# articles

feed_id: https://krebsonsecurity.com/?p=53838
title: Malicious Domain in SolarWinds Hack Turned into ‘Killswitch’
uri: Malicious-Domain-in-SolarWinds-Hack-Turned-into-Killswitch
url: https://krebsonsecurity.com/2020/12/malicious-domain-in-solarwinds-hack-turned-into-killswitch/
content:
<p>A key malicious domain name used to control potentially thousands of computer systems compromised via the months-long breach at network monitoring software vendor <strong>SolarWinds</strong> was commandeered by security experts and used as a &#8220;killswitch&#8221; designed to turn the sprawling cybercrime operation against itself, KrebsOnSecurity has learned.</p>
<p><img loading="lazy" class="aligncenter wp-image-53842" src="media/111d4fec.ks-red.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/12/ks-red.png" alt="" width="597" height="597" /></p>
<p>Austin, Texas-based SolarWinds disclosed this week that a compromise of its software update servers earlier this year may have resulted in <a href="https://krebsonsecurity.com/2020/12/solarwinds-hack-could-affect-18k-customers/" target="_blank" rel="noopener noreferrer">malicious code being pushed to nearly 18,000 customers of its <strong>Orion</strong> platform</a>. Many <a href="https://web.archive.org/web/20201214065921/https://www.solarwinds.com/company/customers" target="_blank" rel="noopener noreferrer">U.S. federal agencies and Fortune 500 firms</a> use(d) Orion to monitor the health of their IT networks.</p>
<p>On Dec. 13, cyber incident response firm <strong>FireEye</strong> <a href="https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html" target="_blank" rel="noopener noreferrer">published a detailed writeup</a> on the malware infrastructure used in the SolarWinds compromise, presenting evidence that the Orion software was first compromised back in March 2020. FireEye said hacked networks were seen communicating with a malicious domain name &#8212; <strong>avsvmcloud[.]com</strong> &#8212; one of several domains the attackers had set up to control affected systems.</p>
<p>As <a href="https://krebsonsecurity.com/2020/12/solarwinds-hack-could-affect-18k-customers/" target="_blank" rel="noopener noreferrer">first reported here on Tuesday</a>, there were signs over the past few days that control over the domain had been transferred to <strong>Microsoft</strong>. Asked about the changeover, Microsoft referred questions to FireEye and to <strong>GoDaddy</strong>, the current domain name registrar for the malicious site.</p>
<p>Today, FireEye responded that the domain seizure was part of a collaborative effort to prevent networks that may have been affected by the compromised SolarWinds software update from communicating with the attackers. What&#8217;s more, the company said the domain was reconfigured to act as a &#8220;killswitch&#8221; that would prevent the malware from continuing to operate in some circumstances.</p>
<p>&#8220;SUNBURST is the malware that was distributed through SolarWinds software,&#8221; FireEye said in a statement shared with KrebsOnSecurity. &#8220;As part of FireEye&#8217;s analysis of SUNBURST, we identified a killswitch that would prevent SUNBURST from continuing to operate.&#8221;</p>
<p>The statement continues:</p>
<blockquote><p>&#8220;Depending on the IP address returned when the malware resolves avsvmcloud[.]com, under certain conditions, the malware would terminate itself and prevent further execution. FireEye collaborated with GoDaddy and Microsoft to deactivate SUNBURST infections.&#8221;</p>
<p>&#8220;This killswitch will affect new and previous SUNBURST infections by disabling SUNBURST deployments that are still beaconing to avsvmcloud[.]com. However, in the intrusions FireEye has seen, this actor moved quickly to establish additional persistent mechanisms to access to victim networks beyond the SUNBURST backdoor.</p>
<p>This killswitch will not remove the actor from victim networks where they have established other backdoors. However, it will make it more difficult to for the actor to leverage the previously distributed versions of SUNBURST.&#8221;</p></blockquote>
<p>It is likely that given their visibility into and control over the malicious domain, Microsoft, FireEye, GoDaddy and others now have a decent idea which companies may still be struggling with SUNBURST infections.</p>
<p>The killswitch revelations came as security researchers said they&#8217;d <a href="https://twitter.com/RedDrip7/status/1339168187619790848" target="_blank" rel="noopener noreferrer">made progress in decoding SUNBURST&#8217;s obfuscated communications methods</a>. Chinese cybersecurity firm <strong>RedDrip Team</strong> published their findings <a href="https://t.co/jsnOldynCV?amp=1" target="_blank" rel="noopener noreferrer">on Github</a>, saying its decoder tool had identified nearly a hundred suspected victims of the SolarWinds/Orion breach, including universities, governments and high tech companies.</p>
<p>Meanwhile, the potential legal fallout for SolarWinds in the wake of this breach continues to worsen. <em>The Washington Post</em> <a href="https://www.washingtonpost.com/technology/2020/12/15/solarwinds-russia-breach-stock-trades/?itid=sf_business-technology" target="_blank" rel="noopener noreferrer">reported Tuesday</a> that top investors in SolarWinds sold millions of dollars in stock in the days before the intrusion was revealed. SolarWinds&#8217;s stock price has fallen more than 20 percent in the past few days. The Post cited former enforcement officials at the <strong>U.S. Securities and Exchange Commission</strong> (SEC) saying the sales were likely to prompt an insider trading investigation.</p>


feed_id: https://krebsonsecurity.com/?p=53851
title: VMware Flaw a Vector in SolarWinds Breach?
uri: VMware-Flaw-a-Vector-in-SolarWinds-Breach
url: https://krebsonsecurity.com/2020/12/vmware-flaw-a-vector-in-solarwinds-breach/
content:
<p>U.S. government cybersecurity agencies warned this week that the attackers behind the widespread hacking spree stemming from the compromise at network software firm SolarWinds used weaknesses in other, non-SolarWinds products to attack high-value targets. According to sources, among those was a flaw in software virtualization platform <strong>VMware</strong>, which the <strong>U.S. National Security Agency</strong> (NSA) warned on Dec. 7 was being used by Russian hackers to impersonate authorized users on victim networks.</p>
<p>On Dec. 7, 2020, the NSA said &#8220;Russian state-sponsored malicious cyber actors are exploiting a vulnerability in <strong>VMware Access</strong> and <strong>VMware Identity Manager</strong> products, allowing the actors access to protected data and abusing federated authentication.&#8221;</p>
<p><a href="media/ce64167a.nsa-vmware.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/12/nsa-vmware.png"><img loading="lazy" class="aligncenter wp-image-53856" src="media/ce64167a.nsa-vmware.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/12/nsa-vmware.png" alt="" width="599" height="432" srcset="https://krebsonsecurity.com/wp-content/uploads/2020/12/nsa-vmware.png 1093w, https://krebsonsecurity.com/wp-content/uploads/2020/12/nsa-vmware-768x554.png 768w" sizes="(max-width: 599px) 100vw, 599px" /></a></p>
<p>VMware released <a href="https://www.vmware.com/security/advisories/VMSA-2020-0027.html" target="_blank" rel="noopener noreferrer">a software update</a> to plug the security hole (<a href="https://nvd.nist.gov/vuln/detail/CVE-2020-4006" target="_blank" rel="noopener noreferrer">CVE-2020-4006</a>) on Dec. 3, and said it learned about the flaw from the NSA.</p>
<p>The NSA <a href="media/8ec6bc47.CSA_VMWARE20ACCESS_U_OO_195076_20.PDF" data-original-source="https://media.defense.gov/2020/Dec/07/2002547071/-1/-1/0/CSA_VMWARE%20ACCESS_U_OO_195076_20.PDF" target="_blank" rel="noopener noreferrer">advisory</a> (PDF) came less than 24 hours before cyber incident response firm <strong>FireEye</strong> <a href="https://www.fireeye.com/blog/products-and-services/2020/12/fireeye-shares-details-of-recent-cyber-attack-actions-to-protect-community.html" target="_blank" rel="noopener noreferrer">said</a> it discovered attackers had broken into its networks and stolen more than 300 proprietary software tools the company developed to help customers secure their networks.</p>
<p>On Dec. 13, FireEye <a href="https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html" target="_blank" rel="noopener noreferrer">disclosed</a> that the incident was the result of the SolarWinds compromise, which involved malicious code being surreptitiously inserted into updates shipped by SolarWinds for users of its <strong>Orion</strong> network management software as far back as March 2020.</p>
<p>In its advisory on the VMware vulnerability, the NSA urged patching it &#8220;as soon as possible,&#8221; specifically encouraging the National Security System, Department of Defense, and defense contractors to make doing so a high priority.</p>
<p>The NSA said that in order to exploit this particular flaw, hackers would already need to have access to a vulnerable VMware device&#8217;s management interface &#8212; i.e., they would need to be on the target&#8217;s internal network (provided the vulnerable VMware interface was not accessible from the Internet). However, the SolarWinds compromise would have provided that internal access nicely.</p>
<p>In response to questions from KrebsOnSecurity, VMware said it has &#8220;received no notification or indication that the CVE 2002-4006 was used in conjunction with the SolarWinds supply chain compromise.&#8221;</p>
<p>VMware added that while some of its own networks used the vulnerable SolarWinds Orion software, an investigation has so far revealed no evidence of exploitation.</p>
<p>&#8220;While we have identified limited instances of the vulnerable SolarWinds Orion software in our environment, our own internal investigation has not revealed any indication of exploitation,&#8221; the company said in a statement. &#8220;This has also been confirmed by SolarWinds own investigations to date.&#8221;</p>
<p>On Dec. 17, DHS&#8217;s <strong>Cyber Security and Infrastructure Security Agency</strong> (CSIA) released <a href="https://us-cert.cisa.gov/ncas/alerts/aa20-352a" target="_blank" rel="noopener noreferrer">a sobering alert</a> on the SolarWinds attack, noting that CISA had evidence of additional access vectors other than the SolarWinds Orion platform.</p>
<p>CSIA&#8217;s advisory specifically noted that &#8220;one of the principal ways the adversary is accomplishing this objective is by compromising the <strong>Security Assertion Markup Language</strong> (SAML) signing certificate using their escalated Active Directory privileges. Once this is accomplished, the adversary creates unauthorized but valid tokens and presents them to services that trust SAML tokens from the environment. These tokens can then be used to access resources in hosted environments, such as email, for data exfiltration via authorized application programming interfaces (APIs).&#8221;</p>
<p>Indeed, the NSA&#8217;s Dec. 7 advisory said the hacking activity it saw involving the VMware vulnerability &#8220;led to the installation of a web shell and follow-on malicious activity where credentials in the form of SAML authentication assertions were generated and sent to Microsoft Active Directory Federation Services (ADFS), which in turn granted the actors access to protected data.&#8221;</p>
<p>Also on Dec. 17, the NSA released <a href="media/afaefeeb.AUTHENTICATION_MECHANISMS_CSA_U_OO_198854_20.PDF" data-original-source="https://media.defense.gov/2020/Dec/17/2002554125/-1/-1/0/AUTHENTICATION_MECHANISMS_CSA_U_OO_198854_20.PDF" target="_blank" rel="noopener noreferrer">a far more detailed advisory</a> explaining how it has seen the VMware vulnerability being used to forge SAML tokens, this time specifically referencing the SolarWinds compromise.<span id="more-53851"></span></p>
<p>CSIA&#8217;s analysis suggested the crooks behind the SolarWinds intrusion were heavily focused on impersonating trusted personnel on targeted networks, and that they&#8217;d devised clever ways to bypass multi-factor authentication (MFA) systems protecting networks they targeted.</p>
<p>The bulletin references research released earlier this week by security firm <strong>Volexity</strong>, which <a href="https://www.volexity.com/blog/2020/12/14/dark-halo-leverages-solarwinds-compromise-to-breach-organizations/" target="_blank" rel="noopener noreferrer">described</a> encountering the same attackers using a novel technique to bypass MFA protections provided by <a href="https://duo.com/" target="_blank" rel="noopener noreferrer">Duo</a> for <strong>Microsoft Outlook Web App</strong> (OWA) users.</p>
<p>Duo&#8217;s parent <strong>Cisco Systems Inc.</strong> responded that the attack described by Volexity didn&#8217;t target any specific vulnerability in its products. As <em>Ars Technica</em> <a href="https://arstechnica.com/information-technology/2020/12/solarwinds-hackers-have-a-clever-way-to-bypass-multi-factor-authentication/" target="_blank" rel="noopener noreferrer">explained</a>, the bypass involving Duo&#8217;s protections could have just as easily involved any of Duo&#8217;s competitors.</p>
<p>&#8220;MFA threat modeling generally doesn&#8217;t include a complete system compromise of an OWA server,&#8221; Ars&#8217; <strong>Dan Goodin</strong> wrote. &#8220;The level of access the hacker achieved was enough to neuter just about any defense.&#8221;</p>
<p>Several media outlets, including <em>The New York Times</em> and <em>The Washington Post</em>, have cited anonymous government sources saying the group behind the SolarWinds hacks was known as <a href="https://en.wikipedia.org/wiki/Cozy_Bear" target="_blank" rel="noopener noreferrer">APT29 or &#8220;Cozy Bear</a>,&#8221; an advanced threat group believed to be part of the <strong>Russian Federal Security Service</strong> (FSB).</p>
<p>SolarWinds has said almost 18,000 customers may have received the backdoored Orion software updates. So far, only a handful of customers targeted by the suspected Russian hackers behind the SolarWinds compromise have been made public &#8212; including the U.S. Commerce, Energy and Treasury departments, and the DHS.</p>
<p>No doubt we will hear about new victims in the public and private sector in the coming days and weeks. In the meantime, thousands of organizations are facing incredibly costly, disruptive and time-intensive work in determining whether they were compromised and if so what to do about it.</p>
<p>The CSIA advisory notes the attackers behind the SolarWinds compromises targeted key personnel at victim firms &#8212; including cyber incident response staff, and IT email accounts. The warning suggests organizations that suspect they were victims should assume their email communications and internal network traffic are compromised, and rely upon or build out-of-band systems for discussing internally how they will proceed to clean up the mess.</p>
<p>&#8220;If the adversary has compromised administrative level credentials in an environment—or if organizations identify SAML abuse in the environment, simply mitigating individual issues, systems, servers, or specific user accounts will likely not lead to the adversary’s removal from the network,&#8221; CSIA warned. &#8220;In such cases, organizations should consider the entire identity trust store as compromised. In the event of a total identity compromise, a full reconstitution of identity and trust services is required to successfully remediate. In this reconstitution, it bears repeating that this threat actor is among the most capable, and in many cases, a full rebuild of the environment is the safest action.&#8221;</p>


feed_id: https://krebsonsecurity.com/?p=53877
title: Happy 11th Birthday, KrebsOnSecurity!
uri: Happy-11th-Birthday-KrebsOnSecurity
url: https://krebsonsecurity.com/2020/12/happy-11th-birthday-krebsonsecurity/
content:
<p>Today marks the 11th anniversary of KrebsOnSecurity! Thank you, Dear Readers, for your continued encouragement and support!</p>
<p><img loading="lazy" class="alignright wp-image-53879" src="media/02cc4d37.eleven.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/12/eleven.png" alt="" width="250" height="314" />With the ongoing disruption to life and livelihood wrought by the Covid-19 pandemic, 2020 has been a fairly horrid year by most accounts. And it&#8217;s perhaps fitting that this was also a leap year, piling on an extra day to a solar rotation that most of us probably can&#8217;t wait to see in the rearview mirror.</p>
<p>But it was hardly a dull one for computer security news junkies. In almost every category &#8212; from <a href="https://krebsonsecurity.com/?s=solar+winds&#038;x=0&#038;y=0" rel="noopener noreferrer" target="_blank">epic breaches</a> and <a href="https://krebsonsecurity.com/?s=ransomware+2020&#038;x=0&#038;y=0" rel="noopener noreferrer" target="_blank">ransomware</a> to <a href="https://krebsonsecurity.com/category/neer-do-well-news/" rel="noopener noreferrer" target="_blank">cybercrime justice</a> and increasingly aggressive <a href="https://krebsonsecurity.com/?s=phishing+2020&#038;x=0&#038;y=0" rel="noopener noreferrer" target="_blank">phishing</a> and <a href="https://krebsonsecurity.com/?s=social+engineering+2020&#038;x=0&#038;y=0" rel="noopener noreferrer" target="_blank">social engineering scams</a> &#8212; 2020 was a year that truly <a href="https://www.youtube.com/watch?v=g7-5io1muSQ" target="_blank" rel="noopener noreferrer">went to eleven</a>.</p>
<p>Almost 150 stories here this past year generated nearly 9,000 responses from readers (although about 6 percent of those <a href="https://krebsonsecurity.com/2020/11/trump-fires-security-chief-christopher-krebs/" rel="noopener noreferrer" target="_blank">were on just one story</a>). Thank you all for your thoughtful engagement, wisdom, news tips and support.</p>
<p>I&#8217;d like to reprise a note from last year&#8217;s anniversary post concerning ads. A good chunk of the loyal readers here are understandably security- and privacy-conscious, and many block advertisements by default — including the ads displayed here.</p>
<p>KrebsOnSecurity does not run third-party ads and has no plans to change that; all of the creatives you see on this site are hosted in-house, are purely image-based, and are vetted first by Yours Truly. Love them or hate ’em, these ads help keep the content at KrebsOnSecurity free to any and all readers. If you’re currently blocking ads here, please consider making an exception for this site.</p>
<p>In case you missed them, some of the most popular feature/enterprise stories on the site this year (in no particular order) included:</p>
<p><a href="https://krebsonsecurity.com/2020/09/the-joys-of-owning-an-og-email-account/" rel="noopener noreferrer" target="_blank">The Joys of Owning an &#8216;OG&#8217; Email Accoun</a>t<br />
<a href="https://krebsonsecurity.com/2020/08/confessions-of-an-id-theft-kingpin-part-i/" rel="noopener noreferrer" target="_blank">Confessions of an ID Theft Kingpin</a> (<a href="https://krebsonsecurity.com/2020/08/confessions-of-an-id-theft-kingpin-part-ii/" rel="noopener noreferrer" target="_blank">Part II</a>)<br />
<a href="https://krebsonsecurity.com/2020/08/why-where-you-should-you-plant-your-flag/" rel="noopener noreferrer" target="_blank">Why and Where You Should Plant Your Flag</a><br />
<a href="https://krebsonsecurity.com/2020/07/thinking-of-a-cybersecurity-career-read-this/" rel="noopener noreferrer" target="_blank">Thinking of a Career in Cybersecurity? Read This</a><br />
<a href="https://krebsonsecurity.com/2020/06/turn-on-mfa-before-crooks-do-it-for-you/" rel="noopener noreferrer" target="_blank">Turn on MFA Before Crooks Do it for You</a><br />
<a href="https://krebsonsecurity.com/2020/06/romanian-skimmer-gang-in-mexico-outed-by-krebsonsecurity-stole-1-2-billion/" rel="noopener noreferrer" target="_blank">Romanian Skimmer Gang in Mexico Outed by KrebsOnSecurity Stole $1.2 Billion</a><br />
<a href="https://krebsonsecurity.com/2020/03/whos-behind-the-web-listings-mail-scam/" rel="noopener noreferrer" target="_blank">Who&#8217;s Behind the &#8216;Web Listings&#8217; Mail Scam?</a><br />
<a href="https://krebsonsecurity.com/2020/04/when-in-doubt-hang-up-look-up-call-back/" rel="noopener noreferrer" target="_blank">When in Doubt: Hang Up, Look Up, &#038; Call Back</a><br />
<a href="https://krebsonsecurity.com/2020/05/riding-the-state-unemployment-fraud-wave/" rel="noopener noreferrer" target="_blank">Riding the State Unemployment Fraud Wave</a><br />
<a href="https://krebsonsecurity.com/2020/04/would-you-have-fallen-for-this-phone-scam/" rel="noopener noreferrer" target="_blank">Would You Have Fallen for this Phone Scam?</a></p>


feed_id: https://krebsonsecurity.com/?p=53893
title: Hamas May Be Threat to 8chan, QAnon Online
uri: Hamas-May-Be-Threat-to-8chan-QAnon-Online
url: https://krebsonsecurity.com/2021/01/hamas-may-be-threat-to-8chan-qanon-online/
content:
<p>In October 2020, KrebsOnSecurity looked at how a web of sites connected to conspiracy theory movements <strong>QAnon</strong> and <strong>8chan</strong> were being kept online by <strong>DDoS-Guard</strong>, a dodgy Russian firm that also hosts the official site for the terrorist group <strong>Hamas</strong>. New research shows DDoS-Guard relies on data centers provided by a U.S.-based publicly traded company, which experts say could be exposed to civil and criminal liabilities as a result of DDoS-Guard&#8217;s business with Hamas.</p>
<div id="attachment_53382" style="width: 610px" class="wp-caption aligncenter"><a href="media/c99c5ab7.qanon-8kun-map.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/10/qanon-8kun-map.png"><img aria-describedby="caption-attachment-53382" loading="lazy" class="wp-image-53382" src="media/c99c5ab7.qanon-8kun-map.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/10/qanon-8kun-map.png" alt="" width="600" height="264" srcset="https://krebsonsecurity.com/wp-content/uploads/2020/10/qanon-8kun-map.png 1457w, https://krebsonsecurity.com/wp-content/uploads/2020/10/qanon-8kun-map-768x338.png 768w" sizes="(max-width: 600px) 100vw, 600px" /></a><p id="caption-attachment-53382" class="wp-caption-text">Many of the IP address ranges in in this map of QAnon and 8Chan-related sites &#8212; are assigned to VanwaTech. Source: twitter.com/Redrum_of_Crows</p></div>
<p><a href="https://krebsonsecurity.com/2020/10/qanon-8chan-sites-briefly-knocked-offline/" target="_blank" rel="noopener noreferrer">Last year&#8217;s story</a> examined how a phone call to Oregon-based <strong>CNServers</strong> was all it took to briefly sideline multiple websites related to 8chan/8kun — a controversial online image board linked to several mass shootings — and QAnon, the far-right conspiracy theory which holds that a cabal of Satanic pedophiles is running a global child sex-trafficking ring and plotting against President Donald Trump.</p>
<p>From that piece:</p>
<blockquote><p>A large number of 8kun and QAnon-related sites (see map above) are connected to the Web via a single Internet provider in Vancouver, Wash. called <strong>VanwaTech</strong> (a.k.a. “OrcaTech“). Previous appeals to VanwaTech to disconnect these sites have fallen on deaf ears, as the company’s owner <strong>Nick Lim</strong> reportedly has been working with 8kun’s administrators to keep the sites online in the name of protecting free speech.</p></blockquote>
<p>After that story, CNServers and a U.K.-based hosting firm called<strong> SpartanHost</strong> both cut ties with VanwaTech. Following a brief disconnection, the sites came back online with the help of DDoS-Guard, an Internet company based in Russia. DDoS-Guard is now VanwaTech&#8217;s <a href="media/0ac3d65c.HE-vanwatech.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/01/HE-vanwatech.png" target="_blank" rel="noopener noreferrer">sole connection to the larger Internet</a>.</p>
<p>A review of <a href="https://docs.google.com/spreadsheets/d/1xQaEih4MUqenJlOVbRNm4oA5U8xQVaJCL2rJQ_iv6fI/edit?usp=sharing" target="_blank" rel="noopener noreferrer">the several thousand websites hosted by DDoS-Guard</a> is revelatory, as it includes a vast number of phishing sites and domains tied to cybercrime services or forums online.</p>
<p>Replying to requests for comment from a <strong>CBSNews</strong> reporter following up on my Oct. 2020 story, DDoS-Guard issued <a href="https://twitter.com/GrahamKates/status/1319264520595001344/photo/1" target="_blank" rel="noopener noreferrer">a statement</a> saying, &#8220;We observe network neutrality and are convinced that any activity not prohibited by law in our country has the right to exist.&#8221;</p>
<p>But experts say DDoS-Guard&#8217;s business arrangement with a Denver-based publicly traded data center firm could create legal headaches for the latter thanks to the Russian company&#8217;s support of Hamas.</p>
<p>In <a href="https://ddos-guard.net/en/info/blog-detail/internet-shield-over-the-city-of-angels-ddos-guard-announces-the-launch-of-a-traffic-scrubbing-center-in-los-angeles-ca" target="_blank" rel="noopener noreferrer">a press release</a> issued in late 2019, DDoS-Guard said its services rely in part on a traffic-scrubbing facility in Los Angeles owned by <a href="https://en.wikipedia.org/wiki/CoreSite" target="_blank" rel="noopener noreferrer">CoreSite</a> [NYSE:COR], a real estate investment trust which invests in &#8220;carrier-neutral data centers and provides colocation and peering services.&#8221;</p>
<div id="attachment_53902" style="width: 609px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-53902" loading="lazy" class=" wp-image-53902" src="media/9a774264.ddosguad-map.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/01/ddosguad-map.png" alt="" width="599" height="415" srcset="https://krebsonsecurity.com/wp-content/uploads/2021/01/ddosguad-map.png 820w, https://krebsonsecurity.com/wp-content/uploads/2021/01/ddosguad-map-768x532.png 768w" sizes="(max-width: 599px) 100vw, 599px" /><p id="caption-attachment-53902" class="wp-caption-text">This facilities map published by DDoS-Guard suggests the company&#8217;s network actually has at least two points of presence in the United States.</p></div>
<p>Hamas has long been named by the U.S. Treasury and State departments as a <a href="https://www.state.gov/executive-order-13224/" target="_blank" rel="noopener noreferrer">Specially Designated Global Terrorist</a> (SDGT) organization. Under such a designation, any U.S. person or organization that provides money, goods or services to an SDGT entity could face civil and/or criminal prosecution and hefty fines ranging from $250,000 to $1 million per violation.<span id="more-53893"></span></p>
<p><strong>Sean Buckley</strong>, a former Justice Department prosecutor with the law firm <a href="https://kobrekim.com/people/sean-s-buckley" target="_blank" rel="noopener noreferrer">Kobre &amp; Kim</a>, said U.S. persons and companies within the United States &#8220;are prohibited from any transaction or dealing in property or interests in property blocked pursuant to an entity&#8217;s designation as a SDGT, including but not limited to the making or receiving of any contribution of funds, goods, or services to or for the benefit of individuals or entities so designated.&#8221;</p>
<p>CoreSite did not respond to multiple requests for comment. But Buckley said companies can incur fines and prosecution for violating SDGT sanctions even when they don&#8217;t know that they are doing so.</p>
<p>In 2019, for example, a U.S. based cosmetics company <a href="https://www.cnbc.com/2019/01/31/elf-beauty-pays-1-million-for-violating-north-korean-sanctions.html" target="_blank" rel="noopener noreferrer">was fined $1 million</a> after investigators determined its eyelash kits were sourcing materials from North Korea, even though the supplier in that case told the cosmetics firm the materials had come from China.</p>
<p>&#8220;U.S. persons or companies found to willfully violate these regulations can be subject to criminal penalties under the International Emergency Economic Powers Act,&#8221; Buckley said. &#8220;However, even in the case that they are unaware they&#8217;re violating these regulations, or if the transaction isn&#8217;t directly with the sanctioned entity, these companies still run a risk of facing substantial civil and monetary penalties by the Department of Treasury&#8217;s Office of Foreign Asset Control if the sanctioned entity stands to benefit from such a transaction.&#8221;</p>
<p>DDoS-Guard said its partnership with CoreSite will help its stable of websites load more quickly and reliably for people visiting them from the United States. It is possible that when and if CoreSite decides it&#8217;s too risky to continue doing business with DDoS-Guard, sites like those affiliated with Hamas, QAnon and 8Chan may become more difficult to reach.</p>
<p>Meanwhile, DDoS-Guard customer VanwaTech continues to host a slew of sites promoting the conspiracy theory that the U.S. 2020 presidential election was stolen from <strong>President Donald Trump</strong> via widespread voting fraud and hacked voting machines, including <strong>maga[.]host</strong>, <strong>donaldsarmy[.]us</strong>, and <strong>donaldwon[.]com</strong>.</p>
<p>These sites are being used to help coordinate <a href="https://wamu.org/story/20/12/22/dc-maga-trump-rally-women-for-america-first/" target="_blank" rel="noopener noreferrer">a protest rally in Washington, D.C. on January 6, 2021</a>, the same day the U.S. Congress is slated to count electoral votes certified by the Electoral College, which in December elected <strong>Joseph R. Biden</strong> as the 46th president of The United States.</p>
<p>In <a href="https://twitter.com/realDonaldTrump/status/1340185773220515840?ref_src=twsrc%5Etfw%7Ctwcamp%5Etweetembed%7Ctwterm%5E1340185773220515840%7Ctwgr%5E%7Ctwcon%5Es1_&amp;ref_url=https%3A%2F%2Fwww.wusa9.com%2Farticle%2Fnews%2Flocal%2Fprotests%2Ftrump-supporters-rally-protest-january-6-maga-protest%2F65-2639563a-b04e-4a40-a028-23083673d46b" target="_blank" rel="noopener noreferrer">a tweet</a> late last year, President Trump urged his supporters to attend the Jan. 6 protest, saying the event &#8220;will be wild.&#8221;</p>
<p>8chan, which has rebranded as 8kun, has been linked to white supremacism, neo-Nazism, antisemitism, multiple mass shootings, and <a href="https://www.motherjones.com/politics/2020/10/jim-watkins-child-pornography-domains/" target="_blank" rel="noopener noreferrer">child pornography</a>. The FBI in 2019 identified QAnon as <a href="https://news.yahoo.com/fbi-documents-conspiracy-theories-terrorism-160000507.html?soc_src=hl-viewer&amp;soc_trk=tw" target="_blank" rel="noopener noreferrer">a potential domestic terror threat</a>, noting that some of its followers have been linked to violent incidents motivated by fringe beliefs.</p>


feed_id: https://krebsonsecurity.com/?p=53980
title: Sealed U.S. Court Records Exposed in SolarWinds Breach
uri: Sealed-U-S-Court-Records-Exposed-in-SolarWinds-Breach
url: https://krebsonsecurity.com/2021/01/sealed-u-s-court-records-exposed-in-solarwinds-breach/
content:
<p>The ongoing breach affecting thousands of organizations that relied on backdoored products by network software firm <strong>SolarWinds</strong> may have jeopardized the privacy of countless sealed court documents on file with the U.S. federal court system, according to a memo released Wednesday by the <strong>Administrative Office (AO) of the U.S. Courts</strong>.</p>
<p><img loading="lazy" class="aligncenter wp-image-53985" src="media/d1edfad6.uscourts.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/01/uscourts.png" alt="" width="593" height="320" /></p>
<p>The judicial branch agency said it will be deploying more stringent controls for receiving and storing sensitive documents filed with the federal courts, following a discovery that its own systems were compromised as part of the SolarWinds supply chain attack. That intrusion involved malicious code being surreptitiously inserted into updates shipped by SolarWinds for some 18,000 users of its <strong>Orion</strong> network management software as far back as March 2020.</p>
<p>&#8220;The AO is working with the Department of Homeland Security on a security audit relating to vulnerabilities in the Judiciary’s <strong>Case Management/Electronic Case Files</strong> system (CM/ECF) that greatly risk compromising highly sensitive non-public documents stored on CM/ECF, particularly sealed filings,&#8221; the agency said in <a href="https://www.uscourts.gov/news/2021/01/06/judiciary-addresses-cybersecurity-breach-extra-safeguards-protect-sensitive-court" target="_blank" rel="noopener noreferrer">a statement</a> published Jan. 6.</p>
<p>&#8220;An apparent compromise of the confidentiality of the CM/ECF system due to these discovered vulnerabilities currently is under investigation,&#8221; the statement continues. &#8220;Due to the nature of the attacks, the review of this matter and its impact is ongoing.&#8221;</p>
<p>The AO declined to comment on specific questions about their breach disclosure. But a source close to the investigation told KrebsOnSecurity that the federal court document system was &#8220;hit hard,&#8221; by the SolarWinds attackers, which multiple U.S. intelligence and law enforcement agencies <a href="https://www.cisa.gov/news/2021/01/05/joint-statement-federal-bureau-investigation-fbi-cybersecurity-and-infrastructure" target="_blank" rel="noopener noreferrer">have attributed as &#8220;likely Russian in origin.&#8221;</a></p>
<p>The source said the intruders behind the SolarWinds compromise seeded the AO&#8217;s network with <a href="https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html" target="_blank" rel="noopener noreferrer">a second stage &#8220;Teardrop&#8221; malware</a> that went beyond the &#8220;Sunburst&#8221; malicious software update that was opportunistically pushed out to all 18,000 customers using the compromised Orion software. This suggests the attackers were targeting the agency for deeper access to its networks and communications.</p>
<p>The AO&#8217;s court document system powers a publicly searchable database called <a href="https://pacer.uscourts.gov/" target="_blank" rel="noopener noreferrer">PACER</a>, and the vast majority of the files in PACER are not restricted and are available to anyone willing to pay for the records.</p>
<p>But experts say many other documents stored in the AO&#8217;s system are sealed &#8212; either temporarily or indefinitely by the courts or parties to a legal matter &#8212; and may contain highly sensitive information, including intellectual property and trade secrets, or even the identities of confidential informants.</p>
<p><strong>Nicholas Weaver</strong>, a lecturer at the computer science department at University of California, Berkeley, said the court document system doesn&#8217;t hold documents that are classified for national security reasons. But he said the system is full of sensitive sealed filings &#8212; such as subpoenas for email records and so-called &#8220;trap and trace&#8221; requests that law enforcement officials use to determine with whom a suspect is communicating via phone, when and for how long.</p>
<p><span class="pullquote pqleft">&#8220;This would be a treasure trove for the Russians knowing about a lot of ongoing criminal investigations,&#8221; Weaver said. &#8220;If the FBI has indicted someone but hasn&#8217;t arrested them yet, that&#8217;s all under seal.</span> A lot of the investigative tools that get protected under seal are filed very early on in the process, often with gag orders that prevent [the subpoenaed party] from disclosing the request.&#8221;</p>
<p>The acknowledgement from the AO comes hours after the <strong>U.S. Justice Department</strong> <a href="https://arstechnica.com/information-technology/2021/01/doj-says-solarwinds-hackers-breached-its-office-365-system-and-read-email/" target="_blank" rel="noopener noreferrer">said it also was a victim of the SolarWinds intruders</a>, who took control over the department&#8217;s <strong>Office 365</strong> system and accessed email sent or received from about three percent of DOJ accounts (the department has more than 100,000 employees).<span id="more-53980"></span></p>
<p>The SolarWinds hack also reportedly jeopardized email systems used by top Treasury Department officials, and granted the attackers access to networks inside the Energy, Commerce and Homeland Security departments.</p>
<p><em>The New York Times</em> on Wednesday <a href="https://www.nytimes.com/2021/01/06/us/politics/russia-cyber-hack.html" rel="noreferrer" data-ss1610060780="1">reported</a> that investigators are examining whether a breach at another software provider &#8212; JetBrains &#8212; may have precipitated the attack on SolarWinds. The company, which was founded by three Russian engineers in the Czech Republic, makes a tool called TeamCity that helps developers test and manage software code. TeamCity is used by developers at 300,000 organizations, including SolarWinds and 79 of the Fortune 100 companies.</p>
<p>&#8220;Officials are investigating whether the company, founded by three Russian engineers in the Czech Republic with research labs in Russia, was breached and used as a pathway for hackers to insert back doors into the software of an untold number of technology companies,&#8221; The Times said. &#8220;Security experts warn that the monthslong intrusion could be the biggest breach of United States networks in history.&#8221;</p>
<p>Under the AO&#8217;s new procedures, highly sensitive court documents filed with federal courts will be accepted for filing in paper form or via a secure electronic device, such as a thumb drive, and stored in a secure stand-alone computer system. These sealed documents will not be uploaded to CM/ECF.</p>
<p>&#8220;This new practice will not change current policies regarding public access to court records, since sealed records are confidential and currently are not available to the public,&#8221; the AO said.</p>
<p><strong>James Lewis</strong>, senior vice president at the C<strong>enter for Strategic and International Studies</strong>, said it&#8217;s too soon to tell the true impact of the breach at the court system, but the fact that they were apparently targeted is a &#8220;a very big deal.&#8221;</p>
<p>&#8220;We don&#8217;t know what the Russians took, but the fact that they had access to this system means they had access to a lot of great stuff, because federal cases tend to involve fairly high profile targets,&#8221; he said.</p>


feed_id: https://krebsonsecurity.com/?p=53942
title: All Aboard the Pequod!
uri: All-Aboard-the-Pequod
url: https://krebsonsecurity.com/2021/01/all-aboard-the-pequod/
content:
<p>Like countless others, I frittered away the better part of Jan. 6 doomscrolling and watching television coverage of the horrifying events unfolding in our nation&#8217;s capital, where a mob of <strong>President Trump</strong> supporters and <strong>QAnon</strong> conspiracy theorists was incited to lay siege to the U.S. Capitol. For those trying to draw meaning from the experience, might I suggest consulting the literary classic <em>Moby Dick</em>, which simultaneously holds clues about QAnon&#8217;s origins and offers an apt allegory about a modern-day <strong>Captain Ahab</strong> and his ill-fated obsessions.</p>
<p>Many have speculated that <strong>Jim Watkins</strong>, the administrator of the online message board <a href="https://en.wikipedia.org/wiki/8chan" target="_blank" rel="noopener noreferrer">8chan</a> (a.k.a. 8kun), and/or his son <strong>Ron</strong> are in fact &#8220;Q,&#8221; the anonymous persona behind the <a href="https://en.wikipedia.org/wiki/QAnon" target="_blank" rel="noopener noreferrer">QAnon conspiracy theory</a>, which holds that <strong>President Trump</strong> is secretly working to save the world from a satanic cult of pedophiles and cannibals.</p>
<p>Last year, as I was <a href="https://krebsonsecurity.com/2020/10/qanon-8chan-sites-briefly-knocked-offline/" target="_blank" rel="noopener noreferrer">scrutinizing the computer networks that kept QAnon online</a>, researcher <a href="https://krebsonsecurity.com/?s=ron+guilmette&amp;x=0&amp;y=0" target="_blank" rel="noopener noreferrer">Ron Guilmette</a> pointed out a tantalizing utterance from Watkins the younger which adds tenuous credence to the notion that one or both of them is Q.</p>
<p><img loading="lazy" class="aligncenter wp-image-53946" src="media/6032888f.mobydick.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/01/mobydick.png" alt="" width="525" height="767" /></p>
<p>We&#8217;ll get to how the Great White Whale (the Capitol?) fits into this tale in a moment. But first, a bit of background. A person identified only as &#8220;Q&#8221; has for years built an impressive following for the far-right conspiracy movement by leaving periodic &#8220;Q drops,&#8221; cryptic messages that QAnon adherents spend much time and effort trying to decipher and relate to current events.</p>
<p>Researchers who have studied more than 5,000 Q drops <a href="https://www.vice.com/en/article/jgqj7x/qanons-mysterious-leader-q-is-actually-multiple-people" target="_blank" rel="noopener noreferrer">are convinced that there are two distinct authors of these coded utterances</a>. The <a href="https://www.insider.com/who-is-q-why-people-think-jim-watkins-qanon-8chan-2020-10" target="_blank" rel="noopener noreferrer">leading theory</a> is that those identities corresponded to the aforementioned father-and-son team responsible for operating 8chan.</p>
<p>Jim Watkins, 56, is the current owner of 8chan, a community perhaps now best known as a forum for violent extremists and mass shooters. Watkins is an American pig farmer based in the Philippines; Ron reportedly resides in Japan.</p>
<p>In the aftermath of back-to-back mass shootings on Aug. 3 and Aug. 4, 2019 in which a manifesto justifying one of the attacks was uploaded to 8chan, Cloudflare stopped providing their content delivery network to 8chan. Several other providers quickly followed suit, leaving 8chan offline for months before it found a haven at <a href="https://krebsonsecurity.com/2019/07/meet-the-worlds-biggest-bulletproof-hoster/" target="_blank" rel="noopener noreferrer">a notorious bulletproof hosting facility in Russia</a>.</p>
<p>One reason Q watchers believe Ron and Jim Watkins may share authorship over the Q drops is that while 8chan was offline, the messages from Q ceased. The drops reappeared only months later when 8chan rebranded as 8kun.</p>
<h4>CALL ME ISHMAEL</h4>
<p>Here&#8217;s where the admittedly &#8220;Qonspiratorial&#8221; clue about the Watkins&#8217; connection to Q comes in. On Aug. 5, 2019, Ron Watkins posted <a href="https://twitter.com/CodeMonkeyZ/status/1158428991755128832?ref_src=twsrc%5Etfw%7Ctwcamp%5Etweetembed%7Ctwterm%5E1158428991755128832%7Ctwgr%5Eshare_3&amp;ref_url=https%3A%2F%2Fmashable.com%2Farticle%2F8chan-down%2F" target="_blank" rel="noopener noreferrer">a Twitter message</a> about 8chan&#8217;s ostracization which compared the community&#8217;s fate to that of the <strong>Pequod</strong>, the name of the doomed whaling ship in the Herman Melville classic &#8220;<em>Moby Dick</em>.&#8221;</p>
<p>&#8220;If we are still down in a few hours then maybe 8chan will just go clearnet and we can brave DDOS attacks like Ishmael on the Pequod,&#8221; Watkins the younger wrote.</p>
<p><img loading="lazy" class="aligncenter wp-image-53945" src="media/3355a717.ron-pequod.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/01/ron-pequod.png" alt="" width="598" height="133" /></p>
<p>Ishmael, the first-person narrator in the novel, is a somewhat disaffected American sailor who decides to try his hand at a whaling ship. Ishmael is a bit of a minor character in the book; very soon into the novel we are introduced to a much more interesting and enigmatic figure &#8212; a Polynesian harpooner by the name of <strong><strong>Q</strong></strong>uee<strong><strong>q</strong></strong>ueg.</p>
<p>Apart from being a cannibal from the Pacific islands who has devoured many people, Queequeg is a pretty nice guy and shows Ismael the ropes of whaling life. Queequeg is covered head to toe in tattoos, which are described by the narrator as the work of a departed prophet and seer from the cannibal&#8217;s home island.</p>
<p><img loading="lazy" class="alignright size-full wp-image-53949" src="media/d0935a54.qq.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/01/qq.png" alt="" width="193" height="344" />Like so many Q drops, Queequeg&#8217;s tattoos tell a mysterious tale, but we never quite learn what that full story is. Indeed, the artist who etched them into Queequeg&#8217;s body is long dead, and the cannibal himself can&#8217;t seem to explain what it all means.</p>
<p>Ishmael describes Queequeg&#8217;s mysterious markings in this passage:</p>
<p>&#8220;&#8230;a complete theory of the heavens and earth, and a mystical treatise on the art of attaining truth; so that Queequeg in his own proper person was a riddle to unfold; a wondrous work in one volume; but whose mysteries not even himself could read, though his own live heart beat against them; and these mysteries were therefore destined in the end to moulder away with the living parchment whereon they were inscribed, and so be unsolved to the last.&#8221;<span id="more-53942"></span></p>
<h4>THE GREAT WHITE WHALE</h4>
<p>It&#8217;s perhaps fitting then that one of the most recognizable figures from the mob that stormed the U.S. Capitol on Wednesday was a heavily-tattooed, spear-wielding QAnon leader who goes by the name &#8220;<strong>Q Shaman</strong>&#8221; (a.k.a. <strong>Jake Angeli</strong>).</p>
<div id="attachment_53958" style="width: 605px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-53958" loading="lazy" class=" wp-image-53958" src="media/29b8fd16.qshaman-twitter.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/01/qshaman-twitter.png" alt="" width="595" height="335" /><p id="caption-attachment-53958" class="wp-caption-text">&#8220;Q Shaman,&#8221; a.k.a. Jake Angeli, at a Black Lives Matter event in Arizona (left) and Wednesday, confronted by U.S. Capitol Police. Image: Twitter, @KelemenCari.</p></div>
<p>&#8220;Angeli&#8217;s presence at the riot, along with others wearing QAnon paraphernalia, comes as the conspiracy-theory movement has been responsible for the popularization of Trump&#8217;s voter-fraud conspiracy theories,&#8221; <a href="https://news.yahoo.com/well-known-qanon-influencer-dubbed-230306934.html" target="_blank" rel="noopener noreferrer">writes</a> <strong>Rachel E. Greenspan</strong> for Yahoo! News.</p>
<p>&#8220;As Q has become increasingly hands-off, giving fewer and fewer messages to his devotees, QAnon leaders like Angeli have gained fame and power in the movement,&#8221; Greenspan wrote.</p>
<p>If somehow Moby Dick was indeed the inspiration for the &#8220;Q&#8221; identity in QAnon, yesterday&#8217;s events at The Capitol were the inexorable denouement of a presidential term that increasingly came to be defined by conspiracy theories. In a somewhat prescient <em>Hartford Courant</em> <a href="https://www.courant.com/la-oe-almond-books-trump-20180422-story.html" target="_blank" rel="noopener noreferrer">op-ed published in 2018</a>, author <strong>Steven Almond</strong> observed that Trump&#8217;s presidency could be best understood through the lens of the Pequod&#8217;s <strong>Captain Ahab</strong>. To wit:</p>
<blockquote><p>&#8220;Melville is offering a mythic account of how one man&#8217;s virile bombast ensnares everyone and everything it encounters. The setting is nautical, the language epic. But the tale, stripped to its ribs, is about the seductive power of the wounded male ego, how naturally a ship steered by men might tack to its vengeful course.&#8221;</p>
<p>&#8220;Trump&#8217;s presidency has been, in its way, a retelling of this epic. Whether we cast him as agent or principal hardly matters. What matters is that Americans have joined the quest. In rapture or disgust, we&#8217;ve turned away from the compass of self-governance and toward the mesmerizing drama of aggression on display, the masculine id unchained and all that it unchains within us. With every vitriolic tweet storm and demeaning comment, Trump strikes through the mask.&#8221;</p></blockquote>
<h4>EPILOGUE</h4>
<p>If all of the above theorizing reads like yet another crackpot QAnon conspiracy, that may be the inevitable consequence of my spending far too much time going down this particular rabbit hole (and re-reading Moby Dick in the process!).</p>
<p>In any case, none of this is likely to matter to the diehard QAnon conspiracy theorists themselves, says <strong>Mike Rothschild</strong>, a writer who specializes in researching and debunking conspiracy theories.</p>
<p>&#8220;Even if Jim Watkins was revealed as owning the board or making the posts, it wouldn&#8217;t matter,&#8221; Rothschild said. &#8220;Anything that happens that disconfirms Q being an official in the military industrial complex is going to help fuel their persecution complex.&#8221;</p>
<p>Rothschild has been working hard on finishing his next book, &#8220;<a href="https://www.amazon.com/Storm-Upon-Us-Conspiracy-Everything-ebook/dp/B08S6YQ1KF/ref=sr_1_3?dchild=1&amp;keywords=mike+rothschild&amp;qid=1610045641&amp;s=books&amp;sr=1-3" target="_blank" rel="noopener noreferrer">The Storm is Upon Us: How QAnon Became a Movement, Cult, and Conspiracy Theory of Everything</a>,&#8221; which is due to be published in October 2021. Who&#8217;s printing the book? Ten points if you guessed <a href="https://www.mhpbooks.com/" target="_blank" rel="noopener noreferrer">Melville House</a>, an independent publisher named after Herman Melville.</p>


