make a story worth pursuing.
Its not just journalists who take what a hacker says with a grain of salt. Troutman Peppers Mirza noted that a threat to go to the media is just one more factor to consider when advising clients who have been breached. The fact that these hackers want to maintain their brand is another factor to consider.
An organization would be more inclined to pay a threat actor group that has a reputation to uphold its commitment, Mirza said. Ultimately, however, the goals of the media and incident and investigation teams are very different.
Were not trying to break a story, she said. We are trying to get our arms around the full scope of what’s happened so that we can provide organized information about the response.
There are stark differences when media and investigators approach a breach from disparate standpoints. On one end, investigation teams on behalf of their compromised client are tight-lipped, taking time to figure out exactly what has happened. On the other end, journalists feel governed by their commitment to tell the truth and inform the public about what is happening as accurately as possible. All the while, hackers are trying to gain something from each side: getting media attention and extorting victims.
How can both be appeased, while also not falling into the trap that hackers have laid out?
It first starts with understanding what an incident response process looks like, said Mirza.
A forensic investigation could take weeks, she said. Victims are not comfortable sharing information as soon as the press may want them to because they don’t have all the information they need or want. Sometimes there are hiccups along the road in response and in figuring out what next steps to take; whether it be negotiating a number for the payment, deciding to pay, figuring out how many people have been impacted, or what information has been stolen.
McMillan said this is why clarity and communication from victims is essential.
You could communicate that, he said. We can understand complicated things. You dont just have to have a [ransom] number, but you want to engage and explain where you are and why things may be a certain way.

Last News
▸ IoT Devices on Average Have 25 Vulnerabilities ◂ Discovered: 23/12/2024 Category: security	▸ DHS-funded SWAMP scans code for bugs. ◂ Discovered: 23/12/2024 Category: security	▸ Debunking Machine Learning in Security. ◂ Discovered: 23/12/2024 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Media & Victims Find Common Ground Against Hackers