AXEL.org

Blog

Encryption: The Past, Present, and Future

Encryption is a hot topic these days. Governments worldwide are attempting to control it via legislation like the United States’ EARN IT Act, and it is the bane of law enforcement agencies everywhere. But, what’s the big deal about it? In this blog, we look to go over a brief history of the subject, the current state of affairs, and what the future holds.

The history

The word encryption derives from the Greek word kryptos,which means hidden. It is a way to store and share information privately so that only the intended recipient can understand its meaning.

Unsurprisingly, the need for discrete communication stretches far back into recorded history. To understand how the early forms of cryptography worked, first, we’ll define the most common methods ancient peoples used.

  • Transposition. A transposition cipher (code) is where the sender rearranges letters in a word to make them appear garbled to unknowing viewers. This rearrangement follows a predefined system only known to the sender and recipient. The recipient decodes the message using the predefined system and can then understand the message.
  • Substitution. A substitution cipher replaces characters with other characters according to predetermined rules. For example, all Es get turned into Rs, Ts into Bs, etc.

Ancient encryption

The most famous early form of encryption is used in the Old Testament of The Bible circa 500-600 B.C. Here the Hebrew writers use a substitution cipher known as Atbash[1]. Atbash simply reverses the order of the alphabet (A becomes Z and so on). The Book of Jeremiah contains passages where proper nouns are referred to only in Atbash.

Later, in 487 B.C., the Spartans used a transposition cipher called ‘scytale’ to communicate during military campaigns[2]. Here, they used a rod of a specific diameter and wrapped a piece of parchment with the encoded message around it. Once bound, it revealed the true meaning of the message.

Speaking of military operations, Julius Caesar favored a substitution cipher to give orders and receive updates from his generals in the field[3]. This method moved each letter three to the right (A becomes D, S becomes V, etc.)

These ciphers worked well until mathematicians began noticing patterns in the prevalence of certain characters in the 9th-century A.D[4]. They cracked the code, which resulted in the creation of more modern forms of cryptography.

From the 15th-century through WWII

Leon Battista created the first polyalphabetic cipher in Italy around 1467 A.D.[5]. Polyalphabetic ciphers use a combination of multiple alphabets, which dramatically increases encryption’s effectiveness. Batista also developed the cipher disc, a mechanical device that uses various concentric wheels with letters inscribed on them to encode and decode messages. It’s no wonder that he’s known as the ‘Father of Western Cryptology.’

Fast forward to the middle of the 19th century. Famous writer Edgar Allan Poe had readers send him ciphered messages, which he attempted to decode in a weekly paper[6]. It’s interesting to think about Poe sitting in his study taking a break from authoring classic tales to nerd out on some secret messages. Eventually, he even penned an essay on cryptography that the British Army used in World War I to break German ciphers. So, we’re lucky he had such a hobby!

World War II is when cryptography became a well-known issue. The Nazi Enigma machine was a highly complex encryption tool that used an electromechanical rotor system to scramble letter input by an attached keyboard.  Polish mathematicians had been able to replicate Enigma machines in 1932, but the British and French forces couldn’t decode German messages as late as 1939. The Allies brought in the Polish codebreakers, and by the time the war was in full effect, they could decipher the Nazi’s secret messages. Changes to the machine and codes throughout the war still made it very difficult, however. This led to Britain’s Alan Turing’s innovative decryption techniques[7] that may have shifted the war in the Allies’ favor.  

Modern encryption

That brings us to the modern era. Cryptography really matured as a field of study with the advent of computer technology. Instead of relying on complex mechanical devices, computers could use mathematical equations and algorithms to create better encryption. The two common algorithms used today are the Symmetric Key Algorithm and the Public Key Algorithm.

Symmetric Key Algorithm. In cryptography, keys are the mathematical parameters used to encrypt and decrypt data. The Symmetric Key Algorithm utilizes the same key for encoding and decoding. The method can encrypt information in chunks (called a block cipher) or by individual characters. Examples of the Symmetric Key Algorithm in practice include:

  • DES (Data Encryption Standard). Developed in 1975, DES became the Gold Standard in encryption for a period. It is a block cipher that uses a 56-bit key. While this was suitable in the 70s and 80s, it is not used anymore due to advancements in computer processing power. Computers today could brute force crack a 56-bit key in a matter of hours.
  • AES (Advanced Encryption Standard). AES builds off the DES algorithm and makes it significantly more secure. It has variants that feature 128-bit, 256-bit, and 512-bit keys. AES 256-bit encryption is the official standard for U.S. government agencies such as the NSA. Incidentally, it is the algorithm AXEL Go uses to encrypt file passwords. Experts estimate it would take billions of years to brute force crack[8].

Public Key Algorithm.  Public Key Algorithms, on the other hand, use two different keys for encryption and decryption. This provides even safer encryption and is used in the RSA token system, digital signatures, and blockchain technology.

