# articles

feed_id: https://krebsonsecurity.com/?p=66726
title: Incognito Darknet Market Mass-Extorts Buyers, Sellers
uri: Incognito-Darknet-Market-Mass-Extorts-Buyers-Sellers
url: https://krebsonsecurity.com/2024/03/incognito-darknet-market-mass-extorts-buyers-sellers/
content:
<p>Borrowing from the playbook of ransomware purveyors, the darknet narcotics bazaar <strong>Incognito Market</strong> has begun extorting all of its vendors and buyers, threatening to publish cryptocurrency transaction and chat records of users who refuse to pay a fee ranging from $100 to $20,000. The bold mass extortion attempt comes just days after Incognito Market administrators reportedly pulled an &#8220;exit scam&#8221; that left users unable to withdraw millions of dollars worth of funds from the platform.</p>
<div id="attachment_66727" style="width: 761px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-66727" decoding="async" class=" wp-image-66727" src="media/1bb51008.incognito-extortion.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/03/incognito-extortion.png" alt="" width="751" height="197" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/03/incognito-extortion.png 1370w, https://krebsonsecurity.com/wp-content/uploads/2024/03/incognito-extortion-768x201.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/03/incognito-extortion-782x205.png 782w" sizes="(max-width: 751px) 100vw, 751px" /><p id="caption-attachment-66727" class="wp-caption-text">An extortion message currently on the Incognito Market homepage.</p></div>
<p>In the past 24 hours, the homepage for the Incognito Market was updated to include a blackmail message from its owners, saying they will soon release purchase records of vendors who refuse to pay to keep the records confidential.</p>
<p>&#8220;We got one final little nasty surprise for y&#8217;all,&#8221; reads the message to Incognito Market users. &#8220;We have accumulated a list of private messages, transaction info and order details over the years. You&#8217;ll be surprised at the number of people that relied on our &#8216;auto-encrypt&#8217; functionality. And by the way, your messages and transaction IDs were never actually deleted after the &#8216;expiry&#8217;&#8230;.SURPRISE SURPRISE!!! Anyway, if anything were to leak to law enforcement, I guess nobody never slipped up.&#8221;</p>
<p>Incognito Market says it plans to publish the entire dump of 557,000 orders and 862,000 cryptocurrency transaction IDs at the end of May.</p>
<p>&#8220;Whether or not you and your customers&#8217; info is on that list is totally up to you,&#8221; the Incognito administrators advised. &#8220;And yes, this is an extortion!!!!&#8221;</p>
<p>The extortion message includes a &#8220;Payment Status&#8221; page that lists the darknet market&#8217;s top vendors by their handles, saying at the top that &#8220;you can see which vendors care about their customers below.&#8221; The names in green supposedly correspond to users who have already opted to pay.</p>
<div id="attachment_66729" style="width: 755px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-66729" decoding="async" loading="lazy" class=" wp-image-66729" src="media/8f7c9d2e.incognito-status.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/03/incognito-status.png" alt="" width="745" height="394" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/03/incognito-status.png 1486w, https://krebsonsecurity.com/wp-content/uploads/2024/03/incognito-status-768x406.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/03/incognito-status-782x414.png 782w, https://krebsonsecurity.com/wp-content/uploads/2024/03/incognito-status-267x140.png 267w" sizes="(max-width: 745px) 100vw, 745px" /><p id="caption-attachment-66729" class="wp-caption-text">The &#8220;Payment Status&#8221; page set up by the Incognito Market extortionists.</p></div>
<p>We&#8217;ll be publishing the entire dump of 557k orders and 862k crypto transaction IDs at the end of May, whether or not you and your customers&#8217; info is on that list is totally up to you. And yes, this is an extortion!!!!</p>
<p>Incognito Market said it plans to open up a &#8220;whitelist portal&#8221; for buyers to remove their transaction records &#8220;in a few weeks.&#8221;<span id="more-66726"></span></p>
<p>The mass-extortion of Incognito Market users comes just days after a large number of users reported they were no longer able to withdraw funds from their buyer or seller accounts. The cryptocurrency-focused publication <strong>Cointelegraph.com</strong> <a href="https://cointelegraph.com/news/bitcoin-monero-reportedly-stolen-darknet-market-exit-scam" target="_blank" rel="noopener">reported Mar. 6</a> that Incognito was exit-scamming its users out of their bitcoins and Monero deposits.</p>
<p>CoinTelegraph notes that Incognito Market administrators initially lied about the situation, and blamed users&#8217; difficulties in withdrawing funds on recent changes to Incognito&#8217;s withdrawal systems.</p>
<p>Incognito Market deals primarily in narcotics, so it&#8217;s likely many users are now worried about being outed as drug dealers. Creating a new account on Incognito Market presents one with an ad for 5 grams of heroin selling for $450.</p>
<div id="attachment_66730" style="width: 759px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-66730" decoding="async" loading="lazy" class=" wp-image-66730" src="media/e8663876.incognito-heroin.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/03/incognito-heroin.png" alt="" width="749" height="558" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/03/incognito-heroin.png 913w, https://krebsonsecurity.com/wp-content/uploads/2024/03/incognito-heroin-768x572.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/03/incognito-heroin-782x582.png 782w" sizes="(max-width: 749px) 100vw, 749px" /><p id="caption-attachment-66730" class="wp-caption-text">New Incognito Market users are treated to an ad for $450 worth of heroin.</p></div>
<p>The double whammy now hitting Incognito Market users is somewhat akin to the double extortion techniques employed by many modern ransomware groups, wherein victim organizations are hacked, relieved of sensitive information and then presented with two separate ransom demands: One in exchange for a digital key needed to unlock infected systems, and another to secure a promise that any stolen data will not be published or sold, and will be destroyed.</p>
<p>Incognito Market has priced its extortion for vendors based on their status or &#8220;level&#8221; within the marketplace. Level 1 vendors can supposedly have their information removed by paying a $100 fee. However, larger &#8220;Level 5&#8221; vendors are asked to cough up $20,000 payments.</p>
<p><img decoding="async" loading="lazy" class="aligncenter wp-image-66733" src="media/9011dff0.extortionprices.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/03/extortionprices.png" alt="" width="750" height="240" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/03/extortionprices.png 863w, https://krebsonsecurity.com/wp-content/uploads/2024/03/extortionprices-768x246.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/03/extortionprices-782x250.png 782w" sizes="(max-width: 750px) 100vw, 750px" /></p>
<p>The past is replete with examples of similar darknet market exit scams, which tend to happen eventually to all darknet markets that aren&#8217;t seized and shut down by federal investigators, said <strong>Brett Johnson</strong>, a convicted and reformed cybercriminal who built the organized cybercrime community Shadowcrew many years ago.</p>
<p>&#8220;Shadowcrew was the precursor to today&#8217;s Darknet Markets and laid the foundation for the way modern cybercrime channels still operate today,&#8221; Johnson said. &#8220;The Truth of Darknet Markets? ALL of them are Exit Scams. The only question is whether law enforcement can shut down the market and arrest its operators before the exit scam takes place.&#8221;</p>


feed_id: https://krebsonsecurity.com/?p=66578
title: Patch Tuesday, March 2024 Edition
uri: Patch-Tuesday-March-2024-Edition
url: https://krebsonsecurity.com/2024/03/patch-tuesday-march-2024-edition/
content:
<p><strong>Apple</strong> and <strong>Microsoft</strong> recently released software updates to fix dozens of security holes in their operating systems. Microsoft today patched at least 60 vulnerabilities in its <strong>Windows OS</strong>. Meanwhile, Apple&#8217;s new <strong>macOS Sonoma</strong> addresses at least 68 security weaknesses, and its latest updates for iOS fixes two zero-day flaws.</p>
<p><img decoding="async" class="size-full wp-image-66741 aligncenter" src="media/4ab005b7.macOS-ios.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/03/macOS-ios.png" alt="" width="618" height="409" /></p>
<p>Last week, Apple pushed out an urgent software update to its flagship iOS platform, <a href="https://securityweek.com/apple-blunts-zero-day-attacks-with-ios-17-4-update/" target="_blank" rel="noopener">warning</a> that there were at least two zero-day exploits for vulnerabilities being used in the wild (CVE-2024-23225 and CVE-2024-23296). The security updates are available in <strong>iOS 17.4</strong>, <strong>iPadOS 17.4</strong>, and <strong>iOS 16.7.6</strong>.</p>
<p>Apple&#8217;s <strong>macOS</strong> <strong>Sonoma 14.4 Security Update</strong> addresses dozens of security issues. <strong>Jason Kitka</strong>, chief information security officer at <strong>Automox</strong>, said the vulnerabilities patched in this update often stem from memory safety issues, a concern that has led to a broader industry conversation about the adoption of memory-safe programming languages [full disclosure: Automox is an advertiser on this site].</p>
<p>On Feb. 26, 2024, the Biden administration <a href="https://www.whitehouse.gov/oncd/briefing-room/2024/02/26/memory-safety-statements-of-support/" target="_blank" rel="noopener">issued a report</a> that calls for greater adoption of memory-safe programming languages. On Mar. 4, 2024, Google published <a href="https://security.googleblog.com/2024/03/secure-by-design-googles-perspective-on.html" target="_blank" rel="noopener">Secure by Design</a>, which lays out the company&#8217;s perspective on memory safety risks.</p>
<p>Mercifully, there do not appear to be any zero-day threats hounding Windows users this month (at least not yet). <strong>Satnam Narang</strong>, senior staff research engineer at <strong>Tenable</strong>, notes that of the 60 CVEs in this month’s Patch Tuesday release, only six are considered &#8220;more likely to be exploited&#8221; according to Microsoft.</p>
<p>Those more likely to be exploited bugs are mostly &#8220;elevation of privilege vulnerabilities&#8221; including <a href="https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2024-26182" target="_blank" rel="noopener">CVE-2024-26182</a> (Windows Kernel), <a href="https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2024-26170" target="_blank" rel="noopener">CVE-2024-26170</a> (Windows Composite Image File System (CimFS), <a href="https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2024-21437" target="_blank" rel="noopener">CVE-2024-21437</a> (Windows Graphics Component), and <a href="https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2024-21433" target="_blank" rel="noopener">CVE-2024-21433</a> (Windows Print Spooler).</p>
<p>Narang highlighted <a href="https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2024-21390" target="_blank" rel="noopener">CVE-2024-21390</a> as a particularly interesting vulnerability in this month’s Patch Tuesday release, which is an elevation of privilege flaw in <strong>Microsoft Authenticator</strong>, the software giant&#8217;s app for multi-factor authentication. Narang said a prerequisite for an attacker to exploit this flaw is to already have a presence on the device either through malware or a malicious application.<span id="more-66578"></span></p>
<p>&#8220;If a victim has closed and re-opened the Microsoft Authenticator app, an attacker could obtain multi-factor authentication codes and modify or delete accounts from the app,&#8221; Narang said. &#8220;Having access to a target device is bad enough as they can monitor keystrokes, steal data and redirect users to phishing websites, but if the goal is to remain stealth, they could maintain this access and steal multi-factor authentication codes in order to login to sensitive accounts, steal data or hijack the accounts altogether by changing passwords and replacing the multi-factor authentication device, effectively locking the user out of their accounts.&#8221;</p>
<p><a href="https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2024-21334" target="_blank" rel="noopener">CVE-2024-21334</a> earned a CVSS (danger) score of 9.8 (1o is the worst), and it concerns a weakness in <strong>Open Management Infrastructure</strong> (OMI), a Linux-based cloud infrastructure in <strong>Microsoft Azure</strong>. Microsoft says attackers could connect to OMI instances over the Internet without authentication, and then send specially crafted data packets to gain remote code execution on the host device.</p>
<p><a href="https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2024-21435" target="_blank" rel="noopener">CVE-2024-21435</a> is a CVSS 8.8 vulnerability in Windows OLE, which acts as a kind of backbone for a great deal of communication between applications that people use every day on Windows, said <strong>Kevin Breen</strong>, senior director of threat research at <strong>Immersive Labs</strong>.</p>
<p>&#8220;With this vulnerability, there is an exploit that allows remote code execution, the attacker needs to trick a user into opening a document, this document will exploit the OLE engine to download a malicious DLL to gain code execution on the system,&#8221; Breen explained. &#8220;The attack complexity has been described as low meaning there is less of a barrier to entry for attackers.&#8221;</p>
<p>A full list of the vulnerabilities addressed by Microsoft this month is available at the <a href="https://isc.sans.edu/forums/diary/Microsoft+Patch+Tuesday+March+2024/30736/" target="_blank" rel="noopener">SANS Internet Storm Center</a>, which breaks down the updates by severity and urgency.</p>
<p>Finally, Adobe today issued security updates that fix dozens of security holes in a wide range of products, including <strong>Adobe Experience Manager</strong>, <strong>Adobe Premiere Pro</strong>, <strong>ColdFusion 2023</strong> and <strong>2021</strong>, <strong>Adobe Bridge</strong>, <strong>Lightroom</strong>, and <strong>Adobe Animate</strong>. Adobe said it is not aware of active exploitation against any of the flaws.</p>
<p>By the way, Adobe recently enrolled all of its <strong>Acrobat</strong> users into a &#8220;new generative AI feature&#8221; that scans the contents of your PDFs so that its new &#8220;AI Assistant&#8221; can  &#8220;understand your questions and provide responses based on the content of your PDF file.&#8221; Adobe provides instructions on how to disable the AI features and opt out <a href="https://helpx.adobe.com/acrobat/using/disable-generative-ai.html" target="_blank" rel="noopener">here</a>.</p>
<p><img decoding="async" loading="lazy" class="size-full wp-image-66740 aligncenter" src="media/35c9f7b8.adobe-ai.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/03/adobe-ai.png" alt="" width="571" height="738" /></p>


feed_id: https://krebsonsecurity.com/?p=66752
title: CEO of Data Privacy Company Onerep.com Founded Dozens of People-Search Firms
uri: CEO-of-Data-Privacy-Company-Onerep-com-Founded-Dozens-of-People-Search
url:
https://krebsonsecurity.com/2024/03/ceo-of-data-privacy-company-onerep-com-founded-dozens-of-people-search-firms/

