# articles

feed_id: https://krebsonsecurity.com/?p=36538
title: Spreading the DDoS Disease and Selling the Cure
uri: Spreading-the-DDoS-Disease-and-Selling-the-Cure
url: https://krebsonsecurity.com/2016/10/spreading-the-ddos-disease-and-selling-the-cure/
content:
<p>Earlier this month a hacker <a href="https://krebsonsecurity.com/2016/10/source-code-for-iot-botnet-mirai-released/" target="_blank">released the source code</a> for <b>Mirai</b>, a malware strain that was used to launch <a href="https://krebsonsecurity.com/2016/09/krebsonsecurity-hit-with-record-ddos/" target="_blank">a historically large</a> 620 Gbps denial-of-service attack against this site in September. That attack came in apparent retribution for a story here which directly preceded the <a href="https://krebsonsecurity.com/2016/09/alleged-vdos-proprietors-arrested-in-israel/" target="_blank">arrest of two Israeli men</a> for allegedly <a href="https://krebsonsecurity.com/2016/09/israeli-online-attack-service-vdos-earned-600000-in-two-years/" target="_blank">running an online attack for hire service called vDOS</a>. Turns out, the site where the Mirai source code was leaked had some very interesting things in common with the place vDOS called home.</p>
<p>The domain name where the Mirai source code was originally placed for download &#8212; <strong>santasbigcandycane[dot]cx</strong> &#8212; is registered at the same domain name registrar that was used to register the now-defunct DDoS-for-hire service <strong>vdos-s[dot]com</strong>.</p>
<p>Normally, this would not be remarkable, since most domain registrars have thousands or millions of domains in their stable. But in this case it is interesting mainly because the registrar used by both domains &#8212; a company called <strong>namecentral.com</strong> &#8212; <em>has apparently been used to register just 38 domains since its inception by its current owner in 2012</em>, according to a historic WHOIS records gathered by <a href="http://www.domaintools.com" target="_blank">domaintools.com</a> (for the full list see <a href="media/70d5636d.namecentraldomains.pdf" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2016/10/namecentraldomains.pdf" target="_blank">this PDF</a>).</p>
<p>What&#8217;s more, a cursory look at the other domains registered via namecentral.com since then reveals a number of other DDoS-for-hire services, also known as &#8220;booter&#8221; or &#8220;stresser&#8221; services.</p>
<p>It&#8217;s extremely odd that someone would take on the considerable cost and trouble of creating a domain name registrar just to register a few dozen domains. It costs $3,500 to apply to the <a href="https://en.wikipedia.org/wiki/ICANN" target="_blank">Internet Corporation for Assigned Names and Numbers</a> (ICANN) for <a href="https://www.icann.org/resources/pages/financials-55-2012-02-25-en" target="_blank">a new registrar authority</a>. The annual fee for being an ICANN-approved registrar is $4,000, and then there&#8217;s a $800 quarterly fee for smaller registrars. In short, domain name registrars generally need to register many thousands of new domains each year just to turn a profit.</p>
<p>Many of the remaining three dozen or so domains registered via Namecentral over the past few years are tied to vDOS. Before vDOS was taken offline it was massively hacked, and a copy of the user and attack database was shared with KrebsOnSecurity. From those records it was easy to tell which third-party booter services were using vDOS&#8217;s application programming interface (API), a software function that allowed them to essentially resell access to vDOS with their own white-labeled stresser.</p>
<p>And a number of those vDOS resellers were registered through Namecentral, including <strong>83144692[dot].com</strong> &#8212; a DDoS-for-hire service marketed at Chinese customers. Another Namecentral domain &#8212; <a href="https://www.youtube.com/watch?v=6I3mo8Ug4sE" target="_blank">vstress.net</a> &#8212; also was a vDOS reseller.</p>
<p>Other DDoS-for-hire domains registered through Namecentral include <strong>xboot[dot]net</strong>, <a href="http://archive.is/zx84l" target="_blank">xr8edstresser[dot]com</a>, <a href="http://archive.is/jsRkL" target="_blank">snowstresser[dot]com</a>, <strong>ezstress[dot]com</strong>, <strong>exilestress[dot]com</strong>, <strong>diamondstresser[dot]net</strong>, <strong>dd0s[dot]pw</strong>, <strong>rebelsecurity[dot]net</strong>, and <strong>beststressers[dot]com</strong>.</p>
<h4>WHO RUNS NAMECENTRAL?</h4>
<p>Namecentral&#8217;s current owner is a 19-year-old California man by the name of <strong>Jesse Wu. </strong>Responding to questions emailed from KrebsOnSecurity, Wu said Namecentral&#8217;s policy on abuse was inspired by <strong>Cloudflare</strong>, the DDoS protection company that guards Namecentral and most of the above-mentioned DDoS-for-hire sites from attacks of the very kind they sell.</p>
<p>&#8220;I&#8217;m not sure (since registrations are automated) but I&#8217;m going to guess that the reason you&#8217;re interested in us is because some stories you&#8217;ve written in the past had domains registered on our service or otherwise used one of our services,&#8221; Wu wrote.</p>
<p>&#8220;We have a policy inspired by Cloudflare&#8217;s similar policy that we ourselves will remain content-neutral and in the support of an open Internet, we will almost never remove a registration or stop providing services, and furthermore we&#8217;ll take any effort to ensure that registrations cannot be influenced by anyone besides the actual registrant making a change themselves &#8211; even if such website makes us uncomfortable,&#8221; Wu said. &#8220;However, as a US based company, we are held to US laws, and so if we receive a valid court issued order to stop providing services to a client, or to turn over/disable a domain, we would happily comply with such order.&#8221;</p>
<p>Wu&#8217;s message continued:</p>
<p>&#8220;As of this email, we have never received such an order, we have never been contacted by any law enforcement agency, and we have never even received a legitimate, credible abuse report. We realize this policy might make us popular with &#8216;dangerous&#8217; websites but even then, if we denied them services, simply not providing them services would not make such website stop existing, they would just have to find some other service provider/registrar or change domains more often. Our services themselves cannot be used for anything harmful &#8211; a domain is just a string of letters, and the rest of our services involve website/ddos protection/ecommerce security services designed to protect websites.&#8221;</p>
<p>Taking a page from Cloudflare, indeed. I&#8217;ve long <a href="http://krebsonsecurity.com/?s=cloudflare+booter&amp;x=0&amp;y=0" target="_blank">taken Cloudflare to task</a> for granting DDoS protection for countless DDoS-for-hire services, to no avail. I&#8217;ve maintained that Cloudflare has a blatant conflict of interest here, and that the DDoS-for-hire industry would quickly blast itself into oblivion because the proprietors of these attack services like nothing more than to turn their attack cannons on each other. Cloudflare has steadfastly maintained that picking and choosing who gets to use their network is <a href="http://blog.cloudflare.com/thoughts-on-abuse" target="_blank">a slippery slope</a> that it will not venture toward.</p>
<p>Although Mr. Wu says he had nothing to do with the domains registered through Namecentral, public records filed elsewhere raise serious unanswered questions about that claim.</p>
<p>In my Sept. 8 story, <a href="https://krebsonsecurity.com/2016/09/israeli-online-attack-service-vdos-earned-600000-in-two-years/" target="_blank">Israeli Online Attack Service Earned $600,000 in Two Years</a>, I explained that the hacked vDOS database indicated the service was run by two 18-year-old Israeli men. At some point, vDOS decided to protect all customer logins to the service with an extended validation (EV) SSL certificate. And for that, it needed to show it was tied to an actual corporate entity.</p>
<p>My investigation into those responsible for supporting vDOS began after I took a closer look at the SSL certificate that vDOS-S[dot]com used to encrypt customer logins. On May 12, 2015, <strong>Digicert.com</strong> issued an EV SSL certificate for vDOS, according to <a href="https://crt.sh/?id=7475563" target="_blank">this record</a>.</p>
<p>As we can see, whoever registered that EV cert did so using the business name <strong>VS NETWORK SERVICES LTD</strong>, and giving an address in the United Kingdom of 217 Blossomfield Rd., Solihull, West Midlands.</p>
<p>Who owns VS NETWORK SERVICES LTD? According <a href="https://beta.companieshouse.gov.uk/officers/EDfEVA0w04RNAIZXte7hKVk4550/appointments" target="_blank">this record</a> from <strong>Companies House UK</strong> &#8212; an official ledger of corporations located in the United Kingdom &#8212; the director of the company was listed as one <strong>Thomas McGonagall. </strong></p>
<div id="attachment_36713" style="width: 590px" class="wp-caption aligncenter"><img class="size-medium wp-image-36713" src="media/a1b0bc26.vsn-companieshouse-580x349.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/10/vsn-companieshouse-580x349.png" alt="Records from Companies House UK on the firm responsible for registering vDOS's SSL certificate." width="580" height="349" srcset="http://krebsonsecurity.com/wp-content/uploads/2016/10/vsn-companieshouse-580x349.png 580w, http://krebsonsecurity.com/wp-content/uploads/2016/10/vsn-companieshouse-768x462.png 768w, http://krebsonsecurity.com/wp-content/uploads/2016/10/vsn-companieshouse-940x566.png 940w, http://krebsonsecurity.com/wp-content/uploads/2016/10/vsn-companieshouse.png 1002w" sizes="(max-width: 580px) 100vw, 580px" /><p class="wp-caption-text">Records from Companies House UK on the firm responsible for registering vDOS&#8217;s SSL certificate.</p></div>
<p>This individual gave the same West Midlands address, stating that he was appointed to VS Network Services on May 12, 2015, and that his birthday was in May 1988. A search in Companies House for Thomas McGonagall shows that a person by that same name and address <a href="https://beta.companieshouse.gov.uk/company/09642105/officers" target="_blank">also was listed</a> that very same day as a director for a company called <strong>REBELSECURITY LTD</strong>.</p>
<p>If we go back even further into the corporate history of this mysterious Mr. McGonagall we find that he <a href="https://beta.companieshouse.gov.uk/company/09179511/officers" target="_blank">was appointed director of NAMECENTRAL LTD</a> on August 18, 2014. Mr. McGonagall&#8217;s birthday is listed as December 1995 in this record, and his address is given as 29 Wigorn Road, 29 Wigorn Road, Smethwick, West Midlands, United Kingdom, B67 5HL. Also on that same day, he was <a href="https://beta.companieshouse.gov.uk/company/09179227/officers" target="_blank">appointed</a> to run <strong>EZSTRESS LTD,</strong> a company at the same Smethwick, West Midlands address.</p>
<p>Strangely enough, those company names correspond to other domains registered through Namecentral around the same time the companies were created, including rebelsecurity[dot]net, ezstress[dot]net.</p>
<p>Asked to explain the odd apparent corporate connections between Namecentral, vDOS, EZStress and Rebelsecurity, Wu chalked that up to an imposter or potential phishing attack.</p>
<p>&#8220;I&#8217;m not sure who that is, and we are not affiliated with Namecentral Ltd.,&#8221; he wrote. &#8220;I looked it up though and it seems like it is either closed or has never been active. From what you described it could be possible someone set up shell companies to try and get/resell EV certs (and someone&#8217;s failed attempt to set up a phishing site for us &#8211; thanks for the heads up).&#8221;</p>
<p>Interestingly, among the three dozen or so domains registered through Namecentral.com is &#8220;certificateavenue.com,&#8221; a site that until recently included nearly identical content as Namecentral&#8217;s home page and appears to be aimed at selling EV certs. Certificateavenue.com was <a href="http://webcache.googleusercontent.com/search?q=cache:4QrzL3tNZ24J:certificateavenue.com/+&amp;cd=1&amp;hl=en&amp;ct=clnk&amp;gl=us" target="_blank">responding</a> as of early-October, but it is no longer online.</p>
<p>I also asked Wu why he chose to become a domain registrar when it appeared he had very few domains to justify the substantial annual costs of maintaining a registrar business.<span id="more-36538"></span></p>
<p>&#8220;Like most other registrars, we register domains only as a value added service,&#8221; he replied via email. &#8220;We have more domains than that (not willing to say exactly how many) but primarily we make our money on our website/ddos protection/ecommerce protection.&#8221;</p>
<p>Now we were getting somewhere. Turns out, Wu isn&#8217;t really in the domain registrar business &#8212; not for the money, anyway. The real money, as his response suggests, is in selling DDoS protection against the very DDoS-for-hire services he is courting with his domain registration service.</p>
<p>Asked to reconcile his claim for having a 100 percent hands-off, automated domain registration system with the fact that Namecentral&#8217;s home page says the company doesn&#8217;t actually have a way to accept automated domain name registrations (like most normal domain registrars), Wu again had an answer.</p>
<p>&#8220;Our site says we only take referred registrations, meaning that at the moment we&#8217;re asking that another prior customer referred you to open a new account for our services, including if you&#8217;d like a reseller account,&#8221; he wrote.</p>
<h4>CAUGHT IN A FIB?</h4>
<p>I was willing to entertain the notion that perhaps Mr. Wu was in fact the target of a rather elaborate scam of some sort. That is, until I stumbled upon another company that was registered in the U.K. to Mr. McGonagall.</p>
<p>That other company &#8212;<strong>SIMPLIFYNT LTD</strong> &#8212; was registered by Mr. McGonagall on October 29, 2014. Turns out, almost the exact same information included in the original Web site registration records for Jesse Wu&#8217;s purchase of Namecentral.com was used for the domain <strong>simplifynt.com, </strong><em>which also was registered on Oct. 29, 2014</em>. I initially missed this domain because it was not registered through Namecentral. If someone had phished Mr. Wu in this case, they had been very quick to the punch indeed.</p>
<p>In the simplyfynt.com domain registration records, Jesse Wu gave his email address as <strong>jesse@jjdev.ru</strong>. That domain is no longer online, but <a href="https://web.archive.org/web/20130523042106/http://jjdev.ru/" target="_blank">a cached copy of it at archive.org</a> shows that it was once a Web development business. That cached page lists yet another contact email address: <strong>sales@jjdevelopments.org</strong>.</p>
<p>I ordered a reverse WHOIS lookup from domaintools.com on all historic Web site registration records that included the domain &#8220;jjdevelopments.org&#8221; anywhere in the records. The search returned 15 other domains, including several more apparent DDoS-for-hire domains such as <strong>twbooter69.com</strong>, <strong>twbooter3.com</strong>, <strong>ratemyddos.com</strong> and <strong>desoboot.com</strong>.</p>
<p>Among the oldest and most innocuous of those 15 domains was <a href="https://web.archive.org/web/20090418165724/http://maplemystery.com/" target="_blank">maplemystery.com</a>, a fan site for a massively multiplayer online role-playing game (MMORPG) called <a href="http://maplestory.nexon.net/landing/" target="_blank">Maple Story</a>. Another historic record lookup ordered from domaintools.com shows that maplemystery.com was originally registered in 2009 to a &#8220;<strong>Denny Ng</strong>.&#8221; As it happens, Denny Ng is listed as the co-owner of <a href="http://www.zillow.com/homedetails/21848-Arbor-Ct-Walnut-CA-91789/21669335_zpid/" target="_blank">the $1.6 million Walnut, Calif. home</a> where Jesse until very recently lived with his mom Cindy Wu (Jesse is now a student at the University of California, San Diego).</p>
<h4>WHO IS DATAWAGON?</h4>
<p>Another domain of interest that was secured via Namecentral is <strong>datawagon.net</strong>. Registered by 19-year-old <strong>Christopher J. &#8220;CJ&#8221; Sculti Jr.</strong>, Datawagon also bills itself as a DDoS mitigation firm. It appears Mr. Sculti built his DDoS protection empire out of his parents&#8217; <a href="http://www.zillow.com/homedetails/3-Mead-Pond-Rd-Rye-NY-10580/2146578290_zpid/" target="_blank">$2.6 million home in Rye, NY</a>. He&#8217;s now a student at Clemson University, according to <a href="https://www.facebook.com/cj.sculti" target="_blank">his Facebook page</a>.</p>
<div id="attachment_36712" style="width: 269px" class="wp-caption alignright"><img class=" wp-image-36712" src="media/27d28f84.cjfb.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/10/cjfb.png" alt="CJ Sculti Jr.'s Facebook profile photo. Sculti is on pictured on the right." width="259" height="294" /><p class="wp-caption-text">CJ Sculti Jr.&#8217;s Facebook profile photo. Sculti is on pictured on the right.</p></div>
<p>As I noted in my story <a href="https://krebsonsecurity.com/2016/09/ddos-mitigation-firm-has-history-of-hijacks/" target="_blank">DDoS Mitigation Firm Has a History of Hijacks</a>, Sculti earned his 15 minutes of fame in 2015 when he lost a cybersquatting suit with <strong>Dominos Pizza</strong> after registering the domain <strong>dominos.pizza</strong> (another domain registered via Namecentral).</p>
<p>Around that time, Sculti contacted KrebsOnSecurity via Skype, asking if I&#8217;d be interested in writing about this cybersquatting dispute with Dominos. In that conversation, Sculti &#8212; apropos of nothing &#8212; admits to having just scanned the Internet for routers that were known to be protected by little more than the factory-default usernames and passwords.</p>
<p>Sculti goes on to brag that his scan revealed a quarter-million routers that were vulnerable, and that he then proceeded to upload some kind software to each vulnerable system. Here&#8217;s a snippet of that chat conversation, which is virtually one-sided.</p>
<p>July 7, 2015:</p>
<p>21:37 <span class="il">CJ</span> <a href="http://krebsonsecurity.com/2015/06/crooks-use-hacked-routers-to-aid-cyberheists/" target="_blank" data-saferedirecturl="https://www.google.com/url?hl=en&amp;q=http://krebsonsecurity.com/2015/06/crooks-use-hacked-routers-to-aid-cyberheists/&amp;source=gmail&amp;ust=1475547292311000&amp;usg=AFQjCNHhALZniKCYldPfIc2VJDXgY6EcOQ">http://krebsonsecurity.com/<wbr />2015/06/crooks-use-hacked-<wbr />routers-to-aid-cyberheists/</a></p>
<p>21:37 <span class="il">CJ</span><br />
vulnerable routers are a HUGE issue</p>
<p>21:37 <span class="il">CJ</span><br />
a few months ago</p>
<p>21:37 <span class="il">CJ</span><br />
I scanned the internet with a few sets of defualt logins</p>
<p>21:37 <span class="il">CJ</span><br />
for telnet</p>
<p>21:37 <span class="il">CJ</span><br />
and I was able to upload and execute a binary</p>
<p>21:38 <span class="il">CJ</span><br />
on 250k devices</p>
<p>21:38 <span class="il">CJ</span><br />
most of which were routers</p>
<p>21:38 Brian Krebs<br />
o_0</p>
<p>21:38 <span class="il">CJ</span><br />
yea</p>
<p>21:38 <span class="il">CJ</span><br />
i&#8217;m surprised no one has looked into that yet</p>
<p>21:38 <span class="il">CJ</span><br />
but</p>
<p>21:39 <span class="il">CJ</span><br />
it&#8217;s a huge issue lol</p>
<p>21:39 <span class="il">CJ</span><br />
that&#8217;s tons of bandwidth</p>
<p>21:39 <span class="il">CJ</span><br />
that could be potentially used</p>
<p>21:39 <span class="il">CJ</span><br />
in the wrong way</p>
<p>21:39 <span class="il">CJ</span><br />
lol<br />
&#8212;</p>
<p>Tons of bandwidth, indeed. The very next time I heard from Sculti was the same day I published the <a href="https://krebsonsecurity.com/2016/09/ddos-mitigation-firm-has-history-of-hijacks/" target="_blank">above-mentioned story</a> about Datawagon&#8217;s relationship to BackConnect Inc., a company that admitted to hijacking 256 Internet addresses from vDOS&#8217;s hosting provider in Bulgaria &#8212; allegedly to defend itself against a monster attack allegedly launched by vDOS&#8217;s proprietors.</p>
<p>Sculti took issue with how he was portrayed in that report, and after a few terse words were exchanged, I blocked his Skype account from further communicating with mine. Less than an hour after that exchange, my Skype inbox was flooded with thousands of bogus contact requests from hacked or auto-created Skype accounts.</p>
<p>Less than six hours after that conversation, my site came under the biggest DDoS attack the Internet had ever witnessed at the time, an attack that experts have since traced back to a large botnet of IoT devices infected with Mirai.</p>
<p>As I wrote in the story that apparently incurred Sculti&#8217;s ire, Datawagon &#8212; like BackConnect &#8212; also has a history of hijacking broad swaths of Internet address space that do not belong to it. That listing came not long after Datawagon announced that it was the rightful owner of some 256 Internet addresses (1.3.3.0/24) that had long been dormant.</p>
<p>The Web <a href="https://www.virustotal.com/en/ip-address/1.3.3.7/information/" target="_blank">address 1.3.3.7</a> currently does not respond to browser requests, but it <a href="https://web.archive.org/web/20151129170013/http://1.3.3.7/" target="_blank">previously routed to a page</a> listing the core members of a hacker group calling itself the <strong>Money Team</strong>. <a href="http://krebsonsecurity.com/wp-content/uploads/2016/09/1-3-3-7-sites.txt" target="_blank">Other sites</a> also previously tied to that Internet address include numerous DDoS-for-hire services, such as nazistresser[dot]biz, exostress[dot]in, scriptkiddie[dot]eu, packeting[dot]eu, leet[dot]hu, booter[dot]in, vivostresser[dot]com, shockingbooter[dot]com and xboot[dot]info, among others.</p>
<p>Datawagon has earned a reputation on hacker forums as a &#8220;bulletproof&#8221; hosting provider &#8212; one that will essentially ignore abuse complaints from other providers and turn a blind eye to malicious activity perpetrated by its customers. In the screenshot below &#8212; taken from a thread on <strong>Hackforums</strong> where Datawagon was suggested as a reliable bulletproof hoster &#8212; the company is mentioned in the same vein as <a href="https://krebsonsecurity.com/2016/08/the-reincarnation-of-a-bulletproof-hoster/" target="_blank">HostSailor</a>, another bulletproof provider that has been the source of much badness (as well as <a href="https://krebsonsecurity.com/2016/08/hostsailor-threatens-to-sue-krebsonsecurity/" target="_blank">legal threats against this author</a>).</p>
<p><img class="aligncenter size-medium wp-image-36711" src="media/2e7d0094.dw-bp-580x280.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/10/dw-bp-580x280.png" alt="dw-bp" width="580" height="280" srcset="http://krebsonsecurity.com/wp-content/uploads/2016/10/dw-bp-580x280.png 580w, http://krebsonsecurity.com/wp-content/uploads/2016/10/dw-bp-768x371.png 768w, http://krebsonsecurity.com/wp-content/uploads/2016/10/dw-bp-940x454.png 940w" sizes="(max-width: 580px) 100vw, 580px" /></p>
<p>In yet another Hackforums discussion thread from June 2016 titled &#8220;VPS [virtual private servers] that allow DDoS scripts,&#8221; one user recommends Datawagon. &#8220;I use datawagon.net. They allow anything.&#8221;</p>
<p>Last year, Sculti <a href="http://florida.intercreditreport.com/company/ip-planet-llc-l15000131547" target="_blank">formed a company</a> in Florida along with a <a href="https://www.quora.com/Whats-it-like-to-be-a-spammer/answer/Vitaliy-Dimitrovich-Vinogradov" target="_blank">self-avowed spammer.</a> Perhaps unsurprisingly, anti-spam group <strong>Spamhaus</strong> soon listed virtually all of Datawagon&#8217;s Internet address space as sources of spam.</p>
<p>Are either Mr. Wu or Mr. Sculti behind the Mirai botnet attacks? I cannot say. But I&#8217;d be willing to bet money that one or both of them knows who is. In any case, it would appear that both men may have hit upon a very lucrative business model. More to come.</p>


feed_id: https://krebsonsecurity.com/?p=36754
title: Hacked Cameras, DVRs Powered Today’s Massive Internet Outage
uri: Hacked-Cameras-DVRs-Powered-Today-s-Massive-Internet-Outage
url: https://krebsonsecurity.com/2016/10/hacked-cameras-dvrs-powered-todays-massive-internet-outage/
content:
<p>A massive and sustained Internet attack that has caused outages and network congestion today for a large number of Web sites was launched with the help of hacked &#8220;Internet of Things&#8221; (IoT) devices, such as CCTV video cameras and digital video recorders, new data suggests.</p>
<p>Earlier today cyber criminals began training their attack cannons on <strong>Dyn</strong>, an Internet infrastructure company that provides critical technology services to some of the Internet&#8217;s top destinations. The attack began creating problems for Internet users reaching an array of sites, including Twitter, Amazon, Tumblr, Reddit, Spotify and Netflix.</p>
<div id="attachment_36755" style="width: 590px" class="wp-caption aligncenter"><img class="wp-image-36755 size-medium" src="media/608e5b82.l3outage-580x330.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/10/l3outage-580x330.png" alt="l3outage" width="580" height="330" srcset="http://krebsonsecurity.com/wp-content/uploads/2016/10/l3outage-580x330.png 580w, http://krebsonsecurity.com/wp-content/uploads/2016/10/l3outage-768x437.png 768w, http://krebsonsecurity.com/wp-content/uploads/2016/10/l3outage.png 778w" sizes="(max-width: 580px) 100vw, 580px" /><p class="wp-caption-text">A depiction of the outages caused by today&#8217;s attacks on Dyn, an Internet infrastructure company. Source: Downdetector.com.</p></div>
<p>At first, it was unclear who or what was behind the attack on Dyn. But over the past few hours, at least one computer security firm has come out saying the attack involved <strong>Mirai</strong>, the same malware strain that was used in <a href="https://krebsonsecurity.com/2016/09/krebsonsecurity-hit-with-record-ddos/" target="_blank">the record 620 Gpbs attack on my site last month</a>. At the end September 2016, the hacker responsible for creating the Mirai malware <a href="https://krebsonsecurity.com/2016/10/source-code-for-iot-botnet-mirai-released/" target="_blank">released the source code for it</a>, effectively letting anyone build their own attack army using Mirai.</p>
<p>Mirai scours the Web for IoT devices protected by little more than factory-default usernames and passwords, and then enlists the devices in attacks that hurl junk traffic at an online target until it can no longer accommodate legitimate visitors or users.</p>
<p>According to researchers at security firm <a href="https://www.flashpoint-intel.com/" target="_blank">Flashpoint</a>, today&#8217;s attack was launched at least in part by a Mirai-based botnet. <strong>Allison Nixon</strong>, director of research at Flashpoint, said the botnet used in today&#8217;s ongoing attack is built on the backs of hacked IoT devices &#8212; mainly compromised digital video recorders (DVRs) and IP cameras made by a Chinese hi-tech company called <strong>XiongMai Technologies</strong>. The components that XiongMai makes are sold downstream to vendors who then use it in their own products.</p>
<p>&#8220;It&#8217;s remarkable that virtually an entire company&#8217;s product line has just been turned into a botnet that is now attacking the United States,&#8221; Nixon said, noting that Flashpoint hasn&#8217;t ruled out the possibility of multiple botnets being involved in the attack on Dyn.</p>
<p>&#8220;At least one Mirai [control server] issued an attack command to hit Dyn,&#8221; Nixon said. &#8220;Some people are theorizing that there were multiple botnets involved here. What we can say is that we&#8217;ve seen a Mirai botnet participating in the attack.&#8221;</p>
<p>As I noted earlier this month in <a href="https://krebsonsecurity.com/2016/10/europe-to-push-new-security-rules-amid-iot-mess/" target="_blank">Europe to Push New Security Rules Amid IoT Mess</a>, many of these products from XiongMai and other makers of inexpensive, mass-produced IoT devices are essentially unfixable, and will remain a danger to others unless and until they are completely unplugged from the Internet.<span id="more-36754"></span></p>
<p>That&#8217;s because while many of these devices allow users to change the default usernames and passwords on a Web-based administration panel that ships with the products, those machines can still be reached via more obscure, less user-friendly communications services called “<strong>Telnet</strong>” and “<strong>SSH</strong>.&#8221;</p>
<p>Telnet and SSH are command-line, text-based interfaces that are typically accessed via a command prompt (e.g., in <strong>Microsoft Windows</strong>, a user could click Start, and in the search box type “cmd.exe” to launch a command prompt, and then type “telnet” to reach a username and password prompt at the target host).</p>
<p><span class="pullquote pqleft">“The issue with these particular devices is that a user cannot feasibly change this password,” Flashpoint’s <strong>Zach Wikholm </strong>told KrebsOnSecurity<strong>.</strong> “The password is hardcoded into the firmware, and the tools necessary to disable it are not present.</span> Even worse, the web interface is not aware that these credentials even exist.”</p>
<p>Flashpoint’s researchers said they scanned the Internet on Oct. 6 for systems that showed signs of running the vulnerable hardware, and found more than 515,000 of them were vulnerable to the flaws they discovered.</p>
<p>&#8220;I truly think this IoT infrastructure is very dangerous on the whole and does deserve attention from anyone who can take action,&#8221; Flashpoint&#8217;s Nixon said.</p>
<p>It&#8217;s unclear what it will take to get a handle on the security problems introduced by millions of insecure IoT devices that are ripe for being abused in these sorts of assaults.</p>
<p>As I noted in <a href="https://krebsonsecurity.com/2016/09/the-democratization-of-censorship/" target="_blank">The Democratization of Censorship</a>, to address the threat from the mass-proliferation of hardware devices such as Internet routers, DVRs and IP cameras that ship with default-insecure settings, we probably need an industry security association, with published standards that all members adhere to and are audited against periodically.</p>
<p>The wholesalers and retailers of these devices might then be encouraged to shift their focus toward buying and promoting connected devices which have this industry security association seal of approval. Consumers also would need to be educated to look for that seal of approval. Something like <a href="https://en.wikipedia.org/wiki/UL_(safety_organization)" target="_blank">Underwriters Laboratories</a> (UL), but for the Internet, perhaps.</p>
<p>Until then, these insecure IoT devices are going to stick around like a bad rash &#8212; unless and until there is a major, global effort to recall and remove vulnerable systems from the Internet. In my humble opinion, this global cleanup effort should be funded mainly by the companies that are dumping these cheap, poorly-secured hardware devices onto the market in an apparent bid to own the market. Well, they should be made to own the cleanup efforts as well.</p>
<p>Devices infected with Mirai are instructed to scour the Internet for IoT devices protected by more than 60 default usernames and passwords. The entire list of those passwords &#8212; and my best approximation of which firms are responsible for producing those hardware devices &#8212; can be found at my story, <a href="https://krebsonsecurity.com/2016/10/who-makes-the-iot-things-under-attack/" target="_blank">Who Makes the IoT Things Under Attack</a>.</p>
<p>Update 10:30 a.m., Oct. 22: Corrected attribution on outage graphic.</p>


feed_id: https://krebsonsecurity.com/?p=36727
title: DDoS on Dyn Impacts Twitter, Spotify, Reddit
uri: DDoS-on-Dyn-Impacts-Twitter-Spotify-Reddit
url: https://krebsonsecurity.com/2016/10/ddos-on-dyn-impacts-twitter-spotify-reddit/
content:
<p>Criminals this morning massively attacked <a href="http://www.dyn.com" target="_blank">Dyn</a>, a company that provides core Internet services for Twitter, SoundCloud, Spotify, Reddit and a host of other sites, causing outages and slowness for many of Dyn&#8217;s customers.</p>
<div id="attachment_36729" style="width: 590px" class="wp-caption aligncenter"><img class="size-medium wp-image-36729" src="media/2e66c432.twitterapi-580x48.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/10/twitterapi-580x48.png" alt="Twitter is experiencing problems, as seen through the social media platform Hootsuite. " width="580" height="48" srcset="http://krebsonsecurity.com/wp-content/uploads/2016/10/twitterapi-580x48.png 580w, http://krebsonsecurity.com/wp-content/uploads/2016/10/twitterapi-768x63.png 768w, http://krebsonsecurity.com/wp-content/uploads/2016/10/twitterapi-940x78.png 940w" sizes="(max-width: 580px) 100vw, 580px" /><p class="wp-caption-text">Twitter is experiencing problems, as seen through the social media platform Hootsuite.</p></div>
<p>In a statement, Dyn said that this morning, October 21, Dyn received a global <strong>distributed denial of service</strong> (DDoS) attack on its DNS infrastructure on the east coast starting at around 7:10 a.m. ET (11:10 UTC).</p>
<p>&#8220;DNS traffic resolved from east coast name server locations are experiencing a service interruption during this time. Updates will be posted as information becomes available,&#8221; the company wrote.</p>
<p>DYN encouraged customers with concerns to check the company&#8217;s <a href="https://www.dynstatus.com/" target="_blank">status page</a> for updates and to reach out to its technical support team.</p>
<p>A DDoS is when crooks use a large number of hacked or ill-configured systems to flood a target site with so much junk traffic that it can no longer serve legitimate visitors.</p>
<p>DNS refers to <strong>Domain Name System</strong> services. DNS is an essential component of all Web sites, responsible for translating human-friendly Web site names like “example.com” into numeric, machine-readable Internet addresses. Anytime you send an e-mail or browse a Web site, your machine is sending a DNS look-up request to your Internet service provider to help route the traffic.</p>
<h4>ANALYSIS</h4>
<p>The attack on DYN comes just hours after DYN researcher <strong>Doug Madory</strong> presented a talk on DDoS attacks in Dallas, Texas at a meeting of the North American Network Operators Group (NANOG). Madory&#8217;s talk &#8212; available <a href="https://www.youtube.com/watch?v=LFJzu0AFDpU" target="_blank">here on Youtube.com</a> &#8212; delved deeper into research that he and I teamed up on to produce the data behind the story <a href="https://krebsonsecurity.com/2016/09/ddos-mitigation-firm-has-history-of-hijacks/" target="_blank">DDoS Mitigation Firm Has History of Hijacks</a>.<span id="more-36727"></span></p>
<p>That story (as well as one published earlier this week, <a href="https://krebsonsecurity.com/2016/10/spreading-the-ddos-disease-and-selling-the-cure/" target="_blank">Spreading the DDoS Disease and Selling the Cure</a>) examined the sometimes blurry lines between certain DDoS mitigation firms and the cybercriminals apparently involved in launching some of the largest DDoS attacks the Internet has ever seen. Indeed, the <a href="https://krebsonsecurity.com/2016/09/krebsonsecurity-hit-with-record-ddos/" target="_blank">record 620 Gbps DDoS against KrebsOnSecurity.com</a> came just hours after I published the story on which Madory and I collaborated.</p>
<p>The record-sized attack that hit my site last month was quickly superseded by a DDoS against <strong>OVH</strong>, a French hosting firm that reported being targeted by a DDoS that was roughly twice the size of the assault on KrebsOnSecurity. As I noted in <a href="https://krebsonsecurity.com/2016/09/the-democratization-of-censorship/" target="_blank">The Democratization of Censorship</a> &#8212; the first story published after bringing my site back up under the protection of <a href="https://projectshield.withgoogle.com/public/" target="_blank">Google&#8217;s Project Shield</a> &#8212; DDoS mitigation firms simply did not count on the size of these attacks increasing so quickly overnight, and are now scrambling to secure far greater capacity to handle much larger attacks concurrently.</p>
<p>The size of these DDoS attacks has increased so much lately thanks largely to the broad availability of tools for compromising and leveraging the <a href="https://krebsonsecurity.com/2016/10/who-makes-the-iot-things-under-attack/" target="_blank">collective firepower of so-called Internet of Things devices</a> &#8212; poorly secured Internet-based security cameras, digital video recorders (DVRs) and Internet routers. Last month, a hacker by the name of <strong>Anna_Senpai</strong> <a href="https://krebsonsecurity.com/2016/10/source-code-for-iot-botnet-mirai-released/" target="_blank">released the source code for Mirai</a>, a crime machine that enslaves IoT devices for use in large DDoS attacks. The 620 Gbps attack that hit my site last month was launched by a botnet built on Mirai, for example.</p>
<p>Interestingly, someone is now targeting infrastructure providers with extortion attacks and invoking the name Anna_senpai. According to <a href="http://www.webhostingtalk.com/showthread.php?t=1606018" target="_blank">a discussion thread</a> started Wednesday on <strong>Web Hosting Talk</strong>, criminals are now invoking the Mirai author&#8217;s nickname in a bid to extort Bitcoins from targeted hosting providers.</p>
<blockquote><p>&#8220;If you will not pay in time, DDoS attack will start, your web-services will<br />
go down permanently. After that, price to stop will be increased to 5 BTC<br />
with further increment of 5 BTC for every day of attack.</p>
<p>NOTE, i?m not joking.</p>
<p>My attack are extremely powerful now &#8211; now average 700-800Gbps, sometimes over 1 Tbps per second. It will pass any remote protections, no current protection systems can help.&#8221;</p></blockquote>
<p>Let me be clear: I have no data to indicate that the attack on Dyn is related to extortion, to Mirai or to any of the companies or individuals Madory referenced in his talk this week in Dallas. But Dyn is known for publishing detailed writeups on outages at other major Internet service providers. Here&#8217;s hoping the company does not deviate from that practice and soon publishes a postmortem on its own attack.</p>
<p><strong>Update, 3:50 p.m. ET:</strong> Security firm <strong>Flashpoint</strong> is now reporting that they have seen indications that a Mirai-based botnet is indeed involved in the attack on Dyn today. Separately, I have heard from a trusted source who&#8217;s been tracking this activity and saw chatter in the cybercrime underground yesterday discussing a plan to attack Dyn.</p>
<p><strong>Update, 10:22 a.m. ET:</strong> Dyn&#8217;s <a href="https://www.dynstatus.com/" target="_blank">status page</a> reports that all services are back to normal as of 13:20 UTC (9:20 a.m. ET). Fixed the link to Doug Madory&#8217;s talk on Youtube, to remove the URL shortener (which isn&#8217;t working because of this attack).</p>
<p><strong>Update, 1:01 p.m. ET:</strong> Looks like the attacks on Dyn have resumed and this event is ongoing. This, from the Dyn status page:</p>
<blockquote>
<div class="update">This DDoS attack may also be impacting Dyn Managed DNS advanced services with possible delays in monitoring. Our Engineers are continuing to work on mitigating this issue.<br />
<small>Oct 21, 16:48 UTC</small></div>
<div class="update"></div>
<div class="update">As of 15:52 UTC, we have begun monitoring and mitigating a DDoS attack against our Dyn Managed DNS infrastructure. Our Engineers are continuing to work on mitigating this issue.<br />
<small>Oct 21, 16:06 UTC</small></div>
</blockquote>


