# articles

feed_id: https://krebsonsecurity.com/?p=45907
title: Patch Tuesday, December 2018 Edition
uri: Patch-Tuesday-December-2018-Edition
url: https://krebsonsecurity.com/2018/12/patch-tuesday-december-2018-edition/
content:
<p><strong>Adobe</strong> and <strong>Microsoft</strong> each released updates today to tackle critical security weaknesses in their software. Microsoft&#8217;s December patch batch is relatively light, addressing more than three dozen vulnerabilities in <strong>Windows</strong> and related applications. Adobe has issued security fixes for its <strong>Acrobat</strong> and <strong>PDF Reader</strong> products, and has a patch for yet another zero-day flaw in <strong>Flash Player</strong> that is already being exploited in the wild.</p>
<p><img class="alignright wp-image-26837" src="media/863df0f6.brokenwindows.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2014/07/brokenwindows.png" alt="" width="205" height="215" />At least nine of the bugs in the Microsoft patches address flaws the company deems &#8220;critical,&#8221; meaning they can be exploited by malware or ne&#8217;er-do-wells to install malicious software with little or no help from users, save for perhaps browsing to a hacked or booby-trapped site.</p>
<p>Microsoft patched a zero-day flaw that is already being exploited (<a href="https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8611" target="_blank" rel="noopener">CVE-2018-8611</a>) and allows an attacker to elevate his privileges on a host system. The weakness, which is present on all supported versions of Windows, is tagged tagged with the less severe &#8220;important&#8221; rating by Microsoft mainly because it requires an attacker to be logged on to the system first.</p>
<p>According to security firm <strong>Rapid7</strong>, other notable vulnerabilities this month are in <strong>Internet Explore</strong>r (<a href="https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8631" target="_blank" rel="noopener">CVE-2018-8631</a>) and <strong>Edge</strong> (<a href="https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8624" target="_blank" rel="noopener">CVE-2018-8624</a>), both of which Microsoft considers most likely to be exploited. Similarly, <a href="https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8628" target="_blank" rel="noopener">CVE-2018-8628</a> is flaw in all supported versions of <strong>PowerPoint</strong> which is also likely to be used by attackers.<span id="more-45907"></span></p>
<p>It generally can&#8217;t hurt for Windows users to wait a day or two after Microsoft releases monthly security updates before installing the fixes; occasionally buggy patches can cause serious headaches for users who install them before all the kinks are worked out. Also, it’s a good idea to get in the habit of backing up your data <em>before</em> installing Windows updates.</p>
<p><strong>Windows 10</strong> likes to install patches all in one go and reboot your computer on its own schedule. Microsoft doesn’t make it easy for Windows 10 users to change this setting, <a href="https://www.howtogeek.com/224471/how-to-prevent-windows-10-from-automatically-downloading-updates/" target="_blank" rel="noopener">but it is possible</a>. For all other Windows OS users, if you’d rather be alerted to new updates when they’re available so you can choose when to install them, there’s a setting for that in <strong>Windows Update</strong>.</p>
<p><img class="alignleft wp-image-18875" src="media/18bb50f1.brokenflash-a.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2013/02/brokenflash-a.png" alt="" width="195" height="166" />For its part, Adobe&#8217;s got new versions of Adobe Reader and Adobe Acrobat that plug <a href="https://helpx.adobe.com/security/products/acrobat/apsb18-41.html" target="_blank" rel="noopener">dozens of security holes</a> in the programs. Also, last week Adobe <a href="https://helpx.adobe.com/security/products/flash-player/apsb18-42.html" target="_blank" rel="noopener">issued an emergency patch</a> to fix a zero-day flaw in Flash Player that bad guys are now using in active attacks.</p>
<p>Fortunately, the most popular Web browser by a long shot &#8212; <strong>Google Chrome</strong> &#8212; auto-updates Flash but also is now making users explicitly enable Flash every time they want to use it (Microsoft also bundles Flash with IE/Edge and updates it whenever Windows systems install monthly updates). By the summer of 2019 Google will <a href="https://nakedsecurity.sophos.com/2018/09/03/chrome-flash-is-almost-almost-almost-dead/" target="_blank" rel="noopener">make Chrome users go into their settings to enable it</a> every time they want to run it.</p>
<p>Firefox also forces users with the Flash add-on installed to click in order to play Flash content; instructions for disabling or removing Flash from Firefox are <a href="https://support.mozilla.org/en-US/kb/disable-or-remove-add-ons" target="_blank" rel="noopener">here</a>. Adobe will stop supporting Flash at the end of 2020.</p>
<p>As always, if you experience any problems installing any of these patches this month, please feel free to leave a comment about it below; there’s a good chance other readers have experienced the same and may even chime in here with some helpful tips.</p>
<p>Further reading:</p>
<p><a href="https://www.askwoody.com/category/microsoft-windows-patches-security/" target="_blank" rel="noopener">Ask Woody&#8217;s summary</a>.</p>
<p><a href="https://www.ghacks.net/2018/12/11/microsoft-windows-security-updates-december-2018-release-overview/" target="_blank" rel="noopener">Ghacks writeup on December 2018 Patch Tuesday</a>.</p>
<p><a href="https://blog.qualys.com/laws-of-vulnerabilities/2018/12/11/december-2018-patch-tuesday-39-vulns-workstation-patches-adobe-vulns" target="_blank" rel="noopener">Qualys&#8217;s take</a>.</p>
<p><a href="https://go.ivanti.com/Webinar-December-Patch-Tuesday-121218.html?_ga=2.109927045.1052735492.1544216575-700294194.1518543969" target="_blank" rel="noopener">Ivanti Patch Tuesday Webinar, 11 a.m. ET, Dec. 12.</a></p>


feed_id: https://krebsonsecurity.com/?p=45980
title: Scanning for Flaws, Scoring for Security
uri: Scanning-for-Flaws-Scoring-for-Security
url: https://krebsonsecurity.com/2018/12/scanning-for-flaws-scoring-for-security/
content:
<p>Is it fair to judge an organization&#8217;s information security posture simply by looking at its Internet-facing assets for weaknesses commonly sought after and exploited by attackers, such as outdated software or accidentally exposed data and devices? Fair or not, a number of nascent efforts are using just such an approach to derive security scores for companies and entire industries. What&#8217;s remarkable is how many organizations don&#8217;t make an effort to view their public online assets as the rest of the world sees them &#8212; until it&#8217;s too late.</p>
<div id="attachment_45982" style="width: 604px" class="wp-caption aligncenter"><img class=" wp-image-45982" src="media/183fc6be.fico-ucc.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/12/fico-ucc.jpg" alt="" width="594" height="359" /><p class="wp-caption-text">Image: US Chamber of Commerce.</p></div>
<p>For years, potential creditors have judged the relative risk of extending credit to consumers based in part on the applicant&#8217;s credit score &#8212; the most widely used being the score developed by <strong>FICO</strong>, previously known as <strong>Fair Isaac Corporation</strong>. Earlier this year, FICO began touting its <a href="media/2f4246bd.cmte_ex_cswg_2017_fall_nm_fico_handout.pdf" data-original-source="https://www.naic.org/meetings1712/cmte_ex_cswg_2017_fall_nm_fico_handout.pdf" target="_blank" rel="noopener">Cyber Risk Score</a> (PDF), which seeks to measure an organization&#8217;s chances of experiencing a data breach in the next 12 months, based on a variety of measurements tied to the company&#8217;s public-facing online assets.</p>
<p>In October, FICO teamed up with the <strong>U.S. Chamber of Commerce</strong> to evaluate more than 2,500 U.S. companies with the Cyber Risk Score, and then invited these companies to sign up and see how their score compares with that of other organizations in their industry. The stated use cases for the Cyber Risk Score include the potential for cyber insurance pricing and underwriting, and evaluating supply chain risk (i.e., the security posture of vendor partners).</p>
<p>The company-specific scores are supposed to be made available only to vetted people at the organization who go through FICO&#8217;s signup process. But in a marketing email sent to FICO members on Tuesday advertising its new benchmarking feature, FICO accidentally exposed the FICO Cyber Risk Score of energy giant <strong>ExxonMobil</strong>.</p>
<p>The marketing email was quickly recalled and reissued in a redacted version, but it seems ExxonMobil&#8217;s score of 587 puts it in the &#8220;elevated&#8221; risk category and somewhat below the mean score among large companies in the Energy and Utilities sector, which was 637. The October analysis by the Chamber and FICO gives U.S. businesses an overall score of 687 on a scale of 300-850.</p>
<div id="attachment_45984" style="width: 605px" class="wp-caption aligncenter"><a class="lightbox" href="media/9cc4c336.exxonmobil.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/12/exxonmobil.jpg"><img class="wp-image-45984" src="media/9cc4c336.exxonmobil.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/12/exxonmobil.jpg" alt="" width="595" height="352" /></a><p class="wp-caption-text">Data accidentally released by FICO about the Cyber Risk Score for ExxonMobil.</p></div>
<p>How useful is such a score? <strong>Mike Lloyd</strong>, chief technology officer at <strong>RedSeal</strong>, was quoted as saying a score &#8220;taken from the outside looking in is similar to rating the fire risk to a building based on a photograph from across the street.&#8221;</p>
<p>&#8220;You can, of course, establish some important things about the quality of a building from a photograph, but it&#8217;s no substitute for really being able to inspect it from the inside,&#8221; Lloyd <a href="https://www.darkreading.com/vulnerabilities---threats/fico-and-us-chamber-of-commerce-score-cyber-risk-across-10-sectors/d/d-id/1333052" target="_blank" rel="noopener">told </a><em>Dark Reading </em>regarding the Chamber/FICO announcement in October.</p>
<p>Naturally, combining external scans with internal vulnerability probes and penetration testing engagements can provide organizations with a much more holistic picture of their security posture. But when a major company makes public, repeated and prolonged external security foibles, it&#8217;s difficult to escape the conclusion that perhaps it isn&#8217;t looking too closely at its internal security either.<span id="more-45980"></span></p>
<h4>ENTIRELY, CERTIFIABLY PREVENTABLE</h4>
<p>Too bad the errant FICO marketing email didn&#8217;t expose the current cyber risk score of big-three consumer credit bureau<strong> Equifax</strong>, which was <a href="https://krebsonsecurity.com/?s=equifax+breach&amp;x=0&amp;y=0" target="_blank" rel="noopener">relieved of personal and financial data on 148 million Americans</a> last year after the company failed to patch one of its Web servers and then failed to detect an intrusion into its systems for months.</p>
<p>A <a href="media/0137a700.Equifax-Report.pdf" data-original-source="https://oversight.house.gov/wp-content/uploads/2018/12/Equifax-Report.pdf" target="_blank" rel="noopener">96-page report</a> (PDF) released this week by a House oversight committee found the Equifax breach was &#8220;entirely preventable.&#8221; For 76 days beginning mid May 2017, the intruders made more than 9,000 queries on 48 Equifax databases.</p>
<p>According to the report, the attackers were able to move the data off of Equifax&#8217;s network undetected thanks to an expired security certificate. Specifically, &#8220;while Equifax had installed a tool to inspect network traffic for evidence of malicious activity, the expired certificate prevented that tool from performing its intended function of detecting malicious traffic.&#8221;</p>
<p>Expired certificates aren&#8217;t particularly rare or noteworthy, but when they persist in publicly-facing Web servers for days or weeks on end, it raises the question: Is anyone at the affected organization paying attention at all to security?</p>
<p>Given how damaging it was for Equifax to have an expired certificate, you might think the company would have done everything in its power to ensure this wouldn&#8217;t happen again. But it <em>would</em> happen again &#8212; on at least two occasions earlier this year.</p>
<p>In April 2018, KrebsOnSecurity <a href="https://krebsonsecurity.com/2018/05/another-credit-freeze-target-nctue-com/" target="_blank" rel="noopener">pointed out</a> that the Web site Equifax makes available for consumers who wish to freeze their credit files was using an expired certificate, causing the site to throw up a dire red warning page that almost certainly scared countless consumers away from securing their credit files.</p>
<p>It took Equifax two weeks to fix that expired cert. A week later, I found another expired certificate on the credit freeze Web portal for the <strong>National Consumer Telecommunications and Utilities Exchange</strong> &#8212; a consumer credit bureau operated by Equifax.</p>
<h4>ARE YOU EXPERIANSED?</h4>
<p>One has to wonder what the median FICO Cyber Risk Score is for the credit bureau industry, because whatever Equifax&#8217;s score is it can&#8217;t be too different from that of its top competitor &#8212; <strong>Experian</strong>, <a href="https://krebsonsecurity.com/?s=experian+breach&amp;x=0&amp;y=0" target="_blank" rel="noopener">which is no stranger to data breaches</a>.</p>
<p>On Tuesday, security researcher <a href="https://twitter.com/notdan" target="_blank" rel="noopener">@notdan</a> tweeted about finding a series of open directories on Experian&#8217;s Web site. Open directories, in which files and folders on a Web server are listed publicly and clickable down to the last file, aren&#8217;t terribly uncommon to find exposed on smaller Web sites, but they&#8217;re not the sort of oversight you&#8217;d expect to see at a company with the size and sensitivity of Experian.</p>
<div id="attachment_45986" style="width: 482px" class="wp-caption aligncenter"><a class="lightbox" href="media/d3235b67.exp-auth.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/12/exp-auth.jpg"><img class="wp-image-45986 size-full" src="media/d3235b67.exp-auth.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/12/exp-auth.jpg" alt="" width="472" height="586" /></a><p class="wp-caption-text">A directory listing that exposed a number of files on an Experian server.</p></div>
<p>Included in <a href="media/75cc098b.stg-exp.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/12/stg-exp.jpg" target="_blank" rel="noopener">one of the exposed directories</a> on the Experian server were dozens of files that appeared to be digital artifacts left behind by a popular Web vulnerability scanner <a href="https://portswigger.net/burp" target="_blank" rel="noopener">Burp Suite</a>. It&#8217;s unclear whether those files were the result of scans run by someone within the company, or if they were the product of an unauthorized security probe by would-be intruders that somehow got indexed by Experian&#8217;s servers (the latter possibility being far more concerning).</p>
<p>Experian did not respond to requests for comment, and the company disabled public access to the directories shortly after other researchers on Twitter began piling on to @notdan&#8217;s findings with their own discoveries.</p>
<div id="attachment_45987" style="width: 602px" class="wp-caption aligncenter"><a class="lightbox" href="media/c1a0fc83.EXP-BURP.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/12/EXP-BURP.jpg"><img class="wp-image-45987" src="media/c1a0fc83.EXP-BURP.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/12/EXP-BURP.jpg" alt="" width="592" height="782" /></a><p class="wp-caption-text">Evidence of data left behind by a Burp Suite Web vulnerability scan run against an Experian server.</p></div>
<p>As I noted in <a href="https://krebsonsecurity.com/2018/12/what-the-marriott-breach-says-about-security/" target="_blank" rel="noopener">last week&#8217;s story on the 4-year-long breach at Marriott</a> that exposed personal and financial data on some 500 million guests, companies that have their heads screwed on correctly from an information security standpoint are run by leaders who are expecting the organization will get breached constantly through vulnerabilities, phishing and malware attacks.</p>
<p>They’re continuously testing their own internal networks and employees for weaknesses, and regularly drilling their breach response preparedness (much like a fire drill). They are finding creative ways to cut down on the volume of sensitive data that they need to store and protect. And they are <a href="https://en.wikipedia.org/wiki/Network_segmentation" target="_blank" rel="noopener">segmenting their networks</a> like watertight compartments in a ship, so that a breach in one part of the organization&#8217;s digital hull can&#8217;t spread to the rest of the vessel and sink the whole ship (it&#8217;s worth noting the House oversight report observed that the lack of network segmentation was a major contributor to the Equifax breach).</p>
<p>But companies with advanced &#8220;<a href="https://krebsonsecurity.com/2015/04/whats-your-security-maturity-level/" target="_blank" rel="noopener">security maturity</a>&#8221; also are regularly taking a hard look at what their outward-facing security posture says to the rest of the world, fully cognizant that appearances matter &#8212; particularly to ne&#8217;er-do-wells who tend to view public security weaknesses like <a href="https://whatis.techtarget.com/definition/broken-window-theory" target="_blank" rel="noopener">broken windows</a>, and as an invitation to mischief.</p>


feed_id: https://krebsonsecurity.com/?p=46017
title: Spammed Bomb Threat Hoax Demands Bitcoin
uri: Spammed-Bomb-Threat-Hoax-Demands-Bitcoin
url: https://krebsonsecurity.com/2018/12/spammed-bomb-threat-hoax-demands-bitcoin/
content:
<p>A new email extortion scam is making the rounds, threatening that someone has planted bombs within the recipient&#8217;s building that will be detonated unless a hefty bitcoin ransom is paid by the end of the business day.</p>
<p>Sources at multiple U.S. based financial institutions reported receiving the threats, which included the subject line, &#8220;I advise you not to call the police.&#8221;</p>
<p>The email reads:</p>
<blockquote><p>My man carried a bomb (Hexogen) into the building where your company is located. It is constructed  under my direction. It can be hidden anywhere because of its small size, it is not able to damage the supporting building structure, but in the case of its detonation you will get many victims.</p>
<p>        My mercenary keeps the building under the control. If he notices any unusual behavior or emergency he will blow up the bomb.</p>
<p>        I can withdraw my mercenary if you pay. You pay me 20.000 $ in Bitcoin and the bomb will not explode, but don&#8217;t try to cheat -I warrant you that I will withdraw my mercenary only after 3 confirmations in blockchain network. </p>
<p>        Here is my Bitcoin address : 1GHKDgQX7hqTM7mMmiiUvgihGMHtvNJqTv</p>
<p>        You have to solve problems with the transfer by the end of the workday. If you are late with the money explosive will explode.</p>
<p>        This is just a business, if you don’t send me the money and the explosive device detonates, other commercial enterprises will transfer me more money, because this isnt a one-time action.</p>
<p>         I wont visit this email. I check my Bitcoin wallet every 35 min and after seeing the money I will order my recruited person to get away.</p>
<p>        If the explosive device explodes and the authorities notice this letter:<br />
        We are not terrorists and dont assume any  responsibility for explosions in other buildings.</p></blockquote>
<p>The bitcoin address included in the email was different in each message forwarded to KrebsOnSecurity. In that respect, this scam is reminiscent of the <a href="https://krebsonsecurity.com/?s=sextortion&#038;x=0&#038;y=0" rel="noopener" target="_blank">various email sextortion campaigns</a> that went viral earlier this year, which led with a password the recipient used at some point in the past and threatened to release embarrassing videos of the recipient unless a bitcoin ransom was paid.</p>
<p>I could see this spam campaign being extremely disruptive in the short run. There is little doubt that some businesses receiving this extortion email will treat it as a credible threat. This is exactly what happened today at one of the banks that forwarded me their copy of this email. Also, KrebsOnSecurity has received reports that numerous school districts across the country have closed schools early today in response to this hoax email threat.</p>
<p>&#8220;There are several serious legal problems with this &#8212; people will be calling the police, and they cannot ignore even a known hoax,&#8221; said <strong>Jason McNew</strong>, CEO and founder of <a href="https://www.strongholdcybersecurity.com/" rel="noopener" target="_blank">Stronghold Cyber Security</a>, a consultancy based in Gettysburg, Pa.</p>
<p>This is a developing story, and may be updated throughout the day.</p>
<p>Update: 4:46 p.m. ET: Added bit about school closings.</p>


feed_id: https://krebsonsecurity.com/?p=45873
title: A Chief Security Concern for Executive Teams
uri: A-Chief-Security-Concern-for-Executive-Teams
url: https://krebsonsecurity.com/2018/12/a-chief-security-concern-for-executive-teams/
content:
<p>Virtually all companies like to say they take their customers&#8217; privacy and security seriously, make it a top priority, blah blah. But you&#8217;d be forgiven if you couldn&#8217;t tell this by studying the executive leadership page of each company&#8217;s Web site. That&#8217;s because very few of the world&#8217;s biggest companies list <em>any</em> security executives in their highest ranks. Even among top tech firms, less than half list a chief technology officer (CTO). This post explores some reasons why this is the case, and why it can&#8217;t change fast enough.</p>
<p>KrebsOnSecurity reviewed the Web sites for the <a href="https://www.statista.com/statistics/263264/top-companies-in-the-world-by-market-value/" target="_blank" rel="noopener">global top 100 companies</a> by market value, and found <span class="pullquote pqright"><em>just five percent of top 100 firms listed a chief information security officer (CISO) or chief security officer (CSO)</em>.</span> Only a little more than a third even listed a CTO in their executive leadership pages.</p>
<p>The reality among high-tech firms that make up <a href="https://www.nasdaq.com/screening/companies-by-industry.aspx?sortname=marketcap&amp;sorttype=1&amp;exchange=NASDAQ" target="_blank" rel="noopener">the top 50 companies in the NASDAQ market</a> was even more striking: Fewer than half listed a CTO in their executive ranks, and I could find <em>only three that featured a person with a security title</em>.</p>
<p>Nobody&#8217;s saying these companies don&#8217;t have CISOs and/or CSOs and CTOs in their employ. A review of these companies via LinkedIn suggests that most of them in fact do have people in those roles (although I suspect the few that aren&#8217;t present or easily findable on LinkedIn have made a personal and/or professional decision not to be listed as such).</p>
<p>But it is interesting to note which roles companies consider worthwhile publishing in their executive leadership pages. For example, 73 percent of the top 100 companies listed a chief of human resources (or &#8220;chief people officer&#8221;), and about one-third included a chief marketing officer.</p>
<p>Not that these roles are somehow more or less important than that of a CISO/CSO within the organization. Nor is the average pay hugely different among all three roles. Yet, considering how much marketing (think consumer/customer data) and human resources (think employee personal/financial data) are impacted by your average data breach, it&#8217;s somewhat remarkable that more companies <em>don&#8217;t</em> list their chief security personnel among their top ranks.</p>
<p><img class="aligncenter  wp-image-46058" src="media/dc67ffe1.board.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/12/board.jpg" alt="" width="597" height="298" /></p>
<p><strong>Julie Conroy</strong>, research director at the market analyst firm <a href="https://aitegroup.com/" target="_blank" rel="noopener">Aite Group</a>, said she initially hypothesized that companies with a regulatory mandate for strong cybersecurity controls (e.g. banks) would have this role in their executive leadership team.</p>
<p>&#8220;But a quick look at Bank of America and Chase&#8217;s websites proved me wrong,&#8221; Conroy said. &#8220;It looks like the CISO in those firms is one layer down, reporting to the executive leadership.&#8221;</p>
<p>Conroy says this dynamic reflects the fact that revenue centers like human capital and the ability to drum up new business are still prioritized and valued by businesses more than cost centers &#8212; including loss prevention and cybersecurity.</p>
<p>&#8220;Marketing and digital strategy roles drive top line revenue for firms—the latter is particularly important in retail and banking businesses as so much commerce moves online,&#8221; Conroy said. &#8220;While you and I know that cybersecurity and loss prevention are critical functions for all types of businesses, I don’t think that reality is reflected in the organizational structure of many businesses still. A common theme in my discussions with executives in cost center roles is how difficult it is for them to get budget to fund the tech they need for loss prevention initiatives.&#8221;<span id="more-45873"></span></p>
<h4>EXHIBIT A: EQUIFAX</h4>
<p>Common or not, the dominant reporting structure in corporations runs the risk of having security concerns take a backseat when they get in the way of productivity, and often leaves the security team without someone to advocate for the proper budget.</p>
<p>Take the mega breach at Equifax last year that exposed the personal and financial data on 148 million people. Much blame has been placed on lax software patching practices at Equifax, but the cause of the intrusion was ultimately a people and organizational structure issue, argues <strong>Lance Spitzner</strong>, director of security awarness at the <a href="https://www.sans.org" target="_blank" rel="noopener">SANS Institute</a>.</p>
<p>&#8220;When you bring up the Equifax breach, most people respond that it was a patching issue, the bad guys exploited a Struts vulnerability that Equifax knew about and should have patched,&#8221; Spitzner <a href="https://www.sans.org/security-awareness-training/blog/just-released-congressional-report-equifax-hack" target="_blank" rel="noopener">wrote</a> in a breakdown of <a href="media/0137a700.Equifax-Report.pdf" data-original-source="https://oversight.house.gov/wp-content/uploads/2018/12/Equifax-Report.pdf" target="_blank" rel="noopener">a damning report released last week</a> by lawmakers on the House Oversight committee.</p>
<p>But why wasn’t it patched? And why did it take them two months to identify the breach? Spitzner says the House report shows the ultimate reason was because the CSO Susan Mauldin did not report to the CIO, but was buried underneath the Chief Legal Officer.  IT was siloed from security; the two rarely communicated or coordinated, leaving gaping holes in the organization.</p>
<p>The reason for this organizational divide? Spitzner notes:</p>
<blockquote><p>&#8220;Ten years prior, the CSO reported to the CIO, however they had strong personality conflicts.  Since the two could not work together, the CSO was moved under legal.  However, when Equifax’s new CIO David Webb and new CSO Susan Mauldin came on board, this split was never resolved.  (Full details of this strategic failure start on page 55 of the report. I feel this is one of the most critical findings.)  As a result, the CSO is now the CISO and that individual reports directly to the CEO at Equifax today.&#8221;</p></blockquote>
<p>Indeed, despite its <a href="https://krebsonsecurity.com/2017/09/equifax-breach-response-turns-dumpster-fire/" target="_blank" rel="noopener">myriad</a> <a href="https://krebsonsecurity.com/2017/10/equifax-breach-fallout-your-salary-history/" target="_blank" rel="noopener">security</a> <a href="https://krebsonsecurity.com/2017/09/ayuda-help-equifax-has-my-data/" target="_blank" rel="noopener">and</a> <a href="https://krebsonsecurity.com/2017/10/equifax-credit-assistance-site-served-spyware/" target="_blank" rel="noopener">management</a> <a href="https://krebsonsecurity.com/2017/09/equifax-or-equiphish/" target="_blank" rel="noopener">foibles</a> since announcing its historic data breach last September, Equifax has apparently taken this particular lesson to heart. Prior to announcing its breach last year, a CISO or CSO was <a href="https://web.archive.org/web/20170729074618/https://www.equifax.com/about-equifax/corporate-leadership/" target="_blank" rel="noopener">noticeably absent</a> from the ranks of Equifax&#8217;s Corporate Leadership page. <a href="https://www.equifax.com/about-equifax/corporate-leadership/" target="_blank" rel="noopener">Not anymore</a>. Here&#8217;s looking at you, <a href="https://www.experianplc.com/about-us/board-and-senior-management/" target="_blank" rel="noopener">Experian</a> and <a href="https://investors.transunion.com/leadership-and-governance/our-leadership-team" target="_blank" rel="noopener">Trans Union</a>.</p>
<h4>EXECUTIVE SILOS</h4>
<p>Workforce experts say the main reason many firms don&#8217;t list their security leaders within their top executives is that these people typically do not report directly to the company&#8217;s board of directors or CEO. More commonly, the CSO or CISO reports to the CTO, or to the chief information officer.</p>
<p>&#8220;You need to make sure that your heads of security are on equal footing with the heads of tech, otherwise there is an inherent conflict at play,&#8221; said <strong>Anthony Belfiore</strong>, chief security officer for insurance company Aon PLC, in a <a href="https://www.wsj.com/articles/companies-cut-ciso-reporting-ties-with-technology-1524515201" target="_blank" rel="noopener">Wall Street Journal story</a> this month about the rising prominence of security leaders at major companies.</p>
<div id="attachment_46056" style="width: 600px" class="wp-caption aligncenter"><img class=" wp-image-46056" src="media/2bd6bcd2.accenture-cisoreport.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/12/accenture-cisoreport.jpg" alt="" width="590" height="148" /><p class="wp-caption-text">Source: Accenture.</p></div>
<p><strong>Alissa Valentina Knight</strong>, senior analyst and colleague of Conroy&#8217;s at the Aite Group, said we’re in the middle of a changing of tides &#8212; where the CISO function once seen as a technology problem is now moving to a boardroom problem and bringing about a gradual shift in reporting structure.</p>
<p>&#8220;Historically, you’d see the CISO reporting to the CTO and despite the company having a CISO, that individual wasn’t listed on the company’s web site, [and] while they had an officer title, they weren’t given that privilege,&#8221; Knight said.</p>
<p>But she added that many companies &#8212; despite having a CISO &#8212; will not list them on their web site’s leadership team page, even when that reporting structure changes from the CTO to the CEO or Board of Directors.</p>
<p>&#8220;Some companies are even moving the cybersecurity function to report up through the CFO,&#8221; Knight said.</p>
<p>According to <a href="https://www.accenture.com/us-en/insights/security/securing-future-enterprise-today" target="_blank" rel="noopener">a survey released this summer</a> by <strong>Accenture</strong>, two-thirds of companies said their chief executive and board of directors now have direct oversight of cybersecurity. The survey also found CIOs also had less control over cybersecurity budgets in 2018, 35 percent in 2017 to 29 percent this year, the survey found.</p>
<p>Companies can minimize conflict between the CSO/CISO and other top executives by having their security leader(s) report to the head of operations, or to the company’s general counsel, Belfiore told The Journal. For example, those that have CISOs reporting to CIOs can mix in reporting lines to legal, risk or the CEO office to offset potential conflicts.</p>
<p><em>*Calculated based on number of top 100 companies with available leadership data (see these <a href="https://docs.google.com/spreadsheets/d/1GZH09XavEr_MAq0MgiZxJ970UsucDjn28hMHtunHojA/edit?usp=sharing" target="_blank" rel="noopener">Top 100</a> and <a href="https://docs.google.com/spreadsheets/d/1XYWXdUrckiPFr0T-PXN_tdvH8LTvy9Oo7eqSOCUSztc/edit?usp=sharing" target="_blank" rel="noopener">Top 50</a> spreadsheets).</em></p>


feed_id: https://krebsonsecurity.com/?p=46087
title: Microsoft Issues Emergency Fix for IE Zero Day
uri: Microsoft-Issues-Emergency-Fix-for-IE-Zero-Day
url: https://krebsonsecurity.com/2018/12/microsoft-issues-emergency-fix-for-ie-zero-day/
content:
<p><strong>Microsoft</strong> today released an emergency software patch to plug a critical security hole in its <strong>Internet Explorer</strong> (IE) Web browser that attackers are already using to break into <strong>Windows</strong> computers.</p>
<p><img class="alignright size-full wp-image-46089" src="media/902a8fcb.iexploder.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/12/iexploder.jpg" alt="" width="170" height="150" /> The software giant <a href="https://blogs.technet.microsoft.com/msrc/2018/12/19/december-2018-security-update-release-2/" target="_blank" rel="noopener">said</a> it learned about the weakness (<strong>CVE-2018-8653</strong>) after receiving a report from <strong>Google</strong> about a new vulnerability being used in targeted attacks.</p>
<p><strong>Satnam Narang</strong>, senior research engineer at <strong>Tenable</strong>, said the vulnerability affects the following installations of IE: Internet Explorer 11 from Windows 7 to Windows 10 as well as Windows Server 2012, 2016 and 2019; IE 9 on Windows Server 2008; and IE 10 on Windows Server 2012.</p>
<p>&#8220;As the flaw is being actively exploited in the wild, users are urged to update their systems as soon as possible to reduce the risk of compromise,” Narang said.<span id="more-46087"></span></p>
<p>According to a somewhat <a href="https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/CVE-2018-8653#ID0EN" target="_blank" rel="noopener">sparse advisory</a> about the patch, malware or attackers could use the flaw to break into Windows computers simply by getting a user to visit a hacked or booby-trapped Web site. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.</p>
<p>Microsoft says users who have Windows Update enabled and have applied the latest security updates are protected automatically. Windows 10 users can manually check for updates <a href="https://support.microsoft.com/en-us/help/4027667/windows-10-update" target="_blank" rel="noopener">this way</a>; instructions on how to do this for earlier versions of Windows are <a href="https://support.microsoft.com/en-us/help/3067639/how-to-get-an-update-through-windows-update" target="_blank" rel="noopener">here</a>.</p>


feed_id: https://krebsonsecurity.com/?p=46096
title: Feds Charge Three in Mass Seizure of Attack-for-hire Services
uri: Feds-Charge-Three-in-Mass-Seizure-of-Attack-for-hire-Services
url: https://krebsonsecurity.com/2018/12/feds-charge-three-in-mass-seizure-of-attack-for-hire-services/
content:
<p>Authorities in the United States this week brought criminal hacking charges against three men as part of an unprecedented, international takedown targeting 15 different &#8220;booter&#8221; or &#8220;stresser&#8221; sites &#8212; attack-for-hire services that helped paying customers launch tens of thousands of digital sieges capable of knocking Web sites and entire network providers offline.</p>
<div id="attachment_46100" style="width: 603px" class="wp-caption aligncenter"><img class=" wp-image-46100" src="media/6c189aba.domainseize.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/12/domainseize.jpg" alt="" width="593" height="463" /><p class="wp-caption-text">The seizure notice appearing on the homepage this week of more than a dozen popular &#8220;booter&#8221; or &#8220;stresser&#8221; DDoS-for-hire Web sites.</p></div>
<p>As of Thursday morning, a seizure notice featuring the seals of the <strong>U.S. Justice Department</strong>, <strong>FBI</strong> and other law enforcement agencies appeared on the booter sites, including:</p>
<p>anonsecurityteam[.]com<br />
booter[.]ninja<br />
bullstresser[.]net<br />
critical-boot[.]com<br />
defcon[.]pro<br />
defianceprotocol[.]com<br />
downthem[.]org<br />
layer7-stresser[.]xyz<br />
netstress[.]org<br />
quantumnstress[.]net<br />
ragebooter[.]com<br />
request[.]rip<br />
str3ssed[.]me<br />
torsecurityteam[.]org<br />
vbooter[.]org</p>
<p>Booter sites are dangerous because they help lower the barriers to cybercrime, allowing even complete novices to launch sophisticated and crippling attacks with the click of a button.</p>
<p><strong>Cameron Schroeder</strong>, assistant U.S. attorney for the Central District of California, called this week&#8217;s action the largest simultaneous seizure of booter service domains ever.</p>
<p>&#8220;This is the biggest action U.S. law enforcement has taken against booter services, and we&#8217;re doing this in cooperation with a large number of industry and foreign law enforcement partners,&#8221; Schroeder said.</p>
<p>Booter services are typically advertised through variety of methods, including Dark Web forums, chat platforms and even youtube.com. They accept payment via PayPal, Google Wallet, and/or cryptocurrencies, and subscriptions can range in price from just a few dollars to several hundred per month. The services are priced according to the volume of traffic to be hurled at the target, the duration of each attack, and the number of concurrent attacks allowed.</p>
<p>Purveyors of stressers and booters claim they are not responsible for how customers use their services, and that they aren&#8217;t breaking the law because &#8212; like most security tools &#8212; stresser services can be used for good or bad purposes. For example, all of the above-mentioned booter sites contained wordy &#8220;terms of use&#8221; agreements that required customers to agree they will only stress-test their own networks &#8212; and that they won&#8217;t use the service to attack others.</p>
<p>But experts say today&#8217;s announcement shreds that virtual fig leaf, and marks several important strategic shifts in how authorities intend to prosecute booter service operators going forward.</p>
<p>&#8220;This action is predicated on the fact that running a booter service itself is illegal,&#8221; said <strong>Allison Nixon</strong>, director of security research at <a href="https://www.flashpoint-intel.com" target="_blank" rel="noopener">Flashpoint</a>, a security firm based in New York City. &#8220;That&#8217;s a slightly different legal argument that has been made in the past against other booter owners.&#8221;</p>
<p>For one thing, the booter services targeted in this takedown advertised the ability to &#8220;resolve&#8221; or determine the true Internet address of a target. This is especially useful for customers seeking to harm targets whose real address is hidden behind mitigation services like Cloudflare (ironically, the same provider used by most of these booter services to withstand attacks by competing booter services).</p>
<p>Some resolvers also allowed customers to determine the Internet address of a target using <a href="https://krebsonsecurity.com/?s=skype+resolver&amp;x=0&amp;y=0" target="_blank" rel="noopener">nothing more than the target&#8217;s Skype username</a>.</p>
<p>&#8220;You don&#8217;t need to use a Skype resolver just to attack yourself,&#8221; assistant U.S. Attorney Schroeder said. <span class="pullquote pqright">&#8220;Clearly, the people running these booter services know their services are being used not by people targeting their own infrastructure, and have built in capabilities that specifically allow customers to attack others.&#8221;</span></p>
<p>Another important distinction between this week&#8217;s coordinated action and past booter site takedowns was that the government actually tested each service it dismantled to validate claims about attack firepower and to learn more about how each service conducted assaults.</p>
<p>In a complaint unsealed today, the Justice Department said that although FBI agents identified at least 60 different booter services operating between June and December 2018, they discovered not all were fully operational and capable of launching attacks. Hence, the 15 services seized this week represent those that the government was able to use to conduct successful, high-volume attacks against their own test sites.</p>
<p>&#8220;This is intended to send a very clear message to all booter operators that they&#8217;re not going to be allowed to operate openly anymore,&#8221; Nixon said. &#8220;The message is that if you&#8217;re running a DDoS-for-hire service that can attack an Internet address in such a way that the FBI can purchase an attack against their own test servers, you&#8217;re probably going to get in trouble.&#8221;<span id="more-46096"></span></p>
<h4>DOWN THEM ALL</h4>
<p>Charged in a Los Angeles federal court this week were the alleged operators of &#8220;Downthem&#8221; &#8212; a booter service the government says helped some 2,000 customers launch debilitating digital assaults at more than 200,000 targets, including many government, banking, university and gaming Web sites.</p>
<p>Prosecutors say that in addition to running and marketing Downthem, defendants <strong>Matthew Gatrel</strong> and <strong>Juan Martinez</strong> sold huge, continuously updated lists of Internet addresses tied to devices that could be used by other booter services to make attacks far more powerful and effective.</p>
<p><div id="attachment_46107" style="width: 606px" class="wp-caption aligncenter"><img class=" wp-image-46107" src="media/cf505133.downthempanel2.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/12/downthempanel2.jpg" alt="" width="596" height="444" /><p class="wp-caption-text">The user interface for Downthem[.]org, one of 15 booter sites seized by the feds today.</p></div>Booter and stresser services let customers pick from among a variety of attack methods, but almost universally the most powerful of these methods involves what&#8217;s known as a &#8220;reflective amplification attack.&#8221; In such assaults, the perpetrators leverage unmanaged Domain Name Servers (DNS) or other devices on the Web to create huge traffic floods.</p>
<p>Ideally, DNS servers only provide services to machines within a trusted domain &#8212; such as translating an Internet address from a series of numbers into a domain name, like example.com. But DNS reflection attacks rely on consumer and business routers and other devices equipped with DNS servers that are (mis)configured to accept queries from anywhere on the Web.</p>
<p>Attackers can send spoofed DNS queries to these DNS servers, forging the request so that it appears to come from the target’s network. That way, when the DNS servers respond, they reply to the spoofed (target) address.</p>
<p>The bad guys also can amplify a reflective attack by crafting DNS queries so that the responses are much bigger than the requests. For example, an attacker could compose a DNS request of less than 100 bytes, prompting a response that is 60-70 times as large. This “amplification” effect is especially pronounced if the perpetrators query dozens of DNS servers with these spoofed requests simultaneously.</p>
<p>The government alleges that Gatrel and Martinez constantly scanned the Internet for these misconfigured devices, and then sold lists of Internet addresses tied to these devices to other booter service operators.</p>
<p>Schroeder said the government is arguing that the use of these third-party servers in reflective amplification attacks can be prosecuted under existing wire fraud and computer trespass laws.</p>
<p>&#8220;Certainly [booter service operators] don&#8217;t have permission from all of those other devices owners to use the devices and their bandwidth to direct these attacks,&#8221; she said. &#8220;We look at it as a wire fraud violation because essentially they&#8217;re stealing property from upstream providers and using their resources to conduct these attacks. There are also multiple ways we can show this is pretty clearly not lawful under the Computer Fraud and Abuse Act.&#8221;</p>
<p>Prosecutors further allege Gatrel resold his booter services to other booter operators, including <strong>Quantum Stresser</strong> &#8212; one of the 15 services seized by the government this week. The alleged operator of that service, Pennsylvania resident <strong>David Bukoski</strong>, was charged in the District of Alaska this week for aiding and abetting computer intrusions.</p>
<p>Investigators say Bukoski&#8217;s booter service was among the longest running services targeted by the FBI, operating since at least 2012. An indictment against Bukoski unsealed this week maintains Quantum Stresser had over 80,000 customer subscriptions, and that during 2018 the service was used to conduct over 50,000 actual or attempted attacks targeting people and networks worldwide.</p>
<p>According to the government, the use of booter and stresser services to conduct attacks is punishable under both wire fraud laws and the Computer Fraud and Abuse Act (18 U.S.C. § 1030), and may result in arrest and prosecution; seizure of computers or other electronics; significant prison sentences; a penalty or fine.</p>
<p>Schroeder said the government understands this week&#8217;s takedowns aren&#8217;t going to solve the booter problem once and for all, and that other booter services will likely spring up in the wake of those dismantled this week. But she said the arrests and seizures have helped built a template that the government can use in tandem with its industry partners to shorten the lifespan of new booter services and to bring those responsible to justice.</p>
<p>&#8220;We certainly don&#8217;t expect this problem to go away after this,&#8221; Schroeder said. But this is an attempt to build a strategic approach to this problem, to look at it in a more systemic way and deal with it on a much larger scale.&#8221;</p>


feed_id: https://krebsonsecurity.com/?p=46143
title: Serial Swatter and Stalker Mir Islam Arrested for Allegedly Dumping Body in River
uri: Serial-Swatter-and-Stalker-Mir-Islam-Arrested-for-Allegedly-Dumping-Bo
url:
https://krebsonsecurity.com/2018/12/serial-swatter-and-stalker-mir-islam-arrested-for-allegedly-dumping-body-in-river/