The future of encryption

While modern encryption is fantastic at protecting data against commonly-used cracking methods, it isn’t completely future-proof. Analysts expect that if quantum computing becomes powerful enough, the algorithms used today could be easily cracked[9]. This is concerning, but it seems as if the industry is aware of the potential problem. First off, the prototype quantum computers of today aren’t capable of such feats, and the tech is tricky in general. It’s unknown if quantum computers will ever get to the point of being useful. Even if it happens, however, there are already quantum-safe encryption algorithms. Software developers will need to update their products accordingly before these quantum computers become commonplace and readily available.

AXEL – At the cutting edge of technology

AXEL developers are at the forefront of the privacy technology movement. That’s why our secure, private file-sharing and cloud storage software AXEL Go already incorporates military-grade AES 256-Bit encryption and blockchain technology. Undoubtedly, we will keep up with the times and shift our encryption strategy as it becomes evident we need to upgrade. We’re always looking for new ways to improve the security and privacy of our platform.

Sign up for a free AXEL Go account today and receive a 14-day trial of our Premium Service with all features unlocked. You will love the peace of mind proper data security affords you. Join the privacy revolution today and download AXEL Go.

[1] Jenny Kile, “The Atbash Cipher and Jeremiah 51:1”, MysteriousWritings.com, https://mysteriouswritings.com/the-atbash-cipher-and-jeremiah-511/

[2] Milica Djekic, “Scytale – Cryptograph of the Ancient Sparta”, OzScience.com, Nov. 11, 2013, http://ozscience.com/technology/a-scytale-cryptography-of-the-ancient-sparta/

[3] Jason Andress, “The Basics of Information Security”, ScienceDirect.com, 2014, https://www.sciencedirect.com/topics/computer-science/caesar-cipher

[4] “Code Breaking a Thousand Years Ago”, 1001inventions.com, https://www.1001inventions.com/feature/code-breaking/

[5] William Servos, “The Alberti Cipher, trincoll.edu, April 25, 2010, http://www.cs.trincoll.edu/~crypto/historical/alberti.html

[6] R. Morelli, “Edgar Allan Poe and Cryptography”, trincoll.edu, May 3, 2018, http://www.cs.trincoll.edu/~crypto/historical/poe.html#:~:text=Like%20other%20literary%20figures%20of,application%20of%20reason%20and%20logic.

[7] “How Alan Turing Cracked The Enigma Code”, IWM.org.uk, https://www.iwm.org.uk/history/how-alan-turing-cracked-the-enigma-code

[8] Mohit Arora, “How secure is AES against brute force attacks?”, EETimes.com, May 7, 2012, https://www.eetimes.com/how-secure-is-aes-against-brute-force-attacks/

[9] Stephen Shankland, “Quantum computers could crack today’s encrypted messages. That’s a problem”, CNet.com, May 24, 2021, https://www.cnet.com/news/quantum-computers-could-crack-todays-encrypted-messages-thats-a-problem/

The Jones Day Law Firm Data Breach Serves as a Warning for Others

In December and January, the technology company Accellion experienced a hack to the Accellion FTA (File Transfer Appliance), a file-sharing program aimed at enterprise customers. Since then, multiple organizations have reported data breaches linked to the software, including the large law firm Jones Day. This created quite the storm for the firm and some high-profile customers like the City of Chicago. Here, we’ll go over the hack and discuss the lessons organizations should learn from the situation.

How it happened

According to a report by the cybersecurity company FireEye[1], the initial attacks occurred via a malicious SQL injection that allowed the criminals to install a web shell on Accellion servers. Then, the hackers could run malware programs at will via the web shell. If you remember, this is very similar to the methods employed by the group behind the infamous SolarWinds hack, covered by us here and here.

Who was behind it?

Cybersecurity experts attribute the attack to the CL0P ransomware gang[2] due to increased activity on the group’s dark website that shames organizations into paying the ransom. Analysts conclude that the victims implicated on the site line up with the known victims of this breach.

The threat actors used the Accellion FTA exploits to steal data from over 100 organizations, including the Australian Securities and Investments Commission, grocery store chain Kroger, the University of Colorado, and the Jones Day law firm. We’ll be specifically looking at the Jones Day state of affairs, as it has become a juicy story.

Jones Day

The Jones Day Law Firm is a major firm headquartered in Cleveland, Ohio, employing over 2500 attorneys and serving thousands of clients globally. In February 2021, representatives confirmed the company was one of those affected by the Accellion FTA breach. Law firms have significantly more to worry about from data breaches than, say, Kroger. This is due to the sheer amount of confidential information that passes between attorneys, legal assistants, clients, and court officials. Jones Day says its internal systems weren’t compromised, but the distinction is a bit moot, given what ended up being leaked.

The City of Chicago

The most interesting insights revealed in breach so far come from leaked correspondence between Jones Day and Chicago government officials. The City of Chicago was not a formal client of the firm, but Jones Day attorneys offered advice on many legal situations. The hackers stole over 85GB of emails, images, and documents sent between the two entities.