content:
<p>The data privacy company <strong>Onerep.com</strong> bills itself as a Virginia-based service for helping people remove their personal information from almost 200 people-search websites. However, an investigation into the history of onerep.com finds this company is operating out of Belarus and Cyprus, and that its founder has launched dozens of people-search services over the years.</p>
<p>Onerep&#8217;s &#8220;Protect&#8221; service starts at $8.33 per month for individuals and $15/mo for families, and promises to remove your personal information from nearly 200 people-search sites. Onerep also markets its service to companies seeking to offer their employees the ability to have their data continuously removed from people-search sites.</p>
<div id="attachment_66754" style="width: 260px" class="wp-caption alignright"><img aria-describedby="caption-attachment-66754" decoding="async" class=" wp-image-66754" src="media/3d6b31cf.onerep-permanente.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/03/onerep-permanente.png" alt="" width="250" height="436" /><p id="caption-attachment-66754" class="wp-caption-text">A testimonial on onerep.com.</p></div>
<p>Customer case studies published on onerep.com state that it struck a deal to offer the service to employees of <strong>Permanente Medicine</strong>, which represents the doctors within the health insurance giant <strong>Kaiser Permanente</strong>. Onerep also says it has made inroads among police departments in the United States.</p>
<p>But a review of Onerep&#8217;s domain registration records and that of its founder reveal a different side to this company. Onerep.com says its founder and CEO is <strong>Dimitri Shelest</strong> from Minsk, Belarus, as does <a href="https://www.linkedin.com/in/dimitri-shelest-183626174/" target="_blank" rel="noopener">Shelest&#8217;s profile on LinkedIn</a>. Historic registration records indexed by <a href="https://www.domaintools.com" target="_blank" rel="noopener">DomainTools.com</a> say Mr. Shelest was a registrant of onerep.com who used the email address <strong>dmitrcox2@gmail.com</strong>.</p>
<p>A search in the data breach tracking service <a href="https://constella.ai" target="_blank" rel="noopener">Constella Intelligence</a> for the name Dimitri Shelest brings up the email address <strong>dimitri.shelest@onerep.com</strong>. Constella also finds that Dimitri Shelest from Belarus used the email address <strong>d.sh@nuwber.com</strong>, and the Belarus phone number <strong>+375-292-702786</strong>.</p>
<p>Nuwber.com is a people search service whose employees all appear to be from Belarus, and it is one of dozens of people-search companies that Onerep claims to target with its data-removal service. Onerep.com&#8217;s website disavows any relationship to Nuwber.com, stating quite clearly, &#8220;Please note that OneRep is not associated with Nuwber.com.&#8221;</p>
<p>However, there is an abundance of evidence suggesting Mr. Shelest is in fact the founder of Nuwber. Constella found that Minsk telephone number (375-292-702786) has been used multiple times in connection with the email address <strong>dmitrcox@gmail.com</strong>. Recall that Onerep.com&#8217;s domain registration records in 2018 list the email address dmitrcox2@gmail.com.</p>
<p>It appears Mr. Shelest sought to reinvent his online identity in 2015 by adding a &#8220;2&#8221; to his email address. A search on the Belarus phone number tied to Nuwber.com shows up in the domain records for <strong>askmachine.org</strong>, and DomainTools says this domain is tied to both dmitrcox@gmail.com and dmitrcox2@gmail.com.</p>
<div id="attachment_66783" style="width: 759px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-66783" decoding="async" loading="lazy" class=" wp-image-66783" src="media/4cc78458.onerep-shellest.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/03/onerep-shellest.png" alt="" width="749" height="439" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/03/onerep-shellest.png 1275w, https://krebsonsecurity.com/wp-content/uploads/2024/03/onerep-shellest-768x450.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/03/onerep-shellest-782x458.png 782w" sizes="(max-width: 749px) 100vw, 749px" /><p id="caption-attachment-66783" class="wp-caption-text">Onerep.com CEO and founder Dimitri Shelest, as pictured on the &#8220;about&#8221; page of onerep.com.</p></div>
<p>A search in DomainTools for the email address dmitrcox@gmail.com shows it is associated with the registration of at least 179 domain names, including dozens of mostly now-defunct people-search companies targeting citizens of Argentina, Brazil, Canada, Denmark, France, Germany, Hong Kong, Israel, Italy, Japan, Latvia and Mexico, among others.</p>
<p>Those include <a href="https://web.archive.org/web/20160324064030/https://nuwber.fr/" target="_blank" rel="noopener"><strong>nuwber.fr</strong></a>, a site registered in 2016 which was identical to <a href="https://web.archive.org/web/20160616212526/https://nuwber.com/" target="_blank" rel="noopener">the homepage of Nuwber.com at the time</a>. DomainTools shows the same email and Belarus phone number are in historic registration records for <a href="https://web.archive.org/web/20170709170147/https://nuwber.at/" target="_blank" rel="noopener">nuwber.at</a>, <a href="https://web.archive.org/web/20160804065746/https://nuwber.ch/" target="_blank" rel="noopener">nuwber.ch</a>, and <a href="https://web.archive.org/web/20160806212859/https://nuwber.dk/" target="_blank" rel="noopener">nuwber.dk</a> (all domains linked here are to their cached copies at archive.org, where available).</p>
<div id="attachment_66755" style="width: 759px" class="wp-caption aligncenter"><a href="media/9041886c.nuwber-dot-com.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/03/nuwber-dot-com.png" target="_blank" rel="noopener"><img aria-describedby="caption-attachment-66755" decoding="async" loading="lazy" class="wp-image-66755" src="media/9041886c.nuwber-dot-com.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/03/nuwber-dot-com.png" alt="" width="749" height="477" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/03/nuwber-dot-com.png 1436w, https://krebsonsecurity.com/wp-content/uploads/2024/03/nuwber-dot-com-768x489.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/03/nuwber-dot-com-782x498.png 782w" sizes="(max-width: 749px) 100vw, 749px" /></a><p id="caption-attachment-66755" class="wp-caption-text">Nuwber.com, circa 2015. Image: Archive.org.</p></div>
<p>A review of historic WHOIS records for onerep.com show it was registered for many years to a resident of Sioux Falls, SD for a completely unrelated site. But around Sept. 2015 the domain switched from the registrar GoDaddy.com to eNom, and the registration records were hidden behind privacy protection services. DomainTools indicates around this time onerep.com started using domain name servers from DNS provider constellix.com. Likewise, Nuwber.com first appeared in late 2015, was also registered through eNom, and also started using constellix.com for DNS at nearly the same time.</p>
<p>Listed <a href="https://www.linkedin.com/in/dzmitrybukuyazau/" target="_blank" rel="noopener">on LinkedIn</a> as a former product manager at OneRep.com between 2015 and 2018 is <strong>Dimitri Bukuyazau</strong>, who says their hometown is Warsaw, Poland. While this LinkedIn profile (linkedin.com/in/<strong>dzmitry</strong>bukuyazau) does not mention Nuwber, a search on this name in Google turns up <a href="https://web.archive.org/web/20200906155823/https://www.privacyduck.com/comparisons/privacyduck-vs-onerep-com-the-eastern-european-privacy-company/" target="_blank" rel="noopener">a 2017 blog post from privacyduck.com</a>, which laid out a number of reasons to support a conclusion that OneRep and Nuwber.com were the same company.</p>
<p>&#8220;Any people search profiles containing your Personally Identifiable Information that were on Nuwber.com were also mirrored identically on OneRep.com, down to the relatives’ names and address histories,&#8221; Privacyduck.com wrote. The post continued:</p>
<blockquote><p>&#8220;Both sites offered the same immediate opt-out process. Both sites had the same generic contact and support structure. They were &#8211; and remain &#8211; the same company (even PissedConsumer.com advocates this fact: https://nuwber.pissedconsumer.com/nuwber-and-onerep-20160707878520.html).&#8221;</p>
<p>&#8220;Things changed in early 2016 when OneRep.com began offering privacy removal services right alongside their own open displays of your personal information. At this point when you found yourself on Nuwber.com OR OneRep.com, you would be provided with the option of opting-out your data on their site for free &#8211; but also be highly encouraged to pay them to remove it from a slew of other sites (and part of that payment was removing you from their own site, Nuwber.com, as a benefit of their service).&#8221;</p></blockquote>
<p>Reached via LinkedIn, Mr. Bukuyazau declined to answer questions, such as whether he ever worked at Nuwber.com. However, Constella Intelligence finds two interesting email addresses for employees at nuwber.com: d.bu@nuwber.com, and d.bu+figure-eight.com@nuwber.com, which was registered under the name &#8220;<strong>Dzmitry</strong>.&#8221;</p>
<p>PrivacyDuck&#8217;s claims about how onerep.com appeared and behaved in the early days are not readily verifiable because the domain onerep.com has been completely excluded from the Wayback Machine at archive.org. The Wayback Machine will honor such requests if they come directly from the owner of the domain in question.</p>
<p>Still, Mr. Shelest&#8217;s name, phone number and email also appear in the domain registration records for a truly dizzying number of country-specific people-search services, including <strong>pplcrwlr.in</strong>, <a href="https://web.archive.org/web/20150205232653/http://pplcrwlr.fr/" target="_blank" rel="noopener">pplcrwlr.fr</a>, <a href="https://web.archive.org/web/20150206043953/http://pplcrwlr.dk/" target="_blank" rel="noopener">pplcrwlr.dk</a>, <a href="https://web.archive.org/web/20150206005352/http://pplcrwlr.jp/" target="_blank" rel="noopener">pplcrwlr.jp</a>, <strong>peeepl.br.com</strong>, <strong>peeepl.in</strong>, <a href="https://web.archive.org/web/20130307194029/http://peeepl.it/" target="_blank" rel="noopener">peeepl.it</a> and <a href="https://web.archive.org/web/20140320054902/http://peeepl.co.uk/" target="_blank" rel="noopener">peeepl.co.uk</a>.</p>
<p>The same details appear in the WHOIS registration records for the now-defunct people-search sites <a href="https://web.archive.org/web/20140208014115/http://waatpp.de/" target="_blank" rel="noopener">waatpp.de</a>, <a href="https://web.archive.org/web/20150205232901/http://waatp1.fr/" target="_blank" rel="noopener">waatp1.fr</a>, <a href="https://web.archive.org/web/20120112131753/http://azersab.com/" target="_blank" rel="noopener">azersab.com</a>, and <a href="https://web.archive.org/web/20120507115825/http://ahavoila.com/" target="_blank" rel="noopener">ahavoila.com</a>, a people-search service for French citizens.<span id="more-66752"></span></p>
<div id="attachment_66756" style="width: 760px" class="wp-caption aligncenter"><a href="media/af7fed4c.waatp-de.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/03/waatp-de.png" target="_blank" rel="noopener"><img aria-describedby="caption-attachment-66756" decoding="async" loading="lazy" class="wp-image-66756" src="media/af7fed4c.waatp-de.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/03/waatp-de.png" alt="" width="750" height="345" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/03/waatp-de.png 1880w, https://krebsonsecurity.com/wp-content/uploads/2024/03/waatp-de-768x353.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/03/waatp-de-1536x707.png 1536w, https://krebsonsecurity.com/wp-content/uploads/2024/03/waatp-de-782x360.png 782w" sizes="(max-width: 750px) 100vw, 750px" /></a><p id="caption-attachment-66756" class="wp-caption-text">The German people-search site waatp.de.</p></div>
<p>A search on the email address dmitrcox@gmail.com suggests Mr. Shelest was previously involved in rather aggressive email marketing campaigns. In 2010, an anonymous source <a href="https://krebsonsecurity.com/2010/09/spam-affialite-program-spamit-com-to-close/" target="_blank" rel="noopener">leaked to KrebsOnSecurity</a> the financial and organizational records of <a href="https://krebsonsecurity.com/tag/spamit/" target="_blank" rel="noopener"><strong>Spamit</strong></a>, which at the time was easily the largest Russian-language pharmacy spam affiliate program in the world.</p>
<p>Spamit paid spammers a hefty commission every time someone bought male enhancement drugs from any of their spam-advertised websites. Mr. Shelest&#8217;s email address stood out because immediately after the Spamit database was leaked, KrebsOnSecurity searched all of the Spamit affiliate email addresses to determine if any of them corresponded to social media accounts at <strong>Facebook.com</strong> (at the time, Facebook allowed users to search profiles by email address).</p>
<p>That mapping, which was done mainly by generous graduate students at my alma mater <strong>George Mason University</strong>, revealed that dmitrcox@gmail.com was used by a Spamit affiliate, albeit not a very profitable one. That same <a href="https://www.facebook.com/dmitry.shelest" target="_blank" rel="noopener">Facebook profile for Mr. Shelest</a> is still active, and it says he is married and living in Minsk (last update: 2021).</p>
<div id="attachment_66757" style="width: 760px" class="wp-caption aligncenter"><a href="media/b4c3dfa1.peeepl.it_.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/03/peeepl.it_.png" target="_blank" rel="noopener"><img aria-describedby="caption-attachment-66757" decoding="async" loading="lazy" class="wp-image-66757" src="media/b4c3dfa1.peeepl.it_.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/03/peeepl.it_.png" alt="" width="750" height="345" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/03/peeepl.it_.png 1880w, https://krebsonsecurity.com/wp-content/uploads/2024/03/peeepl.it_-768x353.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/03/peeepl.it_-1536x707.png 1536w, https://krebsonsecurity.com/wp-content/uploads/2024/03/peeepl.it_-782x360.png 782w" sizes="(max-width: 750px) 100vw, 750px" /></a><p id="caption-attachment-66757" class="wp-caption-text">The Italian people-search website peeepl.it.</p></div>
<p>Scrolling down Mr. Shelest&#8217;s Facebook page to posts made more than ten years ago show him liking the Facebook profile pages for a large number of other people-search sites, including <a href="https://web.archive.org/web/20120215164504/http://findita.com/" target="_blank" rel="noopener">findita.com</a>, <a href="https://web.archive.org/web/20120611000147/http://findmedo.com/" target="_blank" rel="noopener">findmedo.com</a>, <a href="https://web.archive.org/web/20120202191444/http://folkscan.com/" target="_blank" rel="noopener">folkscan.com</a>, <a href="https://web.archive.org/web/20120204021306/http://huntize.com/" target="_blank" rel="noopener">huntize.com</a>, <a href="https://web.archive.org/web/20120201003010/http://ifindy.com/" target="_blank" rel="noopener">ifindy.com</a>, <a href="https://web.archive.org/web/20130209191213/http://jupery.com/" target="_blank" rel="noopener">jupery.com</a>, <a href="https://web.archive.org/web/20120214040919/http://look2man.com/" target="_blank" rel="noopener">look2man.com</a>, <a href="https://web.archive.org/web/20130318231852/http://lookerun.com/" target="_blank" rel="noopener">lookerun.com</a>, <a href="https://web.archive.org/web/20120217181822/http://manyp.com/" target="_blank" rel="noopener">manyp.com</a>, peepull.com, <a href="https://web.archive.org/web/20130425195446/http://perserch.com/" target="_blank" rel="noopener">perserch.com</a>, <a href="https://web.archive.org/web/20140104023637/http://persuer.com/" target="_blank" rel="noopener">persuer.com</a>, <a href="https://web.archive.org/web/20121001072151/http://pervent.com/" target="_blank" rel="noopener">pervent.com</a>, <a href="https://web.archive.org/web/20130116123555/http://piplenter.com/" target="_blank" rel="noopener">piplenter.com</a>, <a href="https://web.archive.org/web/20120215174246/http://piplfind.com/" target="_blank" rel="noopener">piplfind.com</a>, <a href="https://web.archive.org/web/20130302034909/http://piplscan.com/" target="_blank" rel="noopener">piplscan.com</a>, <a href="https://web.archive.org/web/20110210162153/http://popopke.com/" target="_blank" rel="noopener">popopke.com</a>, <a href="https://web.archive.org/web/20120210030201/http://pplsorce.com/" target="_blank" rel="noopener">pplsorce.com</a>, <a href="https://web.archive.org/web/20130215180627/http://qimeo.com/" target="_blank" rel="noopener">qimeo.com</a>, <a href="https://web.archive.org/web/20120125085744/http://scoutu2.com/" target="_blank" rel="noopener">scoutu2.com</a>, <a href="https://web.archive.org/web/20120215092423/http://search64.com/" target="_blank" rel="noopener">search64.com</a>, <a href="https://web.archive.org/web/20120204035144/http://searchay.com/" target="_blank" rel="noopener">searchay.com</a>, <a href="https://web.archive.org/web/20120215082510/http://seekmi.com/" target="_blank" rel="noopener">seekmi.com</a>, <a href="https://web.archive.org/web/20120502175915/http://selfabc.com/" target="_blank" rel="noopener">selfabc.com</a>, <a href="https://web.archive.org/web/20120211043052/http://socsee.com/" target="_blank" rel="noopener">socsee.com</a>, <a href="https://web.archive.org/web/20130116150616/http://srching.com/" target="_blank" rel="noopener">srching.com</a>, <a href="https://web.archive.org/web/20120204100134/http://toolooks.com/" target="_blank" rel="noopener">toolooks.com</a>, <a href="https://web.archive.org/web/20120706142742/http://upearch.com/" target="_blank" rel="noopener">upearch.com</a>, <a href="https://web.archive.org/web/20120306122418/http://webmeek.com/" target="_blank" rel="noopener">webmeek.com</a>, and many country-code variations of <a href="https://web.archive.org/web/20131103141811/http://viadin.ca/" target="_blank" rel="noopener">viadin.ca</a> (e.g. <a href="https://web.archive.org/web/20130427065532/http://viadin.hk/" target="_blank" rel="noopener">viadin.hk</a>, <a href="https://web.archive.org/web/20130805064112/http://viadin.com/" target="_blank" rel="noopener">viadin.com</a> and <a href="https://web.archive.org/web/20130428035516/http://viadin.de/" target="_blank" rel="noopener">viadin.de</a>).</p>
<div id="attachment_66758" style="width: 760px" class="wp-caption aligncenter"><a href="media/9a568fa5.popoke.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/03/popoke.png" target="_blank" rel="noopener"><img aria-describedby="caption-attachment-66758" decoding="async" loading="lazy" class="wp-image-66758" src="media/9a568fa5.popoke.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/03/popoke.png" alt="" width="750" height="345" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/03/popoke.png 1880w, https://krebsonsecurity.com/wp-content/uploads/2024/03/popoke-768x353.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/03/popoke-1536x707.png 1536w, https://krebsonsecurity.com/wp-content/uploads/2024/03/popoke-782x360.png 782w" sizes="(max-width: 750px) 100vw, 750px" /></a><p id="caption-attachment-66758" class="wp-caption-text">The people-search website popopke.com.</p></div>
<p>Domaintools.com finds that all of the domains mentioned in the last paragraph were registered to the email address dmitrcox@gmail.com.</p>
<p>Mr. Shelest has not responded to multiple requests for comment. KrebsOnSecurity also sought comment from onerep.com, which likewise has not responded to inquiries about its founder&#8217;s many apparent conflicts of interest. In any event, these practices would seem to contradict the goal Onerep has stated on its site: &#8220;We believe that no one should compromise personal online security and get a profit from it.&#8221;</p>
<div id="attachment_66759" style="width: 758px" class="wp-caption aligncenter"><a href="media/d9353cc1.findmedo.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/03/findmedo.png" target="_blank" rel="noopener"><img aria-describedby="caption-attachment-66759" decoding="async" loading="lazy" class="wp-image-66759" src="media/d9353cc1.findmedo.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/03/findmedo.png" alt="" width="748" height="319" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/03/findmedo.png 1880w, https://krebsonsecurity.com/wp-content/uploads/2024/03/findmedo-768x327.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/03/findmedo-1536x654.png 1536w, https://krebsonsecurity.com/wp-content/uploads/2024/03/findmedo-782x333.png 782w" sizes="(max-width: 748px) 100vw, 748px" /></a><p id="caption-attachment-66759" class="wp-caption-text">The people-search website findmedo.com.</p></div>
<p><strong>Max Anderson</strong> is chief growth officer at <a href="https://www.360privacy.io/" rel="noopener" target="_blank">360 Privacy</a>, a legitimate privacy company that works to keep its clients&#8217; data off of more than 400 data broker and people-search sites. Anderson said it is concerning to see a direct link between between a data removal service and data broker websites. </p>
<p>&#8220;I would consider it unethical to run a company that sells people’s information, and then charge those same people to have their information removed,&#8221; Anderson said. </p>
<p>Last week, KrebsOnSecurity published <a href="https://krebsonsecurity.com/2024/03/a-close-up-look-at-the-consumer-data-broker-radaris/" target="_blank" rel="noopener">an analysis of the people-search data broker giant <strong>Radaris</strong></a>, whose consumer profiles are deep enough to rival those of far more guarded data broker resources available to U.S. police departments and other law enforcement personnel.</p>
<p>That story revealed that the co-founders of Radaris are two native Russian brothers who operate multiple Russian-language dating services and affiliate programs. It also appears many of the Radaris founders&#8217; businesses have ties to a California marketing firm that works with a Russian state-run media conglomerate currently sanctioned by the U.S. government.</p>
<p><img decoding="async" loading="lazy" class="aligncenter wp-image-66760" src="media/0bb4c1f1.search64.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/03/search64.png" alt="" width="750" height="345" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/03/search64.png 1880w, https://krebsonsecurity.com/wp-content/uploads/2024/03/search64-768x353.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/03/search64-1536x707.png 1536w, https://krebsonsecurity.com/wp-content/uploads/2024/03/search64-782x360.png 782w" sizes="(max-width: 750px) 100vw, 750px" /></p>
<p>KrebsOnSecurity will continue investigating the history of various consumer data brokers and people-search providers. If any readers have inside knowledge of this industry or key players within it, please consider reaching out to krebsonsecurity at gmail.com.</p>