content:
<p>A 22-year-old man convicted of cyberstalking and carrying out numerous bomb threats and <a href="https://en.wikipedia.org/wiki/Swatting" target="_blank" rel="noopener">swatting attacks</a> &#8212; including <a href="http://krebsonsecurity.com/2013/03/the-world-has-no-room-for-cowards/" target="_blank" rel="noopener">a 2013 swatting incident at my home</a> &#8212; was arrested Sunday morning in the Philippines after allegedly helping his best friend dump the body of a housemate into a local river.</p>
<div id="attachment_46146" style="width: 622px" class="wp-caption aligncenter"><img class="size-full wp-image-46146" src="media/a0424334.troymir.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/12/troymir.jpg" alt="" width="612" height="448" /><p class="wp-caption-text">Suspects Troy Woody Jr. (left) and Mir Islam, were arrested in Manila this week for allegedly dumping the body of Woody&#8217;s girlfriend in a local river. Image:  Manila Police Dept.</p></div>
<p>Police in Manila say 22-year-old U.S citizens <strong>Mir Islam</strong> and <strong>Troy Woody Jr.</strong>, 21, used an app to book a ride that was to pick them up at Woody&#8217;s condominium in Mandaluyong City. When the driver arrived the two men stuffed a large box into the trunk of the vehicle.</p>
<p>According to the driver, Islam and Woody asked to be driven to a nearby shopping mall, but told the driver along the way to stop at a compound near the Pasig River in Manila, where the two men allegedly dumped the box before getting back in the hailed car.</p>
<p>The Inquirier <a href="https://newsinfo.inquirer.net/1065895/2-americans-nabbed-for-dumping-dead-woman-in-pasig-river" target="_blank" rel="noopener">reports</a> that authorities recovered the box and identified the victim as <strong>Tomi Michelle Masters</strong>, 23, also a U.S. citizen from Indiana who was reportedly dating Woody and living in the same condo. Masters&#8217; <a href="https://www.instagram.com/sspacekase/" target="_blank" rel="noopener">Instagram profile</a> states that she was in a relationship with Woody.</p>
<p>Brooklyn, NY native Islam, a.k.a. &#8220;<a href="https://www.instagram.com/p/BpQJvN0BpfY/" target="_blank" rel="noopener">Josh the God</a>,&#8221; has a long rap sheet for computer-related crimes. He briefly rose to Internet infamy as one of the core members of <a href="https://en.wikipedia.org/wiki/UGNazi" target="_blank" rel="noopener">UGNazi</a>, an online mischief-making group that claimed credit for hacking and attacking a number of high-profile Web sites.</p>
<p>On June 25, 2012, Islam and nearly two-dozen others were caught up in an FBI dragnet dubbed <a href="https://www.fbi.gov/newyork/press-releases/2012/manhattan-u.s.-attorney-and-fbi-assistant-director-in-charge-announce-24-arrests-in-eight-countries-as-part-of-international-cyber-crime-takedown" target="_blank" rel="noopener">Operation Card Shop</a>. The government accused Islam of being a founding member of <a href="https://krebsonsecurity.com/2012/06/carderprofit-forum-sting-nets-26-arrests/" target="_blank" rel="noopener">carders[dot]org</a> — a credit card fraud forum — trafficking in stolen credit card information, and possessing information for more than 50,000 credit cards.</p>
<div id="attachment_15660" style="width: 605px" class="wp-caption aligncenter"><img class=" wp-image-15660" src="media/fb92df64.joshthegodtwitterwarning.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2012/06/joshthegodtwitterwarning.png" alt="" width="595" height="316" srcset="https://krebsonsecurity.com/wp-content/uploads/2012/06/joshthegodtwitterwarning.png 920w, https://krebsonsecurity.com/wp-content/uploads/2012/06/joshthegodtwitterwarning-285x151.png 285w, https://krebsonsecurity.com/wp-content/uploads/2012/06/joshthegodtwitterwarning-600x318.png 600w" sizes="(max-width: 595px) 100vw, 595px" /><p class="wp-caption-text">JoshTheGod&#8217;s (Mir Islam&#8217;s ) Twitter feed, in April 2012 warning fellow carding forum carderprofit members that the forum was being run by the FBI.</p></div>
<p>In June 2016, Islam <a href="https://krebsonsecurity.com/2016/07/serial-swatter-stalker-and-doxer-mir-islam-gets-just-1-year-in-jail/" target="_blank" rel="noopener">was sentenced to a year in prison</a> for an impressive array of crimes, including stalking people online and posting their personal data on the Internet. Islam also pleaded guilty to reporting phony bomb threats and fake hostage situations at the homes of celebrities and public officials (as well as this author).<span id="more-46143"></span></p>
<p>At that 2016 sentencing, Islam’s lawyer argued that his client suffered from multiple psychological disorders, and that he and his co-conspirators orchestrated the swattings of a sense of “anarchic libertarianism.”</p>
<p>Islam was let out of prison under supervised release before serving the whole sentence, but soon was back inside after violating the terms of his release. Earlier this year, Islam filed a typosquatting lawsuit from prison that named Woody Jr. In <a href="media/2537629f.1.pdf" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/12/1.pdf" target="_blank" rel="noopener">that bizarre handwritten complaint</a> (PDF), Islam refers to Woody variously as &#8220;TJ&#8221; and &#8220;Josh,&#8221; and says the two men were best friends and have known each other for eight years.</p>
<div id="attachment_46151" style="width: 596px" class="wp-caption aligncenter"><img class=" wp-image-46151" src="media/6e3aeaca.joshcomplaint.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/12/joshcomplaint.jpg" alt="" width="586" height="558" /><p class="wp-caption-text">An anti-cybersquatting domain dispute filed by Mir Islam earlier this year while in jail. In it, Islam refers to Woody as &#8220;TJ&#8221; and says the two have been best friends for years.</p></div>
<p>Troy Woody Jr. describes himself as an &#8220;early crypto investor,&#8221; but sources say Woody &#8212; like Islam &#8212; was <a href="https://knowyourmeme.com/memes/people/ugnazi" target="_blank" rel="noopener">a core member of the UGNazi group</a> who went by the nicknames &#8220;MrOsama,&#8221; and &#8220;<a href="https://twitter.com/Everlife" target="_blank" rel="noopener">Everlife.</a>&#8221; His <a href="https://www.instagram.com/titled/" target="_blank" rel="noopener">Instagram profile</a> suggests he was in a relationship with Ms. Masters. Both are pictured in the first of the three large photos below, taken from Woody&#8217;s Instagram account.</p>
<div id="attachment_46145" style="width: 605px" class="wp-caption aligncenter"><img class=" wp-image-46145" src="media/21213c6d.titled.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/12/titled.jpg" alt="" width="595" height="519" /><p class="wp-caption-text">The Instagram profile of Troy Woody Jr., a.k.a. &#8220;titled,&#8221; and &#8220;MrOsama,&#8221; one of two Americans arrested today for allegedly dumping a woman&#8217;s body in a Manila river. The woman pictured on the left is believed to the victim, identified as Woody&#8217;s condo roommate, <strong>Tomi Michelle Masters</strong>, 23.</p></div>
<p>People are innocent until proven guilty in a court of law, at least in the United States. But I can&#8217;t say any of this surprises me. Most I&#8217;ve encountered who were involved serial swatting and stalking attacks definitely had a few screws loose and were fairly scary individuals. Case in point: <a href="https://krebsonsecurity.com/?s=tyler+barriss&amp;x=0&amp;y=0" target="_blank" rel="noopener">Tyler Barriss</a>, the 25-year-old admitted serial swatter and stalker who <a href="https://krebsonsecurity.com/2018/11/calif-man-pleads-guilty-in-fatal-swatting-case-faces-20-years-in-prison/" target="_blank" rel="noopener">pleaded guilty to a swatting attack last year</a> that ended with police shooting and killing an innocent, unarmed man.</p>
<p><strong>Update, 7:13 p.m. ET:</strong> An earlier version of this story incorrectly stated the accused hailed an Uber.</p>


feed_id: https://krebsonsecurity.com/?p=46164
title: Happy 9th Birthday, KrebsOnSecurity!
uri: Happy-9th-Birthday-KrebsOnSecurity
url: https://krebsonsecurity.com/2018/12/happy-9th-birthday-krebsonsecurity/
content:
<p>Hard to believe we&#8217;ve gone another revolution around the Sun: Today marks the <a href="https://krebsonsecurity.com/2009/12/welcome-to-krebsonsecurity-com/" target="_blank" rel="noopener">9th anniversary</a> of KrebsOnSecurity.com!</p>
<p><img class="alignright size-full wp-image-46171" src="media/a949ef78.ix-2.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/12/ix-2.jpg" alt="" width="239" height="246" />This past year featured some <a href="https://krebsonsecurity.com/2018/" target="_blank" rel="noopener">150 blog posts</a>, but as usual the biggest contribution to this site came from the amazing community of readers here who have generously contributed their knowledge, wit and wisdom in more than 10,000 comments.</p>
<p>Speaking of generous contributions, more than 100 readers have expressed their support in 2018 via <a href="https://www.paypal.com/cgi-bin/webscr?cmd=_s-xclick&amp;hosted_button_id=MCCRKHWRX57HS" target="_blank" rel="noopener">PayPal donations</a> to this site. The majority of those funds go toward paying for subscription-based services that KrebsOnSecurity relies upon for routine data gathering and analysis. Thank you.</p>
<p>Your correspondence and tips have been invaluable, so by all means keep them coming. For the record, I&#8217;m reachable via a variety of means, including <a href="mailto:krebsonsecurity@gmail.com">email</a>, <a href="https://krebsonsecurity.com/about/" target="_blank" rel="noopener">the contact form on this site</a>, and of course <a href="https://www.facebook.com/briankrebs" target="_blank" rel="noopener">Facebook</a>, <a href="https://www.linkedin.com/in/bkrebs/" target="_blank" rel="noopener">LinkedIn</a>, and <a href="https://www.twitter.com/briankrebs" target="_blank" rel="noopener">Twitter</a> (direct messages are open to all). For more secure and discreet communications, please consider reaching out via <a href="https://keybase.io/briankrebs" target="_blank" rel="noopener">Keybase</a>, <a href="https://wickr.com/" target="_blank" rel="noopener">Wicker</a> (krebswickr), or <a href="https://signal.org/" target="_blank" rel="noopener">Signal</a> (by request).<span id="more-46164"></span></p>
<p>Many of you have requested a redesign to make this site more mobile-friendly. We&#8217;d targeted for that to happen in 2018, but multiple unforeseen circumstances conspired to delay that project this year. Rest assured, that long-overdue change will be coming soon in 2019. Thanks for your patience.</p>
<p>Below are some of the most-read and commented-on enterprise stories throughout 2018, a year marked by a relentless onslaught of data breaches, data leaks and increasingly sneaky scams. It seems unlikely that 2019 will be any different, and while I will endeavor to keep readers abreast of the latest threats and trends, I&#8217;m also interested to hear what you would like to see more of in the coming year. So please sound off in the comments below or drop me a note.</p>
<p>By the way, if you&#8217;d prefer to keep up with KrebsOnSecurity posts via email, please consider <a href="https://krebsonsecurity.com/subscribe/" target="_blank" rel="noopener">signing up for the newsletter</a> (expect ~3-4 emails per week).</p>
<p>Thanks again for your readership, encouragement and support. Happy New Year!</p>
<p><a href="https://krebsonsecurity.com/2018/12/a-chief-security-concern-for-executive-teams/" target="_blank" rel="noopener">A Chief Security Concern for Executive Teams</a></p>
<p><a href="https://krebsonsecurity.com/2018/12/what-the-marriott-breach-says-about-security/" target="_blank" rel="noopener">What the Marriott Breach Says About Security</a></p>
<p><a href="https://krebsonsecurity.com/2018/11/half-of-all-phishing-sites-now-have-the-padlock/" target="_blank" rel="noopener">Half of All Phishing Sites Now Have the Padlock</a></p>
<p><a href="https://krebsonsecurity.com/2018/10/voice-phishing-scams-are-getting-more-clever/" target="_blank" rel="noopener">Voice Phishing Scams Are Getting More Clever</a></p>
<p><a href="https://krebsonsecurity.com/2018/08/hanging-up-on-mobile-in-the-name-of-security/" target="_blank" rel="noopener">Hanging Up on Mobile in the Name of Security</a></p>
<p><a href="https://krebsonsecurity.com/2018/07/google-security-keys-neutralized-employee-phishing/" target="_blank" rel="noopener">Google: Security Keys Neutralized Employee Phishing</a></p>
<p><a href="https://krebsonsecurity.com/2018/06/plant-your-flag-mark-your-territory/" target="_blank" rel="noopener">Plant Your Flag, Mark Your Territory</a></p>
<p><a href="https://krebsonsecurity.com/2018/04/panerabread-com-leaks-millions-of-customer-records/" target="_blank" rel="noopener">Panerabread.com Leaks Millions of Customer Records</a></p>
<p><a href="https://krebsonsecurity.com/2018/05/tracking-firm-locationsmart-leaked-location-data-for-customers-of-all-major-u-s-mobile-carriers-in-real-time-via-its-web-site/" target="_blank" rel="noopener">Tracking Firm LocationSmart Leaked Location Data for Customers of All Major U.S. Mobile Carriers</a></p>
<p><a href="https://krebsonsecurity.com/2018/04/dont-give-away-historic-details-about-yourself/" target="_blank" rel="noopener">Don&#8217;t Give Away Historical Details About Yourself</a></p>


feed_id: https://krebsonsecurity.com/?p=46190
title: Cloud Hosting Provider DataResolution.net Battling Christmas Eve Ransomware Attack
uri: Cloud-Hosting-Provider-DataResolution-net-Battling-Christmas-Eve-Ranso
url:
https://krebsonsecurity.com/2019/01/cloud-hosting-provider-dataresolution-net-battling-christmas-eve-ransomware-attack/

content:
<p>Cloud hosting provider <strong>Dataresolution.net</strong> is struggling to bring its systems back online after suffering a ransomware infestation on Christmas Eve, KrebsOnSecurity has learned. The company says its systems were hit by the <strong>Ryuk</strong> ransomware, the same malware strain that crippled printing and delivery operations for multiple major U.S. newspapers over the weekend.</p>
<p>San Juan Capistrano, Calif. based <strong>Data Resolution LLC</strong> serves <a href="https://www.erpsoftwareblog.com/members/isv-directory/data-resolution/" target="_blank" rel="noopener">some 30,000 businesses worldwide</a>, offering software hosting, business continuity systems, cloud computing and data center services.</p>
<p>The company has not yet responded to requests for comment. But according to a status update shared by Data Resolution with affected customers on Dec. 29, 2018, the attackers broke in through a compromised login account on Christmas Eve and quickly began infecting servers with the Ryuk ransomware strain.</p>
<div id="attachment_46192" style="width: 604px" class="wp-caption aligncenter"><img class=" wp-image-46192" src="media/ed9cdd9d.datares-12-29.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/01/datares-12-29.jpg" alt="" width="594" height="553" /><p class="wp-caption-text">Part of an update on the outage shared with Data Resolution customers via Dropbox on Dec. 29, 2018.</p></div>
<p>The intrusion gave the attackers control of Data Resolution&#8217;s data center domain, briefly locking the company out of its own systems. The update sent to customers states that Data Resolution shut down its network to halt the spread of the infection and to work through the process of cleaning and restoring infected systems.</p>
<p>Data Resolution is assuring customers that there is no indication any data was stolen, and that the purpose of the attack was to extract payment from the company in exchange for a digital key that could be used to quickly unlock access to servers seized by the ransomware.</p>
<div id="attachment_46193" style="width: 606px" class="wp-caption aligncenter"><img class=" wp-image-46193" src="media/2af89a0c.dataresolution-notice.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/01/dataresolution-notice.jpg" alt="" width="596" height="382" /><p class="wp-caption-text">A snippet of an update that Data Resolution shared with affected customers on Dec. 31, 2018.</p></div>
<p>The Ryuk ransomware strain was first detailed in an August 2018 <a href="https://research.checkpoint.com/ryuk-ransomware-targeted-campaign-break/" target="_blank" rel="noopener">report</a> by security firm <strong>CheckPoint</strong>, which says the malware may be tied to a sophisticated North Korean hacking team known as the <a href="https://en.wikipedia.org/wiki/Lazarus_Group" target="_blank" rel="noopener">Lazarus Group</a>.</p>
<p>Ryuk <a href="https://www.latimes.com/local/lanow/la-me-cyberattack-times-newspaper-malware-20181229-story.html" target="_blank" rel="noopener">reportedly</a> was the same malware that infected the <strong>Los Angeles Times</strong>&#8216; Olympic printing plant over the weekend, an attack that led to the disruption of newspaper printing and delivery services for a number of publications that rely on the plant &#8212; including the Los Angeles Times and the <strong>San Diego Union Tribune</strong>.</p>
<p>A status update shared by Data Resolution with affected customers earlier today indicates the cloud hosting provider is still working to restore email access and multiple databases for clients. The update also said Data Resolution is in the process of restoring service for companies relying on it to host installations of <a href="https://en.wikipedia.org/wiki/Microsoft_Dynamics_GP" target="_blank" rel="noopener">Dynamics GP</a>, a popular software package that many organizations use for accounting and payroll services. <span id="more-46190"></span></p>
<div id="attachment_46196" style="width: 273px" class="wp-caption alignright"><img class="size-full wp-image-46196" src="media/5a70b972.dataresolution-status.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/01/dataresolution-status.jpg" alt="" width="263" height="279" /><p class="wp-caption-text">A status update shared by Data Resolution with affected customers on Jan. 2, 2018 shows the company is still struggling to restore services more than a week after the attack began.</p></div>
<p>Cloud hosting providers are often pitched as a way for companies to increase security and to better protect themselves from threats like ransomware, which scrambles data on infected systems and demands payment in exchange for a digital key needed to unlock affected systems.</p>
<p>At the same time, cloud providers represent <a href="https://krebsonsecurity.com/2016/01/ransomware-a-threat-to-cloud-services-too/" target="_blank" rel="noopener">an especially attractive target for ransomware attacks</a> because they store vast amounts of data for other companies. In 2017, cloud hosting provider <strong>Cloudnine</strong> was <a href="https://www.accountingtoday.com/opinion/the-tech-take-what-happened-at-cloudnine" target="_blank" rel="noopener">hit by a ransomware attack</a>, leading to an outage that lasted for several days.</p>
<p>Much depends on security practices maintained by each provider, according to an <em>MIT Technology Review</em> story last year that named cloud ransomware attacks as a top security concern for 2018</p>
<p>&#8220;The biggest cloud operators, like Google, Amazon, and IBM, have hired some of the brightest minds in digital security, so they won’t be easy to crack,&#8221; <a href="https://www.technologyreview.com/s/609641/six-cyber-threats-to-really-worry-about-in-2018/" target="_blank" rel="noopener">wrote</a> <strong>Martin Giles</strong>. &#8220;But smaller companies are likely to be more vulnerable, and even a modest breach could lead to a big payday for the hackers involved.&#8221;</p>
<p>A source at a company that uses Data Resolution to manage payroll payments told KrebsOnSecurity that the cloud hosting provider said it did not attempt to pay the requested ransom, preferring to restore systems from backups instead.</p>


feed_id: https://krebsonsecurity.com/?p=46207
title: Apple Phone Phishing Scams Getting Better
uri: Apple-Phone-Phishing-Scams-Getting-Better
url: https://krebsonsecurity.com/2019/01/apple-phone-phishing-scams-getting-better/
content:
<p>A new phone-based phishing scam that spoofs <strong>Apple Inc.</strong> is likely to fool quite a few people. It starts with an automated call that display&#8217;s Apple&#8217;s logo, address and real phone number, warning about a data breach at the company. The scary part is that if the recipient is an iPhone user who then requests a call back from Apple&#8217;s legitimate customer support Web page, the fake call gets indexed in the iPhone&#8217;s &#8220;recent calls&#8221; list as a previous call from the legitimate Apple Support line.</p>
<p><strong>Jody Westby</strong> is the CEO of <a href="https://globalcyberrisk.com/our-team/jody-westby/" target="_blank" rel="noopener">Global Cyber Risk LLC</a>,  a security consulting firm based in Washington, D.C. Westby said earlier today she received an automated call on her iPhone warning that multiple servers containing Apple user IDs had been compromised (the same scammers had called her at 4:34 p.m. the day before, but she didn&#8217;t answer that call). The message said she needed to call a 1-866 number before doing anything else with her phone.</p>
<p>Here&#8217;s what her iPhone displayed about the identity of the caller when they first tried her number at 4:34 p.m. on Jan. 2, 2019:</p>
<div id="attachment_46208" style="width: 583px" class="wp-caption aligncenter"><img class=" wp-image-46208" src="media/eaa316df.firstapple.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/01/firstapple.png" alt="" width="573" height="1019" /><p class="wp-caption-text">What Westby&#8217;s iPhone displayed as the scam caller&#8217;s identity. Note that it lists the correct Apple phone number, street address and Web address (minus the https://).</p></div>
<p>Note in the above screen shot that it lists Apple&#8217;s actual street address, their real customer support number, and the real Apple.com domain (albeit without the &#8220;s&#8221; at the end of &#8220;http://&#8221;). The same caller ID information showed up when she answered the scammers&#8217; call this morning.</p>
<p>Westby said she immediately went to the Apple.com support page (https://www.support.apple.com) and requested to have a customer support person call her back. The page displayed a &#8220;case ID&#8221; to track her inquiry, and just a few minutes later someone from the real Apple Inc. called her and referenced that case ID number at the start of the call.</p>
<p>Westby said the Apple agent told her that Apple had not contacted her, that the call was almost certainly a scam, and that Apple would never do that &#8212; all of which she already knew. But when Westby looked at her iPhone&#8217;s recent calls list, she saw the legitimate call from Apple had been lumped together with the scam call that spoofed Apple:</p>
<div id="attachment_46210" style="width: 600px" class="wp-caption aligncenter"><img class=" wp-image-46210" src="media/a2756d0b.applerecentcalls.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/01/applerecentcalls.png" alt="" width="590" height="1049" /><p class="wp-caption-text">The fake call spoofing Apple &#8212; at 11:44 a.m. &#8212; was lumped in the same recent calls list as the legitimate call from Apple. The call at 11:47 was the legitimate call from Apple. The call listed at 11:51 a.m. was the result of Westby accidentally returning the call from the scammers, which she immediately disconnected.</p></div>
<p>The call listed at 11:51 a.m. <em>was the result of Westby accidentally returning the call from the scammers</em>, which she immediately disconnected.</p>
<p>&#8220;I told the Apple representative that they ought to be telling people about this, and he said that was a good point,&#8221; Westby said. &#8220;This was so convincing I&#8217;d think a lot of other people will be falling for it.&#8221;<span id="more-46207"></span></p>
<p>KrebsOnSecurity called the number that the scam message asked Westby to contact (866-277-7794). An automated system answered and said I&#8217;d reached Apple Support, and that my expected wait time was about one minute and thirty seconds. About a minute later, a man with an Indian accent answered and inquired as to the reason for my call.</p>
<p>Playing the part of someone who had received the scam call, I told him I&#8217;d been alerted about a breach at Apple and that I needed to call this number. After asking me to hold for a brief moment, our call was disconnected.</p>
<p>No doubt this is just another scheme to separate the unwary from their personal and financial details, and to extract some kind of payment (for supposed tech support services or some such). But it is remarkable that Apple&#8217;s own devices (or AT&amp;T, which sold her the phone) can&#8217;t tell the difference between a call from Apple and someone trying to spoof Apple.</p>
<p>As I noted in my October 2018 piece, <a href="https://krebsonsecurity.com/2018/10/voice-phishing-scams-are-getting-more-clever/" target="_blank" rel="noopener">Voice Phishing Scams are Getting More Clever</a>, phone phishing usually invokes an element of urgency in a bid to get people to let their guard down. If a call has you worried that there might be something wrong and you wish to call them back, don’t call the number offered to you by the caller. If you want to reach your bank, for example, call the number on the back of your card. If it’s another company you do business with, go to the company’s Web site and look up their main customer support number.</p>
<p>Relying on anything other than a number obtained directly from the company in question &#8212; such as a number obtained from a direct search on Google or another search engine &#8212; is also extremely risky. In many cases, the scammers are <a href="https://krebsonsecurity.com/2018/02/money-laundering-via-author-impersonation-on-amazon/" target="_blank" rel="noopener">polluting top search engine results with phony 800-numbers for customer support lines that lead directly to fraudsters</a>.</p>
<p>These days, scam calls happen on my mobile so often that I almost never answer my phone unless it appears to come from someone in my contacts list. But as this scam shows, even that&#8217;s not always a great strategy.</p>
<p>It’s a good idea to advise your friends and loved ones to ignore calls unless they appear to come from a friend or family member, and most importantly <em>to just hang up the moment the caller starts asking for personal information.</em></p>
<p>Apple has not yet responded to requests for comment.</p>


feed_id: https://krebsonsecurity.com/?p=46036
title: Dirt-Cheap, Legit, Windows Software: Pick Two
uri: Dirt-Cheap-Legit-Windows-Software-Pick-Two
url: https://krebsonsecurity.com/2019/01/dirt-cheap-legit-windows-software-pick-two/
content:
<p>Buying heavily discounted, popular software from second-hand sources online has always been something of an iffy security proposition. But purchasing steeply discounted licenses for cloud-based subscription products like recent versions of <strong>Microsoft Office</strong> can be an extremely risky transaction, mainly because you may not have full control over who has access to your data.</p>
<p>Last week, KrebsOnSecurity heard from a reader who&#8217;d just purchased a copy of <strong>Microsoft Office 2016 Professional Plus</strong> from a seller on <strong>eBay</strong> <em>for less than $4</em>. Let&#8217;s call this Red Flag #1, as a legitimately purchased license of Microsoft Office 2016 is still going to cost between $70 and $100. Nevertheless, almost 350 other people had made the same purchase from this seller over the past year, according to eBay, and there appear to be many auctioneers just like this one.</p>
<p><a class="lightbox" href="media/0f18e3bc.350ebay.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/12/350ebay.jpg"><img class="aligncenter wp-image-46074" src="media/0f18e3bc.350ebay.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/12/350ebay.jpg" alt="" width="597" height="302" /></a></p>
<p>After purchasing the item, the buyer said he received the following explanatory (exclamatory?) email from the seller &#8212; &#8220;<a href="https://feedback.ebay.com/ws/eBayISAPI.dll?ViewFeedback2&amp;userid=newhotsale68&amp;&amp;_trksid=p2047675.l2560&amp;rt=nc&amp;iid=292830187444&amp;sspagename=VIP%3Afeedback&amp;ftab=FeedbackAsSeller" target="_blank" rel="noopener">Newhotsale68</a>&#8221; from Vietnam:</p>
<blockquote><p>Hello my friend!<br />
Thank you for your purchase:)</p>
<p>Very important! Office365 is a subscription product and does not require any KEY activation. Account + password = free lifetime use</p>
<p>1. Log in with the original password and the official website will ask you to change your password!</p>
<p>2. Be sure to remember the modified new password. Once you forget your password, you will lose Office365!</p>
<p>3. After you change your password, log on to the official website to start downloading and installing Office365!</p>
<p>Your account information:</p>
<p>* USERMANE : (sent username)<br />
Password Initial: (sent password)<br />
Microsoft Office 365 access link:</p>
<p>Http://portal.office.com/</p></blockquote>
<p>Sounds legit, right?</p>
<p>This merchant appears to be reselling access to existing Microsoft Office accounts, because in order to use this purchase the buyer must log in to Microsoft&#8217;s site <em>using someone else&#8217;s username and password!</em> Let&#8217;s call this Red Flag #2.</p>
<p>More importantly, the buyer can&#8217;t change the email address associated with the license, which means whoever owns that address can likely still assume control over any licenses tied to it. We&#8217;ll call this Ginormous Red Flag #3.<span id="more-46036"></span></p>
<p>&#8220;The username that you use to register and activate Office is one that they provide to you in their email when you buy the license on eBay,&#8221; wrote the reader who alerted me about this dodgy transaction. &#8220;You never use your own email account to register, you have to log in with theirs. Once you&#8217;re inside the account you can&#8217;t change the username to your email account because the admin locked it down.&#8221;</p>
<p>Here&#8217;s what the profile looked like when the reader tried to change details tied to the license.</p>
<p><a class="lightbox" href="media/fc19452a.tik207.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/12/tik207.jpg"><img class="aligncenter wp-image-46073 size-full" src="media/fc19452a.tik207.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/12/tik207.jpg" alt="" width="430" height="619" /></a></p>
<p>This version of Office prompts the user to sync all data and documents over to a 5TB Microsoft OneDrive account. What could go wrong?</p>
<p>&#8220;You can sign out of their Microsoft account to break the connection to the OneDrive account,&#8221; the reader said. &#8220;By default it had me signed in and I bet most people installing this just click next and stay signed in.&#8221;</p>
<p>That&#8217;s not all: The account was set up so that the administrator (seller) maintained control over specific apps on the Office installation, including <strong>OneNote</strong> and <strong>Class Notebook</strong>.</p>
<p><a class="lightbox" href="media/c4f52ee6.apppermissions.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/12/apppermissions.jpg"><img class="aligncenter wp-image-46080" src="media/c4f52ee6.apppermissions.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/12/apppermissions.jpg" alt="" width="591" height="244" /></a></p>
<p>&#8220;I guess maybe the end result of all of this are the old adages, &#8216;you get what you pay for&#8217; and, &#8216;if it sounds too good to be true than it probably is,'&#8221; the reader said at the conclusion of his email.</p>
<p>Couldn&#8217;t have said it better myself.</p>


feed_id: https://krebsonsecurity.com/?p=46230
title: Patch Tuesday, January 2019 Edition
uri: Patch-Tuesday-January-2019-Edition
url: https://krebsonsecurity.com/2019/01/patch-tuesday-january-2019-edition/
content:
<p><strong>Microsoft</strong> on Tuesday released updates to fix roughly four dozen security issues with its <strong>Windows</strong> operating systems and related software. All things considered, this first Patch Tuesday of 2019 is fairly mild, bereft as it is of any new <strong>Adobe Flash</strong> updates or zero-day exploits. But there are a few spicy bits to keep in mind. Read on for the gory details.<span id="more-46230"></span></p>
<p><img class="alignright size-full wp-image-26837" src="media/863df0f6.brokenwindows.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2014/07/brokenwindows.png" alt="" width="229" height="240" />The updates released Tuesday affect Windows, <strong>Internet Explorer</strong> and <strong>Edge</strong>, <strong>Office</strong>, <strong>Sharepoint</strong>, <strong>.NET Framework</strong> and <strong>Exchange</strong>. Patches are available for all client and server versions of Windows, but none of the &#8220;critical&#8221; flaws &#8212; those that can lead to a remote system compromise without any help from users &#8212; apply to <strong>Windows 7</strong> or <strong>Windows 8.1</strong>, according to <strong>Martin Brinkmann</strong> at <a href="https://www.ghacks.net/2019/01/08/microsoft-windows-security-updates-january-2019-overview/" target="_blank" rel="noopener">Ghacks.net</a>.</p>
<p>Mercifully, none of the vulnerabilities fixed in Tuesday&#8217;s bundle are being actively exploited, although one (<a href="https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0579" target="_blank" rel="noopener">CVE-2019-0579)</a> was publicly disclosed prior to the patch release, meaning attackers may have had a head start figuring out how to exploit it. This bug is one of 11 that Microsoft fixed in its <a href="https://en.wikipedia.org/wiki/Microsoft_Jet_Database_Engine" target="_blank" rel="noopener">Jet Database Engine</a>.</p>
<p>Among the more eyebrow-raising flaws fixed this week is <a href="https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0547" target="_blank" rel="noopener">CVE-2019-0547</a>, a weakness in the Windows component responsible for assigning Internet addresses to host computers (a.k.a. &#8220;Windows DHCP client&#8221;). According to security vendor <strong>Tenable</strong>, this is the most severe bug of the entire patch batch.</p>
<p>&#8220;In order to exploit the vulnerability, an attacker would need to be able to send a specially crafted DHCP response to its target, allowing them to run arbitrary code on the client machine,&#8221; said <strong>Satnam Narang</strong>, senior research engineer at Tenable.</p>
<p>Tuesday&#8217;s update bundle also includes a fix that <a href="https://krebsonsecurity.com/2018/12/microsoft-issues-emergency-fix-for-ie-zero-day/" target="_blank" rel="noopener">Microsoft released late last month as an emergency patch</a> to plug a zero-day flaw in <strong>Internet Explorer</strong> (<a href="https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8653" target="_blank" rel="noopener">CVE-2018-8653</a>) that attackers are already exploiting. Experts at <strong>Recorded Future</strong> say that vulnerability continues to be exploited in the wild, with several exploit kits now including the publicly released proof-of-concept code into their platforms.</p>
<p>&#8220;If you have not patched this vulnerability yet, it should be the number one priority,&#8221; writes <strong>Allan Liska</strong>, senior solutions architect at Recorded Future.</p>
<p>It generally can’t hurt for Windows users to wait a day or two after Microsoft releases monthly security updates before installing the fixes; occasionally buggy patches can cause serious headaches for users who install them before all the kinks are worked out.</p>
<p>Case in point: Computerworld&#8217;s <a href="https://www.computerworld.com/article/3332202/microsoft-windows/patch-tuesday-updates-for-win7-kb-4480970-and-kb-4480960-knock-out-networking.html" target="_blank" rel="noopener">Woody Leonhard</a> notes that multiple organizations are reporting problems with their file-sharing operations after installing this month&#8217;s patch rollup.</p>
<p><strong>Windows 10</strong> likes to install patches all in one go and reboot your computer on its own schedule. Microsoft doesn’t make it easy for Windows 10 users to change this setting, <a href="https://www.howtogeek.com/224471/how-to-prevent-windows-10-from-automatically-downloading-updates/" target="_blank" rel="noopener">but it is possible</a>. For all other Windows OS users, if you’d rather be alerted to new updates when they’re available so you can choose when to install them, there’s a setting for that in <strong>Windows Update</strong>. Also, it’s a good idea to get in the habit of backing up your data <em>before</em> installing Windows updates.</p>
<p>Adobe released an update for its Flash Player plugin, but alas there don&#8217;t appear to be any security fixes in it. However, the company last Thursday did release new versions of its <strong>Adobe Acrobat</strong> and <strong>Reader</strong> that correct <a href="https://helpx.adobe.com/security/products/acrobat/apsb19-02.html" target="_blank" rel="noopener">at least two critical vulnerabilities</a> in each.</p>
<p>If you experience any problems installing any of these patches this month, please feel free to leave a comment about it below; there’s a good chance other readers have experienced the same and may even chime in here with some helpful tips.</p>


feed_id: https://krebsonsecurity.com/?p=45913
title: Secret Service: Theft Rings Turn to Fuze Cards
uri: Secret-Service-Theft-Rings-Turn-to-Fuze-Cards
url: https://krebsonsecurity.com/2019/01/secret-service-theft-rings-turn-to-fuze-cards/
content:
<p>Street thieves who specialize in cashing out stolen credit and debit cards increasingly are hedging their chances of getting caught carrying multiple counterfeit cards by relying on <a href="https://www.fuzecard.com/" target="_blank" rel="noopener">Fuze Cards</a>, a smartcard technology that allows users to store dozens of cards on a single device, the <strong>U.S. Secret Service</strong> warns.</p>
<div id="attachment_46238" style="width: 540px" class="wp-caption aligncenter"><img class="size-full wp-image-46238" src="media/eff89205.fuzeimage.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/01/fuzeimage.jpg" alt="" width="530" height="278" /><p class="wp-caption-text">A Fuze card can store up to 30 credit/debit cards. Image: Fuzecard.com</p></div>
<p>Launched in May 2017, the Fuze Card is a data storage device that looks like a regular credit card but can hold account data for up to 30 credit cards. The Fuze Card displays no credit card number on either side, instead relying on a small display screen on the front that cardholders can use to change which stored card is to be used to complete a transaction.</p>
<p>After the user chooses the card data to be used, the card data is made available in the dynamic magnetic stripe on the back of the card or via the embedded smart chip. Fuze cards also can be used at ATMs to withdraw funds.</p>
<p>An internal memo the U.S. Secret Service shared with financial industry partners states that Secret Service field offices in New York and St. Louis are currently working criminal investigations where Fuze Cards have been used by fraud rings.</p>
<p>The memo, a copy of which was obtained by KrebsOnSecurity, states that card theft rings are using Fuze Cards to avoid raising suspicions that may arise when shuffling through multiple counterfeit cards at the register.</p>
<p><span class="pullquote pqright">&#8220;The transaction may also appear as a declined transaction but the fraudster, with the push of a button, is changing the card numbers being used,&#8221; the memo notes.</span></p>
<p>Fraud rings often will <a href="https://krebsonsecurity.com/2014/06/peek-inside-a-professional-carding-shop/" target="_blank" rel="noopener">purchase data on thousands of credit and debit cards</a> stolen from hacked point-of-sale devices or obtained via physical card skimmers. The data can be encoded onto any card with a magnetic stripe, and then used to buy high-priced items at retail outlets &#8212; or to withdrawn funds from ATMs (if the fraudsters also have the cardholder&#8217;s PIN).</p>
<p>But getting caught holding dozens of counterfeit or stolen cards is tough to explain to authorities. Hence, the allure of the Fuze Card, which may appear to the casual observer to be just another credit card in one&#8217;s wallet.<span id="more-45913"></span></p>
<p>&#8220;While this smart card technology makes up a small portion of fraudulent credit cards currently, investigators should be aware of the potential for significant increases in fraud loss amounts with the emergence of this smart card technology,&#8221; the Secret Service memo concludes.</p>
<p>Fuze Card did not respond to requests for comment.</p>
<p>In many ways, it is unsurprising that thieves are turning to this new technology to perpetrate credit card fraud, which is something of a constant cat-and-mouse game that employs ever-changing techniques. For evidence of this, one need only look to <a href="https://krebsonsecurity.com/all-about-skimmers/" target="_blank" rel="noopener">the constant innovations that fraudsters come up with to deploy physical card skimmers at ATMs and retail checkout lanes</a>.</p>
<p>No doubt, fraudsters engaged in money laundering via virtual currencies like bitcoin will be doubly interested in Fuze Cards in the coming months. Fuze Card says that later this year <a href="https://medium.com/fuzex/bi-weekly-update-21-12-2018-286d4ecfc5ec" target="_blank" rel="noopener">it plans to launch FuzeX</a>, which contains the same amenities of the Fuze Card and will allow users to conduct purchases using virtual currencies.</p>


feed_id: https://krebsonsecurity.com/?p=46248
title: Courts Hand Down Hard Jail Time for DDoS
uri: Courts-Hand-Down-Hard-Jail-Time-for-DDoS
url: https://krebsonsecurity.com/2019/01/courts-hand-down-hard-jail-time-for-ddos/
content:
<p>Seldom do people responsible for launching crippling cyberattacks face justice, but increasingly courts around the world are making examples of the few who do get busted for such crimes. On Friday, a 34-year-old Connecticut man received a whopping 10-year prison sentence for carrying out distributed denial-of-service (DDoS) attacks against a number of hospitals in 2014. Also last week, a 30-year-old in the United Kingdom was sentenced to 32 months in jail for using an army of hacked devices to crash large portions of Liberia&#8217;s Internet access in 2016.</p>
<div id="attachment_46254" style="width: 265px" class="wp-caption alignright"><img class="wp-image-46254 " src="media/f668d313.kaye.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/01/kaye.jpg" alt="" width="255" height="307" /><p class="wp-caption-text">Daniel Kaye. Photo: National Crime Agency</p></div>
<p><strong>Daniel Kaye</strong>, an Israel-U.K. dual citizen, admitted attacking an African phone company in 2016, and to inadvertently knocking out Internet access for much of the country in the process. Kaye launched the attack using a botnet powered by <a href="https://krebsonsecurity.com/?s=mirai&amp;x=0&amp;y=0" target="_blank" rel="noopener">Mirai</a>, a malware strain that enslaves hacked Internet of Things (IoT) devices like poorly-secured Internet routers and Web-based cameras for use in large-scale cyberattacks.</p>
<p>According to court testimony, Kaye was hired in 2015 to attack <strong>Lonestar</strong>, Liberia&#8217;s top mobile phone and Internet provider. Kaye pocketed $10,000 for the attack, which was alleged to have been paid for by an individual working for <strong>Cellcom</strong>, Lonestar&#8217;s competitor in the region. As reported by Israeli news outlet <a href="https://www.haaretz.com/israel-news/.premium-the-israeli-businessmen-who-got-rich-off-angola-s-war-and-their-ties-to-cyberattack-1.6792027" target="_blank" rel="noopener">Haaretz</a>, Kaye testified that the attack was ordered by the CEO of Cellcom Liberia.</p>
<p>In February 2017, authorities in the United Kingdom arrested Kaye an extradited him to Germany to face charges of knocking more than 900,000 Germans offline in a Mirai attack in November 2016. Prosecutors withheld Kaye&#8217;s full name throughout the trial in Germany, but in July 2017 KrebsOnSecurity <a href="https://krebsonsecurity.com/2017/07/who-is-the-govrat-author-and-mirai-botmaster-bestbuy/" target="_blank" rel="noopener">published findings that named Kaye as the likely culprit</a>. Kaye ultimately <a href="https://krebsonsecurity.com/2017/07/suspended-sentence-for-mirai-botmaster-daniel-kaye/" target="_blank" rel="noopener">received a suspended sentence</a> for the attack in Germany, and was sent back to the U.K. to face charges there.</p>
<p>The July 2017 KrebsOnSecurity investigation also linked Kaye to the development and sale of a sophisticated piece of spyware named <strong>GovRAT</strong>, which is documented to have been used in numerous cyber espionage campaigns against governments, financial institutions, defense contractors and more than 100 corporations.</p>
<p>The U.K.&#8217;s <strong>National Crime Agency</strong> called Kaye perhaps the most significant cyber criminal yet caught in Britain. A <a href="https://www.bbc.co.uk/news/uk-46840461" target="_blank" rel="noopener">report on the trial from the BBC</a> says Kaye wept as he was taken away to jail.<span id="more-46248"></span></p>
<p>Here across the pond, 34-year-old <strong>Martin Gottesfeld</strong> was sentenced to 10 years in prison and ordered to pay $443,000 in restitution for damages caused by a series of DDoS attacks he launched against several Boston-area hospitals in 2014. Like Kaye, Gottesfeld was identified thanks to clue he left behind on the Internet: Prosecutors reportedly linked him to a video he uploaded to Youtube about the attack campaign.</p>
<p>The Boston Globe <a href="https://www.boston.com/news/local-news/2019/01/11/martin-gottesfeld-boston-childrens-hospital" target="_blank" rel="noopener">reports</a> that Gottesfeld and his wife in 2016 tried to flee to Cuba in a rented boat, but the trip didn&#8217;t go as planned. It seems the high seas had their own denial-of-service in store for the Gottesfelds: They were rescued from the Gulf of Mexico by a Disney ship that answered Martin&#8217;s SOS distress call and brought them back to the United States.</p>
<p>Ten years may seem like a stiff sentence for DDoS and fleeing from justice, but <a href="https://krebsonsecurity.com/2016/11/akamai-on-the-record-krebsonsecurity-attack/" target="_blank" rel="noopener">as the recipient of hundreds of DDoS attacks</a> over the years I can&#8217;t say it bothers me one bit &#8212; especially considering how few of the anonymous cowards responsible for DDoS attacks are ever held accountable.</p>
<p>Cue the usual comments here about how these guys deserved jobs and not jail, but I for one am glad the courts are starting to recognize that these are real and costly crimes that deserve equally real consequences. Remember: Don&#8217;t do the crime if you can&#8217;t do the time.</p>