Neither Jones Day nor the City of Chicago paid the ransom, and these files were made available on the Dark Web. The Wikileaks-esque whistleblower website DDOSecret.com released a small portion of the haul publicly and has sent the complete data set to journalists. What has been reported on offers a fascinating look behind the political curtain of America’s third-largest city:

  • The Chicago Police Department created a secret drone surveillance program using money from seized assets sold after criminal investigations[3]. The budget for the drone initiative totaled nearly $8 million. The police used it to aid in missing persons cases and anti-terrorism strategies.
  • Mayor Lori Lightfoot attempted to distance herself from a campaign promise regarding police reformation[4].
  • Mayor Lightfoot and Illinois Governor J.B. Pritzker clashed on COVID lockdown restrictions on indoor dining.

Clandestine drone programs aside, there haven’t been many earth-shattering bombshells. Still, it’s embarrassing for both the City of Chicago and Jones Day. Mayor Lightfoot has called into question the authenticity of the emails[5], stopping short of outright denial.

It seems unlikely that a hacker group would go through the trouble of fabricating hundreds of thousands of documents to expose what amounts to normal everyday political shenanigans, but we’ll see how it shakes out.

The lesson

Jones Day and 100+ other affected organizations could have saved themselves the public embarrassment and loss of trust if they used better data transfer solutions. The Accellion FTA was a legacy file-sharing platform left largely unsupported. However, the inertia of technological adoption resulted in massive companies leaving themselves open to a data breach. Given the resources these organizations have at their disposal, the risks of sticking with old tech are unacceptable.

It’s especially objectional for a law firm like Jones Day. Their entire business is keeping confidential legal information away from the public’s eyes. While they may have the clout to recover from this issue, smaller firms would be devastated.

The takeaway for law firms and solo practices should be; take data security very seriously! Don’t rely on outdated platforms or downright insecure solutions like email attachments to share and store documents. Vet the provider you end up going with to ensure they will support the solution for the foreseeable future and continue to provide security patches along with new privacy features. Not doing so leaves you susceptible to catastrophic scenarios.

The right choice

Our file-sharing and cloud storage platform AXEL Go prevents data breaches. It’s the perfect solution for those working within targeted industries such as the legal sector. Our development team built AXEL Go from a framework of security and privacy. It combines secure blockchain technology, decentralized IPFS implementation, and military-grade file encryption to keep the most sensitive files safe.

To learn more, please visit AXELGo.app and sign up for a free 14-day trial of our Premium service. You get to try out all of the innovative features, such as Secure Fetch and storage encryption. Our team is always hard at work improving the platform and releasing updates. Once you see the AXEL difference, you’ll never go back to insecure data transfer systems again.

[1] Andrew Moore, Genevieve Stark, Isif Ibrahima, Van Ta, Kimberly Goody, “Cyber Criminal Exploit Accellion FTA for Data Theft and Extortion”, FireEye.com, Feb. 22, 2021, https://www.fireeye.com/blog/threat-research/2021/02/accellion-fta-exploited-for-data-theft-and-extortion.html

[2] Tara Seals, “Accellion FTA Zero-Day Attacks Show Ties to Clop Ransomware, FIN11”, ThreatPost.com, Feb. 22, 2021, https://threatpost.com/accellion-zero-day-attacks-clop-ransomware-fin11/164150/

[3] Tom Schuba, Frank Main, “CPD launched secret drone program with off-the-books cash”, Chicago Sun Times, May 12, 2021, https://chicago.suntimes.com/city-hall/2021/5/11/22425299/cpd-chicago-police-drone-secret-emails-hack-lori-lightfoot-dodsecrets-city-hall

[4] Gregory Pratt, “Computer hackers stole thousands of Lightfoot administration emails. Here’s a look at some of what they leaked online.”, Chicago Tribune, May 14, 2021, https://www.chicagotribune.com/politics/ct-lightfoot-administration-hacked-emails-closer-look-20210514-havyv352lfegrklmfi76a25wfi-story.html

[5] Bernie Tafoya, “Lightfoot questions legitimacy of city emails made public after hack”, WBBM NewsRadio 780 AM, May 11, 2021, https://www.audacy.com/wbbm780/news/local/mayor-questions-legitimacy-of-emails-made-public-after-hack

Ransom-Wars: The Task Force Awakens

Ransomware is a significant societal problem. If you’re unaware of how it works, read our previous blog on the topic.  2020 was a banner year for ransomware gangs, as analysts estimate they brought in approximately $350 million, with the average payment exceeding $315,000[1]. It’s gotten so concerning that 60+ government agencies and industry leaders formed a task force to tackle the situation.

Key members include the United States Department of Justice, the FBI, the Department of Homeland Security, Europol, Microsoft, Amazon, Cisco, and more. They recently published an 81-page document that discusses the issue and creates a framework for dealing with ransomware[2]. Lucky for you, we read it, so you don’t have to. Here’s the easily digestible summary.

Definition of ransomware

The first quarter or so of the report focuses on defining ransomware and the tactics threat actors use. These are covered in our previous blog if you’re interested. To summarize quickly, ransomware is a type of malware malicious agents install on high-priority computer systems, typically governmental organizations or successful businesses.

Once they infect these networks, the malware moves throughout them and encrypts or exfiltrates the files it finds. A ransom is given that the organizations must pay to decrypt their data or prevent the hackers from leaking it on the internet.