feed_id: https://krebsonsecurity.com/?p=53996
title: Ubiquiti: Change Your Password, Enable 2FA
uri: Ubiquiti-Change-Your-Password-Enable-2FA
url: https://krebsonsecurity.com/2021/01/ubiquiti-change-your-password-enable-2fa/
content:
<p><strong>Ubiquiti</strong>, a major vendor of cloud-enabled Internet of Things (IoT) devices such as routers, network video recorders, security cameras and access control systems, is urging customers to change their passwords and enable multi-factor authentication. The company says an incident at a third-party cloud provider may have exposed customer account information and credentials used to remotely manage Ubiquiti gear.</p>
<p>In an email sent to customers today, <a href="https://en.wikipedia.org/wiki/Ubiquiti_Networks" rel="noopener noreferrer" target="_blank">Ubiquiti Inc.</a> [<a href="https://www.nyse.com/quote/XNYS:UI" rel="noopener noreferrer" target="_blank">NYSE: UI</a>] said it recently became aware of &#8220;unauthorized access to certain of our information technology systems hosted by a third party cloud provider,&#8221; although it declined to name that provider.</p>
<p><img loading="lazy" class="aligncenter  wp-image-54003" src="media/a189b433.ubi-notice.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/01/ubi-notice.png" alt="" width="600" height="633" /></p>
<p>The statement continues:</p>
<p>&#8220;We are not currently aware of evidence of access to any databases that host user data, but we cannot be certain that user data has not been exposed. This data may include your name, email address, and the one-way encrypted password to your account (in technical terms, the passwords are hashed and salted). The data may also include your address and phone number if you have provided that to us.&#8221;</p>
<p>Ubiquiti has not yet responded to requests for more information, but the notice was confirmed as official in <a href="https://community.ui.com/questions/Account-Notification/96467115-49b5-4dd6-9517-f8cdbf6906f3" target="_blank" rel="noopener noreferrer">a post on the company&#8217;s user support forum</a>.</p>
<p>The warning from Ubiquiti carries particular significance because the company has made it fairly difficult for customers using the latest Ubiquiti firmware to interact with their devices without first authenticating through the company&#8217;s cloud-based systems.<span id="more-53996"></span></p>
<p>This has become a sticking point for many Ubiquiti customers, as evidenced by numerous threads on the topic in the company&#8217;s user support forums over the past few months.</p>
<p>&#8220;While I and others do appreciate the convenience and option of using hosted accounts, this incident clearly highlights the problem with relying on your infrastructure for authenticating access to our devices,&#8221; wrote <a href="https://community.ui.com/questions/A-Request-for-Local-Accounts-in-light-of-this-breach-1-11-2021/4972a1fb-ff95-4dc3-b920-63b3b292bf96" target="_blank" rel="noopener noreferrer">one Ubiquiti customer</a> today whose sentiment was immediately echoed by other users. &#8220;A lot us cannot take your process for granted and need to keep our devices offline during setup and make direct connections by IP/Hostname using our Mobile Apps.&#8221;</p>
<p>To manage your security settings on a Ubiquiti device, visit https://account.ui.com and log in. Click on &#8216;Security&#8217; from the left-hand menu.</p>
<p>1. Change your password<br />
2. Set a session timeout value<br />
3. Enable 2FA</p>
<div id="attachment_54000" style="width: 609px" class="wp-caption aligncenter"><a href="media/d867e11e.ubi-changes.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/01/ubi-changes.png"><img aria-describedby="caption-attachment-54000" loading="lazy" class="wp-image-54000" src="media/d867e11e.ubi-changes.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/01/ubi-changes.png" alt="" width="599" height="223" srcset="https://krebsonsecurity.com/wp-content/uploads/2021/01/ubi-changes.png 1304w, https://krebsonsecurity.com/wp-content/uploads/2021/01/ubi-changes-768x286.png 768w" sizes="(max-width: 599px) 100vw, 599px" /></a><p id="caption-attachment-54000" class="wp-caption-text">Image: twitter.com/crosstalksol/</p></div>
<p>According to Ubiquiti&#8217;s investment literature, the company has shipped more than 85 million devices that play a key role in networking infrastructure in over 200 countries and territories worldwide.</p>
<p>This is a developing story that may be updated throughout the day.</p>


feed_id: https://krebsonsecurity.com/?p=54011
title: SolarWinds: What Hit Us Could Hit Others
uri: SolarWinds-What-Hit-Us-Could-Hit-Others
url: https://krebsonsecurity.com/2021/01/solarwinds-what-hit-us-could-hit-others/
content:
<p>New research into the malware that set the stage for the megabreach at IT vendor <strong>SolarWinds</strong> shows the perpetrators spent months inside the company&#8217;s software development labs honing their attack before inserting malicious code into updates that SolarWinds then shipped to thousands of customers. More worrisome, the research suggests the insidious methods used by the intruders to subvert the company&#8217;s software development pipeline could be repurposed against many other major software providers.</p>
<p>In <a href="https://orangematter.solarwinds.com/2021/01/11/new-findings-from-our-investigation-of-sunburst/" target="_blank" rel="noopener noreferrer">a blog post</a> published Jan. 11, SolarWinds said the attackers first compromised its development environment on Sept. 4, 2019. Soon after, the attackers began testing code designed to surreptitiously inject backdoors into <strong>Orion</strong>, a suite of tools used by many Fortune 500 firms and a broad swath of the federal government to manage their internal networks.</p>
<div id="attachment_54013" style="width: 608px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-54013" loading="lazy" class=" wp-image-54013" src="media/06a921df.sw-timeline.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/01/sw-timeline.png" alt="" width="598" height="327" /><p id="caption-attachment-54013" class="wp-caption-text">Image: SolarWinds.</p></div>
<p>According to SolarWinds and <a href="https://www.crowdstrike.com/blog/sunspot-malware-technical-analysis/" target="_blank" rel="noopener noreferrer">a technical analysis</a> from <strong>CrowdStrike</strong>, the intruders were trying to work out whether their &#8220;<strong>Sunspot</strong>&#8221; malware &#8212; designed specifically for use in undermining SolarWinds&#8217; software development process &#8212; could successfully insert their malicious &#8220;<strong>Sunburst</strong>&#8221; backdoor into Orion products without tripping any alarms or alerting Orion developers.</p>
<p>In October 2019, SolarWinds pushed an update to their Orion customers that contained the modified test code. By February 2020, the intruders had used Sunspot to inject the Sunburst backdoor into the Orion source code, which was then digitally signed by the company and propagated to customers via SolarWinds&#8217; software update process.</p>
<p>Crowdstrike said Sunspot was written to be able to detect when it was installed on a SolarWinds developer system, and to lie in wait until specific Orion source code files were accessed by developers. This allowed the intruders to &#8220;replace source code files during the build process, before compilation,&#8221; Crowdstrike wrote.</p>
<p>The attackers also included safeguards to prevent the backdoor code lines from appearing in Orion software build logs, and checks to ensure that such tampering wouldn&#8217;t cause build errors.</p>
<p>&#8220;The design of SUNSPOT suggests [the malware] developers invested a lot of effort to ensure the code was properly inserted and remained undetected, and prioritized operational security to avoid revealing their presence in the build environment to SolarWinds developers,&#8221; CrowdStrike wrote.</p>
<p>A third malware strain &#8212; dubbed &#8220;<strong>Teardrop</strong>&#8221; by <strong>FireEye</strong>, the company that <a href="https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html" target="_blank" rel="noopener noreferrer">first disclosed the SolarWinds attack in December</a> &#8212; was installed via the backdoored Orion updates on networks that the SolarWinds attackers wanted to plunder more deeply.</p>
<p>So far, the Teardrop malware has been found on several government networks, including the Commerce, Energy and Treasury departments, the Department of Justice and <a href="https://krebsonsecurity.com/2021/01/sealed-u-s-court-records-exposed-in-solarwinds-breach/" target="_blank" rel="noopener noreferrer">the Administrative Office of the U.S. Courts</a>.</p>
<p>SolarWinds emphasized that while the Sunspot code was specifically designed to compromise the integrity of its software development process, that same process is likely common across the software industry.</p>
<p>&#8220;Our concern is that right now similar processes may exist in software development environments at other companies throughout the world,&#8221; said SolarWinds <strong>CEO Sudhakar Ramakrishna</strong>. &#8220;The severity and complexity of this attack has taught us that more effectively combatting similar attacks in the future will require an industry-wide approach as well as public-private partnerships that leverage the skills, insight, knowledge, and resources of all constituents.&#8221;</p>


feed_id: https://krebsonsecurity.com/?p=54025
title: Microsoft Patch Tuesday, January 2021 Edition
uri: Microsoft-Patch-Tuesday-January-2021-Edition
url: https://krebsonsecurity.com/2021/01/microsoft-patch-tuesday-january-2021-edition/
content:
<p><strong>Microsoft</strong> today released updates to plug more than 80 security holes in its <strong>Windows</strong> operating systems and other software, including one that is actively being exploited and another which was disclosed prior to today. Ten of the flaws earned Microsoft&#8217;s most-dire &#8220;critical&#8221; rating, meaning they could be exploited by malware or miscreants to seize remote control over unpatched systems with little or no interaction from Windows users.</p>
<p><img loading="lazy" class="aligncenter wp-image-52647" src="media/2471c2d6.windowsec.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/08/windowsec.png" alt="" width="599" height="440" /></p>
<p>Most concerning of this month&#8217;s batch is probably a critical bug (<a href="https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-1647" target="_blank" rel="noopener noreferrer">CVE-2021-1647</a>) in Microsoft&#8217;s default anti-malware suite &#8212; <strong>Windows Defender</strong> &#8212; that is seeing active exploitation. Microsoft recently stopped providing a great deal of detail in their vulnerability advisories, so it&#8217;s not entirely clear how this is being exploited.</p>
<p>But <strong>Kevin Breen</strong>, director of research at <strong>Immersive Labs</strong>, says depending on the vector the flaw could be trivial to exploit.</p>
<p>&#8220;It could be as simple as sending a file,&#8221; he said. &#8220;The user doesn&#8217;t need to interact with anything, as Defender will access it as soon as it is placed on the system.&#8221;</p>
<p>Fortunately, this bug is probably already patched by Microsoft on end-user systems, as the company continuously updates Defender outside of the normal monthly patch cycle.</p>
<p>Breen called attention to another critical vulnerability this month &#8212; <a href="https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-1660" target="_blank" rel="noopener noreferrer">CVE-2020-1660</a> &#8212; which is a remote code execution flaw in nearly every version of Windows that earned a <a href="https://www.first.org/cvss/" target="_blank" rel="noopener noreferrer">CVSS score</a> of 8.8 (10 is the most dangerous).</p>
<p>&#8220;They classify this vulnerability as &#8216;low&#8217; in complexity, meaning an attack could be easy to reproduce,&#8221; Breen said. &#8220;However, they also note that it’s &#8216;less likely&#8217; to be exploited, which seems counterintuitive. Without full context of this vulnerability, we have to rely on Microsoft to make the decision for us.&#8221;<span id="more-54025"></span></p>
<p>CVE-2020-1660 is actually just one of five bugs in a core Microsoft service called <strong>Remote Procedure Call</strong> (RPC), which is responsible for a lot of heavy lifting in Windows. Some of the more memorable computer worms of the last decade spread automatically by exploiting RPC vulnerabilities.</p>
<p><strong>Allan Liska</strong>, senior security architect at <strong>Recorded Future</strong>, said while it is concerning that so many vulnerabilities around the same component were released simultaneously, two previous vulnerabilities in RPC &#8212; <a href="https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2019-1409" target="_blank" rel="noopener noreferrer">CVE-2019-1409</a> and <a href="https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2018-8514" target="_blank" rel="noopener noreferrer">CVE-2018-8514</a> &#8212; were not widely exploited.</p>
<p>The remaining 70 or so flaws patched this month earned Microsoft&#8217;s less-dire &#8220;important&#8221; ratings, which is not to say they&#8217;re much less of a security concern. Case in point: <a href="https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-1709" target="_blank" rel="noopener noreferrer">CVE-2021-1709</a>, which is an &#8220;elevation of privilege&#8221; flaw in Windows 8 through 10 and Windows Server 2008 through 2019.</p>
<p>&#8220;Unfortunately, this type of vulnerability is often quickly exploited by attackers,&#8221; Liska said. &#8220;For example, <a href="https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2019-1458" target="_blank" rel="noopener noreferrer">CVE-2019-1458</a> was announced on December 10th of 2019, and by December 19th an attacker was seen selling an exploit for the vulnerability on underground markets. So, while CVE-2021-1709 is only rated as [an information exposure flaw] by Microsoft it should be prioritized for patching.&#8221;</p>
<p><strong>Trend Micro&#8217;s ZDI Initiative</strong> pointed out another flaw marked &#8220;important&#8221; &#8212; <a href="https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-1648" target="_blank" rel="noopener noreferrer">CVE-2021-1648</a>, an elevation of privilege bug in Windows 8, 10 and some Windows Server 2012 and 2019 that was publicly disclosed by ZDI prior to today.</p>
<p>&#8220;It was also discovered by Google likely because this patch corrects a bug introduced by a previous patch,&#8221; ZDI&#8217;s <strong>Dustin Childs</strong> said. &#8220;The previous CVE was being exploited in the wild, so it’s within reason to think this CVE will be actively exploited as well.”</p>
<p>Separately, Adobe released security updates to tackle at least eight vulnerabilities <a href="https://blogs.adobe.com/psirt/?p=1960" target="_blank" rel="noopener noreferrer">across a range of products</a>, including <strong>Adobe Photoshop</strong> and <strong>Illustrator</strong>. There are no <strong>Flash Player</strong> updates because Adobe retired the browser plugin in December (hallelujah!), and Microsoft&#8217;s update cycle from last month removed the program from Microsoft&#8217;s browsers.</p>
<p>Windows 10 users should be aware that the operating system will download updates and install them all at once on its own schedule, closing out active programs and rebooting the system. If you wish to ensure Windows has been set to pause updating so you have ample opportunity to back up your files and/or system, see <a href="https://www.computerworld.com/article/3543189/check-to-make-sure-you-have-windows-updates-paused.html" target="_blank" rel="noopener noreferrer">this guide</a>.</p>
<p>Please back up your system before applying any of these updates. Windows 10 even has <a href="https://lifehacker.com/how-to-back-up-your-computer-automatically-with-windows-1762867473" target="_blank" rel="noopener noreferrer">some built-in tools</a> to help you do that, either on a per-file/folder basis or by making a complete and bootable copy of your hard drive all at once. You never know when a patch roll-up will bork your system or possibly damage important files. For those seeking more flexible and full-featured backup options (including incremental backups), <a href="https://www.acronis.com/en-us/products/true-image/" target="_blank" rel="noopener noreferrer">Acronis</a> and <a href="https://www.macrium.com/" target="_blank" rel="noopener noreferrer">Macrium</a> are two that I&#8217;ve used previously and are worth a look.</p>
<p>That said, there don&#8217;t appear to be any major issues cropping up yet with this month&#8217;s update batch. But before you apply updates consider paying a visit to <a href="https://www.askwoody.com/category/microsoft-windows-patches-security/" target="_blank" rel="noopener noreferrer">AskWoody.com</a>, which usually has the skinny on any reports about problematic patches.</p>
<p>As always, if you experience glitches or issues installing any of these patches this month, please consider leaving a comment about it below; there’s a better-than-even chance other readers have experienced the same and may chime in here with some helpful tips.</p>


feed_id: https://krebsonsecurity.com/?p=54041
title: Joker’s Stash Carding Market to Call it Quits
uri: Joker-s-Stash-Carding-Market-to-Call-it-Quits
url: https://krebsonsecurity.com/2021/01/jokers-stash-carding-market-to-call-it-quits/
content:
<p><strong>Joker&#8217;s Stash</strong>, by some accounts the largest underground shop for selling stolen credit card and identity data, says it&#8217;s closing up shop effective mid-February 2021. The announcement came on the heels of a turbulent year for the major cybercrime store, and just weeks after U.S. and European authorities seized a number of its servers.</p>
<div id="attachment_54048" style="width: 605px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-54048" loading="lazy" class=" wp-image-54048" src="media/ec639a76.joker-goodbye.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/01/joker-goodbye.png" alt="" width="595" height="627" /><p id="caption-attachment-54048" class="wp-caption-text">A farewell message posted by Joker&#8217;s Stash admin on Jan. 15, 2021.</p></div>
<p>The Russian and English language carding store first opened in October 2014, and quickly became a major source of &#8220;dumps&#8221; &#8212; information stolen from compromised payment cards that thieves can buy and use to create physical counterfeit copies of the cards.</p>
<p>But 2020 turned out to be a tough year for Joker&#8217;s Stash. As cyber intelligence firm <a href="https://intel471.com/blog/jokers-stash-closed-february-2021/" target="_blank" rel="noopener">Intel 471</a> notes, the curator of the store announced in October that he&#8217;d contracted COVID-19, spending a week in the hospital. Around that time, Intel 471 says many of Joker&#8217;s loyal customers started complaining that the shop&#8217;s payment card data quality was increasingly poor.</p>
<p>&#8220;The condition impacted the site’s forums, inventory replenishments and other operations,&#8221; Intel 471 said.</p>
<div id="attachment_54047" style="width: 609px" class="wp-caption aligncenter"><a href="media/66de8bed.joker-covid.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/01/joker-covid.png"><img aria-describedby="caption-attachment-54047" loading="lazy" class="wp-image-54047" src="media/66de8bed.joker-covid.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/01/joker-covid.png" alt="" width="599" height="304" srcset="https://krebsonsecurity.com/wp-content/uploads/2021/01/joker-covid.png 1236w, https://krebsonsecurity.com/wp-content/uploads/2021/01/joker-covid-768x390.png 768w" sizes="(max-width: 599px) 100vw, 599px" /></a><p id="caption-attachment-54047" class="wp-caption-text">Image: Gemini Advisory</p></div>
<p>That COVID diagnosis may have affected the shop owner&#8217;s ability to maintain fresh and valid inventory on his site. <a href="https://www.geminiadvisory.io" target="_blank" rel="noopener">Gemini Advisory</a>, a New York City-based company that monitors underground carding shops, tracked a &#8220;severe decline&#8221; in the volume of compromised payment card accounts for sale on Joker&#8217;s Stash over the past six months.</p>
<p>&#8220;Joker&#8217;s Stash has received numerous user complaints alleging that card data validity is low, which even prompted the administrator to upload proof of validity through a card-testing service,&#8221; Gemini wrote in <a href="https://geminiadvisory.io/jokers-stash-shuts-down/" target="_blank" rel="noopener">a blog post</a> about the planned shutdown.</p>
<div id="attachment_54050" style="width: 607px" class="wp-caption aligncenter"><a href="media/f5750c37.js-dumpsdecline.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/01/js-dumpsdecline.png"><img aria-describedby="caption-attachment-54050" loading="lazy" class="wp-image-54050" src="media/f5750c37.js-dumpsdecline.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/01/js-dumpsdecline.png" alt="" width="597" height="356" srcset="https://krebsonsecurity.com/wp-content/uploads/2021/01/js-dumpsdecline.png 1387w, https://krebsonsecurity.com/wp-content/uploads/2021/01/js-dumpsdecline-768x458.png 768w" sizes="(max-width: 597px) 100vw, 597px" /></a><p id="caption-attachment-54050" class="wp-caption-text">Image: Gemini Advisory</p></div>
<p>Then on Dec. 16, 2020, several of Joker&#8217;s long-held domains began <a href="https://twitter.com/search?q=joker%27s+stash+briankrebs" target="_blank" rel="noopener">displaying notices</a> that the sites had been seized by the <strong>U.S. Department of Justice</strong> and <strong>Interpol</strong>. The crime shop quickly recovered, moving to new infrastructure and assuring the underground community that it would continue to operate normally.</p>
<p>Gemini estimates that Joker&#8217;s Stash generated more than a billion dollars in revenue over the past several years. Much of that revenue came from high-profile breaches, including tens of millions of payment card records stolen from major merchants including <a href="https://www.nbcnews.com/news/us-news/data-breach-saks-lord-taylor-compromises-customer-payment-data-n861856" target="_blank" rel="noopener">Saks Fifth Avenue, Lord and Taylor</a>, <a href="http://krebsonsecurity.com/2014/12/bebe-stores-confirms-credit-card-breach/" target="_blank" rel="noopener">Bebe Stores</a>, <a href="http://krebsonsecurity.com/?s=hilton+breach&amp;x=0&amp;y=0" target="_blank" rel="noopener">Hilton Hotels</a>, <a href="https://krebsonsecurity.com/2017/12/4-years-after-target-the-little-guy-is-the-target/" target="_blank" rel="noopener">Jason’s Deli</a>, <a href="https://www.cnbc.com/2017/09/28/whole-foods-suffers-data-breach-in-some-stores.html" target="_blank" rel="noopener">Whole Foods</a>, <a href="https://www.reuters.com/article/us-chipotle-cyber/chipotle-says-hackers-hit-most-restaurants-in-data-breach-idUSKBN18M2BY" target="_blank" rel="noopener">Chipotle</a>, <a href="https://krebsonsecurity.com/2020/01/wawa-breach-may-have-compromised-more-than-30-million-payment-cards/" target="_blank" rel="noopener">Wawa</a>, <a href="https://krebsonsecurity.com/2017/09/breach-at-sonic-drive-in-may-have-impacted-millions-of-credit-debit-cards/" target="_blank" rel="noopener">Sonic Drive-In</a>, the <a href="https://krebsonsecurity.com/2019/08/breach-at-hy-vee-supermarket-chain-tied-to-sale-of-5m-stolen-credit-debit-cards/" target="_blank" rel="noopener">Hy-Vee supermarket chain</a>, <a href="https://krebsonsecurity.com/2019/03/a-month-after-2-million-customer-cards-sold-online-buca-di-beppo-parent-admits-breach/" target="_blank" rel="noopener">Buca Di Beppo</a>, and <a href="https://krebsonsecurity.com/2020/10/breach-at-dickeys-bbq-smokes-3m-cards/" target="_blank" rel="noopener">Dickey&#8217;s BBQ</a>.</p>
<p>Joker&#8217;s Stash routinely teased big breaches days or weeks in advance of selling payment card records stolen from those companies, and periodically linked to this site and other media outlets as proof of his shop&#8217;s prowess and authenticity.</p>
<p>Like many other top cybercrime bazaars, Joker&#8217;s Stash was a frequent target of phishers looking to rip off unwary or unsophisticated thieves. In 2018, KrebsOnSecurity <a href="https://krebsonsecurity.com/2018/05/will-the-real-jokers-stash-come-forward/" target="_blank" rel="noopener">detailed a vast network of fake Joker&#8217;s Stash sites</a> set up to steal login credentials and bitcoin. The phony sites all traced back to the owners of a Pakistani web site design firm. Many of those fake sites are still active (e.g. jokersstash[.]su). <span id="more-54041"></span></p>
<p>As <a href="https://krebsonsecurity.com/2016/03/carders-park-piles-of-cash-at-jokers-stash/" target="_blank" rel="noopener">noted here in 2016</a>, Joker&#8217;s Stash attracted an impressive number of customers who kept five and six-digit balances at the shop, and who were granted early access to new breaches as well as steep discounts for bulk buys. Those &#8220;partner&#8221; customers will be given the opportunity to cash out their accounts. But the majority of Stash customers do not enjoy this status, and will have to spend their balances by Feb. 15 or forfeit those funds.</p>
<div id="attachment_34284" style="width: 604px" class="wp-caption aligncenter"><a href="media/9e90f120.tr.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2016/03/tr.png"><img aria-describedby="caption-attachment-34284" loading="lazy" class="wp-image-34284" src="media/9e90f120.tr.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2016/03/tr.png" alt="" width="594" height="318" srcset="https://krebsonsecurity.com/wp-content/uploads/2016/03/tr.png 2190w, https://krebsonsecurity.com/wp-content/uploads/2016/03/tr-580x311.png 580w, https://krebsonsecurity.com/wp-content/uploads/2016/03/tr-768x412.png 768w, https://krebsonsecurity.com/wp-content/uploads/2016/03/tr-940x504.png 940w" sizes="(max-width: 594px) 100vw, 594px" /></a><p id="caption-attachment-34284" class="wp-caption-text">The dashboard for a Joker&#8217;s Stash customer who&#8217;s spent over $10,000 buying stolen credit cards from the site.</p></div>
<p>Gemini said another event that may have contributed to this threat actor shutting down their marketplace is the recent spike in the value of Bitcoin. A year ago, one bitcoin was worth about $9,000. Today a single bitcoin is valued at more than $35,000.</p>
<p>&#8220;JokerStash was an early advocate of Bitcoin and claims to keep all proceeds in this cryptocurrency,&#8221; Gemini observed in a blog post. &#8220;This actor was already likely to be among the wealthiest cybercriminals, and the spike may have multiplied their fortune, earning them enough money to retire. However, the true reason behind this shutdown remains unclear.&#8221;</p>
<p>If the bitcoin price theory holds, that would be fairly rich considering the parting lines in the closure notice posted to Joker&#8217;s Stash.</p>
<p>&#8220;We are also want to wish all young and mature ones cyber-gangsters not to lose themselves in the pursuit of easy money,&#8221; the site administrator(s) advised. &#8220;Remember, that even all the money in the world will never make you happy and that all the most truly valuable things in this life are free.&#8221;</p>
<p>Regardless, the impending shutdown is unlikely to have much of an impact on the overall underground carding industry, Gemini notes.</p>
<p>&#8220;Given Joker’s Stash’s high profile, it relied on a robust network of criminal vendors who offered their stolen records on this marketplace, among others,&#8221; the company wrote. &#8220;Gemini assesses with a high level of confidence that these vendors are very likely to fully transition to other large, top-tier dark web marketplaces.&#8221;</p>


feed_id: https://krebsonsecurity.com/?p=54044
title: New Charges Derail COVID Release for Hacker Who Aided ISIS
uri: New-Charges-Derail-COVID-Release-for-Hacker-Who-Aided-ISIS
url: https://krebsonsecurity.com/2021/01/new-charges-derail-covid-release-for-hacker-who-aided-isis/
content:
<p>A hacker serving a 20-year sentence for stealing personal data on 1,300 U.S. military and government employees and giving it to an Islamic State hacker group in 2015 has been charged once again with fraud and identity theft. The new charges have derailed plans to deport him under compassionate release because of the COVID-19 pandemic.</p>
<p><strong>Ardit Ferizi</strong>, a 25-year-old citizen of Kosovo, was <a href="https://apnews.com/article/hacking-islamic-state-group-coronavirus-pandemic-da790d7b9a4f677b5dc74f376e3e66b9" target="_blank" rel="noopener">slated to be sent home earlier this month</a> after a federal judge signed an order commuting his sentence to time served. The release was granted in part due to Ferizi&#8217;s 2018 diagnosis if asthma, as well as a COVID outbreak at the facility where he was housed in 2020.</p>
<p>But while Ferizi was in quarantine awaiting deportation the Justice Department <a href="https://www.justice.gov/usao-ndca/press-release/file/1352911/download" target="_blank" rel="noopener">unsealed new charges against him</a>, saying he&#8217;d conspired from prison with associates on the outside to access stolen data and launder the bitcoin proceeds of his previous crimes.</p>
<p>In the years leading up to his arrest, Ferizi was the administrator of a cybercrime forum called <strong>Pentagon Crew</strong>. He also served as the leader of an ethnic Albanian group of hackers from Kosovo known as Kosova Hacker&#8217;s Security (KHS), which focused on compromising government and private websites in Israel, Serbia, Greece, Ukraine and the United States.</p>
<div id="attachment_54073" style="width: 609px" class="wp-caption aligncenter"><a href="media/ebdb510f.pentagoncrew.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/01/pentagoncrew.png"><img aria-describedby="caption-attachment-54073" loading="lazy" class="wp-image-54073 " src="media/ebdb510f.pentagoncrew.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/01/pentagoncrew.png" alt="" width="599" height="234" srcset="https://krebsonsecurity.com/wp-content/uploads/2021/01/pentagoncrew.png 1142w, https://krebsonsecurity.com/wp-content/uploads/2021/01/pentagoncrew-768x300.png 768w" sizes="(max-width: 599px) 100vw, 599px" /></a><p id="caption-attachment-54073" class="wp-caption-text">The Pentagon Crew forum founded by Ferizi.</p></div>
<p>In December 2015, Ferizi was apprehended in Malaysia and extradited to the United States. In January 2016, Ferizi pleaded guilty to providing material support to a terrorist group and to unauthorized access. He admitted to hacking a U.S.-based e-commerce company, stealing personal and financial data on 1,300 government employees, and providing the data to an Islamic State hacking group.</p>
<p>Ferizi give the purloined data to <a href="https://en.wikipedia.org/wiki/Junaid_Hussain" target="_blank" rel="noopener">Junaid &#8220;Trick&#8221; Hussain</a>, a 21-year-old hacker and recruiter for ISIS who published it in August 2015 as part of a directive that ISIS supporters kill the named U.S. military members and government employees. Later that month, Hussain was reportedly killed by a drone strike in Syria.<span id="more-54044"></span></p>
<p>The government says Ferizi and his associates made money by hacking PayPal and other financial accounts, and through pornography sites he allegedly set up mainly to steal personal and financial data from visitors.</p>
<div id="attachment_33421" style="width: 261px" class="wp-caption alignright"><img aria-describedby="caption-attachment-33421" loading="lazy" class=" wp-image-33421" src="media/78c0f5ad.junaid.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2015/12/junaid.png" alt="" width="251" height="269" /><p id="caption-attachment-33421" class="wp-caption-text">Junaid Hussain&#8217;s Twitter profile photo.</p></div>
<p>Between 2015 and 2019, Ferizi was imprisoned at a facility in Illinois that housed several other notable convicts. For example, prosecutors allege that Ferizi was an associate of <strong>Mahmud &#8220;Red&#8221; Abouhalima</strong>, who was serving a 240 year sentence at the prison for his role in <a href="https://en.wikipedia.org/wiki/1993_World_Trade_Center_bombing" target="_blank" rel="noopener">the 1993 World Trade Center bombing</a>.</p>
<p>Another inmate incarcerated at the same facility was <strong>Shawn Bridges</strong>, a former <strong>U.S. Secret Service</strong> agent <a href="https://arstechnica.com/tech-policy/2017/11/ex-agent-corrupted-by-silk-road-sentenced-to-2-additional-years/" target="_blank" rel="noopener">serving almost eight years</a> for stealing $820,000 worth of bitcoin from online drug dealers while investigating the hidden underground website Silk Road. Prosecutors say Ferizi and Bridges discussed ways to hide their bitcoin.</p>
<p>The information about Ferizi&#8217;s inmate friends came via a tip from another convict, who told the FBI that Ferizi was allegedly using his access to the prison&#8217;s email system to share email and bitcoin account passwords with family members back home.</p>
<p>The Justice Department said subpoenas served on Ferizi&#8217;s email accounts and interviews with his associates show Ferizi&#8217;s brother in Kosovo used the information to &#8220;liquidate the proceeds of Ferizi&#8217;s previous criminal hacking activities.&#8221;</p>
<p>[Side note: It may be little more than a coincidence, but <a href="https://krebsonsecurity.com/2015/12/2016-reality-lazy-authentication-still-the-norm/" target="_blank" rel="noopener">my PayPal account was hacked in Dec. 2015</a> by criminals who social engineered PayPal employees over the phone into changing my password and bypassing multi-factor authentication. The hackers attempted to send my balance to an account tied to Hussain, but the transfer never went through.]</p>
<p>Ferizi is being tried in California, but has not yet had an initial appearance in court. He&#8217;s charged with one count of aggravated identity theft and one count of wire fraud. If convicted of wire fraud, he faces a maximum penalty of 20 years in prison and a fine of $250,000. If convicted of aggravated identity theft, he faces a mandatory penalty of 2 years in prison in addition to the punishment imposed for a wire fraud conviction.</p>


feed_id: https://krebsonsecurity.com/?p=54087
title: DDoS-Guard To Forfeit Internet Space Occupied by Parler
uri: DDoS-Guard-To-Forfeit-Internet-Space-Occupied-by-Parler
url: https://krebsonsecurity.com/2021/01/ddos-guard-to-forfeit-internet-space-occupied-by-parler/
content:
<p><strong>Parler</strong>, the beleaguered social network advertised as a &#8220;free speech&#8221; alternative to Facebook and Twitter, has had a tough month.<strong> Apple</strong> and <strong>Google </strong>removed the Parler app from its stores, and <strong>Amazon </strong>blocked the platform from using its hosting services. Parler has since found a home in <strong>DDoS-Guard</strong>, a Russian digital infrastructure company. But now it appears DDoS-Guard is about to be relieved of more than two-thirds of the Internet address space the company leases to clients &#8212; including the Internet addresses currently occupied by Parler.</p>
<p><img loading="lazy" class="aligncenter wp-image-54098" src="media/072d892b.parler2.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/01/parler2.png" alt="" width="598" height="105" srcset="https://krebsonsecurity.com/wp-content/uploads/2021/01/parler2.png 786w, https://krebsonsecurity.com/wp-content/uploads/2021/01/parler2-768x135.png 768w" sizes="(max-width: 598px) 100vw, 598px" /></p>
<p>The pending disruption for DDoS-Guard and Parler comes compliments of <strong>Ron Guilmette</strong>, a researcher who has made it something of a personal mission to de-platform conspiracy theorist and far-right groups.</p>
<p>In October, a phone call from Guilmette to an Internet provider in Oregon was all it took <a href="https://krebsonsecurity.com/2020/10/qanon-8chan-sites-briefly-knocked-offline/" target="_blank" rel="noopener">to briefly sideline a vast network of sites</a> tied to <strong>8chan/8kun</strong> &#8212; a controversial online image board linked to several mass shootings — and <strong>QAnon</strong>, the far-right conspiracy theory which holds that a cabal of Satanic pedophiles is running a global child sex-trafficking ring and plotting against President Donald Trump. As a result, those QAnon and 8chan sites also ultimately ended up in the arms of DDoS-Guard.</p>
<p>Much like Internet infrastructure firm <strong>CloudFlare</strong>, DDoS-Guard typically doesn&#8217;t host sites directly but instead acts as a go-between to simultaneously keep the real Internet addresses of its clients confidential and to protect them from crippling <a href="https://en.wikipedia.org/wiki/Denial-of-service_attack" target="_blank" rel="noopener">Distributed Denial-of-Service</a> (DDoS) attacks.</p>
<p>The <a href="https://www.linkedin.com/search/results/people/?currentCompany=%5B%225039211%22%5D&amp;origin=COMPANY_PAGE_CANNED_SEARCH" target="_blank" rel="noopener">majority of DDoS-Guard&#8217;s employees are based in Russia</a>, but the company is actually incorporated in two other places: As &#8220;<strong>Cognitive Cloud LLP</strong>&#8221; in Scotland, and as <strong>DDoS-Guard Corp.</strong> based in Belize.  However, none of the company&#8217;s employees are listed as based in Belize, and DDoS-Guard makes no mention of the Latin American region in <a href="media/84713b5d.ddosguad-map-768x532.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/01/ddosguad-map-768x532.png" target="_blank" rel="noopener">its map of global operations</a>.</p>
<p>In studying the more than 11,000 Internet addresses assigned to those two companies, Guilmette found that approximately 66 percent of them were doled out to the Belize entity by <a href="https://en.wikipedia.org/wiki/LACNIC" target="_blank" rel="noopener">LACNIC</a>, the regional Internet registry for the Latin American and Caribbean regions.</p>
<p>Suspecting that DDoS-Guard incorporated in Belize on paper just to get huge swaths of IP addresses that are supposed to be given only to entities with a physical presence in the region, Guilmette filed a complaint with the Internet registry about his suspicions back in November.</p>
<p>Guilmette said LACNIC told him it would investigate, and that any adjudication on the matter could take up to three months. But earlier this week, LACNIC published a notice on its website that it intends to revoke 8,192 IPv4 addresses from DDoS-Guard &#8212; including the Internet address currently assigned to Parler[.]com.</p>
<div id="attachment_54092" style="width: 605px" class="wp-caption aligncenter"><a href="media/41108508.lacnic-revocation.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/01/lacnic-revocation.png"><img aria-describedby="caption-attachment-54092" loading="lazy" class="wp-image-54092" src="media/41108508.lacnic-revocation.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/01/lacnic-revocation.png" alt="" width="595" height="389" srcset="https://krebsonsecurity.com/wp-content/uploads/2021/01/lacnic-revocation.png 785w, https://krebsonsecurity.com/wp-content/uploads/2021/01/lacnic-revocation-768x502.png 768w" sizes="(max-width: 595px) 100vw, 595px" /></a><p id="caption-attachment-54092" class="wp-caption-text">A notice of revocation posted by LACNIC.</p></div>
<p>LACNIC has not yet responded to requests for comment. The notice on its site says the Internet addresses are set to be revoked on Feb. 24.</p>
<p>DDoS-Guard CEO <strong>Evgeniy Marchenko</strong> maintains the company has done nothing wrong, and that DDoS-Guard does indeed have a presence in Belize.</p>
<p>&#8220;They were used strongly according [to] all LACNIC policies by [a] company legally substituted in LACNIC region,&#8221; Marchenko said in an email to KrebsOnSecurity. &#8220;There is nothing illegal or extremist. We have employers and representatives in different countries around the world because we are global service. And Latin America region is not an exception.&#8221;<span id="more-54087"></span></p>
<p>Guilmette said DDoS-Guard could respond by simply moving Parler and other sites sitting in those address ranges to another part of its network. But he considers it a victory nonetheless that a regional Internet registry took his concerns seriously.</p>
<p>&#8220;It appeared to me that it was more probable than not that they got these 8,000+ IPv4 addresses by simply creating an arguably fraudulent shell company in Belize and then going cap in hand to LACNIC, claiming that they had a real presence in the Latin &amp; South American region, and then asking for 8,000+ IPv4 addresses,&#8221; he said. &#8220;So I reported my suspicions to the LACNIC authorities in early November, and as I have only just recently learned, the LACNIC authorities followed up diligently on my report and, it seems, verified my suspicions.&#8221;</p>
<p>In October, KrebsOnSecurity covered another revelation by Guilmette about the same group of QAnon and 8chan-related sites that moved to DDoS-Guard: The companies that provided the Internet address space used by the sites <a href="https://krebsonsecurity.com/2020/10/the-now-defunct-firms-behind-8chan-qanon/" target="_blank" rel="noopener">were defunct businesses in the eyes of their respective U.S. state regulators</a>. In other words, the <strong>American Registry for Internet Numbers</strong> (ARIN) &#8212; the non-profit which administers IP addresses for entities based in North America &#8212; was well within its contract rights to revoke the IP space.</p>
<p>Guilmette brought his findings to ARIN, which declined to act on the complaint and instead referred the matter to state investigatory agencies.</p>
<p>Still, Guilmette&#8217;s gadfly efforts to stir things up in the RIR community sometimes do pay off. For example, he spent nearly three years documenting how <a href="https://krebsonsecurity.com/2019/12/the-great-50m-african-ip-address-heist/" target="_blank" rel="noopener">$50 million worth of the increasingly scarce IPv4 addresses were misappropriated from African companies to dodgy Internet marketing firms</a>.</p>
<p>His complaints about those findings to the <strong>African Network Information Centre</strong> (AFRINIC) resulted in an investigation that led to the termination of a top AFRINIC executive, who was found to have quietly sold many of the address blocks for personal gain to marketers based in Europe, Asia and elsewhere.</p>
<p>And this week, AFRINIC took the unusual step of officially documenting the extent of the damage wrought by its former employee, and <a href="https://mailman.nanog.org/pipermail/nanog/2021-January/211619.html" target="_blank" rel="noopener">revoking discrete chunks of address space</a> <a href="https://pastebin.com/raw/BUvY003C" target="_blank" rel="noopener">currently being used by marketing firms</a>.</p>
<p>In a<a href="media/b4417d25.afrinic-whois-audit-report-full-20210121.pdf" data-original-source="https://afrinic.net/ast/pdf/afrinic-whois-audit-report-full-20210121.pdf" target="_blank" rel="noopener"> detailed report released today</a> (PDF), AFRNIC said its investigation revealed more than 2.3 million IPv4 addresses were &#8220;without any lawful authority, misappropriated from AFRINIC&#8217;s pool of resources and attributed to organizations without any justification.&#8221;</p>
<p>AFRINIC said it began its inquiry in earnest back in March 2019, when it received an application by the <strong>U.S. Federal Bureau of Investigation</strong> (FBI) about &#8220;certain suspicious activities regarding several IPv4 address blocks which it held.&#8221; So far, AFRNINIC said it has reclaimed roughly half of the wayward IP address blocks, with the remainder &#8220;yet to be reclaimed due to ongoing due diligence.&#8221;</p>