feed_id: https://krebsonsecurity.com/?p=46262
title: “Stole $24 Million But Still Can’t Keep a Friend”
uri: Stole-24-Million-But-Still-Can-t-Keep-a-Friend
url: https://krebsonsecurity.com/2019/01/stole-24-million-but-still-cant-keep-a-friend/
content:
<p>Unsettling new claims have emerged about <strong>Nicholas Truglia</strong>, a 21-year-old Manhattan resident accused of hijacking cell phone accounts to steal tens of millions of dollars in cryptocurrencies from victims. The lurid details, made public in a civil lawsuit filed this week by one of his alleged victims, paints a chilling picture of a man addicted to thievery and all its trappings. The documents suggest that Truglia stole from his father and even a dead man &#8212; all the while lamenting that his fabulous new wealth brought him nothing but misery.</p>
<p><img class="aligncenter size-full wp-image-44711" src="media/daad1d09.newsnip.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/08/newsnip.png" alt="" width="419" height="586" /></p>
<p>The unflattering profile was laid out in a series of documents tied to a lawsuit lodged by <strong>Michael Terpin</strong>, a cryptocurrency investor who co-founded the first angel investor group for bitcoin enthusiasts in 2013. Terpin alleges that crooks stole almost $24 million worth of cryptocurrency after fraudulently executing a “<a href="https://krebsonsecurity.com/?s=sim+swap&amp;x=0&amp;y=0" target="_blank" rel="noopener">SIM swap</a>” on his mobile phone account at AT&amp;T in early 2018. Terpin also <a href="https://krebsonsecurity.com/2018/08/hanging-up-on-mobile-in-the-name-of-security/" target="_blank" rel="noopener">is pursuing a $200 million civil lawsuit against AT&amp;T</a> in connection with the theft.</p>
<p>Authorities <a href="https://nypost.com/2018/11/20/man-hacked-into-silicon-valley-execs-phones-to-steal-cryptocurrency-cops/" target="_blank" rel="noopener">arrested Truglia</a> on November 14, 2018 on suspicion of using SIM swaps to steal approximately $1 million worth of cryptocurrencies from a different Silicon Valley executive. But Terpin&#8217;s <a href="media/99e2fc67.-of-Michael-Terpin-ISO-Plaintiffs-Ex-Parte-Motions-3118143-1.pdf" data-original-source="https://www.greenbergglusker.com/content/uploads/2019/01/Conformed-Declaration-of-Michael-Terpin-ISO-Plaintiffs-Ex-Parte-Motions-3118143-1.pdf" target="_blank" rel="noopener">civil lawsuit</a> (PDF) maintains that evidence was revealed at Truglia’s bail hearing that he had texted his father and multiple friends to brag about the $24 million hack on the day of Terpin’s theft, allegedly offering to take friends to the Super Bowl with “porn star escorts.&#8221;</p>
<p>Terpin&#8217;s lawsuit includes a large number of supporting documents, including an affidavit filed by <strong>Chris David</strong>, a 25-year-old New York City resident who claims to have been an acquaintance of Truglia&#8217;s until he began to unravel the source of his new friend&#8217;s overnight riches.</p>
<p>In <a href="media/7d29d29d.Chris-David-Declaration-Redacted-3119196-1.pdf" data-original-source="https://www.greenbergglusker.com/content/uploads/2019/01/Chris-David-Declaration-Redacted-3119196-1.pdf" target="_blank" rel="noopener">his affidavit</a> (PDF), David describes himself as a self-employed private jet broker who met Truglia in a fitness center attached to Truglia&#8217;s luxury apartment building. Truglia allegedly struck up a conversation about booking private jets with his cryptocurrency. When the two met again a few days later, David says Truglia showed him accounts on his mobile phone and computer indicating he had over $7 million in cash in a JP Morgan account and more than $12 million in various cryptocurrencies.</p>
<p>&#8220;At the same time, Nick showed me two thumb drives (<a href="https://trezor.io/" target="_blank" rel="noopener">Trezors</a>),&#8221; David recounted. &#8220;One had over $40 million in cash value of various cryptos, and the other one had over $20 million cash value of various cryptos.&#8221;</p>
<p>David said Truglia initially explained his wealth by saying he&#8217;d made the money by <a href="https://www.webopedia.com/TERM/C/cryptocurrency-mining.html" target="_blank" rel="noopener">mining cryptocurrencies</a>, but that Truglia later would admit he stole the funds.</p>
<p>&#8220;Over the next few months, Nick and I socialized at nightclubs, local bars, the gym, and in his apartment playing video games,&#8221; David recounted. &#8220;Gradually, I got to know Nick. He does not have a job or visible means of support. His typical day is to get up late, go to the gym, eat at the deli across the street, play video games late into the night and he had no friends. Nick was an egotistical braggart about his life and wealth. For example, once at a crowded lounge, he said: &#8216;Chris, I have more money than all of the people here tonight.'&#8221;</p>
<p>David started documenting Truglia&#8217;s activities after he and several of his friends were arrested for allegedly stealing Truglia&#8217;s laptop, mobile phone and Trezor drive. That incident, recounted in <a href="https://nypost.com/2018/11/06/friends-accused-of-torturing-pal-to-steal-his-cryptocurrency/" target="_blank" rel="noopener">this New York Post story</a>  and in David&#8217;s own testimony, indicates that Truglia later recanted the accusation and chalked it up to confusion resulting from a heavy night of drinking.</p>
<p>According to David, when Truglia wasn&#8217;t bragging about his wealth he was displaying it openly: He lived in a $6,000 per month apartment, wore a Rolex watch which he claimed cost $100,000, and boasted he was going to purchase a $250,000 McLaren sports car. David also said he recorded conversations with Truglia in which the latter admitted to stealing $24 million from Terpin.</p>
<p>David said he even witnessed Truglia attempting a SIM swap at a Times Square AT&amp;T store in August 2018. Here&#8217;s David&#8217;s account of that hijack effort, which allegedly failed when Truglia declined to pay the target&#8217;s overdue phone bill:</p>
<p><a class="lightbox" href="media/0c6ee37e.att-truglio.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/01/att-truglio.jpg"><img class="aligncenter wp-image-46269" src="media/0c6ee37e.att-truglio.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/01/att-truglio.jpg" alt="" width="596" height="329" /></a></p>
<p>The affidavit states that later in the month David took screen shots of a now-defunct Twitter account that Truglia allegedly used (@erupts), which included six different messages about what the theft of $24 million had wrought.</p>
<div id="attachment_46265" style="width: 604px" class="wp-caption aligncenter"><img class=" wp-image-46265" src="media/1f129b50.24m1.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/01/24m1.jpg" alt="" width="594" height="383" /><p class="wp-caption-text">Tweets from the account @erupts, allegedly penned by Nicholas Truglia.</p></div>
<p>&#8220;Stole 24 million but still can&#8217;t keep a friend,&#8221; reads another tweet allegedly tied to Truglia&#8217;s account:</p>
<p><img class="aligncenter wp-image-46266" src="media/346f30e8.24m2.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/01/24m2.jpg" alt="" width="594" height="326" /></p>
<p>David says Truglia even acknowledged stealing $15,000 after hacking into his own father&#8217;s accounts. According to David, Truglia&#8217;s dad asked to be repaid, and that his son agreed to return the money &#8212; but in bitcoin. In the image below &#8212; which David claims was a screenshot he took of a mobile phone chat conversation between Truglia and his father &#8212; the elder expresses mystification and frustration about how to complete the transaction.</p>
<div id="attachment_46267" style="width: 453px" class="wp-caption aligncenter"><img class="size-full wp-image-46267" src="media/7f6d188f.truglia-chat.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/01/truglia-chat.jpg" alt="" width="443" height="639" /><p class="wp-caption-text">A screen shot David says he took of an alleged chat conversation between Truglia and his father regarding repayment of $15,000.</p></div>
<p><span id="more-46262"></span>In the affidavit, David also testifies that he saw Truglia in possession of a fake New York State driver&#8217;s license which had the name and identifying information of a deceased man named <strong>Quentin Capobianco</strong>, but with Truglia&#8217;s photo on the license.</p>
<p>A copy of this phony drivers&#8217; license was documented by investigators with the <strong>Regional Enforcement Allied Computer Team</strong>, or <strong>REACT</strong> &#8212; a task force in Santa Clara, Calif. that is almost singularly focused on tracking down criminals who use unauthorized SIM swaps to steal virtual currencies (for a deep dive into the workings of the REACT Task Force, see my November 2018 story, <a href="https://krebsonsecurity.com/2018/11/busting-sim-swappers-and-sim-swap-myths/" target="_blank" rel="noopener">Busting SIM Swappers and SIM Swap Myths</a>).</p>
<div id="attachment_46272" style="width: 551px" class="wp-caption aligncenter"><img class="size-full wp-image-46272" src="media/ba3a0cb0.capo-dl.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/01/capo-dl.jpg" alt="" width="541" height="339" /><p class="wp-caption-text">David said he took this photograph of a license Truglia had in his possession; the license includes Truglia&#8217;s photograph but the information of a dead man that Truglia allegedly SIM swapped.</p></div>
<p><a href="media/53200476.ttachment-Memorandum-Conformed-3118060-1_Redacted-EXHIBIT-B3.pdf" data-original-source="https://www.greenbergglusker.com/content/uploads/2019/01/Attachment-Memorandum-Conformed-3118060-1_Redacted-EXHIBIT-B3.pdf" target="_blank" rel="noopener">That REACT Task Force investigation report</a> (PDF) was included in Terpin&#8217;s lawsuit, and it lays out how detectives tied Truglia to SIM swaps that allegedly gave him access to Capobianco&#8217;s accounts at <strong>Coinbase</strong>, a virtual currency trading and purchasing platform.</p>
<p>David testified that despite Truglia&#8217;s ill-gotten riches, he was constantly borrowing small amounts of cash and was otherwise tight with his money. Much like David&#8217;s testimony, a <a href="media/5d6af5d6.Attachment-Memorandum-Conformed-3118060-1_Redacted-EXHIBIT-C.pdf" data-original-source="https://www.greenbergglusker.com/content/uploads/2019/01/Attachment-Memorandum-Conformed-3118060-1_Redacted-EXHIBIT-C.pdf" target="_blank" rel="noopener">related memo</a> (PDF) filed by <strong>REACT Detective Caleb Tuttle</strong> suggests that Truglia was in the process of being evicted from his pricey Manhattan apartment because he refused to pay his rent.</p>
<div id="attachment_46271" style="width: 601px" class="wp-caption aligncenter"><img class=" wp-image-46271" src="media/dd45361e.tuttle-cut.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/01/tuttle-cut.jpg" alt="" width="591" height="299" /><p class="wp-caption-text">A snippet from a memo filed about Truglia by REACT Task Force Detective Caleb Tuttle.</p></div>
<p>Truglia is currently being held by Santa Clara authorities on a $1.4 million bond. His next court date is April 10. Neither Truglia nor his attorney could be immediately reached for comment. Members of the REACT Task Force declined to comment for this story.</p>
<p>A SIM card is the tiny, removable chip in a mobile device that allows it to connect to the provider’s network. Customers can legitimately request a SIM swap when their existing SIM card has been damaged, or when they are switching to a different phone that requires a SIM card of another size.</p>
<p>But SIM swaps are frequently abused by scam artists who trick mobile providers into tying a target’s service to a new SIM card and mobile phone that the attackers control. Unauthorized SIM swaps often are perpetrated by fraudsters who have already stolen or phished a target’s password, as many banks and online services rely on text messages to send users a one-time code that needs to be entered in addition to a password for online authentication. However, many online services let customers reset their password merely by using their mobile phones.</p>
<p>All four major wireless carriers — AT&amp;T, <strong>Sprint</strong>, <strong>T-Mobile</strong> and <strong>Verizon</strong> — let customers add security against SIM swaps and related schemes by setting a PIN that needs to be provided over the phone or in person at a store before account changes should be made. But these security features can be bypassed by incompetent or <a href="https://krebsonsecurity.com/2018/05/t-mobile-employee-made-unauthorized-sim-swap-to-steal-instagram-account/" target="_blank" rel="noopener">corrupt</a> <a href="https://krebsonsecurity.com/2018/08/florida-man-arrested-in-sim-swap-conspiracy/" target="_blank" rel="noopener">mobile store employees</a>.</p>
<p>For more on ways to minimize your chances of becoming the next SIM swapping victim, check out the &#8220;What Can You Do?&#8221; section at <a href="https://krebsonsecurity.com/2018/08/hanging-up-on-mobile-in-the-name-of-security/" target="_blank" rel="noopener">the conclusion of this story</a>.</p>


feed_id: https://krebsonsecurity.com/?p=46290
title: 773M Password ‘Megabreach’ is Years Old
uri: 773M-Password-Megabreach-is-Years-Old
url: https://krebsonsecurity.com/2019/01/773m-password-megabreach-is-years-old/
content:
<p>My inbox and Twitter messages positively lit up today with people forwarding stories from <a href="https://www.wired.com/story/collection-one-breach-email-accounts-passwords/?mbid=social_twitter&amp;utm_brand=wired&amp;utm_campaign=wired&amp;utm_medium=social&amp;utm_social-type=owned&amp;utm_source=twitter" target="_blank" rel="noopener"><em>Wired</em></a> and other publications about a supposedly new trove of nearly 773 million unique email addresses and 21 million unique passwords that were posted to a hacking forum. A story in <a href="https://www.theguardian.com/technology/2019/jan/17/breached-data-largest-collection-ever-seen-email-password-hacking?CMP=fb_a-technology_b-gdntech" target="_blank" rel="noopener"><em>The Guardian</em></a> breathlessly dubbed it &#8220;the largest collection ever of breached data found.&#8221; But in an interview with the apparent seller, KrebsOnSecurity learned that it is not even close to the largest gathering of stolen data, and that it is at least two to three years old.</p>
<p>The dump, labeled &#8220;<strong>Collection #1</strong>&#8221; and approximately 87GB in size, was <a href="https://www.troyhunt.com/the-773-million-record-collection-1-data-reach/" target="_blank" rel="noopener">first detailed</a> earlier today by <strong>Troy Hunt</strong>, who operates the <strong>HaveIBeenPwned</strong> breach notification service. Hunt said the data cache was likely &#8220;made up of many different individual data breaches from literally thousands of different sources.&#8221;</p>
<p>KrebsOnSecurity sought perspective on this discovery from <strong>Alex Holden</strong>, CTO of <a href="https://www.holdsecurity.com" target="_blank" rel="noopener">Hold Security</a>, a company that specializes in trawling underground spaces for intelligence about malicious actors and their stolen data dumps. Holden said the data appears to have first been posted to underground forums in October 2018, and that it is just a subset of a much larger tranche of passwords being peddled by a shadowy seller online.</p>
<p>Here&#8217;s a screenshot of a subset of that seller&#8217;s current offerings, which total almost <em>1 Terabyte</em> of stolen and hacked passwords:</p>
<div id="attachment_46291" style="width: 603px" class="wp-caption aligncenter"><a class="lightbox" href="media/47f3069d.collection1.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/01/collection1.jpg"><img class="wp-image-46291" src="media/47f3069d.collection1.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/01/collection1.jpg" alt="" width="593" height="618" /></a><p class="wp-caption-text">The 87GB &#8220;Collection1&#8221; archive is one of but many similar tranches of stolen passwords being sold by a particularly prolific ne&#8217;er-do-well in the underground.</p></div>
<p>As we can see above, Collection #1 offered by this seller is indeed 87GB in size. He also advertises a <strong>Telegram</strong> username where he can be reached &#8212; &#8220;<strong>Sanixer</strong>.&#8221; So, naturally, KrebsOnSecurity contacted Sanixer via Telegram to find out more about the origins of Collection #1, which he is presently selling for the bargain price of just $45.</p>
<p>Sanixer said Collection#1 consists of data pulled from a huge number of hacked sites, and was not exactly his &#8220;freshest&#8221; offering. Rather, he sort of steered me away from that archive, suggested that &#8212; unlike most of his other wares &#8212; Collection #1 was at least 2-3 years old. His other password packages, which he said are not all pictured in the above screen shot and total more than 4 terabytes in size, are less than a year old, Sanixer explained.</p>
<p>By way of explaining the provenance of Collection #1, Sanixer said it was a mix of &#8220;dumps and leaked bases,&#8221; and then he offered an interesting screen shot of his additional collections. Click on the image below and notice the open Web browser tab behind his purloined password trove (which is apparently stored at Mega.nz): Troy Hunt&#8217;s published research on this 773 million Collection #1.</p>
<div id="attachment_46292" style="width: 609px" class="wp-caption aligncenter"><a class="lightbox" href="media/a299be02.sanixer.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/01/sanixer.jpg"><img class="wp-image-46292" src="media/a299be02.sanixer.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/01/sanixer.jpg" alt="" width="599" height="339" /></a><p class="wp-caption-text">Sanixer says Collection #1 was from a mix of sources. A description of those sources can be seen in the directory tree on the left side of this screenshot.</p></div>
<p>Holden said the habit of collecting large amounts of credentials and posting it online is not new at all, and that the data is far more useful for things like phishing, blackmail and other indirect attacks &#8212; as opposed to plundering inboxes. Holden added that his company had already derived 99 percent of the data in Collection #1 from other sources.</p>
<p>&#8220;It was popularized several years ago by Russian hackers on various Dark Web forums,&#8221; he said. &#8220;Because the data is gathered from a number of breaches, typically older data, it does not present a direct danger to the general user community. Its sheer volume is impressive, yet, by account of many hackers the data is not greatly useful.&#8221;</p>
<p>A core reason so many accounts get compromised is that far too many people have the nasty habit(s) of choosing poor passwords, re-using passwords and email addresses across multiple sites, and not taking advantage of multi-factor authentication options when they are available.</p>
<p>If this Collection #1 has you spooked, changing your password(s) certainly can&#8217;t hurt &#8212; unless of course you&#8217;re in the habit of re-using passwords. Please don&#8217;t do that. As we can see from the offering above, your password is probably worth way more to you than it is to cybercriminals (in the case of Collection #1, just .000002 cents per password).<span id="more-46290"></span></p>
<p>For most of us, by far the most important passwords are those protecting our email inbox(es). That&#8217;s because in nearly all cases, the person who is in control of that email address can reset the password of any services or accounts tied to that email address – merely by requesting a password reset link via email. For more on this dynamic, please see <a href="https://krebsonsecurity.com/2013/06/the-value-of-a-hacked-email-account/" target="_blank" rel="noopener">The Value of a Hacked Email Account</a>.</p>
<div id="attachment_21036" style="width: 606px" class="wp-caption aligncenter"><a class="lightbox" href="media/d1ab042b.HE-1.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2013/06/HE-1.jpg"><img class="wp-image-21036" src="media/d1ab042b.HE-1.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2013/06/HE-1.jpg" alt="" width="596" height="332" srcset="https://krebsonsecurity.com/wp-content/uploads/2013/06/HE-1.jpg 742w, https://krebsonsecurity.com/wp-content/uploads/2013/06/HE-1-285x158.jpg 285w, https://krebsonsecurity.com/wp-content/uploads/2013/06/HE-1-600x333.jpg 600w" sizes="(max-width: 596px) 100vw, 596px" /></a><p class="wp-caption-text">Your email account may be worth far more than you imagine.</p></div>
<p>And instead of thinking about passwords, consider using <em>unique</em>, lengthy passphrases &#8212; collections of words in an order you can remember &#8212; when a site allows it. In general, a long, unique passphrase takes for more effort to crack than a short, complex one. Unfortunately, many sites do not let users choose passwords or passphrases that exceed a small number of characters, or they will otherwise allow long passphrases but ignore anything entered after the character limit is reached.</p>
<p>If you are the type of person who likes to re-use passwords, then you definitely need to be using <a href="https://thewirecutter.com/reviews/best-password-managers/" target="_blank" rel="noopener">a password manager,</a> which helps you pick and remember strong and unique passwords/passphrases and essentially lets you use the same strong master password/passphrase across all Web sites.</p>
<p>Finally, if you haven&#8217;t done so lately, mosey on over to <a href="https://www.twofactorauth.org" target="_blank" rel="noopener">twofactorauth.org</a> and see if you are taking full advantage of multi-factor authentication at sites you trust with your data. The beauty of multi-factor is that even if thieves manage to guess or steal your password just because they hacked some Web site, that password will be useless to them unless they can also compromise that second factor &#8212; be it your mobile device or <a href="https://krebsonsecurity.com/2018/07/google-security-keys-neutralized-employee-phishing/" target="_blank" rel="noopener">security key</a>.</p>


feed_id: https://krebsonsecurity.com/?p=46319
title: Bomb Threat, Sextortion Spammers Abused Weakness at GoDaddy.com
uri: Bomb-Threat-Sextortion-Spammers-Abused-Weakness-at-GoDaddy-com
url: https://krebsonsecurity.com/2019/01/bomb-threat-sextortion-spammers-abused-weakness-at-godaddy-com/
content:
<p>Two of the most disruptive and widely-received spam email campaigns over the past few months &#8212; including an <a href="https://krebsonsecurity.com/2018/07/sextortion-scam-uses-recipients-hacked-passwords/" target="_blank" rel="noopener">ongoing sextortion email scam</a> and <a href="https://krebsonsecurity.com/2018/12/spammed-bomb-threat-hoax-demands-bitcoin/" target="_blank" rel="noopener">a bomb threat hoax</a> that shut down dozens of schools, businesses and government buildings late last year &#8212; were made possible thanks to an authentication weakness at <strong>GoDaddy.com</strong>, the world&#8217;s largest domain name registrar, KrebsOnSecurity has learned.</p>
<p>Perhaps more worryingly, experts warn this same weakness that let spammers hijack domains registered through GoDaddy also affects a great many other major Internet service providers, and is actively being abused to launch phishing and malware attacks which leverage dormant Web site names currently owned and controlled by some of the world&#8217;s most trusted corporate names and brands.</p>
<p><img class="aligncenter wp-image-46333" src="media/818bf502.spamwall.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/01/spamwall.jpg" alt="" width="592" height="555" /></p>
<p>In July 2018, email users around the world <a href="https://krebsonsecurity.com/2018/07/sextortion-scam-uses-recipients-hacked-passwords/" target="_blank" rel="noopener">began complaining</a> of receiving spam which began with a password the recipient used at some point in the past and threatened to release embarrassing videos of the recipient unless a bitcoin ransom was paid. On December 13, 2018, a similarly large spam campaign was blasted out, threatening that someone <a href="https://krebsonsecurity.com/2018/12/spammed-bomb-threat-hoax-demands-bitcoin/" target="_blank" rel="noopener">had planted bombs within the recipient’s building</a> that would be detonated unless a hefty bitcoin ransom was paid by the end of the business day.</p>
<p>Experts at <a href="https://blog.talosintelligence.com/2018/12/bitcoin-bomb-scare-associated-with.html" target="_blank" rel="noopener">Cisco Talos</a> and other security firms quickly drew parallels between the two mass spam campaigns, pointing to a significant overlap in Russia-based Internet addresses used to send the junk emails. Yet one aspect of these seemingly related campaigns that has been largely overlooked is the degree to which each achieved an unusually high rate of delivery to recipients.</p>
<p>Large-scale spam campaigns often are conducted using newly-registered or hacked email addresses, and/or throwaway domains. The trouble is, spam sent from these assets is trivial to block because anti-spam and security systems tend to discard or mark as spam any messages that appear to come from addresses which have no known history or reputation attached to them.</p>
<p>However, in both the sextortion and bomb threat spam campaigns, the vast majority of the email was being sent through Web site names that had already existed for some time, and indeed even had a trusted reputation. Not only that, <em>new research shows</em> <em>many of these domains were registered long ago and are still owned by dozens of Fortune 500 and Fortune 1000 companies. </em></p>
<p>That&#8217;s according to <strong>Ron Guilmette</strong>, a dogged anti-spam researcher. Researching the history and reputation of thousands of <a href="https://docs.google.com/spreadsheets/d/1p_Eq_LW2zjNopntTGipzn9mOLMeyBqYLA4J0WEM8yVc/edit?usp=sharing" target="_blank" rel="noopener">Web site names</a> used in each of the extortionist spam campaigns, Guilmette made a startling discovery: Virtually all of them had at one time been registered via GoDaddy.com, a Scottsdale, Ariz. based domain name registrar and hosting provider.</p>
<p>Guilmette told KrebsOnSecurity he initially considered the possibility that GoDaddy had been hacked, or that thousands of the registrar&#8217;s customers perhaps had their GoDaddy usernames and passwords stolen.</p>
<p>But as he began digging deeper, Guilmette came to the conclusion that the spammers were exploiting an obscure &#8212; albeit widespread &#8212; weakness among hosting companies, cloud providers and domain registrars that was first publicly detailed in 2016.</p>
<h4>EARLY WARNING SIGNS</h4>
<p>In August 2016, security researcher <strong>Matthew Bryant</strong> wrote about <a href="https://thehackerblog.com/floating-domains-taking-over-20k-digitalocean-domains-via-a-lax-domain-import-system/index.html" target="_blank" rel="noopener">spammers exploiting a security vulnerability to hijack some 20,000 established domain names</a> to blast out junk email. A few months later, Bryant documented the same technique being used <a href="https://thehackerblog.com/the-orphaned-internet-taking-over-120k-domains-via-a-dns-vulnerability-in-aws-google-cloud-rackspace-and-digital-ocean/index-2.html" target="_blank" rel="noopener">to take over more than 120,000 trusted domains</a> for spam campaigns. And Guilmette says he now believes the attack method detailed by Bryant also explains what&#8217;s going on in the more recent sextortion and bomb threat spams.</p>
<p>Grasping the true breadth of Bryant&#8217;s prescient discovery requires a brief and simplified primer on how Web sites work. Your Web browser knows how to find a Web site name like example.com thanks to the global <a href="https://en.wikipedia.org/wiki/Domain_Name_System" target="_blank" rel="noopener">Domain Name System</a> (DNS), which serves as a kind of phone book for the Internet by translating human-friendly Web site names (example.com) into numeric Internet address that are easier for computers to manage.</p>
<p>When someone wants to register a domain at a registrar like GoDaddy, the registrar will typically provide two sets of DNS records that the customer then needs to assign to his domain. Those records are crucial because they allow Web browsers to figure out the Internet address of the hosting provider that&#8217;s serving that Web site domain. Like many other registrars, GoDaddy lets new customers use their managed DNS services for free for a period of time (in GoDaddy&#8217;s case it&#8217;s 30 days), after which time customers must pay for the service.</p>
<p>The crux of Bryant&#8217;s discovery was that the spammers in those 2016 campaigns learned that countless hosting firms and registrars would allow anyone to add a domain to their account without ever validating that the person requesting the change actually owned the domain. Here&#8217;s what Bryant wrote about the threat back in 2016:</p>
<blockquote><p>&#8220;In addition to the hijacked domains often having past history and a long age, they also have WHOIS information which points to real people unrelated to the person carrying out the attack. Now if an attacker launches a malware campaign using these domains, it will be harder to pinpoint who/what is carrying out the attack since the domains would all appear to be just regular domains with no observable pattern other than the fact that they all use cloud DNS. It&#8217;s an attacker&#8217;s dream, troublesome attribution and an endless number of names to use for malicious campaigns.&#8221;</p></blockquote>
<h4>SAY WHAT?</h4>
<p>For a more concrete example of what&#8217;s going on here, we&#8217;ll look at just one of the 4,000+ domains that Guilmette found were used in the Dec. 13, 2018 bomb threat hoax. <strong>Virtualfirefox.com</strong> is a domain registered via GoDaddy in 2013 and currently owned by <strong>The Mozilla Corporation</strong>, a wholly owned subsidiary of the <strong>Mozilla Foundation </strong>&#8212; the makers of the popular Firefox Web browser.</p>
<p>The domain&#8217;s registration has been renewed each year since its inception, but the domain itself has sat dormant for some time. When it was initially set up, it took advantage of two managed DNS servers assigned to it by GoDaddy &#8212; ns17.domaincontrol.com, and ns18.domaincontrol.com.</p>
<p>GoDaddy is a massive hosting provider, and it has more than 100 such DNS servers to serve the needs of its clients. To hijack this domain, the attackers in the December 2018 spam campaign needed only to have created a free account at GoDaddy that was assigned the exact same DNS servers handed out to Virtualfirefox.com (ns17.domaincontrol.com and ns18.domaincontrol.com). After that, the attackers simply claim ownership over the domain, and tell GoDaddy to route all traffic for that domain to an Internet address they control.</p>
<p>Mozilla spokesperson <strong>Ellen Canale</strong> said Mozilla took ownership of virtualfirefox.com in September 2017 after a trademark dispute, but that the DNS nameserver for the record was not reset until January of 2019.</p>
<p>&#8220;This oversight created a state where the DNS pointed to a server controlled by a third party, leaving it vulnerable to misuse,&#8221; Canale said. &#8220;We’ve reviewed the configuration of both our registrar and nameservers and have found no indication of misuse. In addition to addressing the immediate problem, we have reviewed the entire catalog of properties we own to ensure they are properly configured.&#8221;</p>
<p>According to both Guilmette and Bryant, this type of hijack is possible because GoDaddy &#8212; like many other managed DNS providers &#8212; <em>does little to check whether someone with an existing account (free or otherwise) who is claiming ownership over a given domain actually controls that domain name.</em></p>
<p>Contacted by KrebsOnSecurity, GoDaddy acknowledged the authentication weakness documented by Guilmette.</p>
<p><span class="pullquote pqleft">&#8220;After investigating the matter, our team confirmed that a threat actor(s) abused our DNS setup process,&#8221; the company said in an emailed statement.</span></p>
<p>&#8220;We’ve identified a fix and are taking corrective action immediately,&#8221; the statement continued. &#8220;While those responsible were able to create DNS entries on dormant domains, at no time did account ownership change nor was customer information exposed.”<span id="more-46319"></span></p>
<h4>SPAMMY BEAR</h4>
<p>Guilmette has dubbed the criminals responsible as &#8220;Spammy Bear&#8221; because the majority of the hijacked domains used in the spam campaigns traced back to Internet addresses in Russia.</p>
<p>In the case of Mozilla&#8217;s Virtualfirefox.com domain, historic DNS records archived by Farsight Security show that indeed on Dec. 13, 2018 &#8212; the very same day that spammers began blasting out their bomb threat demands &#8212; the Internet address in the domain&#8217;s DNS records at GoDaddy were changed to <strong>194.58.58[.]70</strong>, a server in the Russian Federation owned by a hosting company there called <strong>Reg.ru</strong>.</p>
<div id="attachment_46340" style="width: 566px" class="wp-caption aligncenter"><img class=" wp-image-46340" src="media/36e23523.virtualfirefox.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/01/virtualfirefox.jpg" alt="" width="556" height="146" /><p class="wp-caption-text">The record above, indexed by Farsight Security, shows that the Internet address for virtualfirefox.com was changed to an ISP in Russia on Dec. 13, 2018, the same day spammers used this domain and thousands of others for a mass emailed bomb threat.</p></div>
<p>In fact, Guilmette found that that at least 3,500 of the commandeered domains traced back to Reg.ru and to a handful of other hosting firms in Russia. The next largest collection of fraudulently altered Internet addresses were assigned to hosting providers in the United States (456), although some of those providers (e.g. <strong>Webzilla/WZ Communications</strong>) <a href="https://www.mcclatchydc.com/latest-news/article218740565.html" target="_blank" rel="noopener">have strong ties to Russia</a>. The full list of Internet addresses is available <a href="https://docs.google.com/spreadsheets/d/1M5UZErvoSDMPvYBeMGrKbGCRbMncgke-j8cGwvYyLYU/edit?usp=sharing" target="_blank" rel="noopener">here</a>.</p>
<p>Guilmette&#8217;s sleuthing on the 4,000+ domains abused in both 2018 spam campaigns, combined with data from Farsight, suggest the spammers hijacked domains belonging to a staggering number of recognizable corporations who registered domains at GoDaddy, including but not limited to:</p>
<p><strong>Abbott Laboratories</strong>; <strong>Ancestry.com</strong>; <strong>Autodesk</strong>; <strong>Capital One</strong>; <strong>CVS Pharmacy</strong>; SSL provider <strong>Digicert</strong>; <strong>Dow Chemical</strong>; credit card processors <strong>Elavon</strong> and <strong>Electronic Merchant Systems</strong>; <strong>Fair Isaac Corp.</strong>; <strong>Facebook</strong>; <strong>Gap (Apparel) Inc</strong>; <strong>Fifth Third Bancorp</strong>; <strong>Hearst Communications</strong>; <strong>Hilton Interntional</strong>; <strong>ING Bank</strong>; the <strong>Massachusetts Institute of Technology</strong> (MIT); <strong>McDonalds Corp.</strong>; <strong>NBC Universal Media</strong>; <strong>NRG Energy</strong>; <strong>Oath, Inc (a.k.a Yahoo + AOL)</strong>; <strong>Oracle</strong>; <strong>Tesla Motors</strong>; <strong>Time Warner</strong>; <strong>US Bank; US Steel Corp.; National Association</strong>; <strong>Viacom International</strong>; and <strong>Walgreens</strong>.</p>
<p><img class="wp-image-46328 aligncenter" src="media/87feacdd.spammybear.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/01/spammybear.jpg" alt="" width="588" height="588" /></p>
<p>In an interview with KrebsOnSecurity, Bryant said the domain hijacking technique can be a powerful tool in the hands of spammers and scammers, who can use domains associated with these companies not only to get their missives past junk and malware filters, but also to make phishing and malware lures far more believable and effective.</p>
<p>&#8220;This is extremely advantageous to attackers because they don&#8217;t have to pay any money to set it all up, and there&#8217;s a strong reputation attached to the domain they&#8217;re sending from,&#8221; Bryant said. &#8220;A lot of services will flag email from unknown domains as high risk, but the domains being hijacked by these guys have a good history and reputation behind them. This method also probably greatly complicates any sort of investigatory efforts after the spam campaign is over.&#8221;</p>
<h4>WHAT CAN BE DONE?</h4>
<p>Guilmette said managed DNS providers can add an extra layer of validation to DNS change requests, checking to see if a given domain already has DNS servers assigned to the domain before processing the request. Providers could nullify the threat by simply choosing a different pair of DNS servers to assign to the request. The same validation process would work similarly at other managed DNS providers.</p>
<p>&#8220;As long as they&#8217;re different, that ruins this attack for the spammers,&#8221; Guilmette said. &#8220;The spammers want the DNS servers to be the same ones that were already there when the domain was first set up, because without that they can&#8217;t pull of this hack. All GoDaddy has to do is see if this particularly odd set of circumstances apply in each request.&#8221;</p>
<p>Bryant said after he published his initial research in 2016, a number of managed DNS providers mentioned in his blog posts said they&#8217;d taken steps to blunt the threat, including <strong>Amazon Web Services</strong> (AWS), hosting provider <strong>Digital Ocean</strong>, and <strong>Google Cloud</strong>. But he suspects this is still a &#8220;fairly common&#8221; weakness and hosting providers and registrars, and many providers simply aren&#8217;t convinced of the need to add this extra precaution.</p>
<p>&#8220;A lot of the providers are of the opinion that it&#8217;s down to a user mistake and not a vulnerability they should have to fix,&#8221; he said. &#8220;But it&#8217;s clearly still a big problem.&#8221;</p>
<p><strong>Update, 10:38 p.m.:</strong> An earlier version of this story stated that Guilmette had identified more than 5,000 domains associated with the Spammy Bear campaigns. The true number is closer to 4,000. The discrepancy was my mistake and due to a formatting error in a spreadsheet.</p>


feed_id: https://krebsonsecurity.com/?p=46316
title: How the U.S. Govt. Shutdown Harms Security
uri: How-the-U-S-Govt-Shutdown-Harms-Security
url: https://krebsonsecurity.com/2019/01/how-the-u-s-govt-shutdown-harms-security/
content:
<p>The ongoing partial U.S. federal government shutdown is having a tangible, negative impact on cybercrime investigations, according to interviews with federal law enforcement investigators and a report issued this week by a group representing the interests of FBI agents. Even if lawmakers move forward on new proposals to reopen the government, sources say the standoff is likely to have serious repercussions for federal law enforcement agencies for years to come.</p>
<p><img class="aligncenter wp-image-46381" src="media/1cdb6962.congress.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/01/congress.png" alt="" width="588" height="315" /></p>
<p>One federal agent with more than 20 years on the job told KrebsOnSecurity the shutdown &#8220;is crushing our ability to take the fight to cyber criminals.&#8221;</p>
<p>&#8220;The talent drain after this is finally resolved will cost us five years,&#8221; said the source, who asked to remain anonymous because he was not authorized to speak to the news media. &#8220;Literally everyone I know who is able to retire or can find work in the private sector is actively looking, and the smart private companies are aware and actively recruiting. As a nation, we are much less safe from a cyber security posture than we were a month ago.&#8221;</p>
<p>The source said his agency can’t even get agents and analysts the higher clearances needed for sensitive cases because everyone who does the clearance processing is furloughed.</p>
<p>&#8220;Investigators who are eligible to retire or who simply wish to walk away from their job aren’t retiring or quitting now because they can’t even be processed out due to furlough of the organization&#8217;s human resources people,&#8221; the source said. &#8220;These are criminal investigations involving national security. It’s also a giant distraction and people aren’t as focused.&#8221;</p>
<p>The source&#8217;s comments echoed some of the points made in <a href="media/25e79482.FBIAA20Voices20from20the20Field.pdf" data-original-source="https://www.fbiaa.org/sites/default/files/downloadable/FBIAA%20Voices%20from%20the%20Field.pdf" target="_blank" rel="noopener">a 72-page report</a> (PDF) released this week by the <strong>FBI Agents Association</strong>, a group that advocates on behalf of active and retired FBI special agents.</p>
<p>&#8220;Today we have no funds for making Confidential Human Source payments,&#8221; reads a quote from the FBIAA report, attributed to an agent in the FBI&#8217;s northeast region. &#8220;In my situation, I have two sources that support our national security cyber mission that no longer have funding. They are critical sources providing tripwires and intelligence that protect the United States against our foreign adversaries. The loss in productivity and pertinent intelligence is immeasurable.&#8221;</p>
<p>My federal law enforcement source mentioned his agency also was unable to pay confidential informants for their help with ongoing investigations.</p>
<p>&#8220;We are having the same problems like not being able to pay informants, no travel, critical case coordination meetings postponed, and no procurements to further the mission,&#8221; the source said.</p>
<p>The extended shutdown directly affects more than 800,000 workers, many of them furloughed or required to work without pay. Some federal employees, now missing at least two back-to-back paychecks, are having trouble keeping food on the table. <strong>CNN</strong> <a href="https://www.cnn.com/2019/01/17/politics/fbi-shutdown-food-bank/index.html" target="_blank" rel="noopener">reports</a> that FBI field offices across the country are opening food banks to help support special agents and staff struggling without pay.</p>
<p>An extended lack of pay is forcing many agents to seek side hustles and jobs, despite rules that seek to restrict such activity, according to media reports. Missing multiple paychecks also can force investigators to take on additional debt. This is potentially troublesome because excess debt down the road <a href="https://www.clearpoint.org/blog/personal-finances-credit-score-affect-security-clearance/" target="_blank" rel="noopener">can lead to problems keeping one&#8217;s security clearances</a>.</p>
<p>Excessive debt is a threat to clearances because it can make people more susceptible to being drawn into illegal activities or taking bribes for money, which in turn may leave them vulnerable to extortion. Indeed, <a href="https://news.clearancejobs.com/2018/12/29/government-shutdown-creates-foreign-intelligence-opportunity/" target="_blank" rel="noopener">this story from Clearancejobs.com</a> observes that the shutdown may be inadvertently creating new recruiting opportunities for foreign intelligence operatives.</p>
<p>&#8220;If you are a hostile intelligence service human intelligence (HUMINT) targeting officer you are hoping this situation lasts a long time and has a multitude of unintended consequences affecting the cleared government employee population,&#8221; writes <strong>Christopher Burgess</strong>.<span id="more-46316"></span></p>
<p>The shutdown may impact government and civilian cybersecurity efforts in other ways. As <strong>Brian Fung</strong> <a href="https://www.washingtonpost.com/technology/2019/01/17/shutdown-is-steadily-devouring-us-government-websites/" target="_blank" rel="noopener">reported last week</a> at The Washington Post, a rising number of federal Web sites are falling into disrepair, making it harder for Americans to access online services.</p>
<p>&#8220;In the past week, the number of outdated Web security certificates held by U.S. government agencies has exploded from about 80 to more than 130, according to Netcraft, an Internet security firm based in Britain,&#8221; Fung wrote.</p>
<p><strong>Alex Stamos</strong>, former chief security officer at <strong>Facebook</strong>, said this creates problems for people trying to access key documents at government Web sites because the world&#8217;s dominant browser &#8212; Google Chrome &#8212; heavily discourages users from even visiting sites with expired security certificates.</p>
<p>But Stamos says he&#8217;s far more concerned about who&#8217;s maintaining, monitoring and safeguarding the countless Internet servers and other government online assets during the shutdown.</p>
<p>&#8220;What worries me more is what this indicates for the fact that there&#8217;s not standard maintenance going on,&#8221; Stamos said in <a href="https://risky.biz/RB527/" target="_blank" rel="noopener">this week&#8217;s episode</a> of security journalist <strong>Patrick Gray</strong>&#8216;s &#8220;Risky Business&#8221; podcast. &#8220;We&#8217;ve gone through <a href="https://krebsonsecurity.com/2019/01/patch-tuesday-january-2019-edition/" target="_blank" rel="noopener">a Patch Tuesday</a> since the government shut down. Who is actually maintaining the systems, who is sitting in the SOCs [security operations centers], who&#8217;s looking at the logs? Even if you have critical cybersecurity people at NSA or Cyber Command working, there&#8217;s a lot of importance in having people show up for their jobs.&#8221;</p>
<p>U.S. Senate leaders are now planning to hold competing votes on Thursday in a bid to end the shutdown, but a story Wednesday in <em>The New York Times</em> <a href="https://www.nytimes.com/2019/01/22/us/politics/government-shutdown-senate.html" target="_blank" rel="noopener">reckons</a> that neither measure is expected to draw the 60 votes required to advance.</p>
<p>&#8220;You hear [New England Patriots football coach Bill] Belichick and other coaches constantly preaching about leaving distractions outside the locker room,&#8221; said the federal law enforcement source who spoke with this author. &#8220;Can’t think of many bigger distractions like not getting paid, damaging credit scores, not being able to pay bills, and losing supplemental insurance. We just wish our national leaders would listen to another Belichick gem: &#8216;Do Your Job.'&#8221;</p>


feed_id: https://krebsonsecurity.com/?p=46392
title: Three Charged for Working With Serial Swatter
uri: Three-Charged-for-Working-With-Serial-Swatter
url: https://krebsonsecurity.com/2019/01/three-charged-for-working-with-serial-swatter/
content:
<p>The <strong>U.S. Justice Department</strong> has filed criminal charges against three U.S. men accused of swatting, or making hoax reports of bomb threats or murders in a bid to trigger a heavily armed police response to a target&#8217;s address. Investigators say the men, aged 19 to 23, all carried out the attacks with the help of <strong>Tyler Barriss</strong>, a convicted serial swatter whose last stunt in late 2018 cost an Oklahoma man his life.</p>
<div id="attachment_46397" style="width: 605px" class="wp-caption aligncenter"><img class=" wp-image-46397" src="media/9d86ccaa.swatting.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/01/swatting.jpg" alt="" width="595" height="287" /><p class="wp-caption-text">Image: FBI.gov</p></div>
<p>FBI agents on Wednesday arrested <strong>Neal Patel</strong>, 23, of Des Plaines, Ill. and <strong>Tyler Stewart</strong>, 19 of Gulf Breeze, Fla. The third defendant, <strong>Logan Patten</strong>, 19, of Greenwood, Mo., agreed to turn himself in. The men are charged in three separate indictments with conspiracy and conveying false information about the use of explosive devices.</p>
<p>Investigators say Patten, who used the Twitter handle &#8220;@spared,&#8221; hired Barriss in December 2017 to swat individuals and a high school in Less&#8217;s Summit, Mo.</p>
<p>Around the same time, Stewart, a.k.a. &#8220;@tragic&#8221; on Twitter, allegedly worked with Barriss to make two phony bomb threats to evacuate a high school in Gurnee, Ill. In that incident, Barriss admitted telling police in Gurnee he had left explosives in a classroom and was high on methamphetamine and was thinking about shooting teachers and students.</p>
<p>Also in December 2017, Patel allegedly worked with Barriss to plan a bomb threat targeting a video game convention in Dallas, Texas. Patel is also accused of using stolen credit cards to buy items of clothing for Barriss.</p>
<p>The Justice Department&#8217;s <a href="https://www.justice.gov/usao-cdca/pr/three-men-charged-swatting-schemes-which-admitted-hoax-maker-targeted-individuals" target="_blank" rel="noopener">media release</a> on the indictments doesn&#8217;t specify which convention Barriss and Patel allegedly swatted, but a <em>Wired</em> <a href="https://www.wired.com/story/swatting-deadly-online-gaming-prank/" target="_blank" rel="noopener">story</a> from last year tied Barriss to a similarly timed bomb threat that caused the evacuation of a major <strong>Call of Duty</strong> tournament at the Dallas Convention Center.</p>
<p>&#8220;When the social media star SoaR Ashtronova tweeted about the confusion she felt as she fled the event beneath the whir of police helicopters, Barriss taunted her from one of his Twitter accounts: &#8216;It got ran, baby girl. Thats what happens,&#8221; Wired reported.</p>
<p>Interestingly, it was a dispute over a $1.50 grudge match in a Call of Duty game that would ultimately lead to Barriss&#8217;s final &#8212; and fatal &#8212; swatting a year later. On Dec. 28, 2018, Barriss phoned police in Wichita, Kan. from his location in California, telling them he was a local man who&#8217;d just shot his father and was holding other family members hostage.<span id="more-46392"></span></p>
<p>Prosecutors say Barriss did so after getting in the middle of a dispute between two Call of Duty gamers, 18-year-old <strong>Casey Viner</strong> from Ohio and <strong>Shane Gaskill</strong>, 20, from Wichita. Viner allegedly asked Barriss to swat Gaskill. But when Gaskill noticed Barriss’ Twitter account suddenly following him online, he tried to deflect the attack. Barriss says Gaskill allegedly dared him to go ahead with the swat, but then gave Barriss an old home address &#8212; which was then being occupied by someone else.</p>
<p>When Wichita police responded to the address given by Barriss, they <a href="https://krebsonsecurity.com/2017/12/kansas-man-killed-in-swatting-attack/" target="_blank" rel="noopener">shot and killed 28-year-old <strong>Andrew Finch</strong></a>, a father of two who had no party to the dispute and did not know any of the three men.</p>
<p>Both Viner and Gaskill <a href="https://krebsonsecurity.com/2018/05/3-charged-in-fatal-kansas-swatting-attack/" target="_blank" rel="noopener">have been charged</a> with wire fraud, conspiracy and obstruction of justice. Barriss <a href="https://krebsonsecurity.com/2018/11/calif-man-pleads-guilty-in-fatal-swatting-case-faces-20-years-in-prison/" target="_blank" rel="noopener">pleaded guilty in Nov. 2018 to a total of 51 charges</a> brought by federal prosecutors in Los Angeles, Kansas and Washington, D.C. He has agreed to serve a sentence of between 20 to 25 years in prison. Barrris is slated to be sentenced on March 1, 2019.</p>
<p>Stewart&#8217;s attorney declined to comment. Lawyers assigned to Patel and Patten could not be reached for comment.</p>
<p>As the victim of <a href="http://krebsonsecurity.com/2013/03/the-world-has-no-room-for-cowards/" target="_blank" rel="noopener">a swatting attack in 2013</a> and several other <a href="https://krebsonsecurity.com/2017/09/canadian-man-gets-9-months-detention-for-serial-swattings-bomb-threats/" target="_blank" rel="noopener">unsuccessful attempts</a>, I am pleased to see federal authorities continue to take this crime seriously. According to the FBI, each swatting incident costs emergency responders approximately $10,000. Each hoax also unnecessarily endangers the lives of the responders and the public, and draws important resources away from actual emergencies.</p>