Some rather nasty gangs require double ransoms, one for decryption, the other for not leaking the information. It’s known as double-extortion and is becoming a popular tactic. Now, onto the proposed framework.

The framework for fighting ransomware

We should note that this document’s crux lies in the need for international cooperation for its implementation. Although the United States suffers the majority of ransomware attacks, it is a global problem. The perpetrators come from many different countries such as Russia, Iran, and North Korea, which have zero incentive to stop. This means the rest of the global community needs to agree to the framework for it to work.

Goal 1: Deter

The first goal of the framework is to prevent as many ransomware infections as possible. The document outlines various steps the world must take to do so:

Establish an international ransomware coalition. Governments and corporations around the world have to come together. The document suggests that leaders must communicate regularly about the threats to keep the global community informed about new groups and malware variants. It outlines that nations should create “investigation hub” networks for data sharing and analysis.

The U.S. Government should prioritize ransomware policy. The task force wants the United States, in particular, to get tough on ransomware. It proposes the intelligence community designate it as a formal national security threat and for the DoJ to prosecute ransomware cases more aggressively. Furthermore, it wants the U.S. to levy sanctions against countries that harbor ransomware gangs to increase pressure for cooperation.

Goal 2: Disrupt

The second objective is to disrupt the current business of ransomware gangs and make it a less profitable endeavor. The task force recommends:

Crack down on cryptocurrency markets. Ransomware groups force victims to pay nearly all ransom payments in cryptocurrency.  They do this because cryptocurrencies are borderless and can be challenging to track. There are anonymous exchanges, privacy coins, and techniques to exchange the assets from cryptocurrency to cryptocurrency to obfuscate the origins. The report suggests governments provide more of a regulatory framework to this market. It wants exchanges to follow current anti-money laundering laws to which other financial institutions must adhere.

Create an insurance company consortium. Insurance companies do offer protective plans against ransomware. The task force would like to see collaboration and data sharing between these organizations. It claims this could reduce payments to sanctioned or terrorist bodies since they could use the mass amount of information to get a clearer picture of the groups demanding the ransoms.

Target infrastructure used by criminals. Ransomware campaigns require significant computer infrastructure. The report proposes international cooperation that targets these systems and brings them down.

Goal 3: Help

Unfortunately, many organizations aren’t well prepared for ransomware attacks. The fact is that most organizations over a certain size will be targeted sooner than later. The task force recognizes this and wants to provide these organizations with more information and better toolsets to deal with attacks. It advises:

Create and highlight complementary materials for the framework’s adoption. There are a significant amount of readily available materials about ransomware prevention and mitigation. The task force wants to promote these existing materials and create new ones to fill in any information gaps. The new materials should be geared toward organizational leaders and include specific implementation procedures.

Require government agencies to follow guidelines and incentivize private businesses. The task force wants to include ransomware-specific guidelines in existing cyber-hygiene standards and require government agencies to follow them. Furthermore, it supports creating more grants while alleviating fines and taxes for private companies that follow the framework. This would make a strong incentive for everyone to be on board.

Goal 4: Respond

Organizations need a more effective response after a ransomware infection. This goal aims to aid businesses and agencies after an incident. The task force recommends:

Increased support for victims. Ransomware is destructive and could be incredibly dangerous if it affected critical infrastructure or health-based organizations such as hospitals. The task force wants to set up a relief fund that would help funnel resources quickly if such a situation ever occurs.

Encouragement to report ransomware.  Ransomware attacks are embarrassing for companies, and many don’t even report them. This stops the flow of information and hinders future efforts to predict and prevent attacks. The task force feels proper encouragement and education materials are crucial to getting an accurate, holistic picture of the insidious malware.

Educate organizations about payment alternatives. The truth is, if organizations stopped paying the ransoms, the income would dry up for ransomware gangs, and it would no longer be a worthwhile endeavor. This is easier said than done, as some data is very sensitive and perhaps not backed up offline. Still, the task force urges companies to look at the alternatives to paying whenever possible.

Potential roadblocks

These all sound like good suggestions and would actually go a long way in fighting ransomware if implemented adequately. However, there are some weaknesses to consider:

Privacy concerns. If the world at large enacts this framework, governments and businesses will share a lot of data. As with most scenarios regarding Big Data collection, this has a good chance of going awry from a privacy standpoint. Is it worth it? A detailed cost-benefit analysis would have to be done, but AXEL believes the possibility of abuse is too great as-is. The fact is, even if governments gave privacy guarantees, they don’t mean much.

Inefficient bureaucracy. The task force recommends multiple new governmental and private-public partnership organizations created to combat ransomware. It’s admirable to put so much thought into methods to take on the problem, but additional levels of bureaucracy may prove (as they typically do) to be inefficient.

Data security

AXEL believes that basic education about cybersecurity best practices for all members of an organization is the best way to prevent ransomware infections currently. While all systems have technical weaknesses, the biggest weakness tends to be the human factor. Teaching employees to be vigilant about ransomware and understand the risks entirely is effective.