feed_id: https://krebsonsecurity.com/?p=54119
title: International Action Targets Emotet Crimeware
uri: International-Action-Targets-Emotet-Crimeware
url: https://krebsonsecurity.com/2021/01/international-action-targets-emotet-crimeware/
content:
<p>Authorities across Europe on Tuesday said they&#8217;d seized control over <strong>Emotet</strong>, a prolific malware strain and cybercrime-as-service operation. Investigators say the action could help quarantine more than a million <strong>Microsoft Windows</strong> systems currently compromised with malware tied to Emotet infections.</p>
<p><img loading="lazy" class="aligncenter  wp-image-54133" src="media/8b996e0b.emo-graphic.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/01/emo-graphic.png" alt="" width="592" height="403" /></p>
<p>First surfacing in 2014, Emotet began as a banking trojan, but over the years it has evolved into one of the more aggressive platforms for spreading malware that lays the groundwork for ransomware attacks.</p>
<p>In <a href="https://www.europol.europa.eu/newsroom/news/world%E2%80%99s-most-dangerous-malware-emotet-disrupted-through-global-action" target="_blank" rel="noopener">a statement</a> published Wednesday morning on an action dubbed &#8220;<strong>Operation Ladybird</strong>,&#8221; the European police agency <strong>Europol</strong> said the investigation involved authorities in the Netherlands, Germany, United States, the United Kingdom, France, Lithuania, Canada and Ukraine.</p>
<p>&#8220;The EMOTET infrastructure essentially acted as a primary door opener for computer systems on a global scale,&#8221; Europol said. &#8220;Once this unauthorised access was established, these were sold to other top-level criminal groups to deploy further illicit activities such data theft and extortion through ransomware.&#8221;</p>
<p>Experts say Emotet is a pay-per-install botnet that is used by several distinct cybercrime groups to deploy secondary malware &#8212; most notably <a href="https://krebsonsecurity.com/?s=ryuk&amp;x=0&amp;y=0" target="_blank" rel="noopener">the ransomware strain Ryuk</a> and <a href="https://krebsonsecurity.com/?s=trickbot&amp;x=0&amp;y=0" target="_blank" rel="noopener">Trickbot</a>, a powerful banking trojan. It propagates mainly via malicious links and attachments sent through compromised email accounts, blasting out tens of thousands of malware-laced missives daily.</p>
<p>Emotet relies on several hierarchical tiers of control servers that communicate with infected systems. Those controllers coordinate the dissemination of second-stage malware and the theft of passwords and other data, and their distributed nature is designed to make the crimeware infrastructure more difficult to dismantle or commandeer.</p>
<p>In <a href="https://www.politie.nl/nieuws/2021/januari/27/11-internationale-politieoperatie-ladybird-botnet-emotet-wereldwijd-ontmanteld.html" target="_blank" rel="noopener">a separate statement</a> on the malware takeover, the Dutch National police said two of the three primary servers were located in the Netherlands.</p>
<p>&#8220;A software update is placed on the Dutch central servers for all infected computer systems,&#8221; the Dutch authorities wrote. &#8220;All infected computer systems will automatically retrieve the update there, after which the Emotet infection will be quarantined. Simultaneous action in all the countries concerned was necessary to be able to effectively dismantle the network and thwart any reconstruction.&#8221;<span id="more-54119"></span></p>
<p>A <a href="https://www.bka.de/DE/Presse/Listenseite_Pressemitteilungen/2021/Presse2021/210127_pmEmotet.html" target="_blank" rel="noopener">statement</a> from the German Federal Criminal Police Office about their participation in Operation Ladybird said prosecutors seized 17 servers in Germany that acted as Emotet controllers.</p>
<p>&#8220;As part of this investigation, various servers were initially identified in Germany with which the malicious software is distributed and the victim systems are monitored and controlled using encrypted communication,&#8221; the German police said.</p>
<p>Sources close to the investigation told KrebsOnSecurity the law enforcement action included the arrest of several suspects in Europe thought to be connected to the crimeware gang, although that could not be confirmed. The core group of criminals behind Emotet are widely considered to be operating out of Russia.</p>
<p>A <a href="https://www.youtube.com/watch?v=_BLOmClsSpc&amp;feature=youtu.be" target="_blank" rel="noopener">video released to YouTube</a> by the National Police of Ukraine this morning shows authorities there raiding a residence, seizing cash and computer equipment, and what appear to be numerous large bars made of gold.</p>
<p><img loading="lazy" class="aligncenter  wp-image-54135" src="media/060b38ec.ukraine-emotet.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/01/ukraine-emotet.png" alt="" width="600" height="294" srcset="https://krebsonsecurity.com/wp-content/uploads/2021/01/ukraine-emotet.png 949w, https://krebsonsecurity.com/wp-content/uploads/2021/01/ukraine-emotet-768x377.png 768w" sizes="(max-width: 600px) 100vw, 600px" /></p>
<p>Police in the Netherlands seized huge volumes of data stolen by Emotet infections, including email addresses, usernames and passwords. <a href="https://www.politie.nl/themas/controleer-of-mijn-inloggegevens-zijn-gestolen.html" target="_blank" rel="noopener">A tool on the Dutch police website</a> lets users learn if their email address has been compromised by Emotet.</p>
<p>But because Emotet is typically used to install additional malware that gets its hooks deeply into infected systems, cleaning up after it is going to be far more complicated and may require a complete rebuild of compromised computers.</p>
<p>The <strong>U.S. Cybersecurity &amp; Infrastructure Security Agency</strong> has <a href="https://us-cert.cisa.gov/ncas/alerts/aa20-280a" target="_blank" rel="noopener">labeled Emotet</a> &#8220;one of the most prevalent ongoing threats&#8221; that is difficult to combat because of its &#8216;worm-like&#8217; features that enable network-wide infections.&#8221; Hence, a single Emotet infection can often lead to multiple systems on the same network getting compromised.</p>
<p>It is too soon to say how effective this operation has been in fully wresting control over Emotet, but a takedown of this size is a significant action.</p>
<p>In October, <strong>Microsoft</strong> <a href="https://krebsonsecurity.com/2020/10/microsoft-uses-copyright-law-to-disrupt-trickbot-botnet/" target="_blank" rel="noopener">used trademark law to disrupt the Trickbot botnet</a>. Around the same time, the <strong>U.S. Cyber Command</strong> <a href="https://krebsonsecurity.com/2020/10/report-u-s-cyber-command-behind-trickbot-tricks/" target="_blank" rel="noopener">also took aim at Trickbot</a>. However, neither of those actions completely dismantled the crimeware network, which remains in operation today.</p>
<p><strong>Roman Hüssy</strong>, a Swiss information technology expert who maintains <a href="https://feodotracker.abuse.ch/browse/" target="_blank" rel="noopener">Feodotracker</a> &#8212; a site that lists the location of major botnet controllers &#8212; told KrebsOnSecurity that prior to January 25, some 98 Emotet control servers were active. The site now lists just five Emotet controllers online, although it is unclear if any of those remaining servers have been commandeered as part of the quarantine effort.</p>


feed_id: https://krebsonsecurity.com/?p=54149
title: Arrest, Seizures Tied to Netwalker Ransomware
uri: Arrest-Seizures-Tied-to-Netwalker-Ransomware
url: https://krebsonsecurity.com/2021/01/arrest-seizures-tied-to-netwalker-ransomware/
content:
<p>U.S. and Bulgarian authorities this week seized the darkweb site used by the <strong>NetWalker</strong> ransomware cybercrime group to publish data stolen from its victims. In connection with the seizure, a Canadian national suspected of extorting more than $27 million through the spreading of NetWalker was charged in a Florida court.</p>
<div id="attachment_54151" style="width: 604px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-54151" loading="lazy" class=" wp-image-54151" src="media/7de76cdb.netwalker.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/01/netwalker.png" alt="" width="594" height="378" srcset="https://krebsonsecurity.com/wp-content/uploads/2021/01/netwalker.png 1321w, https://krebsonsecurity.com/wp-content/uploads/2021/01/netwalker-768x488.png 768w" sizes="(max-width: 594px) 100vw, 594px" /><p id="caption-attachment-54151" class="wp-caption-text">The victim shaming site maintained by the NetWalker ransomware group, after being seized by authorities this week.</p></div>
<p>NetWalker is a ransomware-as-a-service crimeware product in which affiliates rent access to the continuously updated malware code in exchange for a percentage of any funds extorted from victims. The crooks behind NetWalker used the now-seized website to publish personal and proprietary data stolen from their prey, as part of a public pressure campaign to convince victims to pay up.</p>
<p>NetWalker has been among the most rapacious ransomware strains, hitting at least 305 victims from 27 countries &#8212; the majority in the United States, according to Chainalysis, a company that tracks the flow virtual currency payments.</p>
<p>&#8220;Chainalysis has traced more than $46 million worth of funds in NetWalker ransoms since it first came on the scene in August 2019,&#8221; the company said in <a href="https://blog.chainalysis.com/reports/netwalker-ransomware-disruption-arrest" target="_blank" rel="noopener">a blog post</a> detailing its assistance with the investigation. &#8220;It picked up steam in mid-2020, growing the average ransom to $65,000 last year, up from $18,800 in 2019.&#8221;</p>
<div id="attachment_54152" style="width: 607px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-54152" loading="lazy" class=" wp-image-54152" src="media/8e5bf39f.nw-ca.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/01/nw-ca.png" alt="" width="597" height="359" /><p id="caption-attachment-54152" class="wp-caption-text">Image: Chainalysis</p></div>
<p>In <a href="https://www.justice.gov/opa/pr/department-justice-launches-global-action-against-netwalker-ransomware" target="_blank" rel="noopener">a statement</a> on the seizure, the Justice Department said the NetWalker ransomware has impacted numerous victims, including companies, municipalities, hospitals, law enforcement, emergency services, school districts, colleges, and universities. For example, the University of California, San Francisco <a href="https://www.ucsf.edu/news/2020/06/417911/update-it-security-incident-ucsf" target="_blank" rel="noopener">paid $1.4 million last summer</a> in exchange for a digital key needed to unlock files encrypted by the ransomware.</p>
<p>&#8220;Attacks have specifically targeted the healthcare sector during the COVID-19 pandemic, taking advantage of the global crisis to extort victims,&#8221; the DOJ said.</p>
<p>U.S. prosecutors say one of NetWalker&#8217;s top affiliates was <strong>Sebastien Vachon-Desjardins</strong>, of Gatineau, in Ottawa, Canada. An indictment unsealed today in Florida alleges Vachon-Desjardins obtained at least $27.6 million from the scheme.</p>
<p>The DOJ&#8217;s media advisory doesn&#8217;t mention the defendant&#8217;s age, but <a href="https://www.ledroit.com/archives/le-gardien-dune-piece-secrete-au-cachot-7d524338f3e3e1afafe0ffa30099572a" target="_blank" rel="noopener">a 2015 report</a> in the Gatineau local news website ledroit.com suggests this may not be his first offense. According to the story, a then-27-year-old Sebastien Vachon-Desjardins was sentenced to more than three years in prison for drug trafficking: He was reportedly found in possession of more than 50,000 methamphetamine tablets.<span id="more-54149"></span></p>
<p>The NetWalker action came on the same day that European authorities announced a coordinated takedown targeting the Emotet crimeware-as-a-service network. Emotet is a pay-per-install botnet that is used by several distinct cybercrime groups to deploy secondary malware — most notably <a href="https://krebsonsecurity.com/?s=ryuk&amp;x=0&amp;y=0" target="_blank" rel="noopener">the ransomware strain Ryuk</a> and <a href="https://krebsonsecurity.com/?s=trickbot&amp;x=0&amp;y=0" target="_blank" rel="noopener">Trickbot</a>, a powerful banking trojan.</p>
<p>The NetWalker ransomware affiliate program kicked off in March 2020, when the administrator of the crimeware project began recruiting people on the dark web. Like many other ransomware programs, NetWalker does not permit affiliates to infect systems physically located in Russia or in any other countries that are part of the <a href="https://en.wikipedia.org/wiki/Commonwealth_of_Independent_States" target="_blank" rel="noopener">Commonwealth of Independent States</a> (CIS) &#8212; which includes most of the nations in the former Soviet Union. This is a prohibition typically made by cybercrime operations that are coordinated out of Russia and/or other CIS nations because it helps minimize the chances that local authorities will investigate their crimes.</p>
<p>The following advertisement (translated into English by cybersecurity firm <a href="https://www.intel471.com" target="_blank" rel="noopener">Intel 471</a>) was posted by the NetWalker affiliate program manager last year to a top cybercrime forum. It illustrates the allure of the ransomware affiliate model, which handles everything from updating the malware to slip past the latest antivirus updates, to leasing space on the dark web where affiliates can interact with victims and negotiate payment. The affiliate, on the other hand, need only focus on finding new victims.</p>
<blockquote><p>We are recruiting affiliates for network processing and spamming.<br />
We are interested in people whose priority is quality and not quantity.<br />
We prefer candidates who can work with large networks and have their own access to them.<br />
We are going to recruit a limited number of affiliates and then close the openings until they are available again.</p>
<p>We offer you prompt and flexible ransomware, a user-friendly admin panel in Tor, an automated service.</p>
<p>Encryption of shared accesses: if several users are logged in to the target computer, the ransomware will infect their mapped drives, as well as network resources where those users are logged in — shared accesses/NAS etc.</p>
<p>Powershell build. Each build is unique, in that the malware is inside the script – it is not downloaded from the internet. This makes bypassing antivirus protection easier, including Windows Defender (cloud+).</p>
<p>A fully automated blog where the victim&#8217;s dumped data is directed. The data is published according to your settings. Instant and automated payouts: initially 20 percent, no less than 16 percent.</p>
<p>Accessibility of a crypting service to avoid AV detections.</p>
<p>The ransomware has been in use since September 2019 and proved to be reliable. The files encrypted with it cannot be decrypted.</p>
<p>Targeting Russia or the CIS is prohibited.</p>
<p>You&#8217;ll get all the information about the ransomware as well as terms and conditions after you place an application via PM.</p>
<p>Application form:<br />
1) The field you specialize in.<br />
2) Your experience. What other affiliate programs have you been in and what was your profit?<br />
3) How many accesses [to networks] do you have? When are you ready to start? How many accesses do you plan on monetizing?</p></blockquote>


feed_id: https://krebsonsecurity.com/?p=53733
title: The Taxman Cometh for ID Theft Victims
uri: The-Taxman-Cometh-for-ID-Theft-Victims
url: https://krebsonsecurity.com/2021/01/the-taxman-cometh-for-id-theft-victims/
content:
<p>The unprecedented volume of <a href="https://krebsonsecurity.com/?s=unemployment+insurance&amp;x=0&amp;y=0" target="_blank" rel="noopener">unemployment insurance fraud witnessed in 2020</a> hasn&#8217;t abated, although news coverage of the issue has largely been pushed off the front pages by other events. But the ID theft problem is coming to the fore once again: Countless Americans will soon be receiving notices from state regulators saying they owe thousands of dollars in taxes on benefits they never received last year.</p>
<p><img loading="lazy" class="alignright wp-image-25751" src="media/018adfd9.taxfraud.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2014/04/taxfraud.jpg" alt="" width="252" height="252" srcset="https://krebsonsecurity.com/wp-content/uploads/2014/04/taxfraud.jpg 693w, https://krebsonsecurity.com/wp-content/uploads/2014/04/taxfraud-150x150.jpg 150w, https://krebsonsecurity.com/wp-content/uploads/2014/04/taxfraud-285x285.jpg 285w, https://krebsonsecurity.com/wp-content/uploads/2014/04/taxfraud-600x600.jpg 600w" sizes="(max-width: 252px) 100vw, 252px" />One state&#8217;s experience offers a window into the potential scope of the problem. Hackers, identity thieves and overseas criminal rings stole over $11 billion in unemployment benefits from California last year, or roughly 10 percent of all such claims the state paid out in 2020, the state&#8217;s labor secretary <a href="https://apnews.com/article/california-bdb79d54d86c3758650fa4f7163cebb2" target="_blank" rel="noopener">told reporters this week</a>. Another 17 percent of claims &#8212; nearly $20 billion more &#8211; are suspected fraud.</p>
<p>California&#8217;s experience is tracked at a somewhat smaller scale in dozens of other states, where chronically underfunded and technologically outdated unemployment insurance systems were caught flat-footed by an avalanche of fraudulent claims. The scammers typically use stolen identity data to claim benefits, and then have the funds credited to an online account that they control.</p>
<p>States are required to send out 1099-G forms reporting taxable income by Jan. 31, and under federal law unemployment benefits are considered taxable income. Unfortunately, many states have not reconciled their forms with confirmed incidences of fraudulent unemployment insurance claims, meaning many people are being told they owe a great deal more in taxes than they actually do.</p>
<p>In <a href="https://www.irs.gov/newsroom/irs-offers-guidance-to-taxpayers-on-identity-theft-involving-unemployment-benefits" target="_blank" rel="noopener">a notice posted Jan. 28</a>, the <strong>U.S. Internal Revenue Service</strong> urged taxpayers who receive forms 1099-G for unemployment benefits they didn&#8217;t actually get because of ID theft to contact their appropriate state agency and request a corrected form.</p>
<p>But the IRS&#8217;s advice ignores two rather inconvenient realities. The first is that the same 1099-G forms which states are sending to their citizens also are reported to the IRS &#8212; typically at the same time the notices are mailed to residents. The other is that many state agencies are completely overwhelmed right now.</p>
<p><strong>Karl Fava</strong>, a certified public accountant in Michigan, told KrebsOnSecurity two of his clients have received 1099-G forms from Michigan regarding thousands of dollars in unemployment payments that they had neither requested nor received.</p>
<p>Fava said Michigan recently stood up a website where victims of unemployment insurance fraud who&#8217;ve received incorrect 1099-Gs can report it, but said he&#8217;s not confident the state will issue corrected notices before the April 15 tax filing deadline.</p>
<p>&#8220;In both cases, the recipients contacted the state but couldn&#8217;t get any help,&#8221; Fava said. &#8220;We&#8217;re not getting a lot of traction in resolving this issue. But the fact that they&#8217;ve now created a web page where people can input information about receiving these tells you they have to know how prevalent this is.&#8221;</p>
<p>Fava said for now he&#8217;s advising his clients who are dealing with this problem to acknowledge the amount of fraudulent income on their federal tax returns, but also to subtract an equal amount on the return and note that the income reported by the state was due to fraud.</p>
<p>&#8220;That way, things can be consistent with what the IRS already knows,&#8221; Fava said. &#8220;Not to acknowledge an issue like this on a federal return is just asking for a notice from the IRS.&#8221;</p>
<p><strong>The Taxpayer Advocate Service</strong>, an <a href="https://www.irs.gov/taxpayer-advocate" target="_blank" rel="noopener">independent office</a> of the U.S. Internal Revenue Service (IRS) that champions taxpayer advocacy issues, said it recently became aware that some taxpayers are receiving 1099-Gs that include reported income due to unemployment insurance identity theft. The office said it is hearing about a lot of such issues in Ohio particularly, but that the problem is happening nationally.<span id="more-53733"></span></p>
<p>Another perennial (albeit not directly related) identity theft scourge involving taxes each year is <a href="https://krebsonsecurity.com/?s=tax+refund+fraud&amp;x=0&amp;y=0" target="_blank" rel="noopener">refund fraud</a>. Tax refund fraud involves the use of identity information and often stolen or misdirected W-2 forms to electronically file an unauthorized tax return for the purposes of claiming a refund in the name of a taxpayer.</p>
<p>Victims usually first learn of the crime after having their returns rejected because scammers beat them to it. <em>Even those who are not required to file a return can be victims of refund fraud, as can those who are not actually due a refund from the IRS.  </em></p>
<p>The best way to avoid tax refund fraud is to file your taxes as early possible. This year, that date is Feb. 12. One way the IRS has sought to stem the flow of bogus tax refund applications is to issue the IP PIN, which is a six-digit number assigned to taxpayers that helps prevent the use of their Social Security number on a fraudulent income tax return. Each PIN is good only for the tax year for which it was issued.</p>
<p>Until recently the IRS restricted who could apply for an IP PIN, but the program has <a href="https://krebsonsecurity.com/2020/12/irs-to-make-id-protection-pin-open-to-all/" target="_blank" rel="noopener">since been opened to all taxpayers</a>. To create one, if you haven&#8217;t already done so you will need to <a href="https://krebsonsecurity.com/2020/08/why-where-you-should-you-plant-your-flag/" target="_blank" rel="noopener noreferrer">plant your flag</a> at the IRS by stepping through the agency’s “secure access authentication” process.</p>
<p><a href="https://sa.www4.irs.gov/ola/" target="_blank" rel="noopener noreferrer">Creating an account</a> requires supplying a great deal of personal data; the information that will be requested is <a href="https://www.irs.gov/individuals/secure-access-how-to-register-for-certain-online-self-help-tools" target="_blank" rel="noopener noreferrer">listed here</a>.</p>
<p>The signup process requires one to validate ownership of a mobile phone number in one’s name, and it will reject any voice-over-IP-based numbers such as those tied to Skype or Google Voice. If the process fails at this point, the site should offer to send an activation code via postal mail to your address on file.</p>
<p>Once you have an account at the IRS and are logged in, you can request an IP PIN by visiting <a href="https://sa.www4.irs.gov/icce-core/loac/ippin/pages/ippin.xhtml" target="_blank" rel="noopener">this link</a> and following the prompts. The site will then display a six digit PIN that needs to be included on your federal return before it can be accepted. Be sure to print out a copy and save it in a secure place.</p>


feed_id: https://krebsonsecurity.com/?p=51747
title: U.K. Arrest in ‘SMS Bandits’ Phishing Service
uri: U-K-Arrest-in-SMS-Bandits-Phishing-Service
url: https://krebsonsecurity.com/2021/02/u-k-arrest-in-sms-bandits-phishing-service/
content:
<p>Authorities in the United Kingdom have arrested a 20-year-old man for allegedly operating an online service for sending high-volume phishing campaigns via mobile text messages. The service, marketed in the underground under the name &#8220;<strong>SMS Bandits</strong>,&#8221; has been responsible for blasting out huge volumes of phishing lures spoofing everything from COVID-19 pandemic relief efforts to PayPal, telecommunications providers and tax revenue agencies.</p>
<p><a href="media/029159e6.smsbanditshome.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/01/smsbanditshome.png"><img loading="lazy" class="aligncenter wp-image-54192" src="media/029159e6.smsbanditshome.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/01/smsbanditshome.png" alt="" width="596" height="376" srcset="https://krebsonsecurity.com/wp-content/uploads/2021/01/smsbanditshome.png 1001w, https://krebsonsecurity.com/wp-content/uploads/2021/01/smsbanditshome-768x483.png 768w" sizes="(max-width: 596px) 100vw, 596px" /></a></p>
<p>The U.K.&#8217;s <strong>National Crime Agency</strong> (NCA) declined to name the suspect, but confirmed that the Metropolitan Police Service&#8217;s cyber crime unit had detained an individual from Birmingham in connection to a business that supplied &#8220;criminal services related to phishing offenses.&#8221;</p>
<p>The proprietors of the phishing service were variously known on cybercrime forums under handles such as SMSBandits, &#8220;<strong>Gmuni</strong>,&#8221; &#8220;<strong>Bamit9</strong>,&#8221; and &#8220;<strong>Uncle Munis</strong>.&#8221; SMS Bandits offered an SMS phishing (a.k.a. &#8220;smishing&#8221;) service for the mass sending of text messages designed to phish account credentials for different popular websites and steal personal and financial data for resale.</p>
<div id="attachment_54197" style="width: 607px" class="wp-caption aligncenter"><a href="media/2d03f1c0.smslive.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/01/smslive.png"><img aria-describedby="caption-attachment-54197" loading="lazy" class="wp-image-54197" src="media/2d03f1c0.smslive.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/01/smslive.png" alt="" width="597" height="180" srcset="https://krebsonsecurity.com/wp-content/uploads/2021/01/smslive.png 1128w, https://krebsonsecurity.com/wp-content/uploads/2021/01/smslive-768x231.png 768w" sizes="(max-width: 597px) 100vw, 597px" /></a><p id="caption-attachment-54197" class="wp-caption-text">Image: osint.fans</p></div>
<p><strong>Sasha Angus</strong> is a partner at <a href="https://www.scyllaintel.com/" target="_blank" rel="noopener noreferrer">Scylla Intel</a>, a cyber intelligence startup that did a great deal of research into the SMS Bandits leading up to the arrest. Angus said the phishing lures sent by the SMS Bandits were unusually well-done and free of grammar and spelling mistakes that often make it easy to spot a phony message.</p>
<p>&#8220;Just by virtue of these guys being native English speakers, the quality of their phishing kits and lures were considerably better than most,&#8221; Angus said.</p>
<p>According to Scylla, the SMS Bandits made a number of operational security (or &#8220;opsec&#8221;) mistakes that made it relatively easy to find out who they were in real life, but the technical side SMS Bandits&#8217; operation was rather advanced.</p>
<p>&#8220;They were launching fairly high-volume smishing campaigns from SMS gateways, but overall their opsec was fairly lousy,&#8221; Angus said. &#8220;But on the telecom front they were using fairly sophisticated tactics.&#8221;</p>
<div id="attachment_54193" style="width: 599px" class="wp-caption aligncenter"><a href="media/3b571a13.sms-freelancer.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/01/sms-freelancer.png"><img aria-describedby="caption-attachment-54193" loading="lazy" class="wp-image-54193" src="media/3b571a13.sms-freelancer.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/01/sms-freelancer.png" alt="" width="589" height="416" srcset="https://krebsonsecurity.com/wp-content/uploads/2021/01/sms-freelancer.png 988w, https://krebsonsecurity.com/wp-content/uploads/2021/01/sms-freelancer-768x542.png 768w" sizes="(max-width: 589px) 100vw, 589px" /></a><p id="caption-attachment-54193" class="wp-caption-text">The proprietor of the SMS Bandits, telling the world he lives in Birmingham.</p></div>
<p>For example, the SMS Bandits automated systems to check whether the phone number list provided by their customers was indeed tied to actual mobile numbers, and not landlines that might tip off telecommunications companies about mass spam campaigns.</p>
<p>&#8220;The telcos are monitoring for malicious SMS messages on a number of fronts,&#8221; Angus said. &#8220;One way to tip off an SMS gateway or wireless provider is to start blasting text messages to phone numbers that can&#8217;t receive them.&#8221;<span id="more-51747"></span></p>
<p>Scylla gathered reams of evidence showing the SMS Bandits used email addresses and passwords stolen through its services to validate a variety of account credentials &#8212; from PayPal to bank accounts and utilities providers. They would then offload the working credentials onto marketplaces they controlled, and to third-party vendors. One of SMS Bandits&#8217; key offerings: An &#8220;auto-shop&#8221; web panel for selling stolen account credentials.</p>
<p>SMS Bandits also provided their own &#8220;bulletproof hosting&#8221; service advertised as a platform that supported &#8220;freedom of speach&#8221; [sic] where customers could &#8220;host any content without restriction.&#8221; Invariably, that content constituted sites designed to phish credentials from users of various online services.</p>
<div id="attachment_54191" style="width: 610px" class="wp-caption aligncenter"><a href="media/11f547df.munihosting.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/01/munihosting.png"><img aria-describedby="caption-attachment-54191" loading="lazy" class="wp-image-54191" src="media/11f547df.munihosting.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/01/munihosting.png" alt="" width="600" height="358" srcset="https://krebsonsecurity.com/wp-content/uploads/2021/01/munihosting.png 1489w, https://krebsonsecurity.com/wp-content/uploads/2021/01/munihosting-768x458.png 768w" sizes="(max-width: 600px) 100vw, 600px" /></a><p id="caption-attachment-54191" class="wp-caption-text">The &#8220;bulletproof&#8221; offerings of Muni Hosting (pronounced &#8220;Money Hosting&#8221;).</p></div>
<p>The SMS Bandits phishing service is tied to another crime-friendly service called &#8220;<strong>OTP Agency</strong>,&#8221; a bulk SMS provider that appears catered to phishers: The service&#8217;s administrator stated on multiple forums that he worked directly with the SMS Bandits.</p>
<p>Otp[.]agency advertises a service designed to help intercept one-time passwords needed to log in to various websites. The customer enters the target&#8217;s phone number and name, and OTP Agency will initiate an automated phone call to the target that alerts them about unauthorized activity on their account.</p>
<p>The call prompts the target to enter a one-time password generated by their phone&#8217;s mobile app, and that code is then relayed back to the scammer&#8217;s user panel at the OTP Agency website.</p>
<p>&#8220;We call the holder with an automatic calling bot, with a very believable script, they enter the OTP on the phone, and you&#8217;ll see it in real time,&#8221; OTP Agency explained on their Telegram channel. The service, which costs anywhere from $40 to $125 per week, advertises unlimited international calling, as well as multiple call scripts and voice accents.</p>
<div id="attachment_54194" style="width: 472px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-54194" loading="lazy" class="size-full wp-image-54194" src="media/32078c95.otp-elite.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/01/otp-elite.png" alt="" width="462" height="494" /><p id="caption-attachment-54194" class="wp-caption-text">One of the pricing plans available to OTP Agency users.</p></div>
<p>The volume of SMS-based phishing skyrocketed in 2020 &#8212; by more than 328 percent &#8212; according to <a href="https://www.proofpoint.com/us/blog/threat-protection/mobile-phishing-increases-more-300-2020-chaos-continues" target="_blank" rel="noopener">a recent report</a> from <strong>Proofpoint</strong>, a security firm that processes more than 80 percent of North America&#8217;s mobile messages [Full disclosure: Proofpoint is currently an advertiser on this site].</p>


feed_id: https://krebsonsecurity.com/?p=54208
title: ‘ValidCC,’ a Major Payment Card Bazaar and Looter of E-Commerce Sites, Shuttered
uri: ValidCC-a-Major-Payment-Card-Bazaar-and-Looter-of-E-Commerce-Si
url:
https://krebsonsecurity.com/2021/02/validcc-a-major-payment-card-bazaar-and-looter-of-e-commerce-sites-shuttered/

content:
<p><strong>ValidCC</strong>, a dark web bazaar run by a cybercrime group that for more than six years hacked online merchants and sold stolen payment card data, abruptly closed up shop last week. The proprietors of the popular store said their servers were seized as part of a coordinated law enforcement operation designed to disconnect and confiscate its infrastructure.</p>
<div id="attachment_54231" style="width: 602px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-54231" loading="lazy" class=" wp-image-54231" src="media/e760d200.validcc17.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/02/validcc17.png" alt="" width="592" height="310" srcset="https://krebsonsecurity.com/wp-content/uploads/2021/02/validcc17.png 1087w, https://krebsonsecurity.com/wp-content/uploads/2021/02/validcc17-768x402.png 768w" sizes="(max-width: 592px) 100vw, 592px" /><p id="caption-attachment-54231" class="wp-caption-text">ValidCC, circa 2017.</p></div>
<p>There are dozens of online shops that sell so-called <a href="https://krebsonsecurity.com/2016/04/all-about-fraud-how-crooks-get-the-cvv/" target="_blank" rel="noopener">&#8220;card not present&#8221; (CNP) payment card data</a> stolen from e-commerce stores, but most source the data from other criminals. In contrast, researchers say ValidCC was actively involved in hacking and pillaging hundreds of online merchants &#8212; seeding the sites with <a href="https://krebsonsecurity.com/2018/11/whos-in-your-online-shopping-cart/" target="_blank" rel="noopener">hidden card-skimming code</a> that siphoned personal and financial information as customers went through the checkout process.</p>
<p>Russian cybersecurity firm <strong>Group-IB</strong> published <a href="https://www.group-ib.com/media/ultrarank/" target="_blank" rel="noopener">a report last year</a> detailing the activities of ValidCC, noting the gang behind the crime shop was responsible for plundering nearly 700 e-commerce sites. Group-IB dubbed the gang &#8220;<strong>UltraRank</strong>,&#8221; which it said had additionally compromised at least 13 third-party suppliers whose software components are used by countless online stores across Europe, Asia, North and Latin America.</p>
<p>Group-IB believes UltraRank is responsible for a slew of hacks that other security firms previously attributed to at least three distinct cybercrime groups.</p>
<p>&#8220;Over five years&#8230;.UltraRank changed its infrastructure and malicious code on numerous occasions, as a result of which cybersecurity experts would wrongly attribute its attacks to other threat actors,&#8221; Group-IB wrote. &#8220;UltraRank combined attacks on single targets with supply chain attacks.&#8221;</p>
<p>ValidCC&#8217;s front man on multiple forums &#8212; a cybercriminal who uses the hacker handle &#8220;<strong>SPR</strong>&#8221; &#8212; told customers on Jan. 28 that the shop would close for good following what appeared to be a law enforcement takedown of its operations. SPR claims his site lost access to a significant inventory &#8212; more than 600,000 unsold stolen payment card accounts.</p>
<p>&#8220;As a result, we lost the proxy and destination backup servers,&#8221; SPR explained. &#8220;Besides, now it&#8217;s impossible to open and decrypt the backend. The database is in the hands of the police, but it&#8217;s encrypted.&#8221;</p>
<p>ValidCC had thousands of users, some of whom held significant balances of bitcoin stored in the shop when it ceased operations. SPR claims the site took in approximately $100,000 worth of virtual currency deposits each day from customers.</p>
<p>Many of those customers took to the various crime forums where the shop has a presence to voice suspicions that the proprietors had simply decided to walk away with their money at a time when Bitcoin was near record-high price levels.</p>
<p>SPR countered that ValidCC couldn&#8217;t return balances because it no longer had access to its own ledgers.</p>
<p>&#8220;We don&#8217;t know anything!,&#8221; SPR pleaded. &#8220;We don&#8217;t know users&#8217; balances, or your account logins or passwords, or the [credit cards] you purchased, or anything else! You are free to think what you want, but our team has never conned or let anyone down since the beginning of our operations! Nobody would abandon a dairy cow and let it die in the field! We did not take this decision lightly!&#8221;<span id="more-54208"></span></p>
<p>Group-IB said ValidCC was one of many cybercrime shops that stored some or all of its operational components at <strong>Media Land LLC</strong>, <a href="https://krebsonsecurity.com/2019/07/meet-the-worlds-biggest-bulletproof-hoster/" target="_blank" rel="noopener">a major &#8220;bulletproof hosting&#8221; provider that supports a vast array of phishing sites, cybercrime forums and malware download servers</a>.</p>
<p>Assuming SPR&#8217;s claims are truthful, it could be that law enforcement agencies targeted portions of Media Land&#8217;s digital infrastructure in some sort of coordinated action. However, so far there are no signs of any major uproar in the cybercrime underground directed at <strong>Yalishanda</strong>, the nickname used by the longtime proprietor of Media Land.</p>
<p>ValidCC&#8217;s demise comes close on the heels of <a href="https://krebsonsecurity.com/2021/01/jokers-stash-carding-market-to-call-it-quits/" target="_blank" rel="noopener">the shuttering of Joker&#8217;s Stash</a>, by some accounts the largest underground shop for selling stolen credit card and identity data. On Dec. 16, 2020, several of Joker’s long-held domains began displaying notices that the sites had been seized by the <strong>U.S. Department of Justice</strong> and <strong>Interpol</strong>. Less than a month later, <a href="https://krebsonsecurity.com/2021/01/jokers-stash-carding-market-to-call-it-quits/" target="_blank" rel="noopener">Joker announced he was closing the shop permanently</a>.</p>
<p>And last week, <a href="https://krebsonsecurity.com/2021/01/international-action-targets-emotet-crimeware/" target="_blank" rel="noopener">authorities across Europe seized control over dozens of servers used to operate<strong> Emotet</strong></a>, a prolific malware strain and cybercrime-as-service operation. While there are no indications that action targeted any criminal groups apart from the Emotet gang, it is often the case that multiple cybercrime groups will share the same dodgy digital infrastructure providers, knowingly or unwittingly.</p>
<p><a href="https://www.geminiadvisory.io" target="_blank" rel="noopener">Gemini Advisory</a>, a New York-based firm that closely monitors cybercriminal stores, said ValidCC&#8217;s administrators recently began recruiting stolen card data resellers who previously had sold their wares to Joker&#8217;s Stash.</p>
<p><strong>Stas Alforov</strong>, Gemini&#8217;s director of research and development, said other card shops will quickly move in to capture the customers and suppliers who frequented ValidCC.</p>
<p>&#8220;There are still a bunch of other shops out there,&#8221; Alforov said. &#8220;There&#8217;s enough tier one shops out there that sell card-not-present data that haven&#8217;t dropped a beat and have even picked up volumes.&#8221;</p>


feed_id: https://krebsonsecurity.com/?p=54249
title: Facebook, Instagram, TikTok and Twitter Target Resellers of Hacked Accounts
uri: Facebook-Instagram-TikTok-and-Twitter-Target-Resellers-of-Hacked-Acc
url:
https://krebsonsecurity.com/2021/02/facebook-instagram-tiktok-and-twitter-target-resellers-of-hacked-accounts/

content:
<p><strong>Facebook, Instagram</strong>, <strong>TikTok</strong>, and <strong>Twitter</strong> this week all took steps to crack down on users involved in trafficking hijacked user accounts across their platforms. The coordinated action seized hundreds of accounts the companies say have played a major role in facilitating the trade and often lucrative resale of compromised, highly sought-after usernames.</p>
<p><img loading="lazy" class="alignright size-full wp-image-37128" src="media/d6565fd1.athook.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2016/12/athook.png" alt="" width="194" height="375" />At the center of the account ban wave are some of the most active members of <strong>OGUsers</strong>, a forum that caters to thousands of people <a href="https://krebsonsecurity.com/?s=ogusers&amp;x=0&amp;y=0" target="_blank" rel="noopener">selling access to hijacked social media and other online accounts</a>.</p>
<p>Particularly prized by this community are short usernames, which can often be resold for thousands of dollars to those looking to claim a choice vanity name.</p>
<p>Facebook told KrebsOnSecurity it seized hundreds of accounts &#8212; mainly on Instagram &#8212; that have been stolen from legitimate users through a variety of intimidation and harassment tactics, including hacking, coercion, extortion, <a href="https://krebsonsecurity.com/?s=sextortion&amp;x=0&amp;y=0" target="_blank" rel="noopener">sextortion</a>, <a href="https://krebsonsecurity.com/?s=sim+swapping&amp;x=0&amp;y=0" target="_blank" rel="noopener">SIM swapping</a>, and <a href="https://krebsonsecurity.com/?s=swatting&amp;x=0&amp;y=0" target="_blank" rel="noopener">swatting</a>.</p>
<h4>THE MIDDLEMEN</h4>
<p>Facebook said it targeted a number of accounts tied to key sellers on OGUsers, as well as those who advertise the ability to broker stolen account sales.</p>
<p>Like most cybercrime forums, OGUsers is overrun with shady characters who are there mainly to rip off other members. As a result, some of the most popular denizens of the community are those who&#8217;ve earned a reputation as trusted &#8220;middlemen.&#8221;</p>
<p>These core members offer escrow services that &#8211; in exchange for a cut of the total transaction cost (usually five percent) &#8212; will hold the buyer&#8217;s funds until he is satisfied that the seller has delivered the credentials and any email account access needed to control the hijacked social media account.</p>
<p>For example, one of the most active accounts targeted in this week&#8217;s social network crackdown is <a href="media/644966ce.ig-trusted.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/02/ig-trusted.png" target="_blank" rel="noopener">the Instagram profile</a> &#8220;<strong>Trusted</strong>,&#8221; self-described as &#8220;top-tier professional middleman/escrow since 2014.&#8221;</p>
<p>Trusted&#8217;s profile included several screenshots of his OGUsers persona, &#8220;Beam,&#8221; who <a href="media/4314b7c2.beam-normies.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/02/beam-normies.png" target="_blank" rel="noopener">warns members</a> about an uptick in the number of new OGUsers profiles impersonating him and other middlemen on the forum. Beam currently has more reputation points or &#8220;vouches&#8221; than almost anyone on the forum, save for perhaps the current and former site administrators.</p>
<div id="attachment_54260" style="width: 608px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-54260" loading="lazy" class=" wp-image-54260" src="media/644966ce.ig-trusted.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/02/ig-trusted.png" alt="" width="598" height="492" srcset="https://krebsonsecurity.com/wp-content/uploads/2021/02/ig-trusted.png 1002w, https://krebsonsecurity.com/wp-content/uploads/2021/02/ig-trusted-768x632.png 768w" sizes="(max-width: 598px) 100vw, 598px" /><p id="caption-attachment-54260" class="wp-caption-text">The now-banned Instagram account for the middleman @trusted/beam.</p></div>
<p>Helpfully, OGUsers <a href="https://krebsonsecurity.com/2020/12/account-hijacking-site-ogusers-hacked-again/" target="_blank" rel="noopener">has been hacked multiple times over the years</a>, and its database of user details and private messages posted on competing crime forums. Those databases show Beam was just the 12th user account created on OGUsers back in 2014.</p>
<p>In his posts, Beam says he has brokered well north of 10,000 transactions. Indeed, the leaked OGUsers databases &#8212; which include private messages on the forum prior to June 2020 &#8212; offer a small window into the overall value of the hijacked social media account industry.</p>
<p>In each of Beam&#8217;s direct messages to other members who hired him as a middleman he would include the address of the bitcoin wallet to which the buyer was to send the funds. <a href="https://www.blockchain.com/btc/address/1DravToLrBUyEdb8XyPtZJr83S6DHedRM6" target="_blank" rel="noopener">Just two</a> <a href="https://www.blockchain.com/btc/address/1BeHkKCzUz1jrVFpy5REAxRsyXSMDsoe35" target="_blank" rel="noopener">of the bitcoin wallets</a> Beam used for middlemanning over the past of couple of years recorded in excess of 6,700 transactions totaling more than 243 bitcoins &#8212; or <em>roughly $8.5 million by today&#8217;s valuation</em> (~$35,000 per coin)<em>. </em>Beam would have earned roughly $425,000 in commissions on those sales.</p>
<p>Beam, a Canadian whose real name is <strong>Noah Hawkins</strong>, declined to be interviewed when contacted earlier this week. But his &#8220;Trusted&#8221; account on Instagram was taken down by Facebook today, as were &#8220;<a href="media/3e1bc125.ig-rl.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/02/ig-rl.png" target="_blank" rel="noopener">@Killer</a>,&#8221; &#8212; a personal Instagram account he used under the nickname &#8220;noah/beam.&#8221; Beam&#8217;s Twitter account &#8212; <a href="https://web.archive.org/web/20190116060539if_/http://twitter.com/nh" target="_blank" rel="noopener">@NH</a> &#8212; has been deactivated by Twitter; it was <a href="https://web.archive.org/web/20140328002545/twitter.com/nh" target="_blank" rel="noopener">hacked and stolen from its original owner back in 2014</a>.</p>
<p>Reached for comment, Twitter confirmed that it worked in tandem with Facebook to seize accounts tied to top members of OGUsers, citing its <a href="https://help.twitter.com/en/rules-and-policies/platform-manipulation" target="_blank" rel="noopener">platform manipulation and spam policy</a>. Twitter said its investigation into the people behind these accounts is ongoing.</p>
<p>TikTok confirmed it also took action to target accounts tied to top OGUusers members, although it declined to say how many accounts were reclaimed.</p>
<p>&#8220;As part of our ongoing work to find and stop inauthentic behavior, we recently reclaimed a number of TikTok usernames that were being used for account squatting,&#8221; TikTok said in a written statement. &#8220;We will continue to focus on staying ahead of the ever-evolving tactics of bad actors, including cooperating with third parties and others in the industry.&#8221;<span id="more-54249"></span></p>
<h4>&#8216;SOCIAL MEDIA SPECIALISTS&#8217;</h4>
<p>Other key middlemen who&#8217;ve brokered thousands more social media account transactions via OGUsers that were part of this week&#8217;s ban wave included <strong>Farzad </strong>(OGUser #81), who used the Instagram accounts <a href="media/82abc976.ig-middleman.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/02/ig-middleman.png" target="_blank" rel="noopener">@middleman</a> and <a href="media/66db4c82.frzd.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/02/frzd.png" target="_blank" rel="noopener">@frzd</a>; and <a href="media/3e1bc125.ig-rl.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/02/ig-rl.png" target="_blank" rel="noopener">@rl</a>, a.k.a. &#8220;<strong>Amp</strong>,&#8221; a major middleman and account seller on OGUusers.</p>
<p>Naturally, the top middlemen in the OGUsers community get much of their business from sellers of compromised social media and online gaming accounts, and these two groups tend to cross-promote one another. Among the top seller accounts targeted in the ban wave was the Instagram account belonging to <strong>Ryan Zanelli</strong> (<a href="media/e6471502.ig-zanelli.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/02/ig-zanelli.png" target="_blank" rel="noopener">@zanelli</a>), a 22-year-old self-described &#8220;<a href="https://www.linkedin.com/in/ryan-zanelli-8a05b5197/" target="_blank" rel="noopener">social media marketing specialist</a>&#8221; from Melbourne, Australia.</p>
<p><img loading="lazy" class="aligncenter wp-image-54263" src="media/e6471502.ig-zanelli.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/02/ig-zanelli.png" alt="" width="600" height="538" srcset="https://krebsonsecurity.com/wp-content/uploads/2021/02/ig-zanelli.png 949w, https://krebsonsecurity.com/wp-content/uploads/2021/02/ig-zanelli-768x689.png 768w" sizes="(max-width: 600px) 100vw, 600px" /></p>
<p>The leaked OGusers databases suggest Zanelli is better known to the OGusers community as &#8220;<strong>Verdict</strong>,&#8221; the fifth profile created on the forum and a longtime administrator of the site.</p>
<p>Reached via Telegram, Zanelli acknowledged he was an administrator of OGUsers, but denied being involved in anything illegal.</p>
<p>&#8220;I&#8217;m an early adaptor to the forum yes just like other countless members, and no social media property I sell is hacked or has been obtained through illegitimate means,&#8221; he said. &#8220;If you want the truth, I don&#8217;t even own any of the stock, I just resell off of people who do.&#8221;</p>
<p>This is not the first time Instagram has come for his accounts: As documented in <a href="https://www.theatlantic.com/technology/archive/2018/12/instagrams-christmas-crackdown-meme-accounts/579055/?utm_campaign=the-atlantic&amp;utm_content=edit-promo&amp;utm_medium=social&amp;utm_source=twitter&amp;utm_term=2018-12-27T12%3A17%3A34" target="_blank" rel="noopener">this story</a> in <em>The Atlantic</em>, some of his accounts totaling more than 1 million followers were axed in late 2018 when the platform took down 500 usernames that were stolen, resold, and used for posting memes.</p>
<p>“This is my full-time income, so it’s very detrimental to my livelihood,” Zanelli told The Atlantic, which identified him only by his first name. “I was trying to eat dinner and socialize with my family, but knowing behind the scenes everything I’ve built, my entire net worth, was just gone before my eyes.”</p>
<p>Another top seller account targeted in the ban wave was the Instagram account <a href="media/19995ff0.ig-h4ck.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/02/ig-h4ck.png" target="_blank" rel="noopener">@h4ck</a>, whose <a href="media/a7672aa3.t-h4ck2.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/02/t-h4ck2.png" target="_blank" rel="noopener">Telegram sales channel</a> also advertises various services to get certain accounts banned and unbanned from differed platforms, including Snapchat and Instagram.</p>
<div id="attachment_54271" style="width: 407px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-54271" loading="lazy" class="size-full wp-image-54271" src="media/a7672aa3.t-h4ck2.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/02/t-h4ck2.png" alt="" width="397" height="778" /><p id="caption-attachment-54271" class="wp-caption-text">Snippets from the Telegram sales channel for @h4ck, one of the Instagram handles seized by Facebook today.</p></div>
<p>Facebook said while this is hardly the first time it has reclaimed accounts associated with hijackers, it is the first time it has done so publicly. The company says it has no illusions that this latest enforcement action is going to put a stop to the rampant problem of account hijacking for resale, but views the effort as part of an ongoing strategy to drive up costs for account traffickers, and to educate potential account buyers about the damage inflicted on people whose accounts are hijacked.</p>
<p>In recognition of the scale of the problem, Instagram today rolled out a new feature called &#8220;Recently Deleted,&#8221; which seeks to help victims undo the damage wrought by an account takeover.</p>
<p>&#8220;We know hackers sometimes delete content when they gain access to an account, and until now people had no way of easily getting their photos and videos back,&#8221; Instagram explained <a href="https://about.instagram.com/blog/announcements/launch-of-ig-recently-deleted-media-folder" target="_blank" rel="noopener">in a blog post</a>. &#8220;Starting today, we will ask people to first verify that they are the rightful account holders when permanently deleting or restoring content from Recently Deleted.&#8221;</p>
<p>Facebook wasn&#8217;t exaggerating about the hijacking community&#8217;s use of extortion and other serious threats to gain control over highly prized usernames. I wish I could get back the many hours spent reading private messages from the OGUsers community, but it is certainly not uncommon for targets to be threatened with swatting attacks, or to have their deeply personal and/or financial information posted publicly online unless they relinquish control over a desired account.</p>
<h4>WHAT YOU CAN DO</h4>
<p>Any accounts that you value should be secured with a unique and strong password, as well the most robust form of multi-factor authentication available. Usually, this is a mobile app that generates a one-time code, but some sites like Twitter and Facebook now support even more robust options &#8212; such as <a href="https://krebsonsecurity.com/?s=security+keys&amp;x=0&amp;y=0" target="_blank" rel="noopener">physical security keys</a>.</p>
<p>Whenever possible, avoid opting to receive the second factor via text message or automated phone calls, as these methods are prone to compromise via <a href="https://krebsonsecurity.com/?s=sim+swapping&amp;x=0&amp;y=0" target="_blank" rel="noopener">SIM swapping</a> &#8212; a crime that is prevalent among people engaged in stealing social media accounts. SIM swapping involves convincing mobile phone company employees to transfer ownership of the target’s phone number to a device the attackers control.</p>
<p>These precautions are even more important <a href="https://krebsonsecurity.com/2013/06/the-value-of-a-hacked-email-account/" target="_blank" rel="noopener">for any email accounts you may have</a>. Sign up with any service online, and it will almost certainly require you to supply an email address. In nearly all cases, the person who is in control of that address can reset the password of any associated services or accounts –merely by requesting a password reset email. Unfortunately, many email providers still let users reset their account passwords by having a link sent via text to the phone number on file for the account.</p>
<p>Most online services require users to supply a mobile phone number when setting up the account, but do not require the number to remain associated with the account after it is established. I advise readers <a href="https://krebsonsecurity.com/2019/03/why-phone-numbers-stink-as-identity-proof/" target="_blank" rel="noopener">to remove their phone numbers from accounts wherever possible</a>, and to take advantage of a mobile app to generate any one-time codes for multifactor authentication.</p>


