There’s a brand new cybersecurity threat for K-12 school systems, and it’s coming from an unexpected source. One of the most trusted names in technology is the new target— and that’s part of the problem.
Where is the threat coming from?
The surprising weak point is coming from none other than Google. Hackers have discovered a method of using the massive amount of trust placed in Google as a cover for illicit activities. Because many content security systems have “whitelisted” Google subdomains, they are not scanned for potential threats. But by modifying the code, hackers were able to steal supposedly secure credit card data.
When did the threat start?
It’s hard to say exactly when this latest breach started, but the discovery was announced in an article published February 18th of this year. Researcher Eric Brandel further explained via Twitter that he was able to replicate the threat in about 5 minutes. He also pointed out that this is not the first time Google has been targeted.
What is the problem?
Traditionally, Content-Security-Policy has identified digital skimmers by recognizing and blocking untrusted servers in locations known to be havens for nefarious activity. However, they are often not equipped to review trusted domains for modification, allowing the hackers to slip into systems undetected and begin harvesting information. Simply put, most systems find nothing suspicious about Google domains, so they don’t even bother to check them. While this may speak to larger changes needed in cybersecurity methodology, in the meantime, and before Google can move to close the threat, any company handling sensitive information will need to be extra cautious.
Who is the target?
Because the primary target so far is credit card data, eCommerce sites have been hit hardest; however, any site that stores personal data is potentially at risk. In the few weeks that have passed since the initial discovery, roughly two dozen sites worldwide have already been identified as compromised. More will almost certainly be discovered, and hackers are still targeting companies that are slow to close the security gap.
How can ANC Group help your school minimize risk?
The key to cybersecurity is remaining proactive. Establishing regular Security Assessments and Vulnerability Testing mitigates the risk of a major problem for your school system. If you wait until there are warning signs of a security breach, it’s likely already too late.
ANC Group works to identify your network’s potential weak spots and designs a custom fix to meet your unique needs. Your main enemy, more than any hacker, is complacency. While it’s impossible to ever have a 100% security guarantee, with constant vigilance, you can stay a step ahead of cybercriminals. We can help.