Another part of the equation is data security. Are you storing and sharing data securely? If not, or you aren’t sure, you should try AXEL Go. AXEL Go utilizes multiple layers of security to protect data from malicious agents. You can read more about our use of technology and download the app to try for yourself at AXELGo.app. Sign up today and receive a free 14-day trial of our Premium service.

[1] “Ransomware Skyrocketed in 2020, But There May Be Fewer Culprits Than You Think”, ChainAnalysis.com, Jan. 26, 2021, https://blog.chainalysis.com/reports/ransomware-ecosystem-crypto-crime-2021

[2] Ransomware Task Force, “Combatting Ransomware”, SecurityAndTechnology.org, April 2021, https://securityandtechnology.org/wp-content/uploads/2021/04/IST-Ransomware-Task-Force-Report.pdf

Apple and Facebook Fight Over Privacy

Apple and Facebook are currently ranked 1 and 6 respectively in the list of biggest companies by market cap[1]. These tech behemoths wield immense influence in both the business and social spheres. They also have different, seemingly opposing views on the nature of privacy in today’s society. These disparate philosophies have increased tensions between the two tech giants, and recently it’s escalated. We’ll break down the history and the sources of the standoff.

A brief history

Things weren’t always so frosty between the organizations. In fact, according to a 2012 biography, Apple CEO Steve Jobs admired Facebook CEO, Mark Zuckerberg[2]. So much so, it was a driving force in the reluctance of Apple to start a competing social network. However, after the death of Jobs in 2011, things cooled off considerably when current CEO Tim Cook took over.

Perhaps sensing the way things were going in the industry, Cook came out in 2014 with an open letter that took indirect jabs at Facebook and Google[3]. In it, he claimed Apple was not in the business of creating detailed user profiles on individuals through the use of data mining. While he did not mention his competitors directly, it was obvious who he was denouncing.

That same year, Zuckerberg fired back in an interview with TIME Magazine[4], stating

“A frustration I have is that a lot of people increasingly seem to equate an advertising business model with somehow being out of alignment with you customers. I think it’s the most ridiculous concept. What, you think because you’re paying Apple that you’re somehow in alignment with them? If you were in alignment with them, then they’d make their products a lot cheaper!”

We’d recommend reading this article. Perhaps everyone was a bit naïve at the time, but re-reading it through the lens of 2021 with an understanding of the path Facebook took, the plan Zuckerberg outlined seems much more nefarious and a good example of real-life supervillainy. What could go wrong with the CEO of the world’s most invasive social platform wanting to bring internet connection to the entirety of the world?

We digress. Throughout the next seven years, the two CEOs traded barbs on issues such as the Cambridge Analytica scandal and Apple’s monopolistic control of its App Store. In the end, the arguments usually boiled down to Tim Cook accusing Facebook of invading users’ privacies and Zuckerberg saying Apple products cost too much or that the company is an unfair gatekeeper.

We tend to fall on Cook’s side of the argument. It’s true Apple products cost significantly more than competing hardware solutions. But, as we outlined in a previous blog about free software, trading privacy for free or cheap products has serious drawbacks. Now, back to the feud.  

Tensions boil over

Fast-forward to today. In late 2020, Apple started requiring software on the App Store to come with informative “privacy labels” that clearly state the data the app collects on its users. This was great news for AXEL, but not so much for Facebook. Facebook Messenger alone has a privacy label that reads more like a novel than a brief overview[5].

The labels, combined with the most recent update, have sent Facebook reeling for solutions. The latest update goes a step farther than labels and provides users with the oft-talked-about ‘Opt-In’ scenario regarding data collection[6]. ‘Opt-In’ is a concept that requires users to agree to corporate data collection formally. This is a major step forward in the fight for digital privacy rights. It’s much better than current United States privacy regulations in states such as California and Virginia. Those pieces of legislation mandate companies provide an ‘Opt-Out’ option. While better than nothing, the fact is that consumers are busy. They don’t have the knowledge or desire to scroll through layers of confusing websites to exercise their right to opt-out.

This makes Opt-In the preferred way to offer privacy. It makes privacy the default, which will vastly increase the number of people exiting the corporate surveillance scheme. Unsurprisingly, companies like Facebook are not happy about this! Personalized advertising is the company’s lifeblood, and without user data to gather and analyze, ad revenues will likely fall.

Facebook’s response

Facebook hasn’t taken these changes lying down. Their argument centers around the effects felt by small businesses due to Apple’s changes. Facebook frames its data collection around its usefulness to small businesses. Without the ability to target people most likely to buy, these companies will feel the brunt of the impact, causing many of them to close.

Facebook started a public relations blitz, using television commercials and full-page ads in popular newspapers[7] to drive home the point. It has received some mockery for this in the mainstream media. It certainly does appear to be a rather transparent way to further its own goals while seeming to have more profound principles.

Facebook also raised another issue, and though it didn’t receive as much attention from the media, it probably has more merit. They claim that Apple’s recent privacy push isn’t out of any benevolent intentions for consumers but rather greed. Apple receives anywhere from 15-30% of App Store sales, depending on the developers’ overall revenue. By giving consumers the choice to opt into data collection, they must know that most users will decline. This could cause a shift from free apps that generate revenue based on advertising to more paid apps. In turn, Apple receives more money from downloads since more of them are paid. If true, it’s a very sneaky way for the tech manufacturer to make more money while playing the good guy.

