Security Updates: Amazon Sidewalk, a Breach and Too Much Ransomware!

There have been many security breaches and updates in the news recently so we picked the ones we think affect the most individuals. As such, this post discusses an important change with Amazon devices that every user should be aware of, a recent password breach and a roundup of recent ransomware attacks.

The importance of sharing the ransomware attacks against businesses is to help people understand the threat is not going away any time soon and that anyone can be a target. We aim to increase awareness so people realize these kinds of attacks are not things that just happen to "someone else".

Security Updates: Amazon Sidewalk, a Breach and Too Much Ransomware!

We will start with the new item most likely to affect you - new features included in many Amazon devices. For a list of all compatible devices, check out this article about Amazon's new Sidewalk feature. The Sidewalk project went live earlier this week and is an opt-out feature, meaning it will be enabled by default and you have to opt-out to disable it.

The purpose of Amazon Sidewalk is to provide greater network coverage in user's homes. It works by turning the devices that support it into repeaters that extend the coverage of your wireless network. This allows devices on the peripheral of your wireless network to connect, creating a mesh network.

However, the capabilities of Amazon Sidewalk does not stop there. Devices supporting this feature provide a low-energy network to other devices, and these can include devices that do not belong to you.

So how does that work and is it secure?

Any signal provided by your wireless network that extends beyond your home, "to the sidewalk", can be used by other Sidewalk enabled devices that are within range of your signal. Since these devices are connecting via the Sidewalk service, rather than directly to your specific wireless network which would require your wireless network SSID and password, they are not supposed to get access to specific details about your network or other devices on it. This is of course according to Amazon and every user should consider what kinds of things they do on their wireless network before deciding to remain opted-in.

The takeaway:  It is important to consider that any peripheral connection can pose a risk and it is smart to err on the side of caution. This is especially true if you are working from home or access any private or financial data on a device at home. Additionally, while Sidewalk limits devices to a 500MB per month data cap, this can still impact your network and your Internet Service Provider (ISP) bill depending upon where you live and the service you have. Either way, you might not be okay supplying wireless to people you do not know and that should be your choice!

To opt out, use the Alexa app to access the settings under More, Settings, Account Settings and Amazon Sidewalk.

Password breach

Yet another data leak has exposed user passwords, this time totaling eight billion, making it one of the largest ever and more likely to have compromised a password you use. The list of exposed passwords landed on a hacker forum and is presumed to include passwords exposed in previous hacks.

This is one of those instances where there isn't anything you could have done to prevent the leak from happening. However, there are always things you can do to better prepare yourself when something like this does happen. The single most important thing you could do is use different combinations of user IDs and passwords for each account you have. This probably sounds tedious and overwhelming, but it could potentially save you hours, months and years trying to restore access to accounts, recover your identity and restore your credit if the wrong person were to gain access to the right accounts.

The takeaway: Whatever you do, be sure you do not reuse your email credentials. Check out our blog post for all the ways this can really hurt you. Beyond that, change any passwords you believe might be at risk. There are places you can go to check to see if a password has shown up on an exposed list, including links to the article about this breach. Always use caution entering your passwords anywhere other than the actual vendor.

For any banking accounts or accounts with saved credit cards, it is a good idea to update the password associated with that account. Even if it was not exposed, it will not hurt you to be extra cautious. If you do decide to change the password, be sure to use a new password, not one that could have also been compromised.

Too much ransomware!

There have been numerous ransomware attacks since the attack on the Colonial Pipeline. Ransomware is extremely dangerous because it encrypts all the local files as well as those on externally attached devices and network mapped drives on any infected device. This post discusses a few recent attacks including:

• JBS
• Fujifilm
• Sturdy Memorial Hospital
• Massachusetts Steamship Authority

JBS - the world's largest meat processing plant, with more than 250,000 employees, was targeted in early June. Luckily the attack was quickly caught and impacted systems were taken offline to begin the remediation process. Additionally, JBS had backup systems that remained intact which provided a great deal of protection.

Unfortunately, the affects of this attack are being felt throughout the meat industry. From local supply chains to livestock being in limbo to workers going home and plants shutting down, this kind of an industry being targeted can have substantial affects to the public as a whole and is a serious threat.

Fujifilm - was forced to shut it's network down after a possible ransomware attack on June 1, 2021. In response, they suspended all affected systems in all geographic areas. In some instances, this included taking down all communication systems, including email and phones. At this time, recovery is still under way.

Sturdy Memorial Hospital - a hospital located in Massachusetts recently released information that they suffered a ransomware attack back in February. Not only did they pay the ransom, but this breach exposed sensitive medical and financial patient data. The information accessed may have included social security numbers, insurance claim numbers, bank routing numbers, treatment information, medical history and more.

The only good news about this attack is that it did not affect patient care and the files that were encrypted were recovered from backups.

Massachusetts Steamship Authority - is the largest ferry service in the state of Massachusetts and was hit with a ransomware attack last week. This hack has limited credit card systems and they are still working on restoring some systems, but trips that were already scheduled have continued to operate without disruption. Luckily, there was no compromise to the safety of vessel operations reported as a result of this attack.

Protecting your data and privacy is a constant battle against all kinds of attacks, attacks directed at you and also at those companies you do business with. Sometimes a threat is introduced via a new feature like Amazon Sidewalk. While you can not protect yourself against every attack, there are plenty of things you can do. These include using long and complex passwords, using unique user IDs and password combinations, and changing passwords with places where a breach or other incident has occurred.

As always, being aware of what is out there can help you protect yourself and others.