diegopoza

System Engineer, geek, foodie, technology lover, speaker.

Sr Manager, Developer Advocacy

Diego Poza

Use penetration testing and 2FA and educate citizens and employees to better anticipate and avoid cyber threats.



On April 7, 2017, at a quarter to midnight, the city of Dallas was hacked.

The perpetrators accessed the City of Dallas's emergency management system and set off 156 blaring alarms—alarms intended to warn people in case of a tornado or hurricane.

It took over an hour and a half for city administrators to understand what had gone wrong and shut the sirens down.

Amid the ongoing digitization of our urban areas, the Dallas incident highlights one of the main dangers that a smart city—for all the good it can do—brings.

Without the right precautions, and without the right security, our smart cities can be just as vulnerable to hacking as our computers and mobile devices.

What happened in Dallas may have been the first high-profile incident of “city hacking,” but it certainly won't be the last.

## Why Security Is a Problem For Smart Cities

The rise of smart cities is intimately linked to the rise in production of Internet of Things (IoT) devices—as are its inherent security problems.

Your average IoT device is relatively cheaply produced. It's not built with the kind of security features you get on a Mac or Windows laptop or tablet or in a mobile phone. It is, however, connected to the internet.

These three factors have made IoT devices incredibly fertile cybercrime targets over the last decade or so.

In 2015, millions of children's names, genders, ages, photos, and parents' records (including home addresses) were compromised through a device known as the InnoTab—a kind of WiFi-enabled tablet for kids.

IoT devices are often trivially easy to access remotely because they're already connected to the internet and not built with cybersecurity in mind. Hackers don't even need to pull information from them. They can simply sit on the device and wait for it to gather information, or even requisition it for use in a distributed denial of service (DDoS) attack or botnet.

Cybersecurity researchers have found vulnerabilities in IoT devices in smart cities, too. Aside from the Dallas incident, significant issues have occurred in smart traffic signals and smart electricity meters. The number of attacks on infrastructure in the U.S. alone went from not even 200 in 2012 to 300 in 2015.

Today, advocates of smart cities are looking much more closely into the security of smart cities and how to build devices that can ensure our cities stay safe and protected—even as they get smarter. According to Gartner, 2.3 billion connected items were used in U.S cities throughout 2017. That number is only going to get bigger and bigger.

## Ensure Security For Critical Facilities

The most vulnerable locations in any smart city are the centers of utilities and power—power plants, water processing plants, and so on.

In Kiev in 2016, hackers shut down 20% of the city's power by hacking into an electrical substation.

Penetration testing is a common method that cities and municipalities use to test for vulnerabilities with their utilities. A security firm is hired to attempt to break in and gain access to the system. Afterward, they produce a report with their findings and give [recommendations for how to avoid the a real attack](https://www.redteamsecure.com/business-insider-rides-shotgun-as-redteam-security-hacks-the-power-grid/).

![Smart city -  crime of person gaining access to a facility](https://images.ctfassets.net/23aumh6u8s0i/1n7pLxG3VH1QfPNkEFt9TX/44b26808a6ffb50c7d924a0e3d40ad18/gaining-physical-access-to-facility)

Pen testing isn't just about lurking around a facility late at night and trying to gain physical access. It might also mean dropping a USB key, loaded with a virus, in the parking lot to see whether an employee happens to pick it up and stick it in their laptop; if they do, the key can be formatted to sit on the device as a keylogger, attempt to gain remote access, or send out phishing emails.

It's about social engineering—still one of the most effective ways of gaining access anywhere.

And it means, of course, more straightforward network and application penetration testing—trying to get in by remotely compromising the system itself.

## Two-Factor Authentication

Facilities that provide critical utilities, such as power and water, need to be made absolutely secure, but so does other essential infrastructure in smart cities—like subway transportation, street lights, and security cameras.

The essential technology of any smart city must employ cryptography to protect data. Otherwise, video feeds of your citizenry can wind up being streamed on the internet, or your street lights can end up flashing on and off for hours on end.

Data should be encrypted both at rest and in transit. Any systems that allow access from any parties must accept a username and a password and should go a step forward and enable two-factor authentication. Two-factor authentication is the easiest and most effective step you can take to prevent unauthorized access because it immediately cuts out the most obvious and available attack vectors.

![Two-factor authentication example using phone device auth to grant access](https://images.ctfassets.net/23aumh6u8s0i/HWYrg3Jdj6NOgoKwz1AgN/69deef407a90c08422882ec34e06392f/two-factor-authentication-using-smartphone)

[Two-factor authentication](https://auth0.com/learn/two-factor-authentication/), at root, is about ensuring that anyone accessing your systems has two methods of proving their identity. That might mean a username, password, and something like a biometric key or a one-time password delivered through an app on their phone, like [Auth0 Guardian](https://auth0.com/docs/multifactor-authentication/guardian) or Google Authenticator.