The reality is that both Facebook and Apple are profit-driven mega-corporations looking to protect their businesses. You can’t blame either of them for this feud, although it seems obvious that Apple comes out ahead from a public utility perspective. Whatever the root cause, any initiative to substantially increase digital privacy is a good thing in our book.

AXEL’s commitment

AXEL is dedicated to fighting for digital privacy rights for everyone. The concept of data custody and forging lasting trust between consumers and technology is embedded into our corporate philosophy. We develop our products and services to live up to these lofty ideals.

If you are looking for a privacy-focused cloud storage and file-sharing platform, try AXEL Go free for 14-days. During the trial period, you receive all Premium features, including removing file-size restrictions, Secure Fetch functionality, and storage encryption. AXEL never collects personal information to sell to third parties or mines your content for advertising. We’re an alternative tech company you can trust. Secure your files. Secure your digital future with AXEL.

[1] “Largest Companies by Market Cap”, CompaniesMarketCap.com, April 30, 2021, https://companiesmarketcap.com/

[2] Emil Protalinski, “Steve Jobs admired Zuckerberg too much to compete with him”, CNET.com, July 17, 2012, https://www.cnet.com/news/steve-jobs-admired-zuckerberg-too-much-to-compete-with-him/

[3] Steve Musil, “Tim Cook explains Apple’s privacy policies in open letter”, CNET.com, Sept. 17, 2014, https://www.cnet.com/news/tim-cook-explains-apples-privacy-policies-in-open-letter/

[4] Lev Grossman, “Inside Facebook’s Plan to Wire the World”, Time.com, Dec. 15, 2014, https://time.com/facebook-world-plan/

[5] Ben Lovejoy, “App privacy labels show stark contrasts among messaging apps”, 9to5mac.com, Jan. 4, 2021, https://9to5mac.com/2021/01/04/app-privacy-labels-messaging-apps/

[6] Ian Sherr, “Apple’s privacy battle with Facebook just became all-out war”, CNET.com, April 26, 2021, https://www.cnet.com/news/apples-privacy-battle-with-facebook-just-became-all-out-war/

[7] Megan Graham, “Facebook blasts Apple in new ads over iPhone privacy change”, CNBC, Dec. 16, 2020, https://www.cnbc.com/2020/12/16/facebook-blasts-apple-in-new-ads-over-iphone-privacy-change-.html

What Else We’ve Learned About the SolarWinds Data Breach

In January, we covered a massive supply-chain data breach known as the SolarWinds attack. To get a broad overview of the incident, how the malicious agents carried out the hack, and the known victims, please read our coverage. Over the past four months, there have been new developments in the story that warrant a follow-up. Here, we go over these updates and discuss the potential for lasting fallout.

A brief synopsis

In December 2020, cybersecurity firm FireEye reported a significant flaw in the SolarWinds Orion database management software suite. When the dust settled, experts found that over 18,000 organizations had inadvertently installed a backdoor for an Advanced Persistent Threat (APT) group, likely Russian in origin. These state-sponsored actors infiltrated major corporations and high-level United States governmental agencies alike. Officials believe it to be the most widespread digital espionage campaign ever carried out against the United States. So, what have we found out since then?

More sophisticated than initially thought

From the very beginning, cybersec professionals knew the culprits were sophisticated and that the program’s scope was enormous. As it turns out, however, initial estimates seemed to have underestimated it. According to a recent analysis by RiskIQ, the infrastructure used by the threat actors was at least 56% larger than originally thought[1].

This implies the state hackers had access to significantly more computing power and probably targeted even more organizations than the known 18,000 victims. The same report also concluded that the use of United States-based infrastructure during the initial attack stage prevented the National Security Agency (NSA) from noticing the situation due to stricter laws against domestic surveillance.

Russians officially blamed

United States intelligence agencies have always blamed Russia for the attack, but it turned into more than an accusation when President Joe Biden and the United States formally sanctioned the adversarial country on March 15[2]. Provisions of the sanctions include:

  • Forbidding U.S. banks from buying bonds from or lending money to Russia’s national financial institutions after June 14.
  • Expelling 10 Russian diplomats accused of being intelligence agents from the United States.
  • Sanctioning six technology companies in Russia accused of supporting intelligence agencies.

The sanctions significantly ratchet up tensions between the two nations and mark a major departure from standard espionage protocol. Previously, the United States and other countries assumed cyber espionage campaigns were always underway from their enemies, and their enemies were under similar assumptions. This meant that there was an implicit understanding that everyone is spying on everyone else, and nobody felt real consequences for it. The sanctions set a new precedent that could result in escalation rather than diplomacy. Although, Russia pulled back troops from the Ukrainian border after the sanctions[3], so perhaps the message landed as intended. Only time will tell what ramifications this act has, but hopefully, it doesn’t increase the divide between the two largest nuclear powers.