feed_id: https://krebsonsecurity.com/?p=36785
title: Senator Prods Federal Agencies on IoT Mess
uri: Senator-Prods-Federal-Agencies-on-IoT-Mess
url: https://krebsonsecurity.com/2016/10/senator-prods-federal-agencies-on-iot-mess/
content:
<p>The co-founder of the newly launched <a href="http://www.warner.senate.gov/public/index.cfm/pressreleases?ContentRecord_id=6232F6A3-DC2D-444C-AEE5-C891511D4286" target="_blank">Senate Cybersecurity Caucus</a> is pushing federal agencies for possible solutions and responses to the security threat from insecure &#8220;Internet of Things&#8221; (IoT) devices, such as the <a href="https://krebsonsecurity.com/2016/10/hacked-cameras-dvrs-powered-todays-massive-internet-outage/" target="_blank">network of hacked security cameras and digital video recorders</a> that were reportedly used to help bring about <a href="https://krebsonsecurity.com/2016/10/ddos-on-dyn-impacts-twitter-spotify-reddit/" target="_blank">last Friday&#8217;s major Internet outages</a>.</p>
<p>In letters to the <strong>Federal Communications Commission</strong> (FCC), the <strong>Federal Trade Commission</strong> (FTC) and the <strong>Department of Homeland Security</strong> (DHS), <strong>Virginia Senator Mark Warner</strong> (D) called the proliferation of insecure IoT devices a threat to resiliency of the Internet.</p>
<p>&#8220;Manufacturers today are flooding the market with cheap, insecure devices, with few market incentives to design the products with security in mind, or to provide ongoing support,&#8221; Warner wrote to the agencies. &#8220;And buyers seem unable to make informed decisions between products based on their competing security features, in part because there are no clear metrics.&#8221;</p>
<p>The letter continues:</p>
<p>&#8220;Because the producers of these insecure IoT devices currently are insulated from any standards requirements, market feedback, or liability concerns, I am deeply concerned that <span class="pullquote pqleft">we are witnessing a ‘<a href="https://en.wikipedia.org/wiki/Tragedy_of_the_commons" target="_blank">tragedy of the commons</a>’ threat to the continued functioning of the internet, as the security so vital to all internet users remains the responsibility of none.</span> Further, buyers have little recourse when, despite their best efforts, security failures occur&#8221; [link added].</p>
<p>As Warner&#8217;s letter notes, last week’s attack on online infrastructure provider <strong>Dyn</strong> was launched at least in part by <strong>Mirai</strong>, a <a href="https://krebsonsecurity.com/2016/10/source-code-for-iot-botnet-mirai-released/" target="_blank">now open-source</a> malware strain that scans the Internet for routers, cameras, digital video recorders and other Internet of Things “IoT” devices protected only by the factory-default passwords.<span id="more-36785"></span></p>
<p>Once infected with Mirai, the IoT systems can be used to flood a target with so much junk Web traffic that the target site can no longer accommodate legitimate users or visitors. The attack on Dyn was slightly different because it resulted in prolonged outages for many other networks and Web sites, including <strong>Netflix</strong>, <strong>PayPal</strong>, <strong>Reddit</strong> and <strong>Twitter</strong>.</p>
<p>As a result of that attack, one of the most-read stories on KrebsOnSecurity so far this year is “<a href="https://krebsonsecurity.com/2016/10/who-makes-the-iot-things-under-attack/" target="_blank">Who Makes the IoT Things Under Attack?</a>“, in which I tried to match default passwords sought out by the Mirai malware with IoT hardware devices for sale on the commercial market today.</p>
<p>In a <a href="https://krebsonsecurity.com/2016/10/europe-to-push-new-security-rules-amid-iot-mess/" target="_blank">follow-up to that story</a>, I interviewed researchers at Flashpoint who discovered that one of the default passwords sought by machines infected with Mirai — username: root and password: <strong>xc3511</strong> — is embedded in a broad array of white-labeled DVR and IP camera electronics boards made by a Chinese company called <strong>XiongMai Technologies</strong>. These components are sold downstream to vendors who then use them in their own products (for a look at XionMai&#8217;s response to all this, see Monday&#8217;s story, <a href="https://krebsonsecurity.com/2016/10/iot-device-maker-vows-product-recall-legal-action-against-western-accusers/" target="_blank">IoT Device Maker Vows Product Recall, Legal Action Against Western Accusers</a>).</p>
<p>In his inquiry to the federal agencies, Warner asked whether there was more the government could be doing to vet the security of IoT devices before or after they are plugged into networks.</p>
<p>&#8220;In the FCC’s Open Internet Order, the Commission suggested that ISPs could take such steps only when addressing &#8216;traffic that constitutes a denial-of-service attack on specific network infrastructure elements,'&#8221; Warner wrote in his missive to the FCC.  &#8220;Is it your agency’s opinion that the Mirai attack has targeted &#8216;specific network infrastructure elements&#8217; to warrant a response from ISPs?&#8221;</p>
<p>In another line of questioning, Warner also asked whether it would it be a reasonable network management practice for ISPs to designate insecure network devices as “insecure” and thereby deny them connections to their networks, including by refraining from assigning devices IP addresses.</p>
<p>It&#8217;s good to see lawmakers asking questions about whether there is a market failure here that requires government intervention or regulation. Judging from the comments on my story earlier this month &#8212; <a href="https://krebsonsecurity.com/2016/10/europe-to-push-new-security-rules-amid-iot-mess/" target="_blank">Europe to Push New Security Rules Amid IoT Mess</a> &#8212; KrebsOnSecurity readers remain fairly divided on the role of government in addressing the IoT problem.</p>
<p>I have been asked by several reporters over the past few days whether I think government has a role to play in fixing the IoT mess. Personally, I do not believe there has ever been a technology challenge that was best served by additional government regulation.</p>
<p>However, I do believe that <em>the credible threat of government regulation</em> is very often what&#8217;s needed to spur the hi-tech industry into meaningful action and self-regulation. And that process usually starts with inquiries like these. So, here&#8217;s hoping more lawmakers in Congress can get up to speed quickly on this vitally important issue.</p>
<p>Sen. Warner&#8217;s letter to the FCC looks very similar to those sent to the other two agencies. A copy of it is available <a href="http://www.warner.senate.gov/public/index.cfm/pressreleases?ContentRecord_id=CD1BBB25-83E0-494D-B7E1-1C350A7CFCCA" target="_blank">here</a>.</p>


feed_id: https://krebsonsecurity.com/?p=36765
title: IoT Device Maker Vows Product Recall, Legal Action Against Western Accusers
uri: IoT-Device-Maker-Vows-Product-Recall-Legal-Action-Against-Western-Acc
url:
https://krebsonsecurity.com/2016/10/iot-device-maker-vows-product-recall-legal-action-against-western-accusers/

content:
<p>A Chinese electronics firm pegged by experts as responsible for making many of the components leveraged in <a href="https://krebsonsecurity.com/2016/10/hacked-cameras-dvrs-powered-todays-massive-internet-outage/">last week&#8217;s massive attack</a> that disrupted Twitter and dozens of popular Web sites has vowed to recall some of its vulnerable products, even as it threatened legal action against this publication and others for allegedly tarnishing the company&#8217;s brand.</p>
<p><img class="aligncenter size-full wp-image-36433" src="media/ef18aa5c.iotstuf.jpg" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/09/iotstuf.jpg" alt="iotstuf" width="500" height="282" /></p>
<p>Last week&#8217;s attack on online infrastructure provider <strong>Dyn</strong> was launched at least in part by <strong>Mirai</strong>, a <a href="https://krebsonsecurity.com/2016/10/source-code-for-iot-botnet-mirai-released/" target="_blank">now open-source</a> malware strain that scans the Internet for routers, cameras, digital video recorders and other Internet of Things &#8220;IoT&#8221; devices protected only by the factory-default passwords. Once infected with Mirai, the IoT systems can be used to flood a target with so much junk Web traffic that the target site can no longer accommodate legitimate users or visitors.</p>
<p>In an interim report on the attack, Dyn said: &#8220;We can confirm, with the help of analysis from <strong>Flashpoint</strong> and <strong>Akamai</strong>, that one source of the traffic for the attacks were devices infected by the Mirai botnet. We observed 10s of millions of discrete IP addresses associated with the Mirai botnet that were part of the attack.&#8221;</p>
<p>As a result of that attack, one of the most-read stories on KrebsOnSecurity so far this year is &#8220;<a href="https://krebsonsecurity.com/2016/10/who-makes-the-iot-things-under-attack/" target="_blank">Who Makes the IoT Things Under Attack?</a>&#8220;, in which I tried to match default passwords sought out by the Mirai malware with IoT hardware devices for sale on the commercial market today.</p>
<p>In a <a href="https://krebsonsecurity.com/2016/10/europe-to-push-new-security-rules-amid-iot-mess/" target="_blank">follow-up to that story</a>, I interviewed researchers at Flashpoint who discovered that one of the default passwords sought by machines infected with Mirai — username: root and password: <strong>xc3511</strong> — is embedded in a broad array of white-labeled DVR and IP camera electronics boards made by a Chinese company called <strong>XiongMai Technologies</strong>. These components are sold downstream to vendors who then use them in their own products.</p>
<p>The scary part about IoT products that include <a href="http://www.xiongmaitech.com/en/index.php/product" target="_blank">XiongMai&#8217;s various electronics components</a>, Flashpoint found, was that while users could change the default credentials in the devices&#8217; Web-based administration panel, the password is hardcoded into the device firmware and the tools needed to disable it aren&#8217;t present.</p>
<p>In <a href="http://mp.weixin.qq.com/s?__biz=MzA4MDQ4NjMwOA==&amp;mid=2651450911&amp;idx=1&amp;sn=f4d41b6fae77ece8493fdec1197d97f0&amp;chksm=845ec4d4b3294dc23df1d6ecba1e76ccec9ac6533aef4403ecf34f9b72e4cb3c7c94e57dfc89&amp;mpshare=1&amp;scene=1&amp;srcid=1024DskPGO5o4Jgp1qYNtrDZ#wechat_redirect" target="_blank">a statement</a> issued on social media Monday, XiongMai (referring to itself as &#8220;XM&#8221;) said it would be issuing a recall on millions of devices &#8212; mainly network cameras.</p>
<p><span class="pullquote pqleft">&#8220;Mirai is a huge disaster for the Internet of Things,&#8221; the company said in a separate statement emailed to journalists. &#8220;XM have to admit that our products also suffered from hacker&#8217;s break-in and illegal use.&#8221;</span></p>
<p>At the same time, the Chinese electronics firm said that in September 2015 it issued a firmware fix for vulnerable devices, and that XiongMai hardware shipped after that date should not by default be vulnerable.</p>
<p>&#8220;Since then, XM has set the device default Telnet off to avoid the hackers to connect,&#8221; the company said. &#8220;In other words, this problem is absent at the moment for our devices after Sep 2015, as Hacker cannot use the Telnet to access our devices.&#8221;</p>
<p>Regarding the default user name/password that ships with XM, &#8220;our devices are asking customers to change the default password when they first time to login,&#8221; the electronics maker wrote. &#8220;When customer power on the devices, the first step, is change the default password.&#8221;</p>
<p>I&#8217;m working with some researchers who are testing XM&#8217;s claims, and will post an update here if and when that research is available. In the meantime, XM is <a href="http://mp.weixin.qq.com/s?__biz=MzA4MDQ4NjMwOA==&amp;mid=2651450911&amp;idx=1&amp;sn=f4d41b6fae77ece8493fdec1197d97f0&amp;chksm=845ec4d4b3294dc23df1d6ecba1e76ccec9ac6533aef4403ecf34f9b72e4cb3c7c94e57dfc89&amp;mpshare=1&amp;scene=1&amp;srcid=1024DskPGO5o4Jgp1qYNtrDZ#wechat_redirect" target="_blank">threatening legal action</a> against media outlets that it says are issuing &#8220;false statements&#8221; against the company.</p>
<p>Google&#8217;s translation of their statement reads, in part: &#8220;Organizations or individuals false statements, defame our goodwill behavior &#8230; through legal channels to pursue full legal responsibility for all violations of people, to pursue our legal rights are reserved.&#8221;<span id="more-36765"></span></p>
<div id="attachment_36770" style="width: 590px" class="wp-caption aligncenter"><img class="size-medium wp-image-36770" src="media/70e2952a.xmcomponents-580x279.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/10/xmcomponents-580x279.png" alt="Xiongmail's electrical components that are white-labeled and embedded in countless IoT products sold under different brand names." width="580" height="279" srcset="http://krebsonsecurity.com/wp-content/uploads/2016/10/xmcomponents-580x279.png 580w, http://krebsonsecurity.com/wp-content/uploads/2016/10/xmcomponents-768x370.png 768w, http://krebsonsecurity.com/wp-content/uploads/2016/10/xmcomponents.png 820w" sizes="(max-width: 580px) 100vw, 580px" /><p class="wp-caption-text">Xiongmail&#8217;s electrical components that are white-labeled and embedded in countless IoT products sold under different brand names.</p></div>
<p>The statement by XM&#8217;s lawyers doesn&#8217;t name KrebsOnSecurity per se, but instead links to a Chinese media story referencing this site under the heading, &#8220;untrue reports link.&#8221;</p>
<div>
<p><b>Brian Karas</b>, a business analyst with <a href="https://ipvm.com/" target="_blank" data-saferedirecturl="https://www.google.com/url?hl=en&amp;q=https://ipvm.com/&amp;source=gmail&amp;ust=1477428128264000&amp;usg=AFQjCNGij-25cLd_GPLzi2M2bHhjyNpy-w">IPVM</a> — a subscription-based news, testing and training site for the video surveillance industry which first reported the news of potential litigation by XM — said that over the past five years China’s market share in the video surveillance industry has surged, due to the efforts of companies like XiongMai and <strong>Dahua</strong> to expand globally, and from the growth of government-controlled security company <strong>Hikvision</strong>.</p>
</div>
<p>Karas said the recent Mirai botnet attacks have created &#8220;extreme concerns about the impact of Chinese video surveillance products.&#8221; Nevertheless,  he said, the threats against those the company accuses of issuing false statements are more about saving face.</p>
<p>&#8220;We believe Xiongmai has issued this announcement as a PR effort within China, to help counter criticisms they are facing,&#8221; Karas wrote. &#8220;We do not believe that Xiongmai or the Ministry of Justice is seriously going to sue any Western companies as this is a typical tactic to save face.&#8221;</p>
<p><strong>Update,Oct. 25, 8:47 a.m.:</strong> Updated the story to reflect an oddity of Google Translate, which translated the statement from XM&#8217;s legal department as Justice Ministry. The threats of litigation come from XM, not the Chinese government. Also made clear that the threat was first written about by IPVM.</p>


feed_id: https://krebsonsecurity.com/?p=36687
title: Are the Days of “Booter” Services Numbered?
uri: Are-the-Days-of-Booter-Services-Numbered
url: https://krebsonsecurity.com/2016/10/are-the-days-of-booter-services-numbered/
content:
<p>It may soon become easier for Internet service providers to anticipate and block certain types of online assaults launched by Web-based attack-for-hire services known as <a href="https://krebsonsecurity.com/?s=booter&amp;x=0&amp;y=0" target="_blank">&#8220;booter&#8221; or &#8220;stresser&#8221;</a> services, new research released today suggests.</p>
<p>The findings come from researchers in Germany who&#8217;ve been studying patterns that emerge when miscreants attempt to mass-scan the entire Internet looking for systems useful for launching these digital sieges &#8212; known as &#8220;distributed denial-of-service&#8221; or DDoS attacks.</p>
<p><img class="aligncenter size-medium wp-image-36825" src="media/93329082.ddosbomb-580x357.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/10/ddosbomb-580x357.png" alt="ddosbomb" width="580" height="357" srcset="http://krebsonsecurity.com/wp-content/uploads/2016/10/ddosbomb-580x357.png 580w, http://krebsonsecurity.com/wp-content/uploads/2016/10/ddosbomb.png 699w" sizes="(max-width: 580px) 100vw, 580px" /></p>
<p>To understand the significance of their research, it may help to briefly examine how DDoS attacks have evolved. Not long ago, if one wanted to take down large Web site, one had to build and maintain a large robot network, or &#8220;botnet,&#8221; of hacked computers &#8212; which is a fairly time intensive, risky and technical endeavor.</p>
<p>These days, however, even the least sophisticated Internet user can launch relatively large DDoS attacks just by paying a few bucks for a subscription to one of dozens of booter or stresser services, some of which <a href="https://krebsonsecurity.com/2016/09/israeli-online-attack-service-vdos-earned-600000-in-two-years/" target="_blank">even accept credit cards and PayPal payments</a>.</p>
<p>These Web-based DDoS-for-hire services don&#8217;t run on botnets: They generally employ a handful of powerful servers that are rented from some dodgy <a href="https://krebsonsecurity.com/2010/11/body-armor-for-bad-web-sites/" target="_blank">&#8220;bulletproof&#8221; hosting provider</a>. The booter service accepts payment and attack instructions via a front end Web site that is <a href="https://krebsonsecurity.com/2015/01/spreading-the-disease-and-selling-the-cure/" target="_blank">hidden behind Cloudflare</a> (a free DDoS protection service).</p>
<p>But the back end of the booter service is where the really interesting stuff happens. Virtually all of the most powerful and effective attack types used by booter services rely on a technique called traffic <strong>amplification</strong> and <strong>reflection</strong>, in which the attacker can reflect or &#8220;spoof&#8221; his traffic from one or more third-party machines toward the intended target.</p>
<p>In this type of assault, the attacker sends a message to a third party, while spoofing the Internet address of the victim. When the third party replies to the message, the reply is sent to the victim — and the reply is much larger than the original message, thereby amplifying the size of the attack.</p>
<p>To find vulnerable systems that can be leveraged this way, booters employ large-scale Internet scanning services that constantly seek to refresh the list of systems that can be used for amplification and reflection attacks. They do this because, as <a href="media/f2bce851.sec14-paper-kuhrer.pdf" data-original-source="https://www.usenix.org/system/files/conference/usenixsecurity14/sec14-paper-kuhrer.pdf" target="_blank">research has shown</a> (PDF), anywhere from 40-50 percent of the amplifiers vanish or are reassigned new Internet addresses after one week.</p>
<p>Enter researchers from <strong>Saarland University</strong> in Germany, as well as the <strong>Yokohama National University</strong> and <strong>National Institute of Information and Communications Technology</strong> &#8212; both in Japan. In a years-long project first detailed in 2015, the researchers looked for scanning that appeared to be kicked off by ne&#8217;er-do-wells running booter services.</p>
<p>To accomplish this, the research team built a kind of distributed &#8220;<a href="https://en.wikipedia.org/wiki/Honeypot_(computing)" target="_blank">honeypot</a>&#8221; system &#8212; which they dubbed &#8220;<strong>AmpPot</strong>&#8221; &#8212; designed to mimic services known to be vulnerable to amplification attacks, such as <a href="https://www.incapsula.com/ddos/attack-glossary/dns-flood.html" target="_blank">DNS</a> and <a href="https://www.incapsula.com/ddos/attack-glossary/ntp-amplification.html" target="_blank">NTP</a> floods.</p>
<p>&#8220;To make them attractive to attackers, our honeypots send back legitimate responses,&#8221; the researchers wrote in <a href="media/6ba708bd.amppot-raid2015.Brian_.pdf" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2016/10/amppot-raid2015.Brian_.pdf" target="_blank">a 2015 paper</a> (PDF). &#8220;Attackers, in turn, will abuse these honeypots as amplifiers, which allows us to observe ongoing attacks, their victims, and the DDoS techniques. To prevent damage caused by our honeypots, we limit the response rate. This way, while attackers can still find these ratelimited honeypots, the honeypots stop replying in the face of attacks.&#8221;</p>
<p>In that 2015 paper, the researchers said they deployed 21 globally-distributed AmpPot instances, which observed more than 1.5 million attacks between February and May 2015. Analyzing the attacks more closely, they found that more than 96% of the attacks stem from single sources, such as booter services.</p>
<p>&#8220;When focusing on amplification DDoS attacks, we find that almost all of them (&gt;96%) are caused by single sources (e.g. booters), and not botnets,&#8221; the team concluded. &#8220;However, we sadly do not have the numbers to compare this [to] DoS attacks in general.&#8221;</p>
<p>Many large-scale Internet scans like the ones the researchers sought to measure are launched by security firms and other researchers, so the team needed a way to differentiate between scans launched by booter services and those conducted for research or other benign purposes.</p>
<p>&#8220;To distinguish between scans performed by researchers and scans performed with malicious intent we relied on a simple assumption: That no attack would be based on the results of a scan performed by (ethical) researchers,&#8221; said <strong>Johannes Krupp</strong>, one of the main authors of the report. &#8220;In fact, thanks to our methodology, we do not have to make this distinction upfront, but we can rather look at the results and say: &#8216;We found attacks linked to this scanner, therefore this scanner must have been malicious.&#8217; If a scan was truly performed by benign parties, we will not find attacks linked to it.&#8221;</p>
<h4>SECRET IDENTIFIERS</h4>
<p>What&#8217;s new in the paper being released today by students at Saarland University&#8217;s <a href="https://cispa.saarland/index.html" target="_blank">Center for IT-Security, Privacy and Accountability</a> (CISPA) is the method by which the researchers were able to link these mass-scans to the very amplification attacks that follow soon after.</p>
<p>The researchers worked out a way to encode a secret identifier into the set of AmpPot honeypots that any subsequent attack will use, which varies per scan source. They then tested to see if the scan infrastructure was also used to actually launch (and not just to prepare) the attacks.<span id="more-36687"></span></p>
<p>Their scheme was based in part on the idea that similar traffic sources should have to travel similar Internet distances to reach the globally-distributed AmpPot sensors. To do this, they looked at the number of &#8220;<a href="https://en.wikipedia.org/wiki/Hop_(networking)" target="_blank">hops</a>&#8221; or Internet network segments that each scan and attack had to traverse.</p>
<p>Using <a href="http://www.mio.com/technology-trilateration.htm" target="_blank">trilateration</a> &#8211;the process of determining absolute or relative locations of points by measurement of distances &#8212; the research team was able to link scanners to attack origins based on hop counts.</p>
<p>These methods revealed some 286 scanners that are used by booter services in preparation for launching amplification attacks. Further, they discovered that roughly 75 percent of those scanners are located in the United States.</p>
<p>The researchers say they were able to confirm that many of the same networks that host scanners are also being used to launch the attacks. More significantly, they were able to attribute approximately one-third of the attacks back to their origin.</p>
<p>&#8220;This is an impressive result, given that the spoofed source of amplification attacks usually remains hidden,&#8221; said <strong>Christian Rossow</strong> of Saarland University.</p>
<p>Rosso said the team hopes to conduct further research on their methods to more definitively tie scanning and attack activity to specific booter services by name. The group is already offering a service to hosting providers and ISPs to share information about incidents (such as attack start and end times). Providers can then use the attack information to inform their customers or to filter attack traffic.</p>
<p>&#8220;We have shared our findings with law enforcement agencies &#8212; in particular, Europol and the FBI &#8212; and a closed circle of tier-1 network providers that use our insights on an operational basis,&#8221; the researchers wrote. &#8220;Our output can be used as forensic evidence both in legal complaints and in ways to add social pressure against spoofing sources.&#8221;</p>
<h4>ANALYSIS</h4>
<p>Even if these newly-described discovery methods were broadly deployed today, it&#8217;s unlikely that booter services would be going away anytime soon. But this research certainly holds the promise that booter service owners will be able to hide the true location of their operations less successfully going forward. and that perhaps more of them will be held accountable for their crimes.</p>
<p>Efforts by other researchers have made it more difficult for booter and stresser services <a href="https://krebsonsecurity.com/2015/08/stress-testing-the-booter-services-financially/" target="_blank">to accept PayPal payments</a>, forcing more booters to rely more on Bitcoin.</p>
<p>Also, there are a number of initiatives that seek to identify a handful of booter services which resell their infrastructure to other services who brand and market them as their own. Case in point, in September 2016 I published <a href="https://krebsonsecurity.com/2016/09/israeli-online-attack-service-vdos-earned-600000-in-two-years/" target="_blank">an expose on vDOS</a>, a booter service that earned (conservatively) $600,000 over two years helping to launch more than 150,000 DDoS attacks.</p>
<p>Turns out, vDOS&#8217;s infrastructure was used by more than a half-dozen other booter services, and shortly after vDOS was taken offline most of those services went dark or were dismantled as well.</p>
<p>One major shift that could help to lessen the appeal of booter services &#8212; both for the profit-seeking booter proprietors and their customers &#8212; is a clear sign from law enforcement officials that this activity is in fact illegal and punishable by real jail time. So far, many booter service owners have been operating under the delusion or rationalization that their services are intended solely for Web site owners to test the ability of their sites to withstand data deluges. The <a href="https://krebsonsecurity.com/2016/10/feds-charge-two-in-lizard-squad-investigation/" target="_blank">recent arrest</a> of two alleged <a href="https://krebsonsecurity.com/?s=Lizard+Squad&amp;x=0&amp;y=0" target="_blank">Lizard Squad</a> members who resold vDOS services through their own &#8220;PoodleStresser&#8221; service is a good start.</p>
<p>Many booter operators apparently believe (or at least hide behind) a wordy &#8220;terms of service&#8221; agreement that all customers must acknowledge somehow <a href="https://krebsonsecurity.com/2013/05/ragebooter-legit-ddos-service-or-fed-backdoor/" target="_blank">absolves them of any sort of liability</a> for how their customers use the service &#8212; regardless of how much hand-holding and technical support they offer those customers.</p>
<p>Indeed, the proprietors of vDOS &#8212; who <a href="https://krebsonsecurity.com/2016/09/alleged-vdos-proprietors-arrested-in-israel/" target="_blank">were arrested</a> shortly after my story about them &#8212; <a href="http://www.wsj.com/articles/web-attack-stemmed-from-game-tactics-1477256958" target="_blank">told</a> the <em>Wall Street Journal</em> through their attorneys that, “If I was to buy a gun and shoot something, is the person that invents the gun guilty?”</p>
<p>The alleged proprietors of vDOS &#8212; 18-year-old Israelis <strong>Yarden Bidani</strong> and <strong>Itay Huri</strong> &#8212; were released from house arrest roughly ten days after their initial arrest. To date, no charges have been filed against either men, but I have reason to believe that may not be the case for long.</p>
<p>Meanwhile, changes may be afoot for booter services advertised at <strong>Hackforums[dot]net</strong>, probably the biggest open-air online marketplace where booter services are advertised, compared and rated (hat tip to <a href="https://twitter.com/MalwareTechBlog/status/791379460813709312" target="_blank">@MalwareTechblog</a>). Earlier this week, Hackforums administrator <strong>Jesse &#8220;Omniscient&#8221; LaBrocca</strong> began restricting access to its &#8220;stressers&#8221; subsection of the sprawling forum, and barring forum members from advertising booter services in their user profiles.</p>
<p>&#8220;I can absolutely see a day when it&#8217;s removed entirely,&#8221; LaBrocca said in a post explaining his actions. &#8220;Could be very soon too.&#8221;</p>
<div id="attachment_36821" style="width: 590px" class="wp-caption aligncenter"><a href="media/d89764dc.bbbooters.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/10/bbbooters.png"><img class="wp-image-36821 size-medium" src="media/9e632fe8.bbbooters-580x131.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/10/bbbooters-580x131.png" alt="bbbooters" width="580" height="131" srcset="http://krebsonsecurity.com/wp-content/uploads/2016/10/bbbooters-580x131.png 580w, http://krebsonsecurity.com/wp-content/uploads/2016/10/bbbooters-768x174.png 768w, http://krebsonsecurity.com/wp-content/uploads/2016/10/bbbooters-940x212.png 940w, http://krebsonsecurity.com/wp-content/uploads/2016/10/bbbooters.png 1000w" sizes="(max-width: 580px) 100vw, 580px" /></a><p class="wp-caption-text">Hackforums administrator Jesse &#8220;Omniscient&#8221; LaBrocca explaining a decision to restrict access to the &#8220;stressers&#8221; portion of the Hackforums marketplace.</p></div>
<p>My worry is that we may soon see a pendulum shift in the way that many booter services operate. For now, the size of attacks launched by booter services is somewhat dependent on the number and power of the back-end servers used to initiate amplification and reflection attacks.</p>
<p>However, I could see a day in the not-too-distant future in which booter service operators start earning most of their money by reselling <a href="https://krebsonsecurity.com/2016/10/hacked-cameras-dvrs-powered-todays-massive-internet-outage/" target="_blank">far more powerful attacks</a> launched by actual botnets made from large networks of hacked <strong>Internet of Things</strong> (IoT) devices &#8212; such as <a href="https://krebsonsecurity.com/2016/10/who-makes-the-iot-things-under-attack/" target="_blank">poorly-secured CCTV cameras and digital video recorders (DVRs)</a>.</p>
<p>In some ways this has already happened, as I detailed in my January 2015 story, <a href="https://krebsonsecurity.com/2015/01/lizard-stresser-runs-on-hacked-home-routers/" target="_blank">Lizard Stresser Runs on Hacked Home Routers</a>. But with the now <a href="https://krebsonsecurity.com/2016/10/source-code-for-iot-botnet-mirai-released/" target="_blank">public release of the source code for the Mirai botnet</a> &#8212; the same malware strain that was used in <a href="https://krebsonsecurity.com/2016/09/krebsonsecurity-hit-with-record-ddos/" target="_blank">the record 620 Gbps DDoS on my site last month</a> and in the <a href="https://krebsonsecurity.com/2016/10/hacked-cameras-dvrs-powered-todays-massive-internet-outage/" target="_blank">widespread Internet outage last week</a> caused by an attack against infrastructure provider <strong>Dyn</strong> &#8212; far more powerful and scalable attacks are now available for resale.</p>
<p>A copy of the paper released today at the ACM CSS conference in Vienna is available <a href="http://dl.acm.org/ft_gateway.cfm?id=2978293&amp;ftid=1805747&amp;dwn=1" target="_blank">here</a> (PDF).</p>


feed_id: https://krebsonsecurity.com/?p=36833
title: Hackforums Shutters Booter Service Bazaar
uri: Hackforums-Shutters-Booter-Service-Bazaar
url: https://krebsonsecurity.com/2016/10/hackforums-shutters-booter-service-bazaar/
content:
<p>Perhaps the most bustling marketplace on the Internet where people can compare and purchase so-called &#8220;booter&#8221; and &#8220;stresser&#8221; subscriptions &#8212; attack-for-hire services designed to knock Web sites offline &#8212; announced last week that it has permanently banned the sale and advertising of these services.</p>
<p>On Friday, Oct. 28, <strong>Jesse LaBrocca </strong>&#8212; the administrator of the popular English-language hacking forum <strong>Hackforums[dot]net</strong> &#8212; said he was shutting down the &#8220;server stress testing&#8221; (SST) section of the forum. The move comes amid heightened public scrutiny of the SST industry, which has been <a href="https://krebsonsecurity.com/2016/09/israeli-online-attack-service-vdos-earned-600000-in-two-years/" target="_blank">linked</a> to several unusually powerful recent attacks and is <a href="https://krebsonsecurity.com/2016/10/are-the-days-of-booter-services-numbered/" target="_blank">responsible for the vast majority of denial-of-service (DOS) attacks</a> on the Internet today.</p>
<div id="attachment_36837" style="width: 590px" class="wp-caption aligncenter"><a class="lightbox" href="media/0694f97b.omni-closed-sst.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/10/omni-closed-sst.png"><img class="wp-image-36837 size-medium" src="media/8213a120.omni-closed-sst-580x236.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/10/omni-closed-sst-580x236.png" alt="The administrator of Hackforums bans the sale and advertising of server stress testing (SST) services, also known as &quot;booter&quot; or &quot;stresser&quot; online attack-for-hire services." width="580" height="236" srcset="http://krebsonsecurity.com/wp-content/uploads/2016/10/omni-closed-sst-580x236.png 580w, http://krebsonsecurity.com/wp-content/uploads/2016/10/omni-closed-sst-768x313.png 768w, http://krebsonsecurity.com/wp-content/uploads/2016/10/omni-closed-sst-940x383.png 940w" sizes="(max-width: 580px) 100vw, 580px" /></a><p class="wp-caption-text">The administrator of Hackforums bans the sale and advertising of server stress testing (SST) services, also known as &#8220;booter&#8221; or &#8220;stresser&#8221; online attack-for-hire services.</p></div>
<p>&#8220;Unfortunately once again the few ruin it for the many,&#8221; LaBrocca wrote under his Hackforums alias &#8220;Omniscient.&#8221; &#8220;I&#8217;m personally disappointed that this is the path I have to take in order to protect the community. I loathe having to censor material that could be beneficial to members. But I need to make sure that we continue to exist and given the recent events I think it&#8217;s more important that the section be permanently shut down.&#8221;</p>
<p>Last month, <a href="https://krebsonsecurity.com/2016/09/krebsonsecurity-hit-with-record-ddos/" target="_blank">a record-sized DDoS</a> hit KrebsOnSecurity.com. The attack was launched with the help of <strong>Mirai</strong>, a malware strain that enslaves <a href="https://krebsonsecurity.com/2016/10/who-makes-the-iot-things-under-attack/" target="_blank">poorly security Internet-of-Things (IoT) devices</a> like CCTV cameras and digital video recorders and uses them to launch crippling attacks.</p>
<p>At the end of September, a Hackforums user named &#8220;<strong>Anna_Senpai</strong>&#8221; used the forum <a href="https://krebsonsecurity.com/2016/10/source-code-for-iot-botnet-mirai-released/" target="_blank">to announce the release the source code for Mirai</a>. A week ago, someone <a href="https://krebsonsecurity.com/2016/10/hacked-cameras-dvrs-powered-todays-massive-internet-outage/" target="_blank">used Mirai</a> to launch <a href="https://krebsonsecurity.com/2016/10/ddos-on-dyn-impacts-twitter-spotify-reddit/" target="_blank">a massive attack on Internet infrastructure firm <strong>Dyn</strong></a>, which for the better part of a day lead to sporadic outages for some of the Web&#8217;s top destinations, including <strong>Twitter</strong>, <strong>PayPal</strong>, <strong>Reddit</strong> and <strong>Netflix</strong>.</p>
<div id="attachment_36550" style="width: 590px" class="wp-caption aligncenter"><a class="lightbox" href="media/464e1dd6.mirai-hf.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/10/mirai-hf.png"><img class="wp-image-36550 size-medium" src="media/61e3129a.mirai-hf-580x232.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/10/mirai-hf-580x232.png" alt="The Hackforums post that includes links to the Mirai source code." width="580" height="232" srcset="http://krebsonsecurity.com/wp-content/uploads/2016/10/mirai-hf-580x232.png 580w, http://krebsonsecurity.com/wp-content/uploads/2016/10/mirai-hf-768x308.png 768w, http://krebsonsecurity.com/wp-content/uploads/2016/10/mirai-hf-940x377.png 940w" sizes="(max-width: 580px) 100vw, 580px" /></a><p class="wp-caption-text">The Hackforums post that includes links to the Mirai source code.</p></div>
<p>As I noted in last week&#8217;s story <a href="https://krebsonsecurity.com/2016/10/are-the-days-of-booter-services-numbered/" target="_blank">Are the Days of Booter Services Numbered?</a>, many booter service owners have been operating under the delusion or rationalization that their services are intended solely for Web site owners to test the ability of their sites to withstand data deluges.</p>
<p>Whatever illusions booter service operators or users may have harbored about their activities should have been dispelled following a talk delivered at the Black Hat security conference in Las Vegas this year. In that speech, <strong>FBI Agent Elliott Peterson</strong> issued an <a href="https://www.youtube.com/watch?v=z7Lu8kPiX6E" target="_blank">unambiguous warning</a> that the agency was prepared to investigate and help prosecute people engaged in selling and buying from booter services.</p>
<p>But it wasn&#8217;t until this month&#8217;s attack on Dyn that LaBrocca warned the Hackforums community he may have to shut down the SST section.</p>
<p>&#8220;I can&#8217;t image this attention is going to be a good thing,&#8221; Omni said in an October 26, 2016 thread titled &#8220;Bad things.&#8221; &#8220;Already a Senator is <a href="https://krebsonsecurity.com/2016/10/senator-prods-federal-agencies-on-iot-mess/" target="_blank">calling for a hearing</a> on the Internet of Things [link added]. In the end there could be new laws which effect [sic] us all. So for those responsible for the attacks and creating this mess&#8230;.you dun goofed. I expect a lot of backlash to come out of this.&#8221;</p>
<p>If LaBrocca appears steamed from this turn of events, it&#8217;s probably with good reason: He stands to lose a fair amount of regular income by banning some of the most lucrative businesses on his forum. Vendors on Hackforums pay fees as high as $25 apiece to achieve a status that allows them to post new sales threads, and banner ads on the forum can run up to $200 per week.</p>
<div id="attachment_36841" style="width: 311px" class="wp-caption alignleft"><a class="lightbox" href="media/7e6dc136.booterstickies.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/10/booterstickies.png"><img class="wp-image-36841" src="media/7e6dc136.booterstickies.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/10/booterstickies.png" alt="&quot;Stickies&quot; advertising various &quot;booter&quot; or &quot;stresser&quot; DDoS-for-hire services." width="301" height="223" /></a><p class="wp-caption-text">&#8220;Stickies&#8221; advertising various &#8220;booter&#8221; or &#8220;stresser&#8221; DDoS-for-hire services.</p></div>
<p>Vendors who wish to &#8220;sticky&#8221; their ads &#8212; that is, pay to keep the ads displayed prominently near or at the top of a given discussion subforum &#8212; pay LaBrocca up to $60 per week for the prime sticky spots. And there were dozens of booter services advertised on Hackforums.</p>
<p><strong>Allison Nixon</strong>, director of security research at <a href="https://www.flashpoint-intel.com/" target="_blank">Flashpoint</a> and an expert on booter services, said the move could put many booter services out of business.</p>
<p>Nixon said the average booter service customer uses the attack services to settle grudges with opponents in online games, and that the closure of the SST subforum may make these services less attractive to those individuals.</p>
<p>&#8220;There is probably a lesser likelihood that the average gamer will see these services and think that it’s an okay idea to purchase them,&#8221; Nixon said. &#8220;The ease of access to these booters services makes people think it’s okay to use them. In gaming circles, for example, people will often use them to DDoS one another and not realize they might be shutting down an innocent person’s network. Recognizing that this is criminal activity on the same level of criminal hacking and fraud may discourage people from using these services, meaning the casual actor may be less likely to buy a booter subscription and launch DDoS attacks.&#8221;</p>
<p>Although the closure of the SST subforum could put many booter services out of business, the action almost seems somewhat arbitrary given the sheer amount of other illegal hacking activity that is blatantly advertised on Hackforums, Nixon said.</p>
<p>&#8220;It’s interesting the norms that are on this forum because they’re so different from how you or I would recognize acceptable behavior,&#8221; she said. &#8220;For example, most people would think it’s not acceptable to see booter services advertised alongside <a href="https://krebsonsecurity.com/2016/07/canadian-man-is-author-of-popular-orcus-rat/" target="_blank">remote access Trojans</a>, <a href="https://krebsonsecurity.com/2014/05/antivirus-is-dead-long-live-antivirus/" target="_blank">malware crypting services</a> and botnets.&#8221;</p>
<p>Other questionable services and subsections advertised on Hackforums include those intended for the sale of hacked social media and e-commerce accounts. More shocking are the dozens of threads wherein Hackforums members advertise the sale of &#8220;girl slaves,&#8221; essentially access to hacked computers belonging to teenage girls who can be extorted and exploited for payment or naked pictures. It&#8217;s worth noting that the youth who was arrested for <a href="http://arstechnica.com/tech-policy/2013/09/miss-teen-usas-webcam-spy-called-himself-cutefuzzypuppy/" target="_blank">snapping nude pictures of Miss Teen USA Cassidy Wolf</a> through her webcam was a regular user of Hackforums.</p>
<div id="attachment_36839" style="width: 590px" class="wp-caption aligncenter"><a class="lightbox" href="media/7d3f65ab.girlslaves.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/10/girlslaves.png"><img class="wp-image-36839 size-medium" src="media/b22d6f33.girlslaves-580x281.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/10/girlslaves-580x281.png" alt="Hackforums users advertising the sale and procurement of &quot;girl slaves.&quot;" width="580" height="281" srcset="http://krebsonsecurity.com/wp-content/uploads/2016/10/girlslaves-580x281.png 580w, http://krebsonsecurity.com/wp-content/uploads/2016/10/girlslaves-768x372.png 768w, http://krebsonsecurity.com/wp-content/uploads/2016/10/girlslaves-940x456.png 940w" sizes="(max-width: 580px) 100vw, 580px" /></a><p class="wp-caption-text">Hackforums users advertising the sale and procurement of &#8220;girl slaves.&#8221;</p></div>
<p><span id="more-36833"></span>Nixon said most Hackforums users are essentially good people who are interested in learning more about technology, security and other topics. But she said many of the younger, impressionable members are heavily influenced by some of the more senior forum participants, a number of whom are peddling dangerous products and services.</p>
<p>&#8220;Most of the stuff on Hackforuns is not that bad,&#8221; Nixon said. &#8220;There are a lot of kids who are pretty much normal people and interested in hacking and technology. But there are also gangs, and there are definitely criminal organizations that have a presence on the forum that will try to enable criminal activity and take advantage of people.&#8221;</p>
<p>The removal of booter services from Hackforums is a gratifying development for me personally and professionally. My site has been under near-constant attack from users of these booter services for several years now. As a result, I have sought to bring more public attention to these crooked businesses and to the young men who&#8217;ve earned handsome profits operating over the years. Here are just a few of those stories:</p>
<p><a href="https://krebsonsecurity.com/2015/08/stress-testing-the-booter-services-financially/" target="_blank">Stress Testing the Booter Services, Financially</a></p>
<p><a href="https://krebsonsecurity.com/2016/10/are-the-days-of-booter-services-numbered/" target="_blank">Are the Days of Booter Services Numbered?</a></p>
<p><a href="https://krebsonsecurity.com/2016/09/israeli-online-attack-service-vdos-earned-600000-in-two-years/" target="_blank">Israeli Online Attack Service &#8216;vDOS&#8217; Earned $600,000 in Two Years</a></p>
<p><a href="https://krebsonsecurity.com/2013/05/ragebooter-legit-ddos-service-or-fed-backdoor/" target="_blank">Ragebooter: Legit DDoS Service, or Fed Backdoor?</a></p>
<p><a href="https://krebsonsecurity.com/2013/05/ddos-services-advertise-openly-take-paypal/" target="_blank">DDoS Services Advertise Openly, Take PayPal</a></p>
<p><a href="https://krebsonsecurity.com/2012/08/booter-shells-turn-web-sites-into-weapons/" target="_blank">Booter Shells Turn Web Sites Into Weapons</a></p>
<p><a href="https://krebsonsecurity.com/2016/10/spreading-the-ddos-disease-and-selling-the-cure/" target="_blank">Spreading the DDoS Disease and Selling the Cure</a></p>
<p><a href="https://krebsonsecurity.com/2015/01/lizard-stresser-runs-on-hacked-home-routers/" target="_blank">Lizard Stresser Runs on Hacked Home Routers</a></p>
<p><a href="https://krebsonsecurity.com/?s=rasbora&amp;x=0&amp;y=0" target="_blank">The New Normal: 200-400 Gpbs DDoS Attacks</a></p>