feed_id: https://krebsonsecurity.com/?p=54297
title: Arrest, Raids Tied to ‘U-Admin’ Phishing Kit
uri: Arrest-Raids-Tied-to-U-Admin-Phishing-Kit
url: https://krebsonsecurity.com/2021/02/arrest-raids-tied-to-u-admin-phishing-kit/
content:
<p>Cyber cops in Ukraine carried out an arrest and several raids last week in connection with the author of a <strong>U-Admin</strong>, a software package used to administer what&#8217;s being called &#8220;one of the world&#8217;s largest phishing services.&#8221; The operation was carried out in coordination with the FBI and authorities in Australia, which was particularly hard hit by phishing scams perpetrated by U-Admin customers.</p>
<div id="attachment_54305" style="width: 606px" class="wp-caption aligncenter"><a href="media/6e2b5c90.unknownadmin.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/02/unknownadmin.png"><img aria-describedby="caption-attachment-54305" loading="lazy" class="wp-image-54305" src="media/6e2b5c90.unknownadmin.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/02/unknownadmin.png" alt="" width="596" height="295" srcset="https://krebsonsecurity.com/wp-content/uploads/2021/02/unknownadmin.png 1026w, https://krebsonsecurity.com/wp-content/uploads/2021/02/unknownadmin-768x380.png 768w" sizes="(max-width: 596px) 100vw, 596px" /></a><p id="caption-attachment-54305" class="wp-caption-text">The U-Admin phishing panel interface. Image: fr3d.hk/blog</p></div>
<p>The Ukrainian attorney general&#8217;s office <a href="https://www.gp.gov.ua/ua/news?_m=publications&amp;_t=rec&amp;id=288438&amp;fp=10" target="_blank" rel="noopener">said</a> it worked with <a href="https://cyberpolice.gov.ua/news/kiberpolicziya-prypynyla-diyalnist-odnogo-z-najbilshyx-u-sviti-fishyngovyx-servisiv-dlya-atak-na-finansovi-ustanovy-riznyx-krayin-506/" target="_blank" rel="noopener">the nation&#8217;s police force</a> to identify a 39-year-old man from the Ternopil region who developed a phishing package and special administrative panel for the product.</p>
<p>&#8220;According to the analysis of foreign law enforcement agencies, more than 50% of all phishing attacks in 2019 in Australia were carried out thanks to the development of the Ternopil hacker,&#8221; the attorney general&#8217;s office said, noting that investigators had identified hundreds of U-Admin customers.</p>
<p><strong>Brad Marden</strong>, superintendent of cybercrime operations for the <strong>Australian Federal Police</strong> (AFP), said their investigation into who was behind U-Admin began in late 2018, after Australian citizens began getting deluged with phishing attacks via mobile text messages that leveraged the software.</p>
<p>&#8220;It was rampant,&#8221; Marden said, noting that the AFP identified the suspect and referred the case to the Ukrainians for prosecution. &#8220;At one stage in 2019 we had a couple of hundred SMS phishing campaigns tied to just this particular actor. Pretty much every Australian received a half dozen of these phishing attempts.&#8221;</p>
<p>U-Admin, a.k.a. &#8220;Universal Admin,&#8221; is crimeware platform that first surfaced in 2016. U-Admin was sold by an individual who used the hacker handle &#8220;<strong>Kaktys</strong>&#8221; on multiple cybercrime forums.</p>
<p>According to <a href="https://fr3d.hk/blog/u-admin-show-tell" target="_blank" rel="noopener">this comprehensive breakdown of the phishing toolkit</a>, the U-Admin control panel isn&#8217;t sold on its own, but rather it is included when customers contact the developer and purchase a set of phishing pages designed to mimic a specific brand &#8212; such as a bank website or social media platform.</p>
<p>Cybersecurity threat intelligence firm <a href="https://www.intel471.com" target="_blank" rel="noopener">Intel 471</a> describes U-Admin as an information stealing framework that uses several plug-ins in one location to help users pilfer victim credentials more efficiently. Those plug-ins include a phishing page generator, a victim tracker, and even a component to help manage money mules (for automatic transfers from victim accounts to people who were hired in advance to receive and launder stolen funds).</p>
<p>Perhaps the biggest selling point for U-Admin is a module that helps phishers intercept multi-factor authentication codes. This core functionality is what&#8217;s known as a &#8220;web inject,&#8221; because it allows phishers to dynamically interact with victims in real-time by injecting content into the phishing page that prompts the victim to enter additional information. The video below, produced by the U-Admin developer, shows a few examples (click to enlarge).<span id="more-54297"></span></p>
<div id="attachment_54306" style="width: 607px" class="wp-caption aligncenter"><a href="media/e047b37e.ezgif.com-gif-maker.gif" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/02/ezgif.com-gif-maker.gif"><img aria-describedby="caption-attachment-54306" loading="lazy" class="wp-image-54306" src="media/e047b37e.ezgif.com-gif-maker.gif" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/02/ezgif.com-gif-maker.gif" alt="" width="597" height="336" srcset="https://krebsonsecurity.com/wp-content/uploads/2021/02/ezgif.com-gif-maker.gif 800w, https://krebsonsecurity.com/wp-content/uploads/2021/02/ezgif.com-gif-maker-768x432.gif 768w" sizes="(max-width: 597px) 100vw, 597px" /></a><p id="caption-attachment-54306" class="wp-caption-text">A demonstration video showing the real-time web injection capabilities of the U-Admin phishing kit. Credit: blog.bushidotoken.net</p></div>
<p>There are multiple recent reports that U-Admin has been used in conjunction with malware &#8212; particularly <a href="https://unit42.paloaltonetworks.com/tutorial-qakbot-infection/" target="_blank" rel="noopener">Qakbot (a.k.a. Qbot)</a> &#8212; to harvest one-time codes needed for multi-factor authentication.</p>
<p>&#8220;Paired with [U-Admin&#8217;s 2FA harvesting functionality], a threat actor can remotely connect to the Qakbot-infected device, enter the stolen credentials plus the 2FA token, and begin initiating transactions,&#8221; explains <a href="https://blog.bushidotoken.net/2020/11/gathering-intelligence-on-qakbot.html" target="_blank" rel="noopener">this Nov. 2020 blog post</a> on an ongoing Qakbot campaign that was <a href="https://research.checkpoint.com/2020/exploring-qbots-latest-attack-methods/" target="_blank" rel="noopener">first documented three months earlier</a> by <strong>Check Point Research</strong>.</p>
<p>In the days following the Ukrainian law enforcement action, several U-Admin customers on the forums where Kaktys was most active began discussing whether the product was still safe to use following the administrator&#8217;s arrest.</p>
<p>The AFP&#8217;s Marden hinted that the suspicions raised by U-Admin&#8217;s customer base might be warranted.</p>
<p>&#8220;I wouldn&#8217;t be unhappy with the crooks continuing to use that piece of kit, without saying anything more on that front,&#8221; Marden said.</p>
<p>While Kaktys&#8217;s customers may be primarily concerned about the risks of using a product supported by a guy who just got busted, perhaps they should be more worried about other crooks [or perhaps the victim banks themselves] moving in on their turf: It appears the U-Admin package being sold in the underground has long included a weakness that could allow anyone to view or alter data that was phished with the help of this kit.</p>
<p>The security flaw was briefly alluded to in <a href="https://isc.sans.edu/forums/diary/A+Phishers+View+of+Phishing+UAdmin+27+Phishing+Control+Panel/23543/" target="_blank" rel="noopener">a 2018 writeup on U-Admin by the SANS Internet Storm Center</a>.</p>
<p>&#8220;Looking at the professionality of the code, the layout and the functionality I’m giving this control panel 3 out of 5 stars,&#8221; joked SANS guest author <strong>Remco Verhoef</strong>. &#8220;We wanted to give them 4 stars, but we gave one star less because of an <a href="https://www.admin-magazine.com/Articles/Uncovering-SQL-Injections" target="_blank" rel="noopener">SQL injection vulnerability</a>&#8221; [link added].</p>
<p>That vulnerability was documented in more detail at exploit archive <strong>Packet Storm Security</strong> in March 2020 and <a href="https://www.checkpoint.com/defense/advisories/public/2020/cpai-2020-0333.html/#protection" target="_blank" rel="noopener">indexed by Check Point Software</a> in May 2020, suggesting it still persists in current versions of the product.</p>
<p>The best advice to sidestep phishing scams is to avoid clicking on links that arrive unbidden in emails, text messages and other mediums. This advice is the same whether you&#8217;re using a mobile or desktop device. In fact, this phishing framework specialized in lures specifically designed to be loaded on mobile devices.</p>
<p>Most phishing scams invoke a temporal element that warns of dire consequences should you fail to respond or act quickly. If you’re unsure whether the message is legitimate, take a deep breath and visit the site or service in question manually — ideally, using a browser bookmark so as to avoid <a href="https://krebsonsecurity.com/?s=typosquatting&amp;x=0&amp;y=0" target="_blank" rel="noopener">potential typosquatting sites</a>.</p>
<p>Further reading:</p>
<p><a href="https://fr3d.hk/blog/u-admin-show-tell" target="_blank" rel="noopener">uAdmin Show &amp; Tell</a><br />
<a href="https://blog.bushidotoken.net/2020/11/gathering-intelligence-on-qakbot.html" target="_blank" rel="noopener">Gathering Intelligence on the Qakbot banking Trojan</a></p>


feed_id: https://krebsonsecurity.com/?p=54321
title: Microsoft Patch Tuesday, February 2021 Edition
uri: Microsoft-Patch-Tuesday-February-2021-Edition
url: https://krebsonsecurity.com/2021/02/microsoft-patch-tuesday-february-2021-edition/
content:
<p><strong>Microsoft</strong> today rolled out updates to plug at least 56 security holes in its <strong>Windows</strong> operating systems and other software. One of the bugs is already being actively exploited, and six of them were publicized prior to today, potentially giving attackers a head start in figuring out how to exploit the flaws.</p>
<p><img loading="lazy" class="aligncenter wp-image-52647" src="media/2471c2d6.windowsec.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/08/windowsec.png" alt="" width="596" height="438" /></p>
<p>Nine of the 56 vulnerabilities earned Microsoft&#8217;s most urgent &#8220;critical&#8221; rating, meaning malware or miscreants could use them to seize remote control over unpatched systems with little or no help from users.</p>
<p>The flaw being exploited in the wild already &#8212; <a href="https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-1732" target="_blank" rel="noopener">CVE-2021-1732</a> &#8212; affects Windows 10, Server 2016 and later editions. It received a slightly less dire &#8220;important&#8221; rating and mainly because it is a vulnerability that lets an attacker increase their authority and control on a device, which means the attacker needs to already have access to the target system.</p>
<p>Two of the other bugs that were disclosed prior to this week are critical and reside in <strong>Microsoft&#8217;s .NET Framework</strong>, a component required by many third-party applications (most Windows users will have some version of .NET installed).<span id="more-54321"></span></p>
<p>Windows 10 users should note that while the operating system installs all monthly patch roll-ups in one go, that rollup does not typically include .NET updates, which are installed on their own. So when you&#8217;ve backed up your system and installed this month&#8217;s patches, you may want to check Windows Update again to see if there are any .NET updates pending.</p>
<p>A key concern for enterprises is another critical bug in the DNS server on Windows Server 2008 through 2019 versions that could be used to remotely install software of the attacker&#8217;s choice. <a href="https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-24078" target="_blank" rel="noopener">CVE-2021-24078</a> earned <a href="https://nvd.nist.gov/vuln-metrics/cvss" target="_blank" rel="noopener">a CVSS Score</a> of 9.8, which is about as dangerous as they come.</p>
<p><strong>Recorded Future</strong> says this vulnerability can be exploited remotely by getting a vulnerable DNS server to query for a domain it has not seen before (e.g. by sending a phishing email with a link to a new domain or even with images embedded that call out to a new domain). <strong>Kevin Breen</strong> of <strong>Immersive Labs</strong> notes that CVE-2021-24078 could let an attacker steal loads of data by altering the destination for an organization&#8217;s web traffic &#8212; such as pointing internal appliances or Outlook email access at a malicious server.</p>
<p>Windows Server users also should be aware that Microsoft this month is enforcing the second round of security improvements as part of a two-phase update to address <a href="https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2020-1472" target="_blank" rel="noopener">CVE-2020-1472</a>, a severe vulnerability that <a href="https://krebsonsecurity.com/2020/09/microsoft-attackers-exploiting-zerologon-windows-flaw/" target="_blank" rel="noopener">first saw active exploitation back in September 2020</a>.</p>
<p>The vulnerability, dubbed &#8220;<strong>Zerologon</strong>,&#8221; is a bug in the core &#8220;<strong>Netlogon</strong>&#8221; component of Windows Server devices. The flaw lets an unauthenticated attacker gain administrative access to a Windows domain controller and run any application at will. A domain controller is a server that responds to security authentication requests in a Windows environment, and a compromised domain controller can give attackers the keys to the kingdom inside a corporate network.</p>
<p>Microsoft&#8217;s <a href="https://krebsonsecurity.com/2020/08/microsoft-patch-tuesday-august-2020-edition/" target="_blank" rel="noopener">initial patch for CVE-2020-1472</a> fixed the flaw on Windows Server systems, but did nothing to stop unsupported or third-party devices from talking to domain controllers using the insecure Netlogon communications method. Microsoft said it chose this two-step approach &#8220;to ensure vendors of non-compliant implementations can provide customers with updates.&#8221; With this month&#8217;s patches, Microsoft will begin rejecting insecure Netlogon attempts from non-Windows devices.</p>
<p>A couple of other, non-Windows security updates are worth mentioning. Adobe today <a href="https://blogs.adobe.com/psirt/?p=1965" target="_blank" rel="noopener">released updates to fix at least 50 security holes in a range of products</a>, including Photoshop and Reader. The Acrobat/Reader update tackles a critical zero-day flaw that <a href="https://helpx.adobe.com/security/products/acrobat/apsb21-09.html" target="_blank" rel="noopener">Adobe says</a> is actively being exploited in the wild against Windows users, so if you have Adobe Acrobat or Reader installed, please make sure these programs are kept up to date.</p>
<p>There is also a zero-day flaw in <strong>Google&#8217;s Chrome Web browser</strong> (CVE-2021-21148) that is seeing active attacks. Chrome downloads security updates automatically, but users still need to restart the browser for the updates to fully take effect. If you&#8217;re a Chrome user and notice a red &#8220;update&#8221; prompt to the right of the address bar, it&#8217;s time to save your work and restart the browser.</p>
<p>Standard reminder: While staying up-to-date on Windows patches is a must, it’s important to make sure you’re updating only after you’ve backed up your important data and files. A reliable backup means you’re less likely to pull your hair out when the odd buggy patch causes problems booting the system.</p>
<p>So do yourself a favor and backup your files before installing any patches. Windows 10 even has <a href="https://lifehacker.com/how-to-back-up-your-computer-automatically-with-windows-1762867473" target="_blank" rel="noopener noreferrer">some built-in tools</a> to help you do that, either on a per-file/folder basis or by making a complete and bootable copy of your hard drive all at once.</p>
<p>Keep in mind that Windows 10 by default will automatically download and install updates on its own schedule. If you wish to ensure Windows has been set to pause updating so you can back up your files and/or system before the operating system decides to reboot and install patches, <a href="https://www.computerworld.com/article/3543189/check-to-make-sure-you-have-windows-updates-paused.html" target="_blank" rel="noopener noreferrer">see this guide</a>.</p>
<p>And as always, if you experience glitches or problems installing any of these patches this month, please consider leaving a comment about it below; there’s a better-than-even chance other readers have experienced the same and may chime in here with some helpful tips.</p>


feed_id: https://krebsonsecurity.com/?p=54326
title: What’s most interesting about the Florida water system hack? That we heard about it at all.
uri: What-s-most-interesting-about-the-Florida-water-system-hack-That-we
url:
https://krebsonsecurity.com/2021/02/whats-most-interesting-about-the-florida-water-system-hack-that-we-heard-about-it-at-all/

content:
<p>Stories about computer security tend to go viral when they bridge the vast divide between geeks and luddites, and this week&#8217;s news about a hacker who tried to poison a Florida town&#8217;s water supply was understandably front-page material. But for security nerds who&#8217;ve been warning about this sort of thing for ages, the most surprising aspect of the incident seems to be that we learned about it at all.</p>
<p><img loading="lazy" class="aligncenter wp-image-54338" src="media/eb4dd2bc.drinkwatersupply.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/02/drinkwatersupply.jpg" alt="" width="588" height="441" /></p>
<p>Spend a few minutes searching Twitter, Reddit or any number of other social media sites and you&#8217;ll find countless examples of researchers posting proof of being able to access so-called &#8220;human-machine interfaces&#8221; &#8212; basically web pages designed to interact remotely with various complex systems, such as those that monitor and/or control things like power, water, sewage and manufacturing plants.</p>
<p>And yet, there have been precious few known incidents of malicious hackers abusing this access to disrupt these complex systems. That is, until this past Monday, when Florida county sheriff <strong>Bob Gualtieri</strong> held a remarkably clear-headed and fact-filled news conference about an attempt to poison the water supply of Oldsmar, a town of around 15,000 not far from Tampa.</p>
<p>Gualtieri told the media that someone (they don&#8217;t know who yet) remotely accessed a computer for the city&#8217;s water treatment system (using Teamviewer) and briefly increased the amount of sodium hydroxide (a.k.a. lye used to control acidity in the water)<em> to 100 times the normal level</em>.</p>
<p>&#8220;The city’s water supply was not affected,&#8221; <em>The Tampa Bay Times</em> <a href="https://www.tampabay.com/news/pinellas/2021/02/08/someone-tried-to-poison-oldsmars-water-supply-during-hack-sheriff-says/" target="_blank" rel="noopener">reported</a>. &#8220;A supervisor working remotely saw the concentration being changed on his computer screen and immediately reverted it, Gualtieri said. City officials on Monday emphasized that several other safeguards are in place to prevent contaminated water from entering the water supply and said they’ve disabled the remote-access system used in the attack.&#8221;</p>
<p>In short, a likely inexperienced intruder somehow learned the credentials needed to remotely access Oldsmar&#8217;s water system, did little to hide his activity, and then tried to change settings by such a wide margin that the alterations would be hard to overlook.</p>
<p>&#8220;The system wasn&#8217;t capable of doing what the attacker wanted,&#8221; said <strong>Joe Weiss</strong>, managing partner at <strong>Applied Control Solutions</strong>, a consultancy for the control systems industry. &#8220;The system isn&#8217;t capable of going up by a factor of 100 because there are certain physics problems involved there. Also, the changes he tried to make wouldn&#8217;t happen instantaneously. The operators would have had plenty of time to do something about it.&#8221;</p>
<p>Weiss was just one of a half-dozen experts steeped in the cybersecurity aspects of industrial control systems that KrebsOnSecurity spoke with this week. While all of those interviewed echoed Weiss&#8217;s conclusion, most also said they were concerned about the prospects of a more advanced adversary.</p>
<p>Here are some of the sobering takeaways from those interviews:</p>
<ul>
<li>There are approximately 54,000 distinct drinking water systems in the United States.</li>
<li>The vast majority of those systems serve fewer than 50,000 residents, with many serving just a few hundred or thousand.</li>
<li>Virtually all of them rely on some type of remote access to monitor and/or administer these facilities.</li>
<li>Many of these facilities are unattended, underfunded, and do not have someone watching the IT operations 24/7.</li>
<li>Many facilities have not separated operational technology (the bits that control the switches and levers) from safety systems that might detect and alert on intrusions or potentially dangerous changes.</li>
</ul>
<p>So, given how easy it is to search the web for and find ways to remotely interact with these HMI systems, why aren&#8217;t there more incidents like the one in Oldsmar making the news? One reason may be that these facilities don&#8217;t have to disclose such events when they do happen.<span id="more-54326"></span></p>
<h4>NO NEWS IS GOOD NEWS?</h4>
<p>The only federal law that applies to the cybersecurity of water treatment facilities in the United States is <a href="https://www.epa.gov/ground-water-and-drinking-water/americas-water-infrastructure-act-2018-awia" target="_blank" rel="noopener">America&#8217;s Water Infrastructure Act of 2018</a>, which requires water systems serving more than 3,300 people &#8220;to develop or update risk assessments and emergency response plans.&#8221;</p>
<p>There is nothing in the law that requires such facilities to report cybersecurity incidents, such as the one that happened in Oldsmar this past weekend.</p>
<p>&#8220;It&#8217;s a difficult thing to get organizations to report cybersecurity incidents,&#8221; said <strong>Michael Arceneaux</strong>, managing director of the <a href="https://www.waterisac.org/" target="_blank" rel="noopener">Water ISAC</a>, an industry group that tries to facilitate information sharing and the adoption of best practices among utilities in the water sector. The Water ISAC&#8217;s 450 members serve roughly 200 million Americans, but its membership comprises less than one percent of the overall water utility industry.</p>
<p>&#8220;Some utilities are afraid that if their vulnerabilities are shared the hackers will have some inside knowledge on how to hack them,&#8221; Arceneaux said. &#8220;Utilities are rather hesitant to put that information in a public domain or have it in a database that could become public.&#8221;</p>
<p>Weiss said the federal agencies are equally reluctant to discuss such incidents.</p>
<p>&#8220;The only reason we knew about this incident in Florida was that the sheriff decided to hold a news conference,&#8221; Weiss said. &#8220;The FBI, Department of Homeland Security, none of them want to talk about this stuff publicly. Information sharing is broken.&#8221;</p>
<p>By way of example, Weiss said that not long ago he was contacted by a federal public defender representing a client who&#8217;d been convicted of hacking into a drinking water system. The attorney declined to share his client&#8217;s name, or divulge many details about the case. But he wanted to know if Weiss would be willing to serve as an expert witness who could help make the actions of a client sound less scary to a judge at sentencing time.</p>
<p>&#8220;He was defending this person who&#8217;d hacked into a drinking water system and had gotten all the way to the pumps and control systems,&#8221; Weiss recalled. &#8220;He said his client had only been in the system for about an hour, and he wanted to know how much damage could his client really could have done in that short a time. He was trying to get a more lenient sentence for the guy.&#8221;</p>
<p>Weiss said he&#8217;s tried to get more information about the defendant, but suspects the details of the case have been sealed.</p>
<p><strong>Andrew Hildick-Smith</strong> is a consultant who served nearly 20 years managing remote access systems for the Massachusetts Water Resources Authority. Hildick-Smith said his experience working with numerous smaller water utilities has driven home the reality that most are severely under-staffed and underfunded.</p>
<p>&#8220;A decent portion of small water utilities depend on their community or town&#8217;s IT person to help them out with stuff,&#8221; he said. &#8220;When you&#8217;re running a water utility, there are so many things to take care of to keep it all running that there isn&#8217;t really enough time to improve what you have. That can spill over into the remote access side, and they may not have a IT person who can look at whether there&#8217;s a better way to do things, such as securing remote access and setting up things like two-factor authentication.&#8221;</p>
<p>Hildick-Smith said most of the cybersecurity incidents that he&#8217;s aware of involving water facilities fall into two categories. The most common are compromises where the systems affected were collateral damage from more opportunistic intrusions.</p>
<p>&#8220;There&#8217;ve been a bunch of times where water systems have had their control system breached, but it&#8217;s most often just sort of by chance, meaning whoever was doing it used the computer for setting up financial transactions, or it was a computer of convenience,&#8221; Hildick-Smith siad. &#8220;But attacks that involved the step of actually manipulating things is pretty short list.&#8221;</p>
<p>The other, increasingly common reason, he said, is of course ransomware attacks on the business side of water utilities.</p>
<p>&#8220;Separate from the sort of folks who wander into a SCADA system by mistake on the water side are a bunch of ransomware attacks against the business side of the water systems,&#8221; he said. &#8220;But even then you generally don&#8217;t get to hear the details of the attack.&#8221;</p>
<p>Hildick-Smith recalled a recent incident at a fairly large water utility that got hit with the Egregor ransomware strain.</p>
<p>&#8220;Things worked out internally for them, and they didn&#8217;t need to talk to the outside world or the press about it,&#8221; he said. &#8220;They made contact with the Water ISAC and the FBI, but it certainly didn&#8217;t become a press event, and any lessons they learned haven&#8217;t been able to be shared with folks.&#8221;</p>
<h4>AN INTERNATIONAL CHALLENGE</h4>
<p>The situation is no different in Europe and elsewhere, says <a href="https://twitter.com/dudekmar" target="_blank" rel="noopener">Marcin Dudek</a>, a control systems security research at <a href="https://www.cert.pl/en/about-us/" target="_blank" rel="noopener">CERT Polska</a>, the computer emergency response team which handles cyber incident reporting in Poland.</p>
<p>Marcin said if water facilities have not been a major target of profit-minded criminal hackers, it is probably because most of these organizations have very little worth stealing and usually no resources for paying extortionists.</p>
<p>&#8220;The access part is quite easy,&#8221; he said. &#8220;There&#8217;s no business case for hacking these types of systems. Quite rarely do they have a proper VPN [virtual private network] for secure remote connection. I think it&#8217;s because there is not enough awareness of the problems of cybersecurity, but also because they are not financed enough. This goes not only for the US. It&#8217;s very similar here in Poland and different countries as well.&#8221;</p>
<p>Many security professionals have sounded off on social media saying public utilities have no business relying on remote access tools like Teamviewer, which by default allows complete control over the host system and is guarded by a simple password.</p>
<p>But Marcin says Teamviewer would actually be an improvement over the types of remote access systems he commonly finds in his own research, which involves HMI systems designed to be used via a publicly-facing website.</p>
<p>&#8220;I&#8217;ve seen a lot of cases where the HMI was directly available from a web page, where you just log in and are then able to change some parameters,&#8221; Marcin said. &#8220;This is particularly bad because web pages can have vulnerabilities, and those vulnerabilities can give the attacker full access to the panel.&#8221;</p>
<p>According to Marcin, utilities typically have multiple safety systems, and in an ideal environment those are separated from control systems so that a compromise of one will not cascade into the other.</p>
<p>&#8220;In reality, it&#8217;s not that easy to introduce toxins into the water treatment so that people will get sick, it&#8217;s not as easy as some people say,&#8221; he said. Still, he worries about more advanced attackers, such as those responsible for <a href="https://www.zdnet.com/article/two-more-cyber-attacks-hit-israels-water-system/" target="_blank" rel="noopener">multiple incidents last year</a> in which attackers gained access to some of Israel&#8217;s water treatment systems and tried to alter water chlorine levels before being detected and stopped.</p>
<p>&#8220;Remote access is something we cannot avoid today,&#8221; Marcin said. &#8220;Most installations are unmanned. If it is a very small water or sewage treatment plant, there will be no people inside and they just login whenever they need to change something.&#8221;</p>
<h4>SELF EVALUTION TIME</h4>
<p>Many smaller water treatment systems may soon be reevaluating their approach to securing remote access. Or at least that&#8217;s the hope of the Water Infrastructure of 2018, which gives utilities serving fewer than 50,000 residents until the end of June 2021 to complete a cybersecurity risk and resiliency assessment.</p>
<p>&#8220;The vast majority of these utilities have yet to really even think about where they stand in terms of cybersecurity,&#8221; said Hildick-Smith.</p>
<p>The only problem with this process is there aren&#8217;t any consequences for utilities that fail to complete their assessments by that deadline.</p>
<p>Hildick-Smith said while water systems are required to periodically report data about water quality to the U.S. Environmental Protection Agency (EPA), the agency has no real authority to enforce the cybersecurity assessments.</p>
<p>&#8220;The EPA has made some kind of vague threats, but they have no enforcement ability here,&#8221; he said. &#8220;Most water systems are going to wait until close the deadline, and then hire someone to do it for them. Others will probably just self-certify, raise their hands and say, &#8216;Yeah, we&#8217;re good.'&#8221;</p>


feed_id: https://krebsonsecurity.com/?p=54083
title: Bluetooth Overlay Skimmer That Blocks Chip
uri: Bluetooth-Overlay-Skimmer-That-Blocks-Chip
url: https://krebsonsecurity.com/2021/02/bluetooth-overlay-skimmer-that-blocks-chip/
content:
<p>As a total sucker for anything skimming-related, I was interested to hear from a reader working security for a retail chain in the United States who recently found Bluetooth-enabled skimming devices placed over top of payment card terminals at several stores. Interestingly, these skimmers interfered with the terminal&#8217;s ability to read chip-based cards, forcing customers to swipe the stripe instead.</p>
<div id="attachment_54200" style="width: 610px" class="wp-caption aligncenter"><a href="media/5546bf3d.btoverlay.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/01/btoverlay.png"><img aria-describedby="caption-attachment-54200" loading="lazy" class="wp-image-54200" src="media/5546bf3d.btoverlay.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/01/btoverlay.png" alt="" width="600" height="546" srcset="https://krebsonsecurity.com/wp-content/uploads/2021/01/btoverlay.png 823w, https://krebsonsecurity.com/wp-content/uploads/2021/01/btoverlay-768x699.png 768w" sizes="(max-width: 600px) 100vw, 600px" /></a><p id="caption-attachment-54200" class="wp-caption-text">The payment card skimmer overlay transmitted stolen data via Bluetooth, physically blocked chip-based transactions, and included a PIN pad overlay.</p></div>
<p>Here&#8217;s a closer look at the electronic gear jammed into these overlay skimmers. It includes a hidden PIN pad overlay that captures, stores and transmits via Bluetooth data from cards swiped through the machine, as well as PINs entered on the device:</p>
<div id="attachment_54201" style="width: 609px" class="wp-caption aligncenter"><a href="media/439dc45b.reverse-bt-skim.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/01/reverse-bt-skim.png"><img aria-describedby="caption-attachment-54201" loading="lazy" class="wp-image-54201" src="media/439dc45b.reverse-bt-skim.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/01/reverse-bt-skim.png" alt="" width="599" height="646" /></a><p id="caption-attachment-54201" class="wp-caption-text">The hidden magnetic stripe reader is in the bottom left, just below the Bluetooth circuit board. A PIN pad overlay (center) intercepts any PINs entered by customers; the cell phone battery (right) powers all of the components.</p></div>
<p>My reader source shared these images on condition that the retailer in question not be named. But it&#8217;s worth pointing out these devices <a href="https://krebsonsecurity.com/2018/02/would-you-have-spotted-this-skimmer/" target="_blank" rel="noopener">can be installed on virtually any customer-facing payment terminal in the blink of eye</a>.<span id="more-54083"></span></p>
<p>Newer, chip-based payment cards are more costly and difficult for thieves to clone, but virtually all cards still store card data on a magnetic stripe on the back of the cards &#8212; mainly for reasons of backwards compatibility. This overlay skimmer included a physical component designed to block the payment terminal from reading the chip, forcing the customer to swipe the stripe instead of dip the chip.</p>
<div id="attachment_54220" style="width: 521px" class="wp-caption aligncenter"><a href="media/95321096.bt-skim-uc.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/02/bt-skim-uc.png"><img aria-describedby="caption-attachment-54220" loading="lazy" class="wp-image-54220 size-full" src="media/95321096.bt-skim-uc.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/02/bt-skim-uc.png" alt="" width="511" height="683" /></a><p id="caption-attachment-54220" class="wp-caption-text">The magnetic stripe reader (top right) worked with a component designed to block the use of chip-based payment cards.</p></div>
<p>What&#8217;s remarkable is that these badboys went undetected for several weeks, particularly given that customers would have been forced to swipe.</p>
<p>&#8220;In this COVID19 world, with counter and terminal wipedowns frequent it was surprising that nobody noticed the overlay placements for a number of weeks,&#8221; the source said.</p>
<p>I realize a great many people use debit cards for everyday purchases, but I’ve never been interested in assuming the added risk and pay for everything with cash or a credit card. Armed with your PIN and debit card data, thieves can clone the card and pull money out of your account at an ATM. Having your checking account emptied of cash while your bank sorts out the situation can be a huge hassle and create secondary problems (bounced checks, for instance).</p>
<p>Want to learn more about overlay skimmers? Check out these other posts:</p>
<p><a href="https://krebsonsecurity.com/2016/06/how-to-spot-ingenico-self-checkout-skimmers/" target="_blank" rel="noopener">How to Spot Ingenico Self-Checkout Skimmers</a></p>
<p><a href="https://krebsonsecurity.com/2016/10/self-checkout-skimmers-go-bluetooth/" target="_blank" rel="noopener">Self-Checkout Skimmers Go Bluetooth</a></p>
<p><a href="https://krebsonsecurity.com/2017/02/more-on-bluetooth-ingenico-overlay-skimmers/" target="_blank" rel="noopener">More on Bluetooth Ingenico Overlay Skimmers</a></p>
<p><a href="https://krebsonsecurity.com/2016/02/safeway-self-checkout-skimmer-close-up/" target="_blank" rel="noopener">Safeway Self-Checkout Skimmers Up Close</a></p>
<p><a href="https://krebsonsecurity.com/2016/05/skimmers-found-at-walmart-a-closer-look/" target="_blank" rel="noopener">Skimmers Found at Wal-Mart: A Closer Look</a></p>


feed_id: https://krebsonsecurity.com/?p=54375
title: U.S. Indicts North Korean Hackers in Theft of $200 Million
uri: U-S-Indicts-North-Korean-Hackers-in-Theft-of-200-Million
url: https://krebsonsecurity.com/2021/02/u-s-indicts-north-korean-hackers-in-theft-of-200-million/
content:
<p>The <strong>U.S. Justice Department</strong> today unsealed indictments against three men accused of working with the North Korean regime to carry out some of the most damaging cybercrime attacks over the past decade, including the <a href="https://krebsonsecurity.com/?s=sony+pictures&amp;x=0&amp;y=0" target="_blank" rel="noopener">2014 hack of Sony Pictures</a>, the global <a href="https://en.wikipedia.org/wiki/WannaCry_ransomware_attack" target="_blank" rel="noopener">WannaCry ransomware contagion of 2017</a>, and the theft of roughly $200 million and attempted theft of more than $1.2 billion from banks and other victims worldwide.</p>
<p><img loading="lazy" class="aligncenter wp-image-54381" src="media/976efacc.nk.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/02/nk.jpg" alt="" width="598" height="396" /></p>
<p>Investigators with the DOJ, <strong>U.S. Secret Service</strong> and <strong>Department of Homeland Security</strong> told reporters on Wednesday the trio&#8217;s activities involved extortion, phishing, direct attacks on financial institutions and ATM networks, as well as malicious applications that masqueraded as software tools to help people manage their cryptocurrency holdings.</p>
<p>Prosecutors say the hackers were part of an effort to circumvent ongoing international financial sanctions against the North Korean regime. The group is thought to be responsible for the attempted theft of approximately $1.2 billion, although it&#8217;s unclear how much of that was actually stolen.</p>
<p>Confirmed thefts attributed to the group include the 2016 hacking of the SWIFT payment system for Bangladesh Bank, which netted thieves $81 million; $6.1 million in a 2018 <a href="https://krebsonsecurity.com/?s=atm+cash+out&amp;x=0&amp;y=0" target="_blank" rel="noopener">ATM cash out scheme</a> targeting a Pakistani bank; and a total of $112 million in virtual currencies stolen between 2017 and 2020 from cryptocurrency companies in Slovenia, Indonesia and New York.</p>
<p>&#8220;The scope of the criminal conduct by the North Korean hackers was extensive and longrunning, and the range of crimes they have committed is staggering,&#8221; said <strong>Acting U.S. Attorney Tracy L. Wilkison</strong> for the Central District of California. &#8220;The conduct detailed in the indictment are the acts of a criminal nation-state that has stopped at nothing to extract revenge and obtain money to prop up its regime.&#8221;</p>
<p><a href="media/5229ac81.kim-il.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/02/kim-il.png"><img loading="lazy" class="alignright wp-image-54382" src="media/5229ac81.kim-il.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/02/kim-il.png" alt="" width="247" height="211" srcset="https://krebsonsecurity.com/wp-content/uploads/2021/02/kim-il.png 789w, https://krebsonsecurity.com/wp-content/uploads/2021/02/kim-il-768x658.png 768w" sizes="(max-width: 247px) 100vw, 247px" /></a>The indictments name <a href="https://www.justice.gov/opa/press-release/file/1367706/download" target="_blank" rel="noopener"><strong>Jon Chang Hyok</strong></a> (a.k.a &#8220;Alex/Quan Jiang&#8221;), <a href="https://www.justice.gov/opa/press-release/file/1367711/download" target="_blank" rel="noopener"><strong>Kim Il</strong></a> (a.k.a. &#8220;Julien Kim&#8221;/&#8221;Tony Walker&#8221;), and <a href="https://www.justice.gov/opa/press-release/file/1367716/download" target="_blank" rel="noopener"><strong>Park Jin</strong> <strong>Hyok</strong></a> (a.k.a. Pak Jin Hek/Pak Kwang Jin). U.S. prosecutors say the men were members of the <a href="https://en.wikipedia.org/wiki/Reconnaissance_General_Bureau" target="_blank" rel="noopener">Reconnaissance General Bureau</a> (RGB), an intelligence division of the Democratic People&#8217;s Republic of Korea (DPRK) that manages the state&#8217;s clandestine operations.</p>
<p>The Justice Department says those indicted were members of a DPRK-sponsored cybercrime group variously identified by the security community as the <strong>Lazarus Group</strong> and <strong>Advanced Persistent Threat 38</strong> (APT 38). The government alleges the men reside in North Korea but were frequently stationed by the DPRK in other countries, including China and Russia.</p>
<p>Park was <a href="https://www.justice.gov/opa/pr/north-korean-regime-backed-programmer-charged-conspiracy-conduct-multiple-cyber-attacks-and" target="_blank" rel="noopener">previously charged in 2018</a> in connection with the WannaCry and Sony Pictures attacks. But today&#8217;s indictments expanded the range of crimes attributed to Park and his alleged co-conspirators, including cryptocurrency thefts, phony cryptocurrency investment schemes and apps, and efforts to launder the proceeds of their crimes.</p>
<p>Prosecutors in California also today unsealed an indictment against <strong>Ghaleb Alaumary</strong>, a 37-year-old from Mississauga, Ontario who pleaded guilty in November 2020 to charges of laundering tens of millions of dollars stolen by the DPRK hackers.</p>
<p>The accused allegedly developed and marketed a series of cryptocurrency applications that were advertised as tools to help people manage their crypto holdings. In reality, prosecutors say, the programs were malware or downloaded malware after the applications were installed.</p>
<p>A <a href="https://us-cert.cisa.gov/ncas/alerts/aa21-048a" target="_blank" rel="noopener">joint cyber advisory</a> from the FBI, the Treasury and DHS&#8217;s Cybersecurity and Infrastructure Agency (CISA) delves deeper into these backdoored cryptocurrency apps, a family of malware activity referred to as &#8220;<strong>AppleJeus</strong>. &#8220;<strong>Hidden Cobra</strong>&#8221; is the collective handle assigned to the hackers behind the AppleJeus malware.</p>
<p>&#8220;In most instances, the malicious application—seen on both Windows and Mac operating systems—appears to be from a legitimate cryptocurrency trading company, thus fooling individuals into downloading it as a third-party application from a website that seems legitimate,&#8221; the advisory reads. &#8220;In addition to infecting victims through legitimate-looking websites, HIDDEN COBRA actors also use phishing, social networking, and social engineering techniques to lure users into downloading the malware.&#8221;<span id="more-54375"></span></p>
<p>The alert notes that these apps have been posing as cryptocurrency trading platforms since 2018, and have been tied to cryptocurrency thefts in more than 30 countries.</p>
<div id="attachment_54380" style="width: 609px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-54380" loading="lazy" class=" wp-image-54380" src="media/c99a4bd0.applejeus.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/02/applejeus.png" alt="" width="599" height="380" /><p id="caption-attachment-54380" class="wp-caption-text">Image: CISA.</p></div>
<p>For example, the DOJ indictments say these apps were involved in stealing $11.8 million in August 2020 from a financial services company based in New York. Warrants obtained by the government allowed the FBI to seize roughly $1.9 million from two different cryptocurrency exchanges used by the hackers, money that investigators say will be returned to the New York financial services firm.</p>
<p>Other moneymaking and laundering schemes attributed to the North Korean hackers include the development and marketing of an initial coin offering (ICO) in 2017 called <a href="https://www.vertic.org/2019/04/24/the-curious-case-of-marine-chain-the-dprk-cyberscam-behind-a-blockchain-powered-maritime-investment-marketplace/" target="_blank" rel="noopener"><strong>Marine Chain Token</strong></a>.</p>
<p>That blockchain-based cryptocurrency offering promised early investors the ability to purchase &#8220;fractional ownership in marine shipping vessels,&#8221; which the government says was just another way for the North Korean government to &#8220;secretly obtain funds from investors, control interests in marine shipping vessels, and evade U.S. sanctions.&#8221;</p>
<p>A copy of the indictments is available <a href="https://www.justice.gov/opa/press-release/file/1367701/download" target="_blank" rel="noopener">here</a> (PDF).</p>