Concurrent Chinese involvement

Although analysts blame Russia for the initial breach, it appears like Chinese state hackers also took advantage of the situation[4]. According to a report by Secureworks, some malicious agents used tactics similar to those employed by the Chinese APT, SPIRAL[5]. Furthermore, during the intrusion, the group accidentally revealed its IP, which originated from China. So, while sanctions only targeted Russia, there is evidence that China played a role too.

Of course, as we talked about in the original SolarWinds blog, it’s exceedingly difficult to analyze blame with a hundred percent certainty. State-sponsored digital espionage groups are adept at covering their tracks and obfuscating origins. And, while the United States government seems positive the Russians were the main culprits, hard evidence of this assertion hasn’t been made public. Not to mention the United States government has been wrong about some pretty bold claims before. We may never know the full truth.

Congress grills Microsoft

Interestingly, the company in the hottest water over the whole snafu isn’t SolarWinds; it’s Microsoft. Probably due to its high-profile nature, the U.S. Congress set its sights on the tech behemoth[6]. This is because, after the breach’s first stage, the hackers exploited Microsoft products and stole sensitive emails and other data from thousands of organizations.

Microsoft itself had its source code exposed to the hackers. Since source code is the lifeblood of a tech company, it shows exactly how all-encompassing the breach was. It also proves a crucial point; no matter how secure a system is, nothing can be completely safe from ill-intentioned cyberspies with the backing of an entire country’s resources. So, although House members assuredly loved grandstanding about the holes in Microsoft’s security, the truth is more complex and nuanced.

White House ramps down recovery efforts

This brings us to the conclusion of the saga. On April 19, the White House announced that several national agencies such as the FBI, CISA, and NSA would soon begin ramping down their efforts regarding SolarWinds. Combined with the Russian sanctions, it signals that the U.S. Government considers the incident largely settled. China appears unlikely to receive any formal retaliation. Hopefully, the most significant data breach of our times serves as a lesson for the future of cybersecurity. Undoubtedly similar incidents will occur in the future, but perhaps mitigation policies will improve, and potential damages will be reduced.

Security is a personal responsibility

If there’s one takeaway everyone should have about SolarWinds, it’s that relying on Big Tech’s security policies is a mistake. People should do a bit of research to find redundant cybersecurity methods for their sensitive data.

You can protect your confidential files by ditching cloud drives like Dropbox, OneDrive, and Google Drive and switch to AXEL Go. AXEL Go utilizes our decentralized, distributed files sharing network backed by blockchain and the InterPlanetary File System. This ensures your documents aren’t stored in one place with a single point of failure.

Additionally, every file you transfer via the AXEL Network gets “digitally shredded” and distributed to scattered server nodes. This means even if a malicious agent compromised a server, they wouldn’t have access to the complete file. Documents are only reconfigured for the initial user and any recipients. This system, combined with military-grade encryption, provides multiple layers of security for AXEL Go users.

You can try AXEL Go Premium with all features unlocked free for 14-days. Sign up today and see how AXEL can improve your workflow and harden your organization’s cybersecurity.

[1] “SolarWinds: Advancing the Story”, RiskIq.com, April 22, 2021, https://community.riskiq.com/article/9a515637

[2] Morgan Chalfant, Maggie Miller, “Biden administration sanctions Russia for SolarWinds hack, election interference”, April 15, 2021, https://thehill.com/homenews/administration/548367-biden-administration-unveils-sweeping-sanctions-on-russia?rl=1

[3] “Russia to pull troops back from near Ukraine”, BBC, April 22, 2021, https://www.bbc.com/news/world-europe-56842763

[4] Dan Goodin, “Chinese hackers targeted SolarWinds customers in parallel with Russian op”, Ars Technica, March 8, 2021, https://arstechnica.com/gadgets/2021/03/chinese-hackers-targeted-solarwinds-customers-in-parallel-with-russian-op/

[5] Counter Threat Unit Research Team, “SUPERNOVA Web Shell Deployment Linked to SPIRAL Threat Group”, Secureworks.com, March 8, 2021, https://www.secureworks.com/blog/supernova-web-shell-deployment-linked-to-spiral-threat-group

[6] Frank Bajak, “SolarWinds hacking campaign puts Microsoft in the hot seat”, The Associated Press, April 17, 2021, https://apnews.com/article/business-technology-government-and-politics-f51e53523312b87121146de8fd7c0020

Common Pitfalls when Attorneys Adopt New Technology

The legal industry faces unique challenges to the adoption of new technology and digital transformation efforts. This article will discuss the most typical obstacles and introduce a framework that will help firms analyze whether a new tech solution is likely to integrate successfully.

Impediments to technological progress in the legal sector

Time investment. As you likely know, being an attorney isn’t a regular 9-5 job. A recent survey claims lawyers work an average of 66 hours per week[1]. That’s like a typical full-time and part-time job combined. So, all but the largest firms with dedicated IT teams can’t afford to spend too much time implementing new technology. Small firms and solo practitioners simply don’t have the resources to research, test, and deploy complex tech solutions.