feed_id: https://krebsonsecurity.com/?p=36854
title: Computer Virus Cripples UK Hospital System
uri: Computer-Virus-Cripples-UK-Hospital-System
url: https://krebsonsecurity.com/2016/11/computer-virus-cripples-uk-hospital-system/
content:
<p>Citing a computer virus outbreak, a hospital system in the United Kingdom has canceled all planned operations and diverted major trauma cases to neighboring facilities. The incident came as U.K. leaders detailed a national cyber security strategy that promises billions in cybersecurity spending, new special police units to pursue organized online gangs, and the possibility of retaliation for major attacks.</p>
<p>In a &#8220;major incident&#8221; alert posted to <a href="http://nlg.nhs.uk" target="_blank">its Web site</a>, the <strong>National Health Service&#8217;s Lincolnshire and Goole</strong> trust said it made the decision to cancel surgeries and divert trauma patients after a virus infected its electronic systems on Sunday, October 30.</p>
<div id="attachment_36858" style="width: 590px" class="wp-caption aligncenter"><a class="lightbox" href="media/e0323fbe.nhsalert.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/11/nhsalert.png"><img class="wp-image-36858 size-medium" src="media/d5a425a1.nhsalert-580x274.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/11/nhsalert-580x274.png" alt="A portion of an alert posted to the NHS's home page." width="580" height="274" srcset="http://krebsonsecurity.com/wp-content/uploads/2016/11/nhsalert-580x274.png 580w, http://krebsonsecurity.com/wp-content/uploads/2016/11/nhsalert-768x363.png 768w, http://krebsonsecurity.com/wp-content/uploads/2016/11/nhsalert-940x445.png 940w" sizes="(max-width: 580px) 100vw, 580px" /></a><p class="wp-caption-text">A portion of the alert posted to the NHS&#8217;s home page.</p></div>
<p>&#8220;We have taken the decision, following expert advise, to shut down the majority of our systems so we can isolate and destroy it,&#8221; the NHS said, of the unspecified malware infection. &#8220;All planned operations, outpatient appointments and diagnostic procedures have been cancelled for Wednesday, Nov. 2 with a small number of exceptions.&#8221;</p>
<p>The advisory continued:</p>
<p>&#8220;Inpatients will continue to be cared for and discharged as soon as they are medically fit. Major trauma cases will continue to be diverted to neighboring hospitals as will high risk women in labour.&#8221;</p>
<p>Although the NHS didn&#8217;t say what kind of virus infected its systems, it is likely an infestation of ransomware &#8212; a malware scourge whose purveyors have taken to targeting hospitals and healthcare facilities.</p>
<p>Ransomware scours an infected computer for documents, audio files, pictures and other things likely to be of value to the system&#8217;s owner, and then encrypts that data with very powerful encryption software. Most ransomware variants also scour the local network for other systems or network shares to infect. Victims usually can only get their files back after paying a specified ransom demand using a virtual currency, such as Bitcoin.<span id="more-36854"></span></p>
<p>Earlier this year, experts began noticing that cybercriminals were using ransomware to target hospitals — organizations that are heavily reliant on instant access to patient records. In March 2016, Henderson, Ky.-based <strong>Methodist Hospital</strong> <a href="https://krebsonsecurity.com/2016/03/hospital-declares-internet-state-of-emergency-after-ransomware-infection/" target="_blank">shut down its computer systems</a> after an infection from the <a href="https://nakedsecurity.sophos.com/2016/02/17/locky-ransomware-what-you-need-to-know/" target="_blank">Locky</a> strain of ransomware. Just weeks before that attack, a California hospital that was similarly besieged with ransomware <a href="http://www.npr.org/sections/thetwo-way/2016/02/17/467149625/la-hospital-pays-hackers-nearly-17-000-to-restore-computer-network" target="_blank">paid a $17,000 ransom to get its files back</a>.</p>
<p>According to <a href="media/c58ecfdf.asset_redirect.html" data-original-source="http://www.mcafee.com/common/js/asset_redirect.html" target="_blank">a recent report</a> by <strong>Intel Security</strong>, the healthcare sector is experiencing over 20 data loss incidents per day related to ransomware attacks. The company said it identified almost $100,000 in payments from hospital ransomware victims to specific bitcoin accounts so far in 2016.</p>
<p>As dependent as healthcare systems are on computers and information technology, the notion that a computer virus could result in bodily injury or death is no longer the stuff of Hollywood movie scripts. Unfortunately, the healthcare industry is for the most part still catching up in its ability to anticipate, prevent and respond to these types of cyber attacks.</p>
<p>As macabre as it may sound, perhaps people dying because of poor cybersecurity is exactly what it will take for more organizations to dedicate the necessary resources toward adequately defending the systems upon which they so heavily rely.</p>
<p>In 2010, I was interviewed by <a href="http://www.team-cymru.org" target="_blank">Team Cyrmu</a>&#8216;s <strong>Steve Santorelli</strong> as part of their ongoing <a href="http://www.youtube.com/user/teamcymru" target="_blank">Who and Why Show</a>. Santorelli gave me a few minutes to answer the question, “What keeps you up at night?” My answer was basically that I worry what will happen to the Internet as we know it when people start to die in a measurable way because of computer and Internet security vulnerabilities and attacks. <a href="https://www.youtube.com/watch?v=mVQa5ciidNM" target="_blank">Here&#8217;s the entire interview</a> if anyone cares to have a listen.</p>
<p>The crippling of NHS&#8217;s systems came as <a href="https://en.wikipedia.org/wiki/Chancellor_of_the_Exchequer">U.K. Chancellor</a> <a href="https://en.wikipedia.org/wiki/Philip_Hammond" target="_blank">Philip Hammond</a> unveiled <a href="https://www.gov.uk/government/news/britains-cyber-security-bolstered-by-world-class-strategy" target="_blank">a national cybersecurity strategy</a>, warning that hostile &#8220;foreign actors&#8221; were developing techniques that threaten the country&#8217;s electrical grid and airports, among other critical infrastructure.</p>
<p>&#8220;If we want Britain to be the best place in the world to be a tech business then it is also crucial that Britain is a safe place to do the digital business,&#8221; Hammond <a href="http://www.bbc.com/news/technology-37821867" target="_blank">said</a> Tuesday as he described the National Cyber Security Strategy in London. &#8220;Trust in the internet and the infrastructure on which it relies is fundamental to our economic future.&#8221;</p>
<p>What can businesses do to lessen the chances of having <em>their</em> critical infrastructure crippled by malware like ransomware? The FBI has the following tips:</p>
<ul>
<li>Regularly back up data and verify the integrity of those backups. Backups are critical in ransomware incidents; if you are infected, backups may be the best way to recover your critical data.</li>
<li>Secure your backups. Ensure backups are not connected to the computers and networks they are backing up. Examples might include securing backups in the cloud or physically storing them offline. It should be noted, some instances of ransomware have the capability to lock cloud-based backups when systems continuously back up in real-time, also known as persistent synchronization.</li>
<li>Scrutinize links contained in e-mails and do not open attachments included in unsolicited e-mails.</li>
<li>Only download software – especially free software – from sites you know and trust. When possible, verify the integrity of the software through a digital signature prior to execution.</li>
<li>Ensure application patches for the operating system, software, and firmware are up to date, including Adobe Flash, Java, Web browsers, etc.</li>
<li>Ensure anti-virus and anti-malware solutions are set to automatically update and regular scans are conducted.</li>
<li>Disable macro scripts from files transmitted via e-mail. Consider using Office Viewer software to open Microsoft Office files transmitted via e-mail instead of full Office Suite applications.</li>
<li>Implement software restrictions or other controls to prevent the execution of programs in common ransomware locations, such as temporary folders supporting popular Internet browsers, or compression/decompression programs, including those located in the AppData/LocalAppData folder.</li>
</ul>
<p>Additional considerations for businesses include the following:</p>
<ul>
<li>Focus on awareness and training. Because end users are often targeted, employees should be made aware of the threat of ransomware, how it is delivered, and trained on information security principles and techniques.</li>
<li>Patch all endpoint device operating systems, software, and firmware as vulnerabilities are discovered. This precaution can be made easier through a centralized patch management system.</li>
<li>Manage the use of privileged accounts by implementing the principle of least privilege. No users should be assigned administrative access unless absolutely needed. Those with a need for administrator accounts should only use them when necessary; they should operate with standard user accounts at all other times.</li>
<li>Configure access controls with least privilege in mind. If a user only needs to read specific files, he or she should not have write access to those files, directories, or shares.</li>
<li>Use virtualized environments to execute operating system environments or specific programs.</li>
<li>Categorize data based on organizational value, and implement physical/logical separation of networks and data for different organizational units. For example, sensitive research or business data should not reside on the same server and/or network segment as an organization’s e-mail environment.</li>
<li>Require user interaction for end user applications communicating with Web sites uncategorized by the network proxy or firewall. Examples include requiring users to type in information or enter a password when the system communicates with an uncategorized Web site.</li>
<li>Implement application whitelisting. Only allow systems to execute programs known and permitted by security policy.</li>
</ul>
<p>Further reading: <a href="http://www.scmagazineuk.com/breaking-nhs-trust-crippled-by-cyberattack/article/569630/" target="_blank">SC Magazine UK&#8217;s take</a> on the attack.</p>


feed_id: https://krebsonsecurity.com/?p=36884
title: Did the Mirai Botnet Really Take Liberia Offline?
uri: Did-the-Mirai-Botnet-Really-Take-Liberia-Offline
url: https://krebsonsecurity.com/2016/11/did-the-mirai-botnet-really-take-liberia-offline/
content:
<p>KrebsOnSecurity received many a missive over the past 24 hours from readers who wanted to know why I&#8217;d not written about widespread media reports that <a href="https://krebsonsecurity.com/?s=mirai&amp;x=0&amp;y=0" target="_blank">Mirai</a> &#8212; a malware strain made from hacked &#8220;Internet of Things&#8221; (IoT) devices such as poorly secured routers and IP cameras &#8212; was used to knock the entire country of <a href="https://en.wikipedia.org/wiki/Liberia" target="_blank">Liberia</a> offline. The trouble is, as far as I can tell no such nationwide outage actually occurred.</p>
<p>First, a quick recap on Mirai: This blog was taken offline in September following <a href="https://krebsonsecurity.com/2016/09/krebsonsecurity-hit-with-record-ddos/" target="_blank">a record 620 Gpbs attack</a> launched by a Mirai botnet. The source code for Mirai was <a href="https://krebsonsecurity.com/2016/10/source-code-for-iot-botnet-mirai-released/" target="_blank">leaked online at the end of September</a>. Since then, the code has been forked several times, resulting in the emergence of several large Mirai-based botnets. In late October, many of the Internet&#8217;s top destinations went offline for the better part of a day when <a href="https://krebsonsecurity.com/2016/10/hacked-cameras-dvrs-powered-todays-massive-internet-outage/" target="_blank">Mirai was used to attack</a> Internet infrastructure firm <strong>Dyn</strong>.</p>
<p>Enter <strong>Kevin Beaumont</strong>, a security architect from Liverpool, England who on Thursday published a <a href="https://medium.com/@networksecurity/shadows-kill-mirai-ddos-botnet-testing-large-scale-attacks-sending-threatening-messages-about-6a61553d1c7#.8fhmt3x4n" target="_blank">piece on Medium.com</a> about an attack by Mirai against Liberia. Beaumont had been researching the output of <a href="https://twitter.com/MiraiAttacks" target="_blank">an automated Twitter account</a> set up by security researchers to monitor attacks from these various Mirai botnets. That Twitter account, <strong>@MiraiAttacks</strong>, burps out a tweet with each new Mirai attack, listing the targeted Internet address, the attack type, and the observed duration of the attack.</p>
<p>Beamont&#8217;s story noted that a botnet based on Mirai was seen attacking the telecommunications infrastructure in the West African nation of Liberia. Citing anonymous sources, Beaumont said transit providers confirmed an attack of more than 500 Gpbs targeting Liberia&#8217;s lone underseas large-transit Internet cable, which Beaumont said &#8220;provides a single point of failure for internet access.&#8221;</p>
<p>&#8220;From monitoring we can see websites hosted in country going offline during the attacks,&#8221; Beaumont wrote. &#8220;Additionally, a source in country at a Telco has confirmed to a journalist they are seeing intermittent internet connectivity, at times which directly match the attack. The attacks are extremely worrying because they suggest a Mirai operator who has enough capacity to seriously impact systems in a nation state.&#8221;</p>
<p>Not long after Beamont&#8217;s story went live, a piece at <a href="http://thehackernews.com/2016/11/ddos-attack-mirai-botnet.html" target="_blank">The Hacker News</a> breathlessly announced that hackers using Mirai had succeeded in knocking Liberia off the Internet. The Hacker News piece includes nifty graphics and images of Liberia&#8217;s underseas Internet cables. Soon after, <strong>ZDNet</strong> <a href="http://www.zdnet.com/article/mirai-botnet-attack-briefly-knocked-an-entire-country-offline/" target="_blank">picked up the outage angle</a>, as did <a href="http://www.bbc.com/news/technology-37859678" target="_blank">the BBC</a> and <a href="https://www.theguardian.com/technology/2016/nov/03/cyberattack-internet-liberia-ddos-hack-botnet" target="_blank">The Guardian</a> and a host of other news outlets.</p>
<div id="attachment_36893" style="width: 590px" class="wp-caption aligncenter"><img class="size-medium wp-image-36893" src="media/76987a21.hackernewsliberia-580x338.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/11/hackernewsliberia-580x338.png" alt="A graphic The Hacker News used to explain Liberia's susceptibility to a DDoS attack. " width="580" height="338" srcset="http://krebsonsecurity.com/wp-content/uploads/2016/11/hackernewsliberia-580x338.png 580w, http://krebsonsecurity.com/wp-content/uploads/2016/11/hackernewsliberia.png 735w" sizes="(max-width: 580px) 100vw, 580px" /><p class="wp-caption-text">A graphic The Hacker News used to explain Liberia&#8217;s susceptibility to a DDoS attack.</p></div>
<p>The only problem that I can see with these stories is that there does not appear to have been anything close to a country-wide outage as a result of this Mirai attack.</p>
<p><strong>Daniel Brewer</strong>, general manager for the <a href="http://cclnetwork.weebly.com/" target="_blank">Cable Consortium of Liberia</a>, confirmed that his organization has fielded inquiries from news outlets and other interest groups following multiple media reports of a nationwide outage. But he could not point to the reason.</p>
<p>&#8220;Both our ACE submarine cable monitoring systems and servers hosted (locally) in LIXP (Liberia Internet Exchange Point) show no downtime in the last 3 weeks,&#8221; Brewer said. &#8220;While it is likely that a local operator might have experienced a brief outage, we have no knowledge of a national Internet outage and there are no data to [substantiate] that.&#8221;<span id="more-36884"></span></p>
<p>Yes, multiple sources confirm that Mirai was used to launch an attack exceeding 500 Gbps against a <em>mobile</em> telecom provider in Liberia, but those sources also say the provider in question had a denial-of-service attack mitigation plan in place that kicked into action shortly after the attack began.</p>
<p>This was confirmed in <a href="https://twitter.com/DynResearch/status/794270004179042306" target="_blank">a tweet</a> on Thursday by Dyn. The company said in <a href="https://twitter.com/DynResearch/status/794167365105811456" target="_blank">a separate tweet</a> that routing in Liberia has been stable for days.</p>
<p><strong>Akamai, </strong>a company with a global Internet presence and visibility, said it saw a dip in traffic levels from Liberia. Akamai <a href="https://twitter.com/akamai_soti/status/794335101794533377" target="_blank">tweeted a graphic</a> Thursday evening that indicated traffic to Liberia was lower than normal as compared to traffic patterns from previous days this week. But there was nothing to indicate a nationwide outage, and the dip in traffic may just as well have to do with the fact that the first Thursday of November in Liberia is Thanksgiving, <a href="https://en.wikipedia.org/wiki/Public_holidays_in_Liberia" target="_blank">a public holiday</a> there.</p>
<p>&#8220;Neither @dynresearch nor @akamai_soti have data supporting the assertion that Liberia suffered a national outage,&#8221; <a href="https://twitter.com/DougMadory/status/794592487159529472" target="_blank">tweeted</a> Dyn&#8217;s Doug Madory.</p>
<p>To recap: Did a Mirai botnet attack an infrastructure provider in Liberia? No question. Is the IoT problem bad enough that we have to worry about entire countries being knocked offline? Quite possibly. Was there an outage that knocked the country of Liberia offline this week? I have yet to see the evidence to support that claim.</p>


feed_id: https://krebsonsecurity.com/?p=36869
title: Ne’er-Do-Well News and Cyber Justice
uri: Ne-er-Do-Well-News-and-Cyber-Justice
url: https://krebsonsecurity.com/2016/11/neer-do-well-news-and-cyber-justice/
content:
<p>Way back in the last millennium when I was a lowly copy aide at <em>The Washington Post</em>, I pitched the Metro Section editor on an idea for new column: &#8220;And the Good News Is&#8230;&#8221; The editor laughed me out of her office. But I still think it&#8217;s a decent idea &#8212; particularly in the context of cybersecurity &#8212; to periodically highlight the good news when people allegedly responsible for spewing so much badness online are made to face justice.</p>
<div id="attachment_36876" style="width: 590px" class="wp-caption aligncenter"><img class="size-medium wp-image-36876" src="media/292de1ab.ncaarrest-580x326.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/11/ncaarrest-580x326.png" alt="NCA officials lead away a suspect arrested in this week's raids. Image: NCA." width="580" height="326" srcset="http://krebsonsecurity.com/wp-content/uploads/2016/11/ncaarrest-580x326.png 580w, http://krebsonsecurity.com/wp-content/uploads/2016/11/ncaarrest-768x432.png 768w, http://krebsonsecurity.com/wp-content/uploads/2016/11/ncaarrest.png 922w" sizes="(max-width: 580px) 100vw, 580px" /><p class="wp-caption-text">NCA officials lead away a suspect arrested in this week&#8217;s raids. Image: NCA.</p></div>
<p>In the United Kingdom this week, 14 people were arrested on suspicion of laundering at least £11 million (~USD $13.7M) on behalf of thieves who stole the money using sophisticated banking Trojans like <a href="https://en.wikipedia.org/wiki/Dridex" target="_blank">Dridex</a> and <a href="https://www.secureworks.com/research/dyre-banking-trojan" target="_blank">Dyre</a>. A <a href="http://www.nationalcrimeagency.gov.uk/news/948-nca-targets-international-cyber-crime-network" target="_blank">statement</a> issued by the U.K.&#8217;s <strong>National Crime Agency</strong> (NCA) said 13 men and a woman, aged between 23 and 52, were arrested in the roundup, including a number of foreign nationals.</p>
<p>The NCA warned in <a href="https://krebsonsecurity.com/2016/07/cybercrime-overtakes-traditional-crime-in-uk/" target="_blank">a report</a> released this year that cybercrime had overtaken traditional crime in the United Kingdom. According to the <strong>U.K.&#8217;s Office of National Statistics</strong>, there were 2.46 million cyber incidents and 2.11 million victims of cybercrime in the U.K. in 2015.</p>
<p>Also in the U.K., 19-year-old <strong>Adam Mudd</strong> pleaded guilty to operating and profiting from <strong>Titanium Stresser,</strong> an attack-for-hire or &#8220;booter&#8221; service that could be hired to knock Web sites offline. When U.K. authorities arrested Mudd at his home last year, they found detailed records of the attack service&#8217;s customers and victims, which included evidence of more than 1.7 million attacks. Prosecutors say Mudd launched the service when he was 15 years old.</p>
<div id="attachment_36874" style="width: 590px" class="wp-caption aligncenter"><img class="size-medium wp-image-36874" src="media/b41eba02.titaniumstresser-580x689.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/11/titaniumstresser-580x689.png" alt="TitaniumStresser[dot]net, as it appeared in 2014." width="580" height="689" srcset="http://krebsonsecurity.com/wp-content/uploads/2016/11/titaniumstresser-580x689.png 580w, http://krebsonsecurity.com/wp-content/uploads/2016/11/titaniumstresser.png 731w" sizes="(max-width: 580px) 100vw, 580px" /><p class="wp-caption-text">TitaniumStresser[dot]net, as it appeared in 2014.</p></div>
<p>As I noted in <a href="https://krebsonsecurity.com/2014/12/lizard-kids-a-long-trail-of-fail/" target="_blank">this 2014 story</a>, the source code for Titanium Stresser was later used by miscreants with the <strong>Lizard Squad</strong> hacking group to power their <a href="http://krebsonsecurity.com/2014/12/lizard-kids-a-long-trail-of-fail/" target="_blank">Lizard Stresser attack service</a>. Happily, two other 19-year-olds <a href="https://krebsonsecurity.com/2016/10/feds-charge-two-in-lizard-squad-investigation/" target="_blank">were arrested earlier this month</a> and accused of operating the Lizard Stresser attack service. It&#8217;s nice to see authorities here and abroad sending a message that operating booter service can land you in jail, full stop.<span id="more-36869"></span></p>
<p>Back stateside, a Florida man has <a href="https://www.justice.gov/opa/pr/florida-man-pleads-guilty-hacking-spamming-scheme-used-stolen-email-accounts" target="_blank">pleaded guilty</a> to hacking and spamming the world with ads for online pharmacies and other businesses eager to buy dodgy customer leads. <strong>Timothy Livingston</strong>, 31, acknowledged that he and his company &#8212; aptly named &#8220;A Whole Lot of Nothing LLC&#8221; &#8212; earned more than $1.3 million using countless hacked email accounts and huge collections of compromised computers to relay the junk missives.</p>
<p>Livingston could hardly be a better caricature of <a href="https://www.amazon.com/Spam-Nation-Organized-Cybercrime---Epidemic/dp/1402295618/ref=sr_1_1?ie=UTF8&amp;qid=1400765293&amp;sr=8-1&amp;keywords=spam+nation" target="_blank">the typical spammer</a>. Living in Florida (Boca Raton) and lavishly spending his ill-gotten gains on a flashy lifestyle. As part of his plea, Livingston agreed to forfeit $1,346,442, as well as a 2009 Cadillac Escalade and a 2006 Ferrari F430 Spider.</p>
<div id="attachment_36873" style="width: 590px" class="wp-caption aligncenter"><img class="size-medium wp-image-36873" src="media/cb3beecf.spider-580x354.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/11/spider-580x354.png" alt="A 2006 Ferrari F430 Spider. Image: Flickr, via Davocano." width="580" height="354" srcset="http://krebsonsecurity.com/wp-content/uploads/2016/11/spider-580x354.png 580w, http://krebsonsecurity.com/wp-content/uploads/2016/11/spider-768x469.png 768w, http://krebsonsecurity.com/wp-content/uploads/2016/11/spider.png 826w" sizes="(max-width: 580px) 100vw, 580px" /><p class="wp-caption-text">A 2006 Ferrari F430 Spider. Image: Flickr, via Davocano.</p></div>


feed_id: https://krebsonsecurity.com/?p=36905
title: Patch Tuesday, 2016 U.S. Election Edition
uri: Patch-Tuesday-2016-U-S-Election-Edition
url: https://krebsonsecurity.com/2016/11/patch-tuesday-2016-u-s-election-edition/
content:
<p>Let&#8217;s get this out of the way up front: Having &#8220;2016 election&#8221; in the headline above is probably the only reason anyone might read this story today. It remains unclear whether Republicans and Democrats can patch things up after a bruising and divisive election, but thanks to a special Election Day Patch Tuesday hundreds of millions of Adobe and Microsoft users have some more immediate patching to do.</p>
<p>As the eyes of the world stayed glued to screens following the U.S. presidential election through the night, <strong>Microsoft</strong> and <strong>Adobe</strong> were busy churning out a large number of new security updates for <strong>Windows</strong>, <strong>MS Office</strong>, <strong>Flash Player</strong> and other software. If you use Flash Player or Microsoft products, please take a deep breath and read on.</p>
<p><img class="alignright size-full wp-image-26837" src="media/d85cffb4.brokenwindows.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/07/brokenwindows.png" alt="brokenwindows" width="229" height="240" /></p>
<p>Regularly scheduled on the second Tuesday of each month, this month&#8217;s &#8220;Patch Tuesday&#8221; fell squarely on Election Day in the United States and included 14 patch bundles. <em>Those patches fixed a total of 68 unique security flaws in Windows and related software</em>.</p>
<p>Six of the 14 patches carry Microsoft&#8217;s most&#8217;s-dire &#8220;critical&#8221; label, meaning they fix bugs that malware or miscreants could use to remotely compromise vulnerable PCs without any help from users apart from maybe visiting a hacked or malicious Web site.</p>
<p>Microsoft says two of the software flaws addressed this week are already being exploited in active attacks. It also warned that three of the software vulnerabilities were publicly detailed prior to the release of these fixes &#8211; potentially giving attackers a head start in figuring out how to exploit the bugs.</p>
<p>&#8220;<a href="https://technet.microsoft.com/library/security/MS16-129" target="_blank">MS16-129 </a>is our usual dogs breakfast of remote code execution vulnerabilities in the <strong>Microsoft Edge</strong> browser, impacting both HTML rendering and scripting,&#8221; said <strong>Bobby Kuzma</strong>, systems engineer at <a href="https://www.coresecurity.com/" target="_blank">Core Security</a>. &#8220;<a href="https://technet.microsoft.com/en-us/library/security/ms16-130.aspx" target="_blank">MS16-130</a> contains  a privilege escalation in the onscreen keyboard function from Vista forward. That’s great news for anyone running touchscreen kiosks that are supposedly locked down.&#8221;<span id="more-36905"></span></p>
<p>As part of a new Microsoft policy that <a href="https://krebsonsecurity.com/2016/10/microsoft-no-more-pick-and-choose-patching/" target="_blank">took effect last month</a>, home and business Windows users will no longer be able to pick and choose which updates to install and which to leave for another time. <span class="il">Consumers on <strong>Windows 7 Service Pack 1</strong> and <strong>Windows 8.1</strong> will henceforth receive what Redmond is calling a “Monthly Rollup,” which addresses both security issues and reliability issues in a single update. The “Security-only updates” option — intended for enterprises and not available via Windows Update —  will only include new security patches that are released for that month. </span><span class="il">What this means is that if any part of the patch bundle breaks, the only option is to remove the entire bundle (instead of the offending patch, as was previously possible). </span></p>
<p><img class="alignleft size-full wp-image-18875" src="media/06f26f56.brokenflash-a.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2013/02/brokenflash-a.png" alt="brokenflash-a" width="211" height="180" />It’s important to note that several update types won’t be included in a rollup, including those <a href="https://helpx.adobe.com/security/products/flash-player/apsb16-37.html" target="_blank">released</a> for <strong>Adobe Flash Player</strong> on Tuesday. For the second time this month, Adobe issued a critical update for its ubiquitous Flash Player browser plugin. The newest Flash version &#8212; v.  23.0.0.207 and available <a href="http://get.adobe.com/flashplayer/" target="_blank">here</a> for both Windows and Mac computers &#8212; plugs at least nine more flaws in Flash. To see if you have Flash installed and if so what version is running, check <a href="http://www.adobe.com/software/flash/about/" target="_blank">this link</a>.</p>
<p>Google users may need to restart the browser to install or automatically download the latest version. When in doubt, click the vertical three dot icon to the right of the URL bar, select &#8220;Help,&#8221; then &#8220;About Chrome&#8221;: If there is an update available, Chrome should install it then.</p>
<p>Somehow KrebsonSecurity neglected to mention the other critical update Adobe pushed for Flash on Oct. 26, 2016 (my bad folks, sorry). It&#8217;s really hard to keep up with Flash updates sometimes. That&#8217;s part of the reason I&#8217;ll continue to encourage readers to disable or remove Adobe Flash unless until it is needed for something specific. Fewer sites now require it, and leaving this buggy, powerful program enabled all the time is just asking for security trouble. Check out the advice at <a href="https://krebsonsecurity.com/2015/06/a-month-without-adobe-flash-player/" target="_blank">A Month Without Adobe Flash Player</a> for tips on how to hobble or do without Flash entirely.</p>
<p>Indeed, Google <a href="http://www.bbc.com/news/technology-36301904" target="_blank">reportedly</a> is planning to phase out full support for Flash on its Chrome browser by the end of 2016. And <strong>Mozilla</strong> is now blocking certain Flash content deemed &#8220;not essential to the the user experience.&#8221; Specifically, as stated by Mozilla&#8217;s <a href="https://blog.mozilla.org/futurereleases/2016/07/20/reducing-adobe-flash-usage-in-firefox/" target="_blank">Benjamin Smedberg</a>, Mozilla Firefox is blocking specific Flash content that is invisible to users.</p>
<p>&#8220;This is expected to reduce Flash crashes and hangs by up to 10%. To minimize website compatibility problems, the changes are initially limited to a short, curated <a href="https://github.com/mozilla-services/shavar-plugin-blocklist" rel="noreferrer" data-ss1478711104="1">list</a> of Flash content that can be replaced with HTML,&#8221; Smedberg wrote back in June. &#8220;We intend to add to this list over time.&#8221;</p>
<p>For more on this week&#8217;s patches, check out coverage from security firms <a href="https://blog.qualys.com/laws-of-vulnerabilities/2016/11/08/microsoft-patches-actively-exploited-kernel-vulnerability-three-previously-disclosed-browser-issues-and-sql-server" target="_blank">Qualys</a> and <a href="http://blog.shavlik.com/november-patch-tuesday-2016/" target="_blank">Shavlik</a>. And, as always, if you experience any issues downloading or installing any of these updates, please leave a note about it in the comments below.</p>


feed_id: https://krebsonsecurity.com/?p=36921
title: Russian ‘Dukes’ of Hackers Pounce on Trump Win
uri: Russian-Dukes-of-Hackers-Pounce-on-Trump-Win
url: https://krebsonsecurity.com/2016/11/russian-dukes-of-hackers-pounce-on-trump-win/
content:
<p>Less than six hours after Donald Trump became the presumptive president-elect of the United States, a Russian hacker gang perhaps best known for breaking into computer networks at the <strong>Democratic National Committee</strong> launched a volley of targeted phishing campaigns against American political think-tanks and non-government organizations (NGOs).</p>
<div id="attachment_36928" style="width: 590px" class="wp-caption aligncenter"><img class="size-medium wp-image-36928" src="media/006bdc5e.cf-phish-580x422.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/11/cf-phish-580x422.png" alt="One of the phishing emails in the latest political espionage attack launched by The Dukes. Source: Volexity." width="580" height="422" srcset="http://krebsonsecurity.com/wp-content/uploads/2016/11/cf-phish-580x422.png 580w, http://krebsonsecurity.com/wp-content/uploads/2016/11/cf-phish-768x559.png 768w, http://krebsonsecurity.com/wp-content/uploads/2016/11/cf-phish-940x684.png 940w, http://krebsonsecurity.com/wp-content/uploads/2016/11/cf-phish.png 1352w" sizes="(max-width: 580px) 100vw, 580px" /><p class="wp-caption-text">One of the phishing emails in the latest political espionage attack launched by The Dukes. Source: Volexity.</p></div>
<p>That&#8217;s according to a new report from Washington, D.C.-based cyber incident response firm <strong>Volexity</strong>. The firm&#8217;s researchers say they&#8217;ve been closely monitoring the activities of an well-established Russian malware development gang known variously as <strong>Cozy Bear</strong>, <strong>APT29</strong>, and <strong>The Dukes</strong>.</p>
<p>Hacking attacks launched by The Dukes were thought to be connected to intrusions at the <strong>Democratic National Committee </strong>(DNC), as well as cyber break-ins at multiple high-profile United States Government organizations, Volexity <a href="https://www.volexity.com/blog/2016/11/09/powerduke-post-election-spear-phishing-campaigns-targeting-think-tanks-and-ngos/" target="_blank">reports in a blog post</a> published Thursday morning.</p>
<p>Last month, the Obama administration <a href="http://www.nytimes.com/2016/10/12/us/politics/obama-russia-hack-election.html" target="_blank">publicly acknowledged</a> for the first time that it believed that the Russian government was responsible for stealing and disclosing emails from the DNC and a range of other institutions and prominent individuals, most recently <a href="http://www.nytimes.com/2016/10/10/us/politics/hillary-clinton-emails-wikileaks.html" data-ss1478792768="1">Hillary Clinton’s campaign chairman, John </a><a href="http://www.nytimes.com/2016/10/10/us/politics/hillary-clinton-emails-wikileaks.html" data-ss1478792768="1">D</a>. <a href="http://www.nytimes.com/2016/10/10/us/politics/hillary-clinton-emails-wikileaks.html" data-ss1478792768="1">Podesta</a>. The emails were posted on <a href="https://wikileaks.com/" rel="noreferrer" data-ss1478792768="1">WikiLeaks</a> and other sites.</p>
<p><strong>Volexity CEO Steven Adair</strong> said The Dukes have launched at least five sorties of email-based malware phishing attacks since Trump&#8217;s acceptance speech, and that the malware campaigns are ongoing.</p>
<p>&#8220;Two of the attacks purported to be messages forwarded on from the <strong>Clinton Foundation</strong> giving insight and perhaps a postmortem analysis into the elections,&#8221; Adair wrote.&#8221;Two of the other attacks purported to be eFax links or documents pertaining to the election’s outcome being revised or rigged. The last attack claimed to be a link to a PDF download on “<em>Why American Elections Are Flawed.</em>”</p>
<p>According to Volexity, in July 2015 the Dukes started heavily targeting think tanks and NGOs.</p>
<p>&#8220;This represented a fairly significant shift in the group’s previous operations and one that continued in the lead up to and immediately after the 2016 United States Presidential election,&#8221; Adair wrote.</p>
<p>Prior to the election, The Dukes were active on August 10, 2016 and on August 25, 2016, launching several waves of highly targeted spear phishing attacks against several U.S.-based think tanks and NGOs.</p>
<p>&#8220;These spear phishing messages were spoofed and made to appear to have been sent from real individuals at well-known think tanks in the United States and Europe,&#8221; Adair wrote. &#8220;These August waves of attacks purported to be from individuals at <a href="https://www.transparency.org/" rel="noreferrer" data-ss1478789549="1">Transparency International</a>, the <a href="https://www.cnas.org/" rel="noreferrer" data-ss1478789549="1">Center for a New American Security (CNAS)</a>,  the <a href="https://www.iiss.org/" rel="noreferrer" data-ss1478789549="1">International Institute for Strategic Studies (IISS)</a>, <a href="http://www.eurasiagroup.net/" rel="noreferrer" data-ss1478789549="1">Eurasia Group</a>, and the <a href="http://www.cfr.org/" rel="noreferrer" data-ss1478789549="1">Council on Foreign Relations (CFR)</a>.&#8221;</p>
<p>Adair said the more typical attacks from The Dukes come in the form of slightly less-targeted email blasts &#8212; often to just a few dozen recipients at a time &#8212; that include booby-trapped <strong>Microsoft Office</strong> documents.</p>
<p>When launched, the tainted <strong>Excel</strong> or <strong>Word</strong> document opens an actual file with real content, but it also prompts the target to enable &#8220;macros&#8221; &#8212; a powerful functionality built into Office documents that hackers can use to automatically download and run malicious code on a Windows system.</p>
<p>The Dukes prefer to launch the attacks using hacked servers and email inboxes belonging to unsuspecting, trusted workers at NGOs and U.S. government systems, Adair explained. Most often, he said, the intruders will repurpose a legitimate document found in one of these hacked inboxes and inject a sophisticated backdoor &#8220;trojan horse program.&#8221;</p>
<p>If the phishing target opens the document and has macros enabled in Microsoft Office &#8212; or allows macros to be run after the decoy document is shown &#8212; a malicious script embedded in the macro installs on the target&#8217;s system a powerful foothold for the attacker.<span id="more-36921"></span></p>
<p><span class="s1">Adair said The Dukes have a well-earned reputation for coding and constantly improving their own custom backdoor trojans, but that they&#8217;re not known for using so-called &#8220;zero day&#8221; threats &#8212; previously unknown security weaknesses in software and hardware that knowledgeable attackers can use to remotely compromise a target&#8217;s computer just by loading a Web page or opening a document. </span></p>
<p><span class="s1">&#8220;In some ways, these guys seem kind of low-budget, but their macros are well-obfuscated and will sail right through just about any [antivirus] tool, appliance or cloud service,&#8221; Adair said in an interview. </span></p>
<p class="p1">The Dukes also take great care not to phish security personnel at targeted organizations. For example, if the phishing target has macros enabled in Microsoft Office or allows them to be run after the decoy document is shown, a malicious script embedded in the macro executes a busy little program that scours the target&#8217;s computer for signs that it is running on an network administrator&#8217;s machine.</p>
<p class="p1">If the malicious script detects the user is &#8220;admin&#8221; or &#8220;administrator,&#8221; the infection goes no further and the malware shuts down. Likewise, it checks many other signs that it might be running in a &#8220;sandbox&#8221; environment &#8212; a test lab often used by security and malware researchers.</p>
<p class="p1">Adair said his although his research team doesn&#8217;t have specific insight into to how successful these latest espionage attacks may have been, The Dukes are an effective information- and resource gathering machine.</p>
<p class="p1">&#8220;My opinion is that if this group got access to a zero-day and it&#8217;s something they can embed in a document, they could devastate anyone they target,&#8221; Adair said. &#8220;This is a well-funded and in some respects professional organization. What they&#8217;re doing takes time and effort, and for eight plus years now they&#8217;ve been in continuous development of new backdoors. They&#8217;re continually targeting different verticals &#8212; universities, NGOs and governments &#8212; and they learn from others, retool and modify their attacks constantly.&#8221;</p>
<p>As <em>The New York Times</em> <a href="http://www.nytimes.com/2016/10/12/us/politics/obama-russia-hack-election.html" target="_blank">reported</a> last month, &#8220;President Obama is weighing a &#8216;proportional&#8217; response to Russia’s efforts to interfere with this fall’s election campaign through hacking.</p>
<p>Thursday morning, security vendor Kaspersky Lab warned that a massive cyberattack hit five of Russia&#8217;s largest banks. Kaspersky said in a statement that the distributed denial of service attacks (DDoS) began Tuesday at 1830 IST and targeted &#8220;the websites of at least five well-known financial institutions in the top 10&#8221; in Russia.</p>
<p>It remains unclear who launched the bank cyberattacks, which are <a href="https://themoscowtimes.com/news/ddos-attack-hits-russian-banks-56077" target="_blank">reportedly</a> ongoing. Kaspersky said the attack on Russia&#8217;s banking system is apparently being launched by a network of more than 24,000 hacked <a href="https://krebsonsecurity.com/tag/internet-of-things/" target="_blank">Internet of Things (IoT) devices</a>, and that more than half of the hacked things were in the United States, India, Taiwan and Israel.</p>
<p>Further reading on the storied hacking history of The Dukes:</p>
<p><strong>F-Secure</strong> calls them <a href="https://www.f-secure.com/documents/996508/1030745/CozyDuke" target="_blank">CozyDuke</a> (PDF).  <strong>FireEye</strong>&#8216;s <a href="media/21d405a4.rpt-apt29-hammertoss.pdf" data-original-source="https://www2.fireeye.com/rs/848-DID-242/images/rpt-apt29-hammertoss.pdf" target="_blank">take</a> (PDF). <strong>Crowdstrike</strong> on <a href="https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/" target="_blank">Cozy Bear</a>.</p>


