Ireland 'still playing catch-up' in funding cyber security
Cyber crime is a highly organised international business. File Picture: iStock
Ireland is “still playing catch-up” in cyber security and the attack on the phone of Foreign Affairs Minister Simon Coveney illustrates the threat that is out there, a cyber expert has said.
While welcoming long-awaited moves to invest in the area, Brian Honan said that much more resources need to be ploughed into the State’s cyber crime and cyber security agencies.
The former cyber security advisor to Europol expressed concern at the differing official reports on the nature of the attack on the phone of Mr Coveney, including that it had been 'hacked'.
Mr Honan’s comments come as details emerged on the success of a Garda investigation into the cyber gang behind the assault on the HSE systems earlier this year.
The Garda National Cyber Crime Bureau (GNCCB) said it had seized the technical infrastructure of the outfit — thereby preventing or disrupting over 750 other cyber attacks — and are making progress in identifying the gang members.
Mr Honan said the initial reason given for the deletion of texts by Mr Coveney in relation to the appointment of Katherine Zappone to a UN role — that it was done to free up space on his phone — “didn’t make sense”.
He said that it might make sense if video files or photographs were being deleted to create more storage, but not texts.
On the second reason that was given — that his phone had been hacked last year — Mr Honan said there is a big difference between a phone being hacked and a phone being phished.
“This is where terminology gets confusing,” he said.
“People say they’ve got hacked, but what happened is they got a phishing email. It looks like a genuine email, say from a bank. You click on the link in the message, you are brought to a site, type in your account and password.
"Criminals now have your user ID and password and can log in as you. People say my phone was hacked, but what has happened is their account details have been stolen from them.
"Typically, it wouldn’t lead to any compromise of the device, it’s a compromise of your account.”
Mr Honan, chief executive of bhconsulting, said that from media reports it appears that the minister had a Telegram account — a social media messaging system — and that criminals knew his phone number and, it appeared, through phishing, accessed his password to the account.
He said it has been reported that messages were sent out from this account to some of his contacts — who were other EU foreign ministers — looking for money.
“So, that’s a typical scam that would happen, the criminals got details and sent normal scam messages.”
He said he didn’t think it was espionage by a hostile, or friendly, state. It would be a “much more serious matter” if the minister’s phone was actually hacked — as in the attackers accessed his device and could see his messages, he said.
He said he would have expected that appropriate security measures would be in place to secure the phone of Mr Coveney, who is also minister for defence, particularly given Ireland’s seat, and now presidency, of the UN Security Council and Brexit.
He welcomed the statements from Mr Coveney’s officials that the attack on his phone was referred to the Garda National Cyber Crime Bureau and the National Cyber Security Centre.
Mr Honan said a third explanation given by officials of the incident — that it was a "cyber attack" did not clarify matters, saying it was a "generic" term that could mean anything from phishing to actual hacking.
The latest official comment from a spokesperson for the minister said: “The department judged this incident to be in the realm of a cyber attack and took all appropriate steps to notify the relevant national security authorities.
"Arising from these, An Garda Síochána and the National Cyber Security Centre investigated.”
While seeking clarity on the nature, and scale, of the attack, Mr Honan said the incident did highlight the “genuine threat” out there from cyber attacks.
“Cyber crime is a highly organised international business," he said.
He said a “lot more” needs to be invested by the State in cyber defences.
“The National Cyber Security Centre needs more people and resources and hopefully they are starting to get them,” he said.
“It’s a sad reflection on this Government and previous governments that it has taken our health service to be compromised in such a manner before any appropriate investment made in the area.”
He added: “The Garda Cyber Crime Bureau have been doing great work and they are slowly getting the investment and resources they need.
“But the Government needs to continue as we are still playing catch-up.
It comes as the GNCCB gave details on its investigation into the HSE cyber attack.
Speaking on RTÉ radio, Detective Inspector Brian Halligan said they had been able to identify and seize the technical infrastructure — the servers, websites, and domains — used by the criminal group.
He said the infrastructure was now in control of the bureau, resulting in “significant disruption” of the criminal group behind the attack and their ability to carry out further attacks.
“To date, 753 potential attacks have been disrupted as a direct work of the bureau seizing this infrastructure,” he said.
He said the bureau had worked with international agencies, including Europol and Interpol.
They have learned a lot from the investigation, he said, which was shared with international colleagues.
Det Insp Halligan said they were making progress in identifying the gang members, saying it is a live investigation and could not provide further details.
CONNECT WITH US TODAY
Be the first to know the latest news and updates