feed_id: https://krebsonsecurity.com/?p=54390
title: Mexican Politician Removed Over Alleged Ties to Romanian ATM Skimmer Gang
uri: Mexican-Politician-Removed-Over-Alleged-Ties-to-Romanian-ATM-Skimmer-G
url:
https://krebsonsecurity.com/2021/02/mexican-politician-removed-over-alleged-ties-to-romanian-atm-skimmer-gang/

content:
<p>The leader of Mexico&#8217;s Green Party has been removed from office following allegations that he received money from a Romanian ATM skimmer gang that stole hundreds of millions of dollars from tourists visiting Mexico&#8217;s top tourist destinations over the past five years. The scandal is the latest fallout stemming from a three-part investigation into the organized crime group by KrebsOnSecurity in 2015.</p>
<div id="attachment_32341" style="width: 601px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-32341" loading="lazy" class=" wp-image-32341" src="media/e830e869.BTpadskimF2M.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2015/09/BTpadskimF2M.png" alt="" width="591" height="584" srcset="https://krebsonsecurity.com/wp-content/uploads/2015/09/BTpadskimF2M.png 616w, https://krebsonsecurity.com/wp-content/uploads/2015/09/BTpadskimF2M-580x573.png 580w" sizes="(max-width: 591px) 100vw, 591px" /><p id="caption-attachment-32341" class="wp-caption-text">One of the Bluetooth-enabled PIN pads pulled from a compromised ATM in Mexico. The two components on the left are legitimate parts of the machine. The fake PIN pad made to be slipped under the legit PIN pad on the machine, is the orange component, top right. The Bluetooth and data storage chips are in the middle.</p></div>
<p><strong>Jose de la Peña Ruiz de Chávez</strong>, who leads the Green Ecologist Party of Mexico (PVEM), was <a href="https://www.occrp.org/en/daily/13878-mexican-politician-denies-links-to-riviera-maya-gang" target="_blank" rel="noopener">dismissed this month</a> after it was revealed that his were among 79 bank accounts seized as part of an ongoing law enforcement investigation into a Romanian organized crime group that owned and operated an ATM network throughout the country.</p>
<p>In 2015, KrebsOnSecurity traveled to Mexico&#8217;s Yucatan Peninsula to follow up on reports about <a href="https://krebsonsecurity.com/2015/07/spike-in-atm-skimming-in-mexico/" target="_blank" rel="noopener">a massive spike in ATM skimming activity</a> that appeared centered around some of the nation&#8217;s primary tourist areas.</p>
<p>That <a href="https://krebsonsecurity.com/2015/09/tracking-a-bluetooth-skimmer-gang-in-mexico/" target="_blank" rel="noopener">three-part</a> <a href="https://krebsonsecurity.com/2015/09/tracking-bluetooth-skimmers-in-mexico-part-ii/" target="_blank" rel="noopener">series</a> <a href="https://krebsonsecurity.com/2015/09/whos-behind-bluetooth-skimming-in-mexico/" target="_blank" rel="noopener">concluded</a> that <strong>Intacash</strong>, an ATM provider owned and operated by a group of Romanian citizens, had been paying technicians working for other ATM companies to install sophisticated Bluetooth-based skimming devices inside cash machines throughout the Quintana Roo region of Mexico, which includes Cancun, Cozumel, Playa del Carmen and Tulum.</p>
<div align="center"><iframe src="https://www.youtube.com/embed/Pi6y2soOp8Y" width="560" height="315" frameborder="0" allowfullscreen="allowfullscreen"></iframe></div>
<p>Unlike most skimmers — which can be detected by looking for out-of-place components attached to the exterior of a compromised cash machine — these skimmers were hooked to the internal electronics of ATMs operated by Intacash’s competitors by authorized personnel who’d reportedly been bribed or coerced by the gang.</p>
<p>But because the skimmers were Bluetooth-based &#8212; allowing thieves periodically to collect stolen data just by strolling up to a compromised machine with a mobile device &#8212; KrebsOnSecurity was able to detect which ATMs had been hacked using nothing more than a cheap smart phone.</p>
<p>In <a href="https://twitter.com/josedelapena12/status/1360005497491963909" target="_blank" rel="noopener">a series of posts on Twitter</a>, De La Peña denied any association with the Romanian organized crime gang, and said he was cooperating with authorities.</p>
<p>But it is likely the scandal will ensnare a number of other important figures in Mexico. According to <a href="https://politica.expansion.mx/estados/2021/02/10/el-pvem-destituye-a-su-lider-en-qroo-ligado-con-la-mafia-rumana" target="_blank" rel="noopener">a report</a> in the Mexican publication <em>Expansion Politica</em>, the official list of bank accounts frozen by the Mexican Ministry of Finance include those tied to the notary <strong>Naín Díaz Medina</strong>; the owner of the Quequi newspaper, <strong>José Alberto Gómez Álvarez</strong>; the former Secretary of Public Security of Cancun, <strong>José Luis Jonathan Yong</strong>; his father José Luis Yong Cruz; and former governors of Quintana Roo.<span id="more-54390"></span></p>
<p>In May 2020, the Mexican daily <em>Reforma</em> <a href="https://krebsonsecurity.com/2020/05/report-atm-skimmer-gang-had-protection-from-mexican-attorney-generals-office/" target="_blank" rel="noopener">reported</a> that the skimming gang enjoyed legal protection from a top anti-corruption official in the Mexican attorney general&#8217;s office.</p>
<p>The following month, my reporting from 2015 emerged as the primary focus of <a href="https://krebsonsecurity.com/2020/06/romanian-skimmer-gang-in-mexico-outed-by-krebsonsecurity-stole-1-2-billion/" target="_blank" rel="noopener">a documentary</a> published by the <a href="https://www.occrp.org" target="_blank" rel="noopener">Organized Crime and Corruption Reporting Project</a> (OCCRP) into Intacash and its erstwhile leader &#8212; 44-year-old <strong>Florian &#8220;The Shark&#8221; Tudor</strong>. The <a href="https://www.occrp.org/en/how-a-crew-of-romanian-criminals-conquered-the-world-of-atm-skimming/" target="_blank" rel="noopener">OCCRP&#8217;s series</a> painted a vivid picture of a highly insular, often violent transnational organized crime ring (referred to as the &#8220;<strong>Riviera Maya Gang</strong>&#8220;) that controlled at least 10 percent of the $2 billion annual global market for skimmed cards.</p>
<div style="text-align: center;"><iframe src="https://www.youtube.com/embed/O9jf-RtpPXM" width="560" height="315" frameborder="0" allowfullscreen="allowfullscreen"></iframe></div>
<p>It also details how the group laundered their ill-gotten gains, and is alleged to have built a human smuggling ring that helped members of the crime gang cross into the U.S. and ply their skimming trade against ATMs in the United States. Finally, the series highlights how the Riviera Maya gang operated with impunity for several years by exploiting relationships with powerful anti-corruption officials in Mexico.</p>
<p>In 2019, police in Mexico arrested Tudor for illegal weapons possession, and raided his various properties there in connection with <a href="https://krebsonsecurity.com/2019/04/alleged-chief-of-romanian-atm-skimming-gang-arrested-in-mexico/" target="_blank" rel="noopener noreferrer">an investigation into the 2018 murder of his former bodyguard</a>, <strong>Constantin Sorinel Marcu</strong>.</p>
<p>According to prosecution documents, Marcu and The Shark spotted my reporting shortly after it was published in 2015, and discussed what to do next on a messaging app:</p>
<blockquote><p><strong>The Shark: </strong>Krebsonsecurity.com See this. See the video and everything. There are two episodes. They made a telenovela.</p>
<p><strong>Marcu:</strong> I see. It’s bad.</p>
<p><strong>The Shark:</strong> They destroyed us. That’s it. Fuck his mother. Close everything.</p></blockquote>
<p>The intercepted communications indicate The Shark also wanted revenge on whoever was responsible for leaking information about their operations.</p>
<blockquote><p><strong>The Shark:</strong> Tell them that I am going to kill them.</p>
<p><strong>Marcu:</strong> Okay, I can kill them. Any time, any hour.</p>
<p><strong>The Shark:</strong> They are checking all the machines. Even at banks. They found over 20.</p>
<p><strong>Marcu:</strong> Whaaaat?!? They found? Already??</p></blockquote>
<p>Since the OCCRP published its investigation, KrebsOnSecurity has received multiple death threats. One was sent from an email address tied to a Romanian programmer and malware author who is active on several cybercrime forums. It read:</p>
<p>&#8220;Don’t worry.. you will be killed you and your wife.. all is matter of time amigo :)&#8221;</p>


feed_id: https://krebsonsecurity.com/?p=54400
title: Checkout Skimmers Powered by Chip Cards
uri: Checkout-Skimmers-Powered-by-Chip-Cards
url: https://krebsonsecurity.com/2021/02/checkout-skimmers-powered-by-chip-cards/
content:
<p>Easily the most sophisticated skimming devices made for hacking terminals at retail self-checkout lanes are a new breed of PIN pad overlay combined with a flexible, paper-thin device that fits inside the terminal&#8217;s chip reader slot. What enables these skimmers to be so slim? They draw their power from the low-voltage current that gets triggered when a chip-based card is inserted. As a result, they do not require external batteries, and can remain in operation indefinitely.</p>
<div id="attachment_54411" style="width: 603px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-54411" loading="lazy" class=" wp-image-54411" src="media/fa54c1ec.overlay-shim.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/02/overlay-shim.png" alt="" width="593" height="705" /><p id="caption-attachment-54411" class="wp-caption-text">A point-of-sale skimming device that consists of a PIN pad overlay (top) and a smart card skimmer (a.k.a. &#8220;shimmer&#8221;). The entire device folds onto itself, with the bottom end of the flexible card shimmer fed into the mouth of the chip card acceptance slot.</p></div>
<p>The overlay skimming device pictured above consists of two main components. The one on top is a regular PIN pad overlay designed to record keypresses when a customer enters their debit card PIN. The overlay includes a microcontroller and a small data storage unit (bottom left).</p>
<p>The second component, which is wired to the overlay skimmer, is a flexible card skimmer (often called a &#8220;shimmer&#8221;) that gets fed into the mouth of the chip card acceptance slot. You&#8217;ll notice neither device contains a battery, because there simply isn&#8217;t enough space to accommodate one.</p>
<p>Virtually all payment card terminals at self-checkout lanes now accept (if not also require) cards with a chip to be inserted into the machine. When a chip card is inserted, the terminal reads the data stored on the smart card by sending an electric current through the chip.</p>
<p>Incredibly, this skimming apparatus is able to siphon a small amount of that power (a few milliamps) to record any data transmitted by the payment terminal transaction and PIN pad presses. When the terminal is no longer in use, the skimming device remains dormant.</p>
<p>The skimmer pictured above does not stick out of the payment terminal at all when it&#8217;s been seated properly inside the machine. Here&#8217;s what the fake PIN pad overlay and card skimmer looks like when fully inserted into the card acceptance slot and viewed head-on:</p>
<div id="attachment_54404" style="width: 605px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-54404" loading="lazy" class=" wp-image-54404" src="media/29acdcdb.pt-inserted.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/02/pt-inserted.png" alt="" width="595" height="344" /><p id="caption-attachment-54404" class="wp-caption-text">The insert skimmer fully ensconced inside the compromised payment terminal. Image: KrebsOnSecurity.com</p></div>
<p>Would you detect an overlay skimmer like this? Here&#8217;s what it looks like when attached to a customer-facing payment terminal:</p>
<div id="attachment_54413" style="width: 609px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-54413" loading="lazy" class=" wp-image-54413" src="media/fb294706.v-overlaytop.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/02/v-overlaytop.png" alt="" width="599" height="624" srcset="https://krebsonsecurity.com/wp-content/uploads/2021/02/v-overlaytop.png 865w, https://krebsonsecurity.com/wp-content/uploads/2021/02/v-overlaytop-768x800.png 768w" sizes="(max-width: 599px) 100vw, 599px" /><p id="caption-attachment-54413" class="wp-caption-text">The PIN pad overlay and skimmer, fully seated on a payment terminal.</p></div>
<h4>REALLY SMART CARDS</h4>
<p>The fraud investigators I spoke with about this device (who did so on condition of anonymity) said initially they couldn&#8217;t figure out how the thieves who plant these devices go about retrieving the stolen data from the skimmer. Normally, overlay skimmers relay this data <a href="https://krebsonsecurity.com/?s=bluetooth+overlay+skimmer&amp;x=0&amp;y=0" target="_blank" rel="noopener">wirelessly using a built-in Bluetooth circuit board</a>. But that also requires the device to have a substantial internal power supply, such as a somewhat bulky cell phone battery.</p>
<p>The investigators surmised that the crooks would retrieve the stolen data by periodically revisiting the compromised terminals with a specialized smart card that &#8212; when inserted &#8212; instructs the skimmer to dump all of the saved information onto the card. And indeed, this is exactly what investigators ultimately found was the case.</p>
<p>&#8220;Originally it was just speculation,&#8221; the source told KrebsOnSecurity. &#8220;But a [compromised] merchant found a couple of &#8216;white&#8217; smartcards with no markings on them [that] were left at one of their stores. They informed us that they had a lab validate that this is how it worked.&#8221;</p>
<p>Some readers might reasonably be asking why it would be the case that the card acceptance slot on any chip-based payment terminal would be tall enough to accommodate both a chip card and a flexible skimming device such as this.</p>
<p>The answer, as with many aspects of security systems that decrease in effectiveness over time, has to do with allowances made for purposes of backward compatibility. Most modern chip-based cards are significantly thinner than the average payment card was just a few years ago, but the design specifications for these terminals state that they must be able to allow the use of older, taller cards &#8212; such as those that still include embossing (raised numbers and letters). Embossing is a practically stone-age throwback to the way credit cards were originally read, through the use of <a href="https://www.pcicomplianceguide.org/are-knuckle-busters-pci-compliant/" target="_blank" rel="noopener">manual &#8220;knuckle-buster&#8221; card imprint machines</a> and carbon-copy paper.</p>
<p>&#8220;The bad guys are taking advantage of that, because most smart cards are way thinner than the specs for these machines require,&#8221; the source explained. &#8220;In fact, these slots are so tall that you could fit two cards in there.&#8221;<span id="more-54400"></span></p>
<h4>IT&#8217;S ALL BACKWARDS</h4>
<p>Backward compatibility is a major theme in enabling many types of card skimming, including <a href="https://krebsonsecurity.com/?s=atm+skimmer&amp;x=0&amp;y=0" target="_blank" rel="noopener">devices made to compromise automated teller machines (ATMs)</a>. Virtually all chip-based cards (at least those issued in the United States) still have much of the same data that’s stored in the chip encoded on a magnetic stripe on the back of the card. This dual functionality also allows cardholders to swipe the stripe if for some reason the card’s chip or a merchant’s smartcard-enabled terminal has malfunctioned.</p>
<p>Chip-based credit and debit cards are designed to make it infeasible for skimming devices or malware to clone your card when you pay for something by dipping the chip instead of swiping the stripe. But thieves are adept at <a href="https://krebsonsecurity.com/2020/07/is-your-chip-card-secure-much-depends-on-where-you-bank/" target="_blank" rel="noopener">exploiting weaknesses in how certain financial institutions have implemented the technology</a> to sidestep key chip card security features and effectively create usable, counterfeit cards.</p>
<p>Many people believe that skimmers are mainly a problem in the United States, where some ATMs still do not require more secure chip-based cards that are far more expensive and difficult for thieves to clone. However, it’s precisely because some U.S. ATMs lack this security requirement that skimming remains so prevalent in other parts of the world.</p>
<p>Mainly for reasons of backward compatibility to accommodate American tourists, a great number of ATMs outside the U.S. allow non-chip-based cards to be inserted into the cash machine. What’s more, many chip-based cards issued by American and European banks alike still have cardholder data encoded on a magnetic stripe in addition to the chip.</p>
<p>When thieves skim non-U.S. ATMs, they generally sell the stolen card and PIN data to fraudsters in Asia and North America. Those fraudsters in turn will encode the card data onto counterfeit cards and withdraw cash at older ATMs here in the United States and elsewhere.</p>
<p>Interestingly, even after most U.S. banks put in place fully chip-capable ATMs, the magnetic stripe will still be needed because it’s an integral part of the way ATMs work: Most ATMs in use today require a magnetic stripe for the card to be accepted into the machine. The main reason for this is to ensure that customers are putting the card into the slot correctly, as embossed letters and numbers running across odd spots in the card reader can take their toll on the machines over time.</p>
<p>And there are the <a href="https://krebsonsecurity.com/?s=fuel+pump&amp;x=0&amp;y=0" target="_blank" rel="noopener">tens of thousands of fuel pumps here in the United States that still allow chip-based card accounts to be swiped</a>. The fuel pump industry has for years won <a href="https://krebsonsecurity.com/2016/12/visa-delays-chip-deadline-for-pumps-to-2020/" target="_blank" rel="noopener">delay after delay</a> in implementing more secure payment requirements for cards (primarily by flexing their ability to favor their own fuel-branded cards, which largely bypass the major credit card networks).</p>
<p>Unsurprisingly, the past two decades have seen the emergence of <a href="https://krebsonsecurity.com/2015/11/gas-theft-gangs-fuel-pump-skimming-scams/" target="_blank" rel="noopener">organized gas theft gangs</a> that take full advantage of the single weakest area of card security in the United States. These thieves use cloned cards to steal hundreds of gallons of gas at multiple filling stations. The gas is pumped into hollowed-out trucks and vans, which ferry the fuel to a giant tanker truck. The criminals then sell and deliver the gas at cut rate prices to shady and complicit fuel station owners and truck stops.</p>
<p>A great many people use debit cards for everyday purchases, but I’ve never been interested in assuming the added risk and pay for everything with cash or a credit card. Armed with your PIN and debit card data, thieves can clone the card and pull money out of your account at an ATM. Having your checking account emptied of cash while your bank sorts out the situation can be a huge hassle and create secondary problems (bounced checks, for instance).</p>
<p>The next skimmer post here will examine an inexpensive and ingenious analog device that helps retail workers quickly check whether their payment terminals have been tampered with by bad guys.</p>


feed_id: https://krebsonsecurity.com/?p=54184
title: How $100M in Jobless Claims Went to Inmates
uri: How-100M-in-Jobless-Claims-Went-to-Inmates
url: https://krebsonsecurity.com/2021/02/how-100m-in-jobless-claims-went-to-inmates/
content:
<p>The U.S. Labor Department&#8217;s inspector general said this week that roughly $100 million in fraudulent unemployment insurance claims were paid in 2020 to criminals who are already in jail. That&#8217;s a tiny share of the estimated tens of billions of dollars in jobless benefits states have given to identity thieves in the past year. To help reverse that trend, many states are now turning to a little-known private company called <strong>ID.me</strong>. This post examines some of what that company is seeing in its efforts to stymie unemployment fraud.</p>
<div id="attachment_54441" style="width: 603px" class="wp-caption aligncenter"><a href="media/d2d8b1c0.idme-prisoncards.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/02/idme-prisoncards.png"><img aria-describedby="caption-attachment-54441" loading="lazy" class="wp-image-54441" src="media/d2d8b1c0.idme-prisoncards.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/02/idme-prisoncards.png" alt="" width="593" height="200" /></a><p id="caption-attachment-54441" class="wp-caption-text">These prisoners tried to apply for jobless benefits. Personal information from the inmate IDs has been redacted. Image: ID.me</p></div>
<p>A new <a href="media/593150d3.19-21-002-03-315.pdf" data-original-source="https://www.oig.dol.gov/public/reports/oa/2021/19-21-002-03-315.pdf" target="_blank" rel="noopener">report</a> (PDF) from the Labor Department&#8217;s Office of Inspector General (OIG) found that from March through October of 2020, some $3.5 billion in fraudulent jobless benefits &#8212; nearly two-thirds of the phony claims it reviewed &#8212; was paid out to individuals with Social Security numbers filed in multiple states. Almost $100 million went to more than 13,000 ineligible people who are currently in prison.</p>
<p>The OIG acknowledges that the total losses from all states is likely to be tens of billions of dollars. Indeed, just one state &#8212; California &#8212; disclosed last month that hackers, identity thieves and overseas criminal rings stole more than $11 billion in jobless benefits from the state last year. That&#8217;s roughly 10 percent of all claims.</p>
<p><em>Bloomberg Law</em> <a href="https://news.bloomberglaw.com/daily-labor-report/jobless-aid-fraud-warrants-greater-federal-action-watchdog-says" target="_blank" rel="noopener">reports</a> that in response to a flood of jobless claims that exploit the lack of information sharing among states, the Labor Dept. urged the states to use a federally funded hub designed to share applicant data and detect fraudulent claims filed in more than one state. But as the OIG report notes, participation in the hub is voluntary, and so far only 32 of 54 state or territory workforce agencies in the U.S. are using it.</p>
<p>Much of this fraud exploits weak authentication methods used by states that have long sought to verify applicants using static, widely available information such as Social Security numbers and birthdays. Many states also lacked the ability to tell when multiple payments were going to the same bank accounts.</p>
<p>To make matters worse, as the Coronavirus pandemic took hold a number of states dramatically pared back the amount of information required to successfully request a jobless benefits claim.</p>
<h4>77,000 NEW (AB)USERS EACH DAY</h4>
<p>In response, 15 states have now allied with McLean, Va.-based ID.me to shore up their authentication efforts, with six more states under contract to use the service in the coming months. That&#8217;s a minor coup for a company launched in 2010 with the goal of helping e-commerce sites validate the identities of customers for the purposes of <a href="https://shop.id.me/" target="_blank" rel="noopener">granting discounts</a> for veterans, teachers, students, nurses and first responders.</p>
<p>ID.me says it now has more than 36 million people signed up for accounts, with roughly 77,000 new users signing up each day. Naturally, a big part of that growth has come from unemployed people seeking jobless benefits.</p>
<p>To screen out fraudsters, ID.me requires applicants to supply a great deal more information than previously requested by the states, such as images of their driver&#8217;s license or other government-issued ID, copies of utility or insurance bills, and details about their mobile phone service.</p>
<p>When an applicant doesn&#8217;t have one or more of the above &#8212; or if something about their application triggers potential fraud flags &#8212; ID.me may require a recorded, live video chat with the person applying for benefits.</p>
<p>This has led to some fairly amusing attempts to circumvent their verification processes, said ID.me founder and CEO <strong>Blake Hall</strong>. For example, it&#8217;s not uncommon for applicants appearing in the company&#8217;s video chat to don disguises. The Halloween mask worn by the applicant pictured below is just one example.</p>
<div id="attachment_54442" style="width: 255px" class="wp-caption alignright"><img aria-describedby="caption-attachment-54442" loading="lazy" class=" wp-image-54442" src="media/95374f51.joblessmask.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/02/joblessmask.png" alt="" width="245" height="299" /><p id="caption-attachment-54442" class="wp-caption-text">Image: ID.me</p></div>
<p>Hall said the company&#8217;s service is blocking a significant amount of &#8220;first party&#8221; fraud &#8212; someone using their own identity to file in multiple states where they aren&#8217;t eligible &#8212; as well as &#8220;third-party&#8221; fraud, where people are tricked into giving away identity data that thieves then use to apply for benefits.</p>
<p>&#8220;There&#8217;s literally every form of attack, from nation states and organized crime to prisoners,&#8221; Hall said. &#8220;It&#8217;s like the D-Day of fraud, this is Omaha Beach we&#8217;re on right now. The amount of fraud we are fighting is truly staggering.&#8221;</p>
<p>According to ID.me, a major driver of phony jobless claims comes from social engineering, where people have given away personal data in response to romance or sweepstakes scams, or after applying for what they thought was a legitimate work-from-home job.</p>
<p>&#8220;A lot of this is targeting the elderly,&#8221; Hall said. &#8220;We&#8217;ve seen [videos] of people in nursing homes, where folks off camera are speaking for them and holding up documents.&#8221;</p>
<p>&#8220;We had one video where the person applying said, &#8216;I&#8217;m here for the prize money,'&#8221; Hall continued. &#8220;Another elderly victim started weeping when they realized they weren&#8217;t getting a job and were the victim of a job scam. In general though, the job scam stuff hits younger people harder and the romance and prize money stuff hits elderly people harder.&#8221;</p>
<p>Many other phony claims are filed by people who&#8217;ve been approached by fraudsters promising them a cut of any unemployment claims granted in their names.</p>
<p>&#8220;That person is told to just claim that they had their identity stolen when and if law enforcement ever shows up,&#8221; Hall said.<br />
<span id="more-54184"></span></p>
<h4>REACTIONS FROM THE UNDERGROUND</h4>
<p>Fraudsters involved in filing jobless benefit claims have definitely taken notice of ID.me&#8217;s efforts. Shortly after the company began working with California in December 2020, ID.me came under a series of denial-of-service (DDoS) attacks aimed at knocking the service offline.</p>
<p>&#8220;We have blocked at least five sustained, large-scale DDoS attacks originating from Nigeria trying to take our service down because we are blocking their fraud,&#8221; Hall said.</p>
<p>In May 2020, KrebsOnSecurity examined postings to several Telegram chat channels <a href="https://krebsonsecurity.com/2020/05/riding-the-state-unemployment-fraud-wave/" target="_blank" rel="noopener">dedicated to selling services that help people fraudulently apply for jobless benefits</a>. These days, some of the most frequent posts on those channels advertise the sale of various &#8220;methods&#8221; or tips about how to bypass ID.me protections.</p>
<div id="attachment_54450" style="width: 608px" class="wp-caption aligncenter"><a href="media/06dceec3.fp-idme.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/02/fp-idme.png"><img aria-describedby="caption-attachment-54450" loading="lazy" class="wp-image-54450" src="media/06dceec3.fp-idme.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/02/fp-idme.png" alt="" width="598" height="140" srcset="https://krebsonsecurity.com/wp-content/uploads/2021/02/fp-idme.png 841w, https://krebsonsecurity.com/wp-content/uploads/2021/02/fp-idme-768x180.png 768w" sizes="(max-width: 598px) 100vw, 598px" /></a><p id="caption-attachment-54450" class="wp-caption-text">Mentions of id.me in cybercrime forums, Telegram channels throughout 2020. Source: Flashpoint-intel.com</p></div>
<p>Asked about the efficacy of those methods, Hall said while his service can&#8217;t stop all phony jobless claims, it can ensure that a single scammer can only file one fraudulent application.</p>
<p>&#8220;I&#8217;d say in this space it&#8217;s not about being perfect, but about being better,&#8221; he said.</p>
<p>That&#8217;s something of an understatement in an era when being able to limit each scammer to a single fraudulent claim can be considered progress. But Hall says one of the reasons we&#8217;re in this mess is that the states have for too long relied on data broker firms that sell authentication services based on static data that is far too easy for fraudsters to steal, buy or trick people into giving away.</p>
<p>&#8220;There&#8217;s been a real shift in the market from data-centric identity verification to verifying through something you have and something you are, like a phone or face or ID,&#8221; he said. &#8220;And those aren&#8217;t in the provenance of the incumbents, the data-centric brokers. When there have been so many data breaches that the toothpaste is basically out of the tube, you need a full orchestration platform.&#8221;</p>
<h4>A BETTER MOUSETRAP?</h4>
<p>Collecting and storing so much personal data on tens of millions of Americans can make one an attractive target for hackers and ID thieves. Hall says ID.me is certified against the <a href="https://csrc.nist.gov/publications/detail/sp/800-63/3/final" target="_blank" rel="noopener">NIST 800-63-3 digital identity guidelines</a>, employs multiple layers of security, and fully segregates static consumer data tied to a validated identity from a token used to represent that identity.</p>
<p>&#8220;We take a defense-in-depth approach, with partitioned networks, and use very sophisticated encryption scheme so that when and if there is a breach, this stuff is firewalled,&#8221; he said. &#8220;You&#8217;d have to compromise the tokens at scale and not just the database. We encrypt all that stuff down to the file level with keys that rotate and expire every 24 hours. And once we&#8217;ve verified you we don&#8217;t need that data about you on an ongoing basis.&#8221;</p>
<p>With such a high percentage of jobless claims now being filed by identity thieves, many states have instituted new fraud filters that ended up rejecting or delaying millions of legitimate claims.</p>
<p><strong>Jim Patterson</strong>, a Republican assemblyman from California, held a news conference in December charging that ID.me&#8217;s system &#8220;continually glitches and rejects legitimate forms of identification, forcing applicants to go through the manual verification process which takes months.&#8221;</p>
<p>ID.me says roughly eight users will pass through its automated self-serve flow for every one user who needs to use the video chat method to verify their identity.</p>
<p>&#8220;The majority of legitimate claimants pass our automated, self-serve identity verification process in less than five minutes,&#8221; Hall said. &#8220;For individuals who fail this process, we are the only company in the United States that offers a secure, video chat based method of identity verification to ensure that all users are able to prove their identity online.&#8221;</p>
<p>Hall says his company also exceeds the industry standard in terms of validating the identities of people with little or no credit history.</p>
<p>&#8220;If you just rely on credit bureaus or data brokers for this, it means anyone who doesn&#8217;t have a credit history doesn&#8217;t get through,&#8221; he said. &#8220;And that tends to have a disproportionate affect on those more likely to be less affluent, such as minority communities.&#8221;</p>


feed_id: https://krebsonsecurity.com/?p=54475
title: Is Your Browser Extension a Botnet Backdoor?
uri: Is-Your-Browser-Extension-a-Botnet-Backdoor
url: https://krebsonsecurity.com/2021/03/is-your-browser-extension-a-botnet-backdoor/
content:
<p>A company that rents out access to more than 10 million Web browsers so that clients can hide their true Internet addresses has built its network by paying browser extension makers to quietly include its code in their creations. This story examines the lopsided economics of extension development, and why installing an extension can be such a risky proposition.</p>
<p><img loading="lazy" class="aligncenter wp-image-45005" src="media/8b179f15.browsers.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/09/browsers.png" alt="" width="594" height="109" /></p>
<p>Singapore-based <strong>Infatica[.]io</strong> is part of a growing industry of shadowy firms trying to woo developers who maintain popular browser extensions &#8212; desktop and mobile device software add-ons available for download from <strong>Apple</strong>, <strong>Google</strong>, <strong>Microsoft</strong> and <strong>Mozilla</strong> designed to add functionality or customization to one&#8217;s browsing experience.</p>
<p>Some of these extensions have garnered hundreds of thousands or even millions of users. But here&#8217;s the rub: As an extension&#8217;s user base grows, maintaining them with software updates and responding to user support requests tends to take up an inordinate amount of the author&#8217;s time. Yet extension authors have few options for earning financial compensation for their work.</p>
<p>So when a company comes along and offers to buy the extension &#8212; or pay the author to silently include some extra code &#8212; that proposal is frequently too good to pass up.</p>
<p>For its part, Infatica seeks out authors with extensions that have at least 50,000 users. An extension maker who agrees to incorporate Infatica&#8217;s computer code can earn anywhere from $15 to $45 each month for every 1,000 active users.</p>
<div id="attachment_54494" style="width: 603px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-54494" loading="lazy" class="wp-image-54494" src="media/e54a87f7.infatica-revshare.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/02/infatica-revshare.png" alt="" width="593" height="434" srcset="https://krebsonsecurity.com/wp-content/uploads/2021/02/infatica-revshare.png 1030w, https://krebsonsecurity.com/wp-content/uploads/2021/02/infatica-revshare-768x562.png 768w" sizes="(max-width: 593px) 100vw, 593px" /><p id="caption-attachment-54494" class="wp-caption-text">An Infatica graphic explaining the potential benefits for extension owners.</p></div>
<p>Infatica&#8217;s code then uses the browser of anyone who has that extension installed to route Web traffic for the company&#8217;s customers, including marketers or anyone able to afford its hefty monthly subscription charges.</p>
<p>The end result is when Infatica customers browse to a web site, that site thinks the traffic is coming from the Internet address tied to the extension user, not the customer&#8217;s.</p>
<p>Infatica prices its service based on the volume of web traffic a customer is seeking to anonymize, from $360 a month for 40 gigabytes all the way to $20,000 a month for 10,000 gigabytes of data traffic pushed through millions of residential computers.</p>
<h4>THE ECONOMICS OF EXTENSIONS</h4>
<p><strong>Hao Nguyen</strong> is the developer behind <a href="https://chrome.google.com/webstore/detail/modheader/idgpnmonknjnojddfkpgkljpfnnfcklj?hl=en" target="_blank" rel="noopener">ModHeader</a>, an extension used by more than 400,000 people to test the functionality of websites by making it easier for users to modify the data shared with those sites. When Nguyen found himself spending increasing amounts of his time and money supporting the extension, he tried including ads in the program to help offset costs.</p>
<p>ModHeader users protested loudly against the change, and Nguyen removed the ads &#8212; which he said weren&#8217;t making him much money anyway.</p>
<p><span class="pullquote pqright">&#8220;I had spent at least 10 years building this thing and had no luck monetizing it,&#8221; </span> he told KrebsOnSecurity.</p>
<p>Nguyen said he ignored multiple requests from different companies offering to pay him to insert their code, mainly because the code gave those firms the ability to inject whatever they wanted into his program (and onto his users&#8217; devices) at any time.</p>
<p>Then came Infatica, whose code was fairly straightforward by comparison, he said. It restricted the company to routing web requests through his users&#8217; browsers, and did not try to access more sensitive components of the user&#8217;s browser experience, such as stored passwords and cookies, or viewing the user&#8217;s screen.</p>
<p>More importantly, the deal would net him at least $1,500 a month, and possibly quite a bit more.</p>
<p>&#8220;I gave Infatica a try but within a few days I got <a href="https://github.com/bewisse/modheader/issues/64" target="_blank" rel="noopener">a lot of negative user reviews</a>,&#8221; he said. &#8220;They didn&#8217;t like that the extension might be using their browser as a proxy for going to not so good places like porn sites.&#8221;</p>
<p>Again he relented, and removed the Infatica code.<span id="more-54475"></span></p>
<h4>A TARGET-RICH ENVIRONMENT</h4>
<p>These days, Nguyen is focusing more of his time on <a href="https://www.chrome-stats.com" target="_blank" rel="noopener">chrome-stats.com</a>, which provides detailed information on more than 150,000 extensions. The service is free for limited use, but subscribers who pay a monthly fee can get access to more resources, such as older extension versions and details about their code components.</p>
<p>According to chrome-stats.com, the majority of extensions &#8212; more than 100,000 of them &#8212; are effectively abandoned by their authors, or haven&#8217;t been updated in more than two years. In other words, there a great many developers who are likely to be open to someone else buying up their creation and their user base.</p>
<div id="attachment_54495" style="width: 603px" class="wp-caption aligncenter"><a href="media/a7d7be23.chromeext-updates.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/02/chromeext-updates.png"><img aria-describedby="caption-attachment-54495" loading="lazy" class="wp-image-54495" src="media/a7d7be23.chromeext-updates.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/02/chromeext-updates.png" alt="" width="593" height="347" srcset="https://krebsonsecurity.com/wp-content/uploads/2021/02/chromeext-updates.png 1174w, https://krebsonsecurity.com/wp-content/uploads/2021/02/chromeext-updates-768x449.png 768w" sizes="(max-width: 593px) 100vw, 593px" /></a><p id="caption-attachment-54495" class="wp-caption-text">Image: chrome-stats.com</p></div>
<p>The vast majority of extensions are free, although a handful that have attracted a large and loyal enough following have been able to charge for their creations or for subscription services tied to the extension. But last year, Google announced it was <a href="https://www.theverge.com/2020/9/22/21451111/google-paid-chrome-extension-monetize-shut-down-end" target="_blank" rel="noopener">shutting down paid Chrome extensions offered on its Chrome Web Store</a>.</p>
<p>Nguyen said this will only exacerbate the problem of frustrated developers turning to offers from dodgy marketing firms.</p>
<p>&#8220;It&#8217;s a really tough marketplace for extension developers to be able to monetize and get reward for maintaining their extensions,&#8221; he said. &#8220;There are tons of small developers who haven&#8217;t been able to do anything with their extensions. That&#8217;s why some of them will go into shady integration or sell the extension for some money and just be done with it.&#8221;</p>
<div id="attachment_54515" style="width: 604px" class="wp-caption aligncenter"><a href="media/3971f0ae.hola-luminati.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/02/hola-luminati.png"><img aria-describedby="caption-attachment-54515" loading="lazy" class="wp-image-54515" src="media/3971f0ae.hola-luminati.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/02/hola-luminati.png" alt="" width="594" height="476" /></a><p id="caption-attachment-54515" class="wp-caption-text">A solicitation sent by Infatica to the developer of the SponsorBlock extension. Image: sponsor.ajay.app</p></div>
<h4>WHO IS INFATICA?</h4>
<p>It is unclear how many extensions currently incorporate Infatica&#8217;s code. KrebsOnSecurity searched for extensions that invoke several domains tied to Infatica&#8217;s Web proxy service (e.g., <strong>extendbalanc[.]org</strong>, <strong>ipv4v6[.]info</strong>). This research was conducted using Nguyen&#8217;s site and <a href="https://crxcavator.io" target="_blank" rel="noopener">crxcavator.io</a>, a similar extension research site owned by networking giant <strong>Cisco Systems</strong>.</p>
<p>Those searches revealed that Infatica&#8217;s code has been associated with at least three dozen extensions over the past few years, including several that had more than 100,000 users. One of those is Video Downloader Plus, which at one point claimed nearly 1.4 million active users.</p>
<p>The founder and director of Infatica &#8212; a resident of Biysk, Russia named <strong>Vladimir Fomenko</strong> &#8212; did not respond to multiple requests for comment.</p>
<div id="attachment_54497" style="width: 608px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-54497" loading="lazy" class=" wp-image-54497" src="media/be1c92fb.fomenko.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/02/fomenko.png" alt="" width="598" height="308" srcset="https://krebsonsecurity.com/wp-content/uploads/2021/02/fomenko.png 907w, https://krebsonsecurity.com/wp-content/uploads/2021/02/fomenko-768x395.png 768w" sizes="(max-width: 598px) 100vw, 598px" /><p id="caption-attachment-54497" class="wp-caption-text">Infatica founder Vladimir M. Fomenko.</p></div>
<p>Fomenko is the sole director of the <a href="https://www.thetimes.co.uk/article/kompromat-fears-over-vladimir-fomenkos-web-service-t7tqdrvcb" target="_blank" rel="noopener">iNinja VPN</a>, another service that obfuscates the true Internet address of its more than 400,000 users. It stands to reason that iNinja VPN also is not only offering its customers a way to obfuscate their Internet address, but is actively using those same systems to route traffic for other customers: A Chrome browser plugin and ad blocker by the same name whose code includes Infatica&#8217;s &#8220;extenbalanc&#8221; domain has 400,000 users.</p>
<p>That would put Infatica in line with the activities of another major controversial VPN/proxy provider: <strong>Illuminati</strong>, a.k.a. &#8220;<strong>HolaVPN</strong>.&#8221; In 2015, security researchers <a href="http://adios-hola.org/" target="_blank" rel="noopener">discovered</a> that users of the HolaVPN browser extension were being used to funnel Web traffic for other people. Indeed, in the screenshot above, Infatica&#8217;s marketing team can be seen comparing its business model to that of HolaVPN.</p>
<p>Fomenko has appeared in <a href="https://krebsonsecurity.com/?s=vladimir+fomenko&amp;x=0&amp;y=0" target="_blank" rel="noopener">two previous KrebsOnSecurity stories</a>; both concerned <strong>King Servers</strong> (a.k.a. &#8220;<strong>Hosting Solution Ltd.</strong>&#8220;), a hosting company he has operated for years which caters mostly to adult websites.</p>
<p>In 2016, hackers suspected of working for Russian state security services <a href="https://edition.cnn.com/2016/08/29/politics/hackers-breach-illinois-arizona-election-systems/" target="_blank" rel="noopener">compromised databases for election systems in Arizona and Illinois</a>. Six of the eight Internet addresses <a href="media/f364682a.boe_flash_aug_2016_final.pdf" data-original-source="https://s.yimg.com/dh/ap/politics/images/boe_flash_aug_2016_final.pdf" target="_blank" rel="noopener">identified by the FBI</a> as sources of the attack traced back to King Servers. In <a href="https://www.nytimes.com/2016/09/28/world/europe/russia-hacker-vladimir-fomenko-king-servers.html" target="_blank" rel="noopener">an interview</a> with <em>The New York Times</em> several months later, Fomenko flatly denied having any ties to the hacking.</p>
<p>According to the Russian daily <a href="https://translate.google.com/translate?sl=ru&amp;tl=en&amp;u=https://novayagazeta.ru/articles/2017/01/26/71296-troyanskiy-kod" target="_blank" rel="noopener"><em>Novaya Gazeta</em></a>, revelations about the 2016 hacking incident&#8217;s ties to King Servers <a href="https://krebsonsecurity.com/2017/01/a-shakeup-in-russias-top-cybercrime-unit/" target="_blank" rel="noopener">led to treason charges</a> against <strong>Sergey Mikhaylov</strong>, the former deputy chief of Russia&#8217;s top anti-cybercrime unit.</p>
<p>Russian authorities charged that Mikhaylov had tipped off the FBI to information about Fomenko and King Servers. In 2019, Mikhaylov was convicted and <a href="https://krebsonsecurity.com/2019/02/former-russian-cybersecurity-chief-sentenced-to-22-years-in-prison/" target="_blank" rel="noopener">sentenced to 22 years in a penal colony</a>.</p>
<h4>BE SPARING IN TRUSTING EXTENSIONS</h4>
<p>Browser extensions — however useful or fun they may seem when you install them — typically have a great deal of power and can effectively read and/or write all data in your browsing sessions. The powers granted to each extension are roughly spelled out in its &#8220;manifest,&#8221; basically a description of what it will be able to access once you incorporate it into your browser.</p>
<p>According to Nguyen&#8217;s chrome-stats.com, about a third of all extensions for Chrome &#8212; by far the most widely-used Web browser &#8212; require no special permissions. But the remainder require the user to place a good deal of trust in the extension&#8217;s author. For example, approximately 30 percent can view all of your data on all or specific websites, or index your open tabs and browsing activity.</p>
<div id="attachment_54496" style="width: 606px" class="wp-caption aligncenter"><a href="media/cc08e5ed.chromext-permissions.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/02/chromext-permissions.png"><img aria-describedby="caption-attachment-54496" loading="lazy" class="wp-image-54496" src="media/cc08e5ed.chromext-permissions.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/02/chromext-permissions.png" alt="" width="596" height="394" srcset="https://krebsonsecurity.com/wp-content/uploads/2021/02/chromext-permissions.png 1159w, https://krebsonsecurity.com/wp-content/uploads/2021/02/chromext-permissions-768x507.png 768w" sizes="(max-width: 596px) 100vw, 596px" /></a><p id="caption-attachment-54496" class="wp-caption-text">Image: chrome-stats.com</p></div>
<p>More than 68,000 Chrome extensions allow the execution of arbitrary code in the context of webpages, effectively allowing the extension to alter the appearance and functionality of specific sites.</p>
<p>I hope it’s obvious by this point, but readers should be extremely cautious about installing extensions — sticking mainly to those that are actively supported and respond to user concerns.</p>
<p>Personally, I do not make much use of browser extensions. In almost every case I’ve considered installing one I’ve been sufficiently spooked by the permissions requested that I ultimately decided it wasn’t worth the risk, given that any extension can go rogue at the whims of its author.</p>
<p>If you’re the type of person who uses multiple extensions, it may be wise to adopt a risk-based approach going forward. Given the high stakes that typically come with installing an extension, consider carefully whether having the extension is truly worth it. This applies equally to plug-ins designed for Web site content management systems like <strong>WordPress</strong> and<strong> Joomla</strong>.</p>
<p>Do not agree to update an extension if it suddenly requests more permissions than a previous version. This should be a giant red flag that something is not right. If this happens with an extension you trust, you’d be well advised to remove it entirely.</p>
<p>Also, never download and install an extension just because some Web site says you need it to view some type of content. Doing so is almost always a high-risk proposition. Here, Rule #1 from <a href="https://krebsonsecurity.com/2011/05/krebss-3-basic-rules-for-online-safety/" target="_blank" rel="noopener">KrebsOnSecurity’s Three Rules of Online Safety</a> comes into play: “If you didn’t go looking for it, don’t install it.” Finally, in the event you do wish to install something, make sure you’re getting it directly from the entity that produced the software.</p>
<p>Google Chrome users can see any extensions they have installed by clicking the three dots to the right of the address bar, selecting “More tools” in the resulting drop-down menu, then “Extensions.” In Firefox, click the three horizontal bars next to the address bar and select “Add-ons,” then click the “Extensions” link on the resulting page to view any installed extensions.</p>