feed_id: https://krebsonsecurity.com/?p=36939
title: Chinese IoT Firm Siphoned Text Messages, Call Records
uri: Chinese-IoT-Firm-Siphoned-Text-Messages-Call-Records
url: https://krebsonsecurity.com/2016/11/chinese-iot-firm-siphoned-text-messages-call-records/
content:
<p>A Chinese technology firm has been siphoning text messages and call records from cheap Android-based mobile smart phones and secretly sending the data to servers in China, researchers revealed this week. The revelations came the same day the <strong>White House</strong> and the <strong>U.S. Department of Homeland Security</strong> issued sweeping guidelines aimed at building security into Internet-connected devices, and just hours before a key congressional panel sought recommendations from industry in regulating basic security standards for so-called &#8220;Internet of Things&#8221; (IoT) devices.</p>
<p>At the center of the spyware controversy is software made by<strong> Shanghai ADUPS Technology</strong>, a Chinese firm whose product touts the ability to wirelessly update software installed on mobile and and IoT devices. The ADUPS technology is typically bundled with smart phones made by dozens of global wireless firms including <strong>ZTE</strong>, <strong>BLU</strong> and <strong>Huawei</strong>, and sold at popular consumer destinations like <strong>Amazon</strong> and <strong>BestBuy</strong>. Often retailing for between $50 and $100, the sleek and powerful devices sell so cheaply because they also require the user to accept on-screen advertisements.</p>
<div id="attachment_36943" style="width: 590px" class="wp-caption aligncenter"><a class="lightbox" href="media/2a6cb28a.adups-iot.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/11/adups-iot.png"><img class="wp-image-36943 size-medium" src="media/9c6c981a.adups-iot-580x370.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/11/adups-iot-580x370.png" alt="An About Us page at ADUPS's Web site explains the company's foothold in the IoT market." width="580" height="370" srcset="http://krebsonsecurity.com/wp-content/uploads/2016/11/adups-iot-580x370.png 580w, http://krebsonsecurity.com/wp-content/uploads/2016/11/adups-iot-768x490.png 768w, http://krebsonsecurity.com/wp-content/uploads/2016/11/adups-iot-940x599.png 940w" sizes="(max-width: 580px) 100vw, 580px" /></a><p class="wp-caption-text">An About Us page at ADUPS&#8217;s Web site explains the company&#8217;s foothold in the IoT market.</p></div>
<p>According to <a href="http://www.kryptowire.com/adups_security_analysis.html" target="_blank">research released this week</a>, the low up-front cost of these smart phones may be subsidized not just by ads but by also by the theft of private information stolen from users. Researchers at Fairfax, Va.-based security firm <strong>Kryptowire </strong>say the ADUPS software gives the company near-total control over the devices that it runs on, and that they have proof ADUPS has abused that control to siphon personal data from countless consumers.</p>
<p><strong>Kryptowire</strong> researchers say they stumbled upon ADUPS&#8217;s spyware capabilities by accident after purchasing <a href="https://www.amazon.com/BLU-R1-HD-Exclusive-Lockscreen/dp/B01F9N5QXI" target="_blank">a $59 BLU R1 HD smart phone</a> from Amazon.com for use during international travel. Prying apart the phone and the ADUPS software, they discovered that all call records and text messages to and from the device were being digitally copied, encrypted and secretly forwarded to a server in Shanghai, China every 72 hours.</p>
<p>They also learned that ADUPS&#8217;s product was able to mine user text messages for specific strings of text, as well as install and remove any software from host devices.</p>
<p>&#8220;This behavior cannot be detected by mobile anti-virus tools because they assume that software that ships with the device is not malware and that it is white-listed,&#8221; Kryptowire wrote in an advisory published Tuesday. &#8220;We were able to capture, decrypt, and trace the data on the network as they were sent to multiple server locations that are located in Shanghai, China.&#8221;</p>
<p>In <a href="http://www.adups.com/article/show_article.php?id=162" target="_blank">a statement</a> posted to its Web site, ADUPS said it collects &#8220;model information, device status, application information, bin/xbin information and summary information from phones and messages,&#8221; and that it has done so &#8220;in response to user demand to screen out junk texts and calls from advertisers.&#8221;</p>
<p>ADUPS further claims that the functionality was added in June 2016 to some <strong>Blu Product Inc.</strong> devices, and that it has since shipped an update through its firmware updating software to disable the spying functionality on Blu phones.</p>
<p>But<strong> Azzedine Benameur</strong>, director of research at Kryptowire, said ADUPS&#8217;s software &#8212; deeply embedded alongside the operating system on these mobile devices &#8212; gives it full ability to re-enable the spyware capabilities at any time. He says ADUPS&#8217;s public response to their research raises more questions than it answers.</p>
<p>&#8220;They do not provide how many devices were affected and how the data were used,&#8221; Benameur said. &#8220;Also, they don&#8217;t mention who had access to that data, including third parties and the Chinese government. Also, there might be other [manufacturers] and device models affected that ADUPS does not mention.&#8221;</p>
<p>ADUPS claims on its Web site to have worldwide presence with more than<em> 700 million active users, and that its firmware is integrated into &#8220;more than 400 leading mobile operators, semiconductor vendors and device manufacturers spanning from wearable and mobile devices to cars and televisions.&#8221;</em></p>
<p>&#8220;This is just one random device of theirs that we looked at,&#8221; Benameur said. &#8220;For a company that claims to provide over-the-air updates for 700 million devices, including cars and millions of IoT devices&#8230;this is really scary and unacceptable behavior.&#8221;</p>
<div id="attachment_36944" style="width: 590px" class="wp-caption aligncenter"><a class="lightbox" href="media/3347f90c.adupsad2015.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/11/adupsad2015.png"><img class="wp-image-36944 size-medium" src="media/1aa0b051.adupsad2015-580x170.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/11/adupsad2015-580x170.png" alt="ADUPS's offer to business partners, January 2015." width="580" height="170" srcset="http://krebsonsecurity.com/wp-content/uploads/2016/11/adupsad2015-580x170.png 580w, http://krebsonsecurity.com/wp-content/uploads/2016/11/adupsad2015-768x225.png 768w, http://krebsonsecurity.com/wp-content/uploads/2016/11/adupsad2015-940x275.png 940w, http://krebsonsecurity.com/wp-content/uploads/2016/11/adupsad2015.png 1393w" sizes="(max-width: 580px) 100vw, 580px" /></a><p class="wp-caption-text">ADUPS&#8217;s offer to business partners, circa January 2015.</p></div>
<p>ADUPS&#8217;s current site promises the company&#8217;s partners &#8220;big data analytics&#8221; and higher profit for partners. Earlier versions of the same page from 2015 and cached at the Internet Archive promise partners a slightly less euphemistic menu of services, from an &#8220;app push service,&#8221; and &#8220;device data mining&#8221; to &#8220;unique package checking&#8221; and &#8220;mobile advertising.&#8221; Interestingly,<a href="http://www.xda-developers.com/micromax-remotely-installing-unwanted-apps-on-devices/" target="_blank"> this story</a> from January 2015 documents how ADUPS&#8217;s software has been used to install unwanted apps on customer mobile devices.</p>
<p>As for the Blu R1 HD phone? Benameur said it would be nice if it came with a disclosure that owners can expect zero privacy or control while using it. Aside from that? &#8220;At $59, it&#8217;s a steal,&#8221; Benameur said. &#8220;Minus the spyware, it&#8217;s a great phone.&#8221;<span id="more-36939"></span></p>
<h4>NEW IOT REGULATIONS?</h4>
<p>The ADUPS scandal, first reported by <a href="http://www.nytimes.com/2016/11/16/us/politics/china-phones-software-security.html?emc=edit_th_20161116&amp;nl=todaysheadlines&amp;nlid=66044131" target="_blank">The New York Times</a>, comes as U.S. lawmakers are under increasing pressure to legislate basic software security standards for Internet-connected devices. Many low-cost IoT devices &#8212; from consumer routers to security cameras and digital video recorders (DVRs) &#8212; ship with little to no security built in. This has left millions of consumer devices ripe for exploitation by malicious hackers who enslave the devices in powerful cyber attacks designed to knock Web sites offline and otherwise disrupt Internet services.</p>
<p>Two of those attacks &#8212; an <a href="https://krebsonsecurity.com/2016/10/hacked-cameras-dvrs-powered-todays-massive-internet-outage/" target="_blank">hours-long digital siege in October against Internet infrastructure provider <strong>Dyn</strong></a>, and a September attack that <a href="https://krebsonsecurity.com/2016/09/krebsonsecurity-hit-with-record-ddos/" target="_blank">crippled <strong>KrebsOnSecurity</strong> for days</a> &#8212; harnessed the computing power and network bandwidth of hundreds of thousands of Internet-based cameras and DVRs that were secured with <a href="https://krebsonsecurity.com/2016/10/who-makes-the-iot-things-under-attack/" target="_blank">the same default password and configured to be remotely controllable over the Web</a>. A Chinese manufacturing firm whose electronics featured prominently in many of the IoT devices used in those attacks recently said it was <a href="https://krebsonsecurity.com/2016/10/iot-device-maker-vows-product-recall-legal-action-against-western-accusers/" target="_blank">issuing a recall for millions of the vulnerable devices</a> &#8212; which were shipped with user credentials that were hard-coded into the devices and that could not be easily changed by users.</p>
<p>Both the attack on Dyn and against this site were referenced on multiple occasions today by lawmakers and witnesses to a <strong>U.S. House Energy &amp; Commerce Committee</strong> hearing titled &#8220;<a href="https://energycommerce.house.gov/hearings-and-votes/hearings/understanding-role-connected-devices-recent-cyber-attacks" target="_blank">Understanding the Role of Connected Devices in Recent Cyber Attacks</a>.&#8221;</p>
<p><strong>Bruce Schneier</strong>, a security expert who has long advocated holding software vendors legally liable for producing fundamentally flawed and/or insecure products, said the IoT attacks and this latest scandal with ADUPS are examples of a market failure that is crying out for government regulation.</p>
<p>&#8220;In many ways, the Dyn attack was benign,&#8221; Schneier said in <a href="media/5757e3c7.HHRG-114-IF17-Wstate-SchneierB-20161116.pdf" data-original-source="http://docs.house.gov/meetings/IF/IF17/20161116/105418/HHRG-114-IF17-Wstate-SchneierB-20161116.pdf" target="_blank">his written testimony</a>. &#8220;Some websites went offline for a while. No one was killed. No property was destroyed. But computers have permeated our lives. The Internet now affects the world in a direct physical manner. The Internet of Things is bringing computerization and connectivity to many tens of millions of devices worldwide. We are connecting cars, drones, medical devices, and home thermostats. What was once benign is now dangerous.&#8221;</p>
<p>Schneier encouraged lawmakers to think about commercial software and hardware that gets shipped with junk security as a form of pollution: But instead of pumping liquid toxic waste into thinly-lined man-made cesspools, many makers of low-end electronics are churning out default-insecure products that will likely remain in operation &#8212; and therefore a public nuisance &#8212; for many years to come.</p>
<p>&#8220;We’re asking consumers to shore up lousy products,&#8221; Schneier told the committee. &#8220;It shouldn’t be that there are default passwords. These devices are low profit margin, they’re made offshore. And the buyer and seller don’t care. I might own this DVR, you might own it. You don’t know if it’s secure or not. You can’t test it. And you fundamentally don’t care. You bought it for the features and the price.&#8221;</p>
<p><strong>Rep. Anna Eshoo</strong> (D-Calif.) called attention to a bill she&#8217;s offered &#8212; the <a href="http://www.nextgov.com/security/2015/10/california-congresswoman-introduces-better-cyber-hygiene-bill/122502/" target="_blank">Promoting Good Cyber Hygiene Act of 2015</a> &#8212; that calls on government regulators to develop best practices aimed at boosting public and private sector network security. As noted above, the <a href="media/83b27b5d.NIST.SP.800-160.pdf" data-original-source="http://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-160.pdf" target="_blank">White House</a> and the <a href="media/efea726f.iples_for_Securing_the_Internet_of_Things-2016-1115-FINAL....pdf" data-original-source="https://www.dhs.gov/sites/default/files/publications/Strategic_Principles_for_Securing_the_Internet_of_Things-2016-1115-FINAL....pdf" target="_blank">Department of Homeland Security</a> both did just that on Tuesday, each <a href="https://morningconsult.com/2016/11/15/white-house-issues-guidelines-iot-cybersecurity/" target="_blank">issuing guidelines on cybersecurity for IoT devices</a>.</p>
<p>&#8220;We need a good housekeeping seal of approval on this, and my bill called for NIST [the <strong>National Institute of Standards and Technology</strong>] to set the standards &#8212; not Congress &#8212; because we really don’t know anything about that, and when we miss the mark we miss it by a wide mile,&#8221; Eshoo said.</p>
<p>Indeed, some experts have advocated creating a sort of government-approved <a href="https://en.wikipedia.org/wiki/UL_(safety_organization)" target="_blank">Underwriters Laboratories</a> <a href="http://www.computerworld.com/article/3051147/internet-of-things/ul-takes-on-cybersecurity-testing-and-certification.html" target="_blank">for cybersecurity</a> that would perhaps imprint its seal of approval on certified IoT devices. But Schneier said most consumers are unlikely to be moved by &#8220;a sticker that says this device costs $20 more and is 30 percent less likely to annoy people you don&#8217;t know.&#8221;</p>
<p>Instead, he suggested Congress should create a new federal agency to regulate basic secure design standards for IoT devices. &#8220;A U.S.-only regulatory system will affect the products in the rest of the world because this is software,&#8221; Schneier said. &#8220;Companies will make one software and sell it everywhere. It makes no sense for anyone to come up with two versions of their software.&#8221;</p>
<div id="attachment_36951" style="width: 323px" class="wp-caption alignright"><img class=" wp-image-36951" src="media/b0a910e5.schneierfu-580x421.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/11/schneierfu-580x421.png" alt="Bruce Schneier, left, and Kevin Fu." width="313" height="227" srcset="http://krebsonsecurity.com/wp-content/uploads/2016/11/schneierfu-580x421.png 580w, http://krebsonsecurity.com/wp-content/uploads/2016/11/schneierfu.png 720w" sizes="(max-width: 313px) 100vw, 313px" /><p class="wp-caption-text">Bruce Schneier, left, and Kevin Fu.</p></div>
<p>Rep. Eshoo called the prospect of creating new bureaucracy in a Republican controlled Congress and White House an idea that was &#8220;dead in the water.&#8221;</p>
<p>&#8220;We have a continuing new, new majority and I don&#8217;t think they want to create a new agency,&#8221; Eshoo said. &#8220;They don&#8217;t like stuff like that. New agencies, new regulations, we&#8217;re dead in the water. But we can&#8217;t leave this issue dead in the water. Our country deserves better.&#8221;</p>
<p>If this Congress or the next is reluctant to mandate basic cybersecurity standards for IoT devices, they may soon find themselves forced to legislate in a hurry when people start dying because of IoT insecurity, Schneier said.</p>
<p>&#8220;The government is getting involved here regardless,&#8221; he said. &#8220;The risks are too great and stakes are too high, and nothing motivates government into action [more] than security and fear. In 2001, we had another small-government, no-regulation administration produce a new federal agency 44 days after the terrorist attacks. If something similar happens with the Internet of Things, we’re going to have a similar response. I see the choice here not between government involvement and no government involvement, but between smart government and stupid government. This is the world of dangerous things, and we regulate dangerous things.&#8221;</p>
<p>Emphasizing that point,<strong> Kevin Fu</strong>, chief executive at healthcare security provider <a href="https://www.virtalabs.com/" target="_blank">Virta Laboratories</a>, told the panel that healthcare and medical device community dodged a bullet on the Dyn attack.</p>
<p>&#8220;Hospitals survived not by design, but by luck. The adversary did not target healthcare. This time,&#8221; Fu said in his <a href="media/4f2e647d.HHRG-114-IF17-Wstate-FuK-20161116.pdf" data-original-source="http://docs.house.gov/meetings/IF/IF17/20161116/105418/HHRG-114-IF17-Wstate-FuK-20161116.pdf" target="_blank">written testimony</a> (PDF). &#8220;Dyn represents a single point of failure for resolving Internet names, but hospitals have other kinds of single points of failure. For instance, heating and ventilation now resembles IoT with unpatched computers controlling negative pressure in units with highly infectious diseases.&#8221;</p>
<p>Such attacks, he said, have very quickly moved from the theoretical to real life. Earlier this month, a denial-of-service attack like the one that knocked my site and Dyn offline was <a href="http://metropolitan.fi/entry/ddos-attack-halts-heating-in-finland-amidst-winter" target="_blank">reportedly used to shut off environmental controls at two apartment buildings in Finland</a>, temporarily leaving residents there without heat or hot water for several days. Also this month, a hospital in the United Kingdom was forced to cancel surgeries and divert trauma patients to nearby hospitals after <a href="https://krebsonsecurity.com/2016/11/computer-virus-cripples-uk-hospital-system/" target="_blank">a cyberattack shut down its internal systems</a>.</p>
<p>Fu urged Congress to study the feasibility of standing up an independent, national embedded cybersecurity testing facility modeled after the automotive crash testing conducted by the <a href="http://www.ntsb.gov/Pages/default.aspx" target="_blank">National Transportation Safety Board</a> (NTSB). Such a center, he posited, could serve as a security test-bed for everything from consumer IoT devices to far more sensitive medical equipment and embedded health and safety devices, more of which are being connected to the Internet each day.</p>
<p>&#8220;The Mayo Clinic reportedly spends roughly $300K per medical device to perform security assessment, and they have thousands of models of devices,&#8221; Fu explained. &#8220;It makes little economic sense to have individual hospitals testing the security of devices that ought to remain secure for all 6,000 hospitals in the USA. Cybersecurity ought to be a public good much like automobile safety. Imagine if every car dealer were individually responsible for crash testing automobiles: costs would skyrocket and the public would have little confidence. A facility for embedded cybersecurity at the scale of a hospital could provide testing to both government and industry, while allowing students to conduct innovative research during surplus time.&#8221;</p>
<p>Fu also suggested that the government could do a much better job working with industry partners to encourage more people to pursue careers in cybersecurity.</p>
<p>&#8220;There are tens of thousands of unfilled cybersecurity jobs in the USA,&#8221; Fu said. &#8220;Existing approaches aren&#8217;t insufficient to train a large enough work force to counter growing cybersecurity threats against IoT devices, our economy, and infrastructure.&#8221;</p>
<p>Whether or not Congress tries to improve IoT security, miscreants who leverage poor IoT security for criminal purposes will continue their search for additional systems that can be rented out in denial-of-service attacks or used in high-stakes digital shakedowns for money, said <strong>Dale Drew</strong>, chief security officer at <strong>Level 3 Communications</strong>.</p>
<p>&#8220;Bad actors are increasingly attracted to IoT devices since they can use those devices without being detected for long periods of time, they know most devices will not be monitored or updated, and they know there are no endpoint protection capabilities on IoT devices that can detect and remove the threats,&#8221; Drew said.  &#8220;Network operators, device manufacturers and users will need to remain vigilant to the security risks these devices present.&#8221;</p>


feed_id: https://krebsonsecurity.com/?p=36961
title: Adobe Fined $1M in Multistate Suit Over 2013 Breach; No Jail for Spamhaus Attacker
uri: Adobe-Fined-1M-in-Multistate-Suit-Over-2013-Breach-No-Jail-for-Spamh
url:
https://krebsonsecurity.com/2016/11/adobe-fined-1m-in-multistate-suit-over-2013-breach-no-jail-for-spamhaus-attacker/

content:
<p><strong>Adobe</strong> will pay just $1 million to settle a lawsuit filed by 15 state attorneys general over its huge 2013 data breach that exposed payment records on approximately 38 million people. In other news, the 39-year-old Dutchman responsible for coordinating an epic, weeks-long <a href="http://searchsecurity.techtarget.com/definition/distributed-denial-of-service-attack" target="_blank">distributed denial-of-service attack</a> against anti-spam provider <strong>Spamhaus</strong> in 2013 will avoid any jail time for his crimes thanks to a court ruling in Amsterdam this week.</p>
<p>On Oct. 3, 2013, KrebsOnSecurity <a href="https://krebsonsecurity.com/2013/10/adobe-to-announce-source-code-customer-data-breach/" target="_blank">broke the story</a> that Adobe had just suffered a breach in which hackers siphoned usernames, passwords and payment card data on 38 million customers. The intruders also made off with digital truckloads of source code for some of Adobe&#8217;s most valuable software properties &#8212; including <strong>Adobe Acrobat</strong> and <strong>Reader</strong>, <strong>Photoshop</strong> and <strong>ColdFusion</strong>.</p>
<p>On Monday, Nov. 11, <strong>North Carolina Attorney General  Roy Cooper</strong> joined his counterparts in 14 other states in <a href="http://www.ncdoj.gov/News-and-Alerts/News-Releases-and-Advisories/Press-Releases/Adobe-to-pay-$1-million-for-data-breach,-bolster-s.aspx" target="_blank">announcing</a> a $1 million settlement with Adobe over the 2013 breach. According to Cooper, the hacked Adobe servers contained the personal information of approximately 552,000 residents of the participating 15 states. That works out to about $1.80 per victim across all 15 states.</p>
<div id="attachment_23214" style="width: 610px" class="wp-caption aligncenter"><a class="lightbox" href="media/4c96e7e8.anonnews153kk.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2013/10/anonnews153kk.png"><img class="wp-image-23214 size-large" src="media/aeb02a4a.anonnews153kk-600x293.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2013/10/anonnews153kk-600x293.png" alt="A posting on anonnews.org that was later deleted." width="600" height="293" srcset="http://krebsonsecurity.com/wp-content/uploads/2013/10/anonnews153kk-285x139.png 285w, http://krebsonsecurity.com/wp-content/uploads/2013/10/anonnews153kk-600x293.png 600w, http://krebsonsecurity.com/wp-content/uploads/2013/10/anonnews153kk.png 1083w" sizes="(max-width: 600px) 100vw, 600px" /></a><p class="wp-caption-text">A posting on anonnews.org that was later deleted.</p></div>
<p>According to <a href="http://www.mass.gov/ago/news-and-updates/press-releases/2016/adobe-to-pay-1-million-update-security.html" target="_blank">a statement</a> by <strong>Massachusetts Attorney General Maura Healey</strong>, &#8220;an investigation by the states revealed that in September 2013, Adobe received an alert that the hard drive for one of its application servers was nearing capacity. In responding to the alert, Adobe learned that an unauthorized attempt was being made to decrypt customer payment card numbers maintained on the server.&#8221;</p>
<p>&#8220;Adobe discovered that one or more unauthorized intruder(s) had compromised a public-facing web server and used it to access other servers on Adobe’s network, including areas where Adobe stored consumer data,&#8221; the statement from Healey&#8217;s office reads. &#8220;The intruder(s) ultimately stole consumer data from Adobe’s servers, including encrypted payment card numbers and expiration dates, names, addresses, telephone numbers, e-mail addresses, usernames (Adobe IDs), and passwords associated with the usernames.&#8221;</p>
<p>When I think of the Adobe breach I&#8217;m reminded of that scene out of the 1982 Spielberg horror classic &#8220;<a href="https://www.youtube.com/watch?v=FZY2e2aHpNI" target="_blank">Poltergeist</a>,&#8221; when <a href="http://www.imdb.com/name/nm0005266/?ref_=tt_ov_st_sm" target="_blank">Craig T. Nelson</a> as &#8220;<a href="http://www.imdb.com/character/ch0010400/?ref_=ttfc_fc_cl_t1" target="_blank">Steve Freeling</a>&#8221; seizes the horrified neighborhood developer <a href="http://www.imdb.com/character/ch0175558/quotes" target="_blank">Mr. Teague</a> by his coat collars and <a href="https://www.youtube.com/watch?v=Lh_W6FLaMvA" target="_blank">screams</a>, &#8220;You son of a bitch! You moved the cemetery but you left the bodies, didn&#8217;t ya?! You left left the bodies and you only moved the headstones!! Why?!?!?! Whyyyyyyeeeiee??!?!?&#8221;</p>
<div id="attachment_36975" style="width: 590px" class="wp-caption aligncenter"><img class="size-medium wp-image-36975" src="media/57aa91c2.teague-imdb-580x406.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/11/teague-imdb-580x406.png" alt="A scene from Poltergeist. Image: IMDB." width="580" height="406" srcset="http://krebsonsecurity.com/wp-content/uploads/2016/11/teague-imdb-580x406.png 580w, http://krebsonsecurity.com/wp-content/uploads/2016/11/teague-imdb.png 631w" sizes="(max-width: 580px) 100vw, 580px" /><p class="wp-caption-text">A scene from Poltergeist. Image: IMDB.</p></div>
<p>Likewise, Adobe had various storefronts for its various software products, but it eventually began to centralized many store operations. The main trouble was the company left copies of their customer records in multiple internal network locations that were no longer as protected as Adobe&#8217;s globally centralized storefront.</p>
<p>North Carolina&#8217;s Cooper said in <a href="http://www.ncdoj.gov/News-and-Alerts/News-Releases-and-Advisories/Press-Releases/Adobe-to-pay-$1-million-for-data-breach,-bolster-s.aspx" target="_blank">a statement</a> on the settlement that businesses and government must do more to protect consumer data. But if this settlement was meant as a deterrent to dissuade other companies from hosting customer payment data on public-facing Web servers, the fine might be more effective if it were more commensurate with the company&#8217;s size and the number of customers impacted.</p>
<p>As <a href="http://www.digitaltrends.com/computing/adobe-hack-1-million-fine/" target="_blank">Digital Trends notes</a>, such a breach under the new <a href="https://en.wikipedia.org/wiki/General_Data_Protection_Regulation" target="_blank">General Data Protection Regulation</a> going into effect in 2018, would be quite a bit more costly. &#8220;Adobe could face fines of up to four percent of its annual global turnover,&#8221; wrote <strong>Jonathan Keane</strong> for DT. &#8220;Last we checked, Adobe&#8217;s previous quarterly earnings were $1.4 billion.&#8221;</p>
<p>Keane also notes that Adobe had previously settled a similar case in California where it settled for an undisclosed amount and $1.1 million in legal fees.</p>
<p>One interesting nugget tucked in at the end of <a href="http://www.ncdoj.gov/News-and-Alerts/News-Releases-and-Advisories/Press-Releases/Adobe-to-pay-$1-million-for-data-breach,-bolster-s.aspx" target="_blank">the statement</a> from the North Carolina AG&#8217;s office is this bit: More than 3,700 breaches impacting nearly 10 million North Carolinians have been reported since the state&#8217;s data breach notification law took effect in 2005, including 677 breaches reported so far in 2016. According to the <a href="http://www.census.gov/quickfacts/table/PST045215/37" target="_blank">United States Census Bureau</a>, there were just over 10 million residents in North Carolina as of July 2015.<span id="more-36961"></span></p>
<p>That means just about everyone in North Carolina was impacted by at least one data breach over the past 12 years. I&#8217;d wager this is true for just about every state in the Union, and probably many times over for some. A handful of lucky states have had single breaches that affected all citizens at once.</p>
<p>In 2012, a phishing attack against an employee of the South Carolina Department of Revenue allowed intruders to make off with Social Security numbers and other personal data on 3.8 million electronic tax filers, as well as 1.9 million of their dependents. Also in that breach, <a href="https://www.scmagazine.com/sc-tax-breach-began-when-employee-fell-for-spear-phish/article/543230/" target="_blank">nearly 700,000 businesses, 3.3 million bank accounts and 5,000 expired credit cards were compromised</a>. As of July 2015, South Carolina had fewer than five million residents, according to the Census Bureau.</p>
<h4>SVEN OLAF KAMPHUIS &#8212; A.K.A. &#8220;Prince of Cyberbunker Republic&#8221;</h4>
<p>In March 2013, a coalition of spammers and spam-friendly hosting firms pooled their resources to launch what would become the largest <a href="https://en.wikipedia.org/wiki/Denial-of-service_attack" target="_blank">distributed denial-of-service (DDoS) attack</a> the Internet had ever witnessed. The assault briefly knocked offline the world’s largest anti-spam organization, and caused a great deal of collateral damage to innocent bystanders in the process. Here’s a never-before-seen look at how that attack unfolded, and a rare glimpse into the shadowy cybercrime forces that orchestrated it.</p>
<p>That paragraph above was the lead for a story I published in August 2016, &#8220;<a href="https://krebsonsecurity.com/2016/08/inside-the-attack-that-almost-broke-the-internet/" target="_blank">Inside the Attack that Almost Broke the Internet</a>&#8220;. It&#8217;s starring member was a colorful Dutchman named <strong>Sven Olaf Kamphuis</strong> who ran a technology services company called <strong>CB3ROB</strong>. This CB3ROB in turn provided services for a Dutch company called “<a href="https://en.wikipedia.org/wiki/CyberBunker" target="_blank">Cyberbunker</a>,” so named because the organization was allegedly housed in a five-story NATO bunker and because it had advertised its services as a <a href="https://krebsonsecurity.com/?s=bulletproof+hosting+provider&amp;x=0&amp;y=0" target="_blank">bulletproof hosting provider</a>.</p>
<div id="attachment_36973" style="width: 590px" class="wp-caption aligncenter"><a class="lightbox" href="media/1636de51.svenplot.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/11/svenplot.png"><img class="wp-image-36973 size-medium" src="media/faeadee0.svenplot-580x790.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/11/svenplot-580x790.png" alt="A snippet from a very long chat log published here detailing the extended DDoS campaigns waged against Spamhaus." width="580" height="790" srcset="http://krebsonsecurity.com/wp-content/uploads/2016/11/svenplot-580x790.png 580w, http://krebsonsecurity.com/wp-content/uploads/2016/11/svenplot.png 622w" sizes="(max-width: 580px) 100vw, 580px" /></a><p class="wp-caption-text">A snippet from a very long chat log published here detailing the extended DDoS campaigns waged against Spamhaus.</p></div>
<p>Kamphuis seemed to honestly believe his Cyberbunker was sovereign territory, even signing his emails “Prince of Cyberbunker Republic.” <a href="https://krebsonsecurity.com/2013/04/dutchman-arrested-in-spamhaus-ddos/" target="_blank">Arrested in Spain in April 2013</a> in connection with the attack on Spamhaus, Kamphuis was later extradited to The Netherlands to stand trial. He has publicly denied being part of the attacks, but the chat logs with him coordinating the attack with co-conspirators are fairly damning considering he didn&#8217;t even use an alias in the discussions and live-posted his campaign of terror to his Facebook account.</p>
<p>Nevertheless, a judge in Amsterdam this week <a href="http://securityaffairs.co/wordpress/53473/cyber-crime/spamhaus-attack.html" target="_blank">sentenced</a> Kamphuis to a total of 240 days in jail. However, the judge also counted the 55 days Kamphuis spent awaiting extradition from Spain, and suspended the remaining 185-day sentence. No jail time for Kamphuis.</p>
<p>Spamhaus founder <strong>Steve Linford</strong> said the organization was disappointed in the sentence, and it warned Kamphuis about any thoughts of retaliation.</p>
<p>&#8220;We had hoped for a longer jail sentence to send the message that organising and conducting DDoS attacks is a crime not acceptable to law courts or society, however the ease with which Kamphuis was arrested and extradited, and the two months already served in jail will hopefully have delivered the message to him that there is no escape from the law should he attempt any attacks in the future,&#8221; Linford wrote in a email. &#8220;Since the remainder of the term is a suspended sentence, any actions or threats made to Spamhaus during the term would be filed with the court as a violation of the conditions of the suspended sentence.&#8221;</p>
<div id="attachment_20102" style="width: 610px" class="wp-caption aligncenter"><img class="size-large wp-image-20102" src="media/06b6d4b1.cyberbunkerfb-600x391.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2013/04/cyberbunkerfb-600x391.png" alt="Facebook profile picture of Sven Olaf Kamphuis" width="600" height="391" srcset="http://krebsonsecurity.com/wp-content/uploads/2013/04/cyberbunkerfb-600x391.png 600w, http://krebsonsecurity.com/wp-content/uploads/2013/04/cyberbunkerfb.png 774w" sizes="(max-width: 600px) 100vw, 600px" /><p class="wp-caption-text">Facebook profile picture of Sven Olaf Kamphuis</p></div>
<p>The only other person charged in connection with the largest attack the Internet had ever seen at the time was <strong>Sean Nolan McDonough</strong>, a.k.a. &#8220;narko&#8221; in the <a href="https://krebsonsecurity.com/2016/08/inside-the-attack-that-almost-broke-the-internet/" target="_blank">chat logs</a> referenced in the snippet pictured above.</p>
<p>Narko was a juvenile when he was arrested by the <strong>U.K.’s National Crime Agency</strong> (NCA); when the NCA raided Narko’s home, they found his computer still logged in to crime forums, and they seized £70,000 from his bank account (believed to be payments for DDoS attacks). Narko later <a href="http://krebsonsecurity.com/2014/12/spamhaus-cloudflare-attacker-pleads-guilty-to-computer-abuse-child-porn-charges/" target="_blank">pleaded guilty to coordinating the attacks</a> and was sentenced to 240 hours of community service, but because of his age and in return for cooperating with the NCA he avoided a jail term.</p>
<p>This sentence sends the wrong message and misses the mark by a mile. The message we as a society of Internet users continue to send by our unwillingness to punish people for these crimes is, &#8220;Hey, if you&#8217;re involved in heavily disrupting networks and commerce through botnet attacks, you don&#8217;t have to worry because you&#8217;ll either never be prosecuted&#8230;or if you are the sentence will be community service or nothing.&#8221;</p>
<p>Neither of <a href="https://krebsonsecurity.com/2016/09/alleged-vdos-proprietors-arrested-in-israel/" target="_blank">the two 18-year-old Israeli men arrested in September</a> for their role in selling the massively profitable <a href="http://krebsonsecurity.com/2016/09/israeli-online-attack-service-vdos-earned-600000-in-two-years/" target="_blank">vDOS attack-for-hire service</a> to knock Web sites offline have been indicted by the Israeli, British or American governments. The hammer has yet to fall on those responsible for lobbing <a href="https://krebsonsecurity.com/2016/09/krebsonsecurity-hit-with-record-ddos/" target="_blank">the record 620 Gpbs attack on my site</a>, or the individual(s) involved in the attack on <a href="https://krebsonsecurity.com/2016/10/ddos-on-dyn-impacts-twitter-spotify-reddit/" target="_blank">Dyn</a> that disrupted service for some of the Web&#8217;s top destinations. I&#8217;m afraid the wheels of justice still creak forward far too slowly in Internet time for the threat of prosecution to be much of an immediate deterrent against online hooliganism in the here-and-now.</p>