feed_id: https://krebsonsecurity.com/?p=66799
title: The Not-so-True People-Search Network from China
uri: The-Not-so-True-People-Search-Network-from-China
url: https://krebsonsecurity.com/2024/03/the-not-so-true-people-search-network-from-china/
content:
<p>It&#8217;s not unusual for the data brokers behind people-search websites <a href="https://krebsonsecurity.com/2024/03/a-close-up-look-at-the-consumer-data-broker-radaris/" target="_blank" rel="noopener">to use pseudonyms</a> in their day-to-day lives (you would, too). Some of these personal data purveyors even try to <a href="https://krebsonsecurity.com/2024/03/ceo-of-data-privacy-company-onerep-com-founded-dozens-of-people-search-firms/" target="_blank" rel="noopener">reinvent their online identities</a> in a bid to hide their conflicts of interest. But it&#8217;s not every day you run across a US-focused people-search network based in China whose principal owners all appear to be completely fabricated identities.</p>
<p>Responding to a reader inquiry concerning the trustworthiness of a site called <strong>TruePeopleSearch[.]net</strong>, KrebsOnSecurity began poking around. The site offers to sell reports containing photos, police records, background checks, civil judgments, contact information &#8220;and much more!&#8221; According to LinkedIn and numerous profiles on websites that accept paid article submissions, the founder of TruePeopleSearch is <strong>Marilyn Gaskell</strong> from Phoenix, Ariz.</p>
<div id="attachment_66803" style="width: 759px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-66803" decoding="async" class=" wp-image-66803" src="media/f14a365f.MarilynGaskell.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/03/MarilynGaskell.png" alt="" width="749" height="338" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/03/MarilynGaskell.png 793w, https://krebsonsecurity.com/wp-content/uploads/2024/03/MarilynGaskell-768x347.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/03/MarilynGaskell-782x353.png 782w" sizes="(max-width: 749px) 100vw, 749px" /><p id="caption-attachment-66803" class="wp-caption-text">The saucy yet studious LinkedIn profile for Marilyn Gaskell.</p></div>
<p>Ms. Gaskell has been quoted in multiple &#8220;articles&#8221; about random subjects, such as <a href="https://hrdailyadvisor.blr.com/2021/09/09/fantasy-football-a-workplace-distraction-or-team-building-activity/" target="_blank" rel="noopener">this article at HRDailyAdvisor</a> about the pros and cons of joining a company-led fantasy football team.</p>
<p>&#8220;Marilyn Gaskell, founder of TruePeopleSearch, agrees that not everyone in the office is likely to be a football fan and might feel intimidated by joining a company league or left out if they don’t join; however, her company looked for ways to make the activity more inclusive,&#8221; this paid story notes.</p>
<p>Also quoted in this article is <strong>Sally Stevens</strong>, who is cited as HR Manager at <strong>FastPeopleSearch[.]io</strong>.</p>
<div id="attachment_66805" style="width: 759px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-66805" decoding="async" loading="lazy" class=" wp-image-66805" src="media/3a5ad492.SallyStevens.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/03/SallyStevens.png" alt="" width="749" height="445" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/03/SallyStevens.png 793w, https://krebsonsecurity.com/wp-content/uploads/2024/03/SallyStevens-768x456.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/03/SallyStevens-782x464.png 782w" sizes="(max-width: 749px) 100vw, 749px" /><p id="caption-attachment-66805" class="wp-caption-text">Sally Stevens, the phantom HR Manager for FastPeopleSearch.</p></div>
<p>&#8220;Fantasy football provides one way for employees to set aside work matters for some time and have fun,&#8221; Stevens contributed. &#8220;Employees can set a special league for themselves and regularly check and compare their scores against one another.&#8221;</p>
<p>Imagine that: Two different people-search companies mentioned in the same story about fantasy football. What are the odds?</p>
<p>Both TruePeopleSearch and FastPeopleSearch allow users to search for reports by first and last name, but proceeding to order a report prompts the visitor to purchase the file from one of several established people-finder services, including <strong>BeenVerified,</strong> <strong>Intelius</strong>, and<strong> Spokeo.</strong></p>
<p><strong>DomainTools.com</strong> shows that both TruePeopleSearch and FastPeopleSearch appeared around 2020 and were registered through <strong>Alibaba Cloud</strong>, in Beijing, China. No other information is available about these domains in their registration records, although both domains appear to use email servers based in China.</p>
<p>Sally Stevens&#8217; LinkedIn profile photo is identical to a stock image titled &#8220;beautiful girl&#8221; from Adobe.com. Ms. Stevens is also quoted in <a href="https://ecogreenequipment.com/sustainable-business-practices-make-your-products-more-attractive/" target="_blank" rel="noopener">a paid blog post at ecogreenequipment.com</a>, as is <strong>Alina Clark</strong>, co-founder and marketing director of <strong>CocoDoc</strong>, an online service for editing and managing PDF documents.</p>
<div id="attachment_66806" style="width: 760px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-66806" decoding="async" loading="lazy" class=" wp-image-66806" src="media/2ccefa89.AlinaClark.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/03/AlinaClark.png" alt="" width="750" height="388" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/03/AlinaClark.png 793w, https://krebsonsecurity.com/wp-content/uploads/2024/03/AlinaClark-768x397.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/03/AlinaClark-782x404.png 782w" sizes="(max-width: 750px) 100vw, 750px" /><p id="caption-attachment-66806" class="wp-caption-text">The profile photo for Alina Clark is a stock photo appearing on more than 100 websites.</p></div>
<p>Scouring multiple image search sites reveals Ms. Clark&#8217;s profile photo on LinkedIn is another stock image that is currently on more than 100 different websites, including Adobe.com. Cocodoc[.]com was registered in June 2020 via Alibaba Cloud Beijing in China.</p>
<p>The same Alina Clark and photo materialized in a paid article at the website Ceoblognation, which in 2021 included her at #11 in a piece called &#8220;<a href="https://hear.ceoblognation.com/2021/12/03/30-entrepreneurs-describe-the-bhags-big-hairy-audacious-goals-for-their-business/#google_vignette" target="_blank" rel="noopener">30 Entrepreneurs Describe The Big Hairy Audacious Goals (BHAGs) for Their Business</a>.&#8221; It&#8217;s also worth noting that Ms. Clark is currently listed as a &#8220;<a href="https://www.forbes.com/sites/forbesbusinesscouncil/people/alinaclark/?sh=61e5d0ed3b20" target="_blank" rel="noopener">former Forbes Council member</a>&#8221; at the media outlet Forbes.com.<span id="more-66799"></span></p>
<p>Entrepreneur #6 is <strong>Stephen Curry</strong>, who is quoted as CEO of <strong>CocoSign[.]com</strong>, a website that claims to offer an &#8220;easier, quicker, safer eSignature solution for small and medium-sized businesses.&#8221; Incidentally, the same photo for Stephen Curry #6 is also used in this &#8220;article&#8221; for #22 <strong>Jake Smith</strong>, who is named as the owner of a different company.</p>
<div id="attachment_66807" style="width: 758px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-66807" decoding="async" loading="lazy" class="wp-image-66807" src="media/6215d4c5.StephenCurry.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/03/StephenCurry.png" alt="" width="748" height="318" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/03/StephenCurry.png 793w, https://krebsonsecurity.com/wp-content/uploads/2024/03/StephenCurry-768x326.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/03/StephenCurry-782x332.png 782w" sizes="(max-width: 748px) 100vw, 748px" /><p id="caption-attachment-66807" class="wp-caption-text">Stephen Curry, aka Jake Smith, aka no such person.</p></div>
<p><a href="https://www.linkedin.com/in/stephen-curry-2b6253218/" target="_blank" rel="noopener">Mr. Curry&#8217;s LinkedIn profile</a> shows a young man seated at a table in front of a laptop, but an online image search shows this is another stock photo. Cocosign[.]com was registered in June 2020 via Alibaba Cloud Beijing. No ownership details are available in the domain registration records.</p>
<p>Listed at #13 in that 30 Entrepreneurs article is <strong>Eden Cheng</strong>, who is cited as co-founder of <strong>PeopleFinderFree[.]com</strong>. KrebsOnSecurity could not find a LinkedIn profile for Ms. Cheng, but a search on her profile image from that Entrepreneurs article shows the same photo for sale at Shutterstock and other stock photo sites.</p>
<p>DomainTools says PeopleFinderFree was registered through Alibaba Cloud, Beijing. Attempts to purchase reports through PeopleFinderFree produce a notice saying the full report is only available via Spokeo.com.</p>
<p><strong>Lynda Fairly</strong> is Entrepreneur #24, and she is quoted as co-founder of <strong>Numlooker[.]com</strong>, a domain registered in April 2021 through Alibaba in China. Searches for people on Numlooker forward visitors to Spokeo.</p>
<p><img decoding="async" loading="lazy" class="aligncenter wp-image-66804" src="media/949474bc.LyndaFairly.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/03/LyndaFairly.png" alt="" width="750" height="503" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/03/LyndaFairly.png 793w, https://krebsonsecurity.com/wp-content/uploads/2024/03/LyndaFairly-768x515.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/03/LyndaFairly-782x525.png 782w" sizes="(max-width: 750px) 100vw, 750px" /></p>
<p>The photo next to Ms. Fairly&#8217;s quote in Entrepreneurs matches that of <a href="https://www.linkedin.com/in/lynda-fairly-2a3b10217/" target="_blank" rel="noopener">a LinkedIn profile for Lynda Fairly</a>. But a search on that photo shows this same portrait has been used by many other identities and names, including a woman from the United Kingdom who&#8217;s a cancer survivor and mother of five; a licensed marriage and family therapist in Canada; a software security engineer at Quora; a journalist on Twitter/X; and a marketing expert in Canada.</p>
<p><strong>Cocofinder[.]com</strong> is a people-search service that launched in Sept. 2019, through Alibaba in China. Cocofinder lists its market officer as <strong>Harriet Chan</strong>, but <a href="https://www.linkedin.com/in/harriet-chan-92196a207/" target="_blank" rel="noopener">Ms. Chan&#8217;s LinkedIn profile</a> is just as sparse on work history as the other people-search owners mentioned already. An image search online shows that outside of LinkedIn, the profile photo for Ms. Chan has only ever appeared in articles at pay-to-play media sites, like <a href="https://www.outbackteambuilding.com/blog/examples-of-soft-skills-for-leaders/" target="_blank" rel="noopener">this one</a> from outbackteambuilding.com.</p>
<p>Perhaps because Cocodoc and Cocosign both sell software services, they are actually tied to a physical presence in the real world &#8212; in Singapore (15 Scotts Rd. #03-12 15, Singapore). But it&#8217;s difficult to discern much from this address alone.</p>
<p>Who&#8217;s behind all this people-search chicanery? A January 2024 review of various people-search services at the website techjury.com states that Cocofinder is a wholly-owned subsidiary of a Chinese company called <strong>Shenzhen Duiyun Technology Co.</strong></p>
<p>&#8220;Though it only finds results from the United States, users can choose between four main search methods,&#8221; Techjury explains. Those include people search, phone, address and email lookup. This claim is supported by <a href="https://www.reddit.com/r/PSA/comments/nga6os/cocofinder_people_search_background_check/" target="_blank" rel="noopener">a Reddit post from three years ago</a>, wherein the Reddit user &#8220;ProtectionAdvanced&#8221; named the same Chinese company.</p>
<p>Is Shenzhen Duiyun Technology Co. responsible for all these phony profiles? How many more fake companies and profiles are connected to this scheme? KrebsOnSecurity found other examples that didn&#8217;t appear directly tied to other fake executives listed here, but which nevertheless are registered through Alibaba and seek to drive traffic to Spokeo and other data brokers. For example, there&#8217;s the winsome <a href="https://enterprenuer.org/founders/meet-daniela-sawyer-founder-of-findpeoplefast/" target="_blank" rel="noopener">Daniela Sawyer</a>, founder of <strong>FindPeopleFast[.]net</strong>, whose profile is flogged in paid stories at entrepreneur.org.</p>
<p>Google currently turns up nothing else for in a search for Shenzhen Duiyun Technology Co. Please feel free to sound off in the comments if you have any more information about this entity, such as how to contact it. Or reach out directly at krebsonsecurity @ gmail.com.</p>
<div id="attachment_66852" style="width: 760px" class="wp-caption aligncenter"><a href="media/962c76c4.mm-tps.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/03/mm-tps.png" target="_blank" rel="noopener"><img aria-describedby="caption-attachment-66852" decoding="async" loading="lazy" class="wp-image-66852" src="media/962c76c4.mm-tps.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/03/mm-tps.png" alt="" width="750" height="329" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/03/mm-tps.png 1638w, https://krebsonsecurity.com/wp-content/uploads/2024/03/mm-tps-768x337.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/03/mm-tps-1536x673.png 1536w, https://krebsonsecurity.com/wp-content/uploads/2024/03/mm-tps-782x343.png 782w" sizes="(max-width: 750px) 100vw, 750px" /></a><p id="caption-attachment-66852" class="wp-caption-text">A mind map highlighting the key points of research in this story. Click to enlarge. Image: KrebsOnSecurity.com</p></div>
<h2>ANALYSIS</h2>
<p>It appears the purpose of this network is to conceal the location of people in China who are seeking to generate affiliate commissions when someone visits one of their sites and purchases a people-search report at Spokeo, for example. And it is clear that Spokeo and others have created incentives wherein anyone can effectively white-label their reports, and thereby make money brokering access to peoples&#8217; personal information.</p>
<p>Spokeo&#8217;s Wikipedia page says the company was founded in 2006 by four graduates from Stanford University. Spokeo co-founder and current <strong>CEO Harrison Tang</strong> has not yet responded to requests for comment.</p>
<p>Intelius is owned by San Diego based <strong>PeopleConnect Inc.</strong>, which also owns <strong>Classmates.com</strong>, <strong>USSearch</strong>, <strong>TruthFinder</strong> and <strong>Instant Checkmate</strong>. PeopleConnect Inc. in turn is owned by <strong>H.I.G. Capital</strong>, a $60 billion private equity firm. Requests for comment were sent to H.I.G. Capital. This story will be updated if they respond.</p>
<p>BeenVerified is owned by a New York City based holding company called <strong>The Lifetime Value Co.</strong>, a marketing and advertising firm whose <a href="https://www.ltvco.com/brands/" target="_blank" rel="noopener">brands</a> include <strong>PeopleLooker</strong>, <strong>NeighborWho</strong>, <strong>Ownerly</strong>, <strong>PeopleSmart</strong>, <strong>NumberGuru</strong>, and <strong>Bumper</strong>, a car history site.</p>
<p><strong>Ross Cohen</strong>, chief operating officer at The Lifetime Value Co., said it&#8217;s likely the network of suspicious people-finder sites was set up by an affiliate. Cohen said Lifetime Value would investigate to determine if this particular affiliate was driving them any sign-ups.</p>
<p>All of the above people-search services operate similarly. When you find the person you&#8217;re looking for, you are put through a lengthy (often 10-20 minute) series of splash screens that require you to agree that these reports won&#8217;t be used for employment screening or in evaluating new tenant applications. Still more prompts ask if you are okay with seeing &#8220;potentially shocking&#8221; details about the subject of the report, including arrest histories and photos.</p>
<p>Only at the end of this process does the site disclose that viewing the report in question requires signing up for a monthly subscription, which is typically priced around $35. Exactly how and from where these major people-search websites are getting their consumer data &#8212; and customers &#8212; will be the subject of further reporting here.</p>
<p>The main reason these various people-search sites require you to affirm that you won&#8217;t use their reports for hiring or vetting potential tenants is that selling reports for those purposes would classify these firms as consumer reporting agencies (CRAs) and expose them to regulations under the <a href="https://www.ftc.gov/legal-library/browse/statutes/fair-credit-reporting-act" target="_blank" rel="noopener">Fair Credit Reporting Act</a> (FCRA).</p>
<p>These data brokers do not want to be treated as CRAs, and for this reason their people search reports typically don&#8217;t include detailed credit histories, financial information, or full Social Security Numbers (Radaris reports include the first six digits of one’s SSN).</p>
<p>But in September 2023, the <strong>U.S. Federal Trade Commission</strong> <a href="https://www.ftc.gov/news-events/news/press-releases/2023/09/ftc-says-truthfinder-instant-checkmate-deceived-users-about-background-report-accuracy-violated-fcra" target="_blank" rel="noopener">found</a> that TruthFinder and Instant Checkmate were trying to have it both ways. The FTC levied a $5.8 million penalty against the companies for allegedly acting as CRAs because they assembled and compiled information on consumers into background reports that were marketed and sold for employment and tenant screening purposes.</p>
<p>The FTC also found TruthFinder and Instant Checkmate deceived users about background report accuracy. The FTC alleges these companies made millions from their monthly subscriptions using push notifications and marketing emails that claimed that the subject of a background report had a criminal or arrest record, when the record was merely a traffic ticket.</p>
<p>The FTC said both companies deceived customers by providing “Remove” and “Flag as Inaccurate” buttons that did not work as advertised. Rather, the “Remove” button removed the disputed information only from the report as displayed to that customer; however, the same item of information remained visible to other customers who searched for the same person.</p>
<p>The FTC also said that when a customer flagged an item in the background report as inaccurate, the companies never took any steps to investigate those claims, to modify the reports, or to flag to other customers that the information had been disputed.</p>
<p>There are a growing number of online reputation management companies that offer to help customers remove their personal information from people-search sites and data broker databases. There are, no doubt, plenty of honest and well-meaning companies operating in this space, but it has been my experience that a great many people involved in that industry have a background in marketing or advertising &#8212; not privacy.</p>
<p>Also, some so-called data privacy companies may be wolves in sheep&#8217;s clothing. On March 14, KrebsOnSecurity published an abundance of evidence indicating that the CEO and founder of the data privacy company <strong>OneRep.com</strong> <a href="https://krebsonsecurity.com/2024/03/ceo-of-data-privacy-company-onerep-com-founded-dozens-of-people-search-firms/" target="_blank" rel="noopener">was responsible for launching dozens of people-search services over the years</a>.</p>
<p>Finally, some of the more popular people-search websites are notorious for ignoring requests from consumers seeking to remove their information, regardless of which reputation or removal service you use. Some force you to create an account and provide more information before you can remove your data. Even then, the information you worked hard to remove may simply reappear a few months later.</p>
<p>This aptly describes countless complaints lodged against the data broker and people search giant <strong>Radaris</strong>. On March 8, KrebsOnSecurity <a href="https://krebsonsecurity.com/2024/03/a-close-up-look-at-the-consumer-data-broker-radaris/" target="_blank" rel="noopener">profiled the co-founders of Radaris</a>, two Russian brothers in Massachusetts who also operate multiple Russian-language dating services and affiliate programs.</p>
<p>The truth is that these people-search companies will continue to thrive unless and until Congress begins to realize it&#8217;s time for some consumer privacy and data protection laws that are relevant to life in the 21st century. Duke University adjunct professor <strong>Justin Sherman</strong> says virtually all state privacy laws exempt records that might be considered &#8220;public&#8221; or &#8220;government&#8221; documents, including voting registries, property filings, marriage certificates, motor vehicle records, criminal records, court documents, death records, professional licenses, bankruptcy filings, and more.</p>
<p>“Consumer privacy laws in California, Colorado, Connecticut, Delaware, Indiana, Iowa, Montana, Oregon, Tennessee, Texas, Utah, and Virginia all contain highly similar or completely identical carve-outs for ‘publicly available information’ or government records,” Sherman said.</p>


feed_id: https://krebsonsecurity.com/?p=66866
title: Mozilla Drops Onerep After CEO Admits to Running People-Search Networks
uri: Mozilla-Drops-Onerep-After-CEO-Admits-to-Running-People-Search-Network
url:
https://krebsonsecurity.com/2024/03/mozilla-drops-onerep-after-ceo-admits-to-running-people-search-networks/

content:
<p>The nonprofit organization that supports the <strong>Firefox</strong> web browser said today it is winding down its new partnership with <strong>Onerep</strong>, an identity protection service recently bundled with Firefox that offers to remove users from hundreds of people-search sites. The move comes just days after a report by KrebsOnSecurity forced Onerep&#8217;s CEO to admit that he has founded dozens of people-search networks over the years.</p>
<div id="attachment_66872" style="width: 759px" class="wp-caption aligncenter"><a href="media/ef1768df.mozillamonitor.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/03/mozillamonitor.png" target="_blank" rel="noopener"><img aria-describedby="caption-attachment-66872" decoding="async" class="wp-image-66872" src="media/ef1768df.mozillamonitor.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/03/mozillamonitor.png" alt="" width="749" height="379" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/03/mozillamonitor.png 1185w, https://krebsonsecurity.com/wp-content/uploads/2024/03/mozillamonitor-768x389.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/03/mozillamonitor-782x396.png 782w" sizes="(max-width: 749px) 100vw, 749px" /></a><p id="caption-attachment-66872" class="wp-caption-text">Mozilla Monitor. Image Mozilla Monitor Plus video on Youtube.</p></div>
<p><strong>Mozilla</strong> only began bundling Onerep in Firefox last month, when it announced the reputation service would be offered on a subscription basis as part of <a href="https://www.mozilla.org/en-US/about/legal/terms/subscription-services/" target="_blank" rel="noopener">Mozilla Monitor Plus</a>. Launched in 2018 under the name <a href="https://en.wikipedia.org/wiki/Firefox_Monitor" target="_blank" rel="noopener">Firefox Monitor</a>, Mozilla Monitor also checks data from the website <a href="https://haveibeenpwned.com/" target="_blank" rel="noopener">Have I Been Pwned?</a> to let users know when their email addresses or password are leaked in data breaches.</p>
<p>On March 14, KrebsOnSecurity <a href="https://krebsonsecurity.com/2024/03/ceo-of-data-privacy-company-onerep-com-founded-dozens-of-people-search-firms/" target="_blank" rel="noopener">published a story</a> showing that Onerep&#8217;s Belarusian CEO and founder <strong>Dimitiri Shelest</strong> launched dozens of people-search services since 2010, including a still-active data broker called <strong>Nuwber</strong> that sells background reports on people. Onerep and Shelest did not respond to requests for comment on that story.</p>
<p>But on March 21, Shelest released a lengthy statement wherein he admitted to maintaining an ownership stake in Nuwber, a consumer data broker he founded in 2015 &#8212; around the same time he launched Onerep.</p>
<p>Shelest maintained that Nuwber has &#8220;zero cross-over or information-sharing with Onerep,&#8221; and said any other old domains that may be found and associated with his name are no longer being operated by him.</p>
<p>&#8220;I get it,&#8221; Shelest wrote. &#8220;My affiliation with a people search business may look odd from the outside. In truth, if I hadn’t taken that initial path with a deep dive into how people search sites work, Onerep wouldn’t have the best tech and team in the space. Still, I now appreciate that we did not make this more clear in the past and I’m aiming to do better in the future.&#8221; The full statement is available <a href="media/6f106324.Dimitri-Shelest-Letter-_-Comment-on-Krebs-article-3.20.24-1.pdf" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/03/Dimitri-Shelest-Letter-_-Comment-on-Krebs-article-3.20.24-1.pdf" target="_blank" rel="noopener">here</a> (PDF).</p>
<div id="attachment_66783" style="width: 759px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-66783" decoding="async" loading="lazy" class=" wp-image-66783" src="media/4cc78458.onerep-shellest.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/03/onerep-shellest.png" alt="" width="749" height="439" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/03/onerep-shellest.png 1275w, https://krebsonsecurity.com/wp-content/uploads/2024/03/onerep-shellest-768x450.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/03/onerep-shellest-782x458.png 782w" sizes="(max-width: 749px) 100vw, 749px" /><p id="caption-attachment-66783" class="wp-caption-text">Onerep CEO and founder Dimitri Shelest.</p></div>
<p>In a statement released today, a spokesperson for Mozilla said it was moving away from Onerep as a service provider in its Monitor Plus product.</p>
<p>&#8220;Though customer data was never at risk, the outside financial interests and activities of Onerep’s CEO do not align with our values,&#8221; Mozilla wrote. &#8220;We’re working now to solidify a transition plan that will provide customers with a seamless experience and will continue to put their interests first.&#8221;<span id="more-66866"></span></p>
<p>KrebsOnSecurity also reported that Shelest&#8217;s email address was used circa 2010 by an affiliate of <a href="https://krebsonsecurity.com/?s=spamit" target="_blank" rel="noopener">Spamit</a>, a Russian-language organization that paid people to aggressively promote websites hawking male enhancement drugs and generic pharmaceuticals. As noted in the March 14 story, this connection was confirmed by research from multiple graduate students at my alma mater George Mason University.</p>
<p>Shelest denied ever being associated with Spamit. &#8220;Between 2010 and 2014, we put up some web pages and optimize them &#8212; a widely used SEO practice &#8212; and then ran AdSense banners on them,&#8221; Shelest said, presumably referring to the dozens of people-search domains KrebsOnSecurity found were connected to his email addresses (dmitrcox@gmail.com and dmitrcox2@gmail.com). &#8220;As we progressed and learned more, we saw that a lot of the inquiries coming in were for people.&#8221;</p>
<p>Shelest also acknowledged that Onerep pays to run ads on &#8220;on a handful of data broker sites in very specific circumstances.&#8221;</p>
<p>&#8220;Our ad is served once someone has manually completed an opt-out form on their own,&#8221; Shelest wrote. &#8220;The goal is to let them know that if they were exposed on that site, there may be others, and bring awareness to there being a more automated opt-out option, such as Onerep.&#8221;</p>
<p>Reached via Twitter/X, HaveIBeenPwned founder <a href="https://twitter.com/troyhunt" target="_blank" rel="noopener">Troy Hunt</a> said he knew Mozilla was considering a partnership with Onerep, but that he was previously unaware of the Onerep CEO&#8217;s many conflicts of interest.</p>
<p>&#8220;I knew Mozilla had this in the works and we&#8217;d casually discussed it when talking about Firefox monitor,&#8221; Hunt told KrebsOnSecurity. &#8220;The point I made to them was the same as I’ve made to various companies wanting to put data broker removal ads on HIBP: removing your data from legally operating services has minimal impact, and you can’t remove it from the outright illegal ones who are doing the genuine damage.&#8221;</p>
<p>Playing both sides &#8212; creating and spreading the same digital disease that your medicine is designed to treat &#8212; may be highly unethical and wrong. But in the United States it&#8217;s not against the law. Nor is collecting and selling data on Americans. Privacy experts say the problem is that data brokers, people-search services like Nuwber and Onerep, and online reputation management firms exist because virtually all U.S. states exempt so-called &#8220;public&#8221; or &#8220;government&#8221; records from consumer privacy laws.</p>
<p>Those include voting registries, property filings, marriage certificates, motor vehicle records, criminal records, court documents, death records, professional licenses, and bankruptcy filings. Data brokers also can enrich consumer records with additional information, by adding social media data and known associates.</p>
<p>The March 14 story on Onerep was the second in a series of three investigative reports published here this month that examined the data broker and people-search industries, and highlighted the need for more congressional oversight &#8212; if not regulation &#8212; on consumer data protection and privacy.</p>
<p>On March 8, KrebsOnSecurity published <a href="https://krebsonsecurity.com/2024/03/a-close-up-look-at-the-consumer-data-broker-radaris/" target="_blank" rel="noopener">A Close Up Look at the Consumer Data Broker Radaris</a>, which showed that the co-founders of Radaris operate multiple Russian-language dating services and affiliate programs. It also appears many of their businesses have ties to a California marketing firm that works with a Russian state-run media conglomerate currently sanctioned by the U.S. government.</p>
<p>On March 20, KrebsOnSecurity published <a href="https://krebsonsecurity.com/2024/03/the-not-so-true-people-search-network-from-china/" target="_blank" rel="noopener">The Not-So-True People-Search Network from China</a>, which revealed an elaborate web of phony people-search companies and executives designed to conceal the location of people-search affiliates in China who are earning money promoting U.S. based data brokers that sell personal information on Americans.</p>