feed_id: https://krebsonsecurity.com/?p=54543
title: Payroll/HR Giant PrismHR Hit by Ransomware?
uri: Payroll-HR-Giant-PrismHR-Hit-by-Ransomware
url: https://krebsonsecurity.com/2021/03/payroll-hr-giant-prismhr-hit-by-ransomware/
content:
<p><strong>PrismHR</strong>, a company that sells technology used by other firms to help more than 80,000 small businesses manage payroll, benefits, and human resources, has suffered what appears to be an ongoing ransomware attack that is disrupting many of its services.</p>
<p><img loading="lazy" class="aligncenter wp-image-54554" src="media/5feaed90.prismhr.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/03/prismhr.png" alt="" width="597" height="274" srcset="https://krebsonsecurity.com/wp-content/uploads/2021/03/prismhr.png 949w, https://krebsonsecurity.com/wp-content/uploads/2021/03/prismhr-768x352.png 768w" sizes="(max-width: 597px) 100vw, 597px" /></p>
<p>Hopkinton, Mass.-based PrismHR handles everything from payroll processing and human resources to health insurance and tax forms for hundreds of &#8220;professional employer organizations&#8221; (PEOs) that serve more than two million employees. The company processes more than $80 billion payroll payments annually on behalf of PEOs and their clients.</p>
<p>Countless small businesses turn to PEOs in part because they simplify compliance with various state payroll taxes, and because PEOs are the easiest way for small businesses to pool their resources and obtain more favorable health insurance rates for their employees.</p>
<p>PrismHR has not yet responded to requests for comment. But in a notice sent to its PEO partners, PrismHR said it detected suspicious activity within its networks on Feb. 28, and that it disabled access to its platform for all users in an effort to contain the security incident.</p>
<p>The company said the disruption has affected 200 PEO clients across the country, and that the most immediate concern is helping PEOs ensure their customers can process payrolls this week.</p>
<p>&#8220;The outage may extend throughout today and possibly later, with potential impact on payroll processing,&#8221; Prism explained in a template email it suggested PEO partners share with their customers. &#8220;We are committed to ensuring everyone receives their pay as timely and as accurately as possible. For this payroll period, we will use estimates from the last available payroll period. Once the software platform is back online, we will perform a reconciliation and correct any discrepancies as soon as possible.&#8221;</p>
<p><strong>Jacob Cloran</strong> is co-founder of <a href="https://www.getdecimal.com" target="_blank" rel="noopener">Decimal</a>, a company that does accounting for small businesses, many of whom rely on PEOs affected by the PrismHR outage. Decimal itself uses a PEO that relies on PrismHR.</p>
<p>&#8220;We don&#8217;t have a good option to run our payroll this week, and the message we&#8217;ve received from our PEO doesn&#8217;t give me a lot of confidence we&#8217;ll be able to do that,&#8221; Cloran said.</p>
<p>Cloran said while there are other cloud-based companies that work with multiple PEOs, PrismHR is by far the largest.</p>
<p>&#8220;Prism is the only real option on the PEO software market,&#8221; he said. &#8220;Everyone I know who has tried any of the others ends up back at Prism. It&#8217;s the best of all bad available options.&#8221;<span id="more-54543"></span></p>
<p>PrismHR did not specify what was responsible for the suspicious network activity, but their actions so far are straight out of the textbook recommendations for responding to a ransomware outbreak. A notice from the PEO working with some of Cloran&#8217;s clients stated that PrismHR was in the process of rebuilding its entire system from data backups in a new environment.</p>
<p>Also, the crooks behind ransomware attacks typically wait until the weekend to unleash their malware within victim organizations, knowing that most targets will be short-staffed or out of the office at this time. PrismHR said it detected the activity on Sunday.</p>
<p>Ransomware victims perhaps in the toughest spot include those providing cloud data hosting and software-as-service offerings, as these businesses are often unable to serve their customers while a ransomware infestation is active.</p>
<p>Ransomware renders any files it touches unreadable unless and until a victim pays for a digital key needed to unlock the encryption on them. Worse, it has become almost a best practice among ransomware criminal groups to steal as much data as possible from the victim organization prior to unleashing the ransom malware within a target environment.</p>
<p>Some of that data is often then published on dark web victim shaming sites in a bid to force the victim company into paying up. Some companies victimized by ransomware even face dual ransom demands: One for a digital key needed to unlock access to files, and a second payment in exchange for a promise not to publish all of the stolen data. Those that refuse to be extorted are told to expect that huge amounts of sensitive company data will be published online or sold on the dark web (or both).</p>
<p>PrismHR said in a statement to its PEO customers that while its investigation and response to the incident is ongoing, the company &#8220;is not aware of any sensitive data being breached or compromised.&#8221;</p>
<p>Given the volume and sensitive nature of the data PrismHR managed on behalf of PEO clients, it&#8217;s no doubt those clients and their customers are hoping that statement is accurate as well.</p>


feed_id: https://krebsonsecurity.com/?p=54566
title: Microsoft: Chinese Cyberspies Used 4 Exchange Server Flaws to Plunder Emails
uri: Microsoft-Chinese-Cyberspies-Used-4-Exchange-Server-Flaws-to-Plunder
url:
https://krebsonsecurity.com/2021/03/microsoft-chinese-cyberspies-used-4-exchange-server-flaws-to-plunder-emails/

content:
<p><strong>Microsoft Corp.</strong> today released software updates to plug four security holes that attackers have been using to plunder email communications at companies that use its <strong>Exchange Server</strong> products. The company says all four flaws are being actively exploited as part of a complex attack chain deployed by a previously unidentified Chinese cyber espionage group.</p>
<p><img loading="lazy" class="aligncenter wp-image-54572" src="media/5315fb8a.exchange.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/03/exchange.png" alt="" width="595" height="201" srcset="https://krebsonsecurity.com/wp-content/uploads/2021/03/exchange.png 1072w, https://krebsonsecurity.com/wp-content/uploads/2021/03/exchange-768x259.png 768w" sizes="(max-width: 595px) 100vw, 595px" /></p>
<p>The software giant typically releases security updates on the second Tuesday of each month, but it occasionally deviates from that schedule when addressing active attacks that target newly identified and serious vulnerabilities in its products.</p>
<p>The patches released today fix security problems in <strong>Microsoft Exchange Server 2013</strong>, <strong>2016</strong> and <strong>2019</strong>. Microsoft said its <strong>Exchange Online</strong> service &#8212; basically hosted email for businesses &#8212; is not impacted by these flaws.</p>
<p>Microsoft credited researchers at Reston, Va. based <a href="https://www.volexity.com/blog/2021/03/02/active-exploitation-of-microsoft-exchange-zero-day-vulnerabilities/" target="_blank" rel="noopener">Volexity</a> for reporting the attacks. Volexity <strong>President Steven Adair</strong> told KrebsOnSecurity it first spotted the attacks on Jan. 6, 2021.</p>
<p>Adair said while the exploits used by the group may have taken great skills to develop, they require little technical know-how to use and can give an attacker easy access to all of an organization&#8217;s email if their vulnerable Exchange Servers are directly exposed to the Internet.</p>
<p>&#8220;These flaws are very easy to exploit,&#8221; Adair said. &#8220;You don&#8217;t need any special knowledge with these exploits. You just show up and say &#8216;I would like to break in and read all their email.&#8217; That&#8217;s all there is to it.&#8221;<span id="more-54566"></span></p>
<p>Microsoft says the flaws are being used by a previously unknown Chinese espionage group that&#8217;s been dubbed &#8220;<strong>Hafnium</strong>,&#8221; which is known to launch its attacks using hosting companies based in the United States.</p>
<p>&#8220;Hafnium primarily targets entities in the United States across a number of industry sectors, including infectious disease researchers, law firms, higher education institutions, defense contractors, policy think tanks, and NGOs,&#8221; Microsoft said. &#8220;HAFNIUM has previously compromised victims by exploiting vulnerabilities in internet-facing servers. Once they’ve gained access to a victim network, HAFNIUM typically exfiltrates data to file sharing sites like MEGA.&#8221;</p>
<p>According to Microsoft, Hafnium attackers have been observed combining all four zero-day flaws to target organizations running vulnerable Exchange Server products.</p>
<p><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-26855" target="_blank" rel="noopener">CVE-2021-26855</a> is a &#8220;server-side request forgery&#8221; (SSRF) flaw, in which a server (in this case, an on-premises Exchange Server) can be tricked into running commands that it should never have been permitted to run, such as authenticating as the Exchange server itself.</p>
<p>The attackers used <a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-26857" target="_blank" rel="noopener">CVE-2021-26857</a> to run code of their choice under the &#8220;system&#8221; account on a targeted Exchange server. The other two zero-day flaws &#8212; <a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-26858" target="_blank" rel="noopener">CVE-2021-26858</a> and <a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-27065" target="_blank" rel="noopener">CVE-2021-27065</a> &#8212; could allow an attacker to write a file to any part of the server.</p>
<p>After exploiting these vulnerabilities to gain initial access, Hafnium operators deployed web shells on the compromised server, Microsoft said. Web shells are essentially software backdoors that allow attackers to steal data and perform additional malicious actions that lead to further compromise.</p>
<p>Neither Microsoft nor Volexity is aware of publicly available code that would allow other cybercriminals to exploit these Exchange vulnerabilities. But given that these attacks are in the wild now, it may only be a matter of days before exploit code is publicly available online.</p>
<p>Microsoft stressed that the exploits detailed today were in no way connected to the <a href="https://krebsonsecurity.com/?s=solar+winds&amp;x=0&amp;y=0" target="_blank" rel="noopener">separate SolarWinds-related attacks</a>. &#8220;We continue to see no evidence that the actor behind SolarWinds discovered or exploited any vulnerability in Microsoft products and services,&#8221; the company said.</p>
<p>Further reading:</p>
<p><a href="https://blogs.microsoft.com/on-the-issues/2021/03/02/new-nation-state-cyberattacks/" target="_blank" rel="noopener">Microsoft&#8217;s writeup on new Hafnium nation state cyberattacks</a></p>
<p><a href="https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/" target="_blank" rel="noopener">Microsoft technical advisory on the four Exchange Server flaws</a></p>


feed_id: https://krebsonsecurity.com/?p=54587
title: Three Top Russian Cybercrime Forums Hacked
uri: Three-Top-Russian-Cybercrime-Forums-Hacked
url: https://krebsonsecurity.com/2021/03/three-top-russian-cybercrime-forums-hacked/
content:
<p>Over the past few weeks, three of the longest running and most venerated Russian-language online forums serving thousands of experienced cybercriminals have been hacked. In two of the intrusions, the attackers made off with the forums&#8217; user databases, including email and Internet addresses and hashed passwords.</p>
<div id="attachment_54593" style="width: 606px" class="wp-caption aligncenter"><a href="media/670fbbe1.mazaleak.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/03/mazaleak.png"><img aria-describedby="caption-attachment-54593" loading="lazy" class="wp-image-54593" src="media/670fbbe1.mazaleak.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/03/mazaleak.png" alt="" width="596" height="481" srcset="https://krebsonsecurity.com/wp-content/uploads/2021/03/mazaleak.png 943w, https://krebsonsecurity.com/wp-content/uploads/2021/03/mazaleak-768x620.png 768w" sizes="(max-width: 596px) 100vw, 596px" /></a><p id="caption-attachment-54593" class="wp-caption-text">References to the leaked Mazafaka crime forum database were posted online in the past 48 hours.</p></div>
<p>On Tuesday, someone dumped thousands of usernames, email addresses and obfuscated passwords on the dark web apparently pilfered from <strong>Mazafaka</strong> (a.k.a. &#8220;<strong>Maza</strong>,&#8221; &#8220;<strong>MFclub</strong>&#8220;), an exclusive crime forum that has for more than a decade played host to some of the most experienced and infamous Russian cyberthieves.</p>
<p>At the top of a 35-page PDF leaked online is a private encryption key allegedly used by Maza administrators. The database also includes ICQ numbers for many users. ICQ, also known as &#8220;I seek you,&#8221; was an instant message platform trusted by countless early denizens of these older crime forums before its use fell out of fashion in favor of more private networks, such as <strong>Jabber</strong> and <strong>Telegram</strong>.</p>
<p>This is notable because ICQ numbers tied to specific accounts often are a reliable data point that security researchers can use to connect multiple accounts to the same user across many forums and different nicknames over time.</p>
<p>Cyber intelligence firm <a href="https://www.intel471.com" target="_blank" rel="noopener">Intel 471</a> assesses that the leaked Maza database is legitimate, and that the file includes more than 3,000 rows containing usernames, partially obfuscated password hashes, email addresses and other contact details.</p>
<p>&#8220;The file comprised more than 3,000 rows, containing usernames, partially obfuscated password hashes, email addresses and other contact details,&#8221; Intel 471 found, noting that Maza forum visitors are now redirected to a breach announcement page. &#8220;Initial analysis of the leaked data pointed to its probable authenticity, as at least a portion of the leaked user records correlated with our own data holdings.&#8221;</p>
<p>The attack on Maza comes just weeks after another major Russian crime forum got plundered. On Jan. 20, a longtime administrator of the Russian language forum <strong>Verified </strong>disclosed that the community&#8217;s domain registrar had been hacked, and that the site&#8217;s domain was redirected to an Internet server the attackers controlled.</p>
<div id="attachment_54594" style="width: 604px" class="wp-caption aligncenter"><a href="media/4a979aba.verifiedhack.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/03/verifiedhack.png"><img aria-describedby="caption-attachment-54594" loading="lazy" class="wp-image-54594" src="media/4a979aba.verifiedhack.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/03/verifiedhack.png" alt="" width="594" height="289" srcset="https://krebsonsecurity.com/wp-content/uploads/2021/03/verifiedhack.png 1562w, https://krebsonsecurity.com/wp-content/uploads/2021/03/verifiedhack-768x374.png 768w, https://krebsonsecurity.com/wp-content/uploads/2021/03/verifiedhack-1536x747.png 1536w" sizes="(max-width: 594px) 100vw, 594px" /></a><p id="caption-attachment-54594" class="wp-caption-text">A note posted by a Verified forum administrator concerning the hack of its registrar in January.</p></div>
<blockquote><p>&#8220;Our [bitcoin] wallet has been cracked. Luckily, we did not keep large amounts in it, but this is an unpleasant incident anyway. Once the circumstances became clear, the admin assumed that THEORETICALLY, all the forum&#8217;s accounts could have been compromised (the probability is low, but it is there). In our business, it&#8217;s better to play safe. So, we&#8217;ve decided to reset everyone&#8217;s codes. This is not a big deal. Simply write them down and use them from now on.&#8221;</p></blockquote>
<p>A short time later, the administrator updated his post, saying:</p>
<blockquote><p>&#8220;We are getting messages that the forum&#8217;s databases were filched after all when the forum was hacked. Everyone&#8217;s account passwords were forcibly reset. Pass this information to people you know. The forum was hacked through the domain registrar. The registrar was hacked first, then domain name servers were changed, and traffic was sniffed.&#8221;</p></blockquote>
<p>On Feb. 15, the administrator posted a message purportedly sent on behalf of the intruders, who claimed they hacked Verified&#8217;s domain registrar between Jan. 16 and 20.</p>
<blockquote><p>&#8220;It should be clear by now that the forum administration did not do an acceptable job with the security of this whole thing,&#8221; the attacker explained. &#8220;Most likely just out of laziness or incompetence, they gave up the whole thing. But the main surprise for us was that they saved all the user data, including cookies, referrers, ip addresses of the first registrations, login analytics, and everything else.&#8221;</p></blockquote>
<p>The compromise of Maza and Verified &#8212; and possibly a third major forum &#8212; has many community members concerned that their real-life identities could be exposed. <strong>Exploit</strong> &#8212; perhaps the next-largest and most popular Russian forum after Verified, also experienced an apparent compromise this week.<span id="more-54587"></span></p>
<p>According to Intel 471, on March 1, 2021, the administrator of the Exploit cybercrime forum claimed that a proxy server the forum used for protection from distributed denial-of-service (DDoS) attacks might have been compromised by an unknown party. The administrator stated that on Feb. 27, 2021, a monitoring system detected unauthorized secure shell access to the server and an attempt to dump network traffic.</p>
<p>Some forum lurkers have speculated that these recent compromises feel like the work of some government spy agency.</p>
<p>&#8220;Only intelligence services or people who know where the servers are located can pull off things like that,&#8221; mused one mainstay of Exploit. &#8220;Three forums in one month is just weird. I don&#8217;t think those were regular hackers. Someone is purposefully ruining forums.&#8221;</p>
<p>Others are wondering aloud which forum will fall next, and bemoaning the loss of trust among users that could be bad for business.</p>
<p>&#8220;Perhaps they work according to the following logic,&#8221; wrote one Exploit user. &#8220;There will be no forums, there will be no trust between everyone, less cooperation, more difficult to find partners &#8211; fewer attacks.&#8221;</p>


feed_id: https://krebsonsecurity.com/?p=54608
title: At Least 30,000 U.S. Organizations Newly Hacked Via Holes in Microsoft’s Email Software
uri: At-Least-30-000-U-S-Organizations-Newly-Hacked-Via-Holes-in-Microsoft
url:
https://krebsonsecurity.com/2021/03/at-least-30000-u-s-organizations-newly-hacked-via-holes-in-microsofts-email-software/

content:
<p>At least 30,000 organizations across the United States &#8212; including a significant number of small businesses, towns, cities and local governments &#8212; have over the past few days been hacked by an unusually aggressive Chinese cyber espionage unit that&#8217;s focused on stealing email from victim organizations, multiple sources tell KrebsOnSecurity. The espionage group is exploiting four newly-discovered flaws in <strong>Microsoft Exchange Server</strong> email software, and has seeded hundreds of thousands of victim organizations worldwide with tools that give the attackers total, remote control over affected systems.</p>
<p><img loading="lazy" class="aligncenter wp-image-54572" src="media/5315fb8a.exchange.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/03/exchange.png" alt="" width="592" height="200" srcset="https://krebsonsecurity.com/wp-content/uploads/2021/03/exchange.png 1072w, https://krebsonsecurity.com/wp-content/uploads/2021/03/exchange-768x259.png 768w" sizes="(max-width: 592px) 100vw, 592px" /></p>
<p>On March 2, Microsoft <a href="https://krebsonsecurity.com/2021/03/microsoft-chinese-cyberspies-used-4-exchange-server-flaws-to-plunder-emails/" target="_blank" rel="noopener">released emergency security updates</a> to plug four security holes in Exchange Server versions 2013 through 2019 that hackers were actively using to siphon email communications from Internet-facing systems running Exchange.</p>
<p>In the three days since then, security experts say the same Chinese cyber espionage group has dramatically stepped up attacks on any vulnerable, unpatched Exchange servers worldwide.</p>
<p>In each incident, the intruders have left behind a &#8220;web shell,&#8221; an easy-to-use, password-protected hacking tool that can be accessed over the Internet from any browser. The web shell gives the attackers administrative access to the victim&#8217;s computer servers.</p>
<p>Speaking on condition of anonymity, two cybersecurity experts who&#8217;ve briefed U.S. national security advisors on the attack told KrebsOnSecurity the Chinese hacking group thought to be responsible has seized control over &#8220;hundreds of thousands&#8221; of Microsoft Exchange Servers worldwide &#8212; with each victim system representing approximately one organization that uses Exchange to process email.</p>
<p>Microsoft said the Exchange flaws are being targeted by a previously unidentified Chinese hacking crew it dubbed &#8220;<a href="https://blogs.microsoft.com/on-the-issues/2021/03/02/new-nation-state-cyberattacks/" target="_blank" rel="noopener">Hafnium</a>,&#8221; and said the group had been conducting targeted attacks on email systems used by a range of industry sectors, including infectious disease researchers, law firms, higher education institutions, defense contractors, policy think tanks, and NGOs.</p>
<p>Microsoft&#8217;s <a href="https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/" target="_blank" rel="noopener">initial advisory about the Exchange flaws</a> credited Reston, Va. based<a href="https://www.volexity.com" target="_blank" rel="noopener"> Volexity </a>for reporting the vulnerabilities. Volexity President <strong>Steven Adair</strong> said the company first saw attackers quietly exploiting the Exchange bugs on Jan. 6, 2021, a day when most of the world was glued to television coverage of the riot at the U.S. Capitol.</p>
<p>But Adair said that over the past few days the hacking group has shifted into high gear, moving quickly to scan the Internet for Exchange servers that weren&#8217;t yet protected by those security updates.</p>
<p>&#8220;We&#8217;ve worked on dozens of cases so far where web shells were put on the victim system back on Feb. 28 [before Microsoft announced its patches], all the way up to today,&#8221; Adair said. &#8220;Even if you patched the same day Microsoft published its patches, there&#8217;s still a high chance there is a web shell on your server. The truth is, if you&#8217;re running Exchange and you haven&#8217;t patched this yet, there&#8217;s a very high chance that your organization is already compromised.&#8221;</p>
<p>Reached for comment, Microsoft said it is working closely with the <strong>U.S. Cybersecurity &amp; Infrastructure Security Agency</strong> (CISA), other government agencies, and security companies, to ensure it is providing the best possible guidance and mitigation for its customers.</p>
<p>&#8220;The best protection is to apply updates as soon as possible across all impacted systems,&#8221; a Microsoft spokesperson said in a written statement. &#8220;We continue to help customers by providing additional investigation and mitigation guidance. Impacted customers should contact our support teams for additional help and resources.&#8221;</p>
<p>Adair said he&#8217;s fielded dozens of calls today from state and local government agencies that have identified the backdoors in their Exchange servers and are pleading for help. The trouble is, patching the flaws only blocks the four different ways the hackers are using to get in. But it does nothing to undo the damage that may already have been done.</p>
<div id="attachment_54640" style="width: 609px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-54640" loading="lazy" class=" wp-image-54640" src="media/c5f5bbb7.chriskrebstweet.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/03/chriskrebstweet.png" alt="" width="599" height="329" /><p id="caption-attachment-54640" class="wp-caption-text">A tweet from Chris Krebs, former director of the Cybersecurity &amp; Infrastructure Security Agency, responding to a tweet from White House National Security Advisor Jake Sullivan.</p></div>
<p><span id="more-54608"></span></p>
<p>By all accounts, rooting out these intruders is going to require an unprecedented and urgent nationwide clean-up effort. Adair and others say they&#8217;re worried that the longer it takes for victims to remove the backdoors, the more likely it is that the intruders will follow up by installing additional backdoors, and perhaps broadening the attack to include other portions of the victim&#8217;s network infrastructure.</p>
<p>Security researchers have published a tool on Microsoft&#8217;s Github code repository that lets anyone scan the Internet for Exchange servers that have been infected with the backdoor shell.</p>
<p>KrebsOnSecurity has seen portions of a victim list compiled by running this tool, and it is not a pretty picture. The backdoor web shell is verifiably present on the networks of thousands of U.S. organizations, including banks, credit unions, non-profits, telecommunications providers, public utilities and police, fire and rescue units.</p>
<p>&#8220;It&#8217;s police departments, hospitals, tons of city and state governments and credit unions,&#8221; said one source who&#8217;s working closely with federal officials on the matter. &#8220;Just about everyone who&#8217;s running self-hosted Outlook Web Access and wasn&#8217;t patched as of a few days ago got hit with a zero-day attack.&#8221;</p>
<p>Another government cybersecurity expert who participated in a recent call with multiple stakeholders impacted by this hacking spree worries the cleanup effort required is going to be Herculean.</p>
<p>&#8220;On the call, many questions were from school districts or local governments that all need help,&#8221; the source said, speaking on condition they were not identified by name. &#8220;If these numbers are in the tens of thousands, how does incident response get done? There are just not enough incident response teams out there to do that quickly.&#8221;</p>
<p>When it released patches for the four Exchange Server flaws on Tuesday, Microsoft emphasized that the vulnerability did not affect customers running its Exchange Online service (Microsoft&#8217;s cloud-hosted email for businesses). But sources say the vast majority of the organizations victimized so far are running some form of Internet-facing Microsoft Outlook Web Access (OWA) email systems in tandem with Exchange servers internally.</p>
<p>&#8220;It&#8217;s a question worth asking, what&#8217;s Microsoft&#8217;s recommendation going to be?,&#8221; the government cybersecurity expert said. &#8220;They&#8217;ll say &#8216;Patch, but it&#8217;s better to go to the cloud.&#8217; But how are they securing their non-cloud products? Letting them wither on the vine.&#8221;</p>
<p>The government cybersecurity expert said this most recent round of attacks is uncharacteristic of the kinds of nation-state level hacking typically attributed to China, which tends to be fairly focused on compromising specific strategic targets.</p>
<p>&#8220;Its reckless,&#8221; the source said. &#8220;It seems out of character for Chinese state actors to be this indiscriminate.&#8221;</p>
<p>Microsoft has said the incursions by Hafnium on vulnerable Exchange servers are in no way connected to the separate <a href="https://krebsonsecurity.com/?s=solar+winds&amp;x=0&amp;y=0" target="_blank" rel="noopener">SolarWinds-related attacks</a>, in which a suspected Russian intelligence group installed backdoors in network management software used by more than 18,000 organizations.</p>
<p>“We continue to see no evidence that the actor behind SolarWinds discovered or exploited any vulnerability in Microsoft products and services,” the company said.</p>
<p>Nevertheless, the events of the past few days may well end up far eclipsing the damage done by the SolarWinds intruders.</p>
<p>This is a fast-moving story, and likely will be updated multiple times throughout the day. Stay tuned.</p>


feed_id: https://krebsonsecurity.com/?p=54660
title: A Basic Timeline of the Exchange Mass-Hack
uri: A-Basic-Timeline-of-the-Exchange-Mass-Hack
url: https://krebsonsecurity.com/2021/03/a-basic-timeline-of-the-exchange-mass-hack/
content:
<p>Sometimes when a complex story takes us by surprise or knocks us back on our heels, it pays to revisit the events in a somewhat linear fashion. Here&#8217;s a brief timeline of what we know leading up to last week&#8217;s mass-hack, when hundreds of thousands of <strong>Microsoft Exchange Server</strong> systems <a href="https://krebsonsecurity.com/2021/03/at-least-30000-u-s-organizations-newly-hacked-via-holes-in-microsofts-email-software/" target="_blank" rel="noopener">got compromised and seeded with a powerful backdoor Trojan horse program</a>.</p>
<p><strong>When did Microsoft find out about attacks on previously unknown vulnerabilities in Exchange?</strong></p>
<p>Pressed for a date when it first became aware of the problem, Microsoft told KrebsOnSecurity it was initially notified &#8220;in early January.&#8221; So far the earliest known report came on Jan. 5, from a principal security researcher for security testing firm <a href="https://devco.re/en/" target="_blank" rel="noopener">DEVCOR</a> who goes by the handle &#8220;<a href="https://twitter.com/orange_8361" target="_blank" rel="noopener">Orange Tsai</a>.&#8221; DEVCOR is credited with reporting two of the four Exchange flaws that <a href="https://krebsonsecurity.com/2021/03/microsoft-chinese-cyberspies-used-4-exchange-server-flaws-to-plunder-emails/" target="_blank" rel="noopener">Microsoft patched on Mar. 2</a>.</p>
<p><img loading="lazy" class="aligncenter wp-image-54677" src="media/9e11d583.orangetsai.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/03/orangetsai.png" alt="" width="595" height="224" /></p>
<p>Reston, Va.-based <a href="https://www.volexity.com" target="_blank" rel="noopener">Volexity</a> first identified attacks on the flaws on Jan. 6, and officially informed Microsoft about it on Feb. 2. Volexity now says it can see attack traffic going back to Jan. 3. Microsoft credits Volexity with reporting the same two Exchange flaws as DEVCOR.</p>
<p>Danish security firm <a href="https://www.dubex.com" target="_blank" rel="noopener">Dubex</a> says it first saw clients hit on Jan. 18, and reported their incident response findings to Microsoft on Jan. 27.</p>
<p>In a blog post on their discovery, <a href="https://www.dubex.dk/aktuelt/nyheder/please-leave-an-exploit-after-the-beep" target="_blank" rel="noopener">Please Leave an Exploit After the Beep</a>, Dubex said the victims it investigated in January had a &#8220;web shell&#8221; backdoor installed via the &#8220;unifying messaging&#8221; module, a component of Exchange that allows an organization to store voicemail and faxes along with emails, calendars, and contacts in users&#8217; mailboxes.</p>
<p>&#8220;A unified messaging server also allows users access to voicemail features via smartphones, Microsoft Outlook and Outlook Web App,&#8221; Dubex wrote. &#8220;Most users and IT departments manage their voicemail separately from their email, and voicemail and email exist as separate inboxes hosted on separate servers. Unified Messaging offers an integrated store for all messages and access to content through the computer and the telephone.&#8221;</p>
<p>Dubex says Microsoft &#8220;escalated&#8221; their issue on Feb. 8, but never confirmed the zero-day with Dubex prior to the emergency patch plea on Mar. 2. &#8220;We never got a &#8216;real&#8217; confirmation of the zero-day before the patch was released,&#8221; said Dubex&#8217;s<strong> Chief Technology Officer Jacob Herbst</strong>.</p>
<p><strong>How long have the vulnerabilities exploited here been around?</strong></p>
<p>On Mar. 2, Microsoft patched four flaws in Exchange Server 2013 through 2019. Exchange Server 2010 is no longer supported, but the software giant made a &#8220;defense in depth&#8221; exception and gave Server 2010 users a freebie patch, too. That means the vulnerabilities the attackers exploited have been in the Microsoft Exchange Server code base for more than ten years.</p>
<p>The timeline also means Microsoft had almost two months to push out the patch it ultimately shipped Mar. 2, or else help hundreds of thousands of Exchange customers mitigate the threat from this flaw before attackers started exploiting it indiscriminately.</p>
<p><img loading="lazy" class="aligncenter wp-image-54572" src="media/5315fb8a.exchange.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/03/exchange.png" alt="" width="598" height="202" srcset="https://krebsonsecurity.com/wp-content/uploads/2021/03/exchange.png 1072w, https://krebsonsecurity.com/wp-content/uploads/2021/03/exchange-768x259.png 768w" sizes="(max-width: 598px) 100vw, 598px" /></p>
<p><strong>Here&#8217;s a rough timeline as we know it so far:</strong><span id="more-54660"></span></p>
<ul>
<li><strong>Jan. 5:</strong> DEVCOR alerts Microsoft of its findings.</li>
<li><strong>Jan. 6:</strong> Volexity spots attacks that use unknown vulnerabilities in Exchange.</li>
<li><strong>Jan. 8:</strong> DEVCOR reports Microsoft had reproduced the problems and verified their findings.</li>
<li><strong>Jan. 11:</strong> DEVCOR snags <a href="https://proxylogon.com/" target="_blank" rel="noopener">proxylogon.com</a>, a domain now used to explain its vulnerability discovery process.</li>
<li><strong>Jan. 27:</strong> Dubex alerts Microsoft about attacks on a new Exchange flaw.</li>
<li><strong>Jan. 29:</strong> <strong>Trend Micro</strong> publishes <a href="https://www.trendmicro.com/en_us/research/21/a/targeted-attack-using-chopper-aspx-web-shell-exposed-via-managed.html" target="_blank" rel="noopener">a blog post</a> about &#8220;<strong>Chopper</strong>&#8221; web shells being dropped via Exchange flaws.</li>
<li><strong>Feb. 2:</strong> Volexity warns Microsoft about active attacks on previously unknown Exchange vulnerabilities.</li>
<li><strong>Feb. 8:</strong> Microsoft tells Dubex it has &#8220;escalated&#8221; its report internally.</li>
<li><strong>Feb. 18:</strong> Microsoft confirms with DEVCOR a target date of Mar. 9 (tomorrow) for publishing security updates for the Exchange flaws. That is the second Tuesday of the month &#8212; a.k.a. &#8220;<strong>Patch Tuesday</strong>,&#8221; when Microsoft releases monthly security updates (and yes that means check back here tomorrow for the always riveting <a href="https://krebsonsecurity.com/?s=patch+tuesday&amp;x=0&amp;y=0" target="_blank" rel="noopener">Patch Tuesday roundup</a>).</li>
<li><strong>Feb. 26-27:</strong> Targeted exploitation gradually turns into a global mass-scan; attackers start rapidly backdooring vulnerable servers.</li>
<li><strong>Mar. 2:</strong> A week earlier than previously planned, Microsoft releases updates to plug 4 zero-day flaws.</li>
<li><strong>Mar. 3:</strong> Tens of thousands of Exchange servers compromised worldwide, with thousands more servers getting freshly hacked each hour.</li>
<li><strong>Mar. 5:</strong> KrebsOnSecurity <a href="https://krebsonsecurity.com/2021/03/at-least-30000-u-s-organizations-newly-hacked-via-holes-in-microsofts-email-software/" target="_blank" rel="noopener">breaks the news</a> that at least 30,000 organizations in the U.S. &#8212; and hundreds of thousands worldwide &#8212; now have backdoors installed.</li>
<li><strong>Mar. 5:</strong> Wired.com confirms the reported number of victims. White House makes statement expressing concern over the size of the attack. Former CISA head <strong>Chris Krebs</strong> tweets the numbers are bigger than what&#8217;s been reported.</li>
<li><strong>Mar. 6:</strong> CISA says it is aware of &#8220;widespread domestic and international exploitation of Microsoft Exchange Server flaws.&#8221;</li>
<li><strong>Mar. 7-Present:</strong> Security experts continue effort to notify victims, coordinate remediation, and remain vigilant for &#8220;Stage 2&#8221; of this attack (further exploitation of already-compromised servers).</li>
</ul>


feed_id: https://krebsonsecurity.com/?p=54668
title: Warning the World of a Ticking Time Bomb
uri: Warning-the-World-of-a-Ticking-Time-Bomb
url: https://krebsonsecurity.com/2021/03/warning-the-world-of-a-ticking-time-bomb/
content:
<p>Globally, hundreds of thousand of organizations running Exchange email servers from Microsoft just got mass-hacked, including at least 30,000 victims in the United States. Each hacked server has been retrofitted with a &#8220;web shell&#8221; backdoor that gives the bad guys total, remote control, the ability to read all email, and easy access to the victim&#8217;s other computers. Researchers are now racing to identify, alert and help victims, and hopefully prevent further mayhem.</p>
<p><img loading="lazy" class="aligncenter wp-image-54723" src="media/9e35c485.worldclock.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/03/worldclock.png" alt="" width="598" height="317" /></p>
<p>On Mar. 5, KrebsOnSecurity broke the news that <a href="https://krebsonsecurity.com/2021/03/at-least-30000-u-s-organizations-newly-hacked-via-holes-in-microsofts-email-software/" target="_blank" rel="noopener">at least 30,000 organizations and hundreds of thousands globally had been hacked</a>. The same sources who shared those figures say the victim list has grown considerably since then, with many victims compromised by multiple cybercrime groups.</p>
<p>Security experts are now trying to alert and assist these victims before malicious hackers launch what many refer to with a mix of dread and anticipation as &#8220;Stage 2,&#8221; when the bad guys revisit all these hacked servers and seed them with ransomware or else additional hacking tools for crawling even deeper into victim networks.</p>
<p>But that rescue effort has been stymied by the sheer volume of attacks on these Exchange vulnerabilities, and by the number of apparently distinct hacking groups that are vying for control over vulnerable systems.</p>
<p>A security expert who has briefed federal and military advisors on the threat says many victims appear to have more than one type of backdoor installed. Some victims had three of these web shells installed. One was pelted with eight distinct backdoors. This initially caused a major overcount of potential victims, and required a great deal of de-duping various victim lists.</p>
<p>The source, who spoke on condition of anonymity, said many in the cybersecurity community recently saw a large spike in attacks on thousands of Exchange servers that was later linked to a profit-motivated cybercriminal group.</p>
<p>&#8220;What we thought was Stage 2 actually was one criminal group hijacking like 10,000 exchange servers,&#8221; said one source who&#8217;s briefed U.S. national security advisors on the outbreak.</p>
<p>On Mar. 2, <a href="https://krebsonsecurity.com/2021/03/microsoft-chinese-cyberspies-used-4-exchange-server-flaws-to-plunder-emails/" target="_blank" rel="noopener">when Microsoft released updates to plug the four Exchange flaws being attacked</a>, it attributed the hacking activity to a previously unidentified Chinese cyber espionage group it called &#8220;Hafnium.&#8221; Microsoft said Hafnium had been using the Exchange flaws to conduct a series of low-and-slow attacks against specific strategic targets, such as non-governmental organization (NGOs) and think tanks.</p>
<p>But by Feb. 26, that relatively stealthy activity was morphing into the indiscriminate mass-exploitation of all vulnerable Exchange servers. That means even Exchange users that patched the same day Microsoft released security updates may have had servers seeded with backdoors.</p>
<p>Many experts who spoke to KrebsOnSecurity said they believe different cybercriminal groups somehow learned of Microsoft&#8217;s plans to ship fixes for the Exchange flaws a week earlier than they&#8217;d hoped (Microsoft <a href="https://krebsonsecurity.com/2021/03/a-basic-timeline-of-the-exchange-mass-hack/" target="_blank" rel="noopener">originally targeted today</a>, Patch Tuesday, as the release date).</p>
<p>The vulnerability scanning activity also ramped up markedly after Microsoft released its updates on Mar. 2. Security researchers love to tear apart patches for clues about the underlying security holes, and one major concern is that various cybercriminal groups may have already worked out how to exploit the flaws independently.</p>
<h4>AVERTING MASS-RANSOMWARE</h4>
<p>Security experts now are desperately trying to reach tens of thousands of victim organizations with a single message: Whether you have patched yet or have been hacked, <em>backup any data stored on those servers immediately.</em></p>
<p>Every source I&#8217;ve spoken with about this incident says they fully expect profit-motivated cybercriminals to pounce on victims by mass-deploying ransomware. Given that so many groups now have backdoor web shells installed, it would be trivial to unleash ransomware on the lot of them in one go. Also, compromised Exchange servers can be a virtual doorway into the rest of the victim&#8217;s network.</p>
<p>&#8220;With the number of different threat actors dropping [web] shells on servers increasing, ransomware is inevitable,&#8221; said <strong>Allison Nixon</strong>, chief research officer at <a href="https://www.unit221b.com" target="_blank" rel="noopener">Unit221B</a>, a New York City-based cyber investigations firm.</p>
<p>So far there are no signs of victims of this mass-hack being ransomed. But that may well change if the exploit code used to break into these vulnerable Exchange servers goes public. And nobody I&#8217;ve interviewed seems to think working exploit code is going to stay unpublished for much longer.</p>
<p>When that happens, the exploits will get folded into publicly available exploit testing kits, effectively making it simple for any attacker to find and compromise a decent number of victims who haven&#8217;t already patched.<span id="more-54668"></span></p>
<h4>CHECK MY OWA</h4>
<p>Nixon is part of a group of security industry leaders who are contributing data and time to a new victim notification platform online called <a href="https://checkmyowa.unit221b.com" target="_blank" rel="noopener">Check My OWA</a> (Outlook Web Access, the Internet-facing Web component of Exchange Server machines).</p>
<div id="attachment_54731" style="width: 607px" class="wp-caption aligncenter"><a href="media/b5ca0989.owaowned.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/03/owaowned.png"><img aria-describedby="caption-attachment-54731" loading="lazy" class="wp-image-54731" src="media/b5ca0989.owaowned.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/03/owaowned.png" alt="" width="597" height="203" /></a><p id="caption-attachment-54731" class="wp-caption-text">Checkmyown.unit221b.com checks if your Exchange Server domain showed up in attack logs or lists of known-compromised domains.</p></div>
<p>Perhaps it&#8217;s better to call it a self-notification service that is operated from Unit221B&#8217;s own web site. It draws on tens of thousands of data points that various ISPs and hosting firms have tied to victims around the world who are likely compromised by the backdoor shells. The data comes from large networks watching the sources and targets of mass-scans for vulnerable Exchange servers.</p>
<p>&#8220;Our goal is to motivate people who we might otherwise have never been able to contact,&#8221; Nixon said. &#8220;My hope is if this site can get out there, then there&#8217;s a chance some victim companies are notified and take action or can get attention.&#8221;</p>
<p>Enter an email address at Check My OWA, and if that address matches a domain name for a victim organization, that email address will get a notice.</p>
<p>If the email&#8217;s domain name (anything to the right of the @ sign) is detected in their database, the site will send that user an email stating that is has observed the email domain in a list of targeted domains.</p>
<blockquote><p>&#8220;Malicious actors were able to successfully compromise, and some of this information suggested they may have been able to install a webshell on an Exchange server associated with this domain,&#8221; reads one of the messages to victims. &#8220;We strongly recommend saving an offline backup of your Exchange server’s emails immediately, and refer back to the site for additional information on patching and remediation.&#8221;</p></blockquote>
<p>Other Exchange users may see this message:</p>
<blockquote><p>&#8220;We have observed your e-mail domain appears in our list of domains the malicious actors were able to successfully compromise, and some of this information suggested they may have been able to install a webshell on an Exchange server associated with this domain,&#8221; is another message the site may return. We strongly recommend saving an offline backup of your Exchange server’s emails immediately, and refer back to the site for additional information on patching and remediation.&#8221;</p></blockquote>
<p>Nixon said Exchange users can save themselves a potentially nightmarish scenario if they just back up any affected systems now. And given the number of adversaries currently attacking still-unpatched Exchange systems, there is almost no way this won&#8217;t end in disaster for at least some victims.</p>
<p>&#8220;There are researchers running honeypots to [attract] attacks from different groups, and those honeypots are getting shelled left and right,&#8221; she said. &#8220;The sooner they can run a backup, the better. This can help save a lot of heartache.&#8221;</p>
<p>Oh, and one more important thing: You&#8217;ll want to keep any backups disconnected from everything. Ransomware has a tendency to infect everything it can, so make sure at least one backup is stored completely offline.</p>
<p>&#8220;Just disconnect them from a computer, put them in a safe place and pray you don&#8217;t need them,&#8221; Nixon said.</p>


feed_id: https://krebsonsecurity.com/?p=54747
title: Microsoft Patch Tuesday, March 2021 Edition
uri: Microsoft-Patch-Tuesday-March-2021-Edition
url: https://krebsonsecurity.com/2021/03/microsoft-patch-tuesday-march-2021-edition/
content:
<p>On the off chance you were looking for more security to-dos from <strong>Microsoft </strong>today&#8230;the company released software updates to plug more than 82 security flaws in Windows and other supported software. Ten of these earned Microsoft&#8217;s &#8220;critical&#8221; rating, meaning they can be exploited by malware or miscreants with little or no help from users.</p>
<p><img loading="lazy" class="aligncenter size-full wp-image-52647" src="media/2471c2d6.windowsec.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/08/windowsec.png" alt="" width="579" height="425" /></p>
<p>Top of the heap this month (apart from the <a href="https://krebsonsecurity.com/2021/03/at-least-30000-u-s-organizations-newly-hacked-via-holes-in-microsofts-email-software/" target="_blank" rel="noopener">ongoing, global Exchange Server mass-compromise</a>) is a patch for an <strong>Internet Explorer</strong> bug that is seeing active exploitation. The IE weakness &#8212; <a href="https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-26411" target="_blank" rel="noopener">CVE-2021-26411</a> &#8212; affects both IE11 and newer EdgeHTML-based versions, and it allows attackers to run a file of their choice by getting you to view a hacked or malicious website in IE.</p>
<p>The IE flaw is tied to a vulnerability that was publicly disclosed in early February by researchers at <a href="http://enki.co.kr/blog/2021/02/04/ie_0day.html" target="_blank" rel="noopener">ENKI</a> who claim it was one of those <a href="https://www.bleepingcomputer.com/news/security/hacking-group-also-used-an-ie-zero-day-against-security-researchers/" target="_blank" rel="noopener">used in a recent campaign by nation-state actors to target security researchers</a>. In the ENKI blog post, the researchers said they will publish proof-of-concept (PoC) details after the bug has been patched.</p>
<p>&#8220;As we’ve seen in the past, once PoC details become publicly available, attackers quickly incorporate those PoCs into their attack toolkits,&#8221; said <strong>Satnam Narang</strong>, staff research engineer at <strong>Tenable</strong>. &#8220;We strongly encourage all organizations that rely on Internet Explorer and Microsoft Edge (EdgeHTML-Based) to apply these patches as soon as possible.&#8221;</p>
<p>This is probably a good place to quote <a href="https://www.ghacks.net/2021/03/09/microsoft-windows-security-updates-march-2021-overview/" target="_blank" rel="noopener">Ghacks.net&#8217;s Martin Brinkman</a>: This is <a href="https://www.ghacks.net/2021/01/31/reminder-microsoft-edge-legacy-will-be-retired-in-march-2021/" target="_blank" rel="noopener">the last patch hurrah</a> for the legacy Microsoft Edge web browser, which is being retired by Microsoft.</p>
<p>For the second month in a row, Microsoft has patched scary flaws in the DNS servers on <strong>Windows Server 2008</strong> through <strong>2019</strong> versions that could be used to remotely install software of the attacker’s choice. All five of the DNS bugs quashed in today&#8217;s patch batch earned a CVSS Score (danger metric) of 9.8 &#8212; almost as bad as it gets.</p>
<p>&#8220;There is the outside chance this could be wormable between DNS servers,&#8221; warned Trend Micro&#8217;s <strong>Dustin Childs</strong>.<span id="more-54747"></span></p>
<p>As mentioned above, hundreds of thousands of organizations are in the midst dealing with a security nightmare after having their Exchange Server and Outlook Web Access (OWA) hacked and retrofitted with a backdoor. If an organization you know has been affected by this attack, please have them check with the new victim notification website <a href="https://krebsonsecurity.com/2021/03/warning-the-world-of-a-ticking-time-bomb/" target="_blank" rel="noopener">mentioned in today&#8217;s story</a>.</p>
<p><strong>Susan Bradley</strong> over at <a href="https://www.askwoody.com/2021/march-patching-madness-begins/" target="_blank" rel="noopener">Askwoody.com says</a> &#8220;nothing in the March security updates (besides the Exchange ones released last week) is causing me to want to urge you to go running to your machines and patch at this time.&#8221; I&#8217;d concur, unless of course you cruise the web with older Microsoft browsers.</p>
<p>It’s a good idea for Windows users to get in the habit of updating at least once a month, but for regular users (read: not enterprises) it’s usually safe to wait a few days until after the patches are released, so that Microsoft has time to iron out any kinks in the new armor.</p>
<p>But before you update, <em>please</em> make sure you have backed up your system and/or important files. It’s not uncommon for a Windows update package to hose one’s system or prevent it from booting properly, and some updates have been known to erase or corrupt files.</p>
<p>So do yourself a favor and backup before installing any patches. Windows 10 even has some <a href="https://lifehacker.com/how-to-back-up-your-computer-automatically-with-windows-1762867473" target="_blank" rel="noopener noreferrer">built-in tools</a> to help you do that, either on a per-file/folder basis or by making a complete and bootable copy of your hard drive all at once.</p>
<p>And if you wish to ensure Windows has been set to pause updating so you can back up your files and/or system before the operating system decides to reboot and install patches on its own schedule, <a href="https://www.computerworld.com/article/3543189/check-to-make-sure-you-have-windows-updates-paused.html" target="_blank" rel="noopener noreferrer">see this guide</a>.</p>
<p>As always, if you experience glitches or problems installing any of these patches this month, please consider leaving a comment about it below; there’s a better-than-even chance other readers have experienced the same and may chime in here with some helpful tips.</p>
<p>Additional reading:</p>
<p>Martin Brinkman&#8217;s <a href="https://www.ghacks.net/2021/03/09/microsoft-windows-security-updates-march-2021-overview/" target="_blank" rel="noopener">always comprehensive take</a>.</p>
<p>The <strong>SANS Internet Storm Center</strong> <a href="https://isc.sans.org/forums/diary/Microsoft+March+2021+Patch+Tuesday/27184/" target="_blank" rel="noopener">no-frills breakdown of the fixes</a>.</p>
<p>&nbsp;</p>