## Education For Citizens and Leaders

Ultimately, the best way to prevent most cyberattacks (on cities or anything else) from succeeding, or at least to mitigate the damages, is education.

Emails that look like they're from a C-suite executive at your company but have an odd-looking From: address, or USB drives that look like they've been forgotten in your office's parking lot: These are highly visible red flags that indicate that some person or group has gotten access to your systems or is trying to. They're also some of the most commonly successful attacks out there because many people don't recognize the signs for what they are.

When one person falls for a phishing email, it can cause huge ripple effects down the line as their contacts are emailed en masse and compromised as well.

Educating denizens about the common forms of cyberattacks and the ways to prevent falling victim to them is the number one way that cities—if they cannot prevent attacks from happening—can ensure that the effects of malicious acts do not ripple out and cause wider damage.

## The Future of Urban Cybersecurity

The cybersecurity challenges of the future are going to look bigger and much different than many of those we have today.

As smart devices proliferate and security vulnerabilities loom larger and larger, it's on all of us to make sure that the cities we are building—no matter how smart—are secure as well.

<include src="asides/AboutAuth0" />


How Do Smart Cities Tackle Cybersecurity?

Information and tools to help you mitigate risk against cyber attacks and data breaches. Learn more about Malware Infiltration, Phishing, USB Traps, and Mobile Attacks.



In 2017, nearly [_179 million records_](https://www.statista.com/statistics/273550/data-breaches-recorded-in-the-united-states-by-number-of-breaches-and-records-exposed/) were exposed due to data breaches. It's clear that cyber criminals are growing more creative with how they gain access to networks and valuable data.

Many of today’s most common cyberattacks have been socially engineered to rely on human error. Even your best employees can become your greatest weakness if they open a suspicious email, click on a malicious link, or pick up and use an anonymous USB device.

There are ways to protect your organization against sensitive data breaches. Here are four of the most common cyberattack examples and the ways you can avoid them.

## **1. Malware Infiltration**

**What makes you vulnerable: outdated software and lack of backup protocols**

Malware is a term that encompasses many different types of malicious software, including ransomware and spyware. Each type of malware can wreak havoc once it gains access to a system.

WannaCry, for example, a form of ransomware, recently [took advantage of a weak spot in Microsoft’s operating system](https://www.symantec.com/security-center/writeup/2017-051310-3522-99). Banks, health care providers, manufacturers, and other businesses across the globe reported WannaCry's encryption.

![WannaCry encryption](https://images.ctfassets.net/23aumh6u8s0i/1vTw3WKZIs3Fs1RZGhNNeI/18d3869c4068bf29ce62e9ce8eb6e9db/WannaCry-encryption)
  
[[Source](https://blog.malwarebytes.com/cybercrime/2017/05/wanacrypt0r-ransomware-hits-it-big-just-before-the-weekend/)]

In order to regain access to their computers, along with any files that hadn’t been backed up, businesses had to pay a ransom to the creators of the WannaCry program in [_bitcoin_](https://bitcoin.org/en/). [_Sixteen National Health Service’s offices_](https://developers.redhat.com/blog/2017/05/19/wannacry-ransomware-who-it-affected-and-why-it-matters/) and over 200,000 PCs worldwide reported this.

_Solution: Regularly updating your systems will go a long way toward removing dangerous holes. It's a simple fix that many teams, including [Equifax](https://www.wired.com/story/equifax-breach-no-excuse/), have neglected._

_If you want added security, consider [moving to the cloud](https://auth0.com/blog/moving-your-app-to-cloud/). Not only will this allow your enterprise more flexibility to scale, but you can also delegate specialized security tasks like IAM and encryption to expert providers._

## **2. Phishing **

**What makes you vulnerable: lack of education and attention to detail in suspicious e-mails**

In 2016, [91% of cyberattacks](https://phishme.com/2016-enterprise-phishing-susceptibility-report/) were the result of a spear-phishing email. Phishing e-mails steal data either by tricking recipients into giving it to the cyber criminals or by getting users to download a file that installs spyware—software designed to steal information directly from a user’s device.

Children’s Mercy Hospital [_recently reported a breach_](https://healthitsecurity.com/news/childrens-mercy-hospital-phishing-attack-impacts-phi-of-60k) that exposed the health care information of at least 60,000 people. E-mails tricked users into disclosing their work e-mail credentials, which led to the exposure of patient health data when the hackers gained access to the inboxes of the targeted hospital workers. Children’s Mercy [_is now being sued_](https://www.hipaajournal.com/childrens-mercy-hospital-sued-for-63000-record-data-breach/) for this major breach.