feed_id: https://krebsonsecurity.com/?p=37020
title: DoD Opens .Mil to Legal Hacking, Within Limits
uri: DoD-Opens-Mil-to-Legal-Hacking-Within-Limits
url: https://krebsonsecurity.com/2016/11/dod-opens-mil-to-legal-hacking-within-limits/
content:
<p>Hackers of all stripes looking to test their mettle can now legally hone their cyber skills, tools and weaponry against any Web property operated by the <strong>U.S. Department of Defense </strong>(DoD), according to a new military-wide policy for reporting and fixing security vulnerabilities.</p>
<p><img class="alignright size-full wp-image-37026" src="media/fe5ff926.hackthearmy.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/11/hackthearmy.png" alt="hackthearmy" width="210" height="207" /></p>
<p>Security researchers are often reluctant to report programming flaws or security holes they&#8217;ve stumbled upon for fear that the vulnerable organization might instead decide to shoot the messenger and pursue hacking charges.</p>
<p>But on Nov. 21, the DoD sought to clear up any ambiguity on that front for the military&#8217;s substantial online presence, creating both a centralized place to report cybersecurity flaws across the dot-mil space as well as a legal safe harbor (and the prospect of public recognition) for researchers who abide by a few ground rules.</p>
<p>The DoD said it would &#8220;deal in good faith&#8221; with researchers &#8220;who discover, test, and submit vulnerabilities or indicators of vulnerabilities in accordance with these guidelines:</p>
<p>&#8220;Your activities are limited exclusively to –<br />
(1) Testing to detect a vulnerability or identify an indicator related to a vulnerability; or<br />
(2) Sharing with, or receiving from, DoD information about a vulnerability or an indicator related to a vulnerability.&#8221;</p>
<p>The Department of Defense also issued the following ten commandments for demonstrating compliance with its policy:</p>
<ol>
<li>You do no harm and do not exploit any vulnerability beyond the minimal amount of testing required to prove that a vulnerability exists or to identify an indicator related to a vulnerability.</li>
<li>You avoid intentionally accessing the content of any communications, data, or information transiting or stored on DoD information system(s) – except to the extent that the information is directly related to a vulnerability and the access is necessary to prove that the vulnerability exists.</li>
<li>You do not exfiltrate any data under any circumstances.</li>
<li>You do not intentionally compromise the privacy or safety of DoD personnel (e.g. civilian employees or military members), or any third parties.</li>
<li>You do not intentionally compromise the intellectual property or other commercial or financial interests of any DoD personnel or entities, or any third parties.</li>
<li>You do not publicly disclose any details of the vulnerability, indicator of vulnerability, or the content of information rendered available by a vulnerability, except upon receiving explicit written authorization from DoD.</li>
<li>You do not conduct denial of service testing.</li>
<li>You do not conduct social engineering, including spear phishing, of DoD personnel or contractors.</li>
<li>You do not submit a high-volume of low-quality reports.</li>
<li>If at any point you are uncertain whether to continue testing, please engage with our team.</li>
</ol>
<p>In return, the DoD said it commits to acknowledging receipt of a report within three business days, and that it will work to confirm the existence of the vulnerability to the researcher and keep the researcher informed of any remediation underway. There are some restrictions, however. For example, researchers who report vulnerabilities will be expected to refrain from publicly disclosing their findings unless and until the DoD provides written consent that it&#8217;s okay to do so.</p>
<p>&#8220;We want researchers to be recognized publicly for their contributions, if that is the researcher’s desire,&#8221; the DoD <a href="https://hackerone.com/deptofdefense" target="_blank">stated</a>. &#8220;We will seek to allow researchers to be publicly recognized whenever possible. However, public disclosure of vulnerabilities will only be authorized at the express written consent of DoD.&#8221;</p>
<p>The DoD said if it couldn&#8217;t immediately fix or publicly acknowledge reported vulnerabilities, it might be because doing so could have life-or-death consequences for service members.</p>
<p>&#8220;Many DoD technologies are deployed in combat zones and, to varying degrees, support ongoing military operations; the proper functioning of DoD systems and applications can have a life-or-death impact on Service members and international allies and partners of the United States,&#8221; the agency observed. &#8220;DoD must take extra care while investigating the impact of vulnerabilities and providing a fix, so we ask your patience during this period.&#8221;</p>
<h4>HACK THE ARMY</h4>
<p>The Defense Department made the announcement <a href="https://hackerone.com/blog/hackers-wanted-hack-the-army-and-pentagon" target="_blank">via Hackerone.com</a>, a company that helps organizations build and manage vulnerability reporting policies. HackerOne also helps customers build out &#8220;bug bounty&#8221; programs that remunerate and recognize researchers who report security flaws.</p>
<p>HackerOne currently is coordinating an upcoming bug bounty program called &#8220;<a href="https://hackerone.com/hackthearmy" target="_blank">Hack the Army</a>,&#8221; in which some 500 qualifying contestants can earn cash rewards for finding and reporting cybersecurity weaknesses in the Army&#8217;s various online properties (incidentally, Hack the Army runs from Nov. 30 through Dec. 21, 2016, and interested/eligible hackers have until Nov. 28, at 17:00 EST to <a href="https://hackerone.com/hackthearmy" target="_blank">apply for a shot</a> at one of those 500 spots).<span id="more-37020"></span></p>
<p><strong>Alex Rice</strong>, HackerOne&#8217;s co-founder and chief technology officer, said most organizations don&#8217;t have an official policy about how they will respond to reports about cybersecurity weaknesses and liabilities, and that the absence of such a policy often discourages researchers from reporting serious security holes.</p>
<p>&#8220;The default is terribly unfriendly to researchers,&#8221; Rice said. &#8220;<a href="https://en.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act" target="_blank">The Computer Fraud and Abuse Act</a> (CFAA) allows almost any company to go after researchers as hackers, and this happened far too many times. What this does is carve out a safe harbor from the CFAA, and begin to create a safe place that is really powerful and important.&#8221;</p>
<p>Rice said HackerOne last year <a href="https://hackerone.com/blog/vulnerability-disclosure-assistance" target="_blank">took an inventory of vulnerability disclosure policies</a> at the <strong>Global</strong> <strong>Forbes 2000</strong> list of companies, and found that only six percent of them had published guidelines.</p>
<p>&#8220;You cannot run an effective public vulnerability disclosure program or a bug bounty program without having competent security professionals internally,&#8221; Rice said. &#8220;The problem is, the vast majority of organizations don&#8217;t have that.&#8221;</p>
<div id="attachment_37033" style="width: 590px" class="wp-caption aligncenter"><img class="size-medium wp-image-37033" src="media/1bb38960.hackerone-580x64.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/11/hackerone-580x64.png" alt="Image: Hackerone." width="580" height="64" srcset="http://krebsonsecurity.com/wp-content/uploads/2016/11/hackerone-580x64.png 580w, http://krebsonsecurity.com/wp-content/uploads/2016/11/hackerone-768x85.png 768w, http://krebsonsecurity.com/wp-content/uploads/2016/11/hackerone-940x103.png 940w, http://krebsonsecurity.com/wp-content/uploads/2016/11/hackerone.png 1063w" sizes="(max-width: 580px) 100vw, 580px" /><p class="wp-caption-text">Image: Hackerone.</p></div>
<p>And when you start asking people to find and report gaps in your cybersecurity armor, you&#8217;d better be ready for them to do just that, said <strong>Jeremiah Grossman</strong>, chief security of strategy at anti-malware firm <a href="http://www.sentinelone.com" target="_blank">SentinelOne</a>.</p>
<p>&#8220;I’ve seen people try to launch these vulnerability disclosure programs and then fail spectacularly because they don&#8217;t have the resources to handle the response,&#8221; said Grossman, who also serves on the advisory board for <a href="http://www.bugcrowd.com" target="_blank">Bugcrowd </a>&#8212; one of HackerOne&#8217;s competitors. &#8220;When you’re really mature in security, and not before then, is about the right time for a bug bounty program. If the organization can handle one to five vulnerabilities reported each month and can fix each of those in a few days, then they&#8217;re probably ready.&#8221;</p>
<p>Rice said one reason he&#8217;s so excited about bug bounty programs is that they offer would-be security professionals a way to demonstrate their skills in a safe and controlled environment.</p>
<p>&#8220;If you&#8217;re a security professional looking to challenge yourself and you skills, there are very few real world opportunities to do that, to test your mettle and improve,&#8221; Rice said. &#8220;But that real-world experience is so unbelievably critical in this industry, and we need to be creating more opportunities for people to improve that. The more we can do that and share what we learn out of it, the more we can raise the talent and education of security professionals worldwide.&#8221;</p>
<p>Hardly a week goes by when I don&#8217;t hear from a young or career-changing reader asking for advice about how to carve out a living in cybersecurity. This happened so often that I created an entire category of posts on this topic: <a href="https://krebsonsecurity.com/?s=how+to+break+into+security&amp;x=0&amp;y=0" target="_blank">How to Break Into Security</a>. I&#8217;ll be revisiting that series soon, but for the time being I want to encourage anyone interested in building their skills through legal hacking to consider creating relationships with companies that have already sanctioned &#8212; and in many cases financially reward &#8212; such activity.</p>
<p>For starters, Bugcrowd <a href="https://bugcrowd.com/list-of-bug-bounty-programs" target="_blank">has a nice list of bug bounty and disclosure programs</a> from across the Web, broken down according to whether they offer various benefits such as financial reward, swag or public recognition. Hackerone maintains <a href="https://hackerone.com/directory" target="_blank">a searchable directory</a> of security contacts and vulnerability reporting policies at various corporations.</p>


feed_id: https://krebsonsecurity.com/?p=36963
title: Akamai on the Record KrebsOnSecurity Attack
uri: Akamai-on-the-Record-KrebsOnSecurity-Attack
url: https://krebsonsecurity.com/2016/11/akamai-on-the-record-krebsonsecurity-attack/
content:
<p>Internet infrastructure giant <strong>Akamai</strong> last week released a special <strong>State of the Internet</strong> report. Normally, the quarterly accounting of noteworthy changes in distributed denial-of-service (DDoS) attacks doesn&#8217;t delve into attacks on specific customers. But this latest Akamai report makes an exception in describing in great detail the <a href="https://krebsonsecurity.com/2016/09/krebsonsecurity-hit-with-record-ddos/" target="_blank">record-sized attack against KrebsOnSecurity.com in September</a>, the largest such assault it has ever mitigated.</p>
<p>&#8220;The attacks made international headlines and were also covered in depth by Brian Krebs himself,&#8221; Akamai said in its report, explaining one reason for the exception. &#8220;The same data we’ve shared here was made available to Krebs for his own reporting and we received permission to name him and his site in this report. Brian Krebs is a security blogger and reporter who does in-depth research and analysis of cybercrime throughout the world, with a recent emphasis on DDoS. His reporting exposed a stressor site <a href="http://krebsonsecurity.com/2016/09/israeli-online-attack-service-vdos-earned-600000-in-two-years/" target="_blank">called vDOS</a> and the security <a href="http://krebsonsecurity.com/2016/09/israeli-online-attack-service-vdos-earned-600000-in-two-years/" target="_blank">firm BackConnect Inc.</a>, which made him the target of a series of large DDoS attacks starting September 15, 2016.&#8221;</p>
<div id="attachment_37003" style="width: 590px" class="wp-caption aligncenter"><a class="lightbox" href="media/7be098e7.kos-ddos-2013-2016.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/11/kos-ddos-2013-2016.png"><img class="wp-image-37003 size-medium" src="media/82cd3fd5.kos-ddos-2013-2016-580x240.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/11/kos-ddos-2013-2016-580x240.png" alt="A visual depiction of the increasing size and frequency of DDoS attacks against KrebsOnSecurity.com, between 2012 and 2016. Source: Akamai." width="580" height="240" srcset="http://krebsonsecurity.com/wp-content/uploads/2016/11/kos-ddos-2013-2016-580x240.png 580w, http://krebsonsecurity.com/wp-content/uploads/2016/11/kos-ddos-2013-2016-768x318.png 768w, http://krebsonsecurity.com/wp-content/uploads/2016/11/kos-ddos-2013-2016-940x389.png 940w, http://krebsonsecurity.com/wp-content/uploads/2016/11/kos-ddos-2013-2016.png 1328w" sizes="(max-width: 580px) 100vw, 580px" /></a><p class="wp-caption-text">A visual depiction of the increasing size and frequency of DDoS attacks against KrebsOnSecurity.com, between 2012 and 2016. Source: Akamai.</p></div>
<p>Akamai said so-called <a href="https://krebsonsecurity.com/?s=stresser&amp;x=0&amp;y=0" target="_blank">&#8220;booter&#8221; or &#8220;stresser&#8221; DDoS-for-hire services</a> that sell attacks capable of knocking Web sites offline continue to account for a large portion of the attack traffic in mega attacks. According to Akamai, most of the traffic from those mega attacks in Q3 2016 were thanks to <a href="https://krebsonsecurity.com/?s=mirai&amp;x=0&amp;y=0" target="_blank">Mirai</a> &#8212; the <a href="https://krebsonsecurity.com/2016/10/source-code-for-iot-botnet-mirai-released/" target="_blank">now open-source malware family</a> that was used to coordinate <a href="https://krebsonsecurity.com/2016/09/krebsonsecurity-hit-with-record-ddos/" target="_blank">the attack on this site in September</a> and <a href="https://krebsonsecurity.com/2016/10/hacked-cameras-dvrs-powered-todays-massive-internet-outage/" target="_blank">a separate assault against infrastructure provider Dyn in October.</a></p>
<p>Akamai said the attack on Sept. 20 was launched by just 24,000 systems infected with Mirai, mostly hacked <strong>Internet of Things</strong> (IoT) devices such as digital video recorders and security cameras.</p>
<p>&#8220;The first quarter of 2016 marked a high point in the number of attacks peaking at more than 100 Gbps,&#8221; Akamai stated in its report. &#8220;This trend was matched in Q3 2016, with another 19 mega attacks. It’s interesting that while the overall number of attacks fell by 8% quarter over quarter, the number of large attacks, as well as the size of the biggest attacks, grew significantly.&#8221;</p>
<p>As detailed here in several previous posts, KrebsOnSecurity.com was a pro-bono customer of Akamai, beginning in August 2012 with Prolexic before Akamai acquired them. Akamai mentions this as well in explaining its decision to terminate our pro-bono arrangement. KrebsOnSecurity is <a href="https://krebsonsecurity.com/2016/09/the-democratization-of-censorship/" target="_blank">now behind</a> <strong>Google</strong>&#8216;s <a href="https://jigsaw.google.com/projects/#project-shield" target="_blank">Project Shield</a>, a free program run by Google to help protect journalists and dissidents from online censorship.</p>
<p>&#8220;Almost as soon as the site was on the Prolexic network, it was <a href="https://krebsonsecurity.com/2012/08/triple-ddos-vs-krebsonsecurity/" target="_blank">hit by a trio of attacks based on the Dirt Jumper DDoS tookit</a>,&#8221; Akamai wrote of this site. &#8220;Those attacks marked the start of hundreds of attacks that were mitigated on the routed platform.&#8221;</p>
<p>In total, Akamai found, this site received 269 attacks in the little more than four years it was on the Prolexic/Akamai network.<span id="more-36963"></span></p>
<p>&#8220;During that time, there were a dozen mega attacks peaking at over 100 Gbps,&#8221; the company wrote. &#8220;The first happened in December 2013, the second in February 2014, and the third in August 2015. In 2016, the size of attacks accelerated dramatically, with four mega attacks happening between March and August, while five attacks occurred in September, ranging from 123 to 623 Gbps. An observant reader can probably correlate clumps of attacks to specific stories covered by Krebs. Reporting on the dark side of cybersecurity draws attention from people and organizations who are not afraid of using DDoS attacks to silence their detractors.&#8221;</p>
<p>In case any trenchant observant readers wish to attempt that, I&#8217;ve published a spreadsheet <a href="https://krebsonsecurity.com/wp-content/uploads/2016/11/krebs_lifetime.csv" target="_blank">here</a> (in .CSV format) which lists the date, duration, size and type of attack used in DDoS campaigns against KrebsOnSecurity.com over the past four years. Although 269 attacks over four years works out to an average of just one attack roughly every five days, both the frequency and intensity of these attacks have increased substantially over the past four years as illustrated by the graphic above.</p>
<p>&#8220;The magnitude of the attacks seen during the final week were significantly larger than the majority of attacks Akamai sees on a regular basis,&#8221; Akamai reports. &#8220;In fact, while the attack on September 20 was the largest attack ever mitigated by Akamai, the attack on September 22 would have qualified for the record at any other time, peaking at 555 Gbps.&#8221;</p>
<p>Akamai found that the 3rd quarter of 2016 marks a full year with China as the top source country for DDoS attacks, with just under 30 percent of attack traffic in Q3 2016. The company notes that this metric doesn&#8217;t count UDP-based attacks &#8211; such as<a href="https://www.incapsula.com/ddos/attack-glossary/dns-amplification.html" target="_blank"> amplification and reflection attacks</a> &#8212; due to the ease with which the sources of the attacks can be spoofed and could create significant distortion of the data.</p>
<p>&#8220;More importantly, the proportion of traffic from China has been reduced by 56%, which had a significant effect on the overall attack count and led to the 8% drop in attacks seen this quarter,&#8221; Akamai reported. The U.S., U.K., France, and Brazil round out the remaining top five source countries.&#8221;</p>
<div id="attachment_37005" style="width: 590px" class="wp-caption aligncenter"><a class="lightbox" href="media/6a0e9c08.akamaitopfive.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/11/akamaitopfive.png"><img class="wp-image-37005 size-medium" src="media/d5b0d2c5.akamaitopfive-580x503.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/11/akamaitopfive-580x503.png" alt="Top sources of DDoS attacks. Image: Akamai." width="580" height="503" srcset="http://krebsonsecurity.com/wp-content/uploads/2016/11/akamaitopfive-580x503.png 580w, http://krebsonsecurity.com/wp-content/uploads/2016/11/akamaitopfive-768x665.png 768w, http://krebsonsecurity.com/wp-content/uploads/2016/11/akamaitopfive-940x815.png 940w, http://krebsonsecurity.com/wp-content/uploads/2016/11/akamaitopfive.png 1004w" sizes="(max-width: 580px) 100vw, 580px" /></a><p class="wp-caption-text">Top sources of DDoS attacks. Image: Akamai.</p></div>
<p>A copy of Akamai&#8217;s Q3 2016 State of the Internet report is available <a href="https://content.akamai.com/pg7407-soti-security-report-q3-en.html" target="_blank">here</a>.</p>


feed_id: https://krebsonsecurity.com/?p=37060
title: San Francisco Rail System Hacker Hacked
uri: San-Francisco-Rail-System-Hacker-Hacked
url: https://krebsonsecurity.com/2016/11/san-francisco-rail-system-hacker-hacked/
content:
<p>The <strong>San Francisco Municipal Transportation Agency</strong> (SFMTA) was hit with a <a href="https://krebsonsecurity.com/?s=ransomware&amp;x=0&amp;y=0" target="_blank">ransomware</a> attack on Friday, causing fare station terminals to carry the message, &#8220;You Hacked. ALL Data Encrypted.&#8221; Turns out, the miscreant behind this extortion attempt got hacked himself this past weekend, revealing details about other victims as well as tantalizing clues about his identity and location.</p>
<div id="attachment_37071" style="width: 580px" class="wp-caption aligncenter"><img class="size-full wp-image-37071" src="media/1acf9d3b.lenovo-victim.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/11/lenovo-victim.png" alt="A copy of the ransom message left behind by the &quot;Mamba&quot; ransomware." width="570" height="402" /><p class="wp-caption-text">A copy of the ransom message left behind by the &#8220;Mamba&#8221; ransomware.</p></div>
<p>On Friday, <em>The San Francisco Examiner</em> <a href="http://www.sfexaminer.com/hacked-appears-muni-stations-fare-payment-system-crashes/" target="_blank">reported</a> that riders of SFMTA&#8217;s Municipal Rail or &#8220;Muni&#8221; system were greeted with handmade &#8220;Out of Service&#8221; and &#8220;Metro Free&#8221; signs on station ticket machines. The computer terminals at all Muni locations carried the &#8220;hacked&#8221; message: &#8220;Contact for key (<strong>cryptom27@yandex.com</strong>),&#8221; the message read.</p>
<p>The hacker in control of that email account said he had compromised thousands of computers at the SFMTA, scrambling the files on those systems with strong encryption. The files encrypted by his ransomware, he said, could only be decrypted with a special digital key, and that key would cost 100 Bitcoins, or approximately USD $73,000.</p>
<p>On Monday, KrebsOnSecurity was contacted by a security researcher who said he hacked this very same cryptom27@yandex.com inbox after reading a news article about the SFMTA incident. The researcher, who has asked to remain anonymous, said he compromised the extortionist&#8217;s inbox by guessing the answer to his secret question, which then allowed him to reset the attacker&#8217;s email password. A screen shot of the user profile page for cryptom27@yandex.com shows that it was tied to a backup email address, <strong>cryptom2016@yandex.com</strong>, which also was protected by the same secret question and answer.</p>
<p>Copies of messages shared with this author from those inboxes indicate that on Friday evening, Nov. 25, the attacker sent a message to SFMTA infrastructure manager <a href="https://www.linkedin.com/in/sean-cunningham-0889885" target="_blank">Sean Cunningham</a> with the following demand (the entirety of which has been trimmed for space reasons), signed with the pseudonym &#8220;<strong>Andy Saolis</strong>.&#8221;</p>
<p>&#8220;if You are Responsible in MUNI-RAILWAY !</p>
<p>All Your Computer’s/Server&#8217;s in MUNI-RAILWAY Domain Encrypted By AES 2048Bit!</p>
<p>We have 2000 Decryption Key !</p>
<p>Send 100BTC to My Bitcoin Wallet , then We Send you Decryption key For Your All Server&#8217;s HDD!!&#8221;</p>
<p>One hundred Bitcoins may seem like a lot, but it&#8217;s apparently not far from a usual payday for this attacker. On Nov. 20, hacked emails show that he successfully extorted 63 bitcoins (~$45,000) from a U.S.-based manufacturing firm.</p>
<p>The attacker appears to be in the habit of switching Bitcoin wallets randomly every few days or weeks. &#8220;For security reasons&#8221; he explained to some victims who took several days to decide whether to pay the ransom they&#8217;d been demanded. <span class="pullquote pqleft">A review of more than a dozen Bitcoin wallets this criminal has used since August indicates that he has successfully extorted at least $140,000 in Bitcoin from victim organizations.</span></p>
<p>That is almost certainly a conservative estimate of his overall earnings these past few months: My source said he was unable to hack another Yandex inbox used by this attacker between August and October 2016, &#8220;w889901665@yandex.com,&#8221; and that this email address is tied to many search results for tech help forum postings from people victimized by a strain of ransomware known as <a href="https://threatpost.com/mamba-ransomware-encrypts-hard-drives-rather-than-files/120730/" target="_blank">Mamba</a>.</p>
<p>Copies of messages shared with this author answer many questions raised by news media coverage of this attack, such as whether the SFMTA was targeted. In short: No. Here&#8217;s why.</p>
<p>Messages sent to the attacker&#8217;s cryptom2016@yandex.com account show a financial relationship with at least two different hosting providers. The credentials needed to manage one of those servers were also included in the attacker&#8217;s inbox in plain text, and my source shared multiple files from that server.</p>
<p>KrebsOnSecurity sought assistance from several security experts in making sense of the data shared by my source. <strong>Alex Holden</strong>, chief information security officer at <a href="http://www.holdsecurity.com" target="_blank">Hold Security Inc</a>, said the attack server appears to have been used as a staging ground to compromise new systems, and was equipped with several open-source tools to help find and infect new victims.</p>
<p>&#8220;It appears our attacker has been using a number of tools which enabled the scanning of large portions of the Internet and several specific targets for vulnerabilities,&#8221; Holden said. &#8220;The most common vulnerability used &#8216;weblogic unserialize exploit&#8217; and especially targeted <b>Oracle Corp.</b> server products, including <b>Primavera </b>project portfolio management software.&#8221;</p>
<p>According to a review of email messages from the Cryptom27 accounts shared by my source, the attacker routinely offered to help victims secure their systems from other hackers for a small number of extra Bitcoins. In one case, a victim that had just forked over a 20 Bitcoin ransom seemed all too eager to pay more for tips on how to plug the security holes that got him hacked. In return, the hacker pasted a link to a Web server, and urged the victim to install a critical security patch for the company&#8217;s Java applications.</p>
<p>&#8220;Read this and install patch before you connect your server to internet again,&#8221; the attacker wrote, linking to <a href="https://blogs.oracle.com/security/entry/security_alert_cve_2015_4852" target="_blank">this advisory</a> that Oracle issued for a security hole that it plugged in November 2015.</p>
<p>In many cases, the extortionist told victims their data would be gone forever if they didn&#8217;t pay the ransom in 48 hours or less. In other instances, he threatens to increase the ransom demand with each passing day.<span id="more-37060"></span></p>
<h4>WHO IS ALI REZA?</h4>
<p>The server used to launch the Oracle vulnerability scans offers tantalizing clues about the geographic location of the attacker. That server kept detailed logs about the date, time and Internet address of each login. A review of the more than 300 Internet addresses used to administer the server revealed that it has been controlled almost exclusively from Internet addresses in Iran. Another hosting account tied to this attacker says his contact number is <strong>+78234512271</strong>, which maps back to a mobile phone provider based in Russia.</p>
<p>But other details from the attack server indicate that the Russian phone number may be a red herring. For example, the attack server&#8217;s logs includes the Web link or Internet address of each victimized server, listing the hacked credentials and short notations apparently made next to each victim by the attacker. Google Translate had difficulty guessing which language was used in the notations, but a fair amount of searching indicates the notes are transliterated Farsi or Persian, the primary language spoken in Iran and several other parts of the Middle East.</p>
<p>User account names on the attack server hold other clues, with names like &#8220;Alireza,&#8221; &#8220;Mokhi.&#8221; Alireza may pertain to <strong>Ali Reza</strong>, the seventh descendant of the Islamic prophet Muhammad, or just to <a href="https://en.wikipedia.org/wiki/Ali_Reza" target="_blank">a very common name among Iranians, Arabs and Turks</a>.</p>
<p>The targets successfully enumerated as vulnerable by the attacker&#8217;s scanning server include the username and password needed to remotely access the hacked servers, as well as the IP address (and in some cases domain name) of the victim organization. In many cases, victims appeared to use newly-registered email addresses to contact the extortionist, perhaps unaware that the intruder had already done enough reconnaissance on the victim organization to learn the identity of the company and the contact information for the victim&#8217;s IT department.</p>
<p>The list of victims from our extortionist shows that the SFMTA was something of an aberration. <span class="pullquote pqright">The vast majority of organizations victimized by this attacker were manufacturing and construction firms based in the United States, and most of those victims ended up paying the entire ransom demanded &#8212; generally one Bitcoin (currently USD $732) per encrypted server.</span></p>
<p>Emails from the attacker&#8217;s inbox indicate some victims managed to negotiate a lesser ransom. <a href="http://chinaconstruction.us/Overview.jsp?id=2" target="_blank">China Construction of America Inc.</a>, for example, paid 24 Bitcoins (~$17,500) on Sunday, Nov. 27 to decrypt some 60 servers infected with the same ransomware &#8212; after successfully haggling the attacker down from his original demand of 40 Bitcoins. Other construction firms apparently infected by ransomware attacks from this criminal include King of Prussia, Pa. based <a href="http://irwinleighton.com/" target="_blank">Irwin &amp; Leighton</a>; <a href="http://cdmsmith.com/" target="_blank">CDM Smith Inc.</a> in Boston; Indianapolis-based <a href="http://www.skillman.com/contact/" target="_blank">Skillman</a>; and the <a href="http://rlgbuilds.com/" target="_blank">Rudolph Libbe Group</a>, a construction consulting firm based in Walbridge, Ohio. It&#8217;s unclear whether any of these companies paid a ransom to regain access to their files.</p>
<h4>PROTECT YOURSELF AND YOUR ORGANIZATION</h4>
<p>The data leaked from this one actor shows how successful and lucrative ransomware attacks can be, and how often victims pay up. For its part, the SFMTA said it never never considered paying the ransom.</p>
<p>&#8220;We have an information technology team in place that can restore our systems and that is what they are doing,&#8221; said SFMTA spokesman <strong>Paul Rose</strong>. &#8220;Existing backup systems allowed us to get most affected computers up and running this morning, and our information technology team anticipates having the remaining computers functional in the next two days.&#8221;</p>
<p>As the SFMTA&#8217;s experience illustrates, having proper and regular backups of your data can save you bundles. But unsecured backups can also be encrypted by ransomware, so it&#8217;s important to ensure that backups are not connected to the computers and networks they are backing up. Examples might include securing backups in the cloud or physically storing them offline. It should be noted, however, that some instances of ransomware <a href="https://krebsonsecurity.com/2016/01/ransomware-a-threat-to-cloud-services-too/" target="_blank">can lock cloud-based backups</a> when systems are configured to continuously back up in real-time.</p>
<p>That last tip is among dozens offered by the Federal Bureau of Investigation, which has been warning businesses about the dangers of ransomware attacks for several years now. For more tips on how to avoid becoming the next ransomware victim, check out the FBI&#8217;s <a href="https://www.ic3.gov/media/2016/160915.aspx" target="_blank">most recent advisory on ransomware</a>.</p>
<p>Finally, as I hope this story shows, truthfully answering secret questions is a surefire way to get your online account hacked. Personally, I try to avoid using vital services that allow someone to <a href="https://krebsonsecurity.com/2015/11/fcc-fines-cox-595k-over-lizard-squad-hack/" target="_blank">reset my password</a> if they can guess the answers to my secret questions. But in some cases &#8212; as with <a href="https://krebsonsecurity.com/2016/08/united-airlines-sets-minimum-bar-on-security/" target="_blank">United Airlines&#8217;s atrocious new password system</a> &#8212; answering secret questions is unavoidable. In cases where I&#8217;m allowed to type in the answer, I always choose a gibberish or completely unrelated answer that only I will know and that cannot be unearthed using social media or random guessing.</p>


feed_id: https://krebsonsecurity.com/?p=37044
title: ATM Insert Skimmers: A Closer Look
uri: ATM-Insert-Skimmers-A-Closer-Look
url: https://krebsonsecurity.com/2016/11/atm-insert-skimmers-a-closer-look/
content:
<p>KrebsOnSecurity has featured multiple stories about the threat from ATM fraud devices known as &#8220;insert skimmers,&#8221; wafer-thin data theft tools made to be completely hidden inside of a cash&#8217;s machine&#8217;s card acceptance slot. For a closer look at how stealthy insert skimmers can be, it helps to see videos of these things being installed and removed. Here&#8217;s a look at promotional sales videos produced by two different ATM insert skimmer peddlers.</p>
<p>Traditional ATM skimmers are fraud devices made to be placed over top of the cash machine&#8217;s card acceptance slot, usually secured to the ATM with glue or double-sided tape. Increasingly, however, more financial institutions are turning to technologies that can detect when something has been affixed to the ATM. As a result, more fraudsters are selling and using insert skimming devices &#8212; which are completely hidden from view once inserted into an ATM.</p>
<div align="center"><iframe src="http://www.youtube.com/embed/fyyCnlvhEjU" width="560" height="315" frameborder="0" allowfullscreen="allowfullscreen"></iframe></div>
<p>The fraudster demonstrating his insert skimmer in the short video above spends the first half of the demo showing how a regular bank card can freely move in and out of the card acceptance slot while the insert skimmer is nestled inside. Toward the end of the video, the scammer retrieves the insert skimmer using what appears to be a rather crude, handmade tool thin enough to fit inside a wallet.</p>
<p>A sales video produced by yet another miscreant in the cybercrime underground shows an insert skimmer being installed and removed from a motorized card acceptance slot that has been fully removed from an ATM so that the fraud device can be seen even while it is inserted.</p>
<div align="center"><iframe src="http://www.youtube.com/embed/kGge4ssI2zg" width="560" height="315" frameborder="0" allowfullscreen="allowfullscreen"></iframe></div>
<p>In a typical setup, insert skimmers capture payment card data from the magnetic stripe on the backs of cards inserted into a hacked ATM, while a pinhole spy camera hidden above or beside the PIN pad records time-stamped video of cardholders entering their PINs. The data allows thieves to fabricate new cards and use PINs to withdraw cash from victim accounts.</p>
<p>Covering the PIN pad with your hand blocks any hidden camera from capturing your PIN — and hidden cameras are used on the vast majority of the more than three dozen ATM skimming incidents that I’ve covered here. Shockingly, few people bother to take this simple and effective step, as <a href="http://krebsonsecurity.com/2012/09/a-handy-way-to-foil-atm-skimmer-scams/" target="_blank">detailed in this skimmer tale from 2012</a>, wherein I obtained hours worth of video seized from two ATM skimming operations and saw customer after customer walk up, insert their cards and punch in their digits — all in the clear.</p>
<p>Once you understand how stealthy these ATM fraud devices are, it&#8217;s difficult to use a cash machine without wondering whether the thing is already hacked. The truth is most of us probably have a better chance of getting physically mugged after withdrawing cash than encountering a skimmer in real life. However, here are a few steps we can all take to minimize the success of skimmer gangs.</p>
<p>-Cover the PIN pad while you enter your PIN.</p>
<p>-Keep your wits about you when you’re at the ATM, and avoid dodgy-looking and standalone cash machines in low-lit areas, if possible.</p>
<p>-Stick to ATMs that are physically installed in a bank. Stand-alone ATMs are usually easier for thieves to hack into.</p>
<p>-Be especially vigilant when withdrawing cash on the weekends; thieves tend to install skimming devices on a weekend — when they know the bank won’t be open again for more than 24 hours.</p>
<p>-Keep a close eye on your bank statements, and dispute any unauthorized charges or withdrawals immediately.</p>
<p>If you liked this piece and want to learn more about skimming devices, check out my series <a href="https://krebsonsecurity.com/all-about-skimmers/" target="_blank">All About Skimmers</a>.</p>


feed_id: https://krebsonsecurity.com/?p=37093
title: New Mirai Worm Knocks 900K Germans Offline
uri: New-Mirai-Worm-Knocks-900K-Germans-Offline
url: https://krebsonsecurity.com/2016/11/new-mirai-worm-knocks-900k-germans-offline/
content:
<p>More than 900,000 customers of German ISP <strong>Deutsche Telekom</strong> (DT) were knocked offline this week after their Internet routers got infected by a new variant of a computer worm known as <strong>Mirai. </strong>The malware wriggled inside the routers via a newly discovered vulnerability in a feature that allows ISPs to remotely upgrade the firmware on the devices. But the new Mirai malware turns that feature off once it infests a device, complicating DT&#8217;s cleanup and restoration efforts.</p>
<p>Security experts say the multi-day outage is a sign of things to come as cyber criminals continue to aggressively scour the Internet of Things (IoT) for vulnerable and poorly-secured routers, Internet-connected cameras and digital video recorders (DVRs). One enslaved, the IoT devices can be used and rented out for a variety of purposes &#8212; from conducting <a href="https://krebsonsecurity.com/2016/10/hacked-cameras-dvrs-powered-todays-massive-internet-outage/" target="_blank">massive denial-of-service attacks</a> capable of knocking large Web sites offline to <a href="https://krebsonsecurity.com/2016/10/iot-devices-as-proxies-for-cybercrime/" target="_blank">helping cybercriminals stay anonymous online</a>.</p>
<div id="attachment_37112" style="width: 590px" class="wp-caption aligncenter"><a class="lightbox" href="media/48720548.shodan-7547.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/11/shodan-7547.png"><img class="wp-image-37112 size-medium" src="media/6239b366.shodan-7547-580x281.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/11/shodan-7547-580x281.png" alt="An internet-wide scan conducted by Shodan.io suggests there may be more than five million devices vulnerable to the exploit that caused problems for so many DT customers this week. Image: Badcyber.com" width="580" height="281" srcset="http://krebsonsecurity.com/wp-content/uploads/2016/11/shodan-7547-580x281.png 580w, http://krebsonsecurity.com/wp-content/uploads/2016/11/shodan-7547-768x372.png 768w, http://krebsonsecurity.com/wp-content/uploads/2016/11/shodan-7547-940x455.png 940w, http://krebsonsecurity.com/wp-content/uploads/2016/11/shodan-7547.png 1142w" sizes="(max-width: 580px) 100vw, 580px" /></a><p class="wp-caption-text">An internet-wide scan conducted by Shodan.io suggests there may be as many as five million devices vulnerable to the exploit that caused problems for so many DT customers this week. Image: Badcyber.com</p></div>
<p>This new variant of Mirai builds on <a href="https://krebsonsecurity.com/2016/10/source-code-for-iot-botnet-mirai-released/" target="_blank">malware source code released at the end of September</a>. That leak came a little more a week after a botnet based on Mirai was used in <a href="https://krebsonsecurity.com/2016/09/krebsonsecurity-hit-with-record-ddos/" target="_blank">a record-sized attack</a> that caused KrebsOnSecurity <a href="https://krebsonsecurity.com/?s=democratization&amp;x=0&amp;y=0" target="_blank">to go offline for several days</a>. Since then, <a href="https://twitter.com/miraiattacks?lang=en" target="_blank">dozens of new Mirai botnets have emerged</a>, all competing for a finite pool of vulnerable IoT systems that can be infected.</p>
<p>Until this week, all Mirai botnets scanned for the same <a href="https://krebsonsecurity.com/2016/10/who-makes-the-iot-things-under-attack/" target="_blank">60+ factory default usernames and passwords used by millions of IoT devices</a>. But the criminals behind one of the larger Mirai botnets apparently decided to add a new weapon to their arsenal, incorporating exploit code <a href="https://devicereversing.wordpress.com/" target="_blank">published earlier this month</a> for a security flaw in specific routers made by <a href="https://en.wikipedia.org/wiki/ZyXEL" target="_blank">Zyxel</a> and <a href="https://de.wikipedia.org/wiki/Speedport" target="_blank">Speedport</a>.</p>
<p>These companies act as original equipment manufacturers (OEMs) that specialize in building DSL modems that ISPs then ship to customers. The vulnerability exists in communications protocols supported by the devices that ISPs can use to remotely manage all of the customer-premises routers on their network.</p>
<p>According to <a href="https://badcyber.com/new-mirai-attack-vector-bot-exploits-a-recently-discovered-router-vulnerability/" target="_blank">BadCyber.com</a>, which first blogged about the emergence of the new Mirai variant, part of the problem is that Deutsche Telekom does not appear to have followed the best practice of blocking the rest of the world from remotely managing these devices as well.</p>
<p>&#8220;The malware itself is really friendly as it closes the vulnerability once the router is infected,&#8221; BadCyber noted. &#8220;It performs [a] command which should make the device &#8216;secure,&#8217; until next reboot. The first one closes port 7547 and the second one kills the telnet service, making it really hard for the ISP to update the device remotely.&#8221; [For the Geek Factor 5 readership out there, the flaw stems from the way these routers parse incoming traffic destined for <a href="http://www.speedguide.net/port.php?port=7547" target="_blank">Port 7547</a> using communications protocols known as <a href="https://en.wikipedia.org/wiki/TR-069" target="_blank">TR-069</a>].</p>
<p>DT has been <a href="https://www.facebook.com/telekomhilft/photos/a.143615195685585.27512.122768271103611/1199966633383764/?type=3&amp;theater" target="_blank">urging customers</a> who are having trouble to briefly disconnect and then reconnect the routers, a process which wipes the malware from the device&#8217;s memory. The devices should then be able to receive a new update from DT that plugs the vulnerability.</p>
<p>That is, unless the new Mirai strain gets to them first. <strong>Johannes Ullrich</strong>, dean of security research at <strong>The SANS Technology Institute</strong>, <a href="https://isc.sans.edu/forums/diary/Port+7547+SOAP+Remote+Code+Execution+Attack+Against+DSL+Modems/21759/" target="_blank">said</a> this version of Mirai aggressively scans the Internet for new victims, and that SANS&#8217;s research has shown vulnerable devices are compromised by the new Mirai variant within five to ten minutes of being plugged into the Internet.</p>
<p>Ullrich said the scanning activity conducted by the new Mirai variant is so aggressive that it can create hangups and crashes even for routers that are are not vulnerable to this exploit.</p>
<p>&#8220;Some of these devices went down because of the sheer number of incoming connections&#8221; from the new Mirai variant, Ullrich said. &#8220;They were listening on Port 7547 but were not vulnerable to this exploit and were still overloaded with the number of connections to that port.&#8221;</p>
<div id="attachment_37111" style="width: 590px" class="wp-caption aligncenter"><img class="size-medium wp-image-37111" src="media/831e9b8e.speedport-580x363.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/11/speedport-580x363.png" alt="A Deutsche Telekom Speedport DSL modem." width="580" height="363" srcset="http://krebsonsecurity.com/wp-content/uploads/2016/11/speedport-580x363.png 580w, http://krebsonsecurity.com/wp-content/uploads/2016/11/speedport.png 681w" sizes="(max-width: 580px) 100vw, 580px" /><p class="wp-caption-text">A Deutsche Telekom Speedport DSL modem.</p></div>
<h4>FEEDING THE CRIME MACHINE</h4>
<p><strong>Allison Nixon</strong>, director of security research at <a href="https://www.flashpoint-intel.com/" target="_blank">Flashpoint</a>, said this latest Mirai variant appears to be an attempt to feed fresh victims into one of the larger and more established Mirai botnets out there today.</p>
<p>Nixon said she suspects this particular botnet is being rented out in discrete chunks to other cybercriminals. Her suspicions are based in part on the fact that the malware phones home to a range of some 256 Internet addresses that for months someone has purchased for the sole purpose of hosting nothing but servers used to control multiple Mirai botnets.</p>
<p>&#8220;The malware points to some [Internet addresses] that are in ranges which were purchased for the express purpose of running Mirai,&#8221; Nixon said. &#8220;That range does nothing but run Mirai control servers on it, and they&#8217;ve been doing it for a while now. I would say this is probably part of a commercial service because purchasing this much infrastructure is not cheap. And you generally don&#8217;t see people doing this for kicks, you see them doing it for money.&#8221;<span id="more-37093"></span></p>
<p>Nixon said the criminals behind this new Mirai variant are busy subdividing their botnet &#8212; thought to be composed of several hundred thousand hacked IoT devices &#8212; among multiple, distinct control servers. This approach, she said, addresses two major concerns among cybercriminals who specialize in building botnets that are resold for use in huge distributed denial of service (DDoS) attacks.</p>
<p>The first is that extended DDoS attacks which leverage firepower from more bots than are necessary to take down a target host can cause the crime machine&#8217;s overall bot count to dwindle more quickly than the botnet can replenish itself with newly infected IoT devices &#8212; greatly diminishing the crime machine&#8217;s strength and earning power.</p>
<p>&#8220;I’ve been watching a lot of chatter in the DDoS community, and one of the topics that frequently comes up is that there are many botnets out there where the people running them don’t know each other, they&#8217;ve just purchased time on the botnet and have been assigned specific slots on it,&#8221; Nixon said. &#8220;Long attacks would end up causing the malware or infected machines to crash, and the attack and would end up killing the botnet if it was overused. Now it looks like someone has architected a response to that concern, knowing that you have to preserve bots as much as you can and not be excessive with the DDoS traffic you&#8217;re pushing.&#8221;</p>
<p>Nixon said dividing the Mirai botnet into smaller sections which each answer to multiple control servers also makes the overall crime machine more resistant to takedown efforts by security firms and researchers.</p>
<p>&#8220;This is an interesting development because a lot of the response to Mirai lately has been to find a Mirai controller and take it down,&#8221; Nixon said. &#8220;Right now, the amount of redundant infrastructure these Mirai actors have is pretty significant, and it suggests they’re trying to make their botnets more difficult to take down.&#8221;</p>
<p>Nixon said she worries that the aggressive Mirai takedown efforts by the security community may soon prompt the crooks to adopt far more sophisticated and resilient methods of keeping their crime machines online.</p>
<p>&#8220;We have to realize that the takedown option is not going to be there forever with these IoT botnets,&#8221; she said.</p>