feed_id: https://krebsonsecurity.com/?p=54767
title: WeLeakInfo Leaked Customer Payment Info
uri: WeLeakInfo-Leaked-Customer-Payment-Info
url: https://krebsonsecurity.com/2021/03/weleakinfo-leaked-customer-payment-info/
content:
<p>A little over a year ago, the FBI and law enforcement partners overseas seized <strong>WeLeakInfo[.]com</strong>, a wildly popular service that sold access to more than 12 billion usernames and passwords stolen from thousands of hacked websites. In an ironic turn of events, a lapsed domain registration tied to WeLeakInfo let someone plunder and publish account data on 24,000 customers who paid to access the service with a credit card.</p>
<p><img loading="lazy" class="aligncenter wp-image-54776" src="media/7a4abd55.wli-homepage.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/03/wli-homepage.png" alt="" width="598" height="306" /></p>
<p>For several years, WeLeakInfo was the largest of several services selling access to hacked passwords. Prosecutors <a href="https://www.justice.gov/usao-dc/pr/weleakinfocom-domain-name-seized" rel="noopener" target="_blank">said</a> it had indexed, searchable information from more than 10,000 data breaches containing over 12 billion indexed records &#8212; including names, email addresses, usernames, phone numbers, and passwords for online accounts.</p>
<p>For a small fee, you could enter an email address and see every password ever associated with that address in a previous breach. Or the reverse &#8212; show me all the email accounts that ever used a specific password (see screenshot above). It was a fantastic tool for launching targeted attacks against people, and that&#8217;s exactly how the service was viewed by many of its customers.</p>
<p>Now, nearly 24,000 WeLeakInfo&#8217;s customers are finding that the personal and payment data they shared with WeLeakInfo over its five-year-run has been leaked online.</p>
<div id="attachment_54808" style="width: 602px" class="wp-caption aligncenter"><a href="media/e12d9494.wli-fees.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/03/wli-fees.png"><img aria-describedby="caption-attachment-54808" loading="lazy" class="wp-image-54808" src="media/e12d9494.wli-fees.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/03/wli-fees.png" alt="" width="592" height="361" srcset="https://krebsonsecurity.com/wp-content/uploads/2021/03/wli-fees.png 795w, https://krebsonsecurity.com/wp-content/uploads/2021/03/wli-fees-768x469.png 768w" sizes="(max-width: 592px) 100vw, 592px" /></a><p id="caption-attachment-54808" class="wp-caption-text">WeLeakInfo&#8217;s service fees.</p></div>
<p>In a post on the database leaking forum <strong>Raidforums</strong>, a regular contributor using the handle &#8220;pompompurin&#8221; said he stole the WeLeakInfo payment logs and other data after noticing the domain wli[.]design was no longer listed as registered.</p>
<p>&#8220;Long story short: FBI let one of weleakinfo&#8217;s domains expire that they used for the emails/payments,&#8221; pompompurin wrote. &#8220;I registered that domain, &amp; was able to [password] reset the stripe.com account &amp; get all the Data. [It&#8217;s] only from people that used stripe.com to checkout. If you used paypal or [bitcoin] ur all good.&#8221;</p>
<p>Cyber threat intelligence firm <a href="https://www.flashpoint-intel.com" target="_blank" rel="noopener">Flashpoint </a>obtained a copy of the data leaked by pompompurin, and said it includes partial credit card data, email addresses, full names, IP addresses, browser user agent string data, physical addresses, phone numbers, and amount paid. One forum member commented that they found their own payment data in the logs.</p>
<div id="attachment_54807" style="width: 589px" class="wp-caption aligncenter"><a href="media/ef4be069.wli-stackup.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/03/wli-stackup.png"><img aria-describedby="caption-attachment-54807" loading="lazy" class="wp-image-54807" src="media/ef4be069.wli-stackup.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/03/wli-stackup.png" alt="" width="579" height="467" srcset="https://krebsonsecurity.com/wp-content/uploads/2021/03/wli-stackup.png 805w, https://krebsonsecurity.com/wp-content/uploads/2021/03/wli-stackup-768x618.png 768w" sizes="(max-width: 579px) 100vw, 579px" /></a><p id="caption-attachment-54807" class="wp-caption-text">How WeLeakInfo stacked up against its competitors (according to WLI).</p></div>
<p>According to <strong>DomainTools</strong> [an advertiser on this site] Wli[.]design was registered on Aug. 24, 2016 with the domain registrar <strong>Dynadot</strong>. On March 12, the domain was moved to another registrar &#8212; <strong>Namecheap</strong>.</p>
<p>Pompompurin released several screenshots of himself logged in to the WeLeakInfo account at stripe.com, an online payment processor. Under &#8220;management and ownership&#8221; was listed a <strong>Gerald Murphy</strong> from Fintona, U.K.</p>
<p>Shortly after WeLeakInfo&#8217;s domain was seized by authorities in Jan. 2020, the U.K.&#8217;s National Crime Agency (NCA) <a href="https://www.psni.police.uk/news/Latest-News/170120-weleakinfo.com-site-hosting-stolen-credentials-taken-down-after-international-operation/" target="_blank" rel="noopener">arrested two individuals</a> in connection with the service, including a 22-year-old from Fintona.</p>
<p><img loading="lazy" class="aligncenter size-full wp-image-54779" src="media/64443560.wli-murphyr.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/03/wli-murphyr.png" alt="" width="424" height="561" /><br />
<span id="more-54767"></span></p>
<h4>PLENTY OF TIME FOR OPSEC MISTAKES</h4>
<p>It&#8217;s been a tough few months for denizens of various hacking forums, which are finding themselves on the defensive end of a great many attacks testing the security of their aliases and operational security lately. Over the past few weeks three of the longest running and most venerated Russian-language online forums serving thousands of experienced cybercriminals <a href="https://krebsonsecurity.com/2021/03/three-top-russian-cybercrime-forums-hacked/" target="_blank" rel="noopener">have been hacked</a>.</p>
<p>In two of the intrusions (against the Russian hacking forums &#8220;Mazafaka&#8221; and &#8220;Verified&#8221;) &#8212; the attackers made off with the forums’ user databases, including email and Internet addresses and hashed passwords.</p>
<p>&#8220;Members of all three forums are worried the incidents could serve as a virtual Rosetta Stone for connecting the real-life identities of the same users across multiple crime forums,&#8221; a recent story here explained.</p>
<p>An exposure of 15 years worth of user data from a forum like Mazafaka is a big risk for registrants because investigators often can use common registration details to connect specific individuals who might have used multiple hacker handles over the years.</p>
<p>Many of the domains from the email addresses listed in the Maza dump date to the early 2000s, back when budding cybercriminals typically took fewer precautions to obfuscate or separate the myriad connections to their real-life identities online.</p>
<p>The biggest potential gold mine for de-anonymizing Maza members is the leak of user numbers for ICQ, an instant messaging service formerly owned by AOL that was widely used by cybercrime forum members up until around 2010. That&#8217;s about when AOL<a href="https://techcrunch.com/2010/04/28/aol-sells-instant-messaging-service-icq-to-dst-for-187-5-million/#:~:text=AOL%20Sells%20Instant%20Messaging%20Service%20ICQ%20To%20DST%20For%20%24187.5%20Million,-Leena%20Rao%40LeenaRao&amp;text=It's%20done.,investor%20DST%20for%20%24187.5%20million." target="_blank" rel="noopener"> sold the platform in 2010 to Russian investor DST for $187.5 million</a>.</p>
<p>Back then, people often associated their ICQ numbers to different interests, pursuits and commerce tied to their real life identities. In many cases, these associations are on public, Russian language forums, such as discussion sites on topics like cars, music or programming.</p>
<p>In a common inadvertent exposure, a cybercriminal happens to make an innocuous post 15 years ago to a now-defunct Russian-language automobile forum.</p>
<p>That post, preserved in perpetuity by sites like archive.org, includes an ICQ number and says there&#8217;s a guy named Sergey in Vladivostok who&#8217;s selling his car. And the profile link on the auto forum leads to another now-defunct but still-archived personal site for Sergey.</p>
<p>Interestingly, services like WeLeakInfo can just as easily be used against cybercriminals as by them. For example, it&#8217;s likely that the database for the automobile forum where Sergey posted got compromised at some point and is for sale on sites like WeLeakInfo (there are active competitors).</p>
<p>Ditto for any other forum where Sergey used the same email address or password. When researchers start finding password re-use across multiple email addresses that all follow a pattern, it becomes much easier to tie Sergey from Vladivostok to his cybercriminal and real-life identities.</p>


feed_id: https://krebsonsecurity.com/?p=54819
title: Can We Stop Pretending SMS Is Secure Now?
uri: Can-We-Stop-Pretending-SMS-Is-Secure-Now
url: https://krebsonsecurity.com/2021/03/can-we-stop-pretending-sms-is-secure-now/
content:
<p>SMS text messages were already the weakest link securing just about anything online, mainly because there are tens of thousands of people (many of them low-paid mobile store employees) who can be tricked or bribed into swapping control over a mobile phone number to someone else. Now we&#8217;re learning about an entire ecosystem of companies that anyone could use to silently intercept text messages intended for other mobile users.</p>
<p><img loading="lazy" class="aligncenter wp-image-45224" src="media/57d2a628.phonescam.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/09/phonescam.png" alt="" width="595" height="375" /></p>
<p>Security researcher &#8220;<a href="https://www.twitter.com/lucky225" target="_blank" rel="noopener">Lucky225</a>&#8221; worked with Vice.com&#8217;s <strong>Joseph Cox</strong> <a href="https://www.vice.com/amp/en/article/y3g8wb/hacker-got-my-texts-16-dollars-sakari-netnumber?__twitter_impression=true" target="_blank" rel="noopener">to intercept Cox&#8217;s incoming text messages with his permission</a>. Lucky225 showed how anyone could do the same after creating an account at a service called <a href="https://sakari.io" target="_blank" rel="noopener">Sakari</a>, a company that helps celebrities and businesses do SMS marketing and mass messaging.</p>
<p>The &#8220;how they did it&#8221; was sickeningly simple. It cost just $16, and there was precious little to prevent someone from stealing your text messages without your knowledge. Cox writes:</p>
<blockquote><p>Sakari offers a free trial to anyone wishing to see what the company&#8217;s dashboard looks like. The cheapest plan, which allows customers to add a phone number they want to send and receive texts as, is where the $16 goes. Lucky225 provided Motherboard with screenshots of Sakari&#8217;s interface, which show a red &#8220;+&#8221; symbol where users can add a number.</p>
<p>While adding a number, Sakari provides the Letter of Authorization for the user to sign. Sakari&#8217;s LOA says that the user should not conduct any unlawful, harassing, or inappropriate behavior with the text messaging service and phone number.</p>
<p>But as Lucky225 showed, a user can just sign up with someone else&#8217;s number and receive their text messages instead.</p></blockquote>
<p>Lucky <a href="https://krebsonsecurity.com/?s=lucky225&amp;x=0&amp;y=0" target="_blank" rel="noopener">told KrebsOnSecurity</a> that Sakari has since taken steps to block its service for being used with mobile telephone numbers. But he said Sakari is just one part of a much larger, unregulated industry that can be used to hijack SMS messages for many phone numbers.</p>
<p>&#8220;It&#8217;s not a Sakari thing,&#8221; Lucky225 replied when first approached for more details. &#8220;It&#8217;s an industry-wide thing. There are many of these &#8216;SMS enablement&#8217; providers.&#8221;</p>
<p>The most common way thieves hijack SMS messages these days involves &#8220;sim swapping,&#8221; a crime that involves bribing or tricking employees at wireless phone companies into modifying customer account information.</p>
<p>In a SIM swap, the attackers redirect the target&#8217;s phone number to a device they control, and then can intercept the target&#8217;s incoming SMS messages and phone calls. From there, the attacker can reset the password of any account which uses that phone number for password reset links.</p>
<p>But the attacks Lucky225 has been demonstrating merely require customers of any number of firms to sign a sworn &#8220;letter of authorization&#8221; or LOA stating that they indeed do have the authority to act on behalf of the owner of the targeted number.</p>
<p><strong>Allison Nixon</strong> is chief research officer at <a href="https://www.unit221b.com" target="_blank" rel="noopener">Unit221B</a>, a New York City-based cyber investigations firm. An expert on SIM-swapping attacks who&#8217;s <a href="https://krebsonsecurity.com/?s=allison+nixon&amp;x=0&amp;y=0" target="_blank" rel="noopener">been quoted quite a bit on this blog</a>, Nixon said she also had Lucky225 test his interception tricks on her mobile phone, only to watch her incoming SMS messages show up on his burner phone.</p>
<p>&#8220;This basically means the only thing standing between anyone and the equivalent of a SIM swap is a forged LOA,&#8221; Nixon said. &#8220;And the &#8216;fix&#8217; put in seems to be temporary in nature.&#8221;</p>
<p><img loading="lazy" class="aligncenter wp-image-45226" src="media/c61b924f.cell8.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/09/cell8.png" alt="" width="597" height="687" /></p>
<p>The interception method that Lucky225 described is still dangerously exposed by a number of systemic weaknesses in the global SMS network, he said.</p>
<p>Most large and legacy telecommunications providers validate transfer requests related to their customers by consulting <strong>NPAC</strong>, or the <a href="https://www.npac.com/" target="_blank" rel="noopener">Number Portability Administration Center</a>. When customers want to move their phone numbers &#8212; mobile or otherwise &#8212; that request is routed through NPAC to the customer&#8217;s carrier.</p>
<p>That change request carries what&#8217;s known as an ALT-SPID, which is a four-digit number that enables NPAC to identify the telecommunications company currently providing service to the customer. More importantly, as part of this process no changes can happen unless the customer&#8217;s carrier has verified the changes with the existing customer.</p>
<p>But Lucky225 said the class of SMS interception he&#8217;s been testing targets a series of authentication weaknesses tied to a system developed by <a href="https://www.netnumber.com" target="_blank" rel="noopener">NetNumber</a>, a private company in Lowell, Mass. NetNumber developed its own proprietary system for mapping telecommunications providers that is used by Sakari and an entire industry of similar firms.</p>
<p>NetNumber developed its six-digit ALT SPIDs (NetNumber IDs) to better organize and track communications service providers that were all using other numbering systems (and differing numbers of digits). But NetNumber also works directly with dozens of voice-over-IP or Internet-based phone companies which do not play by the same regulatory rules that apply to legacy telecommunications providers.</p>
<p>&#8220;There are many VoIP providers that offer &#8216;off net&#8217; &#8216;text enablement&#8217;,&#8221; Lucky225 explained. &#8220;Companies such as ZipWhip that promise to let you &#8216;Text enable your existing business phone number&#8217; so that customers can text your main business line whether it be VoIP, toll-free or a landline number.&#8221;</p>
<p>As Lucky225 wrote in his <a href="https://lucky225.medium.com/its-time-to-stop-using-sms-for-anything-203c41361c80" target="_blank" rel="noopener">comprehensive Medium article</a>, there are a plethora of wholesale VoIP providers that let you become a reseller with little to no verification, many of them allow blanket Letters of Authorization (LOAs), where you as the reseller promise that you have an LOA on file for any number you want to text enable for your resellers or end-users.</p>
<blockquote><p>&#8220;In essence, once you have a reseller account with these VoIP wholesalers you can change the Net Number ID of any phone number to your wholesale provider’s NNID and begin receiving SMS text messages with virtually no authentication whatsoever. No SIM Swap, SS7 attacks, or port outs needed — just type the target’s phone number in a text box and hit submit and within minutes you can start receiving SMS text messages for them. They won’t even be alerted that anything has happened as their voice &amp; data services will continue to work as usual. Surprisingly, despite the fact that <a href="https://twitter.com/lucky225/status/1025206045235277824" target="_blank" rel="noopener">I publicly disclosed this in 2018</a>, nothing has been done to stop this relatively unsophisticated attack.&#8221;</p></blockquote>
<p><span id="more-54819"></span>NetNumber declined to comment on the record, but instead referred to a statement from the CTIA, a trade association representing the wireless industry, which reads:</p>
<p>&#8220;After being made aware of this potential threat, we worked immediately to investigate it, and took precautionary measures. Since that time, no carrier has been able to replicate it. We have no indication of any malicious activity involving the potential threat or that any customers were impacted. Consumer privacy and safety is our top priority, and we will continue to investigate this matter.&#8221;</p>
<p>Lucky225 told KrebsOnSecurity many of the major mobile companies have moved to ensure none of their customers can be affected by changes requested through NetNumber or its partners. But he suspects some of the smaller wired and wireless telecommunications firms may still be vulnerable.</p>
<p>&#8220;I&#8217;m pretty sure it&#8217;s only the big carriers that they&#8217;re protecting now,&#8221; he said. &#8220;But there&#8217;s just so much we don&#8217;t know about what they patched because everyone is being so tight lipped about this right now.&#8221;</p>
<p>Nixon said it&#8217;s time for federal regulators to step up and protect consumers.</p>
<p>&#8220;Its clear this is a lot of foundational infrastructure mucky muck and some fundamental changes are going to need to happen here,&#8221; she said. &#8220;Regulators really need to get involved.&#8221;</p>
<h4>WHAT CAN YOU DO?</h4>
<p>Given the potentially broad impact of fraudsters abusing this and other weaknesses in the vast mobile ecosystem to completely subvert the security of SMS based communications and multi-factor authentication, it&#8217;s probably a good idea to rethink your relationship to your phone number. It&#8217;s now plainer than ever how foolish it is to trust SMS for anything.</p>
<p>My advice has long been to remove phone numbers from your online accounts wherever you can, and avoid selecting SMS or phone calls for second factor or one-time codes. Phone numbers were <a href="https://krebsonsecurity.com/2019/03/why-phone-numbers-stink-as-identity-proof/" target="_blank" rel="noopener">never designed to be identity documents</a>, but that&#8217;s effectively what they&#8217;ve become. It&#8217;s time we stopped letting everyone treat them that way.</p>
<p>Any online accounts that you value should be secured with a unique and strong password, as well the most robust form of multi-factor authentication available. Usually, this is a mobile app like Authy or Google Authenticator that generates a one-time code. Some sites like Twitter and Facebook now support even more robust options — such as <a href="https://krebsonsecurity.com/?s=security+keys&amp;x=0&amp;y=0" target="_blank" rel="noopener">physical security keys</a>.</p>
<p>Removing your phone number may be even more important <a href="https://krebsonsecurity.com/2013/06/the-value-of-a-hacked-email-account/" target="_blank" rel="noopener">for any email accounts you may have</a>. Sign up with any service online, and it will almost certainly require you to supply an email address. In nearly all cases, the person who is in control of that address can reset the password of any associated services or accounts&#8211; merely by requesting a password reset email.</p>
<p>Unfortunately, many email providers still let users reset their account passwords by having a link sent via text to the phone number on file for the account. So remove the phone number as a backup for your email account, and ensure a more robust second factor is selected for all available account recovery options.</p>
<p>Here&#8217;s the thing: Most online services require users to supply a mobile phone number when setting up the account, but do not require the number to remain associated with the account after it is established. I advise readers <a href="https://krebsonsecurity.com/2019/03/why-phone-numbers-stink-as-identity-proof/" target="_blank" rel="noopener">to remove their phone numbers from accounts wherever possible</a>, and to take advantage of a mobile app to generate any one-time codes for multifactor authentication.</p>


feed_id: https://krebsonsecurity.com/?p=54409
title: Fintech Giant Fiserv Used Unclaimed Domain
uri: Fintech-Giant-Fiserv-Used-Unclaimed-Domain
url: https://krebsonsecurity.com/2021/03/fintech-giant-fiserv-used-unclaimed-domain/
content:
<p>If you sell Web-based software for a living and ship code that references an unregistered domain name, you are asking for trouble. But when the same mistake is made by a Fortune 500 company, the results can range from costly to disastrous. Here&#8217;s the story of one such goof committed by <strong>Fiserv </strong>[<a href="https://www.nasdaq.com/symbol/fisv" target="_blank" rel="noopener">NASDAQ:FISV</a>], a $6 billion firm that provides online banking software and other technology solutions to thousands of financial institutions.</p>
<p><img loading="lazy" class="aligncenter wp-image-44816" src="media/f469fe28.fiserve.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/08/fiserve.png" alt="" width="597" height="302" /></p>
<p>In November 2020, KrebsOnSecurity heard from security researcher <strong>Abraham Vegh</strong>, who noticed something odd while inspecting an email from his financial institution.</p>
<p>Vegh could see the message from his bank referenced a curious domain: <strong>defaultinstitution.com</strong>. A quick search of WHOIS registration records showed the domain was unregistered. Wondering whether he might receive email communications to that address if he registered the domain, Vegh snapped it up for a few dollars, set up a catch-all email account for it, and waited.</p>
<p>&#8220;It appears that the domain is provided as a default, and customer bank IT departments are either assuming they don’t need to change it, or are not aware that they could/should,&#8221; Vegh said, noting that a malicious person who stumbled on his discovery earlier could have had a powerful, trusted domain from which to launch email phishing attacks.</p>
<p>At first, only a few wayward emails arrived. Ironically enough, one was from a &#8220;quality assurance&#8221; manager at Fiserv. The automatic reply message stated that the employee was out of the office &#8220;on R&amp;R&#8221; and would be back to work on Dec. 14.</p>
<p>Many other emails poured in, including numerous &#8220;bounced&#8221; messages delivered in reply to missives from <strong>Cashedge.com</strong>, a money transfer service that <a href="https://investors.fiserv.com/news-releases/news-release-details/fiserv-agrees-acquire-cashedge-advance-its-digital-payments-and" target="_blank" rel="noopener">Fiserv acquired in 2011</a>.</p>
<p>Emails get bounced &#8212; or returned to the sender &#8212; when they are sent to an address that doesn&#8217;t exist or that is no longer active. The messages had been sent to an email address for a former client solutions director at Fiserv; the &#8220;reply-to:&#8221; address in those missives was &#8220;donotreply@defaultinstitution.com&#8221;.</p>
<p>The messages were informing customers of CashEdge&#8217;s main service <a href="https://www.fiserv.com/en/solutions/payments/personal-payments-services/popmoney.html" target="_blank" rel="noopener">Popmoney</a> &#8212; which lets users send, request and receive money directly from bank accounts &#8212; that Popmoney was being replaced with <a href="https://www.zellepay.com/" target="_blank" rel="noopener">Zelle</a>, a more modern bank-to-bank transfer service.</p>
<p>Each CashEdge missive included information about recurring transfers that were being canceled, such as the plan ID, send date, amount to be transferred, the name and last four digits of the account number the money was coming from, and the email address of the recipient account.</p>
<p>Incredibly, at the bottom of every message to CashEdge/Popmoney customers was a boilerplate text: &#8220;This email was sent to [recipient name here]. If you have received this email in error, please send an e-mail to customersupport@defaultinstitution.com.&#8221;</p>
<p><img loading="lazy" class="aligncenter wp-image-54537" src="media/f45ad601.popmoney.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/03/popmoney.png" alt="" width="593" height="407" srcset="https://krebsonsecurity.com/wp-content/uploads/2021/03/popmoney.png 782w, https://krebsonsecurity.com/wp-content/uploads/2021/03/popmoney-768x527.png 768w" sizes="(max-width: 593px) 100vw, 593px" /></p>
<p><span id="more-54409"></span>Other services that directed customers to reply to the researcher&#8217;s domain included Fiserv customer<strong> Netspend.com</strong>, a leading provider of prepaid debit cards that require no minimum balance or credit check. The messages from Netspend all were to confirm the email address tied to a new account, and concerned &#8220;me-to-me transfers&#8221; set up through its service.</p>
<p>Each message included a one-time code that recipients were prompted to enter at the company&#8217;s website. But from reading the many replies to these missives, it seems Netspend didn&#8217;t make it terribly obvious where users were supposed to input this code. Here&#8217;s one of the more profane examples of a customer response:</p>
<p><img loading="lazy" class=" wp-image-54472 aligncenter" src="media/7228858d.me-to-me-curse.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/02/me-to-me-curse.png" alt="" width="596" height="464" srcset="https://krebsonsecurity.com/wp-content/uploads/2021/02/me-to-me-curse.png 778w, https://krebsonsecurity.com/wp-content/uploads/2021/02/me-to-me-curse-768x598.png 768w" sizes="(max-width: 596px) 100vw, 596px" /></p>
<p>Many others emailed by Netspend expressed mystification as to why they were receiving such messages, stating they&#8217;d never signed up for the service. From the gist of those messages, the respondents were victims of identity fraud.</p>
<p>&#8220;My accounts were hacked and if any funding is gone your [sic] sued from me and federal trade commission,&#8221; one wrote. &#8220;I didn&#8217;t create the account. Please stop this account and let me know what&#8217;s going on,&#8221; replied another. &#8220;I never signed up for this service. Someone else is using my information,&#8221; wrote a third.</p>
<p>Those messages also concerned me-to-me transfers. Other emails came from Detroit-based <strong>TCF National Bank</strong>.</p>
<p>New York-based <strong>Union Bank</strong> also sent customer information to the researcher&#8217;s domain. Both of those messages were intended to confirm that the recipient had tied their accounts to those at another bank. And in both cases, the recipients replied that they had not authorized the linkage.</p>
<p>In response to questions from KrebsOnSecurity, Fiserv acknowledged that it had inadvertently included references to defaultinstitution.com as a placeholder in software solutions used by some partners.</p>
<p style="font-weight: 400;">&#8220;We have identified 5 clients for which auto-generated emails to their customers included the domain name “<a href="http://defaultinstitution.com/" data-saferedirecturl="https://www.google.com/url?q=http://defaultinstitution.com&amp;source=gmail&amp;ust=1614792728871000&amp;usg=AFQjCNFzE_uGsi3ixISJhRTTLmTo4UmWDw">defaultinstitution.com</a>” in the “reply-to” address,&#8221; Fiserv said in a written statement. &#8220;This placeholder URL was inadvertently left unchanged during implementation of these solutions. Upon being made aware of the situation we immediately conducted an analysis to locate and replace instances of the placeholder domain name. We have also notified the clients whose customers received these emails.&#8221;</p>
<p>Indeed, the last email Vegh&#8217;s inbox received was on Feb. 26.</p>
<p>This is not the first time an oversight by Fiserv has jeopardized the security and privacy of its customers. In 2018, KrebsOnSecurity revealed how a programming weakness in a software platform sold to hundreds of banks <a href="https://krebsonsecurity.com/2018/08/fiserv-flaw-exposed-customer-data-at-hundreds-of-banks/" target="_blank" rel="noopener">exposed personal and financial data of countless customers</a>. Fiserv was <a href="https://krebsonsecurity.com/2019/05/credit-union-sues-fintech-giant-fiserv-over-security-claims/" target="_blank" rel="noopener">later sued over the matter by a credit union customer</a>; that lawsuit is still proceeding.</p>
<p>Vegh said he found a similar domain goof while working as a contractor at the Federal Reserve Bank of Philadelphia back in 2015. In that instance, he discovered <a href="https://whois.domaintools.com/airwatchmagreachability.com" target="_blank" rel="noopener">an unregistered domain</a> invoked by <a href="https://en.wikipedia.org/wiki/AirWatch" target="_blank" rel="noopener">AirWatch</a>, a mobile device management product since acquired by VMWare.</p>
<p>&#8220;After registering that domain I started getting traffic from all around the world from Fortune 500 company devices pinging the domain,&#8221; Vegh said.</p>
<p>Vegh said he plans to give Fiserv control over defaultinstitution.com, and hand over the messages intercepted by his inbox. He&#8217;s not asking for much in return.</p>
<p>&#8220;I had been promised a t-shirt and a case of beer for my efforts then, but alas, never received one,&#8221; he said of his interaction with AirWatch. &#8220;This time, I am hoping to actually receive a t-shirt!&#8221;</p>


feed_id: https://krebsonsecurity.com/?p=53915
title: RedTorch Formed from Ashes of Norse Corp.
uri: RedTorch-Formed-from-Ashes-of-Norse-Corp
url: https://krebsonsecurity.com/2021/03/redtorch-formed-from-ashes-of-norse-corp/
content:
<p>Remember<strong> Norse Corp.</strong>, the company behind the interactive &#8220;pew-pew&#8221; cyber attack map shown in the image below? Norse imploded rather suddenly in 2016 following a series of managerial missteps and funding debacles. Now, the founders of Norse have launched a new company with a somewhat different vision: <strong>RedTorch</strong>, which for the past two years has marketed a mix of services to high end celebrity clients, including spying and anti-spying tools and services.</p>
<div id="attachment_33735" style="width: 607px" class="wp-caption aligncenter"><a href="media/1d424bbe.norsemap.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2016/01/norsemap.png"><img aria-describedby="caption-attachment-33735" loading="lazy" class="wp-image-33735" src="media/1d424bbe.norsemap.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2016/01/norsemap.png" alt="" width="597" height="294" srcset="https://krebsonsecurity.com/wp-content/uploads/2016/01/norsemap.png 2398w, https://krebsonsecurity.com/wp-content/uploads/2016/01/norsemap-580x285.png 580w, https://krebsonsecurity.com/wp-content/uploads/2016/01/norsemap-768x378.png 768w, https://krebsonsecurity.com/wp-content/uploads/2016/01/norsemap-940x463.png 940w" sizes="(max-width: 597px) 100vw, 597px" /></a><p id="caption-attachment-33735" class="wp-caption-text">A snapshot of Norse&#8217;s semi-live attack map, circa Jan. 2016.</p></div>
<p>Norse&#8217;s attack map was everywhere for several years, and even became a common sight in the &#8220;brains&#8221; of corporate security operations centers worldwide. Even if the data that fueled the maps was not particularly useful, the images never failed to enthrall visitors viewing them on room-sized screens.</p>
<p>&#8220;In the tech-heavy, geek-speak world of cybersecurity, these sorts of infographics and maps are popular because they promise to make complicated and boring subjects accessible and sexy,&#8221; I wrote in <a href="https://krebsonsecurity.com/2016/01/sources-security-firm-norse-corp-imploding/" target="_blank" rel="noopener">a January 2016 story about Norse&#8217;s implosion</a>. &#8220;And Norse’s much-vaunted interactive attack map was indeed some serious eye candy: It purported to track the source and destination of countless Internet attacks in near real-time, and showed what appeared to be multicolored fireballs continuously arcing across the globe.&#8221;</p>
<p>That story showed the core Norse team had a history of ambitious but ultimately failed or re-branded companies. One company proclaimed it was poised to spawn a network of cyber-related firms, but instead ended up selling cigarettes online. That company, which later came under investigation by state regulators concerned about underage smokers, later rebranded to another start-up that tried to be an online copyright cop.</p>
<p>Flushed with venture capital funding in 2012, Norse&#8217;s founders started hiring dozens of talented cybersecurity professionals. By 2014 it was throwing lavish parties at top  Internet security conferences. It spent quite a bit of money on marketing gimmicks and costly advertising stunts, burning through millions in investment funding. In 2016, financial reality once again would catch up with the company&#8217;s leadership when Norse <a href="https://krebsonsecurity.com/2016/01/sources-security-firm-norse-corp-imploding/" target="_blank" rel="noopener">abruptly ceased operations and was forced to lay off most of its staff</a>.</p>
<p>Now the top executives behind Norse Corp. are working on a new venture: A corporate security and investigations company called RedTorch that&#8217;s based in <a href="https://en.wikipedia.org/wiki/Mulholland_Drive">Woodland Hills, Calif</a>, the home of many Hollywood celebrities.</p>
<p>RedTorch&#8217;s website currently displays a &#8220;We&#8217;re coming soon&#8221; placeholder page. But <a href="https://web.archive.org/web/20200806220931/http://redtorch.com/index.html" target="_blank" rel="noopener">a version of the site that ran for two years beginning in 2018</a> explained what clients can expect from the company&#8217;s services:</p>
<ul>
<li>&#8220;Frigg Mobile Intelligence,&#8221; for helping celebrities and other wealthy clients do background checks on the people in their lives;</li>
<li>&#8220;Cheetah Counter Surveillance&#8221; tools/services to help deter others from being able to spy on clients electronically;</li>
<li>A &#8220;Centurion Research&#8221; tool for documenting said snooping on others.</li>
</ul>
<div id="attachment_54868" style="width: 609px" class="wp-caption aligncenter"><a href="media/23b1860e.cheetah.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/03/cheetah.png"><img aria-describedby="caption-attachment-54868" loading="lazy" class="wp-image-54868" src="media/23b1860e.cheetah.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/03/cheetah.png" alt="" width="599" height="366" srcset="https://krebsonsecurity.com/wp-content/uploads/2021/03/cheetah.png 953w, https://krebsonsecurity.com/wp-content/uploads/2021/03/cheetah-768x469.png 768w" sizes="(max-width: 599px) 100vw, 599px" /></a><p id="caption-attachment-54868" class="wp-caption-text">An ad for RedTorch&#8217;s &#8220;Cheetah&#8221; counter-surveillance tech. The Guy Fawkes mask/Anonymous threat featured prominently and often on RedTorch&#8217;s website.</p></div>
<p>The closest thing to eye candy for RedTorch is its <a href="https://web.archive.org/web/20200806220831/http://redtorch.com/cheetah.html" target="_blank" rel="noopener">Cheetah Counter Surveillance product line</a>, a suite of hardware and software meant to be integrated into other security products which &#8212; according to RedTorch &#8212; constantly sweeps the client&#8217;s network and physical office space with proprietary technology designed to detect remote listening bugs and other spying devices.</p>
<p>Frigg, another core RedTorch offering, is&#8230;well, friggin&#8217; spooky:</p>
<p>&#8220;Frigg is the easiest way to do a full background check and behavioral analysis on people,&#8221; the product pitch reads. &#8220;Frigg not only shows background checks, but social profiles and a person&#8217;s entire internet footprint, too. This allows one to evaluate a person’s moral fiber and ethics. Frigg employs machine learning and analytics on all known data from a subject&#8217;s footprint, delivering instant insight so you can make safer decisions, instantly.&#8221;</p>
<div id="attachment_54870" style="width: 609px" class="wp-caption aligncenter"><a href="media/b9156f01.frigg.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/03/frigg.png"><img aria-describedby="caption-attachment-54870" loading="lazy" class="wp-image-54870" src="media/b9156f01.frigg.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/03/frigg.png" alt="" width="599" height="217" srcset="https://krebsonsecurity.com/wp-content/uploads/2021/03/frigg.png 1096w, https://krebsonsecurity.com/wp-content/uploads/2021/03/frigg-768x278.png 768w" sizes="(max-width: 599px) 100vw, 599px" /></a><p id="caption-attachment-54870" class="wp-caption-text">The background checking service from RedTorch, called Frigg, says it&#8217;s building &#8220;one of the world&#8217;s largest facial recognition databases and a very accurate facial recognition match standard.&#8221;</p></div>
<p>Frigg promises to include &#8220;elements that stems [sic] from major data hacks of known systems like Ashley Madison, LinkedIn, Dropbox, Fling.com, AdultFriendFinder and hundreds more. Victims of those breaches lost a lot of private data including passwords, and Frigg will help them secure their private data in the future. The matching that is shown will use email, phone and full name correlation.&#8221;</p>
<p>From the rest of Frigg:</p>
<blockquote><p>Frigg references sanction lists such as OFAC, INTERPOL wanted persons, and many more international and domestic lists. Known locations results are based on social media profiles and metadata where, for example, there was an image posted that showed GPS location, or the profile mentions locations among its comments.</p>
<p>Frigg provides the option of continuous monitoring on searched background reports. Notification will be sent or shown once an important update or change has been detected</p>
<p>The flagship version of Frigg will allow a user to upload a picture of a face and get a full background check instantly. <em>RedTorch is working to develop one of the world&#8217;s largest facial recognition databases and a very accurate facial recognition match standard.</em></p></blockquote>
<h4>WHO IS REDTORCH?</h4>
<div id="attachment_54866" style="width: 607px" class="wp-caption aligncenter"><a href="media/37c21776.white-grey.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/03/white-grey.png"><img aria-describedby="caption-attachment-54866" loading="lazy" class="wp-image-54866" src="media/37c21776.white-grey.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/03/white-grey.png" alt="" width="597" height="281" srcset="https://krebsonsecurity.com/wp-content/uploads/2021/03/white-grey.png 1150w, https://krebsonsecurity.com/wp-content/uploads/2021/03/white-grey-768x361.png 768w" sizes="(max-width: 597px) 100vw, 597px" /></a><p id="caption-attachment-54866" class="wp-caption-text">The co-founders of Norse Networks, &#8220;Mr. White&#8221; (left) Norse Corp. co-founder and RedTorch CEO Henry Marx;, and &#8220;Mr. Grey,&#8221; CTO and Norse Corp. co-founder Tommy Stiansen.</p></div>
<p>RedTorch claims it is building a huge facial recognition database, so it&#8217;s perhaps no surprise that its founders prefer to obscure theirs. The contact email on RedTorch says henry @retorch dot com. That address belongs to <strong>RedTorch Inc. CEO Henry Marx</strong>, a former <a href="https://www.linkedin.com/in/henry-marx-a672716/" target="_blank" rel="noopener">music industry executive</a> and co-founder of Norse Networks.</p>
<p>Marx did not respond to requests for comment. Nor did any of the other former Norse Corp. executives mentioned throughout this story. So I should emphasize that it&#8217;s not even clear whether the above-mentioned products and services from RedTorch actually exist.</p>
<p>One executive at Red Torch told this author privately that the company had plenty of high-paying clients, although that person declined to be more specific about what RedTorch might do for those clients or why the company&#8217;s site was currently in transition.</p>
<p>Now a cadre of former Norse Corp. employees who have been tracking the company&#8217;s past executives say they&#8217;ve peered through the playful subterfuge in the anonymous corporate identities on the archived RedTorch website.</p>
<p>Marx appears to be the &#8220;Mr. White&#8221; referenced in the screenshot below, taken from <a href="https://web.archive.org/web/20200808025735/http://redtorch.com/aboutteam.html" target="_blank" rel="noopener">an archived Aug. 2020 version of RedTorch.com</a>. He is wearing a <a href="https://en.wikipedia.org/wiki/Guy_Fawkes" target="_blank" rel="noopener">Guy Fawkes mask</a>, a symbol favored by <a href="https://en.wikipedia.org/wiki/Anonymous_(group)" target="_blank" rel="noopener">the Anonymous hacker collective</a>, the doomed man behind the failed <a href="https://en.wikipedia.org/wiki/Gunpowder_Plot" target="_blank" rel="noopener">Gunpowder plot of 1604 in England</a>, and by possibly the most annoying costumes that darken your front door each Halloween.</p>
<p>Mr. White says he has &#8220;over 30 years in the entertainment industry; built numerous brands and controlled several areas of the entertainment business side,&#8221; and that he&#8217;s &#8220;accomplished over 200 million sold artist performances.&#8221;</p>
<p>Pictured beside Mr. White is RedTorch&#8217;s co-founder, &#8220;Mr. Grey.&#8221; Norse watchers say that would be <strong>Tommy Stiansen</strong>, the Norwegian former co-founder of Norse Corp. whose <a href="https://www.linkedin.com/in/tommystiansen/" target="_blank" rel="noopener">LinkedIn profile</a> says is now chief technology officer at RedTorch. One of his earliest companies provided &#8220;operational billing solutions for telecom networks.&#8221;</p>
<p>&#8220;Extensive experience from Telecom industry as executive and engineer,&#8221; reads Mr. Grey&#8217;s profile at RedTorch. &#8220;Decades of Cyber security experience, entrepreneurship and growing companies; from single employee to hundreds of employees. Been active on computers since 7 years old, back in mid-80&#8217;s and have pioneered many facets of the internet and cyber security market we know today. Extensive government work experience from working with federal governments.&#8221;<span id="more-53915"></span></p>
<p>Stiansen&#8217;s leadership at Norse coincided with the company&#8217;s <a href="media/47c02c6a.Growing_Cyberthreat_From_Iran.pdf" data-original-source="https://web.archive.org/web/20160106000533/http://www.pistachioharvest.com/Growing_Cyberthreat_From_Iran.pdf" target="_blank" rel="noopener">release of a report in 2014</a> on Iran&#8217;s cyber prowess that was widely trounced as deeply flawed and headline-grabbing. Norse&#8217;s critics said the company&#8217;s founders had gone from selling smokes to selling smoke and mirrors.</p>
<p>In its report, Norse said it saw a half-million attacks on industrial control systems by Iran in the previous 24 months — a 115 percent increase in attacks! But there was just one problem: The spike in attacks Norse cited weren&#8217;t real attacks against actual industrial targets. Rather, they were against &#8220;honeypot&#8221; systems set up by Norse to mimic a broad range of devices online.</p>
<p>Translation: The threats Norse warned about weren&#8217;t actionable, and weren&#8217;t anything that people could use to learn about actual attack events hitting sensitive control system networks.</p>
<p>In <a href="http://www.csmonitor.com/World/Passcode/Passcode-Voices/2015/0417/Opinion-Security-firm-s-Iran-report-mostly-hype" target="_blank" rel="noopener">a scathing analysis</a> of Norse’s findings, critical infrastructure security expert <a href="http://www.robertmlee.org/" target="_blank" rel="noopener">Robert M. Lee</a> said Norse’s claim of industrial control systems being attacked and implying it was definitively the Iranian government was disingenuous at best. Lee had obtained an advanced copy of a draft version of the Norse report that was shared with unclassified government and private industry channels, and said the data in the report simply did not support its conclusions.</p>
<p>Around the same time, Stiansen was reportedly telling counterparts at competing security firms that Norse had data showing that <a href="https://krebsonsecurity.com/2014/12/fbi-north-korea-to-blame-for-sony-hack/" target="_blank" rel="noopener">the Sony Pictures hack in November 2014</a> &#8212; in which Sony&#8217;s internal files and emails were published online &#8212; was in fact the work of a disgruntled insider at Sony.</p>
<p>Norse&#8217;s crack team of intelligence analysts had concluded that the FBI and other intelligence sources were wrong in publicly blaming the massive breach on North Korean hackers. But Norse never published that report, nor did it produce any data that might support their insider claim in the Sony hack.</p>
<p>Last month, the U.S. Justice Department <a href="https://krebsonsecurity.com/2021/02/u-s-indicts-north-korean-hackers-in-theft-of-200-million/" target="_blank" rel="noopener">unsealed indictments against three North Korean hackers accused of plundering and pillaging Sony Pictures</a>, launching <a href="https://en.wikipedia.org/wiki/WannaCry_ransomware_attack" target="_blank" rel="noopener">the WannaCry ransomware contagion of 2017</a>, and stealing more than $200 million from banks and other victims worldwide.</p>
<p>Norse&#8217;s conclusions on Iran and Sony were supported by <strong>Tyson Yee</strong>, a former Army intelligence analyst who worked at Norse from 2012 to Jan. 2016. Yee is <a href="https://www.linkedin.com/in/tyson-yee-1477b562/" target="_blank" rel="noopener">listed on LinkedIn</a> as director of intelligence at RedTorch, and his LinkedIn profile says his work prior to RedTorch in Nov. 2018 was for two years as a &#8220;senior skunk works analyst&#8221; at an unnamed employer.</p>