feed_id: https://krebsonsecurity.com/?p=46415
title: 250 Webstresser Users to Face Legal Action
uri: 250-Webstresser-Users-to-Face-Legal-Action
url: https://krebsonsecurity.com/2019/02/250-webstresser-users-to-face-legal-action/
content:
<p>More than 250 customers of a popular and powerful online attack-for-hire service that was dismantled by authorities in 2018 are expected to face legal action for the damage they caused, according to <strong>Europol</strong>, the European Union&#8217;s law enforcement agency.</p>
<p>In April 2018, investigators in the U.S., U.K. and the Netherlands <a href="https://krebsonsecurity.com/2018/04/ddos-for-hire-service-webstresser-dismantled/" target="_blank" rel="noopener">took down attack-for-hire service <strong>WebStresser[.]org</strong></a> and arrested its alleged administrators. Prior to the takedown, the service had more than 151,000 registered users and was responsible for launching some four million attacks over three years. Now, those same authorities are targeting people who paid the service to conduct attacks.</p>
<div id="attachment_43527" style="width: 600px" class="wp-caption aligncenter"><a class="lightbox" href="media/e5959a2d.webstresser.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/04/webstresser.png"><img class="wp-image-43527" src="media/e5959a2d.webstresser.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/04/webstresser.png" alt="" width="590" height="309" /></a><p class="wp-caption-text">Webstresser.org (formerly Webstresser.co), as it appeared in 2017.</p></div>
<p>In the United Kingdom, police have seized more than 60 personal electronic devices from a number of Webstresser users, and some 250 customers of the service will soon face legal action, Europol said in a statement released this week.</p>
<p>&#8220;Size does not matter – all levels of users are under the radar of law enforcement, be it a gamer booting out the competition out of a game, or a high-level hacker carrying out DDoS attacks against commercial targets for financial gain,&#8221; Europol officials warned.</p>
<p>The focus on Webstresser&#8217;s customers is the latest phase of “Operation Power Off,” which targeted one of the most active services for launching point-and-click distributed denial-of-service (DDoS) attacks. WebStresser was one of many so-called “booter” or “stresser” services — virtual hired muscle that even completely unskilled users can rent to knock nearly any website or Internet user offline.</p>
<p>Operation Power Off is part of a broader law enforcement effort to disrupt the burgeoning booter service industry and to <a href="https://krebsonsecurity.com/2018/01/expert-iot-botnets-the-work-of-a-vast-minority/" target="_blank" rel="noopener">weaken demand for such services</a>. In December, authorities in the United States <a href="https://krebsonsecurity.com/2018/12/feds-charge-three-in-mass-seizure-of-attack-for-hire-services/" target="_blank" rel="noopener">filed criminal charges against three men</a> accused of running booter services, and orchestrated a coordinated takedown of 15 different booter sites.</p>
<div id="attachment_46100" style="width: 602px" class="wp-caption aligncenter"><a class="lightbox" href="media/6c189aba.domainseize.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/12/domainseize.jpg"><img class="wp-image-46100" src="media/6c189aba.domainseize.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/12/domainseize.jpg" alt="" width="592" height="462" /></a><p class="wp-caption-text">This seizure notice appeared on the homepage of more than a dozen popular &#8220;booter&#8221; or &#8220;stresser&#8221; DDoS-for-hire Web sites in December 2018.</p></div>
<p><span id="more-46415"></span></p>
<p>The takedowns come as courts in the United States and Europe are beginning to hand down serious punishment for booter service operators, their customers, and for those convicted of launching large-scale DDoS attacks. Last month, a 34-year-old Connecticut man <a href="https://krebsonsecurity.com/2019/01/courts-hand-down-hard-jail-time-for-ddos/" target="_blank" rel="noopener">received a 10-year prison sentence</a> for carrying out DDoS attacks a number of hospitals in 2014. Also last month, a 30-year-old in the United Kingdom was sentenced to 32 months in jail for using an army of hacked devices to crash large portions of Liberia&#8217;s Internet access in 2016.</p>
<p>In December 2018, the ringleader of an online crime group that launched DDoS attacks against Web sites &#8212; including several against KrebsOnSecurity &#8212; was <a href="https://krebsonsecurity.com/2018/12/bomb-threat-hoaxer-ddos-boss-gets-3-years/" target="_blank" rel="noopener">sentenced to three years in a U.K. prison</a>. And in 2017, a 20-year-old from Britain was sentenced to two years in jail for renting out <strong>Titanium Stresser</strong>, a booter service <a href="https://krebsonsecurity.com/2017/04/uk-man-gets-two-years-in-jail-for-running-titanium-stresser-attack-for-hire-service/" target="_blank" rel="noopener">that earned him $300,000</a> over several years it was in operation.</p>
<p>Many in the hacker community have criticized authorities for targeting booter service administrators and users and for not pursuing what they perceive as more serious cybercriminals, noting that the vast majority of both groups are young men under the age of 21 and are using booter services to settle petty disputes over online games.</p>
<p>But not all countries involved in Operation Power Off are taking such a punitive approach. In the Netherlands, the police and the prosecutor’s office have deployed new legal intervention called “<strong>Hack_Right</strong>,” a diversion program intended for first-time cyber offenders. Europol says at least one user of Webstresser has already received this alternative sanction.</p>
<p>&#8220;Skills in coding, gaming, computer programming, cyber security or anything IT-related are in high demand and there are many careers and opportunities available to use these wisely,&#8221; Europol said.</p>
<p>According to U.S. federal prosecutors, the use of booter and stresser services to conduct attacks is punishable under both wire fraud laws and the Computer Fraud and Abuse Act (18 U.S.C. § 1030), and may result in arrest and prosecution, the seizure of computers or other electronics, as well as prison sentences and a penalty or fine.</p>


feed_id: https://krebsonsecurity.com/?p=46440
title: Crooks Continue to Exploit GoDaddy Hole
uri: Crooks-Continue-to-Exploit-GoDaddy-Hole
url: https://krebsonsecurity.com/2019/02/crooks-continue-to-exploit-godaddy-hole/
content:
<p><strong>Godaddy.com</strong>, the world&#8217;s largest domain name registrar, recently addressed an authentication weakness that cybercriminals were using to blast out spam through legitimate, dormant domains. But several more recent malware spam campaigns suggest GoDaddy&#8217;s fix hasn&#8217;t gone far enough, and that scammers likely still have a sizable arsenal of hijacked GoDaddy domains at their disposal.</p>
<p><img class="aligncenter wp-image-46446" src="media/ec220502.godaddy.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/02/godaddy.jpg" alt="" width="594" height="309" /></p>
<p>On January 22, KrebsOnSecurity <a href="https://krebsonsecurity.com/2019/01/bomb-threat-sextortion-spammers-abused-weakness-at-godaddy-com/" target="_blank" rel="noopener">published research</a> showing that crooks behind a series of massive <a href="https://krebsonsecurity.com/2018/07/sextortion-scam-uses-recipients-hacked-passwords/" target="_blank" rel="noopener">sextortion</a> and <a href="https://krebsonsecurity.com/2018/12/spammed-bomb-threat-hoax-demands-bitcoin/" target="_blank" rel="noopener">bomb threat</a> spam campaigns throughout 2018 &#8212; an adversary that&#8217;s been dubbed &#8220;<strong>Spammy Bear</strong>&#8221; &#8212;  achieved an unusual amount of inbox delivery by exploiting a weakness at GoDaddy which allowed anyone to add a domain to their GoDaddy account without validating that they actually owned the domain.</p>
<p>Spammy Bear targeted dormant but otherwise legitimate domains that had one thing in common: They all at one time used GoDaddy&#8217;s hosted <a href="https://en.wikipedia.org/wiki/Domain_Name_System" target="_blank" rel="noopener">Domain Name System</a> (DNS) service. Researcher <strong>Ron Guilmette</strong> discovered that Spammy Bear was able to hijack thousands of these dormant domains for spam simply by registering free accounts at GoDaddy and telling the company&#8217;s automated DNS service to allow the sending of email with those domains from an Internet address controlled by the spammers.</p>
<p>Very soon after that story ran, GoDaddy said it had put in place a fix for the problem, and had scrubbed more than 4,000 domain names used in the spam campaigns that were identified in my Jan. 22 story. But on or around February 1, a new spam campaign that leveraged similarly hijacked domains at GoDaddy began distributing <a href="https://labs.bitdefender.com/2018/10/gandcrab-the-most-popular-multi-million-dollar-ransomware-of-the-year/" target="_blank" rel="noopener">Gand Crab</a>, a potent strain of ransomware.</p>
<p>As noted in a post last week at the blog <a href="https://labs.bitdefender.com/2018/10/gandcrab-the-most-popular-multi-million-dollar-ransomware-of-the-year/" target="_blank" rel="noopener">MyOnlineSecurity</a>, the Gand Crab campaign used a variety of lures, including fake DHL shipping notices and phony AT&amp;T e-fax alerts. The domains documented by MyOnlineSecurity all had their DNS records altered between Jan. 31 and Feb. 1 to allow the sending of email from Internet addresses tied to <a href="https://ipinfo.io/AS44493" target="_blank" rel="noopener">two</a> <a href="https://ipinfo.io/AS40824" target="_blank" rel="noopener">ISPs</a> identified in my original Jan. 22 report on the GoDaddy weakness.</p>
<p>&#8220;What makes these malware laden emails much more likely to be delivered is the fact that the sending domains all have a good reputation,&#8221; MyOnlineSecurity observed. &#8220;There are dozens, if not hundreds of domains involved in this particular campaign. Almost all the domains have been registered for many years, some for more than 10 years.&#8221;</p>
<div id="attachment_46457" style="width: 436px" class="wp-caption aligncenter"><img class="size-full wp-image-46457" src="media/4de66711.ambrosetech.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/02/ambrosetech.jpg" alt="" width="426" height="133" /><p class="wp-caption-text">A &#8220;passive DNS&#8221; lookup shows the DNS changes made by the spammers on Jan. 31 for one of the domains used in the Gand Crab spam campaign documented by MyOnlineSecurity. Image: Farsight Security.</p></div>
<p>In a statement provided to KrebsOnSecurity, GoDaddy said the company was confident the steps it took to address the problem were working as intended, and that GoDaddy had simply overlooked the domains abused in the recent GandCrab spam campaign.</p>
<p>&#8220;The domains used in the Gand Crab campaign were modified before then, but we missed them in our initial sweep,&#8221; GoDaddy spokesperson <strong>Dan Race</strong> said. &#8220;While we are otherwise confident of the mitigation steps we took to prevent the dangling DNS issue, we are working to identify any other domains that need to be fixed.&#8221;</p>
<p>&#8220;We do not believe it is possible for a person to hijack the DNS of one or more domains using the same tactics as used in the Spammy Bear and Gand Crab campaigns,&#8221; Race continued. &#8220;However, we are assessing if there are other methods that may be used to achieve the same results, and we continue our normal monitoring for account takeover. We have also set up a reporting alias at <strong>dns-spam-concerns@godaddy.com</strong> to make it easier to report any suspicious activity or any details that might help our efforts to stop this kind of abuse.&#8221;</p>
<p>That email address is likely to receive quite a few tips in the short run. <em>Virusbulletin</em> editor <strong>Martijn Grooten</strong> this week <a href="https://www.virusbulletin.com/blog/2019/02/amazon-ups-emotet-formbook-and-lokibot-look-those-phishing-and-malware-emails-bypassed-email-security-products/" target="_blank" rel="noopener">published his analysis</a> on a January 29 malware email campaign that came disguised as a shipping notice from <strong>UPS</strong>. Grooten said the spam intercepted from that campaign included links to an Internet address that was previously used to distribute GandCrab, and that virtually <a href="https://docs.google.com/spreadsheets/d/1ywRXAvkI5okrKqdrVpcLzNxnVNr80RBEnc4ykV2t7bs/edit#gid=1976826119" target="_blank" rel="noopener">all of the domains seen sending the fake UPS notices</a> used one of two pairs of DNS servers managed by GoDaddy.</p>
<p>&#8220;The majority of domains, which we think had probably had their DNS compromised, still point to the same IP address though,&#8221; Grooten wrote. That IP address is currently home to <a href="media/ad7f1fde.ccshop.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/02/ccshop.jpg" target="_blank" rel="noopener">a Web site that sells stolen credit card data</a>.</p>
<div id="attachment_46444" style="width: 607px" class="wp-caption aligncenter"><img class=" wp-image-46444" src="media/51036564.upslure.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/02/upslure.jpg" alt="" width="597" height="558" /><p class="wp-caption-text">The fake UPS message used in a Jan. 29 Gand Crab malware spam campaign. Source: Virusbulletin.</p></div>
<p>Grooten told KrebsOnSecurity he suspects criminals may have succeeded at actually compromising several of GoDaddy&#8217;s hosted DNS servers. For one thing, he said, the same pair (sometimes two pairs) of name servers keep appearing in the same campaign.</p>
<p>&#8220;In quite a few campaigns we saw domains used that were alphabetically close, [and] there are other domains used that had moved away from GoDaddy before these campaigns, yet were still used,&#8221; Grooten said. &#8220;It&#8217;s also interesting to note that hundreds &#8212; and perhaps thousands &#8212; of domains had their DNS changed within a short period of time. Such a thing is hard to do if you have to log into individual accounts.&#8221;</p>
<p>GoDaddy did not respond to requests for comment about the possibility of a breach explaining the continuing abuse of its DNS services.<span id="more-46440"></span></p>
<p>First emerging in early 2018, Gand Crab has been dubbed &#8220;the most popular multi-million dollar ransomware of the year.&#8221; Last week, KrebsOnSecurity was contacted by a company hit with Gand Crab in late January after an employee was taken in by what appears to be the same campaign detailed by Virusbulletin.</p>
<p><strong>Charlene Price</strong> is co-owner of <strong>A.S. Price Mechanical</strong>, a small metal fabrication business in Gilbert, South Carolina. Price said an employee was tricked into infecting one of their hard drives with Gand Crab, which encrypted the drive and demanded $2,000 in bitcoin for a key needed to unlock the files.</p>
<p>While Price and her husband consulted with tech experts and debated what to do next, the extortionists doubled the ransom demand to $4,000.</p>
<p>Sites like <a href="https://www.nomoreransom.org/en/decryption-tools.html" target="_blank" rel="noopener">nomoreransom.org</a> distribute free tools and tutorials that can help some ransomware victims recover their files without paying a ransom demand, but those tools often only work with specific versions of a particular ransomware strain. Price said the tool nomoreransom.org made available for Gand Crab infections was unable to decrypt the files on her scrambled hard drive.</p>
<p>&#8220;It’s not fair or right and this is unjust,&#8221; Price said. &#8220;We have accepted the fact, for now, that we are just locked out our company’s information. We know nothing about this type of issue other than we have to pay it or just start again.&#8221;</p>


feed_id: https://krebsonsecurity.com/?p=46464
title: More Alleged SIM Swappers Face Justice
uri: More-Alleged-SIM-Swappers-Face-Justice
url: https://krebsonsecurity.com/2019/02/more-alleged-sim-swappers-face-justice/
content:
<p>Prosecutors in Northern California have charged two men with using <a href="https://krebsonsecurity.com/2018/11/busting-sim-swappers-and-sim-swap-myths/" target="_blank" rel="noopener">unauthorized SIM swaps</a> to steal and extort money from victims. One of the individuals charged allegedly used a hacker nickname belonging to a key figure in the underground who&#8217;s built a solid reputation hijacking mobile phone numbers for profit.</p>
<p>According to indictments <a href="https://www.justice.gov/usao-ndca/pr/two-men-indicted-sim-swapping-scheme-steal-cryptocurrency" target="_blank" rel="noopener">unsealed</a> this week, Tucson, Ariz. resident <strong>Ahmad Wagaafe Hared</strong> and <strong>Matthew Gene Ditman</strong> of Las Vegas were part of a group that specialized in tricking or bribing representatives at the major wireless providers into giving them control over phone numbers belonging to people they later targeted for extortion and theft.</p>
<p>Investigators allege that between October 2016 and May 2018, Hared and Ditman grew proficient at SIM swapping, a complex form of mobile phone fraud that is often used to steal large amounts of cryptocurrencies and other items of value from victims.</p>
<p>The Justice Department says Hared was better known to his co-conspirators as &#8220;<strong>winblo</strong>.&#8221; That nickname corresponds to an extremely active and at one time revered member of the forum <strong>ogusers[.]com</strong>, a marketplace for people who wish to sell highly prized social media account names &#8212; including short usernames at Twitter, Instagram and other sites <a href="https://krebsonsecurity.com/2015/11/talktalk-script-kids-the-quest-for-og/" target="_blank" rel="noopener">that can fetch thousands of dollars apiece</a>.</p>
<p><div id="attachment_46468" style="width: 603px" class="wp-caption aligncenter"><a class="lightbox" href="media/1f5b8796.winblo.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/02/winblo.png"><img class="wp-image-46468" src="media/1f5b8796.winblo.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/02/winblo.png" alt="" width="593" height="281" /></a><p class="wp-caption-text">Winblo&#8217;s account on ogusers[.]com</p></div>Winblo was an associate and business partner of another top Oguser member, a serial SIM swapper known to Oguser members as &#8220;<strong>Xzavyer</strong>.&#8221; In August 2018, <a href="https://krebsonsecurity.com/2018/08/alleged-sim-swapper-arrested-in-california/" target="_blank" rel="noopener">authorities in California arrested a hacker by the same name</a> &#8212; whose real name is <strong>Xzavyer Clemente Narvaez </strong>&#8212; charging him with identity theft, grand theft, and computer intrusion.</p>
<p>Prosecutors allege Narvaez used the proceeds of his crimes (estimated at &gt; $1 million in virtual currencies) to purchase luxury items, including <a href="https://www.cargurus.com/Cars/2018-McLaren-570S-Price-c27201" target="_blank" rel="noopener">a McLaren</a> — a $200,000 high-performance sports car.</p>
<p>According to the indictments against Hared and Ditman, one of the men (the indictment doesn&#8217;t specify which) allegedly used his ill-gotten gains to purchase a BMW i8, an automobile that sells for about $150,000.</p>
<p>Investigators also say the two men stole approximately 40 bitcoins from their SIM swapping victims. That&#8217;s roughly $136,000 in today&#8217;s conversion, but it would have been substantially more in 2017 when the price of a single bitcoin reached nearly $20,000.</p>
<p>Interestingly, KrebsOnSecurity was contacted in 2018 by a California man who said he was SIM swapped by Winblo and several associates. That victim, who asked not to be identified for fear of reprisals, said his Verizon mobile number was SIM hijacked by Winblo and others who used that access to take over his Twitter and PayPal accounts and then demand payment for the return of the accounts.</p>
<p>A computer specialist by trade, the victim said he was targeted because he&#8217;d invested in a cryptocurrency startup, and that the hackers found his contact information from a list of investors they&#8217;d somehow obtained. As luck would have it, he didn&#8217;t have much of value to steal in his accounts.</p>
<p>The victim said he learned more about his tormentors and exactly how they&#8217;d taken over his mobile number after they invited him to an online chat to negotiate a price for the return of his accounts.</p>
<p>&#8220;They told me they had called a Verizon employee line [posing as a Verizon employee] and managed to get my Verizon account ID number,&#8221; said my victim source. &#8220;Once they had that, they called Verizon customer service and had them reset the password. They literally just called and pretended to be me, and were able to get my account tied to another SIM card.&#8221;</p>
<p>The victim said his attackers even called his mom because the mobile account was in her name. Soon after that, his phone went dead.</p>
<p>&#8220;The funny thing was, after I got my account back the next day, there was a voicemail from a Verizon customer service agent who said something like, &#8216;Hey [omitted], heard you were having trouble with your line, hope the new SIM card is working okay, give us a call if not, have a nice day.'&#8221;<span id="more-46464"></span></p>
<h4>RECKONING</h4>
<p>The indictments against Hared and Ditman come amid a series of arrests, charges and sentences targeting admitted and suspected SIM swappers. Last week, <strong>Joel Ortiz </strong>&#8212; a 20-year-old college student valedictorian accused of stealing more than $5 million in cryptocurrency in a slew of SIM hijacking attacks &#8212; became the first to be convicted for the crime, <a href="https://motherboard.vice.com/en_us/article/gyaqnb/hacker-joel-ortiz-sim-swapping-10-years-in-prison" target="_blank" rel="noopener">accepting a plea deal for a 10-year prison term</a>.</p>
<p>Many of the people being arrested and charged with SIM swapping were part of a tight circle of individuals who spent money almost as quickly as they stole it. The video below was posted to the Instagram account &#8220;O,&#8221; a username that was hijacked by Ortiz. The video shows a birthday party celebration for Xzavyer Narvarez at the Hyde Sunset club in Los Angeles. Notice the Twitter bird symbols at the bottom of each card brought out by the club&#8217;s female attendants.</p>
<p>&nbsp;</p>
<div style="text-align: center;"><iframe src="https://www.youtube.com/embed/usCik-feQNE" width="560" height="315" frameborder="0" allowfullscreen="allowfullscreen"></iframe></div>
<p>&nbsp;</p>
<p>Another video posted by Ortiz &#8212; to a hijacked, highly sought Instagram account &#8220;T&#8221; &#8212; shows members of this group dumping out $200 bottles of glow-in-the-dark Dom Perignon champagne onto designer watches that cost thousands of dollars each.</p>
<p>&nbsp;</p>
<div style="text-align: center;"><iframe src="https://www.youtube.com/embed/0Rkcas2upws" width="560" height="315" frameborder="0" allowfullscreen="allowfullscreen"></iframe></div>
<p>&nbsp;</p>
<p>Also last week, 20-year-old <strong>Dawson Bakies</strong> pleaded not guilty in Manhattan Supreme Court to 52 counts of identity theft, grand larceny, and computer trespass tied to alleged SIM swapping activity. According to the <a href="https://nypost.com/2019/02/01/tech-whiz-turned-criminal-stole-500k-in-10-days-officials/" target="_blank" rel="noopener">New York Post</a>, Bakies, who lives with his mom in Columbus, Ohio, allegedly called customer-service representatives posing as his victims and was able to port their phone numbers to a device he controlled.</p>
<p>In November 2018, authorities in New York arrested 21-year-old Manhattan resident <strong>Nicholas Truglia</strong> on suspicion of using SIM swaps to steal approximately $1 million worth of cryptocurrencies from a Silicon Valley executive. Truglia also is being sued by cryptocurrency angel investor Michael Terpin, who alleges that Truglia <a href="https://krebsonsecurity.com/2019/01/stole-24-million-but-still-cant-keep-a-friend/" target="_blank" rel="noopener">used a SIM swap against AT&amp;T to steal $24 million</a> in cryptocurrencies from him.</p>
<h4>WHAT CAN YOU DO?</h4>
<p>SIM swappers tend to target people with plenty of funds in the bank or in cryptocurrency exchanges, but as my victim source&#8217;s story shows, they often also SIM swap individuals who only appear to be high rollers. In the process, they may also rifle through your personal email and try to extort victims in exchange for turning over access to hijacked accounts.</p>
<p>There are several steps that readers can take to insulate themselves from SIM swapping attacks. First and foremost, do not re-use passwords to important accounts anywhere else. Also, take full advantage of the most robust form of multi-factor authentication available for the accounts you care about.</p>
<p>The web site <a href="https://www.twofactorauth.org/" target="_blank" rel="noopener">twofactorauth.org</a> breaks down online service providers by the types of secondary authentication offered (SMS, call, app-based one-time codes, security keys). Take a moment soon to review this important resource and harden your security posture wherever possible.</p>
<p>If the only two-factor authentication offered by a company you use is based on sending a one-time code via SMS or automated phone call, <em>this is still better than relying on simply a password alone</em>. But one-time codes generated by a mobile phone app such as <a href="https://www.authy.com/" target="_blank" rel="noopener">Authy</a> or <strong>Google Authenticator</strong> are more secure than SMS-based options because they are not directly vulnerable to SIM-swapping attacks. If available, <a href="https://krebsonsecurity.com/2018/07/google-security-keys-neutralized-employee-phishing/" target="_blank" rel="noopener">physical security keys</a> are an even better option.</p>
<p>Further reading:</p>
<p><a href="https://krebsonsecurity.com/2018/08/hanging-up-on-mobile-in-the-name-of-security/" target="_blank" rel="noopener">Hanging Up on Mobile in the Name of Security</a></p>
<p><a href="https://krebsonsecurity.com/2018/11/busting-sim-swappers-and-sim-swap-myths/" target="_blank" rel="noopener">Busting SIM Swappers and SIM Swap Myths</a></p>


feed_id: https://krebsonsecurity.com/?p=46496
title: Phishers Target Anti-Money Laundering Officers at U.S. Credit Unions
uri: Phishers-Target-Anti-Money-Laundering-Officers-at-U-S-Credit-Unions
url:
https://krebsonsecurity.com/2019/02/phishers-target-anti-money-laundering-officers-at-u-s-credit-unions/

content:
<p>A highly targeted, malware-laced phishing campaign landed in the inboxes of multiple credit unions last week. The missives are raising eyebrows because they were sent only to specific anti-money laundering contacts at credit unions, and many credit union sources say they suspect the non-public data may have been somehow obtained from the <a href="https://www.ncua.gov/about-ncua" target="_blank" rel="noopener">National Credit Union Administration</a> (NCUA), an independent federal agency that insures deposits at federally insured credit unions.</p>
<p>The <a href="https://en.wikipedia.org/wiki/Patriot_Act" target="_blank" rel="noopener">USA Patriot Act</a>, passed in the wake of the terror attacks of Sept 11, 2001, requires all financial institutions to appoint at least two <a href="https://en.wikipedia.org/wiki/Bank_Secrecy_Act" target="_blank" rel="noopener">Bank Secrecy Act</a> (BSA) contacts responsible for reporting suspicious financial transactions that may be associated with money laundering. U.S. credit unions are required to register these BSA officers with the NCUA.</p>
<p>On the morning of Wednesday, Jan. 30, BSA officers at credit unions across the nation began receiving emails spoofed to make it look like they were sent by BSA officers at other credit unions. The missives addressed each contact by name, claimed that a suspicious transfer from one of the recipient credit union&#8217;s customers was put on hold for suspected money laundering, and encouraged recipients to open an attached PDF to review the suspect transaction.</p>
<div id="attachment_46497" style="width: 607px" class="wp-caption aligncenter"><img class=" wp-image-46497" src="media/8d13a089.bsa-email.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/02/bsa-email.jpg" alt="" width="597" height="390" /><p class="wp-caption-text">One of the many variations on the malware-laced targeted phishing email sent to dozens of credit unions across the nation last week.</p></div>
<p>The phishing emails contained grammatical errors and were sent from email addresses not tied to the purported sending credit union. It is not clear if any of the BSA officers who received the messages actually clicked on the attachment, although one credit union source reported speaking with a colleague who feared a BSA contact at their institution may have fallen for the ruse.</p>
<p>One source at an association that works with multiple credit unions who spoke with KrebsOnSecurity on condition of anonymity said many credit unions are having trouble imagining another source for the recipient list other than the NCUA.</p>
<p>&#8220;I tried to think of any public ways that the scammers might have received a list of BSA officers, but sites like LinkedIn require contact through the site itself,&#8221; the source said. &#8220;CUNA [the Credit Union National Association] has BSA certification schools, but they certify state examiners and trade association staff (like me), so non-credit union employees that utilize the school should have received these emails if the list came from them. As far as we know, only credit union BSA officers have received the emails. I haven’t seen anyone who received the email say they were not a BSA officer yet.&#8221;</p>
<p>&#8220;Wonder where they got the list of BSA contacts at all of our credit unions,&#8221; said another credit union source. &#8220;They sent it to our BSA officer, and [omitted] said they sent it to her BSA officers.&#8221; A BSA officer at a different credit union said their IT department had traced the source of the message they received back to Ukraine.</p>
<p>The NCUA has not responded to multiple requests for comment since Monday. The agency&#8217;s <a href="media/d8e1fb86.credit-union-profile-form-instructions-4501A-9302017.pdf" data-original-source="https://www.ncua.gov/files/publications/regulations/credit-union-profile-form-instructions-4501A-9302017.pdf" target="_blank" rel="noopener">instructions for mandatory BSA reporting</a> (PDF) state that the NCUA will not release BSA contact information to the public. Officials with CUNA also did not respond to requests for comment.</p>
<p>A notice posted by the U.S. Treasury Department&#8217;s <strong>Financial Crimes Enforcement Network</strong> (FinCEN) said the bureau was aware of the phishing campaign, and was urging financial institutions to disregard the missives.<span id="more-46496"></span></p>
<p>The latest scam comes amid a significant rise in successful phishing attacks, according to a non-public alert sent in late January by the <strong>U.S. Secret Service</strong> to financial institutions nationwide. &#8220;The Secret Service is observing a noticeable increase in successful large-scale phishing attacks targeting unsuspecting victims across industry,&#8221; the alert warns.</p>
<p>The Secret Service alert reminds readers that we in the United States are entering tax season, which typically brings a large spike in scams designed to siphon personal and financial data. It also includes some helpful reminders, including:</p>
<p>-Never click on links embedded in emails or open any attachments from unknown or suspect fraudulent email accounts.</p>
<p>-Always independently verify any requested information originates from a legitimate source.</p>
<p>-Visit Web sites by entering the domain name yourself (for sensitive sites, preferably by using a bookmark you created previously).</p>
<p>-If you are contacted via phone, hang up, look up the number for the institution at that institution&#8217;s Web site, and call back. Do not give out information in an unsolicited phone call.</p>


feed_id: https://krebsonsecurity.com/?p=46523
title: Email Provider VFEmail Suffers ‘Catastrophic’ Hack
uri: Email-Provider-VFEmail-Suffers-Catastrophic-Hack
url: https://krebsonsecurity.com/2019/02/email-provider-vfemail-suffers-catastrophic-hack/
content:
<p>Email provider <strong>VFEmail</strong> has suffered what the company is calling &#8220;catastrophic destruction&#8221; at the hands of an as-yet unknown intruder who trashed all of the company&#8217;s primary and backup data in the United States. The firm&#8217;s founder says he now fears some 18 years&#8217; worth of customer email may be gone forever.</p>
<p>Founded in 2001 and based in Milwaukee, Wisc., VFEmail provides email service to businesses and end users. The first signs of the attack came on the morning of Feb. 11, when the company&#8217;s Twitter account started fielding reports from users who said they were no longer receiving messages. VFEmail&#8217;s <a href="https://twitter.com/VFEmail/with_replies" target="_blank" rel="noopener">Twitter account</a> responded that &#8220;external facing systems, of differing OS&#8217;s and remote authentication, in multiple data centers are down.&#8221;</p>
<p><a class="lightbox" href="media/1d37748e.vfemail.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/02/vfemail.jpg"><img class="aligncenter wp-image-46528" src="media/1d37748e.vfemail.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/02/vfemail.jpg" alt="" width="596" height="279" /></a></p>
<p>Two hours later, VFEmail <a href="https://twitter.com/VFEmail/status/1095021927972909056" target="_blank" rel="noopener">tweeted</a> that it had caught a hacker in the act of formatting one of the company&#8217;s mail servers in The Netherlands.</p>
<p>&#8220;nl101 is up, but no incoming email,&#8221; read <a href="https://twitter.com/VFEmail/status/1095022045501579264" target="_blank" rel="noopener">a tweet</a> shortly thereafter. &#8220;I fear all US based data my be lost.&#8221;</p>
<p>&#8220;At this time, the attacker has formatted all the disks on every server,&#8221; wrote VFEmail. &#8220;Every VM [virtual machine] is lost. Every file server is lost, every backup server is lost. Strangely, not all VMs shared the same authentication, but all were destroyed. This was more than a multi-password via ssh exploit, and there was no ransom. Just attack and destroy.&#8221;</p>
<p>In an update posted to <a href="https://www.vfemail.net/" target="_blank" rel="noopener">the company&#8217;s Web site</a>, VFEmail owner <strong>Rick Romero</strong> wrote that new email was being delivered and that efforts were being made to recover what user data could be salvaged.</p>
<p>&#8220;At this time I am unsure of the status of existing mail for US users,&#8221; Romero wrote. &#8220;If you have your own email client, DO NOT TRY TO MAKE IT WORK. If you reconnect your client to your new mailbox, all your local mail will be lost.&#8221;</p>
<p>Reached by KrebsOnSecurity on Tuesday morning, Romero said he was able to recover a backup drive hosted in The Netherlands, but that he fears all of the mail for U.S. users may be irreparably lost.</p>
<p>&#8220;I don&#8217;t have very high expectations of getting any U.S. data back,&#8221; Romero said in an online chat.<span id="more-46523"></span></p>
<p><strong>John Senchak</strong>, a longtime VFEmail user from Florida who also has been a loyal reader and commenter at this blog, told KrebsOnSecurity that the attack completely wiped out his inbox at the company &#8212; some 60,000 emails sent and received over more than a decade.</p>
<p>&#8220;I have a account with that site, all the email in my account was deleted,&#8221; Senchak said.</p>
<p>Asked if he had any clues about the attackers or how they may have broken in, Romero said the intruder appeared to be doing his dirty work from a server based in Bulgaria (94.155.49[9], username &#8220;aktv.&#8221;)</p>
<p>&#8220;I haven&#8217;t done much digging yet on the actors,&#8221; he said. &#8220;It looked like the IP was a Bulgarian hosting company. So I&#8217;m assuming it was just a virtual machine they were using to launch the attack from. There definitely was something that somebody didn&#8217;t want found. Or, I really pissed someone off. That&#8217;s always possible.&#8221;</p>
<p>This isn&#8217;t the first time criminals have targeted VFEmail. I <a href="https://krebsonsecurity.com/2015/11/the-lingering-mess-from-default-insecurity/" target="_blank" rel="noopener">wrote about the company in 2015</a> after it suffered a debilitating distributed denial-of-service (DDoS) attack after Romero declined to pay a ransom demand from <a href="https://blogs.akamai.com/2015/11/operation-profile-armada-collective.html" target="_blank" rel="noopener">an online extortion group</a>. Another series of DDoS attacks in 2017 forced VFEmail to find a new hosting provider.</p>
<p>In December 2018, Romero <a href="https://twitter.com/VFEmail/status/1071429296139440128" target="_blank" rel="noopener">tweeted</a> that service had been disrupted by a DDoS attack that he attributed to &#8220;script kiddies,&#8221; a derisive reference to low-skilled online hooligans.</p>
<p>&#8220;After 17 years if I was planning to shut it down, it&#8217;d be shut down by me &#8211; not script kiddies,&#8221; Romero <a href="https://twitter.com/VFEmail/status/1071571127468740613" target="_blank" rel="noopener">wrote</a> on Dec. 8.</p>
<p>Attacks that seek to completely destroy data and servers without any warning or extortion demand are not as common as, say, <a href="https://krebsonsecurity.com/2019/01/cloud-hosting-provider-dataresolution-net-battling-christmas-eve-ransomware-attack/" target="_blank" rel="noopener">ransomware infestations</a>, but when they do occur they can be devastating (the <a href="https://krebsonsecurity.com/?s=sony+pictures&amp;x=0&amp;y=0" target="_blank" rel="noopener">2014 Sony Pictures hack</a> and the still-unsolved <a href="https://krebsonsecurity.com/?s=staminus&amp;x=0&amp;y=0" target="_blank" rel="noopener">2016 assault on U.S.-based ISP Staminus</a> come to mind).</p>
<p>It&#8217;s not clear how or whether VFEmail will recover from this latest attack, but such actions are an unsettling reminder that although most cybercriminals have some kind of short- or long-term profit motive in mind, an intruder with privileged access to a network can just as well virtually destroy everything within reach as they can plant malware or extortion threats like ransomware.</p>


feed_id: https://krebsonsecurity.com/?p=46434
title: Patch Tuesday, February 2019 Edition
uri: Patch-Tuesday-February-2019-Edition
url: https://krebsonsecurity.com/2019/02/patch-tuesday-february-2019-edition/
content:
<p>Microsoft on Tuesday issued a bevy of patches to correct at least 70 distinct security vulnerabilities in <strong>Windows</strong> and software designed to interact with various flavors of the operating system. This month&#8217;s patch batch tackles some notable threats to enterprises &#8212; including multiple flaws that were publicly disclosed prior to Patch Tuesday. It also bundles fixes to quash threats relevant to end users, including critical updates for <strong>Adobe Flash Player</strong> and <strong>Microsoft Office</strong>, as well as a zero-day bug in <strong>Internet Explorer</strong>.</p>
<p><img class="alignright size-full wp-image-26837" src="media/863df0f6.brokenwindows.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2014/07/brokenwindows.png" alt="" width="229" height="240" />Some 20 of the flaws addressed in February&#8217;s update bundle are weaknesses labeled &#8220;critical,&#8221; meaning Microsoft believes that attackers or malware could exploit them to fully compromise systems through little or no help from users &#8212; save from convincing a user to visit a malicious or hacked Web site.</p>
<p>Microsoft patched a bug in Internet <span style="text-decoration: line-through;">Exploder</span> Explorer (<a href="https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/CVE-2019-0676" target="_blank" rel="noopener">CVE-2019-0676</a>) discovered by <strong>Google</strong> that attackers already are using to target vulnerable systems. This flaw could allow malware or miscreants to check for the presence of specific files on the target&#8217;s hard drive.</p>
<p>Another critical vulnerability that impacts both end users and enterprises is a weakness in the Windows component responsible for assigning Internet addresses to host computers (a.k.a. “Windows DHCP client”). That flaw, <a href="https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0626" target="_blank" rel="noopener">CVE-2019-0626</a>, could let an attacker execute malcode of his choice just by sending the target a specially crafted DHCP request.</p>
<p>At the top of the list of patch concerns mainly for companies is a publicly disclosed issue with <strong>Microsoft Exchange</strong> services (<a href="https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0686" target="_blank" rel="noopener">CVE-2019-0686</a>) that could allow an attacker on the same network as the target to access the inbox of other users. Microsoft said it has not seen active exploitation of this bug yet, but considers it likely to be exploited soon.<span id="more-46434"></span></p>
<p>Security experts are fond of saying &#8220;patch now!&#8221; when it comes to Windows bugs, but in general it can’t hurt for regular users to wait a day or two after Microsoft releases monthly security updates before installing the fixes. That&#8217;s because occasionally buggy patches can cause serious headaches for users who install them before all the kinks are worked out.</p>
<p>Just don&#8217;t put off the task too long. And bear in mind it’s a good idea to get in the habit of backing up your data <em>before</em> installing Windows updates, to hedge against the odd case in which a wonky patch ends up rendering your system unusable until you can work out how to reverse the changes.</p>
<p><strong>Windows 10</strong> likes to install patches all in one go and reboot your computer on its own schedule. Microsoft doesn’t make it easy for Windows 10 users to change this setting, <a href="https://www.howtogeek.com/224471/how-to-prevent-windows-10-from-automatically-downloading-updates/" target="_blank" rel="noopener">but it is possible</a>. For all other Windows OS users, if you’d rather be alerted to new updates when they’re available so you can choose when to install them, there’s a setting for that in <strong>Windows Update</strong>.</p>
<p>Microsoft also included fixes to address <a href="https://helpx.adobe.com/security/products/flash-player/apsb19-06.html" target="_blank" rel="noopener">a single vulnerability in Adobe Flash Player</a>. Microsoft and Adobe disagree on the severity of this flaw, according to security firm <strong>Qualys</strong>. Adobe labels it an &#8220;important&#8221; bug, while Microsoft tags it with a far more severe &#8220;critical&#8221; label. Regardless, Flash flaws are favorite targets of attackers. If you brows the Web with IE or Edge, this month&#8217;s patch batch from Microsoft has you covered.</p>
<p>Fortunately, the most popular Web browser by a long shot — <strong>Google Chrome</strong> — auto-updates Flash but also is now making users explicitly enable Flash every time they want to use it (Microsoft also bundles Flash with IE/Edge and updates it whenever Windows systems install monthly updates). By the summer of 2019 Google will <a href="https://nakedsecurity.sophos.com/2018/09/03/chrome-flash-is-almost-almost-almost-dead/" target="_blank" rel="noopener">make Chrome users go into their settings to enable it</a> every time they want to run it.</p>
<p>Firefox also forces users with the Flash add-on installed to click in order to play Flash content; instructions for disabling or removing Flash from Firefox are <a href="https://support.mozilla.org/en-US/kb/disable-or-remove-add-ons" target="_blank" rel="noopener">here</a>. Adobe will stop supporting Flash at the end of 2020.</p>
<p>Adobe also released <a href="https://helpx.adobe.com/security/products/acrobat/apsb19-07.html" target="_blank" rel="noopener">updates for Adobe Acrobat and Reader</a> that plug at least 70 security holes in these applications, so if you have either installed please be sure to update those.</p>
<p>As always, if you experience any problems installing any of these patches this month, please feel free to leave a comment about it below; there’s a good chance other readers have experienced the same and may even chime in here with some helpful tips.</p>


feed_id: https://krebsonsecurity.com/?p=46569
title: Bomb Threat Hoaxer Exposed by Hacked Gaming Site
uri: Bomb-Threat-Hoaxer-Exposed-by-Hacked-Gaming-Site
url: https://krebsonsecurity.com/2019/02/bomb-threat-hoaxer-exposed-by-hacked-gaming-site/
content:
<p>Federal authorities this week arrested a North Carolina man who allegedly ran with a group of online hooligans that attacked Web sites (including this one), took requests on Twitter to call in bomb threats to thousands of schools, and tried to frame various online gaming sites as the culprits. In an ironic twist, the accused &#8212; who had fairly well separated his real life identity from his online personas &#8212; appears to have been caught after a gaming Web site he frequented got hacked.</p>
<p>On Feb. 12, the <strong>U.S. Justice Department</strong> announced the arrest of <strong>Timothy Dalton Vaughn</strong>, a 20-year-old from Winston-Salem, N.C. Vaughn is alleged to have been a key member of the <strong>Apophis Squad</strong>, a gang of ne&#8217;er-do-wells who made bomb threats against thousands of schools and launched distributed denial-of-service (DDoS) attacks against Web sites — including KrebsOnSecurity on multiple occasions.</p>
<p>The feds say Vaughn used multiple aliases on Twitter and elsewhere to crow about his attacks, including &#8220;<strong>HDGZero</strong>,&#8221; &#8220;<strong>WantedByFeds</strong>,&#8221; and &#8220;<strong>Xavier Farbel</strong>.&#8221; Among the Apophis Squad&#8217;s targets was encrypted mail service <a href="https://www.protonmail.com" target="_blank" rel="noopener">Protonmail</a>, which reached out to this author last year for clues about the identities of the Apophis Squad members after noticing we were both being targeted by them and receiving demands for money in exchange for calling off the attacks.</p>
<p>Protonmail later <a href="https://krebsonsecurity.com/2018/09/leader-of-ddos-for-hire-gang-pleads-guilty-to-bomb-threats/" target="_blank" rel="noopener">publicly thanked</a> KrebsOnSecurity for helping to bring about <a href="https://www.bbc.com/news/uk-england-beds-bucks-herts-46482790" target="_blank" rel="noopener">the arrest</a> of Apophis Squad leader <strong>George Duke-Cohan </strong>&#8212; a.k.a. &#8220;opt1cz,&#8221; &#8220;7R1D3n7,&#8221; and &#8220;Pl3xl3t,&#8221; &#8212; a 19-year-old from the United Kingdom who was convicted in December 2018 and <a href="https://krebsonsecurity.com/2018/12/bomb-threat-hoaxer-ddos-boss-gets-3-years/" target="_blank" rel="noopener">sentenced to three years in prison</a>. But the real-life identity of HDGZero remained a mystery to both of us, as there was little publicly available information at the time connecting that moniker to anyone.</p>
<div id="attachment_45028" style="width: 604px" class="wp-caption aligncenter"><img class=" wp-image-45028" src="media/dab13071.as-booter.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/09/as-booter.png" alt="" width="594" height="523" /><p class="wp-caption-text">The DDoS-for-hire service run by Apophis Squad listed their members.</p></div>
<p>That is, until early January 2019, when <a href="https://www.forbes.com/sites/daveywinder/2019/01/03/town-of-salem-hacked-leaving-more-than-7-6m-with-compromised-data/" target="_blank" rel="noopener">news broke</a> that hackers had broken into the servers of computer game maker <strong>BlankMediaGames</strong> and made off with account details of some 7.6 million people who had signed up to play &#8220;Town of Salem, the company&#8217;s browser-based role playing game. That stolen information has since been posted and resold in underground forums.</p>
<p>A review of the leaked BlankMediaGames user database shows that in late 2018, someone who selected the username &#8220;hdgzero&#8221; signed up to play Town of Salem, registering with the email address <strong>xavierfarbel@gmail.com</strong>. The data also shows this person registered at the site using a Sprint mobile device with an Internet address that traced back to the Carolinas.<span id="more-46569"></span></p>
<p>The Justice Department <a href="https://www.documentcloud.org/documents/5736183-Apophis-Squad-INDICTMENT.html?embed=true&amp;responsive=false&amp;sidebar=false" target="_blank" rel="noopener">indictment</a> against Vaughn and Duke-Cohan released this week alleges the pair were equally responsible for sending spoofed bomb threat emails to 2,000 schools in the United States and more than 400 in the U.K., falsely warning that various explosive devices were planted at the schools and would be detonated unless a ransom demand was paid.</p>
<p>In <a href="https://pastebin.com/HxBpPRz1" target="_blank" rel="noopener">this snippet</a> from a January 2018 online chat taken from a channel maintained by HDGZero, the accused can be seen claiming credit for the bomb threats and posting links to stories in various local media outlets about schools evacuating students in response to the threats. The bomb threat emails were made to look like they were sent by different high-profile squads of online gamers competing against one another in the wildly popular game <a href="https://krebsonsecurity.com/2017/01/who-is-anna-senpai-the-mirai-worm-author/" target="_blank" rel="noopener">Minecraft</a>.</p>
<div id="attachment_46575" style="width: 258px" class="wp-caption alignright"><a class="lightbox" href="media/dd80ab43.apophisddos.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/02/apophisddos.jpg"><img class="wp-image-46575" src="media/dd80ab43.apophisddos.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/02/apophisddos.jpg" alt="" width="248" height="351" /></a><p class="wp-caption-text">One of the many private Twitter messages I received from the Apophis Squad following DDoS attacks on KrebsOnSecurity.</p></div>
<p>The government maintains that, through their various Twitter handles, Duke-Cohan and Vaughn even offered to take requests for shutting down specific schools with bomb threats.</p>
<p>&#8220;We are OPEN for request for school lockdowns / evacs,&#8221; read a tweet from the Twitter account @apophissquadv2, which the Justice Department says Duke-Cohan and Vaughn shared. &#8220;Send us your request to apophissquad@tuta.io (FREE).&#8221;</p>
<p>The government alleges that Vaughn also participated with Duke-Cohan in reporting the hijack of a United Airlines flight bound for the United States. That flight, which had almost 300 passengers on board, was later quarantined for four hours in San Francisco pending a full security check.</p>
<p>The indictment charges Vaughn and Duke-Cohan with conspiracy and eight additional felony offenses, including making threats to injure in interstate commerce and making interstate threats involving explosives. Vaughn is additionally charged with intentionally damaging a computer and interstate threat to damage a protected computer with intent to extort.</p>
<p>A Justice Department <a href="https://www.justice.gov/usao-cdca/pr/members-hacker-collective-face-federal-charges-attacking-computer-systems-emailing-mass" target="_blank" rel="noopener">press release</a> on the indictment states that if convicted of all 11 charges, Vaughn would face a statutory maximum sentence of 80 years in federal prison. If convicted of the nine charges in the indictment in which he is named, Duke-Cohan would face a statutory maximum sentence of 65 years in federal prison.</p>