feed_id: https://krebsonsecurity.com/?p=37121
title: ‘Avalanche’ Global Fraud Ring Dismantled
uri: Avalanche-Global-Fraud-Ring-Dismantled
url: https://krebsonsecurity.com/2016/12/avalanche-global-fraud-ring-dismantled/
content:
<p>In what&#8217;s being billed as an unprecedented global law enforcement response to cybercrime, federal investigators in the United States, United Kingdom and Europe today say they&#8217;ve dismantled a sprawling cybercrime machine known as &#8220;Avalanche&#8221; &#8212; a distributed, cloud-hosting network that for the past seven years has been rented out to fraudsters for use in launching countless malware and phishing attacks.</p>
<div id="attachment_37133" style="width: 590px" class="wp-caption aligncenter"><a class="lightbox" href="media/d3dc224b.avalanchemap.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/12/avalanchemap.png"><img class="wp-image-37133 size-medium" src="media/53939753.avalanchemap-580x354.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/12/avalanchemap-580x354.png" alt="The global distribution of servers used in the Avalanche crime machine. Source: Shadowserver.org" width="580" height="354" srcset="http://krebsonsecurity.com/wp-content/uploads/2016/12/avalanchemap-580x354.png 580w, http://krebsonsecurity.com/wp-content/uploads/2016/12/avalanchemap-768x468.png 768w, http://krebsonsecurity.com/wp-content/uploads/2016/12/avalanchemap-940x573.png 940w, http://krebsonsecurity.com/wp-content/uploads/2016/12/avalanchemap.png 1335w" sizes="(max-width: 580px) 100vw, 580px" /></a><p class="wp-caption-text">The global distribution of servers used in the Avalanche crime machine. Source: Shadowserver.org</p></div>
<p>According to <a href="https://www.europol.europa.eu/newsroom/news/%E2%80%98avalanche%E2%80%99-network-dismantled-in-international-cyber-operation" target="_blank">Europol</a>, the action was the result of a four-year joint investigation between Europol, <a href="http://www.eurojust.europa.eu/" target="_blank">Eurojust</a> the FBI and authorities in the U.K. and Germany that culminated on Nov. 30, 2016 with the arrest of five individuals, the seizure of 39 Web servers, and the sidelining of more than 830,000 web domains used in the scheme.</p>
<p>Built as a criminal cloud-hosting environment that was rented out to scammers, spammers other ne&#8217;er-do-wells, Avalanche has been a major source of cybercrime for years. In 2009, when investigators say the fraud network first opened for business, Avalanche was responsible for funneling roughly two-thirds of all phishing attacks aimed at stealing usernames and passwords for bank and e-commerce sites.  By 2011, Avalanche was being heavily used by crooks to deploy banking Trojans.</p>
<p>The <strong>U.K.&#8217;s National Crime Agency</strong> (NCA), says the more recent Avalanche fraud network comprised up to 600 servers worldwide and was used to host as many as 800,000 web domains at a time.<span id="more-37121"></span></p>
<p>&#8220;Cyber criminals rented the servers and through them launched and managed digital fraud campaigns, sending emails in bulk to infect computers with malware, ransomware and other malicious software that would steal users’ bank details and other personal data,&#8221; the NCA said in <a href="http://www.nationalcrimeagency.gov.uk/news/962-avalanche-takedown" target="_blank">a statement</a> released today on the takedown. The criminals used the stolen information for fraud or extortion. At its peak 17 different types of malware were hosted by the network, including major strains with names such as goznym, urlzone, pandabanker and loosemailsniffer.At least 500,000 computers around the world were infected and controlled by the Avalanche system on any given day.&#8221;</p>
<p>The Avalanche network was especially resilient because it relied on a hosting method known as <a href="http://en.wikipedia.org/wiki/Fast_flux" target="_blank">fast-flux</a>, a kind of round-robin technique that lets botnets hide phishing and malware delivery sites behind an ever-changing network of compromised systems acting as proxies.</p>
<p>&#8220;The complex setup of the Avalanche network was popular amongst cybercriminals, because of the double fast flux technique offering enhanced resilience to takedowns and law enforcement action,&#8221; Europol said in its statement.</p>
<p>It&#8217;s worth noting here that Avalanche has for many years been heavily favored by crime gangs to deploy <a href="https://krebsonsecurity.com/tag/zeus/" target="_blank">Zeus</a> and <a href="https://krebsonsecurity.com/tag/spyeye/" target="_blank">SpyEye</a> malware variants involved in <a href="https://krebsonsecurity.com/category/smallbizvictims/" target="_blank">cleaning out bank accounts for a large number of small to mid-sized businesses</a>. These attacks relied heavily on so-called &#8220;<a href="https://krebsonsecurity.com/tag/money-mules/" target="_blank">money mules</a>,&#8221; people willingly or unwittingly recruited into helping fraudsters launder stolen funds.</p>
<p>At the time of the takedown, the Avalanche cybercrime infrastructure spanned more than 180 countries, according to The Shadowserver Foundation, a nonprofit group that helped authorities gain control over the Avalanche domains. Read more on Shadowserver&#8217;s role in this effort <a href="http://blog.shadowserver.org/2016/12/01/avalanche/" target="_blank">here</a>.</p>
<div id="attachment_37131" style="width: 590px" class="wp-caption aligncenter"><img class="wp-image-37131 size-medium" src="media/add4c952.avalanche_-_double_flux-_details-580x1187.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/12/avalanche_-_double_flux-_details-580x1187.png" alt="The Avalanche crime infrastructure. " width="580" height="1187" srcset="http://krebsonsecurity.com/wp-content/uploads/2016/12/avalanche_-_double_flux-_details-580x1187.png 580w, http://krebsonsecurity.com/wp-content/uploads/2016/12/avalanche_-_double_flux-_details-768x1572.png 768w, http://krebsonsecurity.com/wp-content/uploads/2016/12/avalanche_-_double_flux-_details.png 827w" sizes="(max-width: 580px) 100vw, 580px" /><p class="wp-caption-text">The Avalanche crime infrastructure. Image: Europol</p></div>


feed_id: https://krebsonsecurity.com/?p=37143
title: Visa Delays Chip Deadline for Pumps To 2020
uri: Visa-Delays-Chip-Deadline-for-Pumps-To-2020
url: https://krebsonsecurity.com/2016/12/visa-delays-chip-deadline-for-pumps-to-2020/
content:
<p><strong>Visa</strong> this week delayed by three years a deadline for fuel station owners to install payment terminals at the pump that are capable of handling more secure chip-based cards. Experts say the new deadline &#8212; extended from 2017 &#8212; comes amid a huge spike in fuel pump skimming, and means fraudsters will have another three years to fleece banks and their customers by installing card-skimming devices at the pump.</p>
<p>Until this week, fuel station owners in the United States had until October 1, 2017 to install chip-capable readers at their pumps. Under previous Visa rules, station owners that didn&#8217;t have chip-ready readers in place by then would have been on the hook to absorb 100 percent of the costs of fraud associated with transactions in which the customer presented a chip-based card yet was not asked or able to dip the chip (currently, card-issuing banks eat most of the fraud costs from fuel skimming). The chip card technology standard, also known as <strong>EMV</strong> (short for <a href="https://en.wikipedia.org/wiki/EMV" target="_blank">Europay, MasterCard and Visa</a>) makes credit and debit cards far more expensive and difficult for thieves to clone.</p>
<p>This week, however, Visa said fuel station owners would have until October 1, 2020 to meet the liability shift deadline.</p>
<div id="attachment_37146" style="width: 590px" class="wp-caption aligncenter"><img class="size-medium wp-image-37146" src="media/50313e13.apr-7-580x346.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/12/apr-7-580x346.png" alt="A Bluetooth-based pump card skimmer found inside of a Food N Things pump in Arizona in April 2016." width="580" height="346" srcset="http://krebsonsecurity.com/wp-content/uploads/2016/12/apr-7-580x346.png 580w, http://krebsonsecurity.com/wp-content/uploads/2016/12/apr-7-768x459.png 768w, http://krebsonsecurity.com/wp-content/uploads/2016/12/apr-7-940x561.png 940w, http://krebsonsecurity.com/wp-content/uploads/2016/12/apr-7.png 1035w" sizes="(max-width: 580px) 100vw, 580px" /><p class="wp-caption-text">A Bluetooth-based pump card skimmer found inside of a Food N Things pump in Arizona in April 2016.</p></div>
<p>&#8220;The fuel segment has its own unique challenges, which we recognized when we first set the chip activation date for automated fuel dispensers/pumps (AFDs) two years after regular in-store locations,&#8221; Visa said in <a href="https://usa.visa.com/visa-everywhere/security/emv-at-the-pump.html" target="_blank">a statement</a> explaining its decision. &#8220;We knew that the AFD segment would need more time to upgrade to chip because of the complicated infrastructure and specialized technology required for fuel pumps. For instance, in some cases, older pumps may need to be replaced before adding chip readers, requiring specialized vendors and breaking into concrete. Furthermore, five years after announcing our liability shift, there are still issues with a sufficient supply of regulatory-compliant EMV hardware and software to enable most upgrades by 2017.&#8221;</p>
<p>Visa said fuel pump skimming accounts for just 1.3 percent of total U.S. payment card fraud.</p>
<p>&#8220;During this interim period, Visa will monitor AFD fraud trends closely and work with merchants, acquirers and issuers to help mitigate any potential counterfeit fraud exposure at AFDs,&#8221; Visa said.</p>
<p><strong>Avivah Litan</strong>, a fraud analyst with <a href="http://blogs.gartner.com/avivah-litan/" target="_blank">Gartner Inc.</a>, said the deadline shift wasn&#8217;t unexpected given how many U.S. fuel stations are behind on costly updates, noting that in some cases it can cost more than $10,000 per pump to accommodate chip card readers. <strong>The National Association of Convenience Stores</strong> estimates that station operators will spend approximately $30,000 per store to accommodate chip readers, and that the total cost to the fuel industry could exceed $4 billion.</p>
<p>&#8220;Some of them you can just replace the payment module inside the pump, but the older pumps will need to be completely removed and replaced,&#8221; Litan said. &#8220;Gas stations and their unattended pumps have always been an easy target for thieves. The fraud usually migrates to the point of least resistance, and we&#8217;re seeing now the fraudsters really moving to targeting unattended stations that haven&#8217;t been upgraded.&#8221;<span id="more-37143"></span></p>
<p>The delay comes as some states &#8212; particularly in the southern United States &#8212; are grappling with major increases in fuel station skimming attacks. In September, KrebsOnSecurity published a detailed look at <a href="https://krebsonsecurity.com/2016/09/inside-arizonas-pump-skimmer-scourge/" target="_blank">nine months&#8217; worth of fuel pump skimming incident reports</a> filed by police and regulators in Arizona, which <em>said it saw more fuel station skimming attacks in the month of August 2016 than in all of 2015 combined</em>.</p>
<p>That report about Arizona&#8217;s skimmer scourge found that thieves tend to target pumps that are furthest from the pump station and closest to the street. They also favored stations that did not employ basic security measures such as tamper-evident security tape and security cameras.</p>
<p>Crooks involved in fuel pump skimming generally are tied to organized crime gangs, as evidenced by <a href="https://krebsonsecurity.com/2015/11/gas-theft-gangs-fuel-pump-skimming-scams/">this Nov. 2015 investigation into fuel theft gangs operating in Southern California</a> . The thieves most often use stolen master keys or bribery to gain access to the pumps. Once inside the pumps, the thieves hook up their skimmer to the pump’s card reader and PIN pad. The devices also are connected to the pump’s electric power — so they don’t need batteries and can operate indefinitely. Increasingly, these thieves are installing Bluetooth-based skimmers that can transmit stolen data wirelessly, allowing thieves to avoid taking the risky step of retrieving their skimmer gear.</p>
<p>Some pump skimming devices are <a href="https://krebsonsecurity.com/2013/07/dont-get-sucker-pumped/" target="_blank">capable of stealing debit card PINs as well</a>, <em>so it&#8217;s good idea to avoid paying with a debit card at the pump</em>. Armed with your PIN and debit card data, thieves can clone the card and pull money out of your account at an ATM. Having your checking account emptied of cash while your bank sorts out the situation can be a huge hassle and create secondary problems (bounced checks, for instance).</p>
<p>&#8220;That&#8217;s exactly the sort of advice fuel station owners don&#8217;t want given to consumers,&#8221; Litan said. &#8220;For filling stations, credit is their least favorite form of payment because it&#8217;s the most expensive for them, which is why some stations offer lower prices for debit card transactions. But consumers should never use a debit card at a gas station.&#8221;</p>
<p>Want to learn more about skimming devices? Check out my series, <a href="https://krebsonsecurity.com/all-about-skimmers/" target="_blank">All About Skimmers</a>.</p>


feed_id: https://krebsonsecurity.com/?p=37183
title: Researchers Find Fresh Fodder for IoT Attack Cannons
uri: Researchers-Find-Fresh-Fodder-for-IoT-Attack-Cannons
url: https://krebsonsecurity.com/2016/12/researchers-find-fresh-fodder-for-iot-attack-cannons/
content:
<p>New research published this week could provide plenty of fresh fodder for <a href="https://krebsonsecurity.com/?s=mirai&amp;x=0&amp;y=0" target="_blank">Mirai</a>, a malware strain that enslaves poorly-secured <strong>Internet of Things</strong> (IoT) devices for use in <a href="https://krebsonsecurity.com/2016/10/ddos-on-dyn-impacts-twitter-spotify-reddit/" target="_blank">powerful online attacks</a>. Researchers in Austria have unearthed a pair of backdoor accounts in more than 80 different IP camera models made by <strong>Sony Corp</strong>. Separately, Israeli security experts have discovered trivially exploitable weaknesses in nearly a half-million white-labeled IP camera models that are not currently sought out by Mirai.</p>
<div id="attachment_37191" style="width: 302px" class="wp-caption alignright"><img class=" wp-image-37191" src="media/91246dd1.ipela-sony.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/12/ipela-sony.png" alt="A Sony IPELA camera. Image: Sony." width="292" height="392" /><p class="wp-caption-text">A Sony IPELA camera. Image: Sony.</p></div>
<p>In a blog post published today, Austrian security firm <strong>SEC Consult</strong> said it found two apparent backdoor accounts in <strong>Sony IPELA Engine IP Cameras </strong>&#8212;<strong> </strong>devices mainly used by enterprises and authorities. According to SEC Consult, the two previously undocumented user accounts &#8212; named &#8220;primana&#8221; and &#8220;debug&#8221; &#8212; could be used by remote attackers to commandeer the Web server built into these devices, and then to enable &#8220;<a href="https://en.wikipedia.org/wiki/Telnet" target="_blank">telnet</a>&#8221; on them.</p>
<p>Telnet &#8212; a protocol that allows remote logons over the Internet &#8212; is the very same communications method abused by Mirai, which constantly scours the Web for IoT devices with telnet enabled and protected by factory-default passwords.</p>
<p>&#8220;We believe that this backdoor was introduced by Sony developers on purpose (maybe as a way to debug the device during development or factory functional testing) and not an &#8216;unauthorized third party&#8217; like in other cases (e.g. the <strong>Juniper ScreenOS Backdoor</strong>, <a href="https://community.rapid7.com/community/infosec/blog/2015/12/20/cve-2015-7755-juniper-screenos-authentication-backdoor" target="_blank">CVE-2015-7755</a>),&#8221; SEC Consult wrote.</p>
<p>It&#8217;s unclear precisely how many Sony IP cameras may be vulnerable, but a scan of the Web <a href="https://censys.io/ipv4/metadata?q=%28%22inquiry.cgi%22+OR+%22Sony+Network+Camera%22+OR+%22gen5th%22%29+" target="_blank">using Censys.io</a> indicates there are at least 4,250 that are currently reachable over the Internet.</p>
<p>&#8220;Those Sony IPELA ENGINE IP camera devices are definitely reachable on the Internet and a potential target for Mirai-like botnets, but of course it depends on the network/firewall configuration,&#8221; said <strong>Johannes Greil</strong>, head of SEC Consult Vulnerability Lab. &#8220;From our point of view, this is only the tip of the iceberg because it&#8217;s only one search string from the device we have.&#8221;</p>
<p>Greil said there are other undocumented functionalities in the Sony IP cameras that could be maliciously used by malware or miscreants, such as commands that can be invoked to distort images and/or video recorded by the cameras, or a camera heating feature that could be abused to overheat the devices.</p>
<p>Sony did not respond to multiple requests for comment. But the researchers said Sony has quietly made available to its users an update that disables the backdoor accounts on the affected devices. However, users still need to manually update the firmware using a program called <a href="https://pro.sony.com/bbsc/ssr/mkt-security/resource.downloads.bbsccms-assets-cat-camsec-downloads-SecurityDownloadsIPCameraTools.shtml" target="_blank">SNC Toolbox</a>.</p>
<p>Greil said it seems likely that the backdoor accounts have been present in Sony cameras for at least four years, as there are signs that someone may have discovered the hidden accounts back in 2012 and <a href="https://forum.insidepro.com/viewtopic.php?t=17819&amp;sid=23939616b4f9db0c863c425011b1dae7" target="_blank">attempted to crack the passwords then</a>. SEC Consult&#8217;s writeup on their findings is available <a href="http://blog.sec-consult.com/2016/12/backdoor-in-sony-ipela-engine-ip-cameras.html" target="_blank">here</a>.</p>
<p>In other news, researchers at security firm <strong>Cybereason</strong> say they&#8217;ve found at least two previously unknown security flaws in dozens of IP camera families that are white-labeled under a number of different brands (and some without brands at all) that are available for purchase via places like eBay and Amazon. The devices are all administered with the password &#8220;888888,&#8221; and may be remotely accessible over the Internet if they are not protected behind a firewall. KrebsOnSecurity has confirmed that while the Mirai botnet currently includes this password <a href="https://krebsonsecurity.com/2016/10/ddos-on-dyn-impacts-twitter-spotify-reddit/" target="_blank">in the combinations it tries</a>, the username for this password is not part of Mirai&#8217;s current configuration.</p>
<p>But Cybereason&#8217;s team found that they could easily exploit these devices even if they <em>were</em> set up behind a firewall. That&#8217;s because all of these cameras ship with a factory-default peer-to-peer (P2P) communications capability that enables remote &#8220;cloud&#8221; access to the devices via the manufacturer&#8217;s Web site &#8212; provided a customer visits the site and provides the unique camera ID stamped on the bottom of the devices.</p>
<p>Although it may seem that attackers would need physical access to the vulnerable devices in order to derive those unique camera IDs, Cybereason&#8217;s principal security researcher <strong>Amit Serper</strong> said the company figured out a simple way to enumerate all possible camera IDs using the manufacturer&#8217;s Web site.</p>
<p>&#8220;We reverse engineered these cameras so that we can use the manufacturer&#8217;s own infrastructure to access them and do whatever we want,&#8221; Serper said. &#8220;We can use the company&#8217;s own cloud network and from there jump onto the customer&#8217;s network.&#8221;<span id="more-37183"></span></p>
<p><strong>Lior Div</strong>, co-founder and CEO at Cybereason, said a review of the code built into these devices shows the manufacturer does not appear to have made security a priority, and that people using these devices should simply toss them in the trash.</p>
<p>&#8220;There is no firmware update mechanism built into these cameras, so there&#8217;s no way to patch them,&#8221; Div said. &#8220;The version of Linux running on these devices was in some cases 14 years old, and the other code libraries on the devices are just as ancient. These devices are so hopelessly broken from a security perspective that it&#8217;s hard to really understand what&#8217;s going on in the minds of people putting them together.&#8221;</p>
<p>Cybereason said it is not disclosing full technical details of the flaws because it would enable any attacker to compromise them for use in online attacks. But it has published a few tips that should help customers determine whether they have a vulnerable device. For example, the camera&#8217;s password (888888) is printed on a sticker on the bottom of the devices, and the UID &#8212; also printed on the sticker &#8212; starts with one of these text strings:</p>
<p><img class="aligncenter size-medium wp-image-37189" src="media/dd2687d4.textstrings-580x106.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/12/textstrings-580x106.png" alt="textstrings" width="580" height="106" srcset="http://krebsonsecurity.com/wp-content/uploads/2016/12/textstrings-580x106.png 580w, http://krebsonsecurity.com/wp-content/uploads/2016/12/textstrings.png 637w" sizes="(max-width: 580px) 100vw, 580px" /></p>
<div id="attachment_37190" style="width: 590px" class="wp-caption aligncenter"><img class="size-medium wp-image-37190" src="media/f4f2ccfe.ipcamsticker-580x437.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/12/ipcamsticker-580x437.png" alt="The sticker on the bottom of the camera will tell you if the device is affected by the vulnerability. Image: Cybereason." width="580" height="437" srcset="http://krebsonsecurity.com/wp-content/uploads/2016/12/ipcamsticker-580x437.png 580w, http://krebsonsecurity.com/wp-content/uploads/2016/12/ipcamsticker.png 611w" sizes="(max-width: 580px) 100vw, 580px" /><p class="wp-caption-text">The sticker on the bottom of the camera will tell you if the device is affected by the vulnerability. Image: Cybereason.</p></div>
<p>&#8220;People tend to look down on IoT research and call it junk hacking,&#8221; Cybereason&#8217;s <strong>Yoav Orot</strong> wrote in <a href="https://www.cybereason.com/zero-day-exploits-turn-hundreds-of-thousands-of-ip-cameras-into-iot-botnet-slaves" target="_blank">a blog post</a> about its findings. &#8220;But that isn’t the right approach if researchers hope to prevent future Mirai botnet attacks. A smart (insert device here) is still a computer, regardless of its size. It has a processor, software and hardware and is vulnerable to malware just like a laptop or desktop. Whether the device records The Walking Dead or lets you watch your cat while you’re at work, attackers can still own it. Researchers should work on junk hacking because these efforts can improve device security (and consumer security in the process), keep consumer products out of the garbage heap and prevent them from being used to carry out DDoS attacks.&#8221;</p>
<p>The discoveries by SEC Consult and Cybereason come as policymakers in Washington, D.C. are grappling with what to do about the existing and dawning surge in poorly-secured IoT devices. A blue-ribbon panel commissioned by<strong> President Obama</strong> issued a 90-page report last week full of cybersecurity policy recommendations for the 45th President of the United States, and IoT concerns and addressing <strong>distributed</strong> <strong>denial-of-service </strong>(DDoS) attacks <a href="https://krebsonsecurity.com/2016/12/ddos-iot-top-cybersecurity-priorities-for-45th-president/" target="_blank">emerged as top concerns in that report</a>.</p>
<p>Meanwhile, <em>Morning Consult</em> <a href="https://morningconsult.com/2016/12/05/wheeler-floats-fcc-cybersecurity-certification-iot-devices/" target="_blank">reports</a> that <strong>U.S. Federal Communications Commission </strong><strong>Chairman Tom Wheeler</strong> has laid out an unexpected roadmap through which the agency could regulate the security of IoT devices. The proposed certification process was laid out in a response to <a href="https://krebsonsecurity.com/2016/10/senator-prods-federal-agencies-on-iot-mess/" target="_blank">a letter sent by Sen. Mark Warner (D-Va.)</a> shortly after the IoT-based attacks in October that targeted Internet infrastructure company <strong>Dyn</strong> and <a href="https://krebsonsecurity.com/2016/10/hacked-cameras-dvrs-powered-todays-massive-internet-outage/" target="_blank">knocked offline a number of the Web’s top destinations</a> for the better part of a day.</p>
<p>Morning Consult’s <strong>Brendan Bordelon</strong> notes that while Wheeler is set to step down as chairman on Jan. 20, “the new framework could be used to support legislation enhancing the FCC’s ability to regulate IoT devices.”</p>


feed_id: https://krebsonsecurity.com/?p=37158
title: DDoS, IoT Top Cybersecurity Priorities for 45th President
uri: DDoS-IoT-Top-Cybersecurity-Priorities-for-45th-President
url: https://krebsonsecurity.com/2016/12/ddos-iot-top-cybersecurity-priorities-for-45th-president/
content:
<p>Addressing <strong>distributed</strong> <strong>denial-of-service </strong>(DDoS) attacks<strong> </strong>designed to knock Web services offline and security concerns introduced by the so-called &#8220;<strong>Internet of Things</strong>&#8221; (IoT) should be top cybersecurity priorities for the 45th President of the United States, according to a newly released blue-ribbon report commissioned by <strong>President Obama.</strong></p>
<p><img class="alignright wp-image-37177" src="media/7fdfa840.commish-580x356.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/12/commish-580x356.png" alt="commish" width="295" height="181" srcset="http://krebsonsecurity.com/wp-content/uploads/2016/12/commish-580x356.png 580w, http://krebsonsecurity.com/wp-content/uploads/2016/12/commish-768x472.png 768w, http://krebsonsecurity.com/wp-content/uploads/2016/12/commish-940x578.png 940w, http://krebsonsecurity.com/wp-content/uploads/2016/12/commish.png 1004w" sizes="(max-width: 295px) 100vw, 295px" />&#8220;The private sector and the Administration should collaborate on a roadmap for improving the security of digital networks, in particular by achieving robustness against denial-of-service, spoofing, and other attacks on users and the nation’s network infrastructure,&#8221; reads the first and foremost cybersecurity recommendation for <strong>President-elect Donald Trump</strong>. &#8220;The urgency of the situation demands that the next Administration move forward promptly on our recommendations, working closely with Congress and the private sector.&#8221;</p>
<p>The <a href="media/438d31a9.cybercommissionmembers.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/12/cybercommissionmembers.png" target="_blank">12-person, non-partisan commission</a> produced <a href="media/e0b1c2ee.cybersecurity-commission-report-final-post.pdf" data-original-source="https://www.nist.gov/sites/default/files/documents/2016/12/02/cybersecurity-commission-report-final-post.pdf" target="_blank">a 90-page report</a> (PDF) and recommended as their very first action item that the incoming President &#8220;should direct senior federal executives to launch a private–public initiative, including provisions to undertake, monitor, track, and report on measurable progress in enabling agile, coordinated responses and mitigation of attacks on the users and the nation’s network infrastructure.&#8221;</p>
<p>The panel said this effort should build on previous initiatives, such as a 2011 program by the <strong>U.S. Department of Commerce</strong> called the <a href="https://www.ntia.doc.gov/federal-register-notice/2011/models-advance-voluntary-corporate-notification-consumers-regarding-ill" target="_blank">Industry Botnet Group</a>.</p>
<p>&#8220;Specifically, this effort would identify the actions that can be taken by organizations responsible for the Internet and communications ecosystem to define, identify, report, reduce, and respond to attacks on users and the nation’s network infrastructure,&#8221; the report urged. &#8220;This initiative should include regular reporting on the actions that these organizations are already taking and any changes in technology, law, regulation, policy, financial reimbursement, or other incentives that may be necessary to support further action—while ensuring that no participating entity obstructs lawful content, applications, services, or nonharmful devices, subject to reasonable network management.&#8221;</p>
<p>The report spans some six major imperatives, including 16 recommendations and 63 associated action items. The second major imperative focuses on IoT security concerns, and urges the federal government and private industry to embark upon a number of initiatives to &#8220;rapidly and purposefully to improve the security of the Internet of Things.&#8221;</p>
<p>&#8220;The Department of Justice should lead an interagency study with the Departments of Commerce and Homeland Security and work with the Federal Trade Commission, the Consumer Product Safety Commission, and interested private sector parties to assess the current state of the law with regard to liability for harm caused by faulty IoT devices and provide recommendations within 180 days,&#8221; the panel recommended. &#8220;To the extent that the law does not provide appropriate incentives for companies to design security into their products, and does not offer protections for those that do, the President should draw on these recommendations to present Congress with a legislative proposal to address identified gaps, as well as explore actions that could be accomplished through executive order.&#8221;</p>
<p>Meanwhile, <em>Morning Consult</em> <a href="https://morningconsult.com/2016/12/05/wheeler-floats-fcc-cybersecurity-certification-iot-devices/" target="_blank">reports</a> that <strong>U.S. Federal Communications Commission</strong> <strong>Chairman Tom Wheeler</strong> has laid out an unexpected roadmap through which the agency could regulate the security of IoT devices. The proposed certification process was laid out in a response to <a href="https://krebsonsecurity.com/2016/10/senator-prods-federal-agencies-on-iot-mess/" target="_blank">a letter sent by Sen. Mark Warner (D-Va.)</a> shortly after the IoT-based attacks in October that targeted Internet infrastructure company <strong>Dyn</strong> and <a href="https://krebsonsecurity.com/2016/10/hacked-cameras-dvrs-powered-todays-massive-internet-outage/" target="_blank">knocked offline a number of the Web&#8217;s top destinations</a> for the better part of a day.</p>
<p>Morning Consult&#8217;s <strong>Brendan Bordelon</strong> notes that while Wheeler is set to step down as chairman on Jan. 20, &#8220;the new framework could be used to support legislation enhancing the FCC’s ability to regulate IoT devices.&#8221;<span id="more-37158"></span></p>
<h4>ANALYSIS</h4>
<p>It&#8217;s nice that this presidential commission placed a special emphasis on IoT and denial-of-service attacks, as these two threats alone are clear and present dangers to the stability of e-commerce and free expression online. However, this report overall reads very much like other blue-ribbon commission reports of years past: The recommendations eschew new requirements in favor of the usual calls for best practices, voluntary guidelines, increasing industry-government information sharing, public/private partnerships, and public awareness campaigns.</p>
<p>One recommendation I would like to have seen in this report is a call for federal legislation that requires U.S.-based hosting providers to block spoofed traffic from leaving their networks.</p>
<p>As I noted in a November 2015 story, <a href="http://krebsonsecurity.com/2015/11/the-lingering-mess-from-default-insecurity/" target="_blank">The Lingering Mess from Default Insecurity</a>, one major contributor to the massive spike in denial-of-service attacks over the past few years is that far too many ISPs and hosting providers allow traffic to leave their networks that did not originate there. Using well-known attack techniques known as <a href="https://www.incapsula.com/ddos/attack-glossary/dns-amplification.html" target="_blank">traffic amplification and reflection</a>, an attacker can &#8220;reflect&#8221; his traffic from one or more third-party machines toward the intended target.</p>
<p>In this type of assault, the attacker sends a message to a third party, while spoofing the Internet address of the victim. When the third party replies to the message, the reply is sent to the victim — and the reply is much larger than the original message, thereby amplifying the size of the attack. According to <a href="https://content.akamai.com/pg7407-soti-security-report-q3-en.html" target="_blank">the latest DDoS report</a> from <strong>Akamai</strong>, more than half of all denial-of-service attacks in the third quarter of 2016 involved reflection and spoofing.</p>
<p>One basic step that many ISPs and hosting providers can but apparently are not taking to blunt these spoofing attacks involves a network security standard that was developed and released more than a dozen years ago. Known as <a href="http://www.bcp38.info/index.php/Main_Page" target="_blank">BCP38</a>, its use prevents abusable resources on an ISP&#8217;s network from being leveraged in denial-of-service. BCP38 is designed to filter such spoofed traffic, so that the reflected traffic from the third party never even traverses the network of an ISP that’s adopted the anti-spoofing measures.</p>
<p>However, there are non-trivial economic reasons that many ISPs fail to adopt this best practice. <a href="http://www.internetsociety.org/deploy360/blog/2014/07/anti-spoofing-bcp-38-and-the-tragedy-of-the-commons/" target="_blank">This blog post</a> from the <strong>Internet Society</strong> does a good job of explaining why many ISPs decide not to implement BCP38. Ultimately, it comes down to cost and to a fear that adoption of this best practice will increase costs and prompt some customers to seek out providers that do not enforce this requirement. In some cases, U.S.-based hosting providers that allow spoofing/reflection have been sought out and recommended among miscreants involved in selling DDoS-for-hire services.</p>
<p>In its Q3 2016 State of the Internet report, Akamai notes that while Chinese ISPs occupy the top two sources of spoofed traffic, several large U.S.-based providers make a showing here as well:</p>
<div id="attachment_37171" style="width: 590px" class="wp-caption aligncenter"><img class="size-medium wp-image-37171" src="media/a3bedef5.top10reflectionsources-580x309.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/12/top10reflectionsources-580x309.png" alt="Image: Akamai." width="580" height="309" srcset="http://krebsonsecurity.com/wp-content/uploads/2016/12/top10reflectionsources-580x309.png 580w, http://krebsonsecurity.com/wp-content/uploads/2016/12/top10reflectionsources-768x409.png 768w, http://krebsonsecurity.com/wp-content/uploads/2016/12/top10reflectionsources-940x501.png 940w, http://krebsonsecurity.com/wp-content/uploads/2016/12/top10reflectionsources.png 996w" sizes="(max-width: 580px) 100vw, 580px" /><p class="wp-caption-text">Image: Akamai.</p></div>
<p>It is true that requiring U.S. hosting providers to block spoofing would not solve the spoofing problem globally. But I believe it&#8217;s high time that the United States led by example in this arena, if only because we probably have the most to lose by continued inaction. According to Akamai, more than 21 percent of all denial-of-service attacks originate from the United States. And that number has increased from 17 percent a year ago, Akamai found. What&#8217;s more, the U.S. is the most frequent target of these attacks, according to <a href="media/39f2ea95.WISR2016_EN_Web.pdf" data-original-source="https://www.arbornetworks.com/images/documents/WISR2016_EN_Web.pdf" target="_blank">DDoS stats released this year</a> by <strong>Arbor Networks</strong>.</p>


feed_id: https://krebsonsecurity.com/?p=37209
title: ‘Avalanche’ Crime Ring Leader Eludes Justice
uri: Avalanche-Crime-Ring-Leader-Eludes-Justice
url: https://krebsonsecurity.com/2016/12/avalanche-crime-ring-leader-eludes-justice/
content:
<p>The accused ringleader of a cyber fraud gang that allegedly rented out access to a criminal cloud hosting service known as &#8220;Avalanche&#8221; is now a fugitive from justice following a bizarre series of events in which he shot at Ukrainian police, was arrested on cybercrime charges and then released from custody.</p>
<div id="attachment_37211" style="width: 279px" class="wp-caption alignright"><img class=" wp-image-37211" src="media/b70683c8.kapkanov.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/12/kapkanov.png" alt="Gennady Kapkanov. Source: NPU.gov" width="269" height="323" /><p class="wp-caption-text">Gennady Kapkanov. Source: NPU.gov</p></div>
<p>On Nov. 30, authorities across Europe <a href="https://krebsonsecurity.com/2016/12/avalanche-global-fraud-ring-dismantled/" target="_blank">coordinated the arrest of five individuals</a> thought to be tied to the Avalanche crime gang, in an operation that the FBI and its partners abroad described as an unprecedented global law enforcement response to cybercrime.</p>
<p>According to Ukrainian <a href="http://news.pn/ru/criminal/173397" target="_blank">news outlets</a>, the alleged leader of the gang &#8212; 33-year-old Russian <strong>Gennady Kapkanov</strong> &#8212; did not go quietly. Kapkanov allegedly shot at officers with a Kalashnikov assault rifle through the front door as they prepared to raid his home, and then attempted to escape off of his 4th floor apartment balcony.</p>
<p>Ukrainian police arrested Kapkanov and booked him on cybercrime charges. But a judge in the city of Poltava, Ukraine later ordered Kapkanov released, saying the prosecution had failed to file the proper charges (including charges of shooting at police officers), charges which could have allowed authorities to hold him much longer. Ukrainian media reports that police have since lost track of Kapkanov.</p>
<p>Ukraine&#8217;s Prosecutor General <strong>Yuri Lutsenko</strong> is now <a href="http://lb.ua/news/2016/12/06/352714_prokuror_poltavskoy_oblasti.html" target="_blank">calling for the ouster of the prosecutor</a> in charge of the case. Meanwhile, the Ukranian authorities are now <a href="https://www.npu.gov.ua/ru/publish/article/2067410" target="_blank">asking the public for help</a> in re-arresting Kapkanov.</p>
<div id="attachment_37213" style="width: 557px" class="wp-caption aligncenter"><img class="wp-image-37213 size-full" src="media/35cafdaf.kapkanovguns.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/12/kapkanovguns.png" alt="kapkanovguns" width="547" height="430" /><p class="wp-caption-text">Weapons police say they seized from Kapkanov&#8217;s apartment. Source: npu.gov.ua</p></div>
<p><span id="more-37209"></span></p>
<p>Built as a criminal cloud-hosting environment that was rented out to scammers, spammers other ne’er-do-wells, Avalanche has been a major source of cybercrime for years. In 2009, when investigators say the fraud network first opened for business, Avalanche was responsible for funneling roughly two-thirds of all phishing attacks aimed at stealing usernames and passwords for bank and e-commerce sites.  By 2011, Avalanche was being heavily used by crooks to deploy banking Trojans.</p>
<p>The <strong>U.K.’s National Crime Agency</strong> (NCA), says the more recent Avalanche fraud network comprised up to 600 servers worldwide and was used to host as many as 800,000 web domains at a time.</p>
<div id="attachment_37212" style="width: 590px" class="wp-caption aligncenter"><img class="size-medium wp-image-37212" src="media/b79e183c.kapkanovbalcony-580x384.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/12/kapkanovbalcony-580x384.png" alt="Kapkanov, in blue with his hands over his head, standing on his 4th-floor balcony. Image: npu.gov.ua" width="580" height="384" srcset="http://krebsonsecurity.com/wp-content/uploads/2016/12/kapkanovbalcony-580x384.png 580w, http://krebsonsecurity.com/wp-content/uploads/2016/12/kapkanovbalcony-768x508.png 768w, http://krebsonsecurity.com/wp-content/uploads/2016/12/kapkanovbalcony-940x622.png 940w" sizes="(max-width: 580px) 100vw, 580px" /><p class="wp-caption-text">Kapkanov, in blue with his hands over his head, standing on his 4th-floor balcony. Image: npu.gov.ua</p></div>
<div id="attachment_37223" style="width: 590px" class="wp-caption aligncenter"><img class="size-medium wp-image-37223" src="media/2d7ddcad.kapkanovlicense-580x378.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/12/kapkanovlicense-580x378.png" alt="Kapkanov's drivers license. Source: npu.gov.ua." width="580" height="378" srcset="http://krebsonsecurity.com/wp-content/uploads/2016/12/kapkanovlicense-580x378.png 580w, http://krebsonsecurity.com/wp-content/uploads/2016/12/kapkanovlicense.png 596w" sizes="(max-width: 580px) 100vw, 580px" /><p class="wp-caption-text">Kapkanov&#8217;s drivers license lists an address in the United Kingdom. Source: npu.gov.ua.</p></div>