feed_id: https://krebsonsecurity.com/?p=54930
title: Phish Leads to Breach at Calif. State Controller
uri: Phish-Leads-to-Breach-at-Calif-State-Controller
url: https://krebsonsecurity.com/2021/03/phish-leads-to-breach-at-calif-state-controller/
content:
<p>A phishing attack last week gave attackers access to email and files at the <a href="https://www.sco.ca.gov/eo_about_resp.html" target="_blank" rel="noopener">California State Controller&#8217;s Office</a> (SCO), an agency responsible for handling more than $100 billion in public funds each year. The phishers had access for more than 24 hours, and sources tell KrebsOnSecurity the intruders used that time to steal Social Security numbers and sensitive files on thousands of state workers, and to send targeted phishing messages to at least 9,000 other workers and their contacts.</p>
<div id="attachment_54936" style="width: 608px" class="wp-caption aligncenter"><a href="media/8f7a2cf2.califsco.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/03/califsco.png"><img aria-describedby="caption-attachment-54936" loading="lazy" class="wp-image-54936" src="media/8f7a2cf2.califsco.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/03/califsco.png" alt="" width="598" height="223" srcset="https://krebsonsecurity.com/wp-content/uploads/2021/03/califsco.png 1240w, https://krebsonsecurity.com/wp-content/uploads/2021/03/califsco-768x287.png 768w" sizes="(max-width: 598px) 100vw, 598px" /></a><p id="caption-attachment-54936" class="wp-caption-text">A notice of breach posted by the California State Controller&#8217;s Office.</p></div>
<p>In a &#8220;<a href="https://sco.ca.gov/upd_msg.html" target="_blank" rel="noopener">Notice of Data Breach</a>&#8221; message posted on Saturday, Mar. 20, the Controller&#8217;s Office said that for more than 24 hours starting on the afternoon of March 18 attackers had access to the email records of an employee in its Unclaimed Property Division after the employee clicked a phishing link and then entered their email ID and password.</p>
<p>&#8220;The SCO has reason to believe the compromised email account had personal identifying information contained in Unclaimed Property Holder Reports,&#8221; the agency said, urging state employees contacted by the agency to place fraud alerts on their credit files with the major consumer bureaus.  &#8220;The unauthorized user also sent potentially malicious emails to some of the SCO employee&#8217;s contacts.&#8221;</p>
<p>The SCO has not responded to requests for comment first sent Monday. But an always-reliable source in an adjacent California state agency who&#8217;s been tracking the incident internally with other employees says the SCO forgot to mention the intruders also had access to the phished employee&#8217;s <strong>Microsoft Office 365 files </strong>&#8212; and potentially any files shared with that account across the state network.</p>
<p>&#8220;This isn&#8217;t even the full extent of the breach,&#8221; said the California state employee, who spoke on condition of anonymity.<span id="more-54930"></span></p>
<p>The source said the intruders stole several documents with personal and financial data on thousands of state employees, and then used the phished employee&#8217;s inbox to send targeted phishing emails to at least 9,000 California state workers and their contacts.</p>
<div id="attachment_54937" style="width: 609px" class="wp-caption aligncenter"><a href="media/c53aba14.soc-calif.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/03/soc-calif.png"><img aria-describedby="caption-attachment-54937" loading="lazy" class="wp-image-54937" src="media/c53aba14.soc-calif.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/03/soc-calif.png" alt="" width="599" height="246" srcset="https://krebsonsecurity.com/wp-content/uploads/2021/03/soc-calif.png 1209w, https://krebsonsecurity.com/wp-content/uploads/2021/03/soc-calif-768x316.png 768w" sizes="(max-width: 599px) 100vw, 599px" /></a><p id="caption-attachment-54937" class="wp-caption-text">The State Controller is the Chief Fiscal Officer of California, the sixth largest economy in the world. Source: sco.ca.gov. </p></div>
<p>Many attackers can do a great deal of damage with 24 hours of access to a user&#8217;s account. And spear-phishing others that frequently interact with the SCO via email could land the bad guys even more access to state systems. The SCO holds an enormous amount of personal and financial information on millions of people and companies that do business with or in the state.</p>
<p>Organizations hoping to improve internal security often turn to companies that help employees learn how to detect and dodge email phishing attacks &#8212; by sending them simulated phishing emails and then grading employees on their responses. The employee said that until very recently California was using one such company to help them conduct regular employee training on phishing.</p>
<p>Then in October 2020, the <strong>California Department of Technology </strong>(CDT) issued <a href="media/e5413c7a.SIMM5320-A-Phishing-Exercise-Standard_2020-0930.pdf" data-original-source="https://cdt.ca.gov/wp-content/uploads/2020/10/SIMM5320-A-Phishing-Exercise-Standard_2020-0930.pdf" target="_blank" rel="noopener">a new set of guidelines</a> that effectively require all executives, managers and supervisors to know all of the details of a phishing exercise before it occurs. Which suggests plenty of people who definitely should get phish tested along with everyone else won&#8217;t get the same ongoing training.</p>
<p>&#8220;Meaning, such people will be tested ever again,&#8221; the state agency source said. &#8220;It&#8217;s utterly absurd and no one at CDT is taking ownership of this kludge. The standard was also written in such a way to effectively ban dynamic testing like you see in KnowBe4, where even an administrators won&#8217;t know what phishing template they might receive.&#8221; [Full disclosure: KnowBe4 is an advertiser on this site].</p>
<p>KrebsOnSecurity reached out to the CDT for comment, and will update this post if they reply.</p>


feed_id: https://krebsonsecurity.com/?p=54964
title: No, I Did Not Hack Your MS Exchange Server
uri: No-I-Did-Not-Hack-Your-MS-Exchange-Server
url: https://krebsonsecurity.com/2021/03/no-i-did-not-hack-your-ms-exchange-server/
content:
<p>New data suggests someone has compromised more than 21,000 <strong>Microsoft Exchange Server</strong> email systems worldwide and infected them with malware that invokes both KrebsOnSecurity and Yours Truly by name.</p>
<p><img loading="lazy" class="aligncenter wp-image-54572" src="media/5315fb8a.exchange.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/03/exchange.png" alt="" width="595" height="201" srcset="https://krebsonsecurity.com/wp-content/uploads/2021/03/exchange.png 1072w, https://krebsonsecurity.com/wp-content/uploads/2021/03/exchange-768x259.png 768w" sizes="(max-width: 595px) 100vw, 595px" /></p>
<p>Let&#8217;s just get this out of the way right now: It wasn&#8217;t me.</p>
<p><a href="https://www.shadowserver.org/news/shadowserver-special-report-exchange-scanning-5/" target="_blank" rel="noopener">The Shadowserver Foundation</a>, a nonprofit that helps network owners identify and fix security threats, says it has found 21,248 different Exchange servers which appear to be compromised by a backdoor and communicating with <strong>brian[.]krebsonsecurity[.]top</strong> (NOT a safe domain, hence the hobbling).</p>
<p>Shadowserver has been tracking <a href="https://krebsonsecurity.com/2021/03/a-basic-timeline-of-the-exchange-mass-hack/" target="_blank" rel="noopener">wave after wave of attacks targeting flaws in Exchange</a> that Microsoft addressed earlier this month in <a href="https://krebsonsecurity.com/2021/03/microsoft-chinese-cyberspies-used-4-exchange-server-flaws-to-plunder-emails/" target="_blank" rel="noopener">an emergency patch release</a>. The group looks for attacks on Exchange systems using a combination of active Internet scans and &#8220;honeypots&#8221; &#8212; systems left vulnerable to attack so that defenders can study what attackers are doing to the devices and how.</p>
<p><strong>David Watson, </strong>a longtime member and director of the Shadowserver Foundation Europe, says his group has been keeping a close eye on hundreds of unique variants of backdoors (a.k.a. &#8220;web shells&#8221;) that various cybercrime groups worldwide have been using to commandeer any unpatched Exchange servers. These backdoors give an attacker complete, remote control over the Exchange server (including any of the server&#8217;s emails).</p>
<p>On Mar. 26, Shadowserver saw an attempt to install a new type of backdoor in compromised Exchange Servers, and with each hacked host it installed the backdoor in the same place: &#8220;<strong>/owa/auth/babydraco.aspx.</strong>&#8221;</p>
<p>&#8220;The web shell path that was dropped was new to us,&#8221; said Watson said. &#8220;We have been testing 367 known web shell paths via scanning of Exchange servers.&#8221;</p>
<p>OWA refers to <strong>Outlook Web Access</strong>, the Web-facing portion of on-premises Exchange servers. Shadowserver&#8217;s honeypots saw multiple hosts with the Babydraco backdoor doing the same thing: Running a Microsoft Powershell script that fetches the file &#8220;krebsonsecurity.exe&#8221; from the Internet address <strong>159.65.136[.]128</strong>. Oddly, none of the <a href="https://www.virustotal.com/gui/file/5f7d898ade3162bfb0c8d3006c42e934ff81fab3b4ad3b51c13441fd63e438cb/behavior/VirusTotal%20Jujubox" target="_blank" rel="noopener">several dozen antivirus tools available</a> to scan the file at <strong>Virustotal.com</strong> currently detect it as malicious.</p>
<p>The Krebsonsecurity file also installs a root certificate, modifies the system registry, and schedules a task to run in perpetuity. Which task, you ask? It runs <strong>Windows Defender</strong>, which is a security product Microsoft ships with Windows devices that can help block attacks such as those we&#8217;ve seen targeting Exchange servers.</p>
<p>Turning on Windows Defender ensures that the machines won&#8217;t be compromised by other attackers going forward. While it may be tempting to think this Krebsonsecurity file is some kind of benign worm trying to inoculate vulnerable Exchange Server systems, <em>whoever unleashed this thing is  likely still in control of these 21,000+ Exchange servers</em>.</p>
<p>Indeed, Watson said the Krebsonsecurity file will attempt to open up an encrypted connection between the Exchange server and the above-mentioned IP address, and send a small amount of traffic to it each minute.<span id="more-54964"></span></p>
<p>Shadowserver found more than 21,000 Exchange Server systems that had the Babydraco backdoor installed. But Watson said they don&#8217;t know how many of those systems also ran the secondary download from the rogue Krebsonsecurity domain.</p>
<p>&#8220;Despite the abuse, this is potentially a good opportunity to highlight how vulnerable/compromised MS Exchange servers are being exploited in the wild right now, and hopefully help get the message out to victims that they need to sign up our free daily network reports,&#8221; Watson said.</p>
<p>There are hundreds of thousands of Exchange Server systems worldwide that were vulnerable to attack (Microsoft suggests the number is about 400,000), and most of those have been patched over the last few weeks. However, there are still tens of thousands of vulnerable Exchange servers exposed online. On Mar. 25, Shadowserver <a href="https://twitter.com/Shadowserver/status/1375251582711963648" target="_blank" rel="noopener">tweeted</a> that it was tracking 73,927 unique active webshell paths across 13,803 IP addresses.</p>
<div id="attachment_54982" style="width: 600px" class="wp-caption aligncenter"><a href="media/c7d3f607.ss-activewebshells.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/03/ss-activewebshells.png"><img aria-describedby="caption-attachment-54982" loading="lazy" class="wp-image-54982" src="media/c7d3f607.ss-activewebshells.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/03/ss-activewebshells.png" alt="" width="590" height="336" srcset="https://krebsonsecurity.com/wp-content/uploads/2021/03/ss-activewebshells.png 1545w, https://krebsonsecurity.com/wp-content/uploads/2021/03/ss-activewebshells-768x437.png 768w, https://krebsonsecurity.com/wp-content/uploads/2021/03/ss-activewebshells-1536x874.png 1536w" sizes="(max-width: 590px) 100vw, 590px" /></a><p id="caption-attachment-54982" class="wp-caption-text">Image: Shadowserver.org</p></div>
<p>Exchange Server users that haven&#8217;t yet patched against the four flaws Microsoft fixed earlier this month can get immediate protection by deploying Microsoft&#8217;s &#8220;<a href="https://msrc-blog.microsoft.com/2021/03/15/one-click-microsoft-exchange-on-premises-mitigation-tool-march-2021/" target="_blank" rel="noopener">One-Click On-Premises Mitigation Tool</a>.&#8221;</p>
<p>The motivations of the cybercriminals behind the Krebonsecurity dot top domain are unclear, but the domain itself has a recent association with other cybercrime activity &#8212; and of harassing this author. I first heard about the domain in December 2020, when a reader told me how his entire network had been hijacked by a cryptocurrency mining botnet that called home to it.</p>
<p>&#8220;This morning, I noticed a fan making excessive noise on a server in my homelab,&#8221; the reader said. &#8220;I didn&#8217;t think much of it at the time, but after a thorough cleaning and test, it still was noisy. After I was done with some work-related things, I checked up on it &#8211; and found that a cryptominer had been dropped on my box, pointing to XXX-XX-XXX.krebsonsecurity.top&#8217;. In all, this has infected all three linux boxes on my network.&#8221;</p>
<p>What was the subdomain I X&#8217;d out of his message? Just my Social Security number. I&#8217;d been doxed via DNS.</p>
<p>This is hardly the first time malware or malcontents have abused my name, likeness and website trademarks as <a href="media/1a38c59c.memegenerator-600x216.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2013/05/memegenerator-600x216.png" rel="noopener" target="_blank">a cybercrime meme</a>, for harassment, or just to besmirch my reputation. <a href="https://krebsonsecurity.com/2013/05/krebs-krebsonsecurity-as-malware-memes/" target="_blank" rel="noopener">Here are a few of the more notable examples</a>, although all of those events are almost a decade old. That same list today would be pages long.</p>
<p>Further reading:</p>
<p><a href="https://krebsonsecurity.com/2021/03/a-basic-timeline-of-the-exchange-mass-hack/" target="_blank" rel="noopener">A Basic Timeline of the Exchange Mass-Hack</a></p>
<p><a href="https://krebsonsecurity.com/2021/03/warning-the-world-of-a-ticking-time-bomb/" target="_blank" rel="noopener">Warning the World of a Ticking Timebomb</a></p>
<p><a href="https://krebsonsecurity.com/2021/03/at-least-30000-u-s-organizations-newly-hacked-via-holes-in-microsofts-email-software/" target="_blank" rel="noopener">At Least 30,000 U.S. Organizations Newly Hacked Via Holes in Microsoft&#8217;s Email Software</a></p>
<p><a href="https://krebsonsecurity.com/2021/03/microsoft-chinese-cyberspies-used-4-exchange-server-flaws-to-plunder-emails/" target="_blank" rel="noopener">Microsoft: Chinese Cyberspies Used 4 Exchange Server Flaws to Plunder Emails</a></p>


feed_id: https://krebsonsecurity.com/?p=55007
title: Whistleblower: Ubiquiti Breach “Catastrophic”
uri: Whistleblower-Ubiquiti-Breach-Catastrophic
url: https://krebsonsecurity.com/2021/03/whistleblower-ubiquiti-breach-catastrophic/
content:
<p>On Jan. 11, <strong><a href="https://www.ui.com" target="_blank" rel="noopener">Ubiquiti Inc.</a></strong> [NYSE:UI] &#8212; a major vendor of cloud-enabled Internet of Things (IoT) devices such as routers, network video recorders and security cameras &#8212; disclosed that a breach involving a third-party cloud provider had exposed customer account credentials. Now a source who participated in the response to that breach alleges Ubiquiti massively downplayed a &#8220;catastrophic&#8221; incident to minimize the hit to its stock price, and that the third-party cloud provider claim was a fabrication.</p>
<p><img loading="lazy" class="aligncenter size-full wp-image-55018" src="media/0e5b7197.ubiquiti.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/03/ubiquiti.png" alt="" width="519" height="145" /></p>
<p>A security professional at Ubiquiti who helped the company respond to the two-month breach beginning in December 2020 contacted KrebsOnSecurity after raising his concerns with both Ubiquiti&#8217;s whistleblower hotline and with European data protection authorities. The source &#8212; we&#8217;ll call him <strong>Adam </strong>&#8212; spoke on condition of anonymity for fear of retribution by Ubiquiti.</p>
<p>&#8220;It was catastrophically worse than reported, and legal silenced and overruled efforts to decisively protect customers,&#8221; Adam wrote in a letter to the European Data Protection Supervisor. &#8220;The breach was massive, customer data was at risk, access to customers&#8217; devices deployed in corporations and homes around the world was at risk.&#8221;</p>
<p>Ubiquiti has not responded to repeated requests for comment.</p>
<p>According to Adam, the hackers obtained full read/write access to Ubiquiti databases at <strong>Amazon Web Services</strong> (AWS), which was the alleged &#8220;third party&#8221; involved in the breach. Ubiquiti&#8217;s breach disclosure, he wrote, was &#8220;downplayed and purposefully written to imply that a 3rd party cloud vendor was at risk and that Ubiquiti was merely a casualty of that, instead of the target of the attack.&#8221;</p>
<p>In <a href="https://krebsonsecurity.com/2021/01/ubiquiti-change-your-password-enable-2fa/" target="_blank" rel="noopener">its Jan. 11 public notice</a>, Ubiquiti said it became aware of &#8220;unauthorized access to certain of our information technology systems hosted by a third party cloud provider,&#8221; although it declined to name the third party.</p>
<p><img loading="lazy" class="aligncenter wp-image-54003" src="media/a189b433.ubi-notice.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/01/ubi-notice.png" alt="" width="598" height="632" /></p>
<p>In reality, Adam said, the attackers had gained administrative access to Ubiquiti&#8217;s servers at Amazon&#8217;s cloud service, which secures the underlying server hardware and software but requires the cloud tenant (client) to secure access to any data stored there.</p>
<p>&#8220;They were able to get cryptographic secrets for single sign-on cookies and remote access, full source code control contents, and signing keys exfiltration,&#8221; Adam said.</p>
<p>Adam says the attacker(s) had access to privileged credentials that were previously stored in the <a href="https://en.wikipedia.org/wiki/LastPass" target="_blank" rel="noopener">LastPass</a> account of a Ubiquiti IT employee, and gained root administrator access to all Ubiquiti AWS accounts, including all S3 data buckets, all application logs, all databases, all user database credentials, and secrets required to forge single sign-on (SSO) cookies.</p>
<p>Such access could have allowed the intruders to remotely authenticate to countless Ubiquiti cloud-based devices around the world. According to its website, Ubiquiti has shipped more than 85 million devices that play a key role in networking infrastructure in over 200 countries and territories worldwide.<span id="more-55007"></span></p>
<p>Adam says Ubiquiti&#8217;s security team picked up signals in late December 2020 that someone with administrative access had set up several Linux virtual machines that weren&#8217;t accounted for.</p>
<p>Then they found a backdoor that an intruder had left behind in the system.</p>
<p>When security engineers removed the backdoor account in the first week of January, <span class="pullquote pqright">the intruders responded by sending a message saying they wanted 50 bitcoin (~$2.8 million USD) in exchange for a promise to remain quiet about the breach.</span> The attackers also provided proof they&#8217;d stolen Ubiquiti&#8217;s source code, and pledged to disclose the location of another backdoor if their ransom demand was met.</p>
<p>Ubiquiti did not engage with the hackers, Adam said, and ultimately the incident response team found the second backdoor the extortionists had left in the system. The company would spend the next few days furiously rotating credentials for all employees, before Ubiquiti started alerting customers about the need to reset their passwords.</p>
<p>But he maintains that instead of asking customers to change their passwords when they next log on &#8212; as the company did on Jan. 11 &#8212; Ubiquiti should have immediately invalidated all of its customer&#8217;s credentials and forced a reset on all accounts, mainly because the intruders already had credentials needed to remotely access customer IoT systems.</p>
<p>&#8220;Ubiquiti had negligent logging (no access logging on databases) so it was unable to prove or disprove what they accessed, but the attacker targeted the credentials to the databases, and created Linux instances with networking connectivity to said databases,&#8221; Adam wrote in his letter. &#8220;Legal overrode the repeated requests to force rotation of all customer credentials, and to revert any device access permission changes within the relevant period.&#8221;</p>
<p>If you have Ubiquiti devices installed and haven&#8217;t yet changed the passwords on the devices since Jan. 11 this year, now would be a good time to care of that.</p>
<p>It might also be a good idea to just delete any profiles you had on these devices, make sure they&#8217;re up to date on the latest firmware, and then re-create those profiles with new [and preferably unique] credentials. And seriously consider disabling any remote access on the devices.</p>
<p>Ubiquiti&#8217;s stock price has grown remarkably since the company&#8217;s breach disclosure Jan. 16. After a brief dip following the news, Ubiquiti&#8217;s shares have surged from $243 on Jan. 13 to $370 as of today.</p>


feed_id: https://krebsonsecurity.com/?p=55099
title: New KrebsOnSecurity Mobile-Friendly Site
uri: New-KrebsOnSecurity-Mobile-Friendly-Site
url: https://krebsonsecurity.com/2021/04/new-krebsonsecurity-mobile-friendly-site/
content:
<p>Dear Readers, this has been long overdue, but at last I give you a more responsive, mobile-friendly version of KrebsOnSecurity. We tried to keep the visual changes to a minimum and focus on a simple theme that presents information in a straightforward, easy-to-read format. Please bear with us over the next few days as we hunt down the gremlins in the gears.</p>
<p><img loading="lazy" class="aligncenter wp-image-55100" src="media/9a731ba3.sitelaunch.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/04/sitelaunch.png" alt="" width="599" height="636" /></p>
<p>We were shooting for responsive (fast) and uncluttered. Hopefully, we achieved that and this new design will render well in whatever device you use to view it. If something looks amiss, please don&#8217;t hesitate to drop a note in the comments below.</p>
<p><strong>NB:</strong> KrebsOnSecurity has not changed any of its advertising practices: The handful of ads we run are still image-only creatives that are vetted by me and served in-house. If you&#8217;re blocking ads on this site, please consider adding an exception here. Thank you!</p>


feed_id: https://krebsonsecurity.com/?p=55110
title: Ubiquiti All But Confirms Breach Response Iniquity
uri: Ubiquiti-All-But-Confirms-Breach-Response-Iniquity
url: https://krebsonsecurity.com/2021/04/ubiquiti-all-but-confirms-breach-response-iniquity/
content:
<p>For four days this past week, Internet-of-Things giant <strong>Ubiquiti </strong>failed to respond to requests for comment on a whistleblower&#8217;s allegations the company had massively downplayed a &#8220;catastrophic&#8221; two-month breach ending in January to save its stock price, and that Ubiquiti&#8217;s insinuation that a third-party was to blame was a fabrication. I was happy to add their eventual public response to <a href="https://krebsonsecurity.com/2021/03/whistleblower-ubiquiti-breach-catastrophic/" target="_blank" rel="noopener">the top of Tuesday&#8217;s story on the whistleblower&#8217;s claims</a>, but their statement deserves a post of its own because it actually confirms and reinforces those claims.</p>
<p><img loading="lazy" class="aligncenter wp-image-55018" src="media/0e5b7197.ubiquiti.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/03/ubiquiti.png" alt="" width="762" height="213" /></p>
<p>Ubiquiti&#8217;s IoT gear includes things like WiFi routers, security cameras, and network video recorders. Their products have long been popular with security nerds and DIY types because they make it easy for users to build their own internal IoT networks without spending many thousands of dollars.</p>
<p>But some of that shine started to come off recently for Ubiquiti&#8217;s more security-conscious customers after the company began pushing everyone to use a unified authentication and access solution that makes it difficult to administer these devices without first authenticating to Ubiquiti&#8217;s cloud infrastructure.</p>
<p>All of a sudden, local-only networks were being connected to Ubiquiti&#8217;s cloud, giving rise to countless discussion threads on Ubiquiti&#8217;s user forums from customers upset over the potential for introducing new security risks.</p>
<p>And on Jan. 11, Ubiquiti gave weight to that angst: It told customers to <a href="https://krebsonsecurity.com/2021/01/ubiquiti-change-your-password-enable-2fa/" target="_blank" rel="noopener">reset their passwords and enable multifactor authentication</a>, saying a breach involving a third-party cloud provider might have exposed user account data. Ubiquiti told customers they were &#8220;not currently aware of evidence of access to any databases that host user data, but we cannot be certain that user data has not been exposed.&#8221;</p>
<div id="attachment_54003" style="width: 637px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-54003" loading="lazy" class="size-full wp-image-54003" src="media/a189b433.ubi-notice.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/01/ubi-notice.png" alt="" width="627" height="662" /><p id="caption-attachment-54003" class="wp-caption-text">Ubiquiti&#8217;s notice on Jan. 12, 2021.</p></div>
<p>On Tuesday, KrebsOnSecurity reported that a source who participated in the response to the breach said Ubiquiti should have immediately invalidated all credentials because all of the company&#8217;s key administrator passwords had been compromised as well. The whistleblower also said Ubiquiti never kept any logs of who was accessing its databases.</p>
<p>The whistleblower, &#8220;<strong>Adam</strong>,&#8221; spoke on condition of anonymity for fear of reprisals from Ubiquiti. Adam said the place where those key administrator credentials were compromised &#8212; Ubiquiti&#8217;s presence on Amazon&#8217;s Web Services (AWS) cloud services &#8212; was in fact the &#8220;third party&#8221; blamed for the hack.</p>
<p>From Tuesday&#8217;s piece:</p>
<blockquote><p>&#8220;In reality, Adam said, the attackers had gained administrative access to Ubiquiti’s servers at Amazon’s cloud service, which secures the underlying server hardware and software but requires the cloud tenant (client) to secure access to any data stored there.</p>
<p>“They were able to get cryptographic secrets for single sign-on cookies and remote access, full source code control contents, and signing keys exfiltration,” Adam said.</p>
<p>Adam says the attacker(s) had access to privileged credentials that were previously stored in the LastPass account of a Ubiquiti IT employee, and gained root administrator access to all Ubiquiti AWS accounts, including all S3 data buckets, all application logs, all databases, all user database credentials, and secrets required to forge single sign-on (SSO) cookies.</p>
<p>Such access could have allowed the intruders to remotely authenticate to countless Ubiquiti cloud-based devices around the world. According to its website, Ubiquiti has shipped more than 85 million devices that play a key role in networking infrastructure in over 200 countries and territories worldwide.</p></blockquote>
<p>Ubiquiti finally responded on Mar. 31, in <a href="https://community.ui.com/questions/How-to-remove-this-ridiculous-ad-for-Unifi-Protect-from-UFV-installations/b99f9c81-f0e1-4015-b5f3-122035f21811" target="_blank" rel="noopener">a post signed &#8220;Team UI&#8221; on the company&#8217;s community forum online</a>.</p>
<p>&#8220;Nothing has changed with respect to our analysis of customer data and the security of our products since our notification on January 11. In response to this incident, we leveraged external incident response experts to conduct a thorough investigation to ensure the attacker was locked out of our systems.&#8221;</p>
<p>&#8220;These experts identified no evidence that customer information was accessed, or even targeted. The attacker, who unsuccessfully attempted to extort the company by threatening to release stolen source code and specific IT credentials, never claimed to have accessed any customer information. This, along with other evidence, is why we believe that customer data was not the target of, or otherwise accessed in connection with, the incident.&#8221;</p>
<div id="attachment_55156" style="width: 783px" class="wp-caption aligncenter"><a href="media/a730892d.UI-response.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/04/UI-response.png"><img aria-describedby="caption-attachment-55156" loading="lazy" class="wp-image-55156" src="media/a730892d.UI-response.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/04/UI-response.png" alt="" width="773" height="495" srcset="https://krebsonsecurity.com/wp-content/uploads/2021/04/UI-response.png 854w, https://krebsonsecurity.com/wp-content/uploads/2021/04/UI-response-768x492.png 768w, https://krebsonsecurity.com/wp-content/uploads/2021/04/UI-response-782x501.png 782w" sizes="(max-width: 773px) 100vw, 773px" /></a><p id="caption-attachment-55156" class="wp-caption-text">Ubiquiti&#8217;s response this week on its user forum.</p></div>
<p>Ubiquiti also hinted it had an idea of who was behind the attack, saying it has &#8220;well-developed evidence that the perpetrator is an individual with intricate knowledge of our cloud infrastructure. As we are cooperating with law enforcement in an ongoing investigation, we cannot comment further.&#8221;<span id="more-55110"></span></p>
<p>Ubiquiti&#8217;s statement largely confirmed the reporting here by not disputing any of the facts raised in the piece. And while it may seem that Ubiquiti is quibbling over whether data was in fact stolen, Adam said Ubiquiti can say there is no evidence that customer information was accessed because Ubiquiti failed to keep logs of who was accessing its databases.</p>
<p>“Ubiquiti had negligent logging (no access logging on databases) so it was unable to prove or disprove what they accessed, but the attacker targeted the credentials to the databases, and created Linux instances with networking connectivity to said databases,” Adam wrote in a whistleblower letter to European privacy regulators last month. “Legal overrode the repeated requests to force rotation of all customer credentials, and to revert any device access permission changes within the relevant period.”</p>
<p>It appears investors noticed the incongruity as well. Ubiquiti’s share price hardly blinked at the January breach disclosure. On the contrary, from Jan. 13 to Tuesday&#8217;s story its stock had soared from $243 to $370. By the end of trading day Mar. 30, UI had slipped to $349. By close of trading on Thursday (markets were closed Friday) the stock had fallen to $289.</p>
<p><img loading="lazy" class="aligncenter wp-image-55132" src="media/149e61c2.ubistock.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/04/ubistock.png" alt="" width="738" height="456" /></p>


feed_id: https://krebsonsecurity.com/?p=55161
title: Ransom Gangs Emailing Victim Customers for Leverage
uri: Ransom-Gangs-Emailing-Victim-Customers-for-Leverage
url: https://krebsonsecurity.com/2021/04/ransom-gangs-emailing-victim-customers-for-leverage/
content:
<p>Some of the top ransomware gangs are deploying a new pressure tactic to push more victim organizations into paying an extortion demand: Emailing the victim&#8217;s customers and partners directly, warning that their data will be leaked to the dark web unless they can convince the victim firm to pay up.</p>
<div id="attachment_55166" style="width: 641px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-55166" loading="lazy" class="size-full wp-image-55166" src="media/d992076a.ransompushred.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/04/ransompushred.png" alt="" width="631" height="691" /><p id="caption-attachment-55166" class="wp-caption-text">This letter is from the Clop ransomware gang, putting pressure on a recent victim named on Clop&#8217;s dark web shaming site.</p></div>
<p>&#8220;Good day! If you received this letter, you are a customer, buyer, partner or employee of [victim],&#8221; the missive reads. &#8220;The company has been hacked, data has been stolen and will soon be released as the company refuses to protect its peoples&#8217; data.&#8221;</p>
<p>&#8220;We inform you that information about you will be published on the darknet [link to dark web victim shaming page] if the company does not contact us,&#8221; the message concludes. &#8220;Call or write to this store and ask to protect your privacy!!!!&#8221;</p>
<p>The message above was sent to a customer of <strong>RaceTrac Petroleum</strong>, an Atlanta company that operates more than 650 retail gasoline convenience stores in 12 southeastern states. The person who shared that screenshot above isn&#8217;t a distributor or partner of RaceTrac, but they said they are a RaceTrac rewards member, so the company definitely has their email address and other information.</p>
<p>Several gigabytes of the company&#8217;s files &#8212; including employee tax and financial records &#8212; have been posted to the victim shaming site for the <strong>Clop</strong> ransomware gang.</p>
<p>In response to questions from KrebsOnSecurity, RaceTrac said it was recently impacted by a security incident affecting one of its third-party service providers, <strong>Accellion Inc. </strong></p>
<p>For the past few months, attackers have been exploiting a <a href="https://www.accellion.com/company/press-releases/accellion-provides-update-to-recent-fta-security-incident/" target="_blank" rel="noopener">a zero-day vulnerability in Accellion File Transfer Appliance (FTA) software</a>, a flaw that has been seized upon by Clop to break into dozens of other major companies like <a href="https://www.zdnet.com/article/oil-giant-shell-discloses-data-breach-linked-to-accellion-fta-vulnerability/" target="_blank" rel="noopener">oil giant Shell</a> and <a href="https://www.computerweekly.com/news/252497263/Qualys-caught-up-in-Accellion-FTA-breach" target="_blank" rel="noopener">security firm Qualys</a>.</p>
<p>&#8220;By exploiting a previously undetected software vulnerability, unauthorized parties were able to access a subset of RaceTrac data stored in the Accellion File Transfer Service, including email addresses and first names of some of our RaceTrac Rewards Loyalty users,&#8221; the company <a href="https://www.racetrac.com/Accellion-Incident" target="_blank" rel="noopener">wrote</a>. &#8220;This incident was limited to the aforementioned Accellion services and did not impact RaceTrac’s corporate network. The systems used for processing guest credit, debit and RaceTrac Rewards transactions were not impacted.&#8221;</p>
<p>The same extortion pressure email has been going out to people associated with the <strong>University of California</strong>, which was one of <a href="https://heimdalsecurity.com/blog/attackers-disclose-data-of-students-in-cyberattack/" target="_blank" rel="noopener">several large U.S. universities that got hit with Clop ransomware recently</a>. Most of those university ransomware incidents appeared to be tied to attacks on attacks on the same Accellion vulnerability, and the company has acknowledged roughly a third of its customers on that appliance got compromised as a result.</p>
<p>Clop is one of several ransom gangs that will demand two ransoms: One for a digital key needed to unlock computers and data from file encryption, and a second to avoid having stolen data published or sold online. That means even victims who opt not to pay to get their files and servers back still have to decide whether to pay the second ransom to protect the privacy of their customers.</p>
<p>As I noted in <a href="https://krebsonsecurity.com/2020/11/why-paying-to-delete-stolen-data-is-bonkers/" target="_blank" rel="noopener">Why Paying to Delete Stolen Data is Bonkers</a>, leaving aside the notion that victims might have any real expectation the attackers will actually destroy the stolen data, new research suggests a fair number of victims who do pay up may see some or all of the stolen data published anyway.<span id="more-55161"></span></p>
<p>The email in the screenshot above differs slightly from those covered last week by <em>Bleeping Computer</em>, which was the first to spot the new victim notification wrinkle. Those emails say that the recipient is being contacted as they are a customer of the store, and their personal data, including phone numbers, email addresses, and credit card information, will soon be published if the store does not pay a ransom, <a href="https://www.bleepingcomputer.com/news/security/ransomware-gang-urges-victims-customers-to-demand-a-ransom-payment/" target="_blank" rel="noopener">writes</a> <strong>Lawrence Abrams</strong>.</p>
<p>&#8220;Perhaps you bought something there and left your personal data. Such as phone, email, address, credit card information and social security number,&#8221; the Clop gang states in the email.</p>
<p><strong>Fabian Wosar</strong>, chief technology officer at computer security firm <a href="https://www.emsisoft.com/" target="_blank" rel="noopener">Emsisoft</a>, said the direct appeals to victim customers is a natural extension of other advertising efforts by the ransomware gangs, which <a href="https://krebsonsecurity.com/2020/11/ransomware-group-turns-to-facebook-ads/" target="_blank" rel="noopener">recently included using hacked Facebook accounts to post victim shaming advertisements</a>.</p>
<p>Wosar said Clop isn&#8217;t the only ransomware gang emailing victim customers.</p>
<p>&#8220;Clop likes to do it and I think REvil started as well,&#8221; Wosar said.</p>
<p>Earlier this month, <em>Bleeping Computer</em> <a href="https://www.bleepingcomputer.com/news/security/ransomware-gang-plans-to-call-victims-business-partners-about-attacks/" target="_blank" rel="noopener">reported</a> that the <a href="https://krebsonsecurity.com/?s=revil" target="_blank" rel="noopener">REvil ransomware operation</a> was planning on launching crippling distributed denial of service (DDoS) attacks against victims, or making VOIP calls to victims&#8217; customers to apply further pressure.</p>
<p>&#8220;Sadly, regardless of whether a ransom is paid, consumers whose data has been stolen are still at risk as there is no way of knowing if ransomware gangs delete the data as they promise,&#8221; Abrams wrote.</p>


feed_id: https://krebsonsecurity.com/?p=55179
title: Are You One of the 533M People Who Got Facebooked?
uri: Are-You-One-of-the-533M-People-Who-Got-Facebooked
url: https://krebsonsecurity.com/2021/04/are-you-one-of-the-533m-people-who-got-facebooked/
content:
<p>Ne&#8217;er-do-wells leaked personal data &#8212; including phone numbers &#8212; for some 553 million <strong>Facebook</strong> users this week. Facebook <a href="https://www.businessinsider.com/stolen-data-of-533-million-facebook-users-leaked-online-2021-4?IR=T" target="_blank" rel="noopener">says</a> the data was collected before 2020 when it changed things to prevent such information from being scraped from profiles. To my mind, this just reinforces the need to remove mobile phone numbers from all of your online accounts wherever feasible. Meanwhile, if you&#8217;re a Facebook <a href="https://twitter.com/jaketapper/status/976473447374221313" target="_blank" rel="noopener"><del>product</del></a> user and want to learn if your data was leaked, there are easy ways to find out.</p>
<p>The <a href="https://haveibeenpwned.com/" target="_blank" rel="noopener">HaveIBeenPwned</a> project, which collects and analyzes hundreds of database dumps containing information about billions of leaked accounts, has <a href="https://www.troyhunt.com/the-facebook-phone-numbers-are-now-searchable-in-have-i-been-pwned/" target="_blank" rel="noopener">incorporated the data into his service</a>. Facebook users can enter the mobile number (in international format) associated with their account and see if those digits were exposed in the new data dump (HIBP doesn&#8217;t show you any data, just gives you a yes/no on whether your data shows up). <img loading="lazy" class="aligncenter wp-image-55183" src="media/1f7efa8e.hibp.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/04/hibp.png" alt="" width="773" height="360" srcset="https://krebsonsecurity.com/wp-content/uploads/2021/04/hibp.png 1258w, https://krebsonsecurity.com/wp-content/uploads/2021/04/hibp-768x358.png 768w, https://krebsonsecurity.com/wp-content/uploads/2021/04/hibp-782x364.png 782w" sizes="(max-width: 773px) 100vw, 773px" /></p>
<p>The phone number associated with my late Facebook account (which I deleted in Jan. 2020) was not in HaveIBeenPwned, but then again Facebook claims to have more than 2.7 billion active monthly users.</p>
<p>It appears much of this database has been kicking around the cybercrime underground in one form or another since last summer at least. According to <a href="https://twitter.com/UnderTheBreach/status/1349671294808285184/photo/1" target="_blank" rel="noopener">a Jan. 14, 2021 Twitter post from Under the Breach&#8217;s Alon Gal</a>, the 533 million Facebook accounts database was first put up for sale back in June 2020, offering Facebook profile data from 100 countries, including name, mobile number, gender, occupation, city, country, and marital status.</p>
<p>Under The Breach <a href="https://twitter.com/UnderTheBreach/status/1349671417625931778" target="_blank" rel="noopener">also said back in January</a> that someone had created a Telegram bot allowing users to query the database for a low fee, and enabling people to find the phone numbers linked to a large number of Facebook accounts.</p>
<div id="attachment_55185" style="width: 775px" class="wp-caption aligncenter"><a href="media/b12ce6b7.533m.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/04/533m.png"><img aria-describedby="caption-attachment-55185" loading="lazy" class="wp-image-55185" src="media/b12ce6b7.533m.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/04/533m.png" alt="" width="765" height="272" srcset="https://krebsonsecurity.com/wp-content/uploads/2021/04/533m.png 1114w, https://krebsonsecurity.com/wp-content/uploads/2021/04/533m-768x273.png 768w, https://krebsonsecurity.com/wp-content/uploads/2021/04/533m-782x278.png 782w" sizes="(max-width: 765px) 100vw, 765px" /></a><p id="caption-attachment-55185" class="wp-caption-text">A cybercrime forum ad from June 2020 selling a database of 533 Million Facebook users. Image: @UnderTheBreach</p></div>
<p>Many people may not consider their mobile phone number to be private information, but there is a world of misery that bad guys, stalkers and creeps can visit on your life just by knowing your mobile number. Sure they could call you and harass you that way, but more likely they will see how many of your other accounts &#8212; at major email providers and social networking sites like Facebook, <strong>Twitter</strong>, <strong>Instagram</strong>, e.g. &#8212; rely on that number for password resets.<span id="more-55179"></span></p>
<p>From there, the target is primed for <a href="https://krebsonsecurity.com/tag/sim-swapping/" target="_blank" rel="noopener">a SIM-swapping attack</a>, where thieves trick or bribe employees at mobile phone stores into transferring ownership of the target&#8217;s phone number to a mobile device controlled by the attackers. From there, the bad guys can reset the password of any account to which that mobile number is tied, and of course intercept any one-time tokens sent to that number for the purposes of multi-factor authentication.</p>
<p>Or the attackers take advantage of some other privacy and security wrinkle in the way SMS text messages are handled. Last month, a security researcher showed how easy it was to <a href="https://krebsonsecurity.com/2021/03/can-we-stop-pretending-sms-is-secure-now/" target="_blank" rel="noopener">abuse services aimed at helping celebrities manage their social media profiles to intercept SMS messages for any mobile user</a>. That weakness has supposedly been patched for all the major wireless carriers now, but it really makes you question the ongoing sanity of relying on the Internet equivalent of postcards (SMS) to securely handle quite sensitive information.</p>
<div class="entry-content">
<p>My advice has long been to remove phone numbers from your online accounts wherever you can, and avoid selecting SMS or phone calls for second factor or one-time codes. Phone numbers were <a href="https://krebsonsecurity.com/2019/03/why-phone-numbers-stink-as-identity-proof/" target="_blank" rel="noopener">never designed to be identity documents</a>, but that’s effectively what they’ve become. It’s time we stopped letting everyone treat them that way.</p>
<p>Any online accounts that you value should be secured with a unique and strong password, as well as the most robust form of multi-factor authentication available. Usually, this is a mobile app like Authy or Google Authenticator that generates a one-time code. Some sites like Twitter and Facebook now support even more robust options — such as <a href="https://krebsonsecurity.com/?s=security+keys&amp;x=0&amp;y=0" target="_blank" rel="noopener">physical security keys</a>.</p>
<p>Removing your phone number may be even more important <a href="https://krebsonsecurity.com/2013/06/the-value-of-a-hacked-email-account/" target="_blank" rel="noopener">for any email accounts you may have</a>. Sign up with any service online, and it will almost certainly require you to supply an email address. In nearly all cases, the person who is in control of that address can reset the password of any associated services or accounts– merely by requesting a password reset email.</p>
<p>Unfortunately, many email providers still let users reset their account passwords by having a link sent via text to the phone number on file for the account. So remove the phone number as a backup for your email account, and ensure a more robust second factor is selected for all available account recovery options.</p>
<p>Here’s the thing: Most online services require users to supply a mobile phone number when setting up the account, but do not require the number to remain associated with the account after it is established. I advise readers <a href="https://krebsonsecurity.com/2019/03/why-phone-numbers-stink-as-identity-proof/" target="_blank" rel="noopener">to remove their phone numbers from accounts wherever possible</a>, and to take advantage of a mobile app to generate any one-time codes for multifactor authentication.</p>
<p>Why did KrebsOnSecurity delete its Facebook account early last year? Sure, it might had something to do with the incessant stream of breaches, leaks and privacy betrayals by Facebook over the years. But what really bothered me were the number of people who felt comfortable sharing extraordinarily sensitive information with me on things like Facebook Messenger, all the while expecting that I can vouch for the privacy and security of that message just by virtue of my presence on the platform.</p>
</div>
<p>In case readers want to get in touch for any reason, my email here is <em>krebsonsecurity at gmail dot com</em>, or <em>krebsonsecurity at protonmail.com</em>. I also respond at <strong>Krebswickr</strong> on the encrypted messaging platform <a href="https://www.wickr.com" target="_blank" rel="noopener">Wickr</a>.</p>