Cybersecurity and confidentiality concerns. Legal professionals have needs that go above and beyond the average office worker when it comes to digitization. Due to attorney-client privilege and the ethical responsibility to maintain data security, attorneys need to be extra careful when upgrading their technology. They may have to look for approved ‘legal tech’ solutions when off-the-shelf consumer products don’t meet these standards.

The “billable hour” issue. Although there may be a shift in billing practices in a few firms, most still rely on the time-tested “billable hour” method. It may seem like a paradox, but the increase in efficiency new tech can bring might actually reduce a firm’s profitability due to fewer billable hours plus the cost (initial and ongoing) of the technology itself. While an increase in clients due to more free time could offset this problem, the demand for legal services, especially in less populated regions, probably won’t rise at the same rate.

The partnership model. The traditional hierarchy of law firms puts the “partners” at the top. Depending on the organization’s size, many decision-makers would need to approve any new legal tech initiative. This alone makes it an uphill battle, but add in the fact that partners tend to be older people who may not see technological advancement as a priority, and it becomes a serious deterrent. Obviously, this is a much more significant obstacle at larger firms, but any practice will multiple partners could face a difficult situation.

The “ignorance is bliss” dilemma. Solo practitioners and small firms don’t have the resources of their more massive brethren. This means that tech policies and solutions mega-firms implement have a hard time trickling down. Unfortunately, this can lead to solo practitioners developing an “ignorhttps://www.axel.org/the-10-worst-data-breaches-of-the-decade/ance is bliss” mantra, even if they don’t necessarily believe that to be the case.

For example, whereas large organizations may completely ban the use of insecure applications such as Dropbox for confidential file transfer or storage, smaller practices could still use them due to familiarity. They don’t search out current best practices for data storage because they may fear switching and disrupting their workflow.

While this is an understandable reaction, we urge attorneys to push through this bias for their own sake. After all, if a serious data breach occurs and the lawyer has not lived up to their ethical responsibilities, it becomes an even worse situation.

The innovation-decision process

We recommend running through the innovation-decision process before making conclusions about a particular technology’s viability for your firm. This process goes as follows:

  1. Assess comparative advantage. Does the new technology offer a substantial upgrade to your current systems? Define these advantages and review the overall impact they will have.
  2. Analyze compatibility. Does the solution fit into your existing workflow? If not, what resources will you need to allocate to adapt your business practices?
  3. Consider complexity. If you do need to adapt, calculate the cost-benefit analysis (not just financial, but also psychological) of doing so. Will it be a complicated endeavor? Do the results outweigh these complexities?
  4. Evaluate trialability. See if the vendor offers any sort of trial or demo. You can test out the solution, receive critical feedback and preliminary effectiveness metrics before committing to the entire project.

If you go through this process and discern that the tech is worth using, you will be much more confident in the solution and have a greater chance for success.

Your firm and AXEL Go

While the decision will still be challenging in many instances, sometimes the Universe serves up a no-brainer. AXEL Go is a secure, private file-sharing and cloud storage solution that overcomes the common obstacles and scores well on the innovation-decision process.

With the sudden shift toward working remotely, many attorneys find themselves in need of an easy-to-use file-sharing application that can fit seamlessly into their legacy workflow while providing more robust data security. AXEL Go is the perfect solution for any such lawyer. It has many innovative advantages, including:

  • Industry-leading security. AXEL Go runs on a secure, decentralized network that features blockchain integration and file encryption. Documents stored on the network go through a process of “digital shredding,” where only the uploader and recipient (if there is one) have access to the complete file.
  • Secure Fetch. Think of it as a digital courier. You send a secure, encrypted link to a recipient and request certain sensitive documents. They upload the necessary files, and you receive a notification for download. Recipients do not need AXEL Go accounts, meaning you don’t have to badger clients or colleagues to sign up for new services or software. You get to meet data security guidelines without any hassle or inconvenience.
  • Microsoft Outlook integration. You can now send confidential data via email without having to rely on insecure attachments. Using our Outlook plugin, you can send fortified AXEL Go links directly in an email with the click of a button. It’s a simple process that fits within traditional workflows.

With partnerships with the State Bars of states such as Connecticut, Florida, Nevada, and Georgia, it’s fair to say the legal community sees the unique value proposition AXEL Go offers.

According to a 2021 survey by ALM[2], 56% of legal teams consider “data privacy and security” as their primary focus for 2021. It makes sense when you understand the high probability of attempted hacks and data breaches every firm faces today. Don’t just wait around waiting for the inevitable. Be proactive and protect your most sensitive information with AXEL Go.

If you’re interested in seeing it in action, you can enjoy a completely unlocked trial of our Premium service for 14-days. Sign up today and see the AXEL Go difference for yourself.

[1] “How Many Hours A Week Does A Lawyer Work?”, careerigniter.com, https://www.careerigniter.com/questions/how-many-hours-a-week-does-a-lawyer-work/

[2] “What Do Legal Professionals Expect From 2021?”, Mitratech.com, 2021, https://mitratech.com/resource-hub/whitepapers/alm-survey-legal-tech-plans-2021/