feed_id: https://krebsonsecurity.com/?p=46589
title: A Deep Dive on the Recent Widespread DNS Hijacking Attacks
uri: A-Deep-Dive-on-the-Recent-Widespread-DNS-Hijacking-Attacks
url: https://krebsonsecurity.com/2019/02/a-deep-dive-on-the-recent-widespread-dns-hijacking-attacks/
content:
<p>The U.S. government &#8212; along with a number of leading security companies &#8212; recently warned about a series of highly complex and widespread attacks that allowed suspected Iranian hackers to siphon huge volumes of email passwords and other sensitive data from multiple governments and private companies. But to date, the specifics of exactly how that attack went down and who was hit have remained shrouded in secrecy.</p>
<p>This post seeks to document the extent of those attacks, and traces the origins of this overwhelmingly successful cyber espionage campaign back to a cascading series of breaches at key Internet infrastructure providers.</p>
<p><a class="lightbox" href="media/64b3731a.mideastglobe.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/02/mideastglobe.jpg"><img class="aligncenter wp-image-46628" src="media/64b3731a.mideastglobe.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/02/mideastglobe.jpg" alt="" width="595" height="256" /></a></p>
<p>Before we delve into the extensive research that culminated in this post, it&#8217;s helpful to review the facts disclosed publicly so far. On Nov. 27, 2018, <strong>Cisco&#8217;s Talos</strong> research division <a href="https://blog.talosintelligence.com/2018/11/dnspionage-campaign-targets-middle-east.html" target="_blank" rel="noopener">published a write-up</a> outlining the contours of a sophisticated cyber espionage campaign it dubbed &#8220;<strong>DNSpionage</strong>.&#8221;</p>
<p>The DNS part of that moniker refers to the global &#8220;<a href="https://en.wikipedia.org/wiki/Domain_Name_System" target="_blank" rel="noopener"><strong>D</strong>omain <strong>N</strong>ame <strong>S</strong>ystem</a>,&#8221; which serves as a kind of phone book for the Internet by translating human-friendly Web site names (example.com) into numeric Internet address that are easier for computers to manage.</p>
<p>Talos said the perpetrators of DNSpionage were able to steal email and other login credentials from a number of government and private sector entities in Lebanon and the United Arab Emirates by hijacking the DNS servers for these targets, so that all email and virtual private networking (VPN) traffic was redirected to an Internet address controlled by the attackers.</p>
<p>Talos reported that these DNS hijacks also paved the way for the attackers to obtain SSL encryption certificates for the targeted domains (e.g. webmail.finance.gov.lb), which allowed them to decrypt the intercepted email and VPN credentials and view them in plain text.</p>
<p>On January 9, 2019, security vendor <strong>FireEye</strong> <a href="https://www.fireeye.com/blog/threat-research/2019/01/global-dns-hijacking-campaign-dns-record-manipulation-at-scale.html" target="_blank" rel="noopener">released its report</a>, &#8220;Global DNS Hijacking Campaign: DNS Record Manipulation at Scale,&#8221; which went into far greater technical detail about the &#8220;how&#8221; of the espionage campaign, but contained few additional details about its victims.</p>
<p>Twelve days after the FireEye report, the <strong>U.S. Department of Homeland Security</strong> issued a rare emergency directive <a href="https://cyber.dhs.gov/blog/#why-cisa-issued-our-first-emergency-directive" target="_blank" rel="noopener">ordering</a> all U.S. federal civilian agencies to secure the login credentials for their Internet domain records. As part of that mandate, DHS published a short list of domain names and Internet addresses that were used in the DNSpionage campaign, although those details did not go beyond what was previously released by either Cisco Talos or FireEye.</p>
<p>That changed on Jan. 25, 2019, when security firm <strong>CrowdStrike</strong> <a href="https://www.crowdstrike.com/blog/widespread-dns-hijacking-activity-targets-multiple-sectors/" target="_blank" rel="noopener">published a blog post</a> listing virtually every Internet address known to be (ab)used by the espionage campaign to date. The remainder of this story is based on open-source research and interviews conducted by KrebsOnSecurity in an effort to shed more light on the true extent of this extraordinary &#8212; and ongoing &#8212; attack.</p>
<div id="attachment_46592" style="width: 609px" class="wp-caption aligncenter"><img class=" wp-image-46592" src="media/2ce27485.cs-ips.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/02/cs-ips.jpg" alt="" width="599" height="568" /><p class="wp-caption-text">The &#8220;indicators of compromise&#8221; related to the DNSpionage campaign, as published by CrowdStrike.</p></div>
<h4>PASSIVE DNS</h4>
<p>I began my research by taking each of the Internet addresses laid out in the CrowdStrike report and running them through both <a href="https://www.farsightsecurity.com/" target="_blank" rel="noopener">Farsight Security</a> and <a href="https://securitytrails.com" target="_blank" rel="noopener">SecurityTrails</a>, services that passively collect data about changes to DNS records tied to tens of millions of Web site domains around the world.</p>
<p>Working backwards from each Internet address, I was able to see that in the last few months of 2018 the hackers behind DNSpionage succeeded in compromising key components of DNS infrastructure for more than 50 Middle Eastern companies and government agencies, including targets in Albania, Cyprus, Egypt, Iraq, Jordan, Kuwait, Lebanon, Libya, Saudi Arabia and the United Arab Emirates.</p>
<p>For example, the passive DNS data shows the attackers were able to hijack the DNS records for <strong>mail.gov.ae</strong>, which handles email for government offices of the United Arab Emirates. Here are just a few other interesting assets successfully compromised in this cyber espionage campaign:</p>
<p><strong>-nsa.gov.iq:</strong> the National Security Advisory of Iraq<br />
<strong>-webmail.mofa.gov.ae:</strong> email for the United Arab Emirates&#8217; Ministry of Foreign Affairs<br />
<strong>-shish.gov.al:</strong> the State Intelligence Service of Albania<br />
<strong>-mail.mfa.gov.eg:</strong> mail server for Egypt&#8217;s Ministry of Foreign Affairs<br />
<strong>-mod.gov.eg:</strong> Egyptian Ministry of Defense<br />
<strong>-embassy.ly:</strong> Embassy of Libya<br />
<strong>-owa.e-albania.al:</strong> the Outlook Web Access portal for the e-government portal of Albania<br />
<strong>-mail.dgca.gov.kw:</strong> email server for Kuwait&#8217;s Civil Aviation Bureau<br />
<strong>-gid.gov.jo:</strong> Jordan&#8217;s General Intelligence Directorate<br />
<strong>-adpvpn.adpolice.gov.ae:</strong> VPN service for the Abu Dhabi Police<br />
<strong>-mail.asp.gov.al:</strong> email for Albanian State Police<br />
<strong>-owa.gov.cy:</strong> Microsoft Outlook Web Access for Government of Cyprus<br />
<strong>-webmail.finance.gov.lb:</strong> email for Lebanon Ministry of Finance<br />
<strong>-mail.petroleum.gov.eg:</strong> Egyptian Ministry of Petroleum<br />
<strong>-mail.cyta.com.cy:</strong> Cyta telecommunications and Internet provider, Cyprus<br />
<strong>-mail.mea.com.lb:</strong> email access for Middle East Airlines</p>
<p>The passive DNS data provided by Farsight and SecurityTrails also offered clues about when each of these domains was hijacked. In most cases, the attackers appear to have changed the DNS records for these domains (we&#8217;ll get to the &#8220;how&#8221; in a moment) so that the domains pointed to servers in Europe that they controlled.</p>
<p>Shortly after the DNS records for these TLDs were hijacked &#8212; sometimes weeks, sometimes just days or hours &#8212; the attackers were able to obtain SSL certificates for those domains from SSL providers <a href="https://www.comodo.com" target="_blank" rel="noopener">Comodo</a> and/or <a href="https://letsencrypt.org" target="_blank" rel="noopener">Let&#8217;s Encrypt</a>. The preparation for several of these attacks can be seen at <a href="https://crt.sh" target="_blank" rel="noopener">cert.sh</a>, which provides a searchable database of all new SSL certificate creations.</p>
<p>Let&#8217;s take a closer look at one example. The CrowdStrike report references the Internet address <strong>139.59.134[.]216 </strong>(see above), which according to Farsight was home to just seven different domains over the years. Two of those domains only appeared at that Internet address in December 2018, including domains in Lebanon and &#8212; curiously &#8212; Sweden.</p>
<p>The first domain was &#8220;<strong>ns0.idm.net.lb</strong>,&#8221; which is a server for the Lebanese Internet service provider <a href="https://www.idm.net.lb/" target="_blank" rel="noopener">IDM</a>. From early 2014 until December 2018, ns0.idm.net.lb pointed to <strong>194.126.10[.]18</strong>, which appropriately enough is an Internet address based in Lebanon. But as we can see in the screenshot from Farsight&#8217;s data below, on Dec. 18, 2018, the DNS records for this ISP were changed to point Internet traffic destined for IDM to a hosting provider in Germany (the 139.59.134[.]216 address).</p>
<div id="attachment_46593" style="width: 413px" class="wp-caption aligncenter"><img class="size-full wp-image-46593" src="media/2059756d.idm-net-lb.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/02/idm-net-lb.jpg" alt="" width="403" height="602" /><p class="wp-caption-text">Source: Farsight Security</p></div>
<p>Notice what else is listed along with IDM&#8217;s domain at 139.59.134[.]216, according to Farsight:</p>
<p><img class="aligncenter size-full wp-image-46594" src="media/118c6056.139.59.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/02/139.59.jpg" alt="" width="391" height="249" /></p>
<p>The DNS records for the domains <strong>sa1.dnsnode.net</strong> and <strong>fork.sth.dnsnode.net</strong> also were changed from their rightful home in Sweden to the German hosting provider controlled by the attackers in December. These domains are owned by <a href="https://www.netnod.se/" target="_blank" rel="noopener">Netnod Internet Exchange</a>, a major global DNS provider based in Sweden. Netnod also operates one of the <a href="https://en.wikipedia.org/wiki/Root_name_server" target="_blank" rel="noopener">13 &#8220;root&#8221; name servers,</a> a critical resource that forms the very foundation of the global DNS system.</p>
<p>We&#8217;ll come back to Netnod in a moment. But first let&#8217;s look at another Internet address referenced in the CrowdStrike report as part of the infrastructure abused by the DNSpionage hackers: <strong>82.196.11[.]127</strong>. This address in The Netherlands also is home to the domain <strong>mmfasi[.]com</strong>, which Crowdstrike says was one of the attacker&#8217;s domains that was used as a DNS server for some of the hijacked infrastructure.</p>
<p><img class="aligncenter size-full wp-image-46597" src="media/2a3ead03.82-196.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/02/82-196.jpg" alt="" width="482" height="409" /></p>
<p>As we can see in the screenshot above, 82.196.11[.]127 was temporarily home to another pair of Netnod DNS servers, as well as the server &#8220;<strong>ns.anycast.woodynet.net</strong>.&#8221; That domain is derived from the nickname of <a href="https://en.wikipedia.org/wiki/Bill_Woodcock" target="_blank" rel="noopener">Bill Woodcock</a>, who serves as executive director of <a href="https://www.pch.net/" target="_blank" rel="noopener">Packet Clearing House (PCH)</a>.</p>
<p>PCH is a nonprofit entity based in northern California that also manages significant amounts of the world&#8217;s DNS infrastructure, particularly the DNS for more than 500 top-level domains and a number of the Middle East top-level domains targeted by DNSpionage.<span id="more-46589"></span></p>
<h4>TARGETING THE REGISTRARS</h4>
<p>Contacted on Feb. 14 by KrebsOnSecurity, <strong>Netnod CEO Lars Michael Jogbäck</strong> confirmed that parts of Netnod&#8217;s DNS infrastructure were hijacked in late December 2018 and early January 2019 after the attackers gained access to accounts at Netnod&#8217;s domain name registrar.</p>
<p>Jogbäck pointed to <a href="https://www.netnod.se/news/statement-on-man-in-the-middle-attack-against-netnod" target="_blank" rel="noopener">a statement</a> the company published on its Web site on Feb. 5, which says Netnod learned of its role in the attack on January 2 and has been in contact with all relevant parties and customers throughout this process.</p>
<p>&#8220;As a participant in an international security co-operation, Netnod became aware on 2 January 2019 that we had been caught up in this wave and that we had experienced a MITM (man-in-the-middle) attack,&#8221; the statement reads. &#8220;Netnod was not the ultimate goal of the attack. The goal is considered to have been the capture of login details for Internet services in countries outside of Sweden.&#8221;</p>
<p>In an interview with this author on Feb. 15, PCH&#8217;s Woodcock acknowledged that portions of his organization&#8217;s DNS infrastructure were compromised after the DNSpionage hackers abused unauthorized access to its domain name registrar.</p>
<p>As it happens, the registrar records for both pch.net and dnsnode.net point to the same sources: <strong>Key-Systems GmbH</strong>, a domain registrar based in Germany; and <strong>Frobbit.se</strong>, a company in Sweden. Frobbit is a reseller of Key Systems, and the two companies share some of the same online resources.</p>
<p>Woodcock said domain records for the targeted Middle East TLDs it managed were altered after the DNSpionage hackers phished credentials that Key-Systems uses to make domain changes for their clients.</p>
<p>Specifically, he said, the hackers phished credentials that PCH&#8217;s registrar used to send signaling messages known as the <a href="https://en.wikipedia.org/wiki/Extensible_Provisioning_Protocol" target="_blank" rel="noopener">Extensible Provisioning Protocol (EPP)</a>. EPP is a little-known interface that serves as a kind of back-end for the global DNS system, allowing domain registrars to notify the regional registries (like Verisign) about changes to domain records, including new domain registrations, modifications, and transfers.</p>
<p>&#8220;At the beginning of January, Key-Systems said they believed that their EPP interface had been abused by someone who had stolen valid credentials,&#8221; Woodcock said.</p>
<p>Key-Systems declined to comment for this story, beyond saying it does not discuss details of its reseller clients&#8217; businesses.</p>
<p>Netnod&#8217;s <a href="https://www.netnod.se/news/statement-on-man-in-the-middle-attack-against-netnod" target="_blank" rel="noopener">written statement</a> on the attack referred further inquiries to the company&#8217;s security director <strong>Patrik Fältström</strong>, who also is co-owner of Frobbit.se.</p>
<p>In an email to KrebsOnSecurity, Fältström said unauthorized EPP instructions were sent to various registries by the DNSpionage attackers from both Frobbit and Key Systems.</p>
<p>&#8220;The attack was from my perspective clearly an early version of a serious EPP attack,&#8221; he wrote. &#8220;That is, the goal was to get the right EPP commands sent to the registries. I am extremely nervous personally over extrapolations towards the future. Should registries allow any EPP command to come from the registrars? We will always have some weak registrars, right?&#8221;</p>
<h4>DNSSEC</h4>
<p>One of the more interesting aspects of these attacks is that both Netnod and PCH are vocal proponents and adopters of <a href="https://en.wikipedia.org/wiki/Domain_Name_System_Security_Extensions" target="_blank" rel="noopener">DNSSEC</a> (a.k.a. &#8220;DNS Security Extensions&#8221;), which is a technology designed to defeat the very type of attack that the DNSpionage hackers were able to execute.</p>
<div id="attachment_46631" style="width: 608px" class="wp-caption aligncenter"><img class=" wp-image-46631" src="media/d4358da9.dnssec.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/02/dnssec.jpg" alt="" width="598" height="217" /><p class="wp-caption-text">Image: APNIC</p></div>
<p>DNSSEC protects applications from using forged or manipulated DNS data, by requiring that all DNS queries for a given domain or set of domains be digitally signed. In DNSSEC, if a name server determines that the address record for a given domain has not been modified in transit, it resolves the domain and lets the user visit the site. If, however, that record has been modified in some way or doesn&#8217;t match the domain requested, the name server blocks the user from reaching the fraudulent address.</p>
<p>While DNSSEC can be an effective tool for mitigating attacks such as those launched by DNSpionage, only about 20 percent of the world&#8217;s major networks and Web sites have enabled it, according to <a href="https://stats.labs.apnic.net/dnssec/XA?c=XA&amp;x=1&amp;g=1&amp;r=1&amp;w=7&amp;g=0" target="_blank" rel="noopener">measurements</a> gathered by <strong>APNIC</strong>, the regional Internet address registry for the Asia-Pacific region.</p>
<p>Jogbäck said Netnod&#8217;s infrastructure suffered three separate attacks from the DNSpionage attackers. The first two occurred in a two-week window between Dec. 14, 2018 and Jan. 2, 2019, and targeted company servers that were <em>not</em> protected by DNSSEC.</p>
<p>However, he said the third attack between Dec. 29 and Jan. 2 targeted Netnod infrastructure that <em>was</em> protected by DNSSEC and serving its own internal email network. Yet, because the attackers already had access to its registrar&#8217;s systems, they were able to briefly disable that safeguard &#8212; or at least long enough to obtain SSL certificates for <a href="https://crt.sh/?id=1071765455" target="_blank" rel="noopener">two of Netnod&#8217;s</a> <a href="https://crt.sh/?id=1071723007" target="_blank" rel="noopener">email servers</a>.</p>
<p>Jogbäck told KrebsOnSecurity that once the attackers had those certificates, they re-enabled DNSSEC for the company&#8217;s targeted servers while apparently preparing to launch the second stage of the attack &#8212; diverting traffic flowing through its mail servers to machines the attackers controlled. But Jogbäck said that for whatever reason, the attackers neglected to use their unauthorized access to its registrar to disable DNSSEC before later attempting to siphon Internet traffic.</p>
<p>&#8220;Luckily for us, they forgot to remove that when they launched their man-in-the-middle attack,&#8221; he said. &#8220;If they had been more skilled they would have removed DNSSEC on the domain, which they could have done.&#8221;</p>
<p>Woodcock says PCH validates DNSSEC on all of its infrastructure, but that not all of the company&#8217;s customers &#8212; particularly some of the countries in the Middle East targeted by DNSpionage &#8212; had configured their systems to fully implement the technology.</p>
<p>Woodcock said PCH&#8217;s infrastructure was targeted by DNSpionage attackers in four distinct attacks between December 13, 2018 and January 2, 2019. With each attack, the hackers would turn on their password-slurping tools for roughly one hour, and then switch them off before returning the network to its original state after each run.</p>
<p>The attackers didn&#8217;t need to enable their surveillance dragnet longer than an hour each time because most modern smartphones are configured to continuously pull new email for any accounts the user may have set up on his device. Thus, the attackers were able to hoover up a great many email credentials with each brief hijack.</p>
<p>On Jan. 2, 2019 &#8212; the same day the DNSpionage hackers went after Netnod&#8217;s internal email system &#8212; they also targeted PCH directly, obtaining <a href="https://crt.sh/?id=1075482182" target="_blank" rel="noopener">SSL</a> <a href="https://crt.sh/?id=1075482666" target="_blank" rel="noopener">certificates</a> from Comodo for two PCH domains that handle internal email for the company.</p>
<p>Woodcock said PCH&#8217;s reliance on DNSSEC almost completely blocked that attack, but that it managed to snare email credentials for two employees who were traveling at the time. Those employees&#8217; mobile devices were downloading company email via hotel wireless networks that &#8212; as a prerequisite for using the wireless service &#8212; forced their devices to use the hotel&#8217;s DNS servers, not PCH&#8217;s DNNSEC-enabled systems.</p>
<p>&#8220;The two people who did get popped, both were traveling and were on their iPhones, and they had to traverse through captive portals during the hijack period,&#8221; Woodcock said. &#8220;They had to switch off our name servers to use the captive portal, and during that time the mail clients on their phones checked for new email. Aside from that, DNSSEC saved us from being really, thoroughly owned.&#8221;</p>
<p>Because PCH had protected its domains with DNSSEC, the practical effect of the hijack against its mail infrastructure was that for roughly an hour nobody but the two remote employees received any email.</p>
<p>&#8220;For essentially all of our users, what it looked like was the mail server just wasn&#8217;t available for a short period,&#8221; Woodcock said. &#8220;It didn&#8217;t resolve for a while if they happened to be checking their phone or whatever, and each person thought well that&#8217;s funny, I&#8217;ll check it back in a while. And by the time they checked again it was working fine. A bunch of our staff noticed a brief outage in our email service, but nobody thought enough of it to discuss it with anyone else or open a ticket.&#8221;</p>
<p>But the DNSpionage hackers were not deterred. In a letter to its customers sent earlier this month, PCH said a forensic investigation determined that on Jan. 24 a computer which holds its Web site user database had been compromised. The user data stored in the database included customer usernames, <a href="https://en.wikipedia.org/wiki/Bcrypt" target="_blank" rel="noopener">bcrypt</a> password hashes, emails, addresses, and organization names.</p>
<p>&#8220;We see no evidence that the attackers accessed the user database or exfiltrated it,&#8221; the message reads. &#8220;So we are providing you this information as a matter of transparency and precaution, rather than because we believe that your data was compromised.&#8221;</p>
<h4>IMPROVEMENTS</h4>
<p>Multiple experts interviewed for this story said one persistent problem with DNS-based attacks is that a great deal of organizations tend to take much of their DNS infrastructure for granted. For example, many entities don&#8217;t even log their DNS traffic, nor do they keep a close eye on any changes made to their domain records.</p>
<p>Even for those companies making an effort to monitor their DNS infrastructure for suspicious changes, some monitoring services only take snapshots of DNS records passively, or else only do so actively on a once-daily basis. Indeed, Woodcock said PCH relied on no fewer than three monitoring systems, and that none of them alerted his organization to the various one-hour hijacks that hit PCH&#8217;s DNS systems.</p>
<p>&#8220;We had three different commercial DNS monitoring services, none of which caught it,&#8221; he said. &#8220;None of them even warned us that it had happened after the fact.&#8221;</p>
<p>Woodcock said PCH has since set up a system to poll its own DNS infrastructure multiple times each hour, and to alert immediately on any changes.</p>
<p>Jogbäck said Netnod also has beefed up its monitoring, as well as redoubled efforts to ensure that all of the available options for securing their domain infrastructure were being used. For instance, the company had not previously secured all of its domains with a &#8220;<a href="https://www.icann.org/resources/pages/locked-2013-05-03-en" target="_blank" rel="noopener">domain lock</a>,&#8221; a service that requires a registrar to take additional authentication steps before making any modifications to a domain&#8217;s records.</p>
<p>&#8220;We are really sad we didn&#8217;t do a better job of protecting our customers, but we are also a victim in the chain of the attack,&#8221; Jogbäck said. &#8220;You can change to a better lock after you&#8217;ve been robbed, and hopefully make it more difficult for someone to do it again. But I can truly say we have learned a tremendous amount from being a victim in this attack, and we are now much better off than before.&#8221;</p>
<p>Woodcock said he&#8217;s worried that Internet policymakers and other infrastructure providers aren&#8217;t taking threats to the global DNS seriously or urgently enough, and he&#8217;s confident the DNSpionage hackers will have plenty of other victims to target and exploit in the months and years ahead.</p>
<p>&#8220;All of this is a running battle,&#8221; he said. <span class="pullquote pqleft">&#8220;The Iranians are not just trying to do these attacks to have an immediate effect. They&#8217;re trying to get into the Internet infrastructure deeply enough so they can get away with this stuff whenever they want to.</span> They&#8217;re looking to get as many ways in as possible that they can use for specific goals in the future.&#8221;</p>
<h4>RECOMMENDATIONS</h4>
<p><strong>John Crain</strong> is chief security, stability and resiliency officer at <a href="https://en.wikipedia.org/wiki/ICANN" target="_blank" rel="noopener">ICANN</a>, the non-profit entity that oversees the global domain name industry. Crain said many of the best practices that can make it more difficult for attackers to hijack a target&#8217;s domains or DNS infrastructure have been known for more than a decade.</p>
<p>&#8220;A lot of this comes down to data hygiene,&#8221; Crain said. &#8220;Large organizations down to mom-and-pop entities are not paying attention to some very basic security practices, like multi-factor authentication. These days, if you have a sub-optimal security stance, you&#8217;re going to get owned. That&#8217;s the reality today. We&#8217;re seeing much more sophisticated adversaries now taking actions on the Internet, and if you&#8217;re not doing the basic stuff they&#8217;re going to hit you.&#8221;</p>
<p>Some of those best practices for organizations include:</p>
<p>-Use DNSSEC (both signing zones and validating responses)</p>
<p>-Use registration features like Registry Lock that can help protect domain names records from being changed</p>
<p>-Use access control lists for applications, Internet traffic and monitoring</p>
<p>-Use 2-factor authentication, and require it to be used by all relevant users and subcontractors</p>
<p>-In cases where passwords are used, pick unique passwords and consider password managers</p>
<p>-Review accounts with registrars and other providers</p>
<p>-Monitor certificates by monitoring, for example, <a href="https://www.certificate-transparency.org/how-ct-works" target="_blank" rel="noopener">Certificate Transparency Logs</a></p>


feed_id: https://krebsonsecurity.com/?p=46614
title: New Breed of Fuel Pump Skimmer Uses SMS and Bluetooth
uri: New-Breed-of-Fuel-Pump-Skimmer-Uses-SMS-and-Bluetooth
url: https://krebsonsecurity.com/2019/02/new-breed-of-fuel-pump-skimmer-uses-sms-and-bluetooth/
content:
<p class="p1">Fraud investigators say they&#8217;ve uncovered a sophisticated new breed of credit card skimmers being installed at gas pumps that is capable of relaying stolen card data via mobile text message, thereby enabling fraudsters to collect it from anywhere in the world. One interesting component of this criminal innovation is a small cellphone and Bluetooth-enabled device hidden inside the contactless payment terminal of the pump, which appears to act as a Bluetooth hub that wirelessly gathers card data from multiple compromised pumps at a given filling station.</p>
<p>A memo sent by the <strong>U.S. Secret Service</strong> last week to its various field offices said the agency recently was alerted to the discovery of a fraud device made to fit underneath the plastic cap for the contactless payment terminal attached to the exterior of a fuel pump. Here&#8217;s a look at the back side of that unwelcome parasite:</p>
<div id="attachment_46668" style="width: 603px" class="wp-caption aligncenter"><img class=" wp-image-46668" src="media/4581ee65.nfc-pumpskimmer.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/02/nfc-pumpskimmer.jpg" alt="" width="593" height="527" /><p class="wp-caption-text">A multi-functional wireless device found attached to a contactless payment terminal at a gas station.</p></div>
<p>As we can see from the above image, it includes GSM mobile phone components, allowing it to send stolen card data wirelessly via text message. In contrast, most modern pump skimmers transmit stolen card data to the thieves via Bluetooth. The white rectangular module on the right is <a href="https://www.u-blox.com/en/product/sara-u2-series" target="_blank" rel="noopener">the mobile phone component</a>; the much smaller, <a href="https://www.u-blox.com/en/product/max-m8q-01a-module" target="_blank" rel="noopener">square module</a> below and to the left is built to handle Bluetooth communications.</p>
<p>Bluetooth requires the fraudsters who placed the devices to return to the scene of the crime periodically and download the stolen data with a mobile device or laptop. Using SMS-based skimmers, the fraudsters never need to take that risk and can receive the stolen card data in real-time from anywhere there is mobile phone service.</p>
<p>Gas stations are beginning to implement contactless payments at the pump to go along with traditional magnetic stripe and chip card-based payments. These contactless payments use a technology called “<a href="https://en.wikipedia.org/wiki/Near-field_communication" target="_blank" rel="noopener">near field communication</a>,” or NFC, which exchanges wireless signals when an NFC-enabled card or mobile device is held closely to a point-of-sale device.</p>
<p class="p1">Because this tiny round device was found hidden inside of an NFC card reader on the outside of a gas pump, investigators said they initially thought it might have been designed to somehow siphon or interfere with data being transmitted by contactless payment cards. But this theory was quickly discarded, as contactless cards include security features which render data that might be intercepted largely useless for future transactions (or at least hardly worth the up-front investment, craftsmanship and risk it takes to deploy such skimming devices).</p>
<p><strong>Mark Carl</strong> is chief executive officer at <a href="https://www.controlscan.com/" target="_blank" rel="noopener">ControlScan</a>, a company in Alpharetta, Ga. that helps merchants secure their payment card technology. Carl&#8217;s company is the one that found the skimmer and alerted local authorities, which in turn alerted the Secret Service.</p>
<p>Carl said his team is still trying to reverse engineer the device found inside the NFC reader at the pump, but that so far it appears its purpose is to act as a Bluetooth communications hub for other skimming devices found at the scene. Turns out, investigators also discovered traditional Bluetooth-based skimming devices attached to the power and networking cables inside various pumps at the compromised filling station.</p>
<div id="attachment_46674" style="width: 609px" class="wp-caption aligncenter"><img class=" wp-image-46674" src="media/bdcd0675.nfcpumpskimmerphone.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/02/nfcpumpskimmerphone.jpg" alt="" width="599" height="368" /><p class="wp-caption-text">One of several traditional Bluetooth-enabled card skimming devices found inside pumps at a compromised filling station. Investigators believe this device and others like it found at the station may have been part of a local Bluetooth network that used a device hidden inside the NFC reader on a pump to relay stolen card data via text message.</p></div>
<p>&#8220;Based on the chipsets, and that there were other traditional skimmers in other pumps at the site, we believe this device [the round gizmo found inside the NFC reader] is likely the hub for a Bluetooth local area network,&#8221; Carl told KrebsOnSecurity. &#8220;So an attacker can install multiple skimmers in different pumps, feed all of that data to this device with Bluetooth, and then relay it all via the cellular connection.&#8221;<span id="more-46614"></span></p>
<p>Many readers have asked if they should be scanning fuel pumps with their smart phones using the built-in Bluetooth component or Android mobile app like <a href="https://learn.sparkfun.com/tutorials/gas-pump-skimmers" target="_blank" rel="noopener">Skimmer Scanner.</a> If this seems like fun, then by all means go right ahead, but I wouldn&#8217;t count on these methods failing to detect a Bluetooth skimmer at the pump as proof that the pump is skimmer-free.</p>
<p>For one thing, the skimmer detection app detects only one type of Bluetooth module used in these schemes (HC-05), and there are least three other types commonly found embedded in compromised pumps (HC-06, HC-08 and FCD_1608). And trying to do this with your mobile phone alone is not likely to yield any more conclusive results.</p>
<p>Better advice is to patronize filling stations that have upgraded their pumps in the past few years to add more digital and physical security features. As I wrote in last summer&#8217;s &#8220;<a href="https://krebsonsecurity.com/2018/06/how-to-avoid-card-skimmers-at-the-pump/" target="_blank" rel="noopener">How to Avoid Card Skimmers at the Pump</a>,&#8221; newer and more secure pumps typically feature a horizontal card acceptance slot along with a raised metallic keypad — much like a traditional payphone keypad.</p>
<p>One other tip from that story: Some pump skimming devices are <a href="https://krebsonsecurity.com/2013/07/dont-get-sucker-pumped/" target="_blank" rel="noopener">capable of stealing debit card PINs as well</a>, <em>so it’s a good idea to avoid paying with a debit card at the pump</em>. Armed with your PIN and debit card data, thieves can clone the card and pull money out of your account at an ATM. Having your checking account emptied of cash while your bank sorts out the situation can be a huge hassle and create secondary problems (bounced checks, for instance).</p>
<p>This advice often runs counter to the messaging pushed by fuel station owners themselves, many of whom offer lower prices for cash or debit card transactions. That’s because credit card transactions typically are more expensive to process.</p>


feed_id: https://krebsonsecurity.com/?p=46708
title: Payroll Provider Gives Extortionists a Payday
uri: Payroll-Provider-Gives-Extortionists-a-Payday
url: https://krebsonsecurity.com/2019/02/payroll-provider-gives-extortionists-a-payday/
content:
<p>Payroll software provider <strong>Apex Human Capital Management</strong> suffered a ransomware attack this week that severed payroll management services for hundreds of the company&#8217;s customers for nearly three days. Faced with the threat of an extended outage, Apex chose to pay the ransom demand and begin the process of restoring service to customers.</p>
<p>Roswell, Ga. based <a href="https://apexhcm.com/about-us/#" target="_blank" rel="noopener">Apex HCM</a> is a cloud-based payroll software company that serves some 350 payroll service bureaus that in turn provide payroll services to small and mid-sized businesses. At 4 a.m. on Tuesday, Feb. 19, Apex was alerted that its systems had been infected with a destructive strain of ransomware that encrypts computer files and demands payment for a digital key needed to unscramble the data.</p>
<p><img class="aligncenter wp-image-46701" src="media/c0ecec83.apexupdates.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/02/apexupdates.jpg" alt="" width="599" height="639" /></p>
<p>The company quickly took all of its systems offline, and began notifying customers that it was trying to remediate a security threat. Over a series of bi-hourly updates, Apex kept estimating that it expected to restore service in a few hours, only to have to walk back those estimates almost every other time a new customer update went out.</p>
<p>Contacted Wednesday by an Apex client who was nervous about being unable to make this week&#8217;s payroll for his clients, KrebsOnSecurity reached out to Apex for comment. <strong>Ian Oxman</strong>, the company&#8217;s chief marketing officer, said the ransomware never touched customer data, but instead encrypted and disrupted everything in the company&#8217;s computer systems and at its off-site disaster recovery systems.</p>
<p>&#8220;We had just recently completed a pretty state-of-the-art disaster recovery plan off-site out and of state that was mirroring our live system,&#8221; Oxman said. &#8220;But when the ransomware bomb went off, not only did it go through and infect our own network, it was then immediately picked up in our disaster recovery site, which made switching over to that site unusable.&#8221;</p>
<p>Oxman said Apex hired two outside security firms, and by Feb. 20 the consensus among all three was that paying the ransom was the fastest way to get back online. The company declined to specify how much was paid or what strain of ransomware was responsible for the attack.</p>
<p><span class="pullquote pqright">&#8220;We paid the ransom, and it sucked,&#8221; Oxman said. &#8220;In respect for our clients who needed to get their businesses up and running that was going to be obviously the quicker path.&#8221;</span></p>
<p>Unfortunately for Apex, paying up didn&#8217;t completely solve its problems. For one thing, Oxman said, the decryption key they were given after paying the ransom didn&#8217;t work exactly as promised. Instead of restoring all files and folders to their pre-encrypted state, the decryption process broke countless file directories and rendered many executable files inoperable &#8212; causing even more delays.</p>
<p>&#8220;When they encrypt the data, that happens really fast,&#8221; he said. &#8220;When they gave us the keys to decrypt it, things didn&#8217;t go quite as cleanly.&#8221;<span id="more-46708"></span></p>
<p>One of Apex&#8217;s older business units &#8212; <a href="https://acaondemand.com/" target="_blank" rel="noopener">ACA OnDemand</a> &#8212; is still offline, but the company is now offering to move customers on that platform over to newer (and more expensive) software-as-a-service systems, and to train those customers on how to use them.</p>
<p>Experts say attacks like the one against Apex HCM are playing out across the world every day, and have turned into a billion-dollar business for cyber thieves. The biggest group of victims are professional services firms, according to a study by <strong>NTT Security</strong>.</p>
<p>Ransomware victims perhaps in the toughest spot include those offering cloud data hosting and software-as-service, as these businesses are completely unable to serve their customers while a ransomware infestation is active.</p>
<p>The FBI and multiple <a href="https://us.norton.com/internetsecurity-malware-7-tips-to-prevent-ransomware.html" target="_blank" rel="noopener">security firms</a> have advised victims not to pay any ransom demands, as doing so just encourages the attackers and in any case may not result in actually regaining access to encrypted files.</p>
<p>In practice, however, many cybersecurity consulting firms are quietly urging their customers that paying up is the fastest route back to business-as-usual. It&#8217;s not hard to see why: Having customer data ransomed or stolen can spell the end of cloud-based business, but just being down for more than a few days can often be just as devastating. As a result, the temptation to simply pay up may become stronger with each passing day &#8212; even if the only thing being ransomed is a bunch of desktops and servers.</p>
<p>On Christmas Eve 2018, cloud data hosting firm <strong>Dataresolution.net</strong> was hit with the Ryuk strain of ransomware. More than a week later on Jan. 2, 2019, this blog <a href="https://krebsonsecurity.com/2019/01/cloud-hosting-provider-dataresolution-net-battling-christmas-eve-ransomware-attack/" target="_blank" rel="noopener">reported</a> that the company &#8212; which had chosen not to pay the ransom and instead restore everything from backups &#8212; was still struggling to bring its systems back online.</p>
<p>One dataresolution.net client said the company didn&#8217;t succeed in rebuilding its server or turning over his company&#8217;s database stored there until Jan. 9 &#8212; 16 days after the ransomware outbreak.</p>
<p>&#8220;From my understanding it was another two weeks until all of the clients were rebuilt,&#8221; said the customer, who works as an IT manager at a benefits management firm that used dataresolution.net and its now transitioning away from the company. &#8220;The vendor never provided any analysis on how it occurred and how they would prevent it from occurring again.  Other than different antivirus and not allowing <a href="https://krebsonsecurity.com/2013/12/hacked-via-rdp-really-dumb-passwords/" target="_blank" rel="noopener">RDP connections</a> to the internet they don’t seem to have put any additional safeguards in place. They did not proactively offer any compensation for the outage. I am in the process of documenting the business financial impact to request a &#8216;credit&#8217; at the same time as planning on bringing the system in house.&#8221;</p>
<p>For its part, Apex is still trying to determine how the ransomware got into its systems.</p>
<p>&#8220;That&#8217;s where this forensic analysis is still going on,&#8221; Oxman said. &#8220;For us, the emergency response team literally worked 48 hours straight getting our systems back up, and secondary to that is now trying to figure out what the hell happened and how do we prevent this from happening again. We had just completed a security audit and we were feeling pretty good. Obviously, these cyber hackers found a way in, but I&#8217;m sure that&#8217;s how every company feels that gets hit.&#8221;</p>
<p>Here are a few tips for preventing and dealing with ransomware attacks:</p>
<p><strong>-Patch, early and often:</strong> Many ransomware attacks leverage known security flaws in servers and desktops.</p>
<p><strong>-Disable RDP:</strong> Short for Remote Desktop Protocol, this feature of Windows allows a system to be remotely administered over the Internet. A ridiculous number of businesses &#8212; particularly healthcare providers &#8212; get hit with ransomware because they leave RDP open to the Internet and secured with easy-to-guess passwords. And there are a number of criminal services that <a href="https://krebsonsecurity.com/2013/12/hacked-via-rdp-really-dumb-passwords/" target="_blank" rel="noopener">sell access to brute-forced RDP installations</a>.</p>
<p><strong>-Filter all email:</strong> Invest in security systems that can block executable files at the email gateway.</p>
<p><strong>-Isolate mission-critical systems and data:</strong> This can be harder than it sounds. It may be worth hiring a competent security firm to make sure this is done right.</p>
<p><strong>-Backup key files and databases:</strong> Bear in mind that ransomware can encrypt any network or cloud-based files or folders that are mapped and have been assigned a drive letter. Backing up to a secondary system that is not assigned a drive letter or is disconnected when it&#8217;s not backing up data is key. The old &#8220;3-2-1&#8221; backup rule comes into play here: Wherever possible, keep three backups of your data, on two different storage types, with at least one backup offsite.</p>
<p><strong>-Disable macros in Microsoft Office:</strong> Block external content in Office files. Educate users that ransomware very often succeeds only when a user opens Office file attachment sent via email and manually enables Macros.</p>
<p><strong>-Enable controlled folder access:</strong> <a href="https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-exploit-guard/enable-controlled-folders-exploit-guard" target="_blank" rel="noopener">Create rules</a> to disallow the running of executable files in Windows from local user profile folders (App Data, Local App Data, ProgramData, Temp, etc.)</p>
<p>Sites like <a href="https://www.nomoreransom.org/en/decryption-tools.html" target="_blank" rel="noopener">nomoreransom.org</a> distribute free tools and tutorials that can help some ransomware victims recover files without paying a ransom demand, but those tools often only work with specific versions of a particular ransomware strain.</p>


feed_id: https://krebsonsecurity.com/?p=46717
title: Former Russian Cybersecurity Chief Sentenced to 22 Years in Prison
uri: Former-Russian-Cybersecurity-Chief-Sentenced-to-22-Years-in-Prison
url:
https://krebsonsecurity.com/2019/02/former-russian-cybersecurity-chief-sentenced-to-22-years-in-prison/

content:
<p>A Russian court has handed down lengthy prison terms for two men convicted on treason charges for allegedly sharing information about Russian cybercriminals with U.S. law enforcement officials. The men &#8212; a former Russian cyber intelligence official and an executive at Russian security firm <strong>Kaspersky Lab</strong> &#8212; were reportedly prosecuted for their part in an investigation into <a href="https://krebsonsecurity.com/?s=pavel+vrublevsky&amp;x=0&amp;y=0" target="_blank" rel="noopener">Pavel Vrublevsky</a>, a convicted cybercriminal who ran one of the world&#8217;s biggest spam networks and was a major focus of my 2014 book, <a href="https://www.amazon.com/Spam-Nation-Organized-Cybercrime-Epidemic-ebook/dp/B00L5QGBL0/ref=dp_kinw_strp_1" target="_blank" rel="noopener"><em>Spam Nation</em></a>.</p>
<p><strong>Sergei Mikhailov</strong>, formerly deputy chief of Russia&#8217;s top anti-cybercrime unit, was sentenced today to 22 years in prison. The court also levied a 14-year sentence against <strong>Ruslan Stoyanov</strong>, a senior employee at Kaspersky Lab. Both men maintained their innocence throughout the trial.</p>
<p>Following their dramatic arrests in 2016, many news media outlets reported that the men were suspected of having tipped off American intelligence officials about those responsible for Russian hacking activities tied to the 2016 U.S. presidential election.</p>
<p>That&#8217;s because two others arrested for treason at the same time &#8212; Mikhailov subordinates <a href="https://www.nytimes.com/2017/03/16/world/europe/russian-hacker-fsb-agent-dmitry-dokuchaev.html" target="_blank" rel="noopener">Georgi Fomchenkov and Dmitry Dokuchaev</a> &#8212; were reported by Russian media to have helped the FBI investigate Russian servers linked to the 2016 hacking of the Democratic National Committee. The case against Fomchenkov and Dokuchaev has not yet gone to trial.</p>
<p>What exactly was revealed during the trial of Mikhailov and Stoyanov is not clear, as the details surrounding it were classified. But according to information <a href="https://krebsonsecurity.com/2017/01/a-shakeup-in-russias-top-cybercrime-unit/" target="_blank" rel="noopener">first reported by KrebsOnSecurity in January 2017</a>, the most likely explanation for their prosecution stemmed from a long-running grudge held by <strong>Pavel Vrublevsky</strong>, a Russian businessman who ran a payment firm called <a href="https://krebsonsecurity.com/?s=ChronoPay&amp;x=0&amp;y=0" target="_blank" rel="noopener">ChronoPay</a> and for years paid most of the world’s top spammers and virus writers to pump malware and hundreds of billions of junk emails into U.S. inboxes.<span id="more-46717"></span></p>
<p>In 2013, Vrublevsky was <a href="https://krebsonsecurity.com/2013/08/pavel-vrublevsky-sentenced-to-2-5-years/" target="_blank" rel="noopener">convicted</a> of hiring his most-trusted spammer and malware writer to launch a crippling distributed denial-of-service (DDoS) attack against one of his company&#8217;s chief competitors.</p>
<p>Prior to Vrublevsky&#8217;s conviction, massive amounts of files and emails were taken from Vrublevsky&#8217;s company and shared with this author. Those included spreadsheets chock full of bank account details tied to some of the world’s most active cybercriminals, and to a vast network of shell corporations created by Vrublevsky and his co-workers to help launder the proceeds from their various online pharmacy, spam and <a href="https://krebsonsecurity.com/?s=chronopay+fake+antivirus&amp;x=0&amp;y=0" target="_blank" rel="noopener">fake antivirus operations</a>.</p>
<p>In a telephone interview with this author in 2011, Vrublevsky said he was convinced that Mikhailov was taking information gathered by Russian government cybercrime investigators and feeding it to U.S. law enforcement and intelligence agencies. Vrublevsky told me then that if ever he could prove for certain Mikhailov was involved in leaking incriminating data on ChronoPay, he would have someone “tear him a new asshole.”</p>
<p>An email that Vrublevsky wrote to a ChronoPay employee in 2010 eerily presages the arrests of Mikhailov and Stoyanov, voicing Vrublevsky’s suspicion that the two were closely involved in leaking ChronoPay emails and documents that were seized by Mikhailov’s own division. A copy of that email is shown in Russian in the screen shot below. A translated version of the message text is available <a href="media/7ec8de8b.CPemailtranslated.pdf" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2017/01/CPemailtranslated.pdf" target="_blank" rel="noopener">here</a> (PDF).</p>
<div id="attachment_37811" style="width: 604px" class="wp-caption aligncenter"><a class="lightbox" href="media/9b43dd1a.Psha-mikh.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2017/01/Psha-mikh.png"><img class="wp-image-37811" src="media/9b43dd1a.Psha-mikh.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2017/01/Psha-mikh.png" alt="" width="594" height="219" srcset="https://krebsonsecurity.com/wp-content/uploads/2017/01/Psha-mikh.png 1276w, https://krebsonsecurity.com/wp-content/uploads/2017/01/Psha-mikh-580x214.png 580w, https://krebsonsecurity.com/wp-content/uploads/2017/01/Psha-mikh-768x283.png 768w, https://krebsonsecurity.com/wp-content/uploads/2017/01/Psha-mikh-940x346.png 940w" sizes="(max-width: 594px) 100vw, 594px" /></a><p class="wp-caption-text">A copy of an email Vrublevsky sent to a ChronoPay co-worker about his suspicions that Mikhailov and Stoyanov were leaking government secrets.</p></div>
<p>Predictably, Vrublevsky has taken to gloating on Facebook about today&#8217;s prison&#8217;s sentences, calling them &#8220;good news.&#8221; He told the <a href="https://www.nbcnews.com/news/world/russian-ex-cyber-security-chief-gets-22-year-sentence-treason-n976191" target="_blank" rel="noopener">Associated Press</a> that Mikhailov had abused his position at the FSB to go after Internet entrepreneurs like him and &#8220;turn them into cybercriminals,&#8221; thus &#8220;whipping up cyber hysteria around the world.&#8221;</p>
<p>This is a rather rich quote, as Vrublevsky was already a well-known and established cybercriminal long before Mikhailov came into his life. Also, I would not put it past Vrublevsky to have somehow greased the wheels of this prosecution.</p>
<p>As I noted in <em>Spam Nation</em>, emails leaked from ChronoPay suggest that Vrublevsky funneled as much as $1 million to corrupt Russian political leaders for the purpose of initiating a criminal investigation into <a href="https://krebsonsecurity.com/?s=igor+gusev&amp;x=0&amp;y=0" target="_blank" rel="noopener">Igor Gusev</a>, a former co-founder of ChronoPay who went on to create a pharmacy spam operation that closely rivaled Vrublevsky&#8217;s own pharmacy spam operation &#8212; <a href="https://krebsonsecurity.com/?s=rx+promotion&amp;x=0&amp;y=0" target="_blank" rel="noopener">Rx Promotion</a>.</p>
<div id="attachment_46726" style="width: 535px" class="wp-caption aligncenter"><img class="size-full wp-image-46726" src="media/ff71286e.pasha-fb.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/02/pasha-fb.jpg" alt="" width="525" height="446" /><p class="wp-caption-text">Vrublevsky crowing on Facebook about the sentencing of Mikhailov (left) and Stoyanov.</p></div>