feed_id: https://krebsonsecurity.com/?p=66902
title: Recent ‘MFA Bombing’ Attacks Targeting Apple Users
uri: Recent-MFA-Bombing-Attacks-Targeting-Apple-Users
url: https://krebsonsecurity.com/2024/03/recent-mfa-bombing-attacks-targeting-apple-users/
content:
<p>Several <strong>Apple</strong> customers recently reported being targeted in elaborate phishing attacks that involve what appears to be a bug in Apple&#8217;s password reset feature. In this scenario, a target&#8217;s Apple devices are forced to display dozens of system-level prompts that prevent the devices from being used until the recipient responds &#8220;Allow&#8221; or &#8220;Don&#8217;t Allow&#8221; to each prompt. Assuming the user manages not to fat-finger the wrong button on the umpteenth password reset request, the scammers will then call the victim while spoofing Apple support in the caller ID, saying the user&#8217;s account is under attack and that Apple support needs to &#8220;verify&#8221; a one-time code.</p>
<div id="attachment_66915" style="width: 269px" class="wp-caption alignright"><img aria-describedby="caption-attachment-66915" decoding="async" class=" wp-image-66915" src="media/b5b73aa8.patelpass.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/03/patelpass.png" alt="" width="259" height="559" /><p id="caption-attachment-66915" class="wp-caption-text">Some of the many notifications Patel says he received from Apple all at once.</p></div>
<p><strong>Parth Patel</strong> is an entrepreneur who is trying to build a startup in the conversational AI space. On March 23, Patel <a href="https://twitter.com/parth220_/status/1771589789143478471" target="_blank" rel="noopener">documented on Twitter/X</a> a recent phishing campaign targeting him that involved what&#8217;s known as a &#8220;push bombing&#8221; or &#8220;<a href="https://www.beyondtrust.com/resources/glossary/mfa-fatigue-attack" target="_blank" rel="noopener">MFA fatigue</a>&#8221; attack, wherein the phishers abuse a feature or weakness of a multi-factor authentication (MFA) system in a way that inundates the target&#8217;s device(s) with alerts to approve a password change or login.</p>
<p>&#8220;All of my devices started blowing up, my watch, laptop and phone,&#8221; Patel told KrebsOnSecurity. &#8220;It was like this system notification from Apple to approve [a reset of the account password], but I couldn&#8217;t do anything else with my phone. I had to go through and decline like 100-plus notifications.&#8221;</p>
<p>Some people confronted with such a deluge may eventually click &#8220;Allow&#8221; to the incessant password reset prompts &#8212; just so they can use their phone again. Others may inadvertently approve one of these prompts, which will also appear on a user&#8217;s Apple watch if they have one.</p>
<p>But the attackers in this campaign had an ace up their sleeves: Patel said after denying all of the password reset prompts from Apple, he received a call on his iPhone that said it was from Apple Support (the number displayed was 1-800-275-2273, Apple&#8217;s real customer support line).</p>
<p>&#8220;I pick up the phone and I&#8217;m super suspicious,&#8221; Patel recalled. &#8220;So I ask them if they can verify some information about me, and after hearing some aggressive typing on his end he gives me all this information about me and it&#8217;s totally accurate.&#8221;</p>
<p>All of it, that is, except his real name. Patel said when he asked the fake Apple support rep to validate the name they had on file for the Apple account, the caller gave a name that was not his but rather one that Patel has only seen in background reports about him that are for sale at a people-search website called <strong>PeopleDataLabs</strong>.</p>
<p>Patel said he has worked fairly hard to remove his information from multiple <a href="https://krebsonsecurity.com/?s=people-search" target="_blank" rel="noopener">people-search websites</a>, and he found PeopleDataLabs uniquely and consistently listed this inaccurate name as an alias on his consumer profile.</p>
<p>&#8220;For some reason, PeopleDataLabs has three profiles that come up when you search for my info, and two of them are mine but one is an elementary school teacher from the midwest,&#8221; Patel said. &#8220;I asked them to verify my name and they said Anthony.&#8221;</p>
<p>Patel said the goal of the voice phishers is to trigger an Apple ID reset code to be sent to the user&#8217;s device, which is a text message that includes a one-time password. If the user supplies that one-time code, the attackers can then reset the password on the account and lock the user out. They can also then <a href="https://support.apple.com/guide/icloud/erase-a-device-mmfc0ef36f/icloud#:~:text=Remotely%20erase%20your%20device%20or,Follow%20the%20onscreen%20instructions." target="_blank" rel="noopener">remotely wipe</a> all of the user&#8217;s Apple devices.</p>
<h2>THE PHONE NUMBER IS KEY</h2>
<p>Chris is a cryptocurrency hedge fund owner who asked that only his first name be used so as not to paint a bigger target on himself. Chris told KrebsOnSecurity he experienced a remarkably similar phishing attempt in late February.</p>
<p>&#8220;The first alert I got I hit &#8216;Don&#8217;t Allow&#8217;, but then right after that I got like 30 more notifications in a row,&#8221; Chris said. &#8220;I figured maybe I sat on my phone weird, or was accidentally pushing some button that was causing these, and so I just denied them all.&#8221;</p>
<p>Chris says the attackers persisted hitting his devices with the reset notifications for several days after that, and at one point he received a call on his iPhone that said it was from Apple support.</p>
<p>&#8220;I said I would call them back and hung up,&#8221; Chris said, demonstrating <a href="https://krebsonsecurity.com/2020/04/when-in-doubt-hang-up-look-up-call-back/" target="_blank" rel="noopener">the proper response to such unbidden solicitations</a>. &#8220;When I called back to the real Apple, they couldn&#8217;t say whether anyone had been in a support call with me just then. They just said Apple states very clearly that it will never initiate outbound calls to customers &#8212; unless the customer requests to be contacted.&#8221;</p>
<p><img decoding="async" loading="lazy" class="aligncenter wp-image-45224" src="media/57d2a628.phonescam.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/09/phonescam.png" alt="" width="749" height="472" /></p>
<p>Massively freaking out that someone was trying to hijack his digital life, Chris said he changed his passwords and then went to an Apple store and bought a new iPhone. From there, he created a new Apple iCloud account using a brand new email address.</p>
<p>Chris said he then proceeded to get even more system alerts on his new iPhone and iCloud account &#8212; <em>all the while still sitting at the local Apple Genius Bar</em>.</p>
<p>Chris told KrebsOnSecurity his Genius Bar tech was mystified about the source of the alerts, but Chris said he suspects that whatever the phishers are abusing to rapidly generate these Apple system alerts requires knowing the phone number on file for the target&#8217;s Apple account. After all, that was the <em>only</em> aspect of Chris&#8217;s new iPhone and iCloud account that hadn&#8217;t changed.<span id="more-66902"></span></p>
<h2>WATCH OUT!</h2>
<p>&#8220;Ken&#8221; is a security industry veteran who spoke on condition of anonymity. Ken said he first began receiving these unsolicited system alerts on his Apple devices earlier this year, but that he has not received any phony Apple support calls as others have reported.</p>
<p>&#8220;This recently happened to me in the middle of the night at 12:30 a.m.,&#8221; Ken said. &#8220;And even though I have my Apple watch set to remain quiet during the time I&#8217;m usually sleeping at night, it woke me up with one of these alerts. Thank god I didn&#8217;t press &#8216;Allow,&#8217; which was the first option shown on my watch. I had to scroll watch the wheel to see and press the &#8216;Don&#8217;t Allow&#8217; button.&#8221;</p>
<div id="attachment_66911" style="width: 545px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-66911" decoding="async" loading="lazy" class=" wp-image-66911" src="media/552a36b0.resetpassword.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/03/resetpassword.png" alt="" width="535" height="502" /><p id="caption-attachment-66911" class="wp-caption-text">Ken shared this photo he took of an alert on his watch that woke him up at 12:30 a.m. Ken said he had to scroll on the watch face to see the &#8220;Don&#8217;t Allow&#8221; button.</p></div>
<p>Unnerved by the idea that he could have rolled over on his watch while sleeping and allowed criminals to take over his Apple account, Ken said he contacted the real Apple support and was eventually escalated to a senior Apple engineer. The engineer assured Ken that turning on an <a href="https://support.apple.com/en-us/109345" target="_blank" rel="noopener">Apple Recovery Key</a> for his account would stop the notifications once and for all.</p>
<p>A recovery key is an optional security feature that Apple says &#8220;helps improve the security of your Apple ID account.&#8221; It is a randomly generated 28-character code, and when you enable a recovery key it is supposed to disable Apple&#8217;s standard account recovery process. The thing is, enabling it is not a simple process, and if you ever lose that code in addition to all of your Apple devices you will be permanently locked out.</p>
<p>Ken said he enabled a recovery key for his account as instructed, but that it hasn&#8217;t stopped the unbidden system alerts from appearing on all of his devices every few days.</p>
<p>KrebsOnSecurity tested Ken&#8217;s experience, and can confirm that enabling a recovery key does nothing to stop a password reset prompt from being sent to associated Apple devices. Visiting Apple&#8217;s &#8220;forgot password&#8221; page &#8212; https://iforgot.apple.com &#8212; asks for an email address and for the visitor to solve a CAPTCHA.</p>
<p>After that, the page will display the last two digits of the phone number tied to the Apple account. Filling in the missing digits and hitting submit on that form will send a system alert, whether or not the user has enabled an Apple Recovery Key.</p>
<div id="attachment_66922" style="width: 690px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-66922" decoding="async" loading="lazy" class="size-full wp-image-66922" src="media/c759b25b.applereset.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/03/applereset.png" alt="" width="680" height="552" /><p id="caption-attachment-66922" class="wp-caption-text">The password reset page at iforgot.apple.com.</p></div>
<h2>RATE LIMITS</h2>
<p>What sanely designed authentication system would send dozens of requests for a password change in the span of a few moments, when the first requests haven&#8217;t even been acted on by the user? Could this be the result of a bug in Apple&#8217;s systems?</p>
<p>Apple has not yet responded to requests for comment.</p>
<p>Throughout 2022, a criminal hacking group known as <a href="https://krebsonsecurity.com/?s=lapsus%24" target="_blank" rel="noopener">LAPSUS$</a> used MFA bombing <a href="https://www.bleepingcomputer.com/news/microsoft/microsoft-enforces-number-matching-to-fight-mfa-fatigue-attacks/" target="_blank" rel="noopener">to great effect</a> in intrusions at <strong>Cisco</strong>, <strong>Microsoft</strong> and <strong>Uber</strong>. In response, Microsoft began enforcing &#8220;<a href="https://learn.microsoft.com/en-us/entra/identity/authentication/how-to-mfa-number-match" target="_blank" rel="noopener">MFA number matching</a>,&#8221; a feature that displays a series of numbers to a user attempting to log in with their credentials. These numbers must then be entered into the account owner&#8217;s Microsoft authenticator app on their mobile device to verify they are logging into the account.</p>
<p><strong>Kishan Bagaria</strong> is a hobbyist security researcher and engineer who founded the website texts.com (now owned by <a href="https://www.automattic.com/" target="_blank" rel="noopener">Automattic</a>), and he&#8217;s convinced Apple has a problem on its end. In August 2019, Bagaria reported to Apple a bug that allowed an exploit he dubbed &#8220;<a href="https://kishan.org/airdos/" target="_blank" rel="noopener">AirDoS</a>&#8221; because it could be used to let an attacker infinitely spam all nearby iOS devices with a system-level prompt to share a file via AirDrop &#8212; a file-sharing capability built into Apple products.</p>
<p>Apple fixed that bug nearly four months later in December 2019, thanking Bagaria in <a href="https://support.apple.com/en-us/HT210785" target="_blank" rel="noopener">the associated security bulletin</a>. Bagaria said Apple&#8217;s fix was to add stricter rate limiting on AirDrop requests, and he suspects that someone has figured out a way to bypass Apple&#8217;s rate limit on how many of these password reset requests can be sent in a given timeframe.</p>
<p>&#8220;I think this could be a legit Apple rate limit bug that should be reported,&#8221; Bagaria said.</p>


feed_id: https://krebsonsecurity.com/?p=66425
title: Thread Hijacking: Phishes That Prey on Your Curiosity
uri: Thread-Hijacking-Phishes-That-Prey-on-Your-Curiosity
url: https://krebsonsecurity.com/2024/03/thread-hijacking-phishes-that-prey-on-your-curiosity/
content:
<p>Thread hijacking attacks. They happen when someone you know has their email account compromised, and you are suddenly dropped into an existing conversation between the sender and someone else. These missives draw on the recipient&#8217;s natural curiosity about being copied on a private discussion, which is modified to include a malicious link or attachment. Here&#8217;s the story of a recent thread hijacking attack in which a journalist was copied on a phishing email from the unwilling subject of a recent scoop.</p>
<p>In Sept. 2023, the Pennsylvania news outlet <strong>LancasterOnline.com</strong> published <a href="https://lancasteronline.com/news/politics/smucker-the-ex-con-relationship-includes-travel-nearly-250-000-in-campaign-cash-and-donations/article_96710ba8-595a-11ee-a9e2-a762f8f372bd.html" target="_blank" rel="noopener">a story</a> about <strong>Adam Kidan</strong>, a wealthy businessman with a criminal past who is a major donor to Republican causes and candidates, including <strong>Rep. Lloyd Smucker</strong> (R-Pa).</p>
<div id="attachment_66969" style="width: 760px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-66969" decoding="async" class=" wp-image-66969" src="media/f9b5160e.kidanstory.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/03/kidanstory.png" alt="" width="750" height="473" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/03/kidanstory.png 1070w, https://krebsonsecurity.com/wp-content/uploads/2024/03/kidanstory-768x484.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/03/kidanstory-782x493.png 782w" sizes="(max-width: 750px) 100vw, 750px" /><p id="caption-attachment-66969" class="wp-caption-text">The LancasterOnline story about Adam Kidan.</p></div>
<p>Several months after that piece ran, the story&#8217;s author <strong>Brett Sholtis</strong> received two emails from Kidan, both of which contained attachments. One of the messages appeared to be a lengthy conversation between Kidan and a colleague, with the subject line, &#8220;Re: Successfully sent data.&#8221; The second missive was a more brief email from Kidan with the subject, &#8220;Acknowledge New Work Order,&#8221; and a message that read simply, &#8220;Please find the attached.&#8221;</p>
<p>Sholtis said he clicked the attachment in one of the messages, which then launched a web page that looked exactly like a Microsoft Office 365 login page. An analysis of the webpage reveals it would check any submitted credentials at the real Microsoft website, and return an error if the user entered bogus account information. A successful login would record the submitted credentials and forward the victim to the real Microsoft website.</p>
<p>But Sholtis said he didn&#8217;t enter his Outlook username and password. Instead, he forwarded the messages to LancasterOneline&#8217;s IT team, which quickly flagged them as phishing attempts.</p>
<p>LancasterOnline&#8217;s <strong>Executive Editor Tom Murse</strong> said the two phishing messages from Mr. Kidan raised eyebrows in the newsroom because Kidan had threatened to sue the news outlet multiple times over Sholtis&#8217;s story.</p>
<p>&#8220;We were just perplexed,&#8221; Murse said. &#8220;It seemed to be a phishing attempt but we were confused why it would come from a prominent businessman we&#8217;ve written about. Our initial response was confusion, but we didn&#8217;t know what else to do with it other than to send it to the FBI.&#8221;<span id="more-66425"></span></p>
<div id="attachment_66970" style="width: 758px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-66970" decoding="async" loading="lazy" class=" wp-image-66970" src="media/3610c321.empireworkforce.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/03/empireworkforce.png" alt="" width="748" height="501" /><p id="caption-attachment-66970" class="wp-caption-text">The phishing lure attached to the thread hijacking email from Mr. Kidan.</p></div>
<p>In 2006, Kidan was sentenced to 70 months in federal prison after pleading guilty to defrauding lenders along with <a href="https://en.wikipedia.org/wiki/Jack_Abramoff" target="_blank" rel="noopener">Jack Abramoff</a>, the disgraced lobbyist whose corruption <a href="https://www.nytimes.com/2020/06/25/us/politics/jack-abramoff-marijuana-cryptocurrency.html" target="_blank" rel="noopener">became a symbol</a> of the excesses of Washington influence peddling. He was paroled in 2009, and in 2014 moved his family to a home in Lancaster County, Pa.</p>
<p>The FBI hasn&#8217;t responded to LancasterOnline&#8217;s tip. Messages sent by KrebsOnSecurity to Kidan&#8217;s emails addresses were returned as blocked. Messages left with Mr. Kidan&#8217;s company, Empire Workforce Solutions, went unreturned.</p>
<p>No doubt the FBI saw the messages from Kidan for what they likely were: The result of Mr. Kidan having his Microsoft Outlook account compromised and used to send malicious email to people in his contacts list.</p>
<p>Thread hijacking attacks are hardly new, but that is mainly true because many Internet users still don&#8217;t know how to identify them. The email security firm <strong>Proofpoint</strong> says it has tracked north of 90 million malicious messages in the last five years that leverage this attack method.</p>
<p>One key reason thread hijacking is so successful is that these attacks generally do not include the tell that exposes most phishing scams: A fabricated sense of urgency. A majority of phishing threats warn of negative consequences should you fail to act quickly &#8212; such as an account suspension or an unauthorized high-dollar charge going through.</p>
<p>In contrast, thread hijacking campaigns tend to patiently prey on the natural curiosity of the recipient.</p>
<p><strong>Ryan Kalember</strong>, chief strategy officer at Proofpoint, said probably the most ubiquitous examples of thread hijacking are &#8220;CEO fraud&#8221; or &#8220;<a href="https://krebsonsecurity.com/2015/08/fbi-1-2b-lost-to-business-email-scams/#:~:text=On%20the%20surface%2C%20business%20email%20compromise%20scams%20may%20seem%20unsophisticated%20relative%20to%20moneymaking%20schemes%20that%20involve%20complex%20malicious%20software%2C%20such%20as%20Dyre%20and%20ZeuS." target="_blank" rel="noopener">business email compromise</a>&#8221; scams, wherein employees are tricked by an email from a senior executive into wiring millions of dollars to fraudsters overseas.</p>
<p>But Kalember said these low-tech attacks can nevertheless be quite effective because they tend to catch people off-guard.</p>
<p>&#8220;It works because you feel like you&#8217;re suddenly included in an important conversation,&#8221; Kalember said. &#8220;It just registers a lot differently when people start reading, because you think you&#8217;re observing a private conversation between two different people.&#8221;</p>
<p>Some thread hijacking attacks actually involve multiple threat actors who are actively conversing while copying &#8212; but not addressing &#8212; the recipient.</p>
<p>&#8220;We call these mutli-persona phishing scams, and they&#8217;re often paired with thread hijacking,&#8221; Kalember said. &#8220;It&#8217;s basically a way to build a little more affinity than just copying people on an email. And the longer the conversation goes on, the higher their success rate seems to be because some people start replying to the thread [and participating] psycho-socially.&#8221;</p>
<p>The best advice to sidestep phishing scams is to avoid clicking on links or attachments that arrive unbidden in emails, text messages and other mediums. If you’re unsure whether the message is legitimate, take a deep breath and visit the site or service in question manually — ideally, using a browser bookmark so as to avoid <a href="https://krebsonsecurity.com/?s=typosquatting&amp;x=0&amp;y=0" target="_blank" rel="noopener">potential typosquatting sites</a>.</p>