feed_id: https://krebsonsecurity.com/?p=37259
title: Yahoo: One Billion More Accounts Hacked
uri: Yahoo-One-Billion-More-Accounts-Hacked
url: https://krebsonsecurity.com/2016/12/yahoo-one-billion-more-accounts-hacked/
content:
<p>Just months after disclosing a breach that compromised the passwords for a half billion of its users, <strong>Yahoo</strong> now says a separate incident has jeopardized data from at least a billion more user accounts. The company also warned attackers have figured out a way to log into targeted Yahoo accounts without even supplying the victim&#8217;s password.</p>
<p><img class="aligncenter size-medium wp-image-37262" src="media/bcd9f820.yahboohoo-580x314.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/12/yahboohoo-580x314.png" alt="yahboohoo" width="580" height="314" srcset="http://krebsonsecurity.com/wp-content/uploads/2016/12/yahboohoo-580x314.png 580w, http://krebsonsecurity.com/wp-content/uploads/2016/12/yahboohoo.png 728w" sizes="(max-width: 580px) 100vw, 580px" /></p>
<p>On September 22, Yahoo warned that a security breach of its networks affected more than 500 million account holders. Today, the company said it uncovered a separate incident in which thieves stole data on more than a billion user accounts, and that the newly disclosed breach is separate from the incident disclosed in September.</p>
<p>&#8220;Based on further analysis of this data by the forensic experts, we believe an unauthorized third party, in August 2013, stole data associated with more than one billion user accounts,&#8221; Yahoo&#8217;s chief information security officer <strong>Bob Lord</strong> said in <a href="https://yahoo.tumblr.com/post/154479236569/important-security-information-for-yahoo-users" target="_blank">a statement</a> the company published Wednesday afternoon. &#8220;We have not been able to identify the intrusion associated with this theft.&#8221;</p>
<p>The statement says that for &#8220;potentially affected accounts, the stolen user account information may have included names, email addresses, telephone numbers, dates of birth, hashed passwords (using MD5) and, in some cases, encrypted or unencrypted security questions and answers.&#8221;</p>
<p>In addition, Lord said the attackers had worked out a way to forge &#8220;cookies&#8221; that Yahoo places on user computers when they log in. Authentication cookies are text files that contain information about the user&#8217;s session with Yahoo. Cookies can contain a great deal of information about the user, such as whether that the user has already authenticated to the company&#8217;s servers.</p>
<p>The attackers in this case apparently found a way to forge these authentication cookies, which would have granted them to access targeted accounts without needing to supply the account&#8217;s password. In addition, a forged cookie could have allowed the attackers to remain logged into the hacked accounts for weeks or indefinitely.</p>
<p>Yahoo&#8217;s statement said the company is in the process of notifying the affected account holders, and that it has invalidated the forged cookies.</p>
<p>&#8220;We have connected some of this activity to the same state-sponsored actor believed to be responsible for the data theft the company disclosed on September 22, 2016,&#8221; Lord said.</p>
<p>Yahoo says users should change their passwords and security questions and answers for any other accounts on which they used the same or similar information used for their Yahoo account. The company is asking users to review their accounts for suspicious activity, and to consider using <a href="https://help.yahoo.com/kb/SLN25781.html" target="_blank">Yahoo Account Key</a>, a simple authentication tool that eliminates the need to use a password on Yahoo altogether.<span id="more-37259"></span></p>
<p>For years I have been urging friends and family to migrate off of Yahoo email, mainly because I watched for years as the company appeared to fall far behind its peers in blocking spam and other email-based attacks. But also because of weak security features (like secret questions) that tend to weaken the security of accounts. I stand by that recommendation.</p>
<p>Most importantly, if you are reusing your Yahoo password anywhere else, now is a great time to change those passwords elsewhere. And remember, never reuse your email password (or any other password tied to an account that holds sensitive data about you) at any other site.</p>


feed_id: https://krebsonsecurity.com/?p=37246
title: New Critical Fixes for Flash, MS Windows
uri: New-Critical-Fixes-for-Flash-MS-Windows
url: https://krebsonsecurity.com/2016/12/new-critical-fixes-for-flash-ms-windows/
content:
<p>Both <strong>Adobe</strong> and <strong>Microsoft</strong> on Tuesday issued patches to plug critical security holes in their products. Adobe&#8217;s <strong>Flash Player</strong> patch addresses 17 security flaws, including one &#8220;zero-day&#8221; bug that is already actively being exploited by attackers. Microsoft&#8217;s bundle of updates tackles at least 42 security weaknesses in Windows and associated software.</p>
<p><img class="alignright size-full wp-image-26837" src="media/d85cffb4.brokenwindows.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/07/brokenwindows.png" alt="brokenwindows" width="229" height="240" /></p>
<p>Half of the dozen patches Microsoft released yesterday earned its &#8220;critical&#8221; rating, meaning the flaws fixed in the updates could be exploited by malware or miscreants to seize remote control over vulnerable Windows computers without any help from users.</p>
<p>As per usual, the largest share of flaws fixed are in Microsoft&#8217;s browsers &#8212; <strong>Internet Explorer</strong> and <strong>Edge</strong>. Also included in the mix are updates for <strong>Microsoft Office</strong> and <strong>.NET</strong>.</p>
<p>According to security firm <a href="http://www.shavlik.com/patch-tuesday/" target="_blank">Shavlik</a>, several of the vulnerabilities fixed with this Microsoft patches were publicly disclosed prior to this week, meaning would-be attackers have had a head start trying to figure out how to exploit them.</p>
<p>As part of a new Microsoft policy that <a href="https://krebsonsecurity.com/2016/10/microsoft-no-more-pick-and-choose-patching/" target="_blank">took effect</a> in October, home and business Windows users will no longer be able to pick and choose which updates to install and which to leave for another time. <span class="il">Consumers on <strong>Windows 7 Service Pack 1</strong> and <strong>Windows 8.1</strong> will henceforth receive what Redmond is calling a “Monthly Rollup,” which addresses both security issues and reliability issues in a single update. The “Security-only updates” option — intended for enterprises and not available via Windows Update —  will only include new security patches that are released for that month. What this means is that if any part of the patch bundle breaks, the only option is to remove the entire bundle (instead of the offending patch, as was previously possible).<span id="more-37246"></span></span></p>
<p>It’s important to note that several update types won’t be included in a rollup, including those <a href="https://helpx.adobe.com/security/products/flash-player/apsb16-39.html" target="_blank">released</a> for <strong>Adobe Flash Player</strong> on Tuesday. The latest update brings Flash to <em>v. 24.0.0.186</em> for Windows and Mac users alike. If you have Flash installed, you should update, hobble or remove Flash as soon as possible. To see which version of Flash your browser may have installed, check out <a href="http://www.adobe.com/software/flash/about/" target="_blank">this page</a>.</p>
<p>The smartest option is probably to ditch the program once and for all and significantly increase the security of your system in the process. An extremely powerful and buggy program that binds itself to the browser, Flash is a favorite target of attackers and malware. According to analysis released this month by <strong>Recorded Future</strong>, Adobe Flash vulnerabilities provided six of the top 10 vulnerabilities used by exploit kits in 2016. Exploit kits are automated tools that criminals stitch into the fabric of hacked or malicious Web sites, so that visitors who visit one of these sites with an outdated version of Flash in their browser can have malware silently installed. For some ideas about how to hobble or do without Flash (as well as slightly less radical solutions) check out <a href="http://krebsonsecurity.com/2015/06/a-month-without-adobe-flash-player/" target="_blank">A Month Without Adobe Flash Player</a>.</p>
<div id="attachment_37248" style="width: 590px" class="wp-caption aligncenter"><img class="size-medium wp-image-37248" src="media/fb707bb0.flash-kit-580x467.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/12/flash-kit-580x467.png" alt="Image: RecordedFuture" width="580" height="467" srcset="http://krebsonsecurity.com/wp-content/uploads/2016/12/flash-kit-580x467.png 580w, http://krebsonsecurity.com/wp-content/uploads/2016/12/flash-kit.png 639w" sizes="(max-width: 580px) 100vw, 580px" /><p class="wp-caption-text">Image: RecordedFuture</p></div>
<p>If you choose to keep and update Flash, please do it today. The most recent versions of Flash should be available from the <a href="https://get.adobe.com/flashplayer/" target="_blank">Flash home page.</a> Windows users who browse the Web with anything other than <strong>Internet Explorer</strong> may need to apply this patch twice, once with IE and again using the alternative browser (Firefox, Opera, e.g.).</p>
<p><strong>Chrome </strong>and IE should auto-install the latest Flash version on browser restart (users may need to manually check for updates in and/or restart the browser to get the latest Flash version). Chrome users may need to restart the browser to install or automatically download the latest version. When in doubt, click the vertical three dot icon to the right of the URL bar, select “Help,” then “About Chrome”: If there is an update available, Chrome should install it then.</p>
<p>As always, if you experience any issues downloading or installing any of these updates, please leave a note about it in the comments below.</p>


feed_id: https://krebsonsecurity.com/?p=37228
title: ‘Operation Tarpit’ Targets Customers of Online Attack-for-Hire Services
uri: Operation-Tarpit-Targets-Customers-of-Online-Attack-for-Hire-Ser
url:
https://krebsonsecurity.com/2016/12/operation-tarpit-targets-customers-of-online-attack-for-hire-services/

content:
<p>Federal investigators in the United States and Europe last week arrested nearly three-dozen people suspected of patronizing so-called &#8220;booter&#8221; services that can be hired to knock targeted Web sites offline. The global crackdown is part of an effort by authorities to weaken demand for these services by impressing upon customers that hiring someone to launch cyberattacks on your behalf can land you in jail.</p>
<p>On Dec. 9, 2016, the <strong>U.S. Federal Bureau of Investigation</strong> (FBI) arrested <strong>Sean Sharma</strong>, a 26-year-old student at the University of California accused of using a booter service to knock a San Francisco chat service company&#8217;s Web site offline.</p>
<p>Sharma was one of almost three dozen others across 13 countries who were arrested on suspicion of paying for cyberattacks. As part of a coordinated law enforcement effort dubbed &#8220;Operation Tarpit,&#8221; investigators here and abroad also executed more than 100 so-called &#8220;knock-and-talk&#8221; interviews with booter buyers who were quizzed about their involvement but not formally charged with crimes.</p>
<div id="attachment_37232" style="width: 590px" class="wp-caption aligncenter"><a class="lightbox" href="media/1b20293d.netspoof.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/12/netspoof.png"><img class="wp-image-37232 size-medium" src="media/cf8a5431.netspoof-580x457.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/12/netspoof-580x457.png" alt="Netspoof's DDoS-for-hire packages. Image: Samsclass.info." width="580" height="457" srcset="http://krebsonsecurity.com/wp-content/uploads/2016/12/netspoof-580x457.png 580w, http://krebsonsecurity.com/wp-content/uploads/2016/12/netspoof.png 763w" sizes="(max-width: 580px) 100vw, 580px" /></a><p class="wp-caption-text">Netspoof&#8217;s DDoS-for-hire packages. Image: Samsclass.info.</p></div>
<p>Stresser and booter services leverage commercial hosting services and security weaknesses in Internet-connected devices to hurl huge volleys of junk traffic at targeted Web sites. These attacks, known as &#8220;distributed denial-of-service&#8221; (DDoS) assaults, are digital sieges aimed at causing a site to crash or at least to remain unreachable by legitimate Web visitors.</p>
<p>&#8220;DDoS tools are among the many specialized cyber crime services available for hire that may be used by professional criminals and novices alike,” said <strong>Steve Kelly</strong>, FBI unit chief of the <strong>International Cyber Crime Coordination Cell</strong>, a task force <a href="https://www.fbi.gov/audio-repository/ftw-ic4-generic-mp3-for-audio-podcasting.mp3/view" target="_blank">created earlier this year</a> by the FBI whose stated mission is to &#8216;defeat the most significant cyber criminals and enablers of the cyber underground.&#8217; “While the FBI is working with our international partners to apprehend and prosecute sophisticated cyber criminals, we also want to deter the young from starting down this path.”</p>
<p>According to <strong>Europol</strong>, the European Union&#8217;s law enforcement agency, the operation involved arrests and interviews of suspected DDoS-for-hire customers in Australia, Belgium, France, Hungary, Lithuania, the Netherlands, Norway, Portugal, Romania, Spain, Sweden, the United Kingdom, and the U.S. Europol said investigators are only warning one-time users, but aggressively pursuing repeat offenders who frequented the booter services.</p>
<p>&#8220;This successful operation marks the kick-off of a prevention campaign in all participating countries in order to raise awareness of the risk of young adults getting involved in cybercrime,&#8221; reads <a href="https://www.europol.europa.eu/newsroom/news/joint-international-operation-targets-young-users-of-ddos-cyber-attack-tools" target="_blank">a statement</a> released Monday by Europol. &#8220;Many do it for fun without realizing the consequences of their actions – but the penalties can be severe and have a negative impact on their future prospects.&#8221;</p>
<p>The arrests stemmed at least in part from successes that investigators had infiltrating a booter service operating under the name &#8220;Netspoof.&#8221; According to the <strong>U.K.&#8217;s National Crime Agency</strong>, Netspoof offered subscription packages ranging from £4 (~USD $5) to £380 (~USD $482) – with some customers paying more than £8,000 (&gt; USD $10,000) to launch hundreds of attacks. The NCA <a href="http://www.nationalcrimeagency.gov.uk/index.php/news-media/nca-news/974-operation-vulcanalia-targets-users-of-netspoof-website-attack-tool" target="_blank">said</a> twelve people were arrested in connection with the Netspoof investigation, and that victims included gaming providers, government departments, internet hosting companies, schools and colleges.</p>
<p>The Netspoof portion of last week&#8217;s operation was fueled by the arrest of Netspoof&#8217;s founder &#8212; 20-year-old U.K. resident <strong>Grant Manser</strong>. As <strong>Bleeping Computer</strong> <a href="https://www.bleepingcomputer.com/news/security/34-users-who-paid-for-ddos-attacks-arrested-by-police-101-more-questioned/" target="_blank">reports</a>, Manser&#8217;s business had 12,800 registered users, of which 400 bought his tools, launching 603,499 DDoS attacks on 224,548 targets.</p>
<p>Manser was sentenced in April 2016 to two years youth detention suspended for 18 months, as well as 100 hours of community service. According to BC&#8217;s <strong>Catalin Cimpanu</strong>, the judge in Manser&#8217;s case went easy on him because he built safeguards in his tools that prevented customers from attacking police, hospitals and government institutions.<span id="more-37228"></span></p>
<h4>ANALYSIS</h4>
<p>As a journalist who <a href="https://krebsonsecurity.com/tag/booter/" target="_blank">has long sought to expose the booter and stresser industry</a> and those behind it, this action has been a long time coming. The past three to four years have witnessed a dramatic increase in the number and sophistication of booter services.</p>
<p>In September 2016, this site was the recipient of a record-sized DDoS attack that knocked this site offline for several days. The attack came hours after <a href="http://krebsonsecurity.com/2016/09/israeli-online-attack-service-vdos-earned-600000-in-two-years/" target="_blank">a story I wrote about the now-defunct booter service vDOS</a> was punctuated by <a href="https://krebsonsecurity.com/2016/09/alleged-vdos-proprietors-arrested-in-israel/" target="_blank">the arrest of two 18-year-old Israeli men</a> allegedly tied to the business. I was able to track them down because vDOS had been massively hacked, and huge troves of data from the service&#8217;s servers were shared with KrebsOnSecurity.</p>
<p>vDOS had been in business for four years, but records about how much the business made were incomplete; only two years&#8217; worth of DDoS customer data was available (the rest had apparently been wiped from the server). But in that two years, the records showed that more than 150,000 customer paid in excess of $600,000 to launch DDoS attacks on targeted sites.</p>
<div id="attachment_36219" style="width: 590px" class="wp-caption aligncenter"><a class="lightbox" href="media/2ddc22a8.vdoshome.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/09/vdoshome.png"><img class="wp-image-36219 size-medium" src="media/fa2da85d.vdoshome-580x379.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/09/vdoshome-580x379.png" alt="The vDos home page." width="580" height="379" srcset="http://krebsonsecurity.com/wp-content/uploads/2016/09/vdoshome-580x379.png 580w, http://krebsonsecurity.com/wp-content/uploads/2016/09/vdoshome-768x502.png 768w, http://krebsonsecurity.com/wp-content/uploads/2016/09/vdoshome-940x615.png 940w, http://krebsonsecurity.com/wp-content/uploads/2016/09/vdoshome.png 1191w" sizes="(max-width: 580px) 100vw, 580px" /></a><p class="wp-caption-text">The vDos home page.</p></div>
<p>The demise of vDOS exposed a worrying trend in DDoS-for-hire attack services: The rise of hyper-powered booter services capable of launching attacks that can disrupt operations at even the largest of Web sites and hosting providers.</p>
<p>Hours after the Septemeber attack swept KrebsOnSecurity offline, the same attackers hit French hosting giant <strong>OVH</strong> with an even larger DDoS-for-hire attack. On Oct. 21, 2016, Internet infrastructure provider <a href="https://krebsonsecurity.com/2016/10/hacked-cameras-dvrs-powered-todays-massive-internet-outage/" target="_blank">Dyn was hit by a very similar attack</a>. All three attacks involved collections of hacked computers powered by DDoS-based malware called &#8220;<strong>Mirai</strong>.&#8221; This malware doesn&#8217;t infect Windows computers, but instead worms its way into Linux-based systems that run on many consumer hardware products like wireless routers, security cameras and digital video recorders that are left operating in factory-default (insecure) settings.</p>
<p>Security experts say the crime machine that caused problems for Dyn was not the same one that was used to knock my site offline in September. That&#8217;s because at the beginning of October the miscreant responsible for creating Mirai <a href="https://krebsonsecurity.com/2016/10/source-code-for-iot-botnet-mirai-released/" target="_blank">leaked the source code for the malware online</a>. Since then, dozens of new Mirai robot networks or &#8220;botnets&#8221; have been spotted being used to launch cyberattacks &#8212; including the one used to attack Dyn. And in some cases, the criminals at the helm of these weapons of mass disruption are renting out &#8220;slices&#8221; or shares of the botnet to other crooks, typically at the rate of several thousand dollars per week.</p>
<p>I applaud last week&#8217;s actions here in the United States and abroad, as I believe many booter service customers patronize them out of some rationalization that doing so isn&#8217;t a serious crime. The typical booter service customer is a teenage male who is into online gaming and is seeking a way to knock a rival team or server offline &#8212; sometimes to settle a score or even to win a game. One of the co-proprietors of vDos, for example, was famous for DDoSsing the game server offline if his own team was about to lose &#8212; thereby preserving the team&#8217;s freakishly high &#8216;win&#8217; ratios.</p>
<p>But this is a stereotype that glosses over a serious, costly and metastasizing problem that needs urgent attention. More critically, early law enforcement intervention for youths involved in launching or patronizing these services may be key to turning otherwise bright kids away from the dark side and toward more constructive uses of their time and talents <em>before</em> they wind up in jail. I&#8217;m afraid that absent some sort of &#8220;road to Damascus&#8221; moment or law enforcement intervention, a great many individuals who initially only pay for such attacks end up getting sucked into an alluring criminal vortex of digital extortion, easy money and online hooliganism.</p>


feed_id: https://krebsonsecurity.com/?p=37257
title: My Yahoo Account Was Hacked! Now What?
uri: My-Yahoo-Account-Was-Hacked-Now-What
url: https://krebsonsecurity.com/2016/12/my-yahoo-account-was-hacked-now-what/
content:
<p>Many readers are asking what they should be doing in response to <strong>Yahoo</strong>&#8216;s <a href="https://krebsonsecurity.com/2016/12/yahoo-one-billion-more-accounts-hacked/" target="_blank">disclosure</a> Wednesday that a billion of its user accounts were hacked. Here are a few suggestions and pointers, fashioned into a good old Q&amp;A format.</p>
<div id="attachment_37270" style="width: 590px" class="wp-caption aligncenter"><img class="size-medium wp-image-37270" src="media/786c64fd.effyahoo-580x130.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/12/effyahoo-580x130.png" alt="Image: eff.org" width="580" height="130" srcset="http://krebsonsecurity.com/wp-content/uploads/2016/12/effyahoo-580x130.png 580w, http://krebsonsecurity.com/wp-content/uploads/2016/12/effyahoo-768x172.png 768w, http://krebsonsecurity.com/wp-content/uploads/2016/12/effyahoo-940x210.png 940w, http://krebsonsecurity.com/wp-content/uploads/2016/12/effyahoo.png 943w" sizes="(max-width: 580px) 100vw, 580px" /><p class="wp-caption-text">Image: eff.org</p></div>
<p><strong>Q: Was my account hacked? </strong></p>
<p>A: Experts I&#8217;ve spoken to believe Yahoo has about a billion active accounts. So, yes, it&#8217;s very likely your account&#8217;s password is compromised, and probably most of the other information you at one point entrusted to Yahoo. According to <a href="https://yahoo.tumblr.com/post/154479236569/important-security-information-for-yahoo-users" target="_blank">a statement</a> from the company, the stolen user account information may have included names, email addresses, telephone numbers, dates of birth, hashed passwords (using MD5) and, in some cases, encrypted or unencrypted security questions and answers.”</p>
<p><strong>Q: I&#8217;m not sure if I have a Yahoo account. How do I find out? </strong></p>
<p>A: This is a surprisingly complex question. Thanks to the myriad mergers and business relationships that Yahoo has forged over the years, you may have a Yahoo account and not realize it. That&#8217;s because many accounts that are managed through Yahoo don&#8217;t actually end in &#8220;yahoo.com&#8221; (or yahoo. insert country code here).</p>
<p>For example, British telecom giant <a href="https://signin1.bt.com/login/emailloginform?s_cid=con_Furl_mail&amp;utm_source=ATL&amp;utm_medium=FURL&amp;utm_content=R&amp;utm_campaign=btmail" target="_blank">BT</a> uses Yahoo for their customer email, as did/do <strong>SBCGlobal</strong>, <strong>AT&amp;T</strong> and <strong>BellSouth</strong>. Also, Verizon.net email addresses were serviced by Yahoo <a href="https://help.aol.com/articles/verizon-move-to-aol-mail-faq" target="_blank">until AOL took over</a>. Up in Canada, <strong>Rogers</strong> customers may also have Yahoo email addresses. I&#8217;m sure there are plenty of others I&#8217;m missing, but you get the point: Your Yahoo account may not include the word &#8220;yahoo&#8221; at all in the address.</p>
<p><strong>Q: I created a Yahoo account a few years ago, but Yahoo says it doesn&#8217;t exist anymore. What&#8217;s going on here? </strong></p>
<p>A: Yahoo has a policy of deactivating or deleting accounts that <a href="https://help.yahoo.com/kb/SLN2018.html" target="_blank">remain dormant for more than a year</a>. If you haven&#8217;t touched your account in years, that&#8217;s probably why.</p>
<p><strong>Q: Why would someone want to hack my email account? What could they do with it? </strong></p>
<p>A: Spam, spam, and spam. Oh, and spam. They want to spam your contacts with malware and ads for dodgy products and services. Also, it gives the bad guys direct access to any account that you have signed up for using that email address. Why? Because if the crooks have access to your inbox, they can request a password reset link be sent to your inbox from any Web site you&#8217;ve signed up with at that email address.</p>
<p>For more detail on why these lowlifes might want control over your inbox and how they can monetize that access, see one of the most-read pieces on this blog &#8212; <a href="https://krebsonsecurity.com/2013/06/the-value-of-a-hacked-email-account/" target="_blank">The Value of a Hacked Email Account</a>. NB: Accounts that are hijacked for use in spam campaigns may also be suspended or deleted by Yahoo.<span id="more-37257"></span></p>
<p><strong>Q: What the heck is an MD5? </strong></p>
<p>A: It&#8217;s an inferior password storage method that too many companies still use to protect user passwords. An MD5 &#8220;hash&#8221; is computed by taking your plain text password and running it against an algorithm that is supposed to make the output impossible to reverse. For example, the world&#8217;s worst password &#8212; &#8220;password&#8221; &#8212; always computes to the MD5 hash of &#8220;cc3a0280e4fc1415930899896574e118&#8221; (see <a href="http://www.md5hashgenerator.com/" target="_blank">this MD5 generator</a> for more examples).</p>
<p>The problem is that computing power is super cheap nowadays, and MD5s are no match for brute-force attacks that simply compare the result of hashed dictionary words and other common passwords with user password databases stored in MD5 format (i.e., if the MD5 your email provider stores for you is &#8220;cc3a0280e4fc1415930899896574e118&#8221;, then congrats on using the world&#8217;s worst password).</p>
<p>Long story short, there are vast indexes of these pre-computed MD5 hashes &#8212; known as &#8220;rainbow tables&#8221; &#8212; freely available online that can be used to quickly crack a large percentage of any MD5 password list.</p>
<p><strong>Q: So if using hashing methods like MD5 is such a lame security idea, why is Yahoo still doing this? </strong></p>
<p>A: Yahoo says this breach dates back to 2013. To its credit, Yahoo began moving away from using MD5s for new accounts in 2013 in favor of <a href="https://krebsonsecurity.com/2012/06/how-companies-can-beef-up-password-security/" target="_blank">Bcrypt, far more secure password hashing mechanism</a>. But yeah, even by 2013 anyone with half a clue in securing passwords already long ago knew that storing passwords in MD5 format was no longer acceptable and altogether braindead idea. It&#8217;s one of many reasons I&#8217;ve encouraged my friends and family to ditch Yahoo email for years.</p>
<p><strong>Q: I&#8217;ve been using Yahoo for years. If this service can&#8217;t be trusted, what would you recommend? </strong></p>
<p>A: I&#8217;ve used <strong>Google Mail (Gmail)</strong> for more than a decade, but your mileage may vary. I moved virtually all of my email activity to Gmail years ago mainly because they were among the first to offer more robust authentication and security measures, such as two-step authentication. And they continue to innovate in this space. If you&#8217;d like to migrate the messages from your Yahoo account to a Gmail account, <a href="http://www.wikihow.com/Switch-from-Yahoo!-Mail-to-Gmail" target="_blank">see these instructions</a>.</p>
<p><strong>Q: Yahoo said in some cases encrypted or unencrypted security questions and answers were stolen. Why is this a big deal?</strong></p>
<p>A: Because for years security questions have served as convenient backdoors used by criminals to defraud regular, nice people whose only real crime is that they tend to answer questions honestly. But with the proliferation of data that many people post online about themselves on social media sites &#8212; combined with the volume of public records that are indexed by various paid and free services &#8212; it&#8217;s never been easier for a stranger to answer your secret question, &#8220;What was the name of your elementary school?&#8221;</p>
<p>Don&#8217;t feel bad if you naively answered your secret questions honestly. Even criminals get their accounts hacked via easily-guessed secret questions, as evidenced by this story about the San Francisco transit extortionist who last month <a href="https://krebsonsecurity.com/2016/11/san-francisco-rail-system-hacker-hacked/" target="_blank">had his own account hacked via weak secret questions</a>.</p>
<p><strong>Q: So should I change my secret questions in my Yahoo account? Yahoo says it has &#8220;invalidated unencrypted security questions and answers so that they cannot be used to access an account,&#8221; but how do I know whether my security questions were encrypted or not?</strong></p>
<p>A: Assuming you still can, yes by all means change the answers to the security questions to something only you know. However, it&#8217;s not clear that this is still an option: I tried logging in using the secret questions on two older accounts I have and did not see that option available anymore, so it&#8217;s likely that Yahoo has disabled them altogether. Yahoo&#8217;s statement on this matter is confusing, and the company hasn&#8217;t responded yet to follow-up questions to clarify things.</p>
<p>More importantly, if you have used these questions and answers at other sites, please change those answers at the other sites now. Pro tip: If you must patronize sites that allow password and account recovery via secret questions, don&#8217;t answer the secret questions honestly. Pick answers that aren&#8217;t obvious and that can&#8217;t be found using social media or a search engine.</p>
<p><strong>Q: Yahoo also said that the intruders were able to forge &#8220;cookies.&#8221; What&#8217;s that all about?</strong></p>
<p>A: Yahoo said the attackers had worked out a way to forge cookies, text files that Yahoo places on user computers when they log in. Authentication cookies contain information about the user’s session with Yahoo, and these cookies can contain a great deal of information about the user, such as whether that user has already authenticated to the company’s servers.</p>
<p>The attackers in this case apparently found a way to forge these authentication cookies, which would have granted them to access targeted accounts without needing to supply the account’s password. In addition, a forged cookie could have allowed the attackers to remain logged into the hacked accounts for weeks or indefinitely.</p>
<p>Yahoo’s statement said the company is in the process of notifying the affected account holders, and that it has invalidated the forged cookies.</p>
<p><strong>Q: That sounds pretty bad.</strong></p>
<p>A: Yeah, that&#8217;s about as bad as it gets. It&#8217;s yet another reason I&#8217;m telling people to run away from Yahoo email.</p>
<p><strong>Q: Okay, I don&#8217;t need my account anymore, and/or I&#8217;ve transferred what I need from that account and no longer want to have an account at Yahoo. Can I delete my account? </strong></p>
<p>A: Yes, you can delete your account. Yahoo has <a href="https://help.yahoo.com/kb/SLN2044.html" target="_blank">detailed instructions here</a>. But before you do this, consider whether you have created unique relationships with any other Web sites using this email account. If so, you may lose access to those third-party Web site accounts if you no longer have access to the email inbox you used to create that relationship. Take stock of any third-party Web site user accounts you may have tied to your Yahoo inbox, and if you wish to keep those accounts you&#8217;ll probably need to log in to them separately and change the contact email address.</p>
<p><strong>Q: What else should I be concerned about as a result of this latest hack? </strong></p>
<p>A: Make sure you have not used your Yahoo password at any other sites or online accounts that you value or that hold potentially sensitive information about you. If you have, change the password at those other sites to unique, complex passwords. And stop re-using passwords: It&#8217;s probably the leading cause of account compromises.</p>
<p>Also, be on the lookout for an uptick in possibly much more targeted email phishing and malware attacks. When attackers have a lot of details about you (like the ones Yahoo said were stolen in this hack) it makes it much easier for them to craft convincing email lures. Be especially wary of clicking on links or attachments in emails you were not expecting, and never respond to login or password reset requests sent via email that you did not initiate.</p>
<p>If your mobile phone number was associated with your Yahoo account, that number may receive SMS phishing or &#8220;smishing&#8221; attacks as a result. The standard warning about clicking links applies to unbidden text messages as well.</p>
<p>Enable any and all security measures available to you at your current or new email provider. The most important steps you can take are adding a backup email account that you can use to receive messages or password resets if you somehow lose access to your account (i.e., someone figures out your password and seizes control over your account), and taking advantage of two-step or two-factor authentication. With this new feature enabled, thieves would have to know your username, password, and have access to your mobile device or impersonate you to your mobile provider in order to hijack your account. For more on which providers offer this vital security feature, see <a href="https://twofactorauth.org/" target="_blank">twofactorauth.org</a>. If you&#8217;re sticking with Yahoo despite all of the above, please make sure to take advantage of their two-step feature, called <a href="https://help.yahoo.com/kb/SLN25781.html" target="_blank">Yahoo Account Key</a>.</p>


feed_id: https://krebsonsecurity.com/?p=37299
title: Report: $3-5M in Ad Fraud Daily from ‘Methbot’
uri: Report-3-5M-in-Ad-Fraud-Daily-from-Methbot
url: https://krebsonsecurity.com/2016/12/report-3-5m-in-ad-fraud-daily-from-methbot/
content:
<p>New research suggests that an elaborate cybercrime ring is responsible for stealing between $3 million and $5 million worth of revenue from online publishers and video advertising networks each day. Experts say the scam relies on a vast network of cloaked Internet addresses, rented data centers, phony Web sites and fake users made to look like real people watching short ad segments online.</p>
<p>Online advertising fraud is a $7 billion a year problem, according to <a href="http://www.adweek.com/news/advertising-branding/whats-being-done-rein-7-billion-ad-fraud-169743" target="_blank">AdWeek</a>. Much of this fraud comes from hacked computers and servers that are infected with malicious software which forces the computers to participate in ad fraud. Malware-based ad fraud networks are cheap to acquire and to run, but they&#8217;re also notoriously unstable and unreliable because they are constantly being discovered and cleaned up by anti-malware companies.</p>
<p>Now researchers say they&#8217;ve uncovered a new class of ad robot or &#8220;bot&#8221; fraud that was designed from the ground up to keep its nose clean &#8212; running not on infected hosts but instead distributed across a vast, rented network of dedicated Web servers and computers.</p>
<div id="attachment_37313" style="width: 590px" class="wp-caption aligncenter"><img class="size-medium wp-image-37313" src="media/c375dffa.methbotfarm-580x387.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/12/methbotfarm-580x387.png" alt="The Methbot ad fraud infrastructure. Image: White Ops." width="580" height="387" srcset="http://krebsonsecurity.com/wp-content/uploads/2016/12/methbotfarm-580x387.png 580w, http://krebsonsecurity.com/wp-content/uploads/2016/12/methbotfarm-768x512.png 768w, http://krebsonsecurity.com/wp-content/uploads/2016/12/methbotfarm.png 864w" sizes="(max-width: 580px) 100vw, 580px" /><p class="wp-caption-text">The Methbot ad fraud infrastructure. Image: White Ops.</p></div>
<p>According to <a href="http://www.whiteops.com/" target="_blank">White Ops</a>, a digital advertising security company based in New York City, those rented computers are connected to a network of more than 570,000 Internet addresses apparently leased or hijacked from various sources.</p>
<p>White Ops dubbed the video ad fraud network &#8220;Methbot,&#8221; and says the individuals at the helm of this network are spending upwards of $200,000 a month just maintaining a fully automated fraud network that imitates real Web site publishers showing real viewers video-based advertisements.</p>
<p><strong>Ryan Castellucci</strong>, principal security researcher at White Ops, said Methbot&#8217;s coders built many of the fraud network&#8217;s tools from scratch &#8212; including the Web browser that each rented computer in the network uses to mimic Web sites displaying video ads. Spoofing actual news Web sites and other popular video-rich destinations, Methbot requests video ads from ad networks, and serves the ads to a vast array of bots that &#8220;watch&#8221; the videos.</p>
<p>To make each Web browsing session appear more like one generated by a human, Methbot simulates cursor clicks and mouse movements, and even forges social network login information so that it appears the user who viewed the ad was logged in to a social network at the time.</p>
<p>&#8220;They&#8217;ve written their own browser from scratch in Javascript, and this allows them to arbitrarily control the information that gets fed back to the ad networks and to companies like us who try to detect this stuff,&#8221; Castellucci said. <span class="pullquote pqright">&#8220;This has allowed Methbot to scale to beyond anything the industry has seen before, putting it in a new class of ad fraud.&#8221;</span></p>
<p>Interestingly, the registration records for virtually all of those Internet addresses have been forged so they appear to be controlled by some of the world&#8217;s largest Internet service providers (ISPs).</p>
<p>For instance, one of the many Internet addresses White Ops says was used by Methbot &#8212; <a href="https://whois.domaintools.com/196.62.126.117" target="_blank">196.62.126*117</a> &#8212; is registered in October 2015 to <strong>AT&amp;T Services Inc.</strong>, but the contact address is &#8220;<strong>adw0rd.yandex.ru@gmail.com</strong>&#8221; (the letter &#8220;o&#8221; is a zero). Adw0rd is no doubt a play on <a href="https://en.wikipedia.org/wiki/AdWords" target="_blank">Google Adwords</a>, an online advertising service where advertisers pay to display brief advertising copy to Web users.</p>
<p>Another address tied to Methbot &#8212; <a href="https://whois.domaintools.com/196.62.3.117" target="_blank">196.62.3*117</a> &#8212; is registered to the same adw0rd.yandex.ru@gmail.com account but also to &#8220;<strong>Comcast Cable Communications, Inc.</strong>&#8221; Records for another Methbot IP &#8212; <a href="https://whois.domaintools.com/161.8.252.0" target="_blank">161.8.252.*</a> &#8212; says the address is owned by &#8220;<strong>Verizon Trademark Services LLC.</strong>&#8221;</p>
<p>Whoever dreamed up Methbot clearly spent a great deal of time and money building the fraud machine. For example, White Ops says the address space alone used by this ad fraud operation has a current market value of approximately $4 million. A full list of the <a href="http://www.whiteops.com/methbot/IPs.txt" target="_blank">570,000+ Internet addresses</a> used by Methbot is published in the White Ops <a href="http://www.whiteops.com/methbot" target="_blank">report page</a>.</p>
<p>&#8220;Methbot operators invested significant time, research, development, and resources to build infrastructure designed to remove these limitations and provide them with unlimited scale,&#8221; White Ops said in its report. &#8220;They created dedicated data centers to support proxy networks in order to hide the single origin source of their operation. This is the first time we’ve seen data centers impersonating residential internet connections. This makes the scale of this operation virtually unlimited, with none of the typical durability issues of maintaining a constant base of infected user machines.&#8221;</p>
<div id="attachment_37312" style="width: 590px" class="wp-caption aligncenter"><img class="size-medium wp-image-37312" src="media/381d422b.adbotrevenues-580x281.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/12/adbotrevenues-580x281.png" alt="Methbot is thought to have made quite a bit more than malware-based ad bots that came before it. Source: White Ops." width="580" height="281" srcset="http://krebsonsecurity.com/wp-content/uploads/2016/12/adbotrevenues-580x281.png 580w, http://krebsonsecurity.com/wp-content/uploads/2016/12/adbotrevenues-768x373.png 768w, http://krebsonsecurity.com/wp-content/uploads/2016/12/adbotrevenues.png 872w" sizes="(max-width: 580px) 100vw, 580px" /><p class="wp-caption-text">Methbot is thought to have helped steal quite a bit more ad revenue than malware-based ad bots that came before it. Source: White Ops.</p></div>
<p>White Ops said it estimated the earning potential of Methbot by looking at the number of phony video ad impressions it could serve up and the average cost to advertisers for displaying those ads. Assuming an average CPM (cost per mille, or per thousand number of impressions) of $13, the company estimates Methbot has the ability to serve between two million and three million impressions each day, with a daily revenue ranging from $2.6 million to $5.2 million.<span id="more-37299"></span></p>
<h4>WHO RUNS METHBOT?</h4>
<p>White Ops&#8217;s report doesn&#8217;t delve much into the possible actors behind this ad fraud network, but there are a couple of tantalizing clues in their findings. White Ops found that the Methbot network originally used a program called <a href="http://zombie.js.org/" target="_blank">Zombie</a> to test the ad code in a simulated Web browser environment, but that later the Methbot team built their own Javascript-based browser. The report also notes that Methbot employs a program called &#8220;<strong>Cheerio</strong>&#8221; to parse the HTML rendered by the video ads.</p>
<p>Both Zombie and Cheerio show up in <a href="http://pyha.ru/forum/topic/9211" target="_blank">this October 2015 discussion thread</a> on the Russian-language tech forum <strong>pyha[dot]ru. </strong>That thread was started by a developer using the nickname &#8220;adw0rd,&#8221; the same nickname listed in the phony ISP internet address ranges used by Methbot. A glance at adw0rd&#8217;s profile on pyha[dot]ru shows the user is from St. Petersburg, Russia and that his email is <strong>adw0rd@pyha.ru</strong>.</p>
<p>The <a href="http://adw0rd.com/contacts/" target="_blank">&#8220;contact&#8221; page for adw0rd[dot]com</a> (again, with a zero) includes that same email address, and says the account belongs to a software developer named <strong>Mikhail Andreev</strong>. That page at adw0rd.com says Andreev also has the account &#8220;adw0rd&#8221; on <a href="http://www.facebook.com/adw0rd" target="_blank">Facebook</a>, <a href="https://plus.google.com/106315794105249568050?rel=author" target="_blank">Google</a>, <a href="http://twitter.com/adw0rd" target="_blank">Twitter</a>, <a href="http://ru.linkedin.com/in/adw0rd" target="_blank">LinkedIn</a>, <a href="http://github.com/adw0rd" target="_blank">Github</a> and <a href="http://vk.com/adw0rd" target="_blank">Vkontakte</a> (a Russian version of Facebook). A look back at programming projects dating to 2008 for adw0rd can be <a href="https://web-beta.archive.org/web/20120414100804/adw0rd.ru" target="_blank">found via archive.org</a>. Andreev did not respond to requests for comment.</p>
<p>The &#8220;abuse&#8221; contact email address listed on many of the Internet address ranges that White Ops tied to Methbot was &#8220;stepanenko.aa@mmk.ru,&#8221; someone who appears to have at least at one time <a href="https://local.com.ua/forum/topic/47545-%D1%80%D0%B0%D0%B7%D0%B4%D0%B0%D0%BC-%D0%B2-%D0%B0%D1%80%D0%B5%D0%BD%D0%B4%D1%83-24-%D0%B7%D0%B0-100%D0%B3%D0%BE%D0%B4/page-6" target="_blank">acted as a broker of Internet addresses</a>. That same &#8220;stepanenko&#8221; email address also appears on the <a href="http://is-mmk.ru/about/contacts/" target="_blank">official contacts page</a> for an <strong>Alexey A. Stepanenko</strong>, senior manager of support group IT management systems within the telecommunications infrastructure at <a href="https://en.wikipedia.org/wiki/Magnitogorsk_Iron_and_Steel_Works" target="_blank">Magnitogorst Iron &amp; Steel Works</a>, the third largest steel company in Russia.</p>