feed_id: https://krebsonsecurity.com/?p=46733
title: Crypto Mining Service Coinhive to Call it Quits
uri: Crypto-Mining-Service-Coinhive-to-Call-it-Quits
url: https://krebsonsecurity.com/2019/02/crytpo-mining-service-coinhive-to-call-it-quits/
content:
<p>Roughly one year ago, KrebsOnSecurity published <a href="https://krebsonsecurity.com/2018/03/who-and-what-is-coinhive/" target="_blank" rel="noopener">a lengthy investigation</a> into the individuals behind <strong>Coinhive[.]com</strong>, a cryptocurrency mining service that has been heavily abused to force hacked Web sites to mine virtual currency. On Tuesday, Coinhive announced plans to pull the plug on the project early next month.</p>
<div id="attachment_46735" style="width: 608px" class="wp-caption aligncenter"><img class=" wp-image-46735" src="media/2a6b89a6.coinhive-rip.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/02/coinhive-rip.jpg" alt="" width="598" height="366" /><p class="wp-caption-text">A message posted to the Coinhive blog on Tuesday, Feb. 26, 2019.</p></div>
<p>In March 2018, Coinhive was listed by many security firms as the top malicious threat to Internet users, thanks to the tendency for Coinhive’s computer code to be surreptitiously deployed on hacked Web sites to steal the computer processing power of its visitors’ devices.</p>
<p>Coinhive took a whopping 30 percent of the cut of all <a href="https://en.wikipedia.org/wiki/Monero_(cryptocurrency)" target="_blank" rel="noopener">Monero currency</a> mined by its code, and this presented something of a conflict of interest when it came to stopping the rampant abuse of its platform. At the time, Coinhive was only responding to abuse reports when contacted by a hacked site&#8217;s owner. Moreover, when it would respond, it did so by invalidating the cryptographic key tied to the abuse.</p>
<p>Trouble was, killing the key did nothing to stop Coinhive&#8217;s code from continuing to mine Monero on a hacked site. Once a key was invalidated, Coinhive would simply cut out the middleman and <em>proceed to keep 100 percent of the cryptocurrency mined by sites tied to that account from then on</em>.</p>
<p>In response to that investigation, Coinhive made structural changes to its platform to ensure it was no longer profiting from this shady practice.</p>
<p><strong>Troy Mursch</strong> is chief research officer at <a href="https://badpackets.net/" target="_blank" rel="noopener">Bad Packets LLC</a>, a company that has closely chronicled a number of high-profile Web sites that were hacked and seeded with Coinhive mining code over the years. Mursch said that after those changes by Coinhive, the mining service became far less attractive to cybercriminals.</p>
<p>&#8220;After that, it was not exactly enticing for miscreants to use their platform,&#8221; Mursch said. &#8220;Most of those guys just took their business elsewhere to other mining pools that don&#8217;t charge anywhere near such high fees.&#8221;</p>
<p>As Coinhive noted in the statement about its closure, a severe and widespread drop in the value of most major crytpocurrencies weighed heavily on its decision. At the time of my March 2018 piece on Coinhive, Monero was trading at an all-time high of USD $342 per coin, according to charts maintained by <a href="https://coinmarketcap.com/currencies/monero/#charts" target="_blank" rel="noopener">coinmarketcap.com</a>. Today, a single Monero is worth less than $50.<span id="more-46733"></span></p>
<p>In the announcement about its pending closure, Coinhive said the mining service would cease to operate on March 8, 2019, but that users would still be able to access their earnings dashboards until the end of April. However, Coinhive noted that only those users who had earned above the company&#8217;s minimum payout threshold would be able to cash out their earnings.</p>
<p>Mursch said it is likely that a great many people using Coinhive &#8212; legitimately on their own sites or otherwise &#8212; are going to lose some money as a result. That&#8217;s because Coinhive&#8217;s minimum payout is .05 Monero, which equals roughly USD $2.35.</p>
<p>&#8220;That means Coinhive is going to keep all the virtually currency from user accounts that have mined something below that threshold,&#8221; he said. &#8220;Maybe that&#8217;s just a few dollars or a few pennies here or there, but that&#8217;s kind of been their business model all along. They have made a lot of money through their platform.&#8221;</p>
<p>KrebsOnSecurity&#8217;s <a href="https://krebsonsecurity.com/2018/03/who-and-what-is-coinhive/" target="_blank" rel="noopener">March 2018 Coinhive story</a> traced the origins of the mining service back to <strong>Dominic Szablewski</strong>, a programmer who founded the German-language image board <strong>pr0gramm[.]com</strong> (not safe for work). The story noted that Coinhive began as a money-making experiment that was first debuted on the pr0gramm Web site.</p>
<p>The Coinhive story prompted an unusual fundraising campaign from the pr0gramm[.]com user community, which expressed alarm over the publication of details related to the service&#8217;s founders (even though all of the details included in that piece were drawn from publicly-searchable records). In an expression of solidarity to protest that publication, the pr0gramm board members collectively <a href="https://krebsonsecurity.com/2018/03/coinhive-expose-prompts-cancer-research-fundraiser/" target="_blank" rel="noopener">donated hundreds of thousands of euros</a> to various charities that support curing cancer (Krebs is translated in German to &#8220;cancer&#8221; or &#8220;crab.&#8221;)</p>
<p>After that piece ran, Coinhive added to its Web site the contact information for <strong>Badges2Go UG</strong>, a limited liability company established in 2017 and headed by a <a href="https://www.linkedin.com/in/sylviaklein/" target="_blank" rel="noopener">Slyvia Klein</a> from Frankfurt who is also head of an entity called <strong>Blockchain Future</strong>. Klein did not respond to requests for comment.</p>


feed_id: https://krebsonsecurity.com/?p=46761
title: Booter Boss Interviewed in 2014 Pleads Guilty
uri: Booter-Boss-Interviewed-in-2014-Pleads-Guilty
url: https://krebsonsecurity.com/2019/02/booter-boss-interviewed-in-2014-pleads-guilty/
content:
<p>A 20-year-old Illinois man has pleaded guilty to running multiple DDoS-for-hire services that launched millions of attacks over several years. The plea deal comes almost exactly five years after KrebsOnSecurity <a href="https://krebsonsecurity.com/2014/02/the-new-normal-200-400-gbps-ddos-attacks/" target="_blank" rel="noopener">interviewed both the admitted felon and his father</a> and urged the latter to take a more active interest in his son&#8217;s online activities.</p>
<p><strong>Sergiy P. Usatyuk </strong>of Orland Park, Ill. pleaded guilty this week to one count of conspiracy to cause damage to Internet-connected computers and for his role in owning, administering and supporting illegal &#8220;booter&#8221; or &#8220;stresser&#8221; services designed to knock Web sites offline, including <strong>exostress[.]in</strong>, <strong>quezstresser[.]com</strong>, <strong>betabooter[.]com</strong>, <strong>databooter[.]com</strong>, <strong>instabooter[.]com</strong>, <strong>polystress[.]com</strong> and <strong>zstress[.]net</strong>.</p>
<div id="attachment_24871" style="width: 608px" class="wp-caption aligncenter"><a class="lightbox" href="media/f96b0a72.rasbora1.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2014/02/rasbora1.png"><img class="wp-image-24871" src="media/f96b0a72.rasbora1.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2014/02/rasbora1.png" alt="" width="598" height="310" srcset="https://krebsonsecurity.com/wp-content/uploads/2014/02/rasbora1.png 1215w, https://krebsonsecurity.com/wp-content/uploads/2014/02/rasbora1-285x148.png 285w, https://krebsonsecurity.com/wp-content/uploads/2014/02/rasbora1-600x311.png 600w" sizes="(max-width: 598px) 100vw, 598px" /></a><p class="wp-caption-text">Some of Rasbora&#8217;s posts on hackforums[.]net prior to our phone call in 2014. Most of these have since been deleted.</p></div>
<p>A U.S. Justice Department <a href="https://www.justice.gov/opa/pr/former-operator-illegal-booter-services-pleads-guilty-conspiracy-commit-computer-damage-and" target="_blank" rel="noopener">press release on the guilty plea</a> says Usatyuk &#8212; operating under the hacker aliases &#8220;<strong>Andrew Quez</strong>&#8221; and &#8220;<strong>Brian Martinez</strong>&#8221; &#8212; admitted developing, controlling and operating the aforementioned booter services from around August 2015 through November 2017. But Usatyuk&#8217;s involvement in the DDoS-for-hire space very much predates that period.</p>
<p>In February 2014, KrebsOnSecurity reached out to Usatyuk&#8217;s father <strong>Peter Usatyuk</strong>, an assistant professor at the University of Illinois at Chicago. I did so because a brief amount of sleuthing on Hackforums[.]net revealed that his then 15-year-old son Sergiy &#8212; who at the time went by the nicknames &#8220;<strong>Rasbora</strong>&#8221; and &#8220;<strong>Mr. Booter Master</strong>&#8221;  &#8212; was heavily involved in helping to launch crippling DDoS attacks.</p>
<p>I phoned Usatyuk the elder because Sergiy&#8217;s alter egos had been posting evidence on Hackforums and elsewhere that he&#8217;d just hit KrebsOnSecurity.com with <a href="https://krebsonsecurity.com/2014/02/the-new-normal-200-400-gbps-ddos-attacks/" target="_blank" rel="noopener">a 200 Gbps DDoS attack</a>, which was then considered a fairly impressive DDoS assault.</p>
<p>&#8220;I am writing you after our phone conversation just to confirm that you may call evening time/weekend to talk to my son Sergio regarding to your reasons,&#8221; Peter Usatyuk wrote in an email to this author on Feb. 13, 2014. &#8220;I also have [a] major concern what my 15 yo son [is] doing. If you think that is any kind of illegal work, please, let me know.&#8221;<span id="more-46761"></span></p>
<p>That 2014 story declined to quote Rasbora by name because he was a minor, but his father seemed alarmed enough about my inquiry that he insisted his son speak with me about the matter.</p>
<p>Here&#8217;s what I wrote about Sergiy at the time:</p>
<blockquote><p>Rasbora’s most recent project just happens to be gathering, maintaining huge “top quality” lists of servers that can be used to launch amplification attacks online. Despite his insistence that he’s never launched DDoS attacks, Rasbora did eventually allow that someone reading his posts on Hackforums might conclude that he was actively involved in DDoS attacks for hire.</p>
<p>“I don’t see what a wall of text can really tell you about what someone does in real life though,” said Rasbora, whose real-life identity is being withheld because he’s a minor. This reply came in response to my reading him several posts that he’d made on Hackforums not 24 hours earlier that strongly suggested he was still in the business of knocking Web sites offline: In a Feb. 12 post on a thread called “Hiring a hit on a Web site” that Rasbora has since deleted, he tells a fellow Hackforums user, “If all else fails and you just want it offline, PM me.”</p>
<p>Rasbora has tried to clean up some of his more self-incriminating posts on Hackforums, but he remains defiantly steadfast in his claim that he doesn’t DDoS people. Who knows, maybe his dad will ground him and take away his Internet privileges.</p></blockquote>
<p>I&#8217;m guessing young Sergiy never had his Internet privileges revoked, nor did he heed advice to use his skills for less destructive activities. His dad hung up on me when I called Wednesday evening requesting comment.</p>
<p><a href="media/97278625.Usatyuk-Information.pdf" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/02/Usatyuk-Information.pdf" target="_blank" rel="noopener">Court documents</a> (PDF) related to his case indicate Sergiy Usatyuk and an unnamed co-conspirator earned nearly $550,000 launching some 3.8 million attacks through their various DDoS-for-hire services. The government says he ran the booter services through a Delaware corporation called &#8220;<strong>OkServers LLC</strong>,&#8221; which routinely ignored abuse complaints and as such effectively operated as a &#8220;bulletproof&#8221; hosting company &#8212; despite Sergiy&#8217;s claims to the contrary.</p>
<p>Here&#8217;s Sergiy&#8217;s response to multiple abuse complaints about OKServers filed in the summer of 2018 by <strong>Troy Mursch</strong>, chief research officer at <a href="https://badpackets.net/" target="_blank" rel="noopener">Bad Packets LLC</a>.</p>
<p><a class="lightbox" href="media/0b0b395d.okservers-abuse.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/02/okservers-abuse.jpg"><img class="aligncenter wp-image-46772 size-full" src="media/0b0b395d.okservers-abuse.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/02/okservers-abuse.jpg" alt="" width="426" height="604" /></a></p>
<p>Sergiy&#8217;s guilty plea comes amid a major crackdown by the FBI and the Justice Department on booter services and their operators. In December 2018, the DOJ <a href="https://krebsonsecurity.com/2018/12/feds-charge-three-in-mass-seizure-of-attack-for-hire-services/" target="_blank" rel="noopener">brought charges against three men</a> as part of an unprecedented, international takedown targeting 15 different booter sites.</p>
<p>According to the government, the use of booter and stresser services to conduct attacks is punishable under both wire fraud laws and the Computer Fraud and Abuse Act (18 U.S.C. § 1030), and may result in arrest and prosecution, seizure of computers or other electronics, significant prison sentences, and a penalty or fine.</p>


feed_id: https://krebsonsecurity.com/?p=46787
title: Hackers Sell Access to Bait-and-Switch Empire
uri: Hackers-Sell-Access-to-Bait-and-Switch-Empire
url: https://krebsonsecurity.com/2019/03/hackers-sell-access-to-bait-and-switch-empire/
content:
<p>Cybercriminals are auctioning off access to customer information stolen from an online data broker behind a dizzying array of bait-and-switch Web sites that sell access to a vast range of data on U.S. consumers, including DMV and arrest records, genealogy reports, phone number lookups and people searches. In an ironic twist, the marketing empire that owns the hacked online properties appears to be run by a Canadian man who&#8217;s been sued for fraud by the <strong>U.S. Federal Trade Commission</strong>, <strong>Microsoft</strong> and <strong>Oprah Winfrey</strong>, to name a few.</p>
<p>Earlier this week, a cybercriminal on a Dark Web forum posted an auction notice for access to a Web-based administrative panel for an unidentified &#8220;US Search center&#8221; that he claimed holds some four million customer records, including names, email addresses, passwords and phone numbers. The starting bid price for that auction was $800.</p>
<p>Several screen shots shared by the seller suggested the customers in question had all purchased subscriptions to a variety of sites that aggregate and sell public records, such as <strong>dmv.us.org</strong>, <strong>carhistory.us.org</strong>, <strong>police.us.org</strong>, and <strong>criminalrecords.us.org</strong>.</p>
<div id="attachment_46794" style="width: 605px" class="wp-caption aligncenter"><img class=" wp-image-46794" src="media/876ac536.mra-panel.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/03/mra-panel.jpg" alt="" width="595" height="599" /><p class="wp-caption-text">A (redacted) screen shot shared by the apparent hacker who was selling access to usernames and passwords for customers of multiple data-search Web sites.</p></div>
<p>A few hours of online sleuthing showed that these sites and dozens of others with similar names all at one time shared several toll-free phone numbers for customer support. The results returned by searching on those numbers suggests a singular reason this network of data-search Web sites changed their support numbers so frequently: They quickly became associated with online reports of fraud by angry customers.</p>
<p>That&#8217;s because countless people who were enticed to pay for reports generated by these services later complained that although the sites advertised access for just $1, they were soon hit with a series of much larger charges on their credit cards.</p>
<p>Using historic Web site registration records obtained from <strong>Domaintools.com</strong> (a former advertiser on this site), KrebsOnSecurity discovered that all of the sites linked back to two related companies &#8212; Las Vegas, Nev.-based <a href="http://www.penguinmarketing.com/about/" target="_blank" rel="noopener">Penguin Marketing</a>, and <strong>Terra Marketing Group</strong> out of Alberta, Canada.</p>
<p>Both of these entities are owned by <a href="https://www.linkedin.com/in/jessewillms" target="_blank" rel="noopener">Jesse Willms</a>, a man <em>The Atlantic</em> magazine described in <a href="https://www.theatlantic.com/magazine/archive/2014/01/the-dark-lord-of-the-internet/355726/" target="_blank" rel="noopener">an unflattering January 2014 profile</a> as &#8220;The Dark Lord of the Internet&#8221; [not to be confused with <a href="https://en.wikipedia.org/wiki/The_Dark_Overlord_(hackers)" rel="noopener" target="_blank">The Dark Overlord</a>].</p>
<div id="attachment_46795" style="width: 605px" class="wp-caption aligncenter"><img class=" wp-image-46795" src="media/89cddc08.jessewillms.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/03/jessewillms.jpg" alt="" width="595" height="373" /><p class="wp-caption-text">Jesse Willms&#8217; Linkedin profile.</p></div>
<p>The Atlantic pointed to a sprawling lawsuit filed by the Federal Trade Commission, which <a href="https://www.ftc.gov/enforcement/cases-proceedings/102-3012/willms-jesse-et-al" target="_blank" rel="noopener">alleged</a> that between 2007 and 2011, Willms defrauded consumers of some $467 million by enticing them to sign up for &#8220;risk free&#8221; product trials and then billing their cards recurring fees for a litany of automatically enrolled services they hadn’t noticed in the fine print.</p>
<p>&#8220;In just a few months, Willms’ companies could charge a consumer hundreds of dollars like this, and making the flurry of debits stop was such a convoluted process for those ensnared by one of his schemes that some customers just canceled their credit cards and opened new ones,&#8221; wrote The Atlantic&#8217;s <strong>Taylor Clark</strong>.</p>
<p>Willms&#8217; various previous ventures reportedly extended far beyond selling access to public records. In fact, it&#8217;s likely everyone reading this story has at one time encountered an ad for one of his dodgy, bait-and-switch business schemes, The Atlantic noted:</p>
<blockquote><p>&#8220;If you’ve used the Internet at all in the past six years, your cursor has probably lingered over ads for Willms’s Web sites more times than you’d suspect. His pitches generally fit in nicely with what have become the classics of the dubious-ad genre: tropes like photos of comely newscasters alongside fake headlines such as “Shocking Diet Secrets Exposed!”; too-good-to-be-true stories of a “local mom” who “earns $629/day working from home”; clusters of text links for miracle teeth whiteners and “loopholes” entitling you to government grants; and most notorious of all, eye-grabbing animations of disappearing “belly fat” coupled with a tagline promising the same results if you follow “1 weird old trick.” (A clue: the “trick” involves typing in 16 digits and an expiration date.)&#8221;</p></blockquote>
<p>In a separate lawsuit, Microsoft accused Willms&#8217; businesses of trafficking in massive quantities of counterfeit copies of its software. Oprah Winfrey also sued a Willms-affiliated site (oprahsdietscecrets.com) for linking her to products and services she claimed she had never endorsed.</p>
<p>KrebsOnSecurity reached out to multiple customers whose name, email address and cleartext passwords were exposed in the screenshot shared by the Dark Web auctioneer who apparently hacked Willms&#8217; Web sites. All three of those who responded shared roughly the same experience: They said they&#8217;d ordered reports for specific criminal background checks from the sites on the promise of a $1 risk-free fee, never found what they were looking for, and were subsequently hit by the same merchant for credit card charges ranging from $20 to $38.<span id="more-46787"></span></p>
<p>I also pinged several customer support email addresses tied to the data-broker Web sites that were hacked. I received a response from a &#8220;<strong>Mike Stef</strong>,&#8221; who described himself as a Web developer for Terra Marketing Group. </p>
<p>Stef said the screenshots appeared to be legitimate, and that the company would investigate the matter and alert affected customers if warranted. Stef told me he doubts the company has four million customers, and that the true number was probably closer to a half million. He also insisted that the panel in question did not have access to customer credit card data.</p>
<p>Nevertheless, it appears from the evidence above that Willms and several others who were named in the <a href="media/e78ab65d.120306jessewillmsorder.pdf" data-original-source="https://www.ftc.gov/sites/default/files/documents/cases/2012/03/120306jessewillmsorder.pdf" target="_blank" rel="noopener">FTC&#8217;s 2012 stipulated final judgment</a> (PDF) are still up to their old tricks. The FTC has not yet responded to requests for comment. Nor has Mr. Willms.</p>
<p>I can&#8217;t help express feeling a certain amount of <a href="https://en.wikipedia.org/wiki/Schadenfreude" rel="noopener" target="_blank">schadenfreude</a> (schadenfraud?) at the victim in this hacking case. But that amusement is tempered by the reality that the hundreds of thousands or possibly millions of people who got suckered into paying money to this company are quite likely to find themselves on the receiving end of additional phishing and fraud attacks (particularly <a href="https://www.owasp.org/index.php/Credential_stuffing" target="_blank" rel="noopener">credential stuffing</a>) as a result of their data being auctioned off to the highest bidder.</p>
<p>Terra Marketing Group&#8217;s Web developer Mike Stef responded to my inquiries from an email address at the domain &#8220;<strong>tmgbox.com</strong>.&#8221; That message was instrumental in identifying the connection to Willms and Terra Marketing/Penguin. In the interests of better informing people who might wish to become future customers of this group, I am publishing the list of the domains associated with tmgbox.com and its parent entities. This list may be updated periodically as new information surfaces. </p>
<p>In case it is useful for others, KrebsOnSecurity is also publishing the results of several reverse WHOIS lookups for historic domains tied to email addresses of several people Mike Stef described as &#8220;senior customer support managers&#8221; of Terra Marketing, as these also include some interesting and related (albeit mostly dead) domains. </p>
<p><a href="https://docs.google.com/document/d/10UGp2E8fx5866htykVq7KXvlHpzbfuIbfgN6Ym43_Qo/edit?usp=sharing" rel="noopener" target="_blank">Reverse WHOIS on Peter Graver and Jesse Willms (rickholl2k9@gmail.com)</a></p>
<p><a href="https://docs.google.com/document/d/1w0Sw5K2htfR-lX7kb2CjWOOlICsWwjah49ZW11cPOOA/edit?usp=sharing" rel="noopener" target="_blank">Reverse WHOIS on mike@tmgbox.com</a></p>
<p><a href="https://docs.google.com/document/d/1nJgm3-3JabzcOcvOT9SF6kX3IdH_TlfnwEZzARe0Wjk/edit?usp=sharing" rel="noopener" target="_blank">Reverse WHOIS on Jason Oster (joster2008@gmail.com)</a></p>
<p>Public records search domains associated with Terra Marketing Group and Penguin Marketing:</p>
<p>memberreportaccess.com<br />
publicrecords.us.org<br />
dmvrecords.co<br />
dmv.us.org<br />
courtrecords.us.org<br />
myfeeplan.com<br />
police.us.org<br />
warrantcheck.com<br />
myinfobill.com<br />
propertysearch.us.org<br />
homevalue.us.org<br />
carinfo2.com<br />
backgroundchecks.us.org<br />
arrestrecords.us.org<br />
propertyrecord.com<br />
criminalrecords.us.org<br />
jailinmates.us.org<br />
vehiclereportusa.com<br />
dmvinfocheck.com<br />
carrecordusa.com<br />
carhistoryindex.com<br />
autohistorychecks.com<br />
mugshots.us.org<br />
trafficticket.us.org<br />
prison.us.org<br />
reversephonelookup.us.org<br />
deathrecords.us.org<br />
deathrecord.com<br />
deathcertificates.us.org<br />
census.us.org<br />
phonelookup.us.org<br />
vehiclehistoryreports.us.org<br />
vinsearchusa.org</p>
<p>KrebsOnSecurity would like to thank cybersecurity firm <a href="https://www.intel471.com" rel="noopener" target="_blank">Intel471</a> for their assistance in researching this post.</p>


feed_id: https://krebsonsecurity.com/?p=46823
title: MyEquifax.com Bypasses Credit Freeze PIN
uri: MyEquifax-com-Bypasses-Credit-Freeze-PIN
url: https://krebsonsecurity.com/2019/03/myequifax-com-bypasses-credit-freeze-pin/
content:
<p>Most people who have frozen their credit files with <strong>Equifax</strong> have been issued a numeric Personal Identification Number (PIN) which is supposed to be required before a freeze can be lifted or thawed. Unfortunately, if you don&#8217;t already have an account at the credit bureau&#8217;s new <a href="https://my.equifax.com" target="_blank" rel="noopener">myEquifax portal</a>, it may be simple for identity thieves to lift an existing credit freeze at Equifax and bypass the PIN armed with little more than your, name, Social Security number and birthday.</p>
<p>Consumers in every U.S. state can now freeze their credit files for free with Equifax and two other major bureaus (<strong>Trans Union</strong> and <strong>Experian</strong>). A freeze makes it much harder for identity thieves to open new lines of credit in your name.</p>
<p><img class="aligncenter wp-image-46831" src="media/30b82de4.myequifax.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/03/myequifax.png" alt="" width="594" height="341" /></p>
<p>In the wake of Equifax&#8217;s epic 2017 data breach impacting some 148 million Americans, many people did freeze their credit files at the big three in response. But Equifax has changed a few things since then.</p>
<p>Seeking to manage my own credit freeze at equifax.com as I&#8217;d done in years past, I was steered toward creating an account at myequifax.com, which I was shocked to find I did previously possess.</p>
<p>Getting an account at myequifax.com was easy. In fact, it was too easy. The portal asked me for an email address and suggested a longish, randomized password, which I accepted. I chose an old email address that I knew wasn&#8217;t directly tied to my real-life identity.</p>
<p>The next page asked me enter my SSN and date of birth, and to share a phone number (sharing was optional, so I didn&#8217;t). SSN and DOB data is widely available for sale in the cybercrime underground on almost all U.S. citizens. This has been the reality for years, and was so well before Equifax announced its big 2017 breach.</p>
<p>myEquifax said it couldn&#8217;t verify that my email address belonged to the Brian Krebs at that SSN and DOB. It then asked a series of four security questions &#8212; so-called &#8220;knowledge-based authentication&#8221; or KBA questions designed to see if I can about my recent financial history.</p>
<p>In general, the data being asked about in these KBA quizzes is culled from public records, meaning that this information likely is publicly available in some form &#8212; either digitally or in-person. Indeed, I have <a href="https://krebsonsecurity.com/2013/09/data-broker-giants-hacked-by-id-theft-service/" target="_blank" rel="noopener">long assailed the KBA industry</a> as creating a false sense of security that is easily bypassed by fraudsters.</p>
<p>One potential problem with relying on KBA questions to authenticate consumers online is that so much of the information needed to successfully guess the answers to those multiple-choice questions is now indexed or exposed by search engines, social networks and third-party services online — both criminal and commercial.</p>
<p>The first three multiple-guess questions myEquifax asked were about loans or debts that I have never owed. Thus, the answer to the first three KBA questions asked was, &#8220;none of the above.&#8221; The final question asked for the name of our last mortgage company. Again, information that is not hard to find.</p>
<p>Satisfied with my answers, Equifax informed me that yes indeed I was Brian Krebs and that I could now manage my existing freeze with the company. After requesting a thaw, I was brought to a vintage Equifax page that looked nothing like myEquifax&#8217;s sunnier new online plumage.</p>
<div id="attachment_46832" style="width: 606px" class="wp-caption aligncenter"><a class="lightbox" href="media/bdd754f6.equifax-PIN-needed.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/03/equifax-PIN-needed.png"><img class="wp-image-46832" src="media/bdd754f6.equifax-PIN-needed.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/03/equifax-PIN-needed.png" alt="" width="596" height="496" /></a><p class="wp-caption-text">Equifax&#8217;s site says it will require users requesting changes to an existing credit freeze to have access to their freeze PIN and be ready to supply it. But Equifax never actually asks for the PIN.</p></div>
<p>This page informed me that if I previously secured a freeze of my credit file with Equifax and been given a PIN needed to undo that status in any way, that I should be ready to provide said information <em>if I was requesting changes via phone or email. </em></p>
<p>In other words, <em>credit freezes and thaws requested via myExquifax don&#8217;t require users to supply any pre-existing PIN</em>.</p>
<p>Fine, I said. Let&#8217;s do this.</p>
<p>myEquifax then asked for the date range requested to thaw my credit freeze. Submit.</p>
<p>&#8220;We&#8217;ve successfully processed your security freeze request!,&#8221; the site declared.</p>
<p>This also was exclaimed in an email to the random old address I&#8217;d used at myEquifax, although the site never once made any attempt to validate that I had access to this inbox, something that could be done by simply sending a confirmation link that needs to be clicked to activate the account.</p>
<p>In addition, I noticed Equifax added my old mobile number to my account, even though I never supplied this information and was not using this phone when I created the myEquifax account.</p>
<div id="attachment_46833" style="width: 609px" class="wp-caption aligncenter"><a class="lightbox" href="media/5f17bfe3.MYequifax-success.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/03/MYequifax-success.png"><img class="wp-image-46833" src="media/5f17bfe3.MYequifax-success.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/03/MYequifax-success.png" alt="" width="599" height="324" /></a><p class="wp-caption-text">Successfully unfreezing (temporarily thawing) my credit freeze did not require me to ever supply my previously-issued freeze PIN from Equifax. Anyone who knew the vaguest and most knowable details about me could have done the same.</p></div>
<p>myEquifax.com does not currently seek to verify the account by requesting confirmation via a phone call or text to the phone number associated with the account (also, recall that even providing a phone number was optional).</p>
<p>Happily, I did discover then when I used a different computer and Internet address to try to open up another account under my name, date of birth and SSN, it informed me that a profile already existed for this information. This suggests that signing up at myEquifax is probably a good idea, given that the alternative is more risky.</p>
<p>It was way too easy to create my account, but I&#8217;m not saying everyone will be able to create one online. In testing with several readers over the past 24 hours, myEquifax seems to be returning a lot more error pages at the KBA stage of the process now, prompting people to try again later or make a request via email or phone.</p>
<p>Equifax spokesperson <strong>Nancy Bistritz-Balkan</strong> said not requiring a PIN for people with existing freezes was by design.</p>
<p>&#8220;With myEquifax, we created an online experience that enables consumers to securely and conveniently manage security freezes and fraud alerts,&#8221; Bistritz-Balkan said..</p>
<p>&#8220;We deployed an experience that embraces both security standards (using a multi-factor and layered approach to verify the consumer’s identity) and reflects specific consumer feedback on managing security freezes and fraud alerts online without the use of a PIN,&#8221; she continued. &#8220;The account set-up process, which involves the creation of a username and password, relies on both user inputs and other factors to securely establish, verify, and authenticate that the consumer’s identity is connected to the consumer every time.&#8221;<span id="more-46823"></span></p>
<p>I asked Bistritz-Balkan what else besides a username and a password the company may have meant by &#8220;multi-factor;&#8221; I&#8217;m still waiting for clarification. But I did not experience anything like multi-factor in setting up or logging into my myEquifax account.</p>
<p>This may by closer to Equifax&#8217;s idea of multi-factor: The company told me that if I still really wanted to use my freeze PIN, I could always call their 800 number (800-349-9960) or make the request via mail. Nevermind that if I&#8217;m a bad guy looking to hack others, I&#8217;m definitely going to be using the myEquifax Web site &#8212; <em>not</em> the options that make me have to supply a PIN.</p>
<p>Virtually the entire United States population in 2017 became eligible for free credit monitoring from Equifax following its 2017 breach. Credit monitoring can be useful for recovering from identity theft, but consumers should not expect these services to block new account fraud; the most they will likely do in this case is alert you after ID thieves have already opened new accounts in your name.</p>
<p>A credit freeze does not impact your ability to use any existing financial accounts you may have, including bank and credit/debit accounts. Nor will it protect you from fraud on those existing accounts. It is mainly a way to minimize the risk that someone may be able to create new accounts in your name.</p>
<p>If you haven&#8217;t done so lately, it might a good time to order a free copy of your credit report from <a href="https://www.annualcreditreport.com" target="_blank" rel="noopener">annualcreditreport.com</a>. This service entitles each consumer one free copy of their credit report annual from each of the three credit bureaus &#8212; either all at once or spread out over the year.</p>
<p>Additional reading:</p>
<p><a href="https://krebsonsecurity.com/2018/09/credit-freezes-are-free-let-the-ice-age-begin/" target="_blank" rel="noopener">Credit Freezes are Free: Let the Ice Age Begin</a></p>
<p><a href="https://krebsonsecurity.com/2018/06/plant-your-flag-mark-your-territory/" target="_blank" rel="noopener">Plant Your Flag, Mark Your Territory</a></p>
<p><a href="https://krebsonsecurity.com/2017/09/experian-site-can-give-anyone-your-credit-freeze-pin/" target="_blank" rel="noopener">Experian Site Can Give Anyone Your Freeze PIN</a></p>
<p><a href="https://krebsonsecurity.com/2018/03/survey-americans-spent-1-4b-on-credit-freeze-fees-in-wake-of-equifax-breach/" target="_blank" rel="noopener">Survey: Americans Spent $1.4B on Credit Freeze Fees in Wake of Equifax Breach</a></p>
<p><a href="https://krebsonsecurity.com/2017/10/equifax-breach-fallout-your-salary-history/" target="_blank" rel="noopener">Equifax Breach Fallout: Your Salary History</a></p>
<p><a href="https://krebsonsecurity.com/2013/09/data-broker-giants-hacked-by-id-theft-service/" target="_blank" rel="noopener">Data Broker Giants Hacked by ID Theft Service</a></p>
<p><a href="https://krebsonsecurity.com/2013/10/experian-sold-consumer-data-to-id-theft-service/" target="_blank" rel="noopener">Experian Sold Access to ID Theft Service</a></p>


feed_id: https://krebsonsecurity.com/?p=46789
title: Insert Skimmer + Camera Cover PIN Stealer
uri: Insert-Skimmer-Camera-Cover-PIN-Stealer
url: https://krebsonsecurity.com/2019/03/insert-skimmer-camera-cover-pin-stealer/
content:
<p>Very often the most clever component of your typical ATM skimming attack is the hidden pinhole camera used to record customers entering their PINs. These little video bandits can be hidden 100 different ways, but they&#8217;re frequently disguised as ATM security features &#8212; such as an extra PIN pad privacy cover, or <a href="https://krebsonsecurity.com/2011/12/pro-grade-3d-printer-made-atm-skimmer/" target="_blank" rel="noopener">an all-in-one skimmer over the green flashing card acceptance slot</a> at the ATM.</p>
<p>And sometimes, the scammers just hijack the security camera built into the ATM itself.</p>
<p>Below is the hidden back-end of a skimmer found last month placed over top of the customer-facing security camera at a drive-up bank ATM in Hurst, Texas. The camera components (shown below in green and red) were angled toward the cash&#8217;s machine&#8217;s PIN pad to record victims entering their PINs. Wish I had a picture of this thing attached to the ATM.</p>
<div id="attachment_46877" style="width: 600px" class="wp-caption aligncenter"><img class=" wp-image-46877" src="media/df585cd0.camskimmer.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/03/camskimmer.jpg" alt="" width="590" height="308" /><p class="wp-caption-text">This hidden camera was fixed to the underside of a fake lens cover for the skimmed ATM&#8217;s built-in security camera. Image: Hurst Police.</p></div>
<p>The clever PIN grabber was paired with an &#8220;insert skimmer,&#8221; a wafer-thin, usually metallic and battery powered skimmer made to be fitted straight into the mouth of the ATM&#8217;s card acceptance slot, so that the card skimmer cannot be seen from outside of the compromised ATM.</p>
<div id="attachment_46875" style="width: 377px" class="wp-caption aligncenter"><img class="size-full wp-image-46875" src="media/e0d047e3.insert-skim-inserted.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/03/insert-skim-inserted.jpg" alt="" width="367" height="526" /><p class="wp-caption-text">The insert skimmer, seen as inserted into the card acceptance device in the hacked ATM. Image: Hurst PD.</p></div>
<p><span id="more-46789"></span></p>
<p>For reference, here&#8217;s a similar card acceptance slot, minus the skimmer.</p>
<div id="attachment_46876" style="width: 335px" class="wp-caption aligncenter"><img class="size-full wp-image-46876" src="media/1e273cdd.unalteredcardslot.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/03/unalteredcardslot.jpg" alt="" width="325" height="590" /><p class="wp-caption-text">An unaltered ATM card acceptance slot (without insert skimmer).</p></div>
<p>Police in Hurst, Texas released a photo taken from footage showing what appears to be a young woman affixing the camera skimmer to the drive-up ATM. They said she was driving a blue Ford Expedition with silver trim on the lower portion of the vehicle.</p>
<p><img class="aligncenter size-full wp-image-46878" src="media/2d36ae75.skimmerdriver.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/03/skimmerdriver.jpg" alt="" width="439" height="369" /></p>
<p>The skimmer crooks seem to realize that far fewer people are going to cover their hand when entering a PIN at drive-up ATMs. Often the machine is either too high or too low for the driver-side window, and covering the PIN pad to guard against hidden cameras can be a difficult reach for a lot of people.</p>
<p>Nevertheless, covering the PIN pad with a hand, wallet or purse while you enter the PIN is one of the easiest ways to block skimming attacks. The skimmer scammers don&#8217;t just want your bank card: They want your PIN so they can create an exact copy of the card and use it at another ATM to empty your checking or savings account.</p>
<p>So <a href="https://krebsonsecurity.com/2012/09/a-handy-way-to-foil-atm-skimmer-scams/" target="_blank" rel="noopener">don&#8217;t be like the parade of people in these videos</a> from hidden cameras at hacked ATMs who never once covered the PIN pad.</p>
<p>Further reading: <a href="https://dfw.cbslocal.com/2019/02/12/woman-caught-video-installing-skimmer-banks-atm/" target="_blank" rel="noopener">Woman Caught on Video Installing Skimmer Outside Bank&#8217;s ATM in Hurst</a></p>


feed_id: https://krebsonsecurity.com/?p=46905
title: Patch Tuesday, March 2019 Edition
uri: Patch-Tuesday-March-2019-Edition
url: https://krebsonsecurity.com/2019/03/patch-tuesday-march-2019-edition/
content:
<p><strong>Microsoft</strong> on Tuesday pushed out software updates to fix more than five dozen security vulnerabilities in its <strong>Windows</strong> operating systems, <strong>Internet Explorer</strong>, <strong>Edge</strong>, <strong>Office</strong> and <strong>Sharepoint</strong>. If you (ab)use Microsoft products, it&#8217;s time once again to start thinking about getting your patches on. Malware or bad guys can remotely exploit roughly one-quarter of the flaws fixed in today&#8217;s patch batch without any help from users.</p>
<p><img class="alignright size-full wp-image-26837" src="media/863df0f6.brokenwindows.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2014/07/brokenwindows.png" alt="" width="229" height="240" />One interesting patch from Microsoft this week comes in response to a <a href="https://en.wikipedia.org/wiki/Zero-day_(computing)" target="_blank" rel="noopener">zero-day</a> vulnerability (<a href="https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0797" target="_blank" rel="noopener">CVE-2019-0797</a>) reported by researchers at <strong>Kaspersky Lab, </strong>who discovered the bug could be (and is being) exploited to install malicious software.</p>
<p>Microsoft also addressed a zero day flaw (<a href="https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0808" target="_blank" rel="noopener">CVE-2019-0808</a>) in Windows 7 and Windows Server 2008 that&#8217;s been abused in conjunction with a previously unknown weakness (CVE-2019-5786) in Google&#8217;s Chrome browser. A <a href="https://security.googleblog.com/2019/03/disclosing-vulnerabilities-to-protect.html">security alert</a> from Google last week said attackers were chaining the Windows and Chrome vulnerabilities to drop malicious code onto vulnerable systems.</p>
<p>If you use Chrome, take a moment to make sure you have this update and that there isn&#8217;t an arrow to the right of your Chrome address bar signifying the availability of new update. If there is, close out and restart the browser; it should restore whatever windows you have open on restart.<span id="more-46905"></span></p>
<p>This is the third month in row Microsoft has released patches to fix high-severity, critical flaws in the Windows component responsible for assigning Internet addresses to host computers (a.k.a. “Windows DHCP client”).</p>
<p>These are severe &#8220;receive a bad packet of data and get owned&#8221; type vulnerabilities. But <strong>Allan Liska</strong>, senior solutions architect at security firm Recorded Future, says DHCP vulnerabilities are often difficult to take advantage of, and the access needed to do so generally means there are easier ways to deploy malware.</p>
<p>The bulk of the remaining critical bugs fixed this month reside in Internet Explorer, Edge and Office. All told, not the craziest Patch Tuesday. Even Adobe&#8217;s given us a month off (or at least a week) patching critical Flash Player bugs: The Flash player update shipped this week includes non-security updates.</p>
<p>Staying up-to-date on Windows patches is good. Updating only after you&#8217;ve backed up your important data and files is even better. A good backup means you&#8217;re not pulling your hair out if the odd buggy patch causes problems booting the system.</p>
<p><strong>Windows 10</strong> likes to install patches all in one go and reboot your computer on its own schedule. Microsoft doesn’t make it easy for Windows 10 users to change this setting, <a href="https://www.howtogeek.com/224471/how-to-prevent-windows-10-from-automatically-downloading-updates/" target="_blank" rel="noopener">but it is possible</a>. For all other Windows OS users, if you’d rather be alerted to new updates when they’re available so you can choose when to install them, there’s a setting for that in <strong>Windows Update</strong>.</p>
<p>As always, if you experience any problems installing any of these patches this month, please feel free to leave a comment about it below; there’s a good chance other readers have experienced the same and may even chime in here with some helpful tips.</p>
<p>Further reading:</p>
<p><a href="https://blog.qualys.com/laws-of-vulnerabilities/2019/03/12/march-2019-patch-tuesday-65-vulns-18-critical-rces-in-dhcp-client-adobe-vulns" target="_blank" rel="noopener">Qualys</a></p>
<p><a href="https://isc.sans.edu/forums/diary/Microsoft+March+2019+Patch+Tuesday/24742/" target="_blank" rel="noopener">SANS Internet Storm Center</a></p>
<p><a href="https://www.askwoody.com/2019/march-2019-patch-tuesday-patches/" target="_blank" rel="noopener">Ask Woody</a></p>
<p><a href="https://www.zdnet.com/article/microsoft-march-patch-tuesday-comes-with-fixes-for-two-windows-zero-days/" target="_blank" rel="noopener">ZDNet</a></p>