feed_id: https://krebsonsecurity.com/?p=66576
title: ‘The Manipulaters’ Improve Phishing, Still Fail at Opsec
uri: The-Manipulaters-Improve-Phishing-Still-Fail-at-Opsec
url: https://krebsonsecurity.com/2024/04/the-manipulaters-improve-phishing-still-fail-at-opsec/
content:
<p>Roughly nine years ago, KrebsOnSecurity profiled a Pakistan-based cybercrime group called &#8220;<strong>The Manipulaters</strong>,&#8221; a sprawling web hosting network of phishing and spam delivery platforms. In January 2024, The Manipulaters pleaded with this author to unpublish previous stories about their work, claiming the group had turned over a new leaf and gone legitimate. But new research suggests that while they have improved the quality of their products and services, these nitwits still fail spectacularly at hiding their illegal activities.</p>
<p>In May 2015, KrebsOnSecurity published <a href="https://krebsonsecurity.com/2015/05/phishing-gang-is-audacious-manipulator/" target="_blank" rel="noopener">a brief writeup</a> about the brazen Manipulaters team, noting that they openly operated hundreds of web sites selling tools designed to trick people into giving up usernames and passwords, or deploying malicious software on their PCs.</p>
<div id="attachment_67010" style="width: 760px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-67010" decoding="async" class=" wp-image-67010" src="media/e2748fd6.manipulaters-o365.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/04/manipulaters-o365.png" alt="" width="750" height="292" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/04/manipulaters-o365.png 1097w, https://krebsonsecurity.com/wp-content/uploads/2024/04/manipulaters-o365-768x299.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/04/manipulaters-o365-782x304.png 782w" sizes="(max-width: 750px) 100vw, 750px" /><p id="caption-attachment-67010" class="wp-caption-text">Manipulaters advertisement for &#8220;Office 365 Private Page with Antibot&#8221; phishing kit sold on the domain heartsender,com. &#8220;Antibot&#8221; refers to functionality that attempts to evade automated detection techniques, keeping a phish deployed as long as possible. Image: DomainTools.</p></div>
<p>The core brand of The Manipulaters has long been a shared cybercriminal identity named &#8220;<strong>Saim Raza</strong>,&#8221; who for the past decade has peddled a popular spamming and phishing service variously called &#8220;<strong>Fudtools</strong>,&#8221; &#8220;<strong>Fudpage</strong>,&#8221; &#8220;<strong>Fudsender</strong>,&#8221; &#8220;<strong>FudCo</strong>,&#8221; etc. The term &#8220;FUD&#8221; in those names stands for “<strong>F</strong>ully <strong>U</strong>n-<strong>D</strong>etectable,” and it refers to cybercrime resources that will evade detection by security tools like antivirus software or anti-spam appliances.</p>
<p>A <a href="https://krebsonsecurity.com/2021/09/fudco-spam-empire-tied-to-pakistani-software-firm/" target="_blank" rel="noopener">September 2021 story here</a> checked in on The Manipulaters, and found that Saim Raza and company were prospering under their FudCo brands, which they secretly managed from a front company called <strong>We Code Solutions</strong>.</p>
<p>That piece worked backwards from all of the known Saim Raza email addresses to identify Facebook profiles for multiple We Code Solutions employees, many of whom could be seen celebrating company anniversaries gathered around a giant cake with the words &#8220;FudCo&#8221; painted in icing.</p>
<p><img decoding="async" loading="lazy" class="aligncenter wp-image-56860" src="media/8a798345.fudcocake.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/09/fudcocake.png" alt="" width="750" height="772" srcset="https://krebsonsecurity.com/wp-content/uploads/2021/09/fudcocake.png 834w, https://krebsonsecurity.com/wp-content/uploads/2021/09/fudcocake-768x790.png 768w, https://krebsonsecurity.com/wp-content/uploads/2021/09/fudcocake-782x805.png 782w" sizes="(max-width: 750px) 100vw, 750px" /></p>
<p>Since that story ran, KrebsOnSecurity has heard from this Saim Raza identity on two occasions. The first was in the weeks following the Sept. 2021 piece, when one of Saim Raza&#8217;s known email addresses &#8212; <strong>bluebtcus@gmail.com</strong> &#8212; pleaded to have the story taken down.</p>
<p>&#8220;Hello, we already leave that fud etc before year,&#8221; the Saim Raza identity wrote. &#8220;Why you post us? Why you destroy our lifes? We never harm anyone. Please remove it.&#8221;</p>
<p>Not wishing to be manipulated by a phishing gang, KrebsOnSecurity ignored those entreaties. But on Jan. 14, 2024, KrebsOnSecurity heard from the same bluebtcus@gmail.com address, apropos of nothing.</p>
<p>&#8220;Please remove this article,&#8221; Sam Raza wrote, linking to the 2021 profile. <span class="pullquote pqright">&#8220;Please already my police register case on me. I already leave everything.&#8221;</span></p>
<p>Asked to elaborate on the police investigation, Saim Raza said they were freshly released from jail.</p>
<p>&#8220;I was there many days,&#8221; the reply explained. &#8220;Now back after bail. Now I want to start my new work.&#8221;</p>
<p>Exactly what that &#8220;new work&#8221; might entail, Saim Raza wouldn&#8217;t say. But <a href="https://www.domaintools.com/resources/blog/the-resurgence-of-the-manipulaters-team-breaking-heartsenders?utm_source=Krebs-on-Security" target="_blank" rel="noopener">a new report</a> from researchers at <strong>DomainTools.com</strong> finds that several computers associated with The Manipulaters have been massively hacked by malicious data- and password-snarfing malware for quite some time.</p>
<p>DomainTools says the malware infections on Manipulaters PCs exposed &#8220;vast swaths of account-related data along with an outline of the group&#8217;s membership, operations, and position in the broader underground economy.&#8221;</p>
<p>&#8220;Curiously, the large subset of identified Manipulaters customers appear to be compromised by the same stealer malware,&#8221; DomainTools wrote. &#8220;All observed customer malware infections began after the initial compromise of Manipulaters PCs, which raises a number of questions regarding the origin of those infections.&#8221;<span id="more-66576"></span></p>
<p>A number of questions, indeed. The core Manipulaters product these days is a spam delivery service called <strong>HeartSender</strong>, whose homepage openly advertises phishing kits targeting users of various Internet companies, including <strong>Microsoft 365</strong>, <strong>Yahoo</strong>, <strong>AOL</strong>, <strong>Intuit</strong>, <strong>iCloud</strong> and <strong>ID.me</strong>, to name a few.</p>
<div id="attachment_67009" style="width: 760px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-67009" decoding="async" loading="lazy" class=" wp-image-67009" src="media/cbdabd4b.heartsender.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/04/heartsender.png" alt="" width="750" height="442" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/04/heartsender.png 1147w, https://krebsonsecurity.com/wp-content/uploads/2024/04/heartsender-768x453.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/04/heartsender-782x461.png 782w" sizes="(max-width: 750px) 100vw, 750px" /><p id="caption-attachment-67009" class="wp-caption-text">A screenshot of the homepage of HeartSender 4 displays an IP address tied to fudtoolshop@gmail.com. Image: DomainTools.</p></div>
<p>HeartSender customers can interact with the subscription service via the website, but the product appears to be far more effective and user-friendly if one downloads HeartSender as a Windows executable program. Whether that HeartSender program was somehow compromised and used to infect the service&#8217;s customers is unknown.</p>
<p>However, DomainTools also found the hosted version of HeartSender service leaks an extraordinary amount of user information that probably is not intended to be publicly accessible. Apparently, the HeartSender web interface has several webpages that are accessible to unauthenticated users, exposing customer credentials along with support requests to HeartSender developers.</p>
<p>&#8220;Ironically, the Manipulaters may create more short-term risk to their own customers than law enforcement,&#8221; DomainTools wrote. &#8220;The data table “User Feedbacks” (sic) exposes what appear to be customer authentication tokens, user identifiers, and even a customer support request that exposes root-level SMTP credentials–all visible by an unauthenticated user on a Manipulaters-controlled domain. Given the risk for abuse, this domain will not be published.&#8221;</p>
<p>This is hardly the first time The Manipulaters have shot themselves in the foot. In 2019, <em>The Manipulaters failed to renew their core domain name</em> — manipulaters[.]com — the same one tied to so many of the company’s past and current business operations. That domain was quickly scooped up by <a href="https://www.scyllaintel.com/" target="_blank" rel="noopener">Scylla Intel</a>, a cyber intelligence firm that focuses on connecting cybercriminals to their real-life identities.</p>
<p>Currently, The Manipulaters seem focused on building out and supporting HeartSender, which specializes in spam and email-to-SMS spamming services.</p>
<p>&#8220;The Manipulaters’ newfound interest in email-to-SMS spam could be in response to the massive increase in <a href="https://krebsonsecurity.com/2023/10/phishers-spoof-usps-12-other-natl-postal-services/" target="_blank" rel="noopener">smishing activity impersonating the USPS</a>,&#8221; DomainTools wrote. &#8220;Proofs posted on HeartSender’s Telegram channel contain numerous references to postal service impersonation, including proving delivery of USPS-themed phishing lures and the sale of a USPS phishing kit.&#8221;</p>
<p>Reached via email, the Saim Raza identity declined to respond to questions about the DomainTools findings.</p>
<p>&#8220;First [of] all we never work on virus or compromised computer etc,&#8221; Raza replied. &#8220;If you want to write like that fake go ahead. Second I leave country already. If someone bind anything with exe file and spread on internet its not my fault.&#8221;</p>
<p>Asked why they left Pakistan, Saim Raza said the authorities there just wanted to shake them down.</p>
<p>&#8220;After your article our police put FIR on my [identity],&#8221; Saim Raza explained. &#8220;FIR&#8221; in this case stands for &#8220;First Information Report,&#8221; which is the initial complaint in the criminal justice system of Pakistan.</p>
<p>&#8220;They only get money from me nothing else,&#8221; Saim Raza continued. &#8220;Now some officers ask for money again again. Brother, there is no good law in Pakistan just they need money.&#8221;</p>
<p>Saim Raza has a history of being slippery with the truth, so who knows whether The Manipulaters and/or its leaders have in fact fled Pakistan (it may be more of an extended vacation abroad). With any luck, these guys will soon venture into a more Western-friendly, &#8220;good law&#8221; nation and receive a warm welcome by the local authorities.</p>


feed_id: https://krebsonsecurity.com/?p=67035
title: Fake Lawsuit Threat Exposes Privnote Phishing Sites
uri: Fake-Lawsuit-Threat-Exposes-Privnote-Phishing-Sites
url: https://krebsonsecurity.com/2024/04/fake-lawsuit-threat-exposes-privnote-phishing-sites/
content:
<p>A cybercrook who has been setting up websites that mimic the self-destructing message service <strong>privnote.com</strong> accidentally exposed the breadth of their operations recently when they threatened to sue a software company. The disclosure revealed a profitable network of phishing sites that behave and look like the real Privnote, except that any messages containing cryptocurrency addresses will be automatically altered to include a different payment address controlled by the scammers.</p>
<div id="attachment_67081" style="width: 758px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-67081" decoding="async" class=" wp-image-67081" src="media/214dd656.privnotedotcom.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/04/privnotedotcom.png" alt="" width="748" height="746" /><p id="caption-attachment-67081" class="wp-caption-text">The real Privnote, at privnote.com.</p></div>
<p>Launched in 2008, privnote.com employs technology that encrypts each message so that even Privnote itself <a href="https://privnote.com/info/privacy" target="_blank" rel="noopener noreferrer">cannot read its contents</a>. And it doesn’t send or receive messages. Creating a message merely generates a link. When that link is clicked or visited, the service warns that the message will be gone forever after it is read.</p>
<p>Privnote&#8217;s ease-of-use and popularity among cryptocurrency enthusiasts has made it <a href="https://krebsonsecurity.com/2020/06/privnotes-com-is-phishing-bitcoin-from-users-of-private-messaging-service-privnote-com/" target="_blank" rel="noopener">a perennial target of phishers</a>, who erect Privnote clones that function more or less as advertised but also quietly inject their own cryptocurrency payment addresses when a note is created that contains crypto wallets.</p>
<p>Last month, a new user on <strong>GitHub</strong> named <strong>fory66399</strong> <a href="https://github.com/MetaMask/eth-phishing-detect/issues/29814" target="_blank" rel="noopener">lodged a complaint</a> on the &#8220;issues&#8221; page for <strong>MetaMask</strong>, a software cryptocurrency wallet used to interact with the Ethereum blockchain. Fory66399 insisted that their website &#8212; <strong>privnote[.]co</strong> &#8212; was being wrongly flagged by MetaMask&#8217;s &#8220;eth-phishing-detect&#8221; list as malicious.</p>
<p>&#8220;We filed a lawsuit with a lawyer for dishonestly adding a site to the block list, damaging reputation, as well as ignoring the moderation department and ignoring answers!&#8221; fory66399 threatened. &#8220;Provide evidence or I will demand compensation!&#8221;</p>
<p>MetaMask&#8217;s lead product manager <strong>Taylor Monahan</strong> replied by posting several screenshots of privnote[.]co showing the site did indeed swap out any cryptocurrency addresses.</p>
<p><img decoding="async" loading="lazy" class="aligncenter wp-image-67040" src="media/5f5d3178.tayprivnoteco.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/04/tayprivnoteco.png" alt="" width="750" height="774" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/04/tayprivnoteco.png 858w, https://krebsonsecurity.com/wp-content/uploads/2024/04/tayprivnoteco-768x792.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/04/tayprivnoteco-782x807.png 782w" sizes="(max-width: 750px) 100vw, 750px" /></p>
<p>After being told where they could send a copy of their lawsuit, Fory66399 appeared to become flustered, and proceeded to mention a number of other interesting domain names:</p>
<blockquote><p>You sent me screenshots from some other site! It&#8217;s red!!!!<br />
The tornote.io website has a different color altogether<br />
The privatenote,io website also has a different color! What&#8217;s wrong?????</p></blockquote>
<p>A search at <a href="https://www.domaintools.com" target="_blank" rel="noopener">DomainTools.com</a> for privatenote[.]io shows it has been registered to two names over as many years, including <strong>Andrey Sokol</strong> from Moscow and <strong>Alexandr Ermakov</strong> from Kiev. There is no indication these are the real names of the phishers, but the names are useful in pointing to other sites targeting Privnote since 2020.</p>
<p>DomainTools says other domains registered to Alexandr Ermakov include <strong>pirvnota[.]com</strong>, <strong>privatemessage[.]net</strong>, <strong>privatenote[.]io</strong>, and <strong>tornote[.]io</strong>.</p>
<div id="attachment_67046" style="width: 757px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-67046" decoding="async" loading="lazy" class="wp-image-67046" src="media/f2082d18.privatemessage.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/04/privatemessage.png" alt="" width="747" height="461" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/04/privatemessage.png 1104w, https://krebsonsecurity.com/wp-content/uploads/2024/04/privatemessage-768x474.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/04/privatemessage-782x482.png 782w" sizes="(max-width: 747px) 100vw, 747px" /><p id="caption-attachment-67046" class="wp-caption-text">A screenshot of the phishing domain privatemessage dot net.</p></div>
<p>The registration records for pirvnota[.]com at one point were updated from Andrey Sokol to &#8220;<strong>BPW</strong>&#8221; as the registrant organization, and &#8220;<strong>Tambov district</strong>&#8221; in the registrant state/province field. Searching DomainTools for domains that include both of these terms reveals <strong>pirwnote[.]com</strong>.</p>
<p>Other Privnote phishing domains that also phoned home to the same Internet address as pirwnote[.]com include <strong>privnode[.]com</strong>, <strong>privnate[.]com</strong>, and <strong>prevnóte[.]com</strong>. Pirwnote[.]com is currently selling security cameras made by the Chinese manufacturer <a href="https://krebsonsecurity.com/tag/hikvision/" target="_blank" rel="noopener">Hikvision</a>, via an Internet address based in Hong Kong.</p>
<p>It appears someone has gone to great lengths to make tornote[.]io seem like a legitimate website. For example, <a href="https://medium.com/@tornoteprivnote" target="_blank" rel="noopener">this account at Medium</a> has authored more than a dozen blog posts in the past year singing the praises of Tornote as a secure, self-destructing messaging service. However, <a href="media/349bfe31.tornote-before.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/04/tornote-before.png" target="_blank" rel="noopener">testing</a> <a href="media/7aeb7310.tornote-after.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/04/tornote-after.png" target="_blank" rel="noopener">shows</a> tornote[.]io will also replace any cryptocurrency addresses in messages with their own payment address.<span id="more-67035"></span></p>
<p>These malicious note sites attract visitors by gaming search engine results to make the phishing domains appear prominently in search results for &#8220;privnote.&#8221; A search in Google for &#8220;privnote&#8221; currently returns tornote[.]io as the fifth result. Like other phishing sites tied to this network, Tornote will use the same cryptocurrency addresses for roughly 5 days, and then rotate in new payment addresses.</p>
<div id="attachment_67044" style="width: 758px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-67044" decoding="async" loading="lazy" class="wp-image-67044" src="media/7aeb7310.tornote-after.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/04/tornote-after.png" alt="" width="748" height="457" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/04/tornote-after.png 1280w, https://krebsonsecurity.com/wp-content/uploads/2024/04/tornote-after-768x469.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/04/tornote-after-782x478.png 782w" sizes="(max-width: 748px) 100vw, 748px" /><p id="caption-attachment-67044" class="wp-caption-text">Tornote changed the cryptocurrency address entered into a test note to this address controlled by the phishers.</p></div>
<p>Throughout 2023, Tornote was hosted with the Russian provider <a href="https://krebsonsecurity.com/tag/ddos-guard/" target="_blank" rel="noopener">DDoS-Guard</a>, at the Internet address <strong>186.2.163[.]216</strong>. A review of the passive DNS records tied to this address shows that apart from subdomains dedicated to tornote[.]io, the main other domain at this address was <strong>hkleaks[.]ml</strong>.</p>
<p>In August 2019, a slew of websites and social media channels dubbed &#8220;HKLEAKS&#8221; began doxing the identities and personal information of pro-democracy activists in Hong Kong. According to <a href="media/dccbbd2d.Report23168--hkleaks-061323.pdf" data-original-source="https://tspace.library.utoronto.ca/bitstream/1807/128586/1/Report%23168--hkleaks-061323.pdf" target="_blank" rel="noopener">a report</a> (PDF) from <strong>Citizen Lab</strong>, hkleaks[.]ml was the second domain that appeared as the perpetrators began to expand the list of those doxed.</p>
<div id="attachment_67042" style="width: 758px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-67042" decoding="async" loading="lazy" class="wp-image-67042" src="media/3f00825a.hkleaks.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/04/hkleaks.png" alt="" width="748" height="257" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/04/hkleaks.png 1373w, https://krebsonsecurity.com/wp-content/uploads/2024/04/hkleaks-768x264.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/04/hkleaks-782x269.png 782w" sizes="(max-width: 748px) 100vw, 748px" /><p id="caption-attachment-67042" class="wp-caption-text">HKleaks, as indexed by The Wayback Machine.</p></div>
<p>DomainTools shows there are more than 1,000 other domains whose registration records include the organization name &#8220;BPW&#8221; and &#8220;Tambov District&#8221; as the location. Virtually all of those domains were registered through one of two registrars &#8212; Hong Kong-based <strong>Nicenic</strong> and Singapore-based <strong>WebCC </strong>&#8212; and almost all appear to be phishing or pill-spam related.</p>
<p>Among those is <strong>rustraitor[.]info</strong>, a website erected after Russia invaded Ukraine in early 2022 that doxed Russians perceived to have helped the Ukrainian cause.</p>
<div id="attachment_67043" style="width: 760px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-67043" decoding="async" loading="lazy" class="wp-image-67043" src="media/0c1b71bc.rustraitor.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/04/rustraitor.png" alt="" width="750" height="351" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/04/rustraitor.png 1456w, https://krebsonsecurity.com/wp-content/uploads/2024/04/rustraitor-768x359.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/04/rustraitor-782x366.png 782w" sizes="(max-width: 750px) 100vw, 750px" /><p id="caption-attachment-67043" class="wp-caption-text">An archive.org copy of Rustraitor.</p></div>
<p>In keeping with the overall theme, these phishing domains appear focused on stealing usernames and passwords to some of the cybercrime underground&#8217;s busiest shops, including <a href="https://krebsonsecurity.com/?s=briansclub" target="_blank" rel="noopener">Brian&#8217;s Club</a>. What do all the phished sites have in common? They all accept payment via virtual currencies.</p>
<p>It appears MetaMask&#8217;s Monahan made the correct decision in forcing these phishers to tip their hand: Among the websites at that DDoS-Guard address are multiple MetaMask phishing domains, including <strong>metarrnask[.]com</strong>,<strong> meternask[.]com</strong>, and <strong>rnetamask[.]com</strong>.</p>
<p>How profitable are these private note phishing sites? Reviewing the four malicious cryptocurrency payment addresses that the attackers swapped into notes passed through privnote[.]co (as pictured in Monahan&#8217;s screenshot above) shows that between March 15 and March 19, 2024, those address raked in and transferred out nearly $18,000 in cryptocurrencies. And that&#8217;s just one of their phishing websites.</p>


