Reporter offered money by cyber criminals to hack BBC | BBC News

Summary of YouTube Video Transcript

Key Concepts: Cybercrime, Ransomware, Insider Threat, Multi-Factor Authentication (MFA) Bomb, Access Broker, Social Engineering, Bitcoin, Encrypted Messaging (Signal).

1. Initial Contact and Offer:

• BBC cyber correspondent Joe Tidy was contacted unsolicitedly via Signal, an encrypted messaging app, by cybercriminals.
• The criminals offered him 15% of any ransom payment obtained from hacking the BBC in exchange for his login password and security codes. The offer was later increased to 25%.
• The criminals' plan involved either stealing private data or encrypting BBC servers and demanding a ransom. They estimated potential ransom in the "tens of millions of pounds."

2. Rationale for Playing Along:

• Tidy consulted with senior editors and decided to feign cooperation to gain firsthand insight into the "insider threat" aspect of cybercrime, which is a less-publicized method of attack.
• The "insider threat" refers to situations where individuals within an organization collude with hackers.
• Tidy wanted to verify the legitimacy of the offer and ensure it wasn't an entrapment attempt.

3. Verification Attempt and Escalation:

• To prove their legitimacy, the criminals agreed to deposit half a Bitcoin (approximately $55,000) into a deposit system for Tidy.
• After about three days, the criminals grew impatient and demanded Tidy run a piece of code on his laptop to assess his IT access within the BBC.
• Tidy stalled, leading to the criminals launching an "MFA bomb."

4. The MFA Bomb Attack:

• An "MFA bomb" involves repeatedly attempting to reset an account password, triggering numerous multi-factor authentication requests.
• Tidy's phone became unusable for several hours due to the constant stream of authentication requests.
• Accepting any of these requests would have granted the criminals access to his account.

5. Cybercriminal Tactics and Vulnerabilities:

• Cybercriminals are often "lazy" and seek the easiest entry point into an organization.
• They may purchase credentials from "access brokers" on online forums. An "access broker" is someone who sells stolen or compromised credentials.
• Directly targeting employees is a less common but still viable tactic.
• The incident highlighted the potential vulnerability of employees, especially those who are disgruntled or in financial need, to lucrative offers from cybercriminals.

6. Real-World Example and Consequences:

• A recent case in Brazil involved an individual selling their username and password to cybercriminals, resulting in approximately $100 million in damages to the affected bank.
• The individual who shared the information was arrested.

7. Key Arguments and Perspectives:

• The incident underscores the pervasive and aggressive nature of cybercriminals.
• It highlights the importance of vigilance and adherence to security protocols for all employees.
• The BBC's director general would be pleased that Joe fully embodied the BBC values in his approach to this.

8. Notable Quotes:

• "Cyber criminals are lazy. So they will find the easiest way into an organization that they can."
• "If I was a disgruntled employee or if I was hard up for cash, it would be a potentially lucrative and pleasing offer to to to get."

9. Synthesis/Conclusion:

The incident involving Joe Tidy demonstrates the multifaceted nature of cyber threats, including the potential for insider compromise. It emphasizes the importance of employee awareness, robust security measures like multi-factor authentication, and the need to resist the persuasive tactics of cybercriminals. The case also highlights the real-world consequences of succumbing to such offers, including potential legal repercussions.