feed_id: https://krebsonsecurity.com/?p=46785
title: Ad Network Sizmek Probes Account Breach
uri: Ad-Network-Sizmek-Probes-Account-Breach
url: https://krebsonsecurity.com/2019/03/ad-network-sizmek-probes-account-breach/
content:
<p>Online advertising firm <strong>Sizmek Inc.</strong> [<a href="https://www.marketbeat.com/stocks/NASDAQ/SZMK/" target="_blank" rel="noopener">NASDAQ: SZMK</a>] says it is investigating a security incident in which a hacker was reselling access to a user account with the ability to modify ads and analytics for a number of big-name advertisers.</p>
<p>In a recent posting to a Russian-language cybercrime forum, an individual who&#8217;s been known to sell access to hacked online accounts kicked off an auction for &#8220;the admin panel of a big American ad platform.&#8221;</p>
<p>&#8220;You can add new users to the ad system, edit existing ones and ad offers,&#8221; the seller wrote. The starting bid was $800.</p>
<p>The seller included several screen shots of the ad company&#8217;s user panel. A few minutes on LinkedIn showed that many of these people are current or former employees of Sizmek.</p>
<p>The seller also shared a screenshot of the ad network&#8217;s Alexa site rankings:</p>
<div id="attachment_46921" style="width: 608px" class="wp-caption aligncenter"><img class=" wp-image-46921" src="media/11dbdf67.hackedadnetwork.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/03/hackedadnetwork.jpg" alt="" width="598" height="310" /><p class="wp-caption-text">A screenshot of the Alexa ranking for the &#8220;big American ad network,&#8221; access to which was sold on a cybercrime forum.</p></div>
<p>I checked <a href="https://www.alexa.com/siteinfo/sizmek.com" target="_blank" rel="noopener">Sizmek&#8217;s Alexa page</a> and at the time it almost mirrored the statistics shown in the screenshot above. Sizmek&#8217;s own <a href="https://www.globenewswire.com/news-release/2018/01/03/1281638/0/en/Sizmek-Announces-First-AI-Enabled-Adtech-Platform-Offering-Total-Transparency.html" target="_blank" rel="noopener">marketing boilerplate</a> says the company operates its ad platform in more than 70 countries, connecting more than 20,000 advertisers and 3,600 agencies to audiences around the world. The company is listed by market analysis firm <a href="https://www.datanyze.com/market-share/ad-servers" target="_blank" rel="noopener">Datanyze.com</a> as the world third-largest ad server network.</p>
<p>After reaching out to a number of folks at Sizmek, I heard back from <strong>George Pappachen</strong>, the company&#8217;s general counsel.</p>
<p>Pappachen said the account being resold on the dark web is a regular user account (not a all-powerful administrator account, despite the seller&#8217;s claim) for its <a href="https://www.sizmek.com/blog/goodbye-busywork-next-generation-sizmek-advertising-suite-is-here-to-make-you-more-efficient/" target="_blank" rel="noopener">Sizmek Advertising Suite</a> (SAS). Pappachen described Sizmek&#8217;s SAS product line as &#8220;a sizable and important one&#8221; for the company and a relatively new platform that has hundreds of users.</p>
<p>He acknowledged that the purloined account had the ability to add or modify the advertising creatives that get run on customer ad campaigns. And Sizmek is used in ad campaigns for some of the biggest brands out there. Some of the companies shown in the screenshot of the panel shared by the dark web seller include PR firm <strong>Fleishman-Hillard</strong>, media giants <strong>Fox Broadcasting</strong>, <strong>Gannett</strong>, and <strong>Hearst Digital</strong>, as well as <strong>Kohler</strong>, and <strong>Pandora</strong>.</p>
<div id="attachment_46923" style="width: 607px" class="wp-caption aligncenter"><a class="lightbox" href="media/6d8bf0f3.panel1.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/03/panel1.jpg"><img class="wp-image-46923" src="media/6d8bf0f3.panel1.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/03/panel1.jpg" alt="" width="597" height="271" /></a><p class="wp-caption-text">A screenshot shared by the dark web seller. Portions of this panel &#8212; access to a Sizmek user account &#8212; was likely translated by the Chrome Web browser, which has a built-in page translate function. As seen here, that function tends to translate items in the frame of the panel, but it leaves untouched the data inside those frames.</p></div>
<p>Crooks who exploited this access could hijack existing ad campaigns running on some of the world&#8217;s top online properties, by inserting malicious scripts into the HTML code of ads that run on popular sites. Or they could hijack referral commissions destined for others and otherwise siphon ad profits from the system.</p>
<p>&#8220;Or someone who is looking to sabotage our systems in a bigger way or allow malicious code to enter our systems,&#8221; Pappachen offered.</p>
<p>Pappachen said Sizmek forced a password reset on all internal employees (&#8220;a few hundred&#8221;), and that the company is scrubbing its SAS user database for departed employees, partners and vendors whose accounts may have been hijacked.</p>
<p>&#8220;We&#8217;re now doing some level of screening to see if there&#8217;s been any kind of intrusion we can detect,&#8221; Pappachen said. &#8220;It seemed like [the screenshots were accounts from] past employees. I think there were even a couple of vendors that had access to the system previously.&#8221;<span id="more-46785"></span></p>
<p>The Sizmek incident carries a few lessons. For starters, it seems like an awful lot of people at Sizmek had access to sensitive controls and data a good deal longer than they should have. User inventory and management is a sometimes painful but very necessary ongoing security process at any mature organization.</p>
<p>Best practices in this space call for actively monitoring all accounts &#8212; users and admins &#8212; for signs of misuse or unauthorized access. And when employees or vendors sever business ties, terminate their access immediately.</p>
<p>Pappachen asked KrebsOnSecurity what else could have prevented this. I suggested some form of mobile-based multi-factor authentication option would prevent stolen credentials from turning into instant access. He said the company does use app/mobile based authentication for several of its new products and some internal programs, but allowed that &#8220;the legacy ones probably did not have this feature.&#8221;</p>
<h4>PASSWORD SPRAYING</h4>
<p><img class="aligncenter size-full wp-image-46925" src="media/b017d982.pwspray.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/03/pwspray.jpg" alt="" width="602" height="585" /></p>
<p>It&#8217;s not clear how this miscreant got access to Sizmek&#8217;s systems. But it is clear that attackers have moved rapidly of late toward targeting employees at key roles in companies they&#8217;d like to infiltrate, and they&#8217;re automating the guessing of passwords for employee accounts. One popular version of this attack involves what&#8217;s known as &#8220;<a href="https://resources.infosecinstitute.com/password-spraying/" target="_blank" rel="noopener">password spraying</a>,&#8221; which attempts to access a large number of accounts (usernames/email addresses) with a few commonly used passwords.</p>
<p>There are technologies like <a href="https://en.wikipedia.org/wiki/CAPTCHA" target="_blank" rel="noopener">CAPTCHAs</a> &#8212; requiring the user to solve an image challenge or retype squiggly letters &#8212; which try to weed out automated bot programs from humans. Then again, password spraying attacks often are conducted &#8220;low and slow&#8221; to help evade these types of bot challenges.</p>
<p>Password spraying was suspected in a compromise reported last week at <strong>Citrix</strong>, which <a href="https://www.citrix.com/blogs/2019/03/08/citrix-investigating-unauthorized-access-to-internal-network/" target="_blank" rel="noopener">said it heard from the FBI</a> on March 6 that attackers had successfully compromised multiple Citrix employee accounts. A little-known security company <strong>Resecurity</strong> <a href="https://resecurity.com/blog/supply-chain-the-major-target-of-cyberespionage-groups/" target="_blank" rel="noopener">claimed</a> it had evidence that Iranian hackers were responsible, had been in Citrix&#8217;s network for years, and had offloaded terabytes of data.</p>
<p>Resecurity drew criticism from many in the security community for not sharing enough evidence of the attacks. But earlier this week the company <a href="https://resecurity.com/blog/supply-chain-the-major-target-of-cyberespionage-groups/" target="_blank" rel="noopener">updated its blog post</a> to include several Internet addresses and proxies it says the attackers used in the Citrix campaign. The update stated the attackers had gained access to nearly 32,000 Citrix accounts through password spraying.</p>
<p>Resecurity also presented evidence that it notified Citrix of the breach as early as Dec. 28, 2018. Citrix initially denied that claim, but has since acknowledged that it did receive a notification from Resecurity on Dec. 28. Citrix has declined to comment further beyond saying it is still investigating the matter.</p>
<h4>BRUTE-FORCE LIGHT</h4>
<p><img class="aligncenter wp-image-46927" src="media/27d3b44c.bflight.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/03/bflight.jpg" alt="" width="592" height="321" />If anything, password spraying is a fairly crude, if sometimes marginally effective attack tool. But what we&#8217;ve started to see more of over the past year has been what one might call &#8220;<strong>brute-force light</strong>&#8221; attacks on accounts. A source who has visibility into a botnet of Internet of Things devices that is being mostly used for credential stuffing attacks said he&#8217;s seeing the attackers use distributed, hacked systems like routers, security cameras and digital video recorders <a href="https://krebsonsecurity.com/2016/10/iot-devices-as-proxies-for-cybercrime/" target="_blank" rel="noopener">to anonymize their repeated queries</a>.</p>
<p>This source noticed that the automated system used by the IoT botmasters typically will try several dozen variations on a password that each target had previously used at another site &#8212; adding a &#8220;1&#8221; or an exclamation point at the end of a password, or capitalizing the first letter of whole words in previous passwords, and so on.</p>
<p>The idea behind this method to snare not only users who are wholesale re-using the same password across multiple sites, but to also catch users who may just be re-using slight variations on the same password.</p>
<p>This form of credential stuffing is brilliant from the attacker&#8217;s perspective because it probably nets him quite a few more correct guesses than normal password spraying techniques.</p>
<p>It&#8217;s also smart because it borrows from human nature. Let&#8217;s say your average password re-user is in the habit of recycling the password &#8220;monkeybutt.&#8221; But then he gets to a site that wants him to use capitalization in his password to create an account. So what does this user pick? Yes, &#8220;Monkeybutt.&#8221; Or &#8220;Monkeybutt1&#8221;. You get the picture.</p>
<p>There&#8217;s an old saying in security: &#8220;Everyone gets penetration tested, whether or not they pay someone for the pleasure.&#8221; It&#8217;s kind of like that with companies and their users and passwords. How would your organization hold up to a password spraying or brute-force light attack? If you don&#8217;t know, you should probably find out, and then act on the results accordingly. I guarantee you the bad guys are going to find out even if you don&#8217;t.</p>


feed_id: https://krebsonsecurity.com/?p=46369
title: Why Phone Numbers Stink As Identity Proof
uri: Why-Phone-Numbers-Stink-As-Identity-Proof
url: https://krebsonsecurity.com/2019/03/why-phone-numbers-stink-as-identity-proof/
content:
<p>Phone numbers stink for security and authentication. They stink because most of us have so much invested in these digits that they&#8217;ve become de facto identities. At the same time, when you lose control over a phone number &#8212; maybe it&#8217;s hijacked by fraudsters, you got separated or divorced, or you were way late on your phone bill payments &#8212; whoever inherits that number can then be you in a lot of places online.</p>
<p><img class="aligncenter wp-image-45226" src="media/c61b924f.cell8.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/09/cell8.png" alt="" width="597" height="687" /></p>
<p>How exactly did we get to the point where a single, semi-public and occasionally transient data point like a phone number can unlock access to such a large part of our online experience? KrebsOnSecurity spoke about this at length with <strong>Allison Nixon</strong>, director of security research at New York City-based cyber intelligence firm <a href="https://www.flashpoint-intel.com" target="_blank" rel="noopener">Flashpoint</a>.</p>
<p>Nixon said much of her perspective on mobile identity is colored by the lens of her work, which has her identifying some of the biggest criminals involved in hijacking phone numbers <a href="https://krebsonsecurity.com/?s=SIM+swap&amp;x=0&amp;y=0" target="_blank" rel="noopener">via SIM swapping attacks</a>. Illegal SIM swaps allow fraudsters to hijack a target&#8217;s phone&#8217;s number and use it to steal financial data, passwords, cryptocurrencies and other items of value from victims.</p>
<p>Nixon said countless companies have essentially built their customer authentication around the phone number, and that a great many sites still let users reset their passwords with nothing more than a one-time code texted to a phone number on the account. In this attack, the fraudster doesn&#8217;t need to know the victim&#8217;s password to hijack the account: He just needs to have access to the target&#8217;s mobile phone number.</p>
<p>&#8220;As a consumer, I&#8217;m forced to use my phone number as an identity document, because sometimes that&#8217;s the only way to do business with a site online,&#8221; Nixon said. &#8220;But from that site&#8217;s side, when they see a password reset come in via that phone number, they have no way to know if that&#8217;s me. And there&#8217;s nothing anyone can do to stop it except to stop using phone numbers as identity documents.&#8221;</p>
<p>Beyond SIM-swapping attacks, there are a number of ways that phone numbers can get transferred to new owners, Nixon said. The biggest reason is lack of payment for past phone bills. But maybe someone goes through a nasty divorce or separation, and can no longer access their phone or phone accounts. The account is sent to collections and closed, and the phone number gets released back into the general pool for reassignment after a period of time.</p>
<p>Many major providers still let people reset their passwords with just a text message. Last week I went to regain access to a Yahoo account I hadn&#8217;t used in almost five years. Yahoo&#8217;s forgot password feature let me enter a phone number, and after entering a code sent to my phone I was able to read my email.</p>
<p>So, if that Yahoo account is tied to a mobile number that you can receive text messages at, then you can assume control over the account. <a href="https://krebsonsecurity.com/2013/06/the-value-of-a-hacked-email-account/" target="_blank" rel="noopener">And every other account associated with that Yahoo account.</a> <em>Even if that phone number no longer belongs to the person who originally established the email account.</em></p>
<p>This is exactly what happened recently to a reader who shared this account:</p>
<blockquote><p>A while ago I bought a new phone number. I went on Yahoo! mail and typed in the phone number in the login. It asked me if I wanted to receive an SMS to gain access. I said yes, and it sent me a verification key or access code via SMS. I typed the code I received. I was surprised that I didn&#8217;t access my own email, but the email I accessed was actually the email of the previous owner of my new number.</p>
<p>Yahoo! didn&#8217;t even ask me to type the email address, or the first and last name. It simply sent me the SMS, I typed the code I received, and without asking me to type an email or first and last name, it gave me access to the email of my number&#8217;s PREVIOUS OWNER. Didn&#8217;t ask for credentials or email address. This seriously needs to be revised. At minimum Yahoo! should ask me to type the email address or the first and last name before sending me an SMS which contains an access code.</p></blockquote>
<p><strong>Brian Krebs (BK): </strong>You have your own experiences like this. Or sort of. You tell.</p>
<p><strong>Allison Nixon (AN): </strong>Any threat intelligence company will have some kind of business function that requires purchasing burner phones fairly frequently, which involves getting new phone numbers. When you get new numbers, they are recycled from previous owners because there probably aren&#8217;t any new ones anymore. I get a lot of various text messages for password resets. One I kept getting was texts from this guy&#8217;s bank. Every time he got a deposit, I would get a text saying how much was deposited and some basic information about the account.</p>
<p>I approached the bank because I was concerned that maybe this random person would be endangered by the security research we were going to be doing with this new number. I asked them to take him off the number, but they said there wasn&#8217;t anything they could do about it.</p>
<p>One time I accidentally hijacked a random person&#8217;s account. I was trying to get my own account back at an online service provider, and I put a burner phone number into the site, went through the SMS password reset process, got the link and it said &#8216;Welcome Back&#8217; to some username I didn&#8217;t know. Then I clicked okay and was suddenly reading the private messages of the account.</p>
<p>I realized I&#8217;d hijacked the account of the previous owner of the phone. It was unintentional, but also very clear that there was no technical reason I couldn&#8217;t hijack even more accounts associated with this number. This is a problem affecting <em>a ton</em> of service providers. This could have happened at many, many other web sites.<span id="more-46369"></span></p>
<p><strong>BK:</strong> We weren&#8217;t always so tied to our phone numbers, right? What happened?</p>
<p><strong>AN:</strong> The whole concept of a phone number goes back over a hundred years. The operator would punch in a number you know was associated with your friend and you could call that person and talk to them. Back then, a phone wasn&#8217;t tied any one person&#8217;s identity, and possession of that phone number never proved that person&#8217;s identity.</p>
<p>But these days, phone number <em>are</em> tied to peoples&#8217; identities, even though we&#8217;re recycling them and this recycling is a fundamental part of how the phone system works. Despite the fact that phone number recycling has always existed, we still have all these Internet companies who&#8217;ve decided they&#8217;re going to accept the phone number as an identity document and that&#8217;s terrible.</p>
<p><img class="aligncenter wp-image-45224" src="media/57d2a628.phonescam.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/09/phonescam.png" alt="" width="595" height="375" /></p>
<p><strong>BK:</strong> How does the phone number compare to more traditional, physical identity documents?</p>
<p><strong>AN:</strong> Take the traditional concept of identity documents &#8212; where you have to physically show up and present ID at some type of business or office, and then from there they would look up your account and you can conduct a transaction. Online, it&#8217;s totally different and you can&#8217;t physically show your ID and can&#8217;t show your face.</p>
<p>In the Internet ecosystem, there are different companies and services that sell things online who have settled on various factors that are considered a good enough proxy for an identity document. You supply a username, password, and sometimes you provide your email address or phone number. Often times when you set up your account you have some kind of agreed-upon way of proofing that over time. Based on that pre-established protocol, the user can log in and do transactions.</p>
<p>It&#8217;s not a good system and the way the whole thing works just enables fraud. When you&#8217;re bottlenecked into physically showing up in a place, there&#8217;s only so much fraud you can do. A lot of attacks against phone companies are not attacking the inherent value of a phone number, but its use as an identity document.</p>
<p><strong>BK:</strong> You said phone number recycling is a fundamental part of how the phone system works. Talk more about that, how common that is.</p>
<p><strong>AN:</strong> You could be divorced, or thrown into sudden poverty after losing a job. But that number can be given away, and if it goes to someone else you don&#8217;t get it back. There all kinds of life situations where a phone number is not a good identifier.</p>
<p>Maybe part of the reason the whole phone number recycling issue doesn&#8217;t get much attention is people who can&#8217;t pay their bills probably don&#8217;t have a lot of money to steal anyways, but it&#8217;s pretty terrible that this situation can be abused to kick people when they&#8217;re down. I don&#8217;t think a lot of money can be stolen in this way, but I do think the fact that this happens really can undermine the entire system.</p>
<p><strong>BK:</strong> It seems to me that it would be a good thing if more online merchants made it easier to log in to their sites without using passwords, but instead with an app that just asks hey was that you just now trying to log in? Yes? Okay. Boom, you&#8217;re logged in. Seems like this kind of &#8220;push&#8221; login can leverage the user&#8217;s smart phone while not relying on the number &#8212; or passwords, for that matter.</p>
<p>If phone numbers are bad, what should we look to as more reliable and resilient identifiers?</p>
<p><strong>AN:</strong> That&#8217;s something I&#8217;ve been thinking a lot about lately. It seems like all of the other options are either bad or really controversial. On the one hand, I want my bank to know who I am, and I want to expose my email and phone number to them so they can verify it&#8217;s me and know how to get in touch with me if needed. But if I&#8217;m setting up an email account, I don&#8217;t want to have to give them all of my information. I&#8217;m not attached to any one alternative idea, I just don&#8217;t like what we&#8217;re doing now.</p>
<p>For more on what you can do to reduce your dependence on mobile phone numbers, check out the &#8220;What Can You Do?&#8221; section of <a href="https://krebsonsecurity.com/2018/08/hanging-up-on-mobile-in-the-name-of-security/" target="_blank" rel="noopener">Hanging Up on Mobile in the Name of Security</a>.</p>


feed_id: https://krebsonsecurity.com/?p=47007
title: Facebook Stored Hundreds of Millions of User Passwords in Plain Text for Years
uri: Facebook-Stored-Hundreds-of-Millions-of-User-Passwords-in-Plain-Text-f
url:
https://krebsonsecurity.com/2019/03/facebook-stored-hundreds-of-millions-of-user-passwords-in-plain-text-for-years/

content:
<p>Hundreds of millions of <strong>Facebook</strong> users had their account passwords stored in plain text and searchable by thousands of Facebook employees &#8212; in some cases going back to 2012, KrebsOnSecurity has learned. Facebook says an ongoing investigation has so far found no indication that employees have abused access to this data.</p>
<p><img class="aligncenter size-full wp-image-30789" src="media/c216a134.facebook_dislike_china_-_Google_Search.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2015/04/facebook_dislike_china_-_Google_Search.png" alt="" width="392" height="362" /></p>
<p>Facebook is probing a series of security failures in which employees built applications that logged unencrypted password data for Facebook users and stored it in plain text on internal company servers. That&#8217;s according to a senior Facebook employee who is familiar with the investigation and who spoke on condition of anonymity because they were not authorized to speak to the press.</p>
<p>The Facebook source said the investigation so far indicates between 200 million and 600 million Facebook users may have had their account passwords stored in plain text and searchable by more than 20,000 Facebook employees. The source said Facebook is still trying to determine how many passwords were exposed and for how long, but so far the inquiry has uncovered archives with plain text user passwords in them dating back to 2012.</p>
<p>My Facebook insider said access logs showed some 2,000 engineers or developers made approximately nine million internal queries for data elements that contained plain text user passwords.</p>
<p>&#8220;The longer we go into this analysis the more comfortable the legal people [at Facebook] are going with the lower bounds&#8221; of affected users, the source said. &#8220;Right now they&#8217;re working on an effort to reduce that number even more by only counting things we have currently in our data warehouse.&#8221;</p>
<p>In an interview with KrebsOnSecurity, Facebook software engineer <strong>Scott Renfro</strong> said the company wasn&#8217;t ready to talk about specific numbers &#8212; such as the number of Facebook employees who could have accessed the data.</p>
<p>Renfro said the company planned to alert affected Facebook users, but that no password resets would be required.</p>
<p>&#8220;We&#8217;ve not found any cases so far in our investigations where someone was looking intentionally for passwords, nor have we found signs of misuse of this data,&#8221; Renfro said. &#8220;In this situation what we&#8217;ve found is these passwords were inadvertently logged but that there was no actual risk that&#8217;s come from this. We want to make sure we&#8217;re reserving those steps and only force a password change in cases where there&#8217;s definitely been signs of abuse.&#8221;</p>
<p>A written statement from Facebook provided to KrebsOnSecurity says the company expects to notify &#8220;hundreds of millions of Facebook Lite users, tens of millions of other Facebook users, and tens of thousands of Instagram users.&#8221; Facebook Lite is a version of Facebook designed for <a href="https://www.howtogeek.com/348076/what%E2%80%99s-the-difference-between-facebook-and-facebook-lite/" target="_blank" rel="noopener">low speed connections and low-spec phones</a>.</p>
<p><span id="more-47007"></span></p>
<p>Both <a href="https://www.zdnet.com/article/github-says-bug-exposed-account-passwords/" target="_blank" rel="noopener">Github</a> and <a href="https://krebsonsecurity.com/2018/05/twitter-to-all-users-change-your-password-now/" target="_blank" rel="noopener">Twitter</a> were forced to admit similar stumbles in recent months, but in both of those cases the plain text user passwords were available to a relatively small number of people within those organizations, and for far shorter periods of time.</p>
<p>Renfro said the issue first came to light in January 2019 when security engineers reviewing some new code noticed passwords were being inadvertently logged in plain text.</p>
<p>&#8220;This prompted the team to set up a small task force to make sure we did a broad-based review of anywhere this might be happening,&#8221; Renfro said. &#8220;We have a bunch of controls in place to try to mitigate these problems, and we&#8217;re in the process of investigating long-term infrastructure changes to prevent this going forward. We&#8217;re now reviewing any logs we have to see if there has been abuse or other access to that data.&#8221;</p>
<p>Facebook&#8217;s password woes come amid a tough month for the social network. Last week, <em>The New York Times</em> <a href="https://www.nytimes.com/2019/03/13/technology/facebook-data-deals-investigation.html" target="_blank" rel="noopener">reported</a> that federal prosecutors are conducting a criminal investigation into data deals Facebook struck with some of the world&#8217;s largest tech companies.</p>
<p>Earlier in March, Facebook <a href="https://techcrunch.com/2019/03/03/facebook-phone-number-look-up/" target="_blank" rel="noopener">came under fire</a> from security and privacy experts for using phone numbers provided for security reasons &#8212; like two-factor authentication &#8212; for <a href="https://twitter.com/i/web/status/1101402001907372032" target="_blank" rel="noopener">other things</a> (like marketing, advertising and making users searchable by their phone numbers across the social network&#8217;s different platforms).</p>
<p><strong>Update, 11:43 a.m.:</strong> Facebook has posted a statement about this incident <a href="https://newsroom.fb.com/news/2019/03/keeping-passwords-secure/" target="_blank" rel="noopener">here</a>.</p>


feed_id: https://krebsonsecurity.com/?p=47021
title: Alleged Child Porn Lord Faces US Extradition
uri: Alleged-Child-Porn-Lord-Faces-US-Extradition
url: https://krebsonsecurity.com/2019/03/alleged-child-porn-lord-faces-us-extradition/
content:
<p>In 2013, the <strong>FBI</strong> <a href="https://krebsonsecurity.com/2013/08/firefox-zero-day-used-in-child-porn-hunt/" target="_blank" rel="noopener">exploited a zero-day vulnerability in Firefox</a> to seize control over a Dark Web network of child pornography sites. The alleged owner of that ring &#8211; 33-year-old <a href="https://en.wikipedia.org/wiki/Freedom_Hosting" target="_blank" rel="noopener">Freedom Hosting</a> operator <strong>Eric Eoin Marques</strong> &#8211; was arrested in Ireland later that year on a U.S. warrant and has been in custody ever since. This week, Ireland&#8217;s Supreme Court cleared the way for Marques to be extradited to the United States.</p>
<div id="attachment_47063" style="width: 602px" class="wp-caption aligncenter"><img class=" wp-image-47063" src="media/65d35939.marques.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/03/marques.jpg" alt="" width="592" height="314" /><p class="wp-caption-text">Eric Eoin Marques. Photo: Irishtimes.com</p></div>
<p>The FBI has called Marques the world&#8217;s largest facilitator of child porn. He is wanted on four charges linked to hidden child porn sites like &#8220;Lolita City&#8221; and &#8220;PedoEmpire,&#8221; which the government says were extremely violent, graphic and depicting the rape and torture of pre-pubescent children. Investigators allege that sites on Freedom Hosting had thousands of customers, and earned Marques more than $1.5 million.</p>
<p>For years Freedom Hosting had developed a reputation as a safe haven for hosting child porn. Marques allegedly operated Freedom Hosting as a turnkey solution for Web sites that hide their true location using <a href="https://www.torproject.org/projects/torbrowser.html.en" target="_blank" rel="noopener">Tor</a>, an online anonymity tool.</p>
<p>The sites could only be accessed using the Tor Browser Bundle, which is built on the Firefox Web browser. On Aug. 4, 2013, U.S. federal agents exploited a previously unknown vulnerability in Firefox version 17 that allowed them to identify the true Internet addresses and computer names of people using Tor Browser to visit the child porn sites at Freedom Hosting.</p>
<p>Irish public media service RTE <a href="https://www.rte.ie/news/2013/0912/473824-eric-eoin-marques/" target="_blank" rel="noopener">reported in 2013</a> that Marques briefly regained access to one of his hosting servers even after the FBI had seized control over it and changed the password, briefly locking the feds out of the system.</p>
<p>As <a href="https://www.wired.com/2013/09/freedom-hosting-fbi/" target="_blank" rel="noopener">Wired.com observed</a> at the time, &#8220;in addition to the wrestling match over Freedom Hosting&#8217;s servers, Marques allegedly dove for his laptop when the police raided him, in an effort to shut it down.&#8221;</p>
<p>Marques, who holds dual Irish-US citizenship, was denied bail and held pending his nearly six-year appeal process to contest his extradition. FBI investigators told the courts they feared he would try to destroy evidence and/or flee the country. FBI agents testified that Marques had made inquiries about how to get a visa and entry into Russia and set up residence and citizenship there.<span id="more-47021"></span></p>
<p>&#8220;My suspicion is he was trying to look for a place to reside to make it the most difficult to be extradited to the US,&#8221; FBI Special Agent <strong>Brooke Donahue</strong> <a href="https://www.independent.ie/irish-news/courts/child-porn-accused-trying-to-move-to-russia-fbi-29574802.html" target="_blank" rel="noopener">reportedly</a> told an Irish court in 2013.</p>
<p>Even before the FBI testified in court about its actions, clues began to emerge that the Firefox exploit used to record the true Internet address of Freedom Hosting visitors was developed specifically for U.S. federal investigators. In an analysis posted on Aug. 4, reverse engineer <a title="https://twitter.com/vlad902/status/364230383941849090" href="https://twitter.com/vlad902/status/364230383941849090" target="_blank" rel="noopener">Vlad Tsrklevich</a> concluded that because the payload of the Firefox exploit didn&#8217;t download or execute any secondary backdoor or commands &#8220;it’s very likely that this is being operated by an [law enforcement agency] and not by blackhats.”</p>
<p>According to <a href="https://www.irishtimes.com/news/crime-and-law/why-irishman-is-to-be-extradited-to-us-on-child-pornography-charges-1.3832931" target="_blank" rel="noopener"><em>The Irish Times</em></a>, in a few days Marques is likely to be escorted from Cloverhill Prison to Dublin Airport where he will be put on a US-bound flight and handcuffed to a waiting US marshal. If convicted of all four charges, he faces life in prison (3o years for each count).</p>


feed_id: https://krebsonsecurity.com/?p=47080
title: A Month After 2 Million Customer Cards Sold Online, Buca di Beppo Parent Admits Breach
uri: A-Month-After-2-Million-Customer-Cards-Sold-Online-Buca-di-Beppo-Pare
url:
https://krebsonsecurity.com/2019/03/a-month-after-2-million-customer-cards-sold-online-buca-di-beppo-parent-admits-breach/

content:
<p>On Feb. 21, 2019, KrebsOnSecurity contacted Italian restaurant chain <strong>Buca di Beppo</strong> after discovering strong evidence that two million credit and debit card numbers belonging to the company&#8217;s customers were being sold in the cybercrime underground. Today, Buca&#8217;s parent firm announced it had remediated a 10-month breach of its payment systems at dozens of restaurants, including some locations of its other brands such as <strong>Earl of Sandwich</strong> and <strong>Planet Hollywood</strong>.</p>
<div id="attachment_47087" style="width: 609px" class="wp-caption aligncenter"><a class="lightbox" href="media/4302bd45.davincibreach.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/03/davincibreach.png"><img class="wp-image-47087" src="media/4302bd45.davincibreach.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/03/davincibreach.png" alt="" width="599" height="400" /></a><p class="wp-caption-text">Some 2.1 million+ credit and debit card accounts stolen from dozens of Earl Enterprises restaurant locations went up for sale on a popular carding forum on Feb. 20, 2019.</p></div>
<p>In a statement posted to its Web site today, Orlando, Fla. based hospitality firm <strong><a href="https://www.earlenterprise.com/" target="_blank" rel="noopener">Earl Enterprises</a></strong> said a data breach involving malware installed on its point-of-sale systems allowed cyber thieves to steal card details from customers between May 23, 2018 and March 18, 2019.</p>
<p>Earl Enterprises did not respond to requests for specifics about how many customers total may have been impacted by the 10-month breach. The company&#8217;s statement directs concerned customers <a href="http://www.earlenterprise.com/incident/" target="_blank" rel="noopener">to an online tool</a> that allows one to look up breached locations by city and state.</p>
<p>According to an analysis of that page, it appears the breach impacts virtually all 67 Buca di Beppo locations in the United States; a handful out of the total 31 Earl of Sandwich locations; and Planet Hollywood locations in Las Vegas, New York City and Orlando. Also impacted were <a href="http://tequilataquerialv.com/" target="_blank" rel="noopener">Tequila Taqueria</a> in Las Vegas; <a href="https://chickenguy.com/location/disney-springs/" target="_blank" rel="noopener">Chicken Guy!</a> in Disney Springs, Fla.; and <a href="http://mixology101la.com/" target="_blank" rel="noopener">Mixology</a> in Los Angeles.</p>
<p>KrebsOnsecurity contacted the executive team at Buca di Beppo in late February after determining most of this restaurant&#8217;s locations were likely involved a data breach that first surfaced on <a href="https://krebsonsecurity.com/?s=joker%27s+stash&amp;x=0&amp;y=0" target="_blank" rel="noopener">Joker&#8217;s Stash</a>, an underground shop that sells huge new batches of freshly-stolen credit and debit cards on a regular basis.<span id="more-47080"></span></p>
<p>Joker&#8217;s Stash typically organizes different batches of stolen cards around a codename tied to a specific merchant breach. This naming convention allows criminals who purchased cards from a specific batch and found success using those cards fraudulently to buy from the same batch again when future cards stolen from the same breached merchant are posted for sale.</p>
<p>While a given batch&#8217;s nickname usually has little relation to the breached merchant, Joker&#8217;s Stash does offer a number of search options for customers that can sometimes be used to trace a large batch of stolen cards back to a specific merchant.</p>
<p>This is especially true if the victim merchant has a number of store locations in multiple smaller U.S. towns. That&#8217;s because while Joker&#8217;s Stash makes its stolen cards searchable via a variety of qualities &#8212; the card-issuing bank or expiration date, for example &#8212; perhaps the most useful in this case is the city or ZIP code tied to each card.</p>
<p>As with <a href="https://krebsonsecurity.com/?s=zip+code+card+breach&amp;x=0&amp;y=0" target="_blank" rel="noopener">a number of other carding sites</a>, Joker&#8217;s Stash indexes cards by the city and/or ZIP code of the store from which the card was stolen (<em>not</em> the ZIP code of the affected cardholders).</p>
<p>On Feb. 20, Joker&#8217;s Stash moved a new batch of some 2.15 million stolen cards that it dubbed the &#8220;Davinci Breach.&#8221; An analysis of the cities and towns listed among the Davinci cards for sale included a number of hacked store locations that were not in major cities, such as Burnsville, Minn., Levonia, Mich., Midvale, Utah, Norwood, Ohio, and Wheeling, Ill.</p>
<p>Earl Enterprises said in its statement the malicious software installed at affected stores captured payment card data, which could have included credit and debit card numbers, expiration dates and, in some cases, cardholder names. The company says online orders were not affected.</p>
<p>Malicious hackers typically steal card data from organizations by hacking into point-of-sale systems remotely and seeding those systems with malicious software that can copy account data stored on a card’s magnetic stripe. Thieves can use that data to clone the cards and then use the counterfeits to buy high-priced merchandise from electronics stores and big box retailers.</p>
<p>Cardholders are not responsible for fraudulent charges, but your bank isn&#8217;t always going to detect card fraud. That&#8217;s why it&#8217;s important to regularly review your monthly statements and quickly report any unauthorized charges.</p>


feed_id: https://krebsonsecurity.com/?p=47105
title: Man Behind Fatal ‘Swatting’ Gets 20 Years
uri: Man-Behind-Fatal-Swatting-Gets-20-Years
url: https://krebsonsecurity.com/2019/03/man-behind-fatal-swatting-gets-20-years/
content:
<p><strong>Tyler Barriss</strong>, a 26-year-old California man who admitted making a phony emergency call to police in late 2017 that led to the shooting death of an innocent Kansas resident, has been sentenced to 20 years in federal prison.</p>
<div id="attachment_42104" style="width: 470px" class="wp-caption aligncenter"><img class="size-full wp-image-42104" src="media/e6e75b15.tylerrajbarriss.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/01/tylerrajbarriss.png" alt="" width="460" height="614" /><p class="wp-caption-text">Tyler Barriss, in an undated selfie.</p></div>
<p>Barriss has admitted to his role in the Kansas man&#8217;s death, as well as to dozens of other non-fatal &#8220;swatting&#8221; attacks. These dangerous hoaxes involve making false claims to emergency responders about phony hostage situations or bomb threats, with the intention of prompting a heavily-armed police response to the location of the claimed incident.</p>
<p>On Dec. 28, 2017, Barriss placed a call from California to police in Wichita, Kan., claiming that he was a local resident who’d just shot his father and was holding other family members hostage.</p>
<p>When Wichita officers responded to the address given by the caller — 1033 W. McCormick — they <a href="https://krebsonsecurity.com/2017/12/kansas-man-killed-in-swatting-attack/" target="_blank" rel="noopener">shot and killed</a> 28-year-old <strong>Andrew Finch</strong>, a father of two who had done nothing wrong.</p>
<p>Barriss admitted setting that fatal swatting in motion after <a href="https://krebsonsecurity.com/2018/05/3-charged-in-fatal-kansas-swatting-attack/" target="_blank" rel="noopener">getting in the middle of a dispute</a> between two <strong>Call of Duty</strong> online gamers, 18-year-old <strong>Casey Viner</strong> from Ohio and <strong>Shane Gaskill</strong>, 20, from Wichita. Viner and Gaskill are awaiting their own trials in connection with Finch&#8217;s death.<span id="more-47105"></span></p>
<p>Barriss pleaded guilty to making hoax bomb threats in phone calls to the headquarters of the <strong>FBI</strong> and the <strong>Federal Communications Commission</strong> in Washington, D.C. He also made bomb threat and swatting calls from Los Angeles to emergency numbers in Ohio, New Hampshire, Nevada, Massachusetts, Illinois, Utah, Virginia, Texas, Arizona, Missouri, Maine, Pennsylvania, New Mexico, New York, Michigan, Florida and Canada.</p>
<p>“I hope that this prosecution and lengthy sentence sends a strong message that will put an end to the juvenile and reckless practice of ‘swatting’ within the gaming community, as well as in any other context,” said <strong>Kansas U.S. Attorney Stephen McAllister</strong> said in a written statement. “Swatting is just a terrible idea. I also hope that today’s result helps bring some peace to the Finch family and some closure to the Wichita community.&#8221;</p>
<p>Many readers have commented here that the officer who fired the shot which killed Andrew Finch should also face prosecution. However, the district attorney for the county that encompasses Wichita decided in April 2018 that the officer <a href="https://www.kansas.com/news/local/crime/article208738719.html" target="_blank" rel="noopener">will not face charges</a>, and will not be named because he isn’t being charged with a crime.<span id="more-45700"></span></p>
<p>As the victim of <a href="https://krebsonsecurity.com/2013/03/the-world-has-no-room-for-cowards/" target="_blank" rel="noopener">a swatting attack in 2013</a> and two other attempted swattings, I’m glad to finally see a swatting prosecution that <a href="https://krebsonsecurity.com/2017/02/men-who-sent-swat-team-heroin-to-my-home-sentenced/" target="_blank" rel="noopener">may actually serve as a deterrent</a> to this idiotic and extremely dangerous crime going forward.</p>
<p>But as I&#8217;ve observed in previous stories about swatting attacks, it would also be nice if more police forces around the country received additional training on exercising restraint in the use of deadly force, particularly in responding to hostage or bomb threat scenarios that have hallmarks of a swatting hoax.</p>
<p>For example, perpetrators of swatting often call non-emergency numbers at state and local police departments to carry out their crimes precisely because they are not local to the region and cannot reach the target’s police department by calling 911. This is exactly what Tyler Barriss did in the Wichita case and others. Swatters also often use <a href="http://www.abouttty.com/" target="_blank" rel="noopener">text-to-speech (TTY) services</a> for the hearing impaired to relay hoax swat calls, as was the case with my 2013 swatting.</p>


feed_id: https://krebsonsecurity.com/?p=47108
title: Annual Protest Raises $250K to Cure Krebs
uri: Annual-Protest-Raises-250K-to-Cure-Krebs
url: https://krebsonsecurity.com/2019/03/annual-protest-raises-250k-to-cure-krebs/
content:
<p>For the second year in a row, denizens of a large German-language online forum have donated more than USD $250,000 to cancer research organizations in protest of a story KrebsOnSecurity published in 2018 that unmasked the creators of <strong>Coinhive</strong>, a now-defunct cryptocurrency mining service that was massively abused by cybercriminals. Krebs is translated as &#8220;cancer&#8221; in German.</p>
<div id="attachment_47133" style="width: 585px" class="wp-caption aligncenter"><img class=" wp-image-47133" src="media/1bdc4b2d.krebsaction.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/03/krebsaction.png" alt="" width="575" height="287" /><p class="wp-caption-text">Images posted to the decidedly not-safe-for-work German-language image forum pr0gramm[.]com. Members have posted thousands of thank you receipts from cancer research organizations that benefited from their fight cancer/krebs campaign.</p></div>
<p>On March 26, 2018, KrebsOnSecurity published <a href="https://krebsonsecurity.com/2018/03/who-and-what-is-coinhive/" target="_blank" rel="noopener">Who and What is Coinhive</a>, which showed the founder of Coinhive was the co-creator of the German image hosting and discussion forum <strong>pr0gramm[dot]com</strong> (not safe for work).  I undertook the research because Coinhive’s code at the time was found on tens of thousands of hacked Web sites, and Coinhive seemed uninterested in curbing widespread abuse of its platform.</p>
<p>Pr0gramm&#8217;s top members accused KrebsOnSecurity of violating their privacy, even though all of the research published about them was publicly available online. In protest, the forum&#8217;s leaders urged members to donate money to medical research in a bid to find a cure for Krebs (i.e. &#8220;cancer&#8221;).</p>
<p>All told, thousands of Pr0gramm&#8217;s members <a href="https://krebsonsecurity.com/2018/03/coinhive-expose-prompts-cancer-research-fundraiser/" target="_blank" rel="noopener">donated more than USD $250,000 to cancer cure efforts</a> within days of that March 2018 story. This week, the Pr0gramm administrators rallied members to commemorate that successful fundraiser with yet another.</p>
<p>&#8220;As announced there will be a donation marathon at anniversary day of Krebsaction,&#8221; Pr0gramm&#8217;s administrators announced. &#8220;Today, March 27th, we&#8217;re firing the starting shot for the marathon. Please tag your donation bills properly if they shall be accounted. The official tag is &#8216;krebsspende.&#8217;</p>
<p>According to a running tally on Pr0gramm&#8217;s site, this year&#8217;s campaign has raised 252,000 euros for cancer research so far, or about USD $284,000. That brings the total that Pr0gramm members have donated to cancer research to more than a half-million dollars.</p>
<p>As a bonus, Coinhive <a href="https://krebsonsecurity.com/2019/02/crytpo-mining-service-coinhive-to-call-it-quits/" target="_blank" rel="noopener">announced last month that it was shutting down</a>, citing a perfect storm of negative circumstances. Coinhive had made structural changes to its systems following my 2018 story so that it would no longer profit from accounts used on hacked Web sites. Perhaps more importantly, the value of the cryptocurrency Coinhive&#8217;s code helped to mine dropped precipitously over the past year.</p>