feed_id: https://krebsonsecurity.com/?p=67114
title: April’s Patch Tuesday Brings Record Number of Fixes
uri: April-s-Patch-Tuesday-Brings-Record-Number-of-Fixes
url: https://krebsonsecurity.com/2024/04/aprils-patch-tuesday-brings-record-number-of-fixes/
content:
<p>If only Patch Tuesdays came around infrequently &#8212; like total solar eclipse rare &#8212; instead of just creeping up on us each month like The Man in the Moon. Although to be fair, it would be tough for <strong>Microsoft</strong> to eclipse the number of vulnerabilities fixed in this month&#8217;s patch batch &#8212; a record 147 flaws in <strong>Windows</strong> and related software.</p>
<p><img decoding="async" class="aligncenter wp-image-56287" src="media/96fddb2c.windupate.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/07/windupate.png" alt="" width="750" height="528" srcset="https://krebsonsecurity.com/wp-content/uploads/2021/07/windupate.png 841w, https://krebsonsecurity.com/wp-content/uploads/2021/07/windupate-768x541.png 768w, https://krebsonsecurity.com/wp-content/uploads/2021/07/windupate-782x550.png 782w, https://krebsonsecurity.com/wp-content/uploads/2021/07/windupate-100x70.png 100w" sizes="(max-width: 750px) 100vw, 750px" /></p>
<p>Yes, you read that right. Microsoft today released updates to address 147 security holes in Windows, <strong>Office</strong>, <strong>Azure</strong>, <strong>.NET Framework</strong>, <strong>Visual Studio</strong>, <strong>SQL Server</strong>,<strong> DNS Server</strong>, <strong>Windows Defender</strong>, <strong>Bitlocker</strong>, and <strong>Windows Secure Boot</strong>.</p>
<p>&#8220;This is the largest release from Microsoft this year and the largest since at least 2017,&#8221; said <strong>Dustin Childs</strong>, from <strong>Trend Micro&#8217;s Zero Day Initiative </strong>(ZDI). &#8220;As far as I can tell, it’s the largest Patch Tuesday release from Microsoft of all time.&#8221;</p>
<p>Once again this month, there are no known zero-day vulnerabilities threatening Windows users. Tempering the sheer volume of this month&#8217;s patches is the middling severity of many of the bugs. Only three of April&#8217;s vulnerabilities earned Microsoft&#8217;s most-dire &#8220;critical&#8221; rating, meaning they can be abused by malware or malcontents to take remote control over unpatched systems with no help from users.</p>
<p>Most of the flaws that Microsoft deems &#8220;more likely to be exploited&#8221; this month are marked as &#8220;important,&#8221; which usually involve bugs that require a bit more user interaction (social engineering) but which nevertheless can result in system security bypass, compromise, and the theft of critical assets.</p>
<p><strong>Ben McCarthy</strong>, lead cyber security engineer at <strong>Immersive Labs</strong> called attention to <a href="https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2024-20670" target="_blank" rel="noopener">CVE-2024-20670</a>, an <strong>Outlook for Windows</strong> spoofing vulnerability described as being easy to exploit. It involves convincing a user to click on a malicious link in an email, which can then steal the user&#8217;s password hash and authenticate as the user in another Microsoft service.<span id="more-67114"></span></p>
<p>Another interesting bug McCarthy pointed to is <a href="https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2024-29063" target="_blank" rel="noopener">CVE-2024-29063</a>, which involves hard-coded credentials in Azure&#8217;s search backend infrastructure that could be gleaned by taking advantage of <strong>Azure AI</strong> search.</p>
<p>&#8220;This along with many other AI attacks in recent news shows a potential new attack surface that we are just learning how to mitigate against,&#8221; McCarthy said. &#8220;Microsoft has updated their backend and notified any customers who have been affected by the credential leakage.&#8221;</p>
<p><a href="https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2024-29988" target="_blank" rel="noopener">CVE-2024-29988</a> is a weakness that allows attackers to bypass <strong>Windows SmartScreen</strong>, a technology Microsoft designed to provide additional protections for end users against phishing and malware attacks. Childs said one ZDI&#8217;s researchers found this vulnerability being exploited in the wild, although Microsoft doesn&#8217;t currently list CVE-2024-29988 as being exploited.</p>
<p>&#8220;I would treat this as in the wild until Microsoft clarifies,&#8221; Childs said. &#8220;The bug itself acts much like <a href="https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2024-21412" target="_blank" rel="noopener">CVE-2024-21412</a> – a [<a href="https://krebsonsecurity.com/2024/02/fat-patch-tuesday-february-2024-edition/" target="_blank" rel="noopener">zero-day threat from February</a>] that bypassed the Mark of the Web feature and allows malware to execute on a target system. Threat actors are sending exploits in a zipped file to evade EDR/NDR detection and then using this bug (and others) to bypass Mark of the Web.&#8221;</p>
<p><strong>Satnam Narang</strong> at <strong>Tenable</strong> notes that this month&#8217;s release includes fixes for two dozen flaws in <strong>Windows Secure Boot</strong>, the majority of which are considered “Exploitation Less Likely” according to Microsoft.</p>
<p>&#8220;However, the last time Microsoft patched a flaw in Windows Secure Boot <a href="https://krebsonsecurity.com/2023/05/microsoft-patch-tuesday-may-2023-edition/" target="_blank" rel="noopener">in May 2023</a> had a notable impact as it was exploited in the wild and linked to the BlackLotus UEFI bootkit, which was sold on dark web forums for $5,000,&#8221; Narang said. &#8220;BlackLotus can bypass functionality called secure boot, which is designed to block malware from being able to load when booting up. While none of these Secure Boot vulnerabilities addressed this month were exploited in the wild, they serve as a reminder that flaws in Secure Boot persist, and we could see more malicious activity related to Secure Boot in the future.&#8221;</p>
<p>For links to individual security advisories indexed by severity, check out <a href="https://www.zerodayinitiative.com/blog/2024/4/9/the-april-2024-security-updates-review" target="_blank" rel="noopener">ZDI&#8217;s blog</a> and the Patch Tuesday post from the <a href="https://isc.sans.edu/diary/April%202024%20Microsoft%20Patch%20Tuesday%20Summary/30822" target="_blank" rel="noopener">SANS Internet Storm Center</a>. Please consider backing up your data or your drive before updating, and drop a note in the comments here if you experience any issues applying these fixes.</p>
<p>Adobe today released nine patches tackling at least two dozen vulnerabilities in a range of software products, including <strong>Adobe After Effects</strong>, <strong>Photoshop</strong>, <strong>Commerce</strong>, <strong>InDesign</strong>, <strong>Experience Manager</strong>, <strong>Media Encoder</strong>, <strong>Bridge</strong>, <strong>Illustrator</strong>, and <strong>Adobe Animate</strong>.</p>
<p>KrebsOnSecurity needs to correct the record on a point mentioned at the end of March&#8217;s &#8220;<a href="https://krebsonsecurity.com/2024/02/fat-patch-tuesday-february-2024-edition/" target="_blank" rel="noopener">Fat Patch Tuesday</a>&#8221; post, which looked at new AI capabilities built into <strong>Adobe Acrobat</strong> that are turned on by default. Adobe has since clarified that its apps won&#8217;t use AI to auto-scan your documents, as the original language in its FAQ suggested.</p>
<p>&#8220;In practice, no document scanning or analysis occurs unless a user actively engages with the AI features by agreeing to the terms, opening a document, and selecting the AI Assistant or generative summary buttons for that specific document,&#8221; Adobe <a href="https://www.windowslatest.com/2024/04/02/adobe-clarifies-its-windows-apps-wont-auto-scan-your-documents-for-ai/" target="_blank" rel="noopener">said</a> earlier this month.</p>


feed_id: https://krebsonsecurity.com/?p=67137
title: Twitter’s Clumsy Pivot to X.com Is a Gift to Phishers
uri: Twitter-s-Clumsy-Pivot-to-X-com-Is-a-Gift-to-Phishers
url: https://krebsonsecurity.com/2024/04/twitters-clumsy-pivot-to-x-com-is-a-gift-to-phishers/
content:
<p>On April 9, Twitter/X began automatically modifying links that mention &#8220;twitter.com&#8221; to read &#8220;x.com&#8221; instead. But over the past 48 hours, dozens of new domain names have been registered that demonstrate how this change could be used to craft convincing phishing links &#8212; such as <strong>fedetwitter[.]com</strong>, which until very recently rendered as <strong>fedex.com</strong> in tweets.</p>
<div id="attachment_67139" style="width: 662px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-67139" decoding="async" class="wp-image-67139 size-full" src="media/c906679a.ruseriousx.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/04/ruseriousx.png" alt="" width="652" height="698" /><p id="caption-attachment-67139" class="wp-caption-text">The message displayed when one visits goodrtwitter.com, which Twitter/X displayed as goodrx.com in tweets and messages.</p></div>
<p>A search at <a href="https://www.domaintools.com" target="_blank" rel="noopener">DomainTools.com</a> shows at least 60 domain names have been registered over the past two days for domains ending in &#8220;twitter.com,&#8221; although research so far shows the majority of these domains have been registered &#8220;defensively&#8221; by private individuals to prevent the domains from being purchased by scammers.</p>
<p>Those include <strong>carfatwitter.com</strong>, which Twitter/X truncated to carfax.com when the domain appeared in user messages or tweets. Visiting this domain currently displays a message that begins, &#8220;Are you serious, X Corp?&#8221;</p>
<p><strong>Update:</strong> It appears Twitter/X has corrected its mistake, and no longer truncates any domain ending in &#8220;twitter.com&#8221; to &#8220;x.com.&#8221;</p>
<p><em>Original story:</em></p>
<p>The same message is on other newly registered domains, including <strong>goodrtwitter.com</strong> (goodrx.com), <strong>neobutwitter.com</strong> (neobux.com), <strong>roblotwitter.com</strong> (roblox.com), <strong>square-enitwitter.com</strong> (square-enix.com) and yandetwitter.com (yandex.com). The message left on these domains indicates they were defensively registered by <a href="https://compostintraining.club/@prplecake" target="_blank" rel="noopener">a user on Mastodon</a> whose bio says they are a systems admin/engineer. That profile has not responded to requests for comment.</p>
<p>A number of these new domains including &#8220;twitter.com&#8221; appear to be registered defensively by Twitter/X users in Japan. The domain netflitwitter.com (netflix.com, to Twitter/X users) now displays a message saying it was &#8220;acquired to prevent its use for malicious purposes,&#8221; along with a Twitter/X username.</p>
<p>The domain mentioned at the beginning of this story &#8212; fedetwitter.com &#8212; redirects users to the blog of a Japanese technology enthusiast. A user with the handle &#8220;amplest0e&#8221; appears to have registered <strong>space-twitter.com</strong>, which Twitter/X users would see as the CEO&#8217;s &#8220;space-x.com.&#8221; The domain &#8220;ametwitter.com&#8221; already redirects to the real americanexpress.com.<span id="more-67137"></span></p>
<p>Some of the domains registered recently and ending in &#8220;twitter.com&#8221; currently do not resolve and contain no useful contact information in their registration records. Those include <strong>firefotwitter[.]com</strong> (firefox.com), <strong>ngintwitter[.]com</strong> (nginx.com), and <strong>webetwitter[.]com</strong> (webex.com).</p>
<div id="attachment_67144" style="width: 760px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-67144" decoding="async" loading="lazy" class=" wp-image-67144" src="media/363c01b0.sextwitter.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/04/sextwitter.png" alt="" width="750" height="491" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/04/sextwitter.png 1299w, https://krebsonsecurity.com/wp-content/uploads/2024/04/sextwitter-768x503.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/04/sextwitter-782x512.png 782w" sizes="(max-width: 750px) 100vw, 750px" /><p id="caption-attachment-67144" class="wp-caption-text">The domain setwitter.com, which Twitter/X until very recently rendered as &#8220;sex.com,&#8221; redirects to this blog post warning about the recent changes and their potential use for phishing.</p></div>
<p><strong>Sean McNee</strong>, vice president of research and data at DomainTools, told KrebsOnSecurity it appears Twitter/X did not properly limit its redirection efforts.</p>
<p>&#8220;Bad actors could register domains as a way to divert traffic from legitimate sites or brands given the opportunity &#8212; many such brands in the top million domains end in x, such as webex, hbomax, xerox, xbox, and more,&#8221; McNee said. &#8220;It is also notable that several other globally popular brands, such as Rolex and Linux, were also on the list of registered domains.&#8221;</p>
<p>The apparent oversight by Twitter/X was cause for amusement and amazement from many former users who have migrated to other social media platforms since the new CEO took over. <strong>Matthew Garrett</strong>, a lecturer at U.C. Berkeley&#8217;s School of Information, <a href="https://infosec.exchange/@mjg59@nondeterministic.computer/112243298637438787" target="_blank" rel="noopener">summed up</a> the Schadenfreude thusly:</p>
<p>&#8220;Twitter just doing a &#8216;redirect links in tweets that go to x.com to twitter.com instead but accidentally do so for all domains that end x.com like eg spacex.com going to spacetwitter.com&#8217; is not absolutely the funniest thing I could imagine but it&#8217;s high up there.&#8221;</p>