Here’s an example of an imitation Dropbox e-mail asking for confirmation of a user’s e-mail:

![Imitation Dropbox email phishing scam asking for confirmation of a user’s e-mail](https://images.ctfassets.net/23aumh6u8s0i/7jVF95LDb067AOrODuA8SI/2fb640b69a3567e208636c1abad55fc1/dropbox-email-asking-confirmation-of-user-email)

[_Source_](https://www.bankinfosecurity.com/locky-returns-via-spam-dropbox-themed-phishing-attacks-a-10250)

When users click the “Verify your email” link, spyware software is automatically downloaded onto the users' computers.

_Solution: As these e-mails start to look more realistic, it’s important to educate employees on how to spot a questionable e-mail chain._

_Creative training programs include the following:_

- _Digital Defense's [SecurED training program](https://www.digitaldefense.com/professional-services/secured-training/) that works with award-winning Hollywood comedy writers_
- _Terranova's [customizable newsletters](https://terranovacorporation.com/solution/communication-material/)_
- _Inspired eLearning's [Security Awareness for the C-Suite](https://inspiredelearning.com/security-awareness/awareness-c-suite/)_
- _Wombat Security's [everyday tips](https://www.wombatsecurity.com/security-education/free-security-awareness-resources)_

_[See here for a larger list.](https://www.csoonline.com/article/3225471/security/please-dont-send-me-to-cybersecurity-training.html)_

## **3. USB Traps**

**What makes you vulnerable: lack of education and policy on outside device use **

Hackers who want a direct route to company data often use a hardware device, such as a USB drive. A [_recent Google study_](https://static.googleusercontent.com/media/research.google.com/en//pubs/archive/45597.pdf) revealed that at least 45% of people who find a USB drive will plug it into their computers. Planted USB drives may contain malware or a link that requests information, similar to a phishing e-mail.

The worst-case scenario is a drive that contains a HID spoof. This is where the USB drive tricks the computer into believing the drive is actually a keyboard and then issues a set of keystrokes that forces the computer to dump data back to the hacker. It can also allow them access to whatever network the computer is connected to.

![HID spoof process](https://images.ctfassets.net/23aumh6u8s0i/6tgD3dKhZRBiDXExHQw0H3/b36a8b23e6518b6d0c93f44e0e0f69f3/hid-spoof-process)

_Solution: Outlawing anonymous, external drives on company devices will send a clear message to your organization. Whether a drive was planted or simply purchased from an illegitimate source, removing the temptation to plug something in without properly vetting is a low-hanging fruit that can have enormous power to secure your team and your end users._

## **4. Mobile Attacks**

**What makes you vulnerable: employees accessing company data and networks via cell phones**

Hackers are well aware of the explosion of smartphone and tablet use and have created attacks specifically designed for mobile software. [_The Pegasus attack_](https://blog.lookout.com/lookout-trident-pegasus-enterprise-discovery) on Apple’s iOS software is a prime example. Pegasus infected iPhones through phishing text messages that asked recipients to click on a link inside the text message.

<p style="text-align: center;">
  <img style="width: 300px;" src="https://images.ctfassets.net/23aumh6u8s0i/1ii40f6m9VQ1rBmWpgY1pF/de53a4b3444b16e607d52ee34bb9933e/pegasus-mobile-attack-on-ios" alt="Example of Pegasus attack on Apple iOS mobile software."/>
</p>

[_Source_](https://www.hax4us.com/2017/03/hindi-english-smishing-brother-of.html)

Phishing text messages are composed to look legitimate, just as phishing e-mails are. With Pegasus, clicking the link triggered the installation of spyware capable of monitoring people through their camera and microphone. The software also copied all of their calendar, contact, and e-mail data.

Pegasus was an especially frightening cyberattack because it took advantage of [_“zero day” vulnerabilities_](https://www.huffingtonpost.co.uk/entry/what-is-the-pegasus-iphone-spyware-and-why-was-it-so-dangerous_uk_57c0043fe4b0ba22a4d3f930?guccounter=1), meaning there wasn’t any prior knowledge of the vulnerabilities in Apple’s iOS until Pegasus struck. Once infected, users had their login credentials stolen from WhatsApp, Gmail, and other sensitive communication applications.

_Solution: If a mobile phone or tablet has been breached, you need a Plan B. Make sure employees quickly change their passwords by using a professional password manager, such as [LastPass](https://www.lastpass.com/) or [Valt](https://valt.io/). Many employees secure critical information with easy-to-guess iterations of a single password. Encouraging length and complexity in all passwords going forward will make it difficult for hackers to access multiple areas at once._

## Additional Security for All Systems at the Login Stage

Good password policy and sound employee education are key; however, taking the next step with [secure login procedures](https://auth0.com/b2c-customer-identity-management) will add a new dimension of safety to your system. Specialized identity solutions providers can offer support with [multifactor authentication](https://auth0.com/docs/multifactor-authentication).

Tracking your users from the start will help eliminate fraud at its origin, helping provide a secure foundation to allow your team to scale.

<include src="asides/AboutAuth0" />


"usb-traps"