feed_id: https://krebsonsecurity.com/?p=47142
title: Canadian Police Raid ‘Orcus RAT’ Author
uri: Canadian-Police-Raid-Orcus-RAT-Author
url: https://krebsonsecurity.com/2019/04/canadian-police-raid-orcus-rat-author/
content:
<p>Canadian police last week raided the residence of a Toronto software developer responsible for authoring and selling “<strong>Orcus RAT</strong>,” a software product that’s been marketed on underground forums and used in countless malware attacks since its creation in 2015. Its author maintains Orcus is a legitimate <strong>R</strong>emote <strong>A</strong>dministration <strong>T</strong>ool that is merely being abused, but security experts say it includes multiple features more typically seen in malware known as a <strong>R</strong>emote <strong>A</strong>ccess <strong>T</strong>rojan.</p>
<div id="attachment_47154" style="width: 605px" class="wp-caption aligncenter"><a class="lightbox" href="media/63e0fe4f.orcusad.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/04/orcusad.jpg"><img class="wp-image-47154" src="media/63e0fe4f.orcusad.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/04/orcusad.jpg" alt="" width="595" height="243" /></a><p class="wp-caption-text">An advertisement for Orcus RAT.</p></div>
<p>As <a href="https://krebsonsecurity.com/2016/07/canadian-man-is-author-of-popular-orcus-rat/" target="_blank" rel="noopener">first detailed by KrebsOnSecurity in July 2016</a>, Orcus is the brainchild of <a href="https://www.linkedin.com/in/john-revesz-b3437b2/?authType=NAME_SEARCH&amp;authToken=JxFD&amp;locale=en_US&amp;srchid=24600671469033281031&amp;srchindex=3&amp;srchtotal=4&amp;trk=vsrp_people_res_name&amp;trkInfo=VSRPsearchId%3A24600671469033281031%2CVSRPtargetId%3A6884248%2CVSRPcmpt%3Aprimary%2CVSRPnm%3Atrue%2CauthType%3ANAME_SEARCH" target="_blank" rel="noopener"><strong>John “Armada” Rezvesz</strong></a>, a Toronto resident who until recently maintained and sold the RAT under the company name <strong>Orcus Technologies</strong>.</p>
<p>In an “official press release” <a href="https://pastebin.com/JgZpxwpf" target="_blank" rel="noopener">posted to pastebin.com</a> on Mar. 31, 2019, Rezvesz said his company recently was the subject of an international search warrant executed jointly by the <strong>Royal Canadian Mounted Police</strong> (RCMP) and the <strong>Canadian Radio-television and Telecommunications Commission</strong> (CRTC).</p>
<p>“In this process authorities seized numerous backup hard drives [containing] a large portion of Orcus Technologies business, and practices,” Rezvesz wrote. “Data inclusive on these drives include but are not limited to: User information inclusive of user names, real names, financial transactions, and further. The arrests and searches expand to an international investigation at this point, including countries as America, Germany, Australia, Canada and potentially more.”</p>
<p>Reached via email, Rezvesz declined to say whether he was arrested in connection with <a href="media/8a26d605.orcussearch.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/04/orcussearch.jpg" target="_blank" rel="noopener">the search warrant</a>, a copy of which he shared with KrebsOnSecurity. In response to an inquiry from this office, the RCMP stopped short of naming names, but said “we can confirm that our National Division Cybercrime Investigative Team did execute a search warrant at a Toronto location last week.”</p>
<p>The RCMP said the raid was part of an international coordinated effort with the Federal Bureau of Investigation and the Australian Federal Police, as part of “a series of ongoing, parallel investigations into Remote Access Trojan (RAT) technology. This type of malicious software (malware) enables remote access to Canadian computers, without their users’ consent and can lead to the subsequent installation of other malware and theft of personal information.”</p>
<p>“The CRTC executed a warrant under Canada’s Anti-Spam Legislation (CASL) and the RCMP National Division executed a search warrant under the Criminal Code respectively,” reads <a href="https://www.canada.ca/en/radio-television-telecommunications/news/2019/03/crtc-and-rcmp-national-division-execute-warrants-in-malware-investigation.html" target="_blank" rel="noopener">a statement</a> published last week by the Canadian government. “Tips from international private cyber security firms triggered the investigation.”</p>
<p>Rezvesz maintains his software was designed for legitimate use only and for system administrators seeking more powerful, full-featured ways to remotely manage multiple PCs around the globe. He’s also said he’s not responsible for how licensed customers use his products, and that he actively kills software licenses for customers found to be using it for online fraud.</p>
<p>Yet the <a href="https://web.archive.org/web/20170602061727/https://orcustechnologies.com/features.html" target="_blank" rel="noopener">list of features and plugins</a> advertised for this RAT includes functionality that goes significantly beyond what one might see in a traditional remote administration tool, such as DDoS-for-hire capabilities, and the ability to disable the light indicator on webcams so as not to alert the target that the RAT is active.</p>
<p>“It can also implement a watchdog that restarts the server component or even trigger a Blue Screen of Death (BSOD) if the someone tries to kill its process,” wrote researchers at security firm Fortinet in <a href="https://www.fortinet.com/blog/threat-research/a-peculiar-case-of-orcus-rat-targeting-bitcoin-investors.html" target="_blank" rel="noopener">a Dec. 2017 analysis of the RAT</a>. “This makes it harder for targets to remove it from their systems. These are, of course, on top of the obviously ominous features such as password retrieval and key logging that are normally seen in Remote Access Trojans.”</p>
<p>As KrebsOnSecurity <a href="https://krebsonsecurity.com/2016/07/canadian-man-is-author-of-popular-orcus-rat/" target="_blank" rel="noopener">noted in 2016</a>, in conjunction with his RAT Rezvesz also sold and marketed a bulletproof “dynamic DNS service” that promised not to keep any records of customer activity.<span id="more-47142"></span></p>
<p>Rezvesz appears to have a flair for the dramatic, and has periodically emailed this author over the years. Sometimes, the missives were taunting, or vaguely ominous and threatening. Like the time he reached out to say he was hiring a private investigator to find and track me. Still other unbidden communications from Rezvesz were friendly, even helpful with timely news tips.</p>
<p>According to Rezvesz himself, he is no stranger to the Canadian legal system. In June 2018, Rezvesz shared court documents indicating he has been involved in multiple physical assault charges since 2007, including &#8220;7 domestic disputes between partners as well as incidents with his parents.&#8221;</p>
<p>“I am not your A-typical computer geek, Brian,” he wrote in a 2018 email. “I tend to have a violent nature, and have both Martial arts and Military training. So, I suppose it is really good that I took your article with a grain of salt instead of actually really getting upset.”</p>
<p><a class="lightbox" href="media/6edfd971.armada-abuse.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/04/armada-abuse.jpg"><img class="aligncenter wp-image-47149 " src="media/6edfd971.armada-abuse.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/04/armada-abuse.jpg" alt="" width="599" height="254" /></a></p>
<p>The sale and marketing of remote administration tools is not illegal in the United States, and indeed there are plenty of such tools sold by legitimate companies to help computer experts remotely administer computers. However, these tools tend to be viewed by prosecutors as malware and spyware when their proprietors advertise them as hacking devices and provide customer support aimed at helping buyers deploy the RATs stealthily and to evade detection by anti-malware programs.</p>
<p>Last year, a 21-year-old Kentucky man <a href="https://krebsonsecurity.com/2018/07/luminositylink-rat-author-pleads-guilty/" target="_blank" rel="noopener">pleaded guilty</a> to authoring and distributing a popular hacking tool called “<strong>LuminosityLink</strong>,” which experts say was used by thousands of customers to gain access to tens of thousands of computers across 78 countries worldwide.</p>
<p>Also in 2018, 27-year-old Arkansas resident <strong>Taylor Huddleston</strong> was <a href="https://krebsonsecurity.com/2018/02/bot-roundup-avalanche-kronos-nanocore/" target="_blank" rel="noopener">sentenced to three years in jail</a> for making and selling the “<strong>NanoCore RAT</strong>,” which was being used to spy on webcams and steal passwords from systems running the software.</p>
<p>In many previous law enforcement investigations targeting RAT developers and sellers, investigators also have targeted customers of these products. In 2014, the U.S. Justice Department announced a series of actions against more than 100 people accused of purchasing and using “<strong>Blackshades</strong>,” a cheap and powerful RAT that the U.S. government said was used to infect more than a half million computers worldwide.</p>
<p>Earlier this year, Rezvesz <a href="https://twitter.com/OrcusTech" target="_blank" rel="noopener">posted on Twitter</a> that he was making the source code for Orcus RAT publicly available, and that he was focusing his attention on developing a new and improved RAT product.</p>
<p>Meanwhile on Hackforums[.]net — the forum where Orcus was principally advertised and sold — members and customers expressed concern that authorities would soon be visiting Orcus RAT customers, posts that were deleted almost as quickly by the Hackforums administrator.</p>
<p>As if in acknowledgement of that concern, in the Pastebin press release published this week Rezvesz warned people away from using Orcus RAT, and added some choice advice for others who would follow his path.</p>
<p><span class="gmail-il">“Orcus</span> is no longer to be considered safe or secure solution to Remote Administrative needs,&#8221; he wrote, pointing to <a href="media/7d2f993e.UdfIj0l.jpg" data-original-source="https://i.imgur.com/UdfIj0l.jpg" target="_blank" rel="noopener">a screenshot</a> of a court order he says came from one of the police investigators, which requires him to abstain from accessing Hackforums or Orcus-related sites. &#8220;Please move away from this software without delay. It has been a pleasure getting to know everyone in my time online, and I hope you all can take my words as a life lesson. Stay safe, don’t do stupid shit.”</p>


feed_id: https://krebsonsecurity.com/?p=47218
title: Alleged Chief of Romanian ATM Skimming Gang Arrested in Mexico
uri: Alleged-Chief-of-Romanian-ATM-Skimming-Gang-Arrested-in-Mexico
url: https://krebsonsecurity.com/2019/04/alleged-chief-of-romanian-atm-skimming-gang-arrested-in-mexico/
content:
<p>An alleged top boss of a Romanian crime syndicate that U.S. authorities say is responsible for deploying card-skimming devices at Automated Teller Machines (ATMs) throughout North America was arrested in Mexico last week on firearms charges. The arrest comes months after the accused allegedly ordered the execution of a former bodyguard who was trying to help U.S. authorities bring down the group&#8217;s lucrative skimming operations.</p>
<p>On Mar. 31, police in Cancun, Mexico <a href="https://www.riviera-maya-news.com/two-romanian-men-arrested-with-cash-gun-at-puerto-morelos/2019.html" target="_blank" rel="noopener">arrested two Romanian men</a>, identified only as 42-year-old &#8220;<strong>Florian N</strong>&#8221; and 37-year-old &#8220;<strong>Adrian Nicholae N</strong>,&#8221; 37, for the possession of an illegal firearm and cash totaling nearly 500,000 pesos (~USD $26,000) in both American and Mexican denominations.</p>
<div id="attachment_47225" style="width: 570px" class="wp-caption aligncenter"><img class="size-full wp-image-47225" src="media/3a8b73bd.tudorarrest.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/04/tudorarrest.jpg" alt="" width="560" height="269" /><p class="wp-caption-text">An uncaptioned photo published by the Mexican police. According to multiple sources, the individual on the left is Intacash boss Florian Tudor, along with his deputy Nicholae Cosmin.</p></div>
<p>The two men&#8217;s faces were partially obscured in the mugshots released to Mexican media. But according to multiple sources familiar with the investigation, the older man arrested (pictured on the left) is <strong>Florian &#8220;The Shark&#8221; Tudor</strong>, reputed to be in charge of a relatively new ATM company based in Mexico called <strong>Intacash</strong>. The man on the right has been identified as <strong>Nicholae Cosmin</strong>, Tudor&#8217;s deputy.</p>
<p>Intacash was the central focus of a <a href="https://krebsonsecurity.com/2015/09/tracking-a-bluetooth-skimmer-gang-in-mexico/" target="_blank" rel="noopener">three</a>&#8211;<a href="https://krebsonsecurity.com/2015/09/tracking-bluetooth-skimmers-in-mexico-part-ii/" target="_blank" rel="noopener">part</a> <a href="https://krebsonsecurity.com/2015/09/whos-behind-bluetooth-skimming-in-mexico/" target="_blank" rel="noopener">investigation</a> KrebsOnSecurity published in September 2015. That story tracked the activities of a crime gang that was bribing and otherwise coercing ATM technicians to install sophisticated Bluetooth-based skimmers inside cash machines throughout popular tourist destinations in and around Mexico&#8217;s Yucatan Peninsula &#8212; including Cancun, Cozumel, Playa del Carmen and Tulum.</p>
<p>Meanwhile, Intcash&#8217;s machines were about the only ATMs in top tourist spots in Mexico that <em>weren&#8217;t</em> getting compromised with these bluetooth skimming devices.</p>
<p>Law enforcement and ATM industry sources cited in that story said they believe Intacash is controlled by Romanian nationals and that its key principals were the ones paying ATM technicians to compromise machines at competing ATM providers.</p>
<p>As I discovered in reporting that series, it was possible to tell which ATMs were compromised in Mexico&#8217;s top tourist spots just by approaching each with a smart phone and looking for the presence of a Bluetooth signal beaconing out a wireless network with the name &#8220;Free2Move&#8221;.</p>
<p>This functionality allowed the crime syndicate to siphon credit and debit card details and PINs from hacked ATMs wirelessly, without ever again having to touch the compromised machines (see the video below for more on that investigation).</p>
<div align="center"><iframe src="https://www.youtube.com/embed/Pi6y2soOp8Y" width="560" height="315" frameborder="0" allowfullscreen="allowfullscreen"></iframe></div>
<p>In April 2018, KrebsOnSecurity heard from a Romanian person who claimed to have been working for Intacash. This individual seemed extremely concerned for their safety, but at the same time eager to share details about the company&#8217;s operations and owners.</p>
<p>The source shared photographs of Intacash&#8217;s chief deputies, as well as screenshots of card data allegedly hoovered up by the company&#8217;s various skimming operations. The source repeatedly told me the Romanian gang was paying large sums of money to Mexican authorities to stay off their radar.</p>
<p>The last time I heard from that source was June 2018, just after a like-minded associate at Intacash was found shot dead in his car. The associate, 44-year-old <strong>Sorinel Constantin Marcu</strong>, was already wanted on a warrant from <strong>Interpol</strong>, the international criminal police organization.</p>
<p>In 2014, a Romanian court issued a criminal warrant for Marcu on allegations of attempted murder back in his hometown of Craiova, Romanian&#8217;s 6th-largest city. But Marcu was able to flee to Mexico before he could be tried. The court later convicted Marcu in abstentia, leveling a sentence of eight years in prison.</p>
<p>On  the evening of June 11, 2018, Marcu was shot in the head, reportedly while trying to kidnap a businessman in Mexico, according to multiple media accounts. A street surveillance video of the incident published by <a href="https://www.gds.ro/Local/2018-06-26/craioveanul-impuscat-in-mexic-incerca-sa-rapeasca-un-afacerist-video/" target="_blank" rel="noopener">Romanian daily Gazeta de SUD</a> shows a <a href="https://en.wikipedia.org/wiki/Dodge_Nitro" target="_blank" rel="noopener">Dodge Nitro</a> allegedly driven by Marcu hitting the businessman&#8217;s parked car.</p>
<div align="center"><iframe src="https://www.youtube.com/embed/bKLvCyj1qC4" width="560" height="315" frameborder="0" allowfullscreen="allowfullscreen"></iframe></div>
<p>The businessman manages to flee, and the passenger in Marcu&#8217;s vehicle briefly starts after him, before returning to the picture a few seconds later. Marcu&#8217;s passenger gets back in the vehicle, which then moves out of view of the security camera.</p>
<p>&#8220;Later, one of the businessman&#8217;s guards came out of the house and shot several gun shots in the car driven by Marcu, and he was killed on the spot,&#8221; Gazeta reported.<span id="more-47218"></span></p>
<p>My source&#8217;s last communication was that they had tried to reach out to U.S. federal investigators but hadn&#8217;t had much luck. The source wanted the name and a number of someone to talk to at the FBI or Secret Service.</p>
<p>That source also said corrupt Mexican authorities were complicit in changing the news media narrative of what happened to Sorinel Marcu.</p>
<p>&#8220;Hi Brian do you have some news about your contact? Because the person who was going to testify now is dead,&#8221; my source wrote. &#8220;The boss of the gang do it, who I told you kill him, now he pay a lot of money to change the real story, and now that Cancun’s police work for him. Because the maybe guilty stayed 24 hours arrested (or less) for homicide. Please if this week you can do something for us, help us!&#8221;</p>
<p>Searching for others who might have knowledge of the shooting, I found a Facebook posting by Marcu&#8217;s brother &#8212; <strong>Aurelio Marcu</strong> &#8212; who <a href="https://mobile.facebook.com/story.php?story_fbid=2215017835385850&amp;id=1484190511801923&amp;_rdr" target="_blank" rel="noopener">commented on a Facebook video</a> recorded shortly after Marcu&#8217;s execution in which bystanders can be heard telling those approaching the car not to move his brother&#8217;s body. The video was posted by a Mexican news channel, which reported the men questioned by police in connection with the incident were carrying Russian passports.</p>
<p>&#8220;They are from Romania, not Russia,&#8221; Aurelio Marcu wrote in a comment on the video, saying the boss of the gang is a guy named Tudor Florin, also known as &#8220;Rechinu&#8221; or &#8220;shark&#8221; in Romanian.</p>
<div id="attachment_47226" style="width: 608px" class="wp-caption aligncenter"><img class=" wp-image-47226" src="media/a0e941b4.guncar.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/04/guncar.jpg" alt="" width="598" height="223" /><p class="wp-caption-text">Police in Puerto Morelos seized weapons and a Cadillac Escalade from Romanians Florian Tudor and Nicholae Cosmin. Image: Riviera-maya-news.com.</p></div>
<p>In an interview with KrebsOnSecurity, Aurelio Marcu said his younger brother was killed in front of a new apartment complex being built and paid for by Mr. Tudor, and that the dead man&#8217;s body was moved to his car to make it look like he was slain there instead. He also said his brother and the passenger in the Dodge Nitro were following a man who worked in Tudor&#8217;s crew, not some random businessman.</p>
<p>&#8220;He was unarmed, and if you look at <a href="media/e68f75a9.poza-mort-Sursa-De-Peso-640x360.jpg" data-original-source="https://www.gds.ro/wp-content/uploads/2018/06/poza-mort-Sursa-De-Peso-640x360.jpg" target="_blank" rel="noopener">the pictures</a> in the papers from his death, you can see he is wearing flip flops when he was shot,&#8221; Aurelio Marcu said, speaking through an interpreter. &#8220;How can you go kidnap someone wearing flip flops and with no weapon?&#8221;</p>
<h4>BAD BODYGUARD</h4>
<p>Marcu the elder said his dead brother long served as Tudor&#8217;s personal bodyguard, but at some point the two had a falling out over the money and women. Marcu said things got really tense between Tudor and his brother when the latter began sabotaging Intacash&#8217;s operations by applying superglue to the PIN pads and card acceptance slots of Intacash ATMs throughout Cancun.</p>
<div id="attachment_47227" style="width: 608px" class="wp-caption aligncenter"><a class="lightbox" href="media/e67a4b55.cmarcu.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/04/cmarcu.jpg"><img class="wp-image-47227" src="media/e67a4b55.cmarcu.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/04/cmarcu.jpg" alt="" width="598" height="165" /></a><p class="wp-caption-text">A warrant for Constantine Sorinel Marcu, on attempted murder charges. Marcu was shot and killed in June 2018, allegedly by Mr. Tudor and/or his associates.</p></div>
<p>Marcu said Tudor&#8217;s crew had tried once before to kill his brother, but only managed to seriously wound him in a knife attack that ruptured his spleen.</p>
<p>Asked why he believes Florian Tudor was responsible for his brother&#8217;s death, Marcu said Sorinel &#8220;was an impediment for them, and Mr. Tudor was afraid that he would talk to the police.&#8221;</p>
<p>Marcu said Tudor and his associates are working with criminal syndicates in China, India and Indonesia to help cash out credit and debit card accounts stolen via Intacash&#8217;s extensive ATM skimming operations. He also said Mr. Tudor is reputed to keep up to USD $50,000 in cash on hand at all times, just in case he needs to buy himself out of a sticky situation with the police.</p>
<p>&#8220;This is so that if anything happens to him, he has a window to escape,&#8221; Marcu said. &#8220;He used to brag that he had days when he was making like $200,000 a day doing all this ATM and fake credit cards stuff.&#8221;</p>
<p>Additionally, Marcu said Mr. Tudor is working on building a theme park in the Puerto Morelos area of Quintana Roo, a Mexican state on the Yucatan Peninsula that encompasses Cancun and other tourist areas close by.</p>
<p>Aurelio Marcu says he and his brother are from the the same hometown as Tudor and his crew &#8212; Craiova, Romania, and that he&#8217;s been living under active protection from the Romanian police out of fear for his life.</p>
<p>Marcu is doubly worried now because he&#8217;s recently learned that both Tudor and Cosmin made bail on the weapons charges. He believes they are probably trying to figure out how to quietly wind down their operations in Mexico and flee the country.</p>
<p>KrebsOnSecurity has learned that Tudor and others alleged to be part of the Romanian ATM skimming ring in Mexico are the target of a more wide-ranging FBI investigation into the alleged Romanian crime family. The FBI did not respond to requests for comment.</p>
<p>According to people briefed on the investigation, Mexico is a central hub for hundreds of individuals from Romania who have moved into tourist areas to help execute various ATM skimming and money laundering schemes there and across the border in the United States.</p>
<p>Those officials describe the Romanian crime network in Mexico as part of a far larger criminal syndicate that has foot soldiers who are ready and able to execute ATM skimming attacks throughout North America and in virtually every major U.S. city.</p>
<p>Sources say Romanian intelligence services also have been keeping tabs on this group&#8217;s operations south of the U.S. border &#8212; specifically on Mssrs. Tudor and Cosmin, as well as the now-deceased Sorinel Marcu.</p>


feed_id: https://krebsonsecurity.com/?p=47266
title: A Year Later, Cybercrime Groups Still Rampant on Facebook
uri: A-Year-Later-Cybercrime-Groups-Still-Rampant-on-Facebook
url: https://krebsonsecurity.com/2019/04/a-year-later-cybercrime-groups-still-rampant-on-facebook/
content:
<p>Almost exactly one year ago, KrebsOnSecurity <a href="https://krebsonsecurity.com/2018/04/deleted-facebook-cybercrime-groups-had-300000-members/" target="_blank" rel="noopener">reported</a> that a mere two hours of searching revealed more than 100 Facebook groups with some 300,000 members openly advertising services to support all types of cybercrime, including spam, credit card fraud and identity theft. Facebook responded by deleting those groups. Last week, a similar analysis led to the takedown of 74 cybercrime groups operating openly on Facebook with more than 385,000 members.</p>
<p><img src="media/f6f7d408.fbtd.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/04/fbtd.png" alt="" width="315" height="269" class="aligncenter size-full wp-image-43481" /></p>
<p>Researchers at <strong>Cisco Talos</strong> <a href="https://blog.talosintelligence.com/2019/04/hiding-in-plain-sight.html" target="_blank" rel="noopener">discovered</a> the groups using the same sophisticated methods I employed last year &#8212; running a search on Facebook.com for terms unambiguously tied to fraud, such as &#8220;spam&#8221; and &#8220;phishing.&#8221; Talos said most of the groups were less than a year old, and that Facebook deleted the groups after being notified by Cisco.</p>
<p>Talos also re-confirmed my findings that Facebook still generally ignores individual abuse reports about groups that supposedly violate its &#8216;community standards,&#8217; which specifically forbid the types of activity espoused by the groups that Talos flagged.</p>
<p>&#8220;Talos initially attempted to take down these groups individually through Facebook&#8217;s abuse reporting functionality,&#8221; the researchers found. &#8220;While some groups were removed immediately, other groups only had specific posts removed.&#8221;</p>
<p>But Facebook <em>deleted all offending groups</em> after researchers told Facebook&#8217;s security team they were going to publish their findings.  This is <a href="https://krebsonsecurity.com/2018/04/is-facebooks-anti-abuse-system-broken/" target="_blank" rel="noopener">precisely what I experienced a year ago</a>.</p>
<p>Not long after Facebook deleted most of the 120 cybercrime groups I reported to it back in April 2018, many of the groups began reemerging elsewhere on the social network under similar names with the same members.</p>
<p>Instead of reporting those emergent groups directly to people at Facebook&#8217;s public relations arm &#8212; something most mere mortals aren&#8217;t able to do &#8212; KrebsOnSecurity decided to report the re-offenders via Facebook&#8217;s <a href="https://www.facebook.com/help/reportlinks" target="_blank" rel="noopener">regular abuse reporting procedures</a>. </p>
<p>What did we find? KrebsOnSecurity <a href="https://krebsonsecurity.com/2018/04/is-facebooks-anti-abuse-system-broken/" target="_blank" rel="noopener">received a series of replies</a> saying that Facebook had reviewed my reports but that none of the groups were found to have violated its standards. KrebsOnSecurity later found that reporting the abusive Facebook groups <a href="https://twitter.com/briankrebs/status/986996647103205378" rel="noopener" target="_blank">to a quarter-million followers on Twitter</a> was the fastest way to get them disabled.<span id="more-47266"></span></p>
<p>How else have Facebook&#8217;s public statements about its supposed commitment to security and privacy been undermined by pesky facts over the past few weeks?</p>
<ul>
<li>KrebsOnSecurity <a href="https://krebsonsecurity.com/2019/03/facebook-stored-hundreds-of-millions-of-user-passwords-in-plain-text-for-years/" target="_blank" rel="noopener">broke the news</a> that Facebook developers wrote apps which stored somewhere between 200 million and 600 million Facebook user passwords in plain text. These plaintext passwords were indexed by Facebook&#8217;s data centers and searchable for years by more than 20,000 Facebook employees.</li>
<p></p>
<li>It emerged that Facebook&#8217;s new account signup page urges users <a href="https://www.thedailybeast.com/beyond-sketchy-facebook-demanding-some-new-users-email-passwords" target="_blank" rel="noopener"><em>to supply the password to their email account</em></a> so Facebook can harvest contact details and who knows what else. Yes, that&#8217;s right: Facebook has been asking new users to share their email password, despite decades of consumer advice warning that is exactly what phishers do.</li>
<p> 	</p>
<li>Cybersecurity firm <strong>UpGuard</strong> <a href="https://www.upguard.com/breaches/facebook-user-data-leak" target="_blank" rel="noopener">discovered</a> two troves of unprotected Facebook user data sitting on Amazon’s servers, <a href="https://www.wired.com/story/facebook-apps-540-million-records/" target="_blank" rel="noopener">exposing hundreds of millions of records about users</a>, including their names, passwords, comments, interests, and likes.<br />
</p>
<li>Facebook is <a href="https://motherboard.vice.com/en_us/article/kzdxjx/facebook-phone-number-two-factor-authentication" target="_blank" rel="noopener">making users searchable by marketers and others via phone number</a>, even when that phone number was only provided solely for the purposes of multi-factor authentication.</li>
</ul>
<p>Once again, that old adage applies: If you can&#8217;t quite figure out how you&#8217;re the customer in a given online relationship, that&#8217;s probably because you&#8217;re best described as the product being sold to others.</p>
<p>I long ago stopped providing personal information via any Facebook account. But for my part, there remain probably three big reasons why I&#8217;m still on Facebook.</p>
<p>For better or worse, a great many sources choose to share important information this way. Also, sometimes Facebook is the fastest way to find a potential source and get their attention.</p>
<p>Secondly, many people unfortunately still get much of their news from Facebook and prefer to be notified about new stories this way.</p>
<p>Finally, I periodically need to verify some new boneheaded privacy disclosure or security screw-up manufactured by Facebook.</p>
<p>I would probably never delete my Facebook account, for the same reason I wouldn&#8217;t voluntarily delete my accounts from various cybercrime forums: For my part, the potential benefits of being there outweigh the potential risks. Then again, I am likely far from your typical Facebook (ab)user. </p>
<p>But what about you, Dear Reader? How does your Facebook cost/benefit analysis break down? Have any of the recent or not-so-recent Facebook scandals prompted you to delete your account, or to heavily restrict what types of information you store on the social network or make available to others? Sound off in the comments below.</p>


feed_id: https://krebsonsecurity.com/?p=47263
title: Patch Tuesday Lowdown, April 2019 Edition
uri: Patch-Tuesday-Lowdown-April-2019-Edition
url: https://krebsonsecurity.com/2019/04/patch-tuesday-lowdown-april-2019-edition/
content:
<p>Microsoft today released fifteen software updates to fix more than 70 unique security vulnerabilities in various flavors of its <strong>Windows</strong> operating systems and supported software, including at least two <a href="https://en.wikipedia.org/wiki/Zero-day_(computing)" target="_blank" rel="noopener">zero-day</a> bugs. These patches apply to <strong>Windows</strong>, <strong>Internet Explorer</strong> (IE) and <strong>Edge</strong> browsers, <strong>Office,</strong> <strong>Sharepoint</strong> and <strong>Exchange</strong>. Separately, <strong>Adobe</strong> has issued security updates for <strong>Acrobat/Reader</strong> and <strong>Flash Player</strong>.</p>
<p><img class="alignright size-full wp-image-26837" src="media/863df0f6.brokenwindows.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2014/07/brokenwindows.png" alt="" width="229" height="240" />According to security firm <a href="https://www.rapid7.com/" target="_blank" rel="noopener">Rapid 7</a>, two of the vulnerabilities &#8212; <a href="https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0803" target="_blank" rel="noopener">CVE-2019-0803</a> and <a href="https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0859" target="_blank" rel="noopener">CVE-2019-0859</a> &#8212; are already being exploited in the wild. They can result in unauthorized elevation of privilege, and affect all supported versions of Windows.</p>
<p>&#8220;An attacker must already have local access to an affected system to use these to gain kernel-level code execution capabilities,&#8221; Rapid7 researcher <strong>Greg Wiseman</strong> observed. &#8220;However, one of the 32 Remote Code Execution (RCE) vulnerabilities patched today could potentially be used with them in an exploit chain to obtain full control of a system.&#8221;</p>
<p>Aside from these zero-day privilege escalation flaws, Wiseman said, it&#8217;s a fairly standard Patch Tuesday.</p>
<p>&#8220;Which of course still means that there are bugs that should be patched as soon as possible, such as the eight vulnerabilities classified as critical in the scripting engine used by Microsoft browsers, and CVE-<a href="https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/CVE-2019-0822" target="_blank" rel="noopener">2019-0822</a> (an RCE in Microsoft Office that can be exploited by convincing a user to open a malicious file).&#8221;</p>
<p><img class="alignleft size-full wp-image-2614" src="media/3d91e05a.shockwave.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2010/04/shockwave.jpg" alt="" width="197" height="120" />Adobe&#8217;s Patch Tuesday includes security updates for its <a href="https://helpx.adobe.com/security/products/flash-player/apsb19-19.html" target="_blank" rel="noopener">Flash Player and AIR software</a>,  as well as <a href="https://helpx.adobe.com/security/products/acrobat/apsb19-17.html" target="_blank" rel="noopener">Adobe Reader and Acrobat.</a></p>
<p>Flash updates are installed along with other monthly Windows patch rollups for consumers, and auto-installed by Google Chrome, but users may need to reboot the operating system (in the case of IE/Edge) or the browser (in Chrome) for the new updates to take effect.</p>
<p>Adobe&#8217;s actions also sound the death knell for <strong>Adobe Shockwave Player</strong>, which has at long last reached end-of-life.</p>
<p>That means no more security updates for Shockwave, which has always been something of an ugly stepchild to Flash. That is to say, Shockwave <a href="https://krebsonsecurity.com/2014/05/why-you-should-ditch-adobe-shockwave/" target="_blank" rel="noopener">never really got the security attention Flash has received</a> but nevertheless has been just as vulnerable and often <a href="https://krebsonsecurity.com/2012/12/shocking-delay-in-fixing-adobe-shockwave-bug/" target="_blank" rel="noopener">lagging months or years behind Flash in terms of updates</a>.<span id="more-47263"></span></p>
<p><strong>Chris Goettl</strong>, director of product management and security for security firm <a href="https://www.ivanti.com/company/about-ivanti" target="_blank" rel="noopener" data-saferedirecturl="https://www.google.com/url?q=https://www.ivanti.com/company/about-ivanti&amp;source=gmail&amp;ust=1554924550527000&amp;usg=AFQjCNEyhYTU-sy-ui_6EPJOOr5uF_g6qw">Ivanti</a>, <a href="https://www.ivanti.com/blog/april-patch-tuesday-2019" target="_blank" rel="noopener">said</a> Windows users need to get any existing Shockwave installations out of their environments now.</p>
<p>&#8220;There are 7 vulnerabilities that are going to be vulnerable for the majority of Shockwave installs still in existence,&#8221; Goettl said. &#8220;You can bet an exploit is imminent there.&#8221;</p>
<p>Standard advice: Staying up-to-date on Windows patches is good. Updating only after you’ve backed up your important data and files is even better. A good backup means you’re not pulling your hair out if the odd buggy patch causes problems booting the system.</p>
<p><strong>Windows 10</strong> likes to install patches all in one go and reboot your computer on its own schedule. Microsoft doesn’t make it easy for Windows 10 users to change this setting, <a href="https://www.howtogeek.com/224471/how-to-prevent-windows-10-from-automatically-downloading-updates/" target="_blank" rel="noopener">but it is possible</a>. For all other Windows OS users, if you’d rather be alerted to new updates when they’re available so you can choose when to install them, there’s a setting for that in <strong>Windows Update</strong>.</p>
<p>As always, if you experience any problems installing any of these patches this month, please feel free to leave a comment about it below; there’s a good chance other readers have experienced the same and may even chime in here with some helpful tips.</p>
<p>Further reading:</p>
<p><a href="https://blog.qualys.com/laws-of-vulnerabilities/2019/04/09/april-2019-patch-tuesday-74-vulns-16-critical-2-actively-attacked-1-poc-exploit-adobe-vulns" target="_blank" rel="noopener">Qualys on Patch Tuesday</a></p>
<p><a href="https://isc.sans.edu/forums/diary/Microsoft+April+2019+Patch+Tuesday/24826/" target="_blank" rel="noopener">SANS Internet Storm Center&#8217;s Patch Tuesday Priorities.</a></p>
<p><a href="https://www.ghacks.net/2019/04/09/microsoft-windows-security-updates-april-2019-overview/" target="_blank" rel="noopener">Martin Brinkmann of Ghacks.net</a></p>


feed_id: https://krebsonsecurity.com/?p=47261
title: Android 7.0+ Phones Can Now Double as Google Security Keys
uri: Android-7-0-Phones-Can-Now-Double-as-Google-Security-Keys
url: https://krebsonsecurity.com/2019/04/android-7-0-phones-can-now-double-as-google-security-keys/
content:
<p><strong>Google</strong> this week made it easier for <strong>Android</strong> users to enable strong 2-factor authentication (2FA) when logging into Google&#8217;s various services. The company announced that all phones running Android 7.0 and higher can now be used as <strong>Security Keys</strong>, an additional authentication layer that helps thwart phishing sites and password theft.</p>
<p>As <a href="https://krebsonsecurity.com/2018/07/google-security-keys-neutralized-employee-phishing/" target="_blank" rel="noopener">first disclosed by KrebsOnSecurity last summer</a>, Google maintains it has not had any of its 85,000+ employees successfully phished on their work-related accounts since early 2017, when it began requiring all employees to use physical Security Keys in place of passwords and one-time codes.</p>
<p><img class="aligncenter wp-image-47322" src="media/63ec93ca.androidkey.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/04/androidkey.png" alt="" width="581" height="535" /></p>
<p>The most commonly used Security Keys are inexpensive USB-based devices that offer an alternative approach to 2FA, which requires the user to log in to a Web site using something they know (the password) and something they have (e.g. a one-time token, key fob or mobile device).</p>
<p>But Google said starting this week, any mobile phone running Android 7.0+ (Nougat) <a href="https://www.blog.google/technology/safety-security/your-android-phone-is-a-security-key/" target="_blank" rel="noopener">can serve the same function as a USB-based security key</a>. Once a user has enrolled their Android phone as a Security Key, the user will need to approve logins via a prompt sent to their phone after submitting their username and password at a Google login page.</p>
<p>Many readers have expressed confusion or skepticism about how Security Keys can prevent users from getting hooked by phishing sites or clever man-in-the-middle attacks. This capability was described in far greater visual detail in this video last year by <strong>Christiaan Brand</strong>, product manager at Google Cloud.</p>
<div align="center"><iframe src="https://www.youtube.com/embed/Tq9BO0D9YP0" width="560" height="315" frameborder="0" allowfullscreen="allowfullscreen"></iframe></div>
<p>But the short version is that even if a user who has enrolled a Security Key for authentication tries to log in at a site pretending to be Google, the company&#8217;s systems simply refuse to request the Security Key if the user isn&#8217;t on an official Google site, and the login attempt fails.</p>
<p>&#8220;It puts you in this mode&#8230;.[in] which is there is no other way to log in apart from the Security Key,&#8221; Brand said. &#8220;No one can trick you into a downgrade attack, no one can trick you into anything different. You need to provide a security key or you don’t get into your account.&#8221;</p>
<p>Google says built-in security keys available on phones running Android 7.0+ (Nougat) with Google Play Services, enabling existing phones to act as users’ primary 2FA method for work (G Suite, Cloud Identity, and GCP) and personal Google accounts to sign in on a Bluetooth-enabled <strong>Chrome OS</strong>, <strong>macOS X</strong>, or <strong>Windows 10</strong> device with a <strong>Chrome</strong> browser.<span id="more-47261"></span></p>
<p>The basic idea behind two-factor authentication (Google calls it &#8220;two step verification&#8221; or 2SV) is that even if thieves manage to phish or steal your password, they still cannot log in to your account unless they also hack or possess that second factor.</p>
<p>The most common forms of 2FA require the user to supplement a password with a one-time code sent to their mobile device via an app (like <a href="https://authy.com/" target="_blank" rel="noopener">Authy</a> or <a href="https://play.google.com/store/apps/details?id=com.google.android.apps.authenticator2&amp;hl=en_US" target="_blank" rel="noopener">Google Authenticator</a>), text message, or an automated phone call. But all of these methods are susceptible to interception by various attacks.</p>
<p>For example, thieves can intercept that one-time code by tricking your mobile provider into either <a href="https://krebsonsecurity.com/2018/05/t-mobile-employee-made-unauthorized-sim-swap-to-steal-instagram-account/" target="_blank" rel="noopener">swapping your mobile device’s SIM card</a> or <a href="https://krebsonsecurity.com/2018/02/how-to-fight-mobile-number-port-out-scams/" target="_blank" rel="noopener">“porting” your mobile number</a> to a different device.</p>
<p>A Security Key implements a form of multi-factor authentication known as <strong>Universal 2nd Factor (U2F)</strong>, which allows the user to complete the login process simply by inserting the USB device and pressing a button on the device. The key works without the need for any special software drivers.</p>
<p>Probably the most popular maker of Security Keys is <a href="https://www.yubico.com/" target="_blank" rel="noopener">Yubico</a>, which sells a basic U2F key for $20 (it offers regular USB versions as well as those made for devices that require USB-C connections, such as Apple’s newer <strong>Mac OS</strong> systems). Yubikey also sells more expensive U2F keys designed to work with mobile devices.</p>
<p>A number of high-profile sites now allow users to enroll their accounts with USB- or Bluetooth-based Security Keys, including <strong>Dropbox</strong>, <strong>Facebook</strong>, <strong>Github</strong> and <strong>Twitter</strong>. If you decide to use Security Keys with your account, it&#8217;s a good idea to register a backup key and keep it in a safe place, so you can still get into your account if you loose your initial key (or phone, in Google&#8217;s case).</p>
<p>To be sure you&#8217;re using the most robust forms of authentication at sites you entrust with sensitive data, spend a few minutes reviewing the options at <a href="https://www.twofactorauth.org" target="_blank" rel="noopener">twofactorauth.org</a>, which maintains probably the most comprehensive list of which sites support 2FA, indexing each by type of site (email, gaming, finance, etc) and the type of 2FA offered (SMS, phone call, software token, etc.).</p>
<p>Please bear in mind that <em>if the only 2FA options offered by a site you frequent are SMS and/or phone calls, this is still better than simply relying on a password to secure your account.</em></p>
<p>I should also note that Google says Android 7.0+ phones also can be used as the Security Key for people who have adopted the company&#8217;s super-paranoid <a href="https://landing.google.com/advancedprotection/" target="_blank" rel="noopener">Advanced Protection</a> option. This is a far more stringent authentication process for Google properties designed specifically for users who are most likely to be targeted by sophisticated attacks, such as journalists, activists, business leaders and political campaigns.</p>
<p>I&#8217;ve had Advanced Protection turned on since shortly after Google made it available. It wasn&#8217;t terribly difficult to set up, but it&#8217;s probably not for your casual user. For one thing, it requires users to enroll two security keys, and in the event the user loses both of those keys, Google may take days to validate your request and grant you access to your account.</p>


feed_id: https://krebsonsecurity.com/?p=46986
title: ‘Land Lordz’ Service Powers Airbnb Scams
uri: Land-Lordz-Service-Powers-Airbnb-Scams
url: https://krebsonsecurity.com/2019/04/land-lordz-service-powers-airbnb-scams/
content:
<p>Scammers who make a living swindling <strong>Airbnb.com</strong> customers have a powerful new tool at their disposal: A software-as-a-service offering called &#8220;<strong>Land Lordz</strong>,&#8221; which helps automate the creation and management of fake Airbnb Web sites and the sending of messages to advertise the fraudulent listings.</p>
<p>The ne&#8217;er-do-well who set up the account below has been paying $550 a month for a Land Lordz &#8220;basic plan&#8221; subscription at landlordz[.]site that helps him manage more than 500 scam properties and interactions with up to 100 (soon-to-be-scammed) &#8220;guests&#8221; looking to book the fake listings. Currently, this scammer has just four dozen listings, virtually all of which are for properties in London and the surrounding United Kingdom.</p>
<div id="attachment_47349" style="width: 607px" class="wp-caption aligncenter"><a class="lightbox" href="media/82c5a87d.landlordsscamprices.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/04/landlordsscamprices.jpg"><img class="wp-image-47349" src="media/82c5a87d.landlordsscamprices.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/04/landlordsscamprices.jpg" alt="" width="597" height="266" /></a><p class="wp-caption-text">The Land Lordz administrative panel for a scammer who&#8217;s running dozens of Airbnb scams in the United Kingdom.</p></div>
<p>Your typical victim will respond to an advertisement for a listing provided at Airbnb.com, and be assured they can pay through Airbnb, which offers buyer protection and refunds for unhappy customers. But when the interested party inquires about the listing, they are sent a link to a site that looks like Airbnb.com but which is actually a phishing page.</p>
<p>In the case of these particular fraudsters, their fake page was &#8220;<strong>airbnb.longterm-airbnb[.]co[.]uk</strong>&#8221; (I&#8217;ve added brackets to prevent the link from being clickable). The site looks exactly like the real Airbnb, includes pictures of the requested property, and steers visitors toward signing in or to creating a new account. The fake site simply forwards all requests on this page to Airbnb.com, and records any usernames and passwords submitted through the site.</p>
<div id="attachment_47364" style="width: 608px" class="wp-caption aligncenter"><a class="lightbox" href="media/74e98f43.ll-loggedguest.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/04/ll-loggedguest.jpg"><img class="wp-image-47364" src="media/74e98f43.ll-loggedguest.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/04/ll-loggedguest.jpg" alt="" width="598" height="320" /></a><p class="wp-caption-text">The fake Airbnb site used by the scammers logged all Airbnb credentials submitted by new and existing users.</p></div>
<p><span id="more-46986"></span></p>
<p>Here&#8217;s a look at some of the properties listed for rent by these scammers. All of the names and images on these listings have been lifted from other legitimate listings.</p>
<div id="attachment_47363" style="width: 604px" class="wp-caption aligncenter"><a class="lightbox" href="media/36485d06.ll-properties.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/04/ll-properties.jpg"><img class="wp-image-47363" src="media/36485d06.ll-properties.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/04/ll-properties.jpg" alt="" width="594" height="320" /></a><p class="wp-caption-text">Fake properties for rent, as listed by the Land Lordz Airbnb scam service.</p></div>
<p>The Land Lordz service includes several sets of default positive comments from fake past reviewers that can be used to populate the phony listings. The non-existent home and apartment rentals offered by these scammers are all sold on monthly rates, and the seller&#8217;s page says buyers must pay a deposit of the first month before the date is locked in.</p>
<div id="attachment_47358" style="width: 603px" class="wp-caption aligncenter"><a class="lightbox" href="media/dcdbabe1.ll-fakecomments.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/04/ll-fakecomments.jpg"><img class="wp-image-47358" src="media/dcdbabe1.ll-fakecomments.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/04/ll-fakecomments.jpg" alt="" width="593" height="272" /></a><p class="wp-caption-text">A phony comments generator page.</p></div>
<p>The Land Lordz panel lets the scammer keep track of all messages with would-be victims, who are strung along and told the reservation on the residence will be lifted unless a cash deposit is made within 72 hours. Here&#8217;s one from would-be victim Shanon, on March 28, 2019, to the scammers.</p>
<blockquote><p>Shanon: My partner wants to see the place before we send money over as we done this last time and someone scammed us I ain’t saying your not legit as you have send documents with details on name etc</p>
<p>Scammer: &#8220;Hello, The property is still available for your dates. The price is € 250 + €500 secure deposit. As security deposit needs to be added ,discount needs to be applied please follow the airbnb link&#8221; (which goes to the fake Airbnb page).</p></blockquote>
<p><strong>Alex Holden</strong>, chief information security officer of <a href="https://www.holdsecurity.com" target="_blank" rel="noopener">Hold Security LLC</a> and the researcher who shared screen shots of this fraud panel, said the scammers appear to be advertising their fake listings primarily via <a href="https://www.gumtree.com" target="_blank" rel="noopener">Gumtree</a>, a free classifieds service in the U.K.</p>
<p><strong>People who lose money in these scams fail big time on two things.</strong> First, they fail to notice they are not on airbnb.com. More importantly, they end up wiring money to secure the promise of a fake apartment or home in another country, and the thieves cut off all communications at that point.</p>
<p>Like they did to this poor sucker, who paid $1,200 in exchange for a piece of paper which promised they&#8217;d hand over keys to the apartment at a specific date:</p>
<div id="attachment_47357" style="width: 607px" class="wp-caption aligncenter"><a class="lightbox" href="media/a14918b0.ll-pickupkeys.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/04/ll-pickupkeys.png"><img class="wp-image-47357" src="media/a14918b0.ll-pickupkeys.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/04/ll-pickupkeys.png" alt="" width="597" height="281" /></a><p class="wp-caption-text">The subject of this victim&#8217;s message &#8220;pickup of keys&#8221; says it all.</p></div>
<p><a href="https://www.goatsontheroad.com/airbnb-scam/" target="_blank" rel="noopener">This 2018 story</a> from travel blog <strong>goatsontheroad.com</strong> tells the tale of a couple that was very nearly scammed by a Land Lordz-like trap, before the wife figures out they&#8217;re no longer on airbnb.com.</p>
<p>It&#8217;s important to note that these scams can just as likely target users of Airbnb as they can other services, such as craigslist.com and booking.com. Be wary of clicking on links in emails from property hosts, and make sure you are always on Airbnb or whatever site you think you&#8217;re on.</p>
<p>Airbnb could help by adding some type of robust multi-factor authentication, such as <a href="https://krebsonsecurity.com/2019/04/android-7-0-phones-can-now-double-as-google-security-keys/" target="_blank" rel="noopener">Security Keys</a> &#8212; which would defeat these Airbnb phishing pages. According to <a href="https://twofactorauth.org/" target="_blank" rel="noopener">twofactorauth.org</a>, Airbnb currently does not support <em><span style="text-decoration: underline;">any</span></em> type of multi-factor authentication that users can enable.</p>
<p>Airbnb.com <a href="https://www.airbnb.com/help/article/501/how-can-i-keep-my-account-secure" target="_blank" rel="noopener">says</a> if the company detects something phishy about a login for your account it may ask you to enter a security code sent to your phone or email address, or verify some of your account details.</p>
<p>In case anyone would like to follow up on this research, other domains used by these scammers include <strong>airbnb.longterm-airbnb[.]co.uk</strong>, <strong>airbnb.pt-anuncio[.]com</strong>, <strong>airbnb.request-online[.]com</strong>, and <strong>airbnb-invoice[.]com</strong>. Some of the bank accounts and payment recipients from scams tied to <a href="https://prnt.sc/mi16us" target="_blank" rel="noopener">these</a> <a href="https://icq.com/files/0kEbCWx6ZaUMEn5keOnpaP5c6c6f731bd" target="_blank" rel="noopener">listings</a> <a href="https://imgur.com/a/yM7C7Bc" target="_blank" rel="noopener">are</a> <a href="https://icq.com/files/0aXlUet2yPXzmgzK7MdrP85c73a6c11bd" target="_blank" rel="noopener">pictured</a> <a href="https://imgur.com/a/30wWNEw" target="_blank" rel="noopener">here</a>.</p>