feed_id: https://krebsonsecurity.com/?p=67160
title: Why CISA is Warning CISOs About a Breach at Sisense
uri: Why-CISA-is-Warning-CISOs-About-a-Breach-at-Sisense
url: https://krebsonsecurity.com/2024/04/why-cisa-is-warning-cisos-about-a-breach-at-sisense/
content:
<p>The <strong>U.S. Cybersecurity and Infrastructure Security Agency</strong> (CISA) said today it is investigating a breach at business intelligence company <strong>Sisense</strong>, whose products are designed to allow companies to view the status of multiple third-party online services in a single dashboard. CISA urged all Sisense customers to reset any credentials and secrets that may have been shared with the company, which is the same advice Sisense gave to its customers Wednesday evening.</p>
<p><img decoding="async" class="aligncenter wp-image-67162" src="media/dc703211.sisense.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/04/sisense.png" alt="" width="749" height="340" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/04/sisense.png 1304w, https://krebsonsecurity.com/wp-content/uploads/2024/04/sisense-768x348.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/04/sisense-782x354.png 782w" sizes="(max-width: 749px) 100vw, 749px" /></p>
<p>New York City based Sisense has more than a thousand customers across a range of industry verticals, including financial services, telecommunications, healthcare and higher education. On April 10, <strong>Sisense Chief Information Security Officer Sangram Dash</strong> told customers the company had been made aware of reports that &#8220;certain Sisense company information may have been made available on what we have been advised is a restricted access server (not generally available on the internet.)&#8221;</p>
<p>&#8220;We are taking this matter seriously and promptly commenced an investigation,&#8221; Dash continued. &#8220;We engaged industry-leading experts to assist us with the investigation. This matter has not resulted in an interruption to our business operations. Out of an abundance of caution, and while we continue to investigate, we urge you to promptly rotate any credentials that you use within your Sisense application.&#8221;</p>
<p>In its alert, CISA said it was working with private industry partners to respond to a recent compromise discovered by independent security researchers involving Sisense.</p>
<p>&#8220;CISA is taking an active role in collaborating with private industry partners to respond to this incident, especially as it relates to impacted critical infrastructure sector organizations,&#8221; the sparse alert reads. &#8220;We will provide updates as more information becomes available.&#8221;</p>
<p><img decoding="async" loading="lazy" class="aligncenter wp-image-67161" src="media/759ceffc.cisa-sisense.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/04/cisa-sisense.png" alt="" width="750" height="688" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/04/cisa-sisense.png 884w, https://krebsonsecurity.com/wp-content/uploads/2024/04/cisa-sisense-768x705.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/04/cisa-sisense-782x717.png 782w" sizes="(max-width: 750px) 100vw, 750px" /></p>
<p>Sisense declined to comment when asked about the veracity of information shared by two trusted sources with close knowledge of the breach investigation. Those sources said the breach appears to have started when the attackers somehow gained access to the company&#8217;s Gitlab code repository, and in that repository was a token or credential that gave the bad guys access to Sisense&#8217;s Amazon S3 buckets in the cloud.</p>
<p>Customers can use Gitlab either as a solution that is hosted in the cloud at Gitlab.com, or as a self-managed deployment. KrebsOnSecurity understands that Sisense was using the self-managed version of Gitlab.</p>
<p>Both sources said the attackers used the S3 access to copy and exfiltrate several terabytes worth of Sisense customer data, which apparently included millions of access tokens, email account passwords, and even SSL certificates.</p>
<p>The incident raises questions about whether Sisense was doing enough to protect sensitive data entrusted to it by customers, such as whether the massive volume of stolen customer data was ever encrypted while at rest in these Amazon cloud servers.</p>
<p>It is clear, however, that unknown attackers now have all of the credentials that Sisense customers used in their dashboards.<span id="more-67160"></span></p>
<p>The breach also makes clear that Sisense is somewhat limited in the clean-up actions that it can take on behalf of customers, because access tokens are essentially text files on your computer that allow you to stay logged in for extended periods of time &#8212; sometimes indefinitely. And depending on which service we&#8217;re talking about, it may be possible for attackers to re-use those access tokens to authenticate as the victim without ever having to present valid credentials.</p>
<p>Beyond that, it is largely up to Sisense customers to decide if and when they change passwords to the various third-party services that they&#8217;ve previously entrusted to Sisense.</p>
<p>Earlier today, a public relations firm working with Sisense reached out to learn if KrebsOnSecurity planned to publish any further updates on their breach (KrebsOnSecurity posted a screenshot of the CISO&#8217;s customer email to both <a href="https://www.linkedin.com/posts/bkrebs_there-is-something-potentially-huge-popping-activity-7183982303784620033-T3wd?utm_source=share&amp;utm_medium=member_desktop" target="_blank" rel="noopener">LinkedIn</a> and <a href="https://infosec.exchange/@briankrebs/112249710611213991" target="_blank" rel="noopener">Mastodon</a> on Wednesday evening). The PR rep said Sisense wanted to make sure they had an opportunity to comment before the story ran.</p>
<p>But when confronted with the details shared by my sources, Sisense apparently changed its mind.</p>
<p>&#8220;After consulting with Sisense, they have told me that they don&#8217;t wish to respond,&#8221; the PR rep said in an emailed reply.</p>
<p><strong>Update, 6:49 p.m., ET:</strong> Added clarification that Sisense is using a self-hosted version of Gitlab, not the cloud version managed by Gitlab.com. </p>
<p>Also, Sisense&#8217;s CISO Dash just sent an update to customers directly. The latest advice from the company is far more detailed, and involves resetting a potentially large number of access tokens across multiple technologies, including Microsoft Active Directory credentials, GIT credentials, web access tokens, and any single sign-on (SSO) secrets or tokens. </p>
<p>The full message from Dash to customers is below:</p>
<p>&#8220;Good Afternoon,</p>
<p>We are following up on our prior communication of April 10, 2024, regarding reports that certain Sisense company information may have been made available on a restricted access server. As noted, we are taking this matter seriously and our investigation remains ongoing.</p>
<p>Our customers must reset any keys, tokens, or other credentials in their environment used within the Sisense application.</p>
<p>Specifically, you should:<br />
&#8211; Change Your Password: Change all Sisense-related passwords on http://my.sisense.com<br />
&#8211; Non-SSO:<br />
    &#8211; Replace the Secret in the Base Configuration Security section with your GUID/UUID.<br />
    &#8211; Reset passwords for all users in the Sisense application.<br />
    &#8211; Logout all users by running GET /api/v1/authentication/logout_all under Admin user.<br />
&#8211; Single Sign-On (SSO):<br />
    &#8211; If you use SSO JWT for the user’s authentication in Sisense, you will need to update sso.shared_secret in Sisense and then use the newly generated value on the side of the SSO handler.<br />
    &#8211; We strongly recommend rotating the x.509 certificate for your SSO SAML identity provider.<br />
    &#8211; If you utilize OpenID, it’s imperative to rotate the client secret as well.<br />
    &#8211; Following these adjustments, update the SSO settings in Sisense with the revised values.<br />
    &#8211; Logout all users by running GET /api/v1/authentication/logout_all under Admin user.<br />
&#8211; Customer Database Credentials: Reset credentials in your database that were used in the Sisense application to ensure continuity of connection between the systems.<br />
&#8211; Data Models: Change all usernames and passwords in the database connection string in the data models.<br />
&#8211; User Params: If you are using the User Params feature, reset them.<br />
&#8211; Active Directory/LDAP: Change the username and user password of users whose authorization is used for AD synchronization.<br />
&#8211; HTTP Authentication for GIT: Rotate the credentials in every GIT project.<br />
&#8211; B2D Customers: Use the following API PATCH api/v2/b2d-connection in the admin section to update the B2D connection.<br />
&#8211; Infusion Apps: Rotate the associated keys.<br />
&#8211; Web Access Token: Rotate all tokens.<br />
&#8211; Custom Email Server: Rotate associated credentials.<br />
&#8211; Custom Code: Reset any secrets that appear in custom code Notebooks.</p>
<p>If you need any assistance, please submit a customer support ticket at https://community.sisense.com/t5/support-portal/bd-p/SupportPortal and mark it as critical. We have a dedicated response team on standby to assist with your requests.</p>
<p>At Sisense, we give paramount importance to security and are committed to our customers’ success. Thank you for your partnership and commitment to our mutual security.</p>
<p>Regards,</p>
<p>Sangram Dash<br />
Chief Information Security Officer&#8221;</p>


feed_id: https://krebsonsecurity.com/?p=67102
title: Crickets from Chirp Systems in Smart Lock Key Leak
uri: Crickets-from-Chirp-Systems-in-Smart-Lock-Key-Leak
url: https://krebsonsecurity.com/2024/04/crickets-from-chirp-systems-in-smart-lock-key-leak/
content:
<p>The U.S. government is warning that &#8220;smart locks&#8221; securing entry to an estimated 50,000 dwellings nationwide contain hard-coded credentials that can be used to remotely open any of the locks. The lock&#8217;s maker <strong>Chirp Systems</strong> remains unresponsive, even though it was first notified about the critical weakness in March 2021. Meanwhile, Chirp&#8217;s parent company, <strong>RealPage, Inc.</strong>, is being sued by multiple U.S. states for allegedly colluding with landlords to illegally raise rents.</p>
<p><img decoding="async" class="aligncenter wp-image-67129" src="media/b6179640.chirpsystems.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/04/chirpsystems.png" alt="" width="751" height="451" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/04/chirpsystems.png 1309w, https://krebsonsecurity.com/wp-content/uploads/2024/04/chirpsystems-768x462.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/04/chirpsystems-782x470.png 782w" sizes="(max-width: 751px) 100vw, 751px" /></p>
<p>On March 7, 2024, the <strong>U.S. Cybersecurity &amp; Infrastructure Security Agency</strong> (CISA) <a href="https://www.cisa.gov/news-events/ics-advisories/icsa-24-067-01" target="_blank" rel="noopener">warned</a> about a remotely exploitable vulnerability with &#8220;low attack complexity&#8221; in Chirp Systems smart locks.</p>
<p>&#8220;Chirp Access improperly stores credentials within its source code, potentially exposing sensitive information to unauthorized access,&#8221; CISA&#8217;s alert warned, assigning the bug a CVSS (badness) rating of 9.1 (out of a possible 10). &#8220;Chirp Systems has not responded to requests to work with CISA to mitigate this vulnerability.&#8221;</p>
<p><strong>Matt Brown</strong>, the researcher CISA credits with reporting the flaw, is a senior systems development engineer at Amazon Web Services. Brown said he discovered the weakness and reported it to Chirp in March 2021, after the company that manages his apartment building started using Chirp smart locks and told everyone to install Chirp&#8217;s app to get in and out of their apartments.</p>
<p>&#8220;I use Android, which has a pretty simple workflow for downloading and decompiling the APK apps,&#8221; Brown told KrebsOnSecurity. &#8220;Given that I am pretty picky about what I trust on my devices, I downloaded Chirp and after decompiling, found that they were storing passwords and private key strings in a file.&#8221;</p>
<p>Using those hard-coded credentials, Brown found an attacker could then connect to an application programming interface (API) that Chirp uses which is managed by smart lock vendor <strong>August.com</strong>, and use that to enumerate and remotely lock or unlock any door in any building that uses the technology.<span id="more-67102"></span></p>
<p>Brown said when he complained to his leasing office, they sold him a small $50 key fob that uses Near-Field Communications (NFC) to toggle the lock when he brings the fob close to his front door. But he said the fob doesn&#8217;t eliminate the ability for anyone to remotely unlock his front door using the exposed credentials and the Chirp mobile app.</p>
<div id="attachment_67131" style="width: 662px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-67131" decoding="async" loading="lazy" class="size-full wp-image-67131" src="media/a4271f38.camdenchirp.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/04/camdenchirp.png" alt="" width="652" height="698" /><p id="caption-attachment-67131" class="wp-caption-text">A smart lock enabled with Chirp. Image: Camdenliving.com</p></div>
<p>Also, the fobs pass the credentials to his front door over the air in plain text, meaning someone could clone the fob just by bumping against him with <a href="https://play.google.com/store/apps/details?id=com.wakdev.wdnfc&amp;hl=en_US&amp;gl=US" target="_blank" rel="noopener">a smartphone app</a> made to read and write NFC tags.</p>
<p>Neither August nor Chirp Systems responded to requests for comment. It&#8217;s unclear exactly how many apartments and other residences are using the vulnerable Chirp locks, but multiple articles about the company from 2020 state that approximately 50,000 units use Chirp smart locks with August&#8217;s API.</p>
<p>Roughly a year before Brown reported the flaw to Chirp Systems, the company was bought by <strong>RealPage</strong>, a firm founded in 1998 as a developer of multifamily property management and data analytics software. In 2021, RealPage was acquired by the private equity giant <a href="https://en.wikipedia.org/wiki/Thoma_Bravo" target="_blank" rel="noopener">Thoma Bravo</a>.</p>
<p>Brown said the exposure he found in Chirp&#8217;s products is &#8220;an obvious flaw that is super easy to fix.&#8221;</p>
<p>&#8220;It&#8217;s just a matter of them being motivated to do it,&#8221; he said. &#8220;But they&#8217;re part of a private equity company now, so they&#8217;re not answerable to anybody. It&#8217;s too bad, because it&#8217;s not like residents of [the affected] properties have another choice. It&#8217;s either agree to use the app or move.&#8221;</p>
<p>In October 2022, <a href="https://www.propublica.org/article/yieldstar-rent-increase-realpage-rent" target="_blank" rel="noopener">an investigation</a> by <em>ProPublica</em> examined RealPage&#8217;s dominance in the rent-setting software market, and that it found &#8220;uses a mysterious algorithm to help landlords push the highest possible rents on tenants.&#8221;</p>
<p>&#8220;For tenants, the system upends the practice of negotiating with apartment building staff,&#8221; ProPublica found. &#8220;RealPage discourages bargaining with renters and has even recommended that landlords in some cases accept a lower occupancy rate in order to raise rents and make more money. One of the algorithm’s developers told ProPublica that leasing agents had &#8216;too much empathy&#8217; compared to computer generated pricing.&#8221;</p>
<p>Last year, the U.S. Department of Justice <a href="https://www.propublica.org/article/doj-backs-tenants-price-fixing-case-big-landlords-real-estate-tech" target="_blank" rel="noopener">threw its weight behind</a> a massive lawsuit filed by dozens of tenants who are accusing the $9 billion apartment software company of helping landlords collude to inflate rents.</p>
<p>In February 2024, attorneys general for Arizona and the District of Columbia sued RealPage, alleging RealPage&#8217;s software helped create a rental monopoly.</p>


feed_id: https://krebsonsecurity.com/?p=67190
title: Who Stole 3.6M Tax Records from South Carolina?
uri: Who-Stole-3-6M-Tax-Records-from-South-Carolina
url: https://krebsonsecurity.com/2024/04/who-stole-3-6m-tax-records-from-south-carolina/
content:
<p><img decoding="async" class="aligncenter wp-image-42398" src="media/69b57c63.taxthiefa.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/01/taxthiefa.png" alt="" width="750" height="275" /></p>
<p>For nearly a dozen years, residents of South Carolina have been kept in the dark by state and federal investigators over who was responsible for hacking into the state&#8217;s revenue department in 2012 and stealing tax and bank account information for 3.6 million people. The answer may no longer be a mystery: KrebsOnSecurity found compelling clues suggesting the intrusion was carried out by the same Russian hacking crew that stole of millions of payment card records from big box retailers like <strong>Home Depot</strong> and <strong>Target</strong> in the years that followed.</p>
<p>Questions about who stole tax and financial data on roughly three quarters of all South Carolina residents came to the fore last week at the confirmation hearing of <strong>Mark Keel</strong>, who was appointed in 2011 by <strong>Gov. Nikki Haley</strong> to head the state&#8217;s law enforcement division. If approved, this would be Keel&#8217;s third six-year term in that role.</p>
<p><em>The Associated Press</em> <a href="https://apnews.com/article/south-carolina-hacking-tax-returns-2012-5984ce1c6f47938da7a671d0fccadd22" target="_blank" rel="noopener">reports</a> that Keel was careful not to release many details about the breach at his hearing, telling lawmakers he knows who did it but that he wasn&#8217;t ready to name anyone.</p>
<p>&#8220;I think the fact that we didn&#8217;t come up with a whole lot of people&#8217;s information that got breached is a testament to the work that people have done on this case,&#8221; Keel asserted.</p>
<p>A ten-year <a href="//www.postandcourier.com/columbia/news/scs-massive-data-breach-10-years-later-questions-linger-as-investigation-remains-open/article_29dd8164-4025-11ed-9433-73cafd23fadb.html" target="_blank" rel="noopener">retrospective</a> published in 2022 by <em>The Post and Courier</em> in Columbia, S.C. said investigators determined the breach began on Aug. 13, 2012, after a state IT contractor clicked a malicious link in an email. State officials said they found out about the hack from federal law enforcement on October 10, 2012.</p>
<p>KrebsOnSecurity examined posts across dozens of cybercrime forums around that time, and found only one instance of someone selling large volumes of tax data in the year surrounding the breach date.</p>
<p>On Oct. 7, 2012 &#8212; three days before South Carolina officials say they first learned of the intrusion &#8212; a notorious cybercriminal who goes by the handle &#8220;<strong>Rescator</strong>&#8221; advertised the sale of &#8220;a database of the tax department of one of the states.&#8221;</p>
<p>&#8220;Bank account information, SSN and all other information,&#8221; Rescator&#8217;s sales thread on the Russian-language crime forum <strong>Embargo</strong> read. &#8220;If you purchase the entire database, I will give you access to it.&#8221;</p>
<p>A week later, Rescator posted a similar offer on the exclusive Russian forum <strong>Mazafaka</strong>, saying he was selling information from a U.S. state tax database, without naming the state. Rescator said the data exposed included Social Security Number (SSN), employer, name, address, phone, taxable income, tax refund amount, and bank account number.</p>
<p>&#8220;There is a lot of information, I am ready to sell the entire database, with access to the database, and in parts,&#8221; Rescator told Mazafaka members. &#8220;There is also information on corporate taxpayers.&#8221;<span id="more-67190"></span></p>
<p>On Oct. 26, 2012, the state announced the breach publicly. State officials said they were working with investigators from the <strong>U.S. Secret Service</strong> and digital forensics experts from Mandiant, which produced <a href="media/6205ba3e.Mandiant20Report_0.pdf" data-original-source="https://oag.ca.gov/system/files/Mandiant%20Report_0.pdf" target="_blank" rel="noopener">an incident report</a> (PDF) that was later published by South Carolina Dept. of Revenue. KrebsOnSecurity sought comment from the Secret Service, South Carolina prosecutors, and Mr. Keel&#8217;s office. This story will be updated if any of them respond.</p>
<p>On Nov. 18, 2012, Rescator told fellow denizens of the forum <strong>Verified</strong> he was selling a database of 65,000 records with bank account information from several smaller, regional financial institutions. Rescator&#8217;s sales thread on Verified listed more than a dozen database fields, including account number, name, address, phone, tax ID, date of birth, employer and occupation.</p>
<p>Asked to provide more context about the database for sale, Rescator told forum members the database included financial records related to tax filings of a U.S. state. Rescator added that there was a second database of around 80,000 corporations that included social security numbers, names and addresses, but no financial information.</p>
<p>The AP says South Carolina paid $12 million to Experian for identity theft protection and credit monitoring for its residents after the breach.</p>
<p>&#8220;At the time, it was one of the largest breaches in U.S. history but has since been surpassed greatly by hacks to Equifax, Yahoo, Home Depot, Target and PlayStation,&#8221; the AP&#8217;s <strong>Jeffrey Collins</strong> wrote.</p>
<p>As it happens, Rescator&#8217;s criminal hacking crew was directly responsible for <a href="https://krebsonsecurity.com/tag/target-breach/" target="_blank" rel="noopener">the 2013 breach at Target</a> and the 2014 <a href="https://krebsonsecurity.com/tag/home-depot-breach/" target="_blank" rel="noopener">hack of Home Depot</a>. The Target intrusion saw Rescator&#8217;s cybercrime shops selling roughly 40 million stolen payment cards, and 56 million cards from Home Depot customers.</p>
<p>Who is Rescator? On Dec. 14, 2023, KrebsOnSecurity published the results of <a href="https://krebsonsecurity.com/2023/12/ten-years-later-new-clues-in-the-target-breach/" target="_blank" rel="noopener">a 10-year investigation into the identity of Rescator</a>, a.k.a. <strong>Mikhail Borisovich Shefel</strong>, a 36-year-old who lives in Moscow and who recently changed his last name to Lenin.</p>
<p><img decoding="async" loading="lazy" class="aligncenter wp-image-67207" src="media/ddbe5ba2.shefel-fb1.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/04/shefel-fb1.png" alt="" width="750" height="572" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/04/shefel-fb1.png 942w, https://krebsonsecurity.com/wp-content/uploads/2024/04/shefel-fb1-768x585.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/04/shefel-fb1-782x596.png 782w" sizes="(max-width: 750px) 100vw, 750px" /></p>
<p>Mr. Keel&#8217;s assertion that somehow the efforts of South Carolina officials following the breach may have lessened its impact on citizens seems unlikely. The stolen tax and financial data appears to have been sold openly on cybercrime forums by one of the Russian underground&#8217;s most aggressive and successful hacking crews.</p>
<p>While there are no indications from reviewing forum posts that Rescator ever sold the data, his sales threads came at a time when the incidence of <a href="https://krebsonsecurity.com/category/tax-refund-fraud/" target="_blank" rel="noopener">tax refund fraud</a> was skyrocketing.</p>
<p>Tax-related identity theft occurs when someone uses a stolen identity and SSN to file a tax return in that person&#8217;s name claiming a fraudulent refund. Victims usually first learn of the crime after having their returns rejected because scammers beat them to it. Even those who are not required to file a return can be victims of refund fraud, <em>as can those who are not actually owed a refund</em> from the <strong>U.S. Internal Revenue Service</strong> (IRS).</p>
<p>According to <a title="http://www.cbsnews.com/news/irs-refunded-4-billion-to-identity-thieves-last-year-inspector-generals-report-says/" href="http://www.cbsnews.com/news/irs-refunded-4-billion-to-identity-thieves-last-year-inspector-generals-report-says/" target="_blank" rel="noopener">a 2013 report</a> from the Treasury Inspector General’s office, the IRS issued nearly $4 billion in bogus tax refunds in 2012, and more than $5.8 billion in 2013. The money largely was sent to people who stole SSNs and other information on U.S. citizens, and then filed fraudulent tax returns on those individuals claiming a large refund but at a different address.</p>
<p>It remains unclear why Shefel has never been officially implicated in the breaches at Target, Home Depot, or in South Carolina. It may be that Shefel <em>has</em> been indicted, and that those indictments remain sealed for some reason. Perhaps prosecutors were hoping Shefel would decide to leave Russia, at which point it would be easier to apprehend him if he believed no one was looking for him.</p>
<p>But all signs are that Shefel is deeply rooted in Russia, and has no plans to leave. In January 2024, authorities in Australia, the United States and the U.K. levied financial sanctions against 33-year-old Russian man <strong>Aleksandr Ermakov</strong> for allegedly stealing data on 10 million customers of the Australian health insurance giant Medibank.</p>
<p>A week after those sanctions were put in place, KrebsOnSecurity published <a href="https://krebsonsecurity.com/2024/01/who-is-alleged-medibank-hacker-aleksandr-ermakov/" target="_blank" rel="noopener">a deep dive on Ermakov</a>, which found that he co-ran a Moscow-based IT security consulting business along with Mikhail Shefel called<strong> Shtazi-IT</strong>.</p>
<div id="attachment_66196" style="width: 759px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-66196" decoding="async" loading="lazy" class=" wp-image-66196" src="media/d0187576.shtazi-ru.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2024/01/shtazi-ru.png" alt="" width="749" height="307" srcset="https://krebsonsecurity.com/wp-content/uploads/2024/01/shtazi-ru.png 1806w, https://krebsonsecurity.com/wp-content/uploads/2024/01/shtazi-ru-768x315.png 768w, https://krebsonsecurity.com/wp-content/uploads/2024/01/shtazi-ru-1536x629.png 1536w, https://krebsonsecurity.com/wp-content/uploads/2024/01/shtazi-ru-782x320.png 782w" sizes="(max-width: 749px) 100vw, 749px" /><p id="caption-attachment-66196" class="wp-caption-text">A Google-translated version of Shtazi dot ru. Image: Archive.org.</p></div>


feed_id: https://krebsonsecurity.com/?p=67255
title: Russian FSB Counterintelligence Chief Gets 9 Years in Cybercrime Bribery Scheme
uri: Russian-FSB-Counterintelligence-Chief-Gets-9-Years-in-Cybercrime-Bribe
url:
https://krebsonsecurity.com/2024/04/russian-fsb-counterintelligence-chief-gets-9-years-in-cybercrime-bribery-scheme/

content:
<p>The head of counterintelligence for a division of the Russian <strong>Federal Security Service</strong> (FSB) was sentenced last week to nine years in a penal colony for accepting a USD $1.7 million bribe to ignore the activities of a prolific Russian cybercrime group that hacked thousands of e-commerce websites. The protection scheme was exposed in 2022 when Russian authorities arrested six members of the group, which sold millions of stolen payment cards at flashy online shops like <strong>Trump&#8217;s Dumps</strong>.</p>
<div id="attachment_39492" style="width: 760px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-39492" decoding="async" class=" wp-image-39492" src="media/ad4460b9.trumpsdumps-580x395.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2017/05/trumpsdumps-580x395.png" alt="" width="750" height="511" srcset="https://krebsonsecurity.com/wp-content/uploads/2017/05/trumpsdumps-580x395.png 580w, https://krebsonsecurity.com/wp-content/uploads/2017/05/trumpsdumps-768x524.png 768w, https://krebsonsecurity.com/wp-content/uploads/2017/05/trumpsdumps-940x641.png 940w, https://krebsonsecurity.com/wp-content/uploads/2017/05/trumpsdumps.png 1295w" sizes="(max-width: 750px) 100vw, 750px" /><p id="caption-attachment-39492" class="wp-caption-text">A now-defunct carding shop that sold stolen credit cards and invoked 45&#8217;s likeness and name.</p></div>
<p>As <a href="https://therecord.media/former-fsb-officer-sentenced-russia-helping-hackers" target="_blank" rel="noopener">reported</a> by <em>The Record</em>, a Russian court last week sentenced former FSB officer <strong>Grigory Tsaregorodtsev</strong> for taking a $1.7 million bribe from a cybercriminal group that was seeking a &#8220;roof,&#8221; a well-placed, corrupt law enforcement official who could be counted on to both disregard their illegal hacking activities and run interference with authorities in the event of their arrest.</p>
<p>Tsaregorodtsev was head of the counterintelligence department for a division of the FSB based in Perm, Russia. In February 2022, Russian <a href="https://krebsonsecurity.com/2022/02/russian-govt-continues-carding-shop-crackdown/" target="_blank" rel="noopener">authorities arrested six men in the Perm region</a> accused of selling stolen payment card data. They also seized multiple carding shops run by the gang, including <strong>Ferum Shop</strong>, <strong>Sky-Fraud</strong>, and <strong>Trump&#8217;s Dumps</strong>, a popular fraud store that invoked the 45th president’s likeness and promised to &#8220;make credit card fraud great again.&#8221;</p>
<p>All of the domains seized in that raid were registered by an IT consulting company in Perm called <strong>Get-net LLC</strong>, which was owned in part by <strong>Artem Zaitsev</strong> &#8212; one of the six men arrested. Zaitsev reportedly was a well-known programmer whose company supplied services and leasing to the local FSB field office.<span id="more-67255"></span></p>
<div id="attachment_58442" style="width: 759px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-58442" decoding="async" loading="lazy" class=" wp-image-58442" src="media/e85102c0.deptk-td.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/02/deptk-td.png" alt="" width="749" height="483" /><p id="caption-attachment-58442" class="wp-caption-text">The message for Trump&#8217;s Dumps users left behind by Russian authorities that seized the domain in 2022.</p></div>
<p>Russian news sites report that Internal Affairs officials with the FSB grew suspicious when Tsaregorodtsev became a little too interested in the case following the hacking group&#8217;s arrests. The former FSB agent had reportedly assured the hackers he could have their case transferred and that they would soon be free.</p>
<p>But when that promised freedom didn&#8217;t materialize, four the of the defendants pulled the walls down on the scheme and brought down their own roof. The FSB arrested Tsaregorodtsev, and seized $154,000 in cash, 100 gold bars, real estate and expensive cars.</p>
<p>At Tsaregorodtsev&#8217;s trial, his lawyers argued that their client wasn&#8217;t guilty of bribery per se, but that he did admit to fraud because he was ultimately unable to fully perform the services for which he&#8217;d been hired.</p>
<p>The Russian news outlet <em>Kommersant</em> reports that all four of those who cooperated were released with probation or correctional labor. Zaitsev received a sentence of 3.5 years in prison, and defendant <strong>Alexander Kovalev</strong> got four years.</p>
<p>In 2017, KrebsOnSecurity <a href="https://krebsonsecurity.com/2017/05/trumps-dumps-making-dumps-great-again/" target="_blank" rel="noopener">profiled Trump&#8217;s Dumps</a>, and found the contact address listed on the site was tied to an email address used to register more than a dozen domains that were made to look like legitimate Javascript calls many e-commerce sites routinely make to process transactions &#8212; such as &#8220;js-link[dot]su,&#8221; &#8220;js-stat[dot]su,&#8221; and &#8220;js-mod[dot]su.&#8221;</p>
<p>Searching on those malicious domains revealed <a href="https://web.archive.org/web/20161114152809/https://www.riskiq.com/blog/labs/magecart-keylogger-injection/" target="_blank" rel="noopener">a 2016 report from RiskIQ</a>, which shows the domains featured prominently in a series of hacking campaigns against e-commerce websites. According to RiskIQ, the attacks targeted online stores running outdated and unpatched versions of shopping cart software from <strong>Magento</strong>, <strong>Powerfront</strong> and <strong>OpenCart</strong>.</p>
<p>Those shopping cart flaws allowed the crooks to install &#8220;web skimmers,&#8221; malicious Javascript used to steal credit card details and other information from payment forms on the checkout pages of vulnerable e-commerce sites. The stolen customer payment card details were then sold on sites like Trump&#8217;s Dumps and Sky-Fraud.</p>


feed_id: https://krebsonsecurity.com/?p=67297
title: FCC Fines Major U.S. Wireless Carriers for Selling Customer Location Data
uri: FCC-Fines-Major-U-S-Wireless-Carriers-for-Selling-Customer-Location-D
url:
https://krebsonsecurity.com/2024/04/fcc-fines-major-u-s-wireless-carriers-for-selling-customer-location-data/

content:
<p>The <strong>U.S. Federal Communications Commission</strong> (FCC) today levied fines totaling nearly $200 million against the four major carriers &#8212; including <strong>AT&amp;T</strong>, <strong>Sprint</strong>, <strong>T-Mobile</strong> and <strong>Verizon</strong> &#8212; for illegally sharing access to customers&#8217; location information without consent.</p>
<p><img decoding="async" class="aligncenter wp-image-43845" src="media/f262877a.locationtracking.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/05/locationtracking.jpg" alt="" width="744" height="482" /></p>
<p>The fines mark the culmination of a more than four-year investigation into the actions of the major carriers. In February 2020, the FCC put all four wireless providers on notice that their practices of sharing access to customer location data were likely violating the law.</p>
<p>The FCC said it found the carriers each sold access to its customers&#8217; location information to &#8216;aggregators,&#8217; who then resold access to the information to third-party location-based service providers.</p>
<p>&#8220;In doing so, each carrier attempted to offload its obligations to obtain customer consent onto downstream recipients of location information, which in many instances meant that no valid customer consent was obtained,&#8221; <a href="https://www.fcc.gov/document/fcc-fines-largest-wireless-carriers-sharing-location-data" target="_blank" rel="noopener">an FCC statement</a> on the action reads. &#8220;This initial failure was compounded when, after becoming aware that their safeguards were ineffective, the carriers continued to sell access to location information without taking reasonable measures to protect it from unauthorized access.&#8221;</p>
<p>The FCC&#8217;s <a href="media/a40b0964.FCC-24-40A1.pdf" data-original-source="https://docs.fcc.gov/public/attachments/FCC-24-40A1.pdf" target="_blank" rel="noopener">findings against AT&amp;T</a>, for example, show that AT&amp;T sold customer location data directly or indirectly to at least 88 third-party entities. The FCC <a href="media/d4189fc0.FCC-24-41A1.pdf" data-original-source="https://docs.fcc.gov/public/attachments/FCC-24-41A1.pdf" target="_blank" rel="noopener">found</a> Verizon sold access to customer location data (indirectly or directly) to 67 third-party entities. Location data for Sprint customers found its way to 86 third-party entities, and to 75 third-parties in the case of T-Mobile customers.</p>
<p>The commission said it took action after <strong>Sen. Ron Wyden</strong> (D-Ore.) <a href="media/74c29b4d.wyden-securus-location-tracking-letter-to-fcc.pdf" data-original-source="https://www.wyden.senate.gov/imo/media/doc/wyden-securus-location-tracking-letter-to-fcc.pdf" target="_blank" rel="noopener">sent a letter to the FCC</a> detailing how a company called <strong>Securus Technologies</strong> had been selling location data on customers of virtually any major mobile provider to law enforcement officials.</p>
<p>That same month, KrebsOnSecurity <a href="https://krebsonsecurity.com/2018/05/tracking-firm-locationsmart-leaked-location-data-for-customers-of-all-major-u-s-mobile-carriers-in-real-time-via-its-web-site/" target="_blank" rel="noopener">broke the news</a> that <strong>LocationSmart</strong> — a data aggregation firm working with the major wireless carriers — had a free, unsecured demo of its service online that anyone could abuse to find the near-exact location of virtually any mobile phone in North America.<span id="more-67297"></span><span id="more-50646"></span></p>
<p>The carriers <a href="https://krebsonsecurity.com/2018/06/verizon-to-stop-sharing-customer-location-data-with-third-parties/" target="_blank" rel="noopener">promised to &#8220;wind down&#8221; location data sharing agreements</a> with third-party companies. But in 2019, reporting at <a href="https://www.vice.com/en_us/article/nepxbz/i-gave-a-bounty-hunter-300-dollars-located-phone-microbilt-zumigo-tmobile" target="_blank" rel="noopener">Vice.com showed</a> that little had changed, detailing how reporters were able to locate a test phone after paying $300 to a bounty hunter who simply bought the data through a little-known third-party service.</p>
<p>Sen. Wyden said no one who signed up for a cell plan thought they were giving permission for their phone company to sell a detailed record of their movements to anyone with a credit card.</p>
<p>&#8220;I applaud the FCC for following through on my investigation and holding these companies accountable for putting customers’ lives and privacy at risk,” Wyden said in a statement today.</p>
<p>The FCC fined Sprint and T-Mobile $12 million and $80 million respectively. AT&amp;T was fined more than $57 million, while Verizon received a $47 million penalty. Still, these fines represent a tiny fraction of each carrier&#8217;s annual revenues. For example, $47 million is less than one percent of Verizon&#8217;s total wireless service revenue in 2023, which was nearly $77 billion.</p>
<p>The fine amounts vary because they were calculated based in part on the number of days that the carriers continued sharing customer location data after being notified that doing so was illegal (the agency also considered the number of active third-party location data sharing agreements). The FCC notes that AT&amp;T and Verizon each took more than 320 days from the publication of the Times story to wind down their data sharing agreements; T-Mobile took 275 days; Sprint kept sharing customer location data for 386 days.</p>
<p><strong>Update, 6:25 p.m. ET:</strong> Clarified that the FCC launched its investigation at the request of Sen. Wyden.</p>


feed_id: https://krebsonsecurity.com/?p=67317
title: Man Who Mass-Extorted Psychotherapy Patients Gets Six Years
uri: Man-Who-Mass-Extorted-Psychotherapy-Patients-Gets-Six-Years
url: https://krebsonsecurity.com/2024/04/man-who-mass-extorted-psychotherapy-patients-gets-six-years/
content:
<p>A 26-year-old Finnish man was sentenced to more than six years in prison today after being convicted of hacking into an online psychotherapy clinic, leaking tens of thousands of patient therapy records, and attempting to extort the clinic and patients.</p>
<p><img decoding="async" class="aligncenter  wp-image-61773" src="media/0074dfea.kikmaki-wanted.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/11/kikmaki-wanted.png" alt="" width="750" height="357" srcset="https://krebsonsecurity.com/wp-content/uploads/2022/11/kikmaki-wanted.png 2936w, https://krebsonsecurity.com/wp-content/uploads/2022/11/kikmaki-wanted-768x366.png 768w, https://krebsonsecurity.com/wp-content/uploads/2022/11/kikmaki-wanted-1536x731.png 1536w, https://krebsonsecurity.com/wp-content/uploads/2022/11/kikmaki-wanted-2048x975.png 2048w, https://krebsonsecurity.com/wp-content/uploads/2022/11/kikmaki-wanted-782x372.png 782w" sizes="(max-width: 750px) 100vw, 750px" /></p>
<p>On October 21, 2020, the <strong>Vastaamo Psychotherapy Center</strong> in Finland became the target of blackmail when a tormentor identified as “ransom_man” demanded payment of 40 bitcoins (~450,000 euros at the time) in return for a promise not to publish highly sensitive therapy session notes Vastaamo had exposed online.</p>
<p>Ransom_man announced on the dark web that he would start publishing 100 patient profiles every 24 hours. When Vastaamo declined to pay, ransom_man shifted to extorting individual patients. According to Finnish police, some 22,000 victims reported extortion attempts targeting them personally, targeted emails that threatened to publish their therapy notes online unless paid a 500 euro ransom.</p>
<p>Finnish prosecutors quickly zeroed in on a suspect:<strong> Julius &#8220;Zeekill&#8221; Kivimäki</strong>, a notorious criminal hacker convicted of committing tens of thousands of cybercrimes before he became an adult. After being charged with the attack in October 2022, Kivimäki fled the country. He was <a href="https://krebsonsecurity.com/2023/02/finlands-most-wanted-hacker-nabbed-in-france/" target="_blank" rel="noopener">arrested four months later in France</a>, hiding out under an assumed name and passport.</p>
<p><strong>Antti Kurittu</strong> is a former criminal investigator who worked on an investigation involving Kivimäki’s use of the Zbot botnet, among other activities Kivimäki engaged in as a member of the hacker group <a href="https://krebsonsecurity.com/2015/02/webnic-registrar-blamed-for-hijack-of-lenovo-google-domains/" target="_blank" rel="noopener">Hack the Planet</a> (HTP).</p>
<p>Kurittu said the prosecution had demanded at least seven years in jail, and that the sentence handed down was six years and three months. Kurittu said prosecutors knocked a few months off of Kivimäki&#8217;s sentence because he agreed to pay compensation to his victims, and that Kivimäki will remain in prison during any appeal process.</p>
<p>&#8220;I think the sentencing was as expected, knowing the Finnish judicial system,&#8221; Kurittu told KrebsOnSecurity. &#8220;As Kivimäki has not been sentenced to a non-suspended prison sentence during the last five years, he will be treated as a first-timer, his previous convictions notwithstanding.&#8221;</p>
<p>But because juvenile convictions in Finland don&#8217;t count towards determining whether somebody is a first-time offender, Kivimäki will end up serving approximately half of his sentence.</p>
<p>&#8220;This seems like a short sentence when taking into account the gravity of his actions and the life-altering consequences to thousands of people, but it&#8217;s almost the maximum the law allows for,&#8221; Kurittu said.<span id="more-67317"></span></p>
<p>Kivimäki initially gained notoriety as a self-professed member of the <a href="https://krebsonsecurity.com/tag/lizard-squad/" target="_blank" rel="noopener">Lizard Squad</a>, a mainly low-skilled hacker group that specialized in DDoS attacks. But American and Finnish investigators say Kivimäki’s involvement in cybercrime dates back to at least 2008, when he was introduced to a founding member of what would soon become HTP.</p>
<p>Finnish police said Kivimäki also used the nicknames “Ryan”, “RyanC” and “Ryan Cleary” (Ryan Cleary was actually a member of a rival hacker group — <a href="https://en.wikipedia.org/wiki/LulzSec" target="_blank" rel="noopener">LulzSec</a> — who was sentenced to prison for hacking).</p>
<p>Kivimäki and other HTP members were involved in mass-compromising web servers using known vulnerabilities, and by 2012 Kivimäki’s alias Ryan Cleary was selling access to those servers in the form of a DDoS-for-hire service. Kivimäki was 15 years old at the time.</p>
<p>In 2013, investigators going through devices seized from Kivimäki found computer code that had been used to crack more than 60,000 web servers using a previously unknown vulnerability in <strong>Adobe’s ColdFusion</strong> software. KrebsOnSecurity detailed the work of HTP in September 2013, after the group <a href="https://krebsonsecurity.com/2013/09/data-broker-giants-hacked-by-id-theft-service/" target="_blank" rel="noopener">compromised servers inside data brokers LexisNexis, Kroll, and Dun &amp; Bradstreet</a>.</p>
<p>The group used the same ColdFusion flaws <a href="https://krebsonsecurity.com/2013/10/data-broker-hackers-also-compromised-nw3c/" target="_blank" rel="noopener">to break into the National White Collar Crime Center (NWC3)</a>, a non-profit that provides research and investigative support to the <strong>U.S. Federal Bureau of Investigation</strong> (FBI).</p>
<p>As KrebsOnSecurity reported at the time, this small ColdFusion botnet of data broker servers was being controlled by the same cybercriminals who’d <a href="https://krebsonsecurity.com/2013/03/credit-reports-sold-for-cheap-in-the-underweb/" target="_blank" rel="noopener">assumed control over <strong>SSNDOB</strong></a>, which operated one of the underground’s most reliable services for obtaining Social Security Number, dates of birth and credit file information on U.S. residents.</p>
<p>Kivimäki was responsible for making <a href="http://www.forbes.com/sites/insertcoin/2014/08/24/sony-online-entertainment-presidents-flight-diverted-by-psn-hackers-bomb-threat/" target="_blank" rel="noopener">an August 2014 bomb threat</a> against former <strong>Sony Online Entertainment President John Smedley</strong> that grounded an American Airlines plane. Kivimäki also was involved in calling in multiple fake bomb threats and “swatting” incidents — reporting fake hostage situations at an address to prompt a heavily armed police response to that location.</p>
<p><strong>Ville Tapio,</strong> the former CEO of Vastaamo, was fired and also prosecuted following the breach. Ransom_man bragged about Vastaamo&#8217;s sloppy security, noting the company had used the laughably weak username and password &#8220;root/root&#8221; to protect sensitive patient records.</p>
<p>Investigators later found Vastaamo had originally been hacked in 2018 and again in 2019. In April 2023, a Finnish court handed down <a href="https://yle.fi/a/74-20027665" target="_blank" rel="noopener">a three-month sentence for Tapio</a>, but that sentence was suspended because he had no previous criminal record.</p>