feed_id: https://krebsonsecurity.com/?p=37245
title: Before You Pay that Ransomware Demand…
uri: Before-You-Pay-that-Ransomware-Demand
url: https://krebsonsecurity.com/2016/12/before-you-pay-that-ransomware-demand/
content:
<p>A decade ago, if a desktop computer got infected with malware the chief symptom probably was an intrusive browser toolbar of some kind. Five years ago you were more likely to get whacked by a banking trojan that stole all your passwords and credit card numbers. These days if your mobile or desktop computer is infected what gets installed is likely to be &#8220;ransomware&#8221; &#8212; malicious software that locks your most prized documents, songs and pictures with strong encryption and then requires you to pay for a key to unlock the files.</p>
<p>Here&#8217;s some basic advice about where to go, what to do &#8212; and what <em>not to do</em> &#8212; when you or someone you know gets hit with ransomware.</p>
<div id="attachment_37362" style="width: 590px" class="wp-caption aligncenter"><img class="wp-image-37362 size-medium" src="media/c5ec7e8f.needhelp-580x200.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/12/needhelp-580x200.png" alt="Image: nomoreransom.org" width="580" height="200" srcset="http://krebsonsecurity.com/wp-content/uploads/2016/12/needhelp-580x200.png 580w, http://krebsonsecurity.com/wp-content/uploads/2016/12/needhelp-768x265.png 768w, http://krebsonsecurity.com/wp-content/uploads/2016/12/needhelp.png 871w" sizes="(max-width: 580px) 100vw, 580px" /><p class="wp-caption-text">Image: nomoreransom.org</p></div>
<p>First off &#8212; breathe deep and try not to panic. And don&#8217;t pay the ransom.</p>
<p>True, this may be easier said than done: In many cases the ransom note that hijacks the victim&#8217;s screen is accompanied by a digital clock ominously ticking down the minutes and seconds from 72 hours. When the timer expires, the ransom demand usually goes up or even doubles. Continue to ignore the demands and your files will be gone, kaput, nil, nyet, zilch, done forever, warns the extortion message.</p>
<p>See, the key objective of ransomware is a psychological one &#8212; to instill fear, uncertainty and dread in the victim &#8212; and to sow the conclusion in the victim&#8217;s mind that any solution for restoring full access to all his files involves paying up. Indeed, paying the ransom is often the easiest, fastest and most complete way of reversing a security mistake, such as failing to patch, opening a random emailed document e.g., or clicking a link that showed up unbidden in instant message. Some of the more advanced and professional ransomware operations have included helpful 24/7 web-based tech support.</p>
<div id="attachment_37365" style="width: 590px" class="wp-caption aligncenter"><a class="lightbox" href="media/30935715.lockyransom.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/12/lockyransom.png"><img class="wp-image-37365 size-medium" src="media/e9485f20.lockyransom-580x448.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/12/lockyransom-580x448.png" alt="The ransom note from a recent version of the &quot;Locky&quot; ransomware variant. Image: Bleepingcomputer.com." width="580" height="448" srcset="http://krebsonsecurity.com/wp-content/uploads/2016/12/lockyransom-580x448.png 580w, http://krebsonsecurity.com/wp-content/uploads/2016/12/lockyransom-768x593.png 768w, http://krebsonsecurity.com/wp-content/uploads/2016/12/lockyransom.png 845w" sizes="(max-width: 580px) 100vw, 580px" /></a><p class="wp-caption-text">The ransom note from a recent version of the &#8220;Locky&#8221; ransomware variant. Image: Bleepingcomputer.com.</p></div>
<p>Paying up is certainly not the cheapest option. The average ransom demanded is approximately $722, according to <a href="http://www.zdnet.com/article/two-thirds-of-companies-pay-ransomware-demands-but-not-everyone-gets-their-data-back/" target="_blank">an analysis</a> published in September by <strong>Trend Micro</strong>. Interestingly, Trend found the majority of organizations that get infected by ransomware end up paying the ransom. They also found three-quarters of companies which had not suffered a ransomware infection reported they would not pay up when presented with a data ransom demand. Clearly, people tend to see things differently when they&#8217;re the ones in the hot seat.</p>
<p>And for those not yet quite confident in the ways of Bitcoin (i.e. most victims), paying up means a crash course in acquiring the virtual currency known as Bitcoin. Some ransomware attackers are friendlier than others in helping victims wade through the process of setting up an account to handle Bitcoin, getting it funded, and figuring out how to pay other people with it. Others just let you figure it all out. The entire ordeal is a trial by fire for sure, but it can also be a very expensive, humbling and aggravating experience.</p>
<p>In the end the extortionist <a href="https://krebsonsecurity.com/2016/11/san-francisco-rail-system-hacker-hacked/" target="_blank">may bargain with you if they&#8217;re in a good mood, or if you have a great sob story</a>. But they still want you to know that your choice is a binary one: Pay up, or kiss your sweet files goodbye forever.</p>
<p>This scenario reminds me of the classic short play/silent movie about the villainous landlord and the poor young lady who can&#8217;t pay the rent. I imagine the modern version of this play might go something like&#8230;</p>
<p><img class="alignright wp-image-37345 size-full" src="media/ddcba529.mustpaytherent.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/12/mustpaytherent.png" alt="mustpaytherent" width="336" height="239" />Villain: You MUST pay the ransom!</p>
<p>Victim: I CAN&#8217;T pay the ransom!</p>
<p>Villain: You MUST pay the ransom!</p>
<p>Victim: I CAN&#8217;T pay the ransom!</p>
<p>Hero: I&#8217;ll pay the ransom!</p>
<p>Victim: Oh! My hero!</p>
<p>Villain: Curses! Foiled again!</p>
<p>Okay, nobody&#8217;s going to pay the ransomware demand for you (that&#8217;s only in Hollywood!). But just like the hero in the silent movie, there are quite a few people out there who are in fact working hard to help victims avoid paying the ransom (AND get their files back to boot).</p>
<p>Assuming you don&#8217;t have a recent backup you can restore, fear not: With at least some strains of ransomware, the good guys have already worked out a way to break or sidestep the encryption, and they&#8217;ve posted the keys needed to unlock these malware variants free of charge online.</p>
<p>But is the strain that hit your device one that experts already know how to crack? <span id="more-37245"></span></p>
<h4>WHERE TO GO?</h4>
<p>The first place victims should look to find out is <a href="https://nomoreransom.org" target="_blank">nomoreransom.org</a>, a site backed by security firms and cybersecurity organizations in 22 countries. Since its launch on July 25, 2016, nomoreransom.org estimates that it has been able to save 6,000 victims of ransomware more than $2 million USD to date. Last week the group announced the site is now available in Dutch, French, Italian, Portuguese and Russian.</p>
<p><img class="aligncenter size-full wp-image-37354" src="media/645540ba.ransomnote.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/12/ransomnote.png" alt="ransomnote" width="401" height="64" /></p>
<p>Visit <a href="https://www.nomoreransom.org/crypto-sheriff.php" target="_blank">the Crypto Sheriff page</a> at nomoreransom.org, upload one of the files encrypted by the ransomware, and the site will let you know if there is a solution available to unlock all of your files for free.</p>
<p>Another destination that may be useful for ransomware victims is <a href="https://www.bleepingcomputer.com/" target="_blank">bleepingcomputer.com</a>, which has an excellent <a href="https://www.bleepingcomputer.com/forums/f/239/ransomware-help-tech-support/" target="_blank">Ransomware Help and Tech Support section</a> that is quite useful and may save you a great deal of time and money. But please don&#8217;t just create an account here and cry for help. Your best bet is to read the &#8220;pinned&#8221; notes at the top of that section and follow the instructions carefully.</p>
<p>Chances are, whoever responds to your request will want you to have run a few tools to help identify which strain of ransomware hit your system before agreeing to help. So please be patient and be kind, and remember that if someone decides to help you here they are likely doing so out of their own time and energy.</p>
<div id="attachment_37368" style="width: 590px" class="wp-caption aligncenter"><a class="lightbox" href="media/3a3bba54.BPransomguides.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/12/BPransomguides.png"><img class="wp-image-37368 size-medium" src="media/49dba4ba.BPransomguides-580x750.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/12/BPransomguides-580x750.png" alt="Bleepingcomputer.com's ransomware guide." width="580" height="750" srcset="http://krebsonsecurity.com/wp-content/uploads/2016/12/BPransomguides-580x750.png 580w, http://krebsonsecurity.com/wp-content/uploads/2016/12/BPransomguides.png 759w" sizes="(max-width: 580px) 100vw, 580px" /></a><p class="wp-caption-text">Bleepingcomputer.com&#8217;s ransomware guide.</p></div>
<h4>HOW NOT TO BE THE NEXT RANSOMWARE VICTIM</h4>
<p>Regularly backup your data, and make sure the backups are not connected to the computers and networks they are backing up. Most ransomware variants can encrypt files on any attached drives or network files that are also accessible to the host machine (<a href="https://krebsonsecurity.com/2016/01/ransomware-a-threat-to-cloud-services-too/" target="_blank">including cloud hosting and cloud-based backups</a> if those passwords are stored on the machine). Bleepingcomputer&#8217;s <strong>Lawrence Abrams</strong> just published this a nice primer called <a href="https://www.bleepingcomputer.com/news/security/how-to-protect-and-harden-a-computer-against-ransomware/" target="_blank">How to Protect and Harden a Computer Against Ransomware</a>.</p>
<p>Many companies are now selling products that claim to block ransomware attacks. Those claims are beyond the scope of this article, but don&#8217;t be lulled into thinking these products will always protect you.</p>
<p>Even products that could somehow block all ransomware attacks can&#8217;t prevent the biggest reason that ransomware attacks succeed: They trick victims into taking an action that inadvertently undermines the security of their device &#8212; be it a smart phone, tablet or desktop computer.</p>
<p>This usually involves clicking a link or downloading and opening a file that arrives in an email or instant message. In either case, it is an action that opens the door to the attacker to download and install malware.</p>
<p>Remember my Three Rules of Online Security:</p>
<div id="attachment_9818" style="width: 196px" class="wp-caption alignright"><img class=" wp-image-9818" src="media/0ebd79d0.three-300x300.jpg" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2011/05/three-300x300.jpg" alt="...For Online Safety." width="186" height="186" srcset="http://krebsonsecurity.com/wp-content/uploads/2011/05/three-150x150.jpg 150w, http://krebsonsecurity.com/wp-content/uploads/2011/05/three-300x300.jpg 300w" sizes="(max-width: 186px) 100vw, 186px" /><p class="wp-caption-text">&#8230;For Online Safety.</p></div>
<p><strong>1: If you didn&#8217;t go looking for it, don&#8217;t install it.</strong></p>
<p><strong>2: If you installed it, update it.</strong></p>
<p><strong>3: If you no longer need it (or, if it&#8217;s become too big of a security risk) get rid of it.</strong></p>
<p>These rules apply no matter what device you use to get online, but I&#8217;ll add a few recommendations here that are more device-specific. For desktop users, some of the biggest risks come from insecure browser plugins, as well as malicious <strong>Microsoft Office</strong> documents and <a href="https://krebsonsecurity.com/?s=macros&amp;x=0&amp;y=0" target="_blank">&#8220;macros&#8221;</a> sent via email and disguised as invoices or other seemingly important, time-sensitive documents.</p>
<p>Microsoft has macros turned off by default in most modern Office versions because they allow attackers to take advantage of resources on the target&#8217;s computer that could result in running code on the system. So understand that responding affirmatively to an &#8220;Enable Macros?&#8221; prompt in an Office document you received externally and were not expecting is extremely risky behavior.</p>
<p>Enterprises can use a variety of group policy changes to harden their defenses against ransomware attacks, such as <a href="http://www.thewindowsclub.com/block-macro-malware-microsoft-office" target="_blank">this one</a> which blocks macros from opening and automatically running in Office programs on Windows 10. Other ransomware-specific group policy guides are <a href="http://www.questiondriven.com/2016/03/07/how-to-prevent-ransomware-infections/" target="_blank">here</a>, <a href="https://bartblaze.blogspot.com/p/ransomware-prevention.html" target="_blank">here</a> and <a href="https://www.bleepingcomputer.com/virus-removal/cryptolocker-ransomware-information" target="_blank">here</a> (happy to add more &#8220;here&#8217;s&#8221; here if they are worthy, <a href="https://krebsonsecurity.com/about/" target="_blank">let me know</a>).</p>
<p>Also, get rid of or hobble notoriously insecure, oft-targeted browser plugins that require frequent security updates &#8212; like <a href="https://krebsonsecurity.com/?s=junk+java&amp;x=0&amp;y=0" target="_blank">Java</a> and <a href="https://krebsonsecurity.com/2015/06/a-month-without-adobe-flash-player/" target="_blank">Flash</a>. If you&#8217;re not good about updating these programs frequently, you may fall victim to an exploit kit that delivers ransomware. Exploit kits are malicious programs made to be stitched into hacked or malicious Web sites. People who visit these sites or who are redirected to them and who are browsing the Web with an outdated version of Flash or Java can have malware automatically and quietly installed.</p>
<p>Mobile users in general need to spend just a tiny fraction more time discerning the origin and reputation of the applications they wish to install, as mobile ransomware variants tend to mimic or even piggyback on popular games and applications found in app stores and other places. Don&#8217;t just download the first app that matches your search. And always download from the original source whenever possible to ensure you&#8217;re not getting a copycat, counterfeit or malicious version of the game or application that you&#8217;re seeking.</p>
<p>For more tips on how not to become the next ransomware victim, check out the bottom half of the FBI&#8217;s <a href="https://www.ic3.gov/media/2016/160915.aspx" target="_blank">most recent advisory on the topic</a>.</p>


feed_id: https://krebsonsecurity.com/?p=37383
title: Holiday Inn Parent IHG Probes Breach Claims
uri: Holiday-Inn-Parent-IHG-Probes-Breach-Claims
url: https://krebsonsecurity.com/2016/12/holiday-inn-parent-ihg-probes-breach-claims/
content:
<p><strong>InterContinental Hotels Group (IHG)</strong>, the parent company for more than 5,000 hotels worldwide including <strong>Holiday Inn</strong>, says it is investigating claims of a possible credit card breach at some U.S. locations.</p>
<div id="attachment_37384" style="width: 590px" class="wp-caption aligncenter"><img class="wp-image-37384 size-medium" src="media/efab030b.ihg-ny-580x356.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/12/ihg-ny-580x356.png" alt="An Intercontinental hotel in New York City. Image: IHG" width="580" height="356" srcset="http://krebsonsecurity.com/wp-content/uploads/2016/12/ihg-ny-580x356.png 580w, http://krebsonsecurity.com/wp-content/uploads/2016/12/ihg-ny-768x471.png 768w, http://krebsonsecurity.com/wp-content/uploads/2016/12/ihg-ny-940x576.png 940w, http://krebsonsecurity.com/wp-content/uploads/2016/12/ihg-ny.png 943w" sizes="(max-width: 580px) 100vw, 580px" /><p class="wp-caption-text">An Intercontinental hotel in New York City. Photo: IHG.</p></div>
<p>Last week, KrebsOnSecurity began hearing from sources who work in fraud prevention at different financial institutions. Those sources said they were seeing a pattern of fraud on customer credit and debit cards that suggested a breach at some IHG properties &#8212; particularly Holiday Inn and <strong>Holiday Inn Express</strong> locations.</p>
<p>Asked about the fraud patterns reported by my sources, a spokesperson for IHG said the company had received similar reports, and that it has hired an outside security firm to help investigate. IHG also issued the following statement:</p>
<blockquote><p>&#8220;IHG takes the protection of payment card data very seriously. We were made aware of a report of unauthorized charges occurring on some payment cards that were recently used at a small number of U.S.-based hotel locations.  We immediately launched an investigation, which includes retaining a leading computer security firm to provide us with additional support.  We continue to work with the payment card networks.&#8221;</p>
<p>&#8220;We are committed to swiftly resolving this matter. In the meantime, and in line with best practice, we recommend that individuals closely monitor their payment card account statements.  If there are unauthorized charges, individuals should immediately notify their bank. Payment card network rules generally state that cardholders are not responsible for such charges.&#8221;</p></blockquote>
<p>Headquartered in Denham, U.K., IHG operates more than 5,000 hotels across nearly 100 countries. The company&#8217;s <a href="https://www.ihgplc.com/our-brands" target="_blank">dozen brands</a> include Holiday Inn, Holiday Inn Express, <strong>InterContinental</strong>, <strong>Kimpton Hotels</strong>, and <strong>Crowne Plaza</strong>.<span id="more-37383"></span></p>
<p>Card-stealing cyber thieves have broken into some of the largest hotel chains over the past few years. Hotel brands that have acknowledged card breaches over the last year after prompting by KrebsOnSecurity include <a href="https://krebsonsecurity.com/2016/09/kimpton-hotels-acknowledges-data-breach/" target="_blank">Kimpton Hotels</a>, <a href="http://krebsonsecurity.com/2015/07/banks-card-breach-at-trump-hotel-properties/" target="_blank">Trump Hotels</a> (<a href="http://krebsonsecurity.com/2016/04/sources-trump-hotels-breached-again/" target="_blank">twice</a>), <a href="http://krebsonsecurity.com/2015/09/banks-card-breach-at-hilton-hotel-properties/" target="_blank">Hilton</a>, <a href="http://krebsonsecurity.com/2015/03/credit-card-breach-at-mandarian-oriental/" target="_blank">Mandarin Oriental</a>, and <a href="http://krebsonsecurity.com/2014/01/hotel-franchise-firm-white-lodging-investigates-breach/" target="_blank">White Lodging</a> (<a href="http://krebsonsecurity.com/2015/04/white-lodging-confirms-second-breach/" target="_blank">twice</a>). Card breaches also have hit hospitality chains <a href="http://krebsonsecurity.com/2015/11/starwood-hotels-warns-of-credit-card-breach/" target="_blank">Starwood Hotels</a> and <a href="http://krebsonsecurity.com/2016/01/hyatt-card-breach-hit-250-hotels-in-50-nations/" target="_blank">Hyatt</a>.<span id="more-36174"></span></p>
<p>In many of those incidents, thieves planted malicious software on the point-of-sale devices at restaurants and bars inside of the hotel chains. Point-of-sale based malware has driven most of the credit card breaches over the past two years, including intrusions at <a href="https://krebsonsecurity.com/?s=target+breach&amp;x=0&amp;y=0" target="_blank">Target</a> and <a href="https://krebsonsecurity.com/?s=home+depot+breach&amp;x=0&amp;y=0" target="_blank">Home Depot</a>, as well as breaches at <a href="https://krebsonsecurity.com/?s=point-of-sale+vendor&amp;x=0&amp;y=0" target="_blank">a slew of point-of-sale vendors</a>. The malware usually is installed via hacked remote administration tools. Once the attackers have their malware loaded onto the point-of-sale devices, they can remotely capture data from each card swiped at that cash register.</p>
<p>Thieves can then <a href="https://krebsonsecurity.com/2014/06/peek-inside-a-professional-carding-shop/" target="_blank">sell that data to crooks</a> who specialize in encoding the stolen data onto any card with a magnetic stripe, and using the cards to purchase high-priced electronics and gift cards from big-box stores like Target and Best Buy.</p>
<p>Readers should remember that they’re not liable for fraudulent charges on their credit or debit cards, but they still have to report the unauthorized transactions. There is no substitute for keeping a close eye on your card statements. Also, consider using credit cards instead of debit cards; having your checking account emptied of cash while your bank sorts out the situation can be a hassle and lead to secondary problems (bounced checks, for instance).</p>


feed_id: https://krebsonsecurity.com/?p=37393
title: Happy Seventh Birthday, KrebsOnSecurity!
uri: Happy-Seventh-Birthday-KrebsOnSecurity
url: https://krebsonsecurity.com/2016/12/happy-seventh-birthday-krebsonsecurity/
content:
<p>Hard to believe it&#8217;s time to celebrate another go &#8217;round the Sun for KrebsOnSecurity! Today marks exactly seven years since I left <em>The Washington Post</em> and started this here solo thing. And what a remarkable year 2016 has been!</p>
<p><img class="aligncenter wp-image-37395" src="media/cf88ecab.7-2016.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/12/7-2016.png" alt="7-2016" width="590" height="613" /></p>
<p>The word cloud above includes a sampling of tags used in stories on KrebsOnSecurity throughout the past year. It&#8217;s been a wild one, riddled with huge attacks, <a href="https://krebsonsecurity.com/?s=arrest&amp;x=0&amp;y=0" target="_blank">big cybercriminal busts</a> and of course a <a href="https://krebsonsecurity.com/?s=breach&amp;x=0&amp;y=0" target="_blank">whole mess of data breaches</a>.</p>
<p>The biggest attack of all &#8212; the <a href="https://krebsonsecurity.com/2016/09/krebsonsecurity-hit-with-record-ddos/" target="_blank">620 Gbps distributed denial-of-service (DDoS) assault against this site on Sept. 22</a> &#8212; resulted in KrebsOnSecurity being unplugged for several days. The silver lining? I now have a stronger site and readership. Through it all, the community that has grown up around this site was extremely supportive and encouraging. I couldn&#8217;t be prouder of this community, so a huge THANK YOU to all of my readers, both new and old.</p>
<p>It&#8217;s fair to say that many of the subjects in the word cloud above are going to continue to haunt us in 2017, particularly <a href="https://krebsonsecurity.com/?s=ransomware&amp;x=0&amp;y=0" target="_blank">ransomware</a>, <a href="https://krebsonsecurity.com/tag/ceo-fraud/" target="_blank">CEO fraud</a> and <a href="https://krebsonsecurity.com/?s=ddos&amp;x=0&amp;y=0" target="_blank">DDoS attacks</a>. I am hopeful to have more on the &#8220;who&#8221; behind the September attacks against this site in the New Year. I promise it&#8217;s going to be a story worth waiting for. Stay tuned.<span id="more-37393"></span></p>
<p>Also, many of you have asked whether we can have a more responsive theme on this blog. It is true that the site hasn&#8217;t been updated appearance-wise since it launched seven years ago, and that it&#8217;s long overdue for a facelift. We were on track to have that done by today&#8217;s blog post, but for a variety of reasons this will have to wait until the early New Year. Thank you for your patience.</p>
<p>My aim from the beginning with this site has been to focus on producing original, impactful reporting on computer security and cybercrime, and to keep the content free for anyone and everyone. That remains my intention. For those of you who have <a href="https://en.wikipedia.org/wiki/AdBlock" target="_blank">Adblock</a> installed, please consider adding an exception for my site: For security reasons (see <a href="https://en.wikipedia.org/wiki/Malvertising" target="_blank">malvertising</a> for more info), this site has not allowed third-party content since <a href="https://krebsonsecurity.com/2011/11/attemped-malvertising-on-krebsonsecurity-com/" target="_blank">late 2011</a>, and all of the handful of ads that run here are hosted locally and have been fully vetted.</p>
<p>As always, below are links to some of the most-read stories on the site this year. Thanks again for your readership, encouragement and support!</p>
<p><a href="https://krebsonsecurity.com/2016/10/hacked-cameras-dvrs-powered-todays-massive-internet-outage/" target="_blank">Oct. 21: Hacked Cameras, DVRs Powered Today’s Massive Internet Outage</a></p>
<p><a href="https://krebsonsecurity.com/2016/10/who-makes-the-iot-things-under-attack/" target="_blank">Oct. 3: Who Makes the IoT Things Under Attack?</a></p>
<p><a href="https://krebsonsecurity.com/2016/09/the-democratization-of-censorship/" target="_blank">Sept. 25: The Democratization of Censorship</a></p>
<p><a href="https://krebsonsecurity.com/2016/09/secret-service-warns-of-periscope-skimmers/" target="_blank">Sept. 13: Secret Service Warns of &#8216;Periscope&#8217; Skimmers</a></p>
<p><a href="https://krebsonsecurity.com/2016/09/alleged-vdos-proprietors-arrested-in-israel/" target="_blank">Sept. 10: Alleged vDOS Proprietors Arrested in Israel</a></p>
<p><a href="https://krebsonsecurity.com/2016/09/israeli-online-attack-service-vdos-earned-600000-in-two-years/" target="_blank">Sept. 8: Israeli Online Attack Service &#8216;vDOS&#8217; Earned $600,000 in Two Years</a></p>
<p><a href="https://krebsonsecurity.com/2016/08/inside-the-attack-that-almost-broke-the-internet/" target="_blank">Aug. 26: Inside &#8216;The Attack that Almost Broke the Internet&#8217;</a></p>
<p><a href="https://krebsonsecurity.com/2016/02/this-is-why-people-fear-the-internet-of-things/" target="_blank">Feb. 18: This is Why People Fear the Internet of Things</a></p>
<p><a href="https://krebsonsecurity.com/2016/02/the-great-emv-fake-out-no-chip-for-you/" target="_blank">Feb. 16: The Great EMV Fakeout: No Chip for You!</a></p>
<p><a href="https://krebsonsecurity.com/2016/01/sources-security-firm-norse-corp-imploding/" target="_blank">Jan. 30: Sources: Security Firm Norse Corp. Imploding</a></p>


feed_id: https://krebsonsecurity.com/?p=37410
title: The Download on the DNC Hack
uri: The-Download-on-the-DNC-Hack
url: https://krebsonsecurity.com/2017/01/the-download-on-the-dnc-hack/
content:
<p>Over the past few days, several longtime readers have asked why I haven&#8217;t written about two stories that have consumed the news media of late: The alleged Russian hacking attacks against the U.S. <strong>Democratic National Committee</strong> (DNC) and, more recently, the discovery of malware on a laptop at a Vermont power utility that has been attributed to Russian hacker groups.</p>
<p>I&#8217;ve avoided covering these stories mainly because I don&#8217;t have any original reporting to add to them, and because I generally avoid chasing the story of the day &#8212; preferring instead to focus on producing original journalism on cybercrime and computer security.</p>
<p><img class="aligncenter size-medium wp-image-37473" src="media/f39323fb.dnc-580x355.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/01/dnc-580x355.png" alt="dnc" width="580" height="355" srcset="http://krebsonsecurity.com/wp-content/uploads/2017/01/dnc-580x355.png 580w, http://krebsonsecurity.com/wp-content/uploads/2017/01/dnc-768x470.png 768w, http://krebsonsecurity.com/wp-content/uploads/2017/01/dnc.png 922w" sizes="(max-width: 580px) 100vw, 580px" />But there is another reason for my reticence: Both of these stories are so politically fraught that to write about them means signing up for gobs of vitriolic hate mail from readers who assume I have some political axe to grind no matter what I publish on the matter.</p>
<p><a href="http://www.rollingstone.com/politics/features/something-about-this-russia-story-stinks-w458439" target="_blank">An article</a> in <em>Rolling Stone</em> over the weekend aptly captures my unease with reporting on both of these stories in the absence of new, useful information (the following quote refers specifically to the Obama administration&#8217;s sanctions against Russia related to the DNC incident).</p>
<p>&#8220;The problem with this story is that, like the Iraq-WMD mess, it takes place in the middle of a highly politicized environment during which the motives of all the relevant actors are suspect,&#8221; Rolling Stone political reporter <strong>Matt Taibbi</strong> wrote. &#8220;Absent independent verification, reporters will have to rely upon the secret assessments of intelligence agencies to cover the story at all. Many reporters I know are quietly freaking out about having to go through that again.&#8221;</p>
<p>Alas, one can only nurse a New Year&#8217;s holiday vacation for so long. Here are some of the things I&#8217;ve been ruminating about over the past few days regarding each of these topics. Please be kind.</p>
<p>Gaining sufficient public support for a conclusion that other countries are responsible for hacking important U.S. assets can be difficult &#8211; even when the alleged aggressor is already despised and denounced by the entire civilized world.</p>
<p>The remarkable hacking of <strong>Sony Pictures Entertainment</strong> in late 2014 and the Obama administration&#8217;s quick fingering of hackers in North Korea as the culprits is a prime example: When the Obama administration released its findings that North Korean hackers were responsible for breaking into SPE, few security experts I spoke to about the incident were convinced by the intelligence data coming from the White House.</p>
<p>That seemed to change somewhat following the <a href="http://www.nytimes.com/2015/01/19/world/asia/nsa-tapped-into-north-korean-networks-before-sony-attack-officials-say.html?_r=0" target="_blank">leak of a National Security Agency document</a> which suggested the United States had planted malware capable of tracking the inner workings of the computers and networks used by the North&#8217;s hackers. Nevertheless, I&#8217;d wager that if we took a scientific poll among computer security experts today, a fair percentage of them probably still strongly doubt the administration&#8217;s conclusions.</p>
<p>If you were to ask those doubting experts to explain why they persist in their unbelief, my guess is you would find these folks break down largely into two camps: Those who believe the administration will never release any <em>really detailed</em> (and likely classified) information needed to draw a more definitive conclusion, and those who because of their political leanings tend to disbelieve virtually everything that comes out of the current administration.</p>
<p>Now, the American public is being asked to accept the White House&#8217;s technical assessment of another international hacking incident, only this time the apparent intention of said hacking is nothing less than to influence the outcome of a historically divisive presidential election in which the sitting party lost.</p>
<p>It probably doesn&#8217;t matter how many indicators of compromise and digital fingerprints the Obama administration releases on this incident: Chances are decent that if you asked a panel of security experts a year from now whether the march of time and additional data points released or leaked in the interim have influenced their opinion, you&#8217;ll find them just as evenly divided as they are today.</p>
<p>The mixed messages coming from the camp of President-elect Trump haven&#8217;t added any clarity to the matter, either. Trump has publicly mocked American intelligence assessments that Russia meddled with the U.S. election on his behalf, and said recently that he doubts the U.S. government can be certain it was hackers backed by the Russian government who hacked and leaked emails from the DNC.</p>
<p>However, one of Trump&#8217;s top advisers &#8212; former <strong>CIA Director</strong> <strong>James Woolsey</strong> &#8212; <a href="http://www.cnn.com/2017/01/02/politics/digital-fingerprints-russia-hacking/" target="_blank">now says</a> he believes the Russians (and possibly others) <em>were</em> in fact involved in the DNC hack.</p>
<p>It&#8217;s worth noting that the U.S. government has offered some additional perspective on why it is so confident in its conclusion that Russian military intelligence services were involved in the DNC hack. A <a href="https://www.whitehouse.gov/the-press-office/2016/12/29/fact-sheet-actions-response-russian-malicious-cyber-activity-and" target="_blank">White House fact sheet</a> published alongside the <a href="media/1bfbb69b.JAR_16-20296A_GRIZZLY20STEPPE-2016-1229.pdf" data-original-source="https://www.us-cert.gov/sites/default/files/publications/JAR_16-20296A_GRIZZLY%20STEPPE-2016-1229.pdf" target="_blank">FBI/DHS Joint Analysis Report</a> (PDF) says the report &#8220;includes information on computers around the world that Russian intelligence services have co-opted without the knowledge of their owners in order conduct their malicious activity in a way that makes it difficult to trace back to Russia. In some cases, the cybersecurity community was aware of this infrastructure, in other cases, this information is newly declassified by the U.S. government.&#8221;<span id="more-37410"></span></p>
<h4>BREADCRUMBS</h4>
<p>As I said in <a href="https://twitter.com/briankrebs/status/814574626768568320" target="_blank">a tweet a few days back</a>, the only remarkable thing about the hacking of the DNC is that the people responsible for protecting those systems somehow didn&#8217;t expect to be constantly targeted with email-based malware attacks. Lest anyone think perhaps the Republicans were better at anticipating such attacks, the FBI <a href="http://www.chicagotribune.com/news/local/politics/ct-illinois-republican-party-email-hack-met-1212-20161211-story.html" target="_blank">notified the Illinois Republican Party</a> in June 2016 that some of its email accounts may have been hacked by the same group. The New York Times has <a href="http://www.nytimes.com/2016/12/10/us/politics/trump-mocking-claim-that-russia-hacked-election-at-odds-with-gop.html" target="_blank">reported</a> that Russian hackers also broke into the DNC&#8217;s GOP counterpart &#8212; the <strong>Republican National Committee</strong> &#8212; but chose to release documents only on the Democrats.</p>
<p>I can&#8217;t say for certain if the Russian government was involved in directing or at least supporting attacks on U.S. political parties. But it seems to me they would be foolish not to have at least tried to get their least-hated candidate elected given how apparently easy it was to break in to the headquarters of both parties. Based on what I&#8217;ve learned over the past decade studying Russian language, culture and hacking communities, my sense is that if the Russians were responsible and wanted to hide that fact &#8212; they&#8217;d have left a trail leading back to some other country&#8217;s door.</p>
<p>That so many Russian hackers simply don&#8217;t bother to cover their tracks when attacking and plundering U.S. targets is a conclusion that many readers of this blog have challenged time and again, particularly with stories in my <a href="https://krebsonsecurity.com/category/breadcrumbs/" target="_blank">Breadcrumbs series</a>. It&#8217;s too convenient and pat to be true, these detractors frequently claim. In my experience, however, if Russian hackers profiled on this blog were exposed because they did a poor job hiding their tracks, it&#8217;s usually because they didn&#8217;t even try.</p>
<p>In my view, this has more to do with the reality that there is very little chance these hackers will ever be held accountable for their crimes as long as they remain in Russia (or at least in former Soviet states that remain loyal to Russia). Take the case of <strong>Evgeniy Mikhailovich Bogachev</strong>, one of the hackers named in the U.S. government&#8217;s assessment of those responsible for the DNC attack.</p>
<div id="attachment_34554" style="width: 590px" class="wp-caption aligncenter"><img class="size-medium wp-image-34554" src="media/8f794a9e.bogachev-1-580x297.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/04/bogachev-1-580x297.png" alt="Bogachev, the alleged Zeus Trojan author, in undated photos." width="580" height="297" srcset="http://krebsonsecurity.com/wp-content/uploads/2016/04/bogachev-1-580x297.png 580w, http://krebsonsecurity.com/wp-content/uploads/2016/04/bogachev-1.png 669w" sizes="(max-width: 580px) 100vw, 580px" /><p class="wp-caption-text">Bogachev, the alleged Zeus Trojan author, in undated photos.</p></div>
<p>A Russian hacker better known by his hacker alias &#8220;Slavik&#8221; and as the author of the <a href="https://krebsonsecurity.com/tag/zeus-trojan/" target="_blank">ZeuS Trojan</a> malware, Bogachev landed on the FBI&#8217;s 10-most-wanted list in 2014. The cybercriminal organization Bogchev allegedly ran was responsible for the theft of more than $100 million from banks and businesses worldwide that were infected with his ZeuS malware. That organization, dubbed the &#8220;Business Club,&#8221; had members spanning most of Russia&#8217;s 11 time zones.</p>
<p><strong>Fox-IT</strong>, a Dutch security firm that infiltrated the Business Club&#8217;s back-end operations, said that beginning in late fall 2013 — about the time that conflict between Ukraine and Russia was just beginning to heat up — Slavik retooled his cyberheist botnet to serve as purely a spying machine, and began scouring infected systems in Ukraine for specific keywords in emails and documents that would likely only be found in classified documents.</p>
<p>Likewise, the keyword searches that Slavik used to scour bot-infected systems in Turkey suggested the botmaster was searching for specific files from the Turkish Ministry of Foreign Affairs or the Turkish KOM – a specialized police unit. Fox-IT said it was clear that Slavik was looking to intercept communications about the conflict in Syria on Turkey’s southern border — one that Russia has supported by reportedly shipping arms into the region.</p>
<p>To date, Bogachev appears to be a free man, despite <a href="https://krebsonsecurity.com/2015/02/fbi-3m-bounty-for-zeus-trojan-author/" target="_blank">a $3 million bounty</a> placed on his head by the FBI. This is likely because he&#8217;s remained inside Russia or at least within its sphere of protective influence. According to the FBI, Bogachev is known to enjoy boating and may be hiding out on a vessel somewhere in the Black Sea.</p>
<h4>AN &#8216;INFORMATION NEXUS&#8217;</h4>
<p>For the relatively few Russian hackers who do wind up in Russian prisons as a result of their cybercriminal activity, agreeing to hack another government might be the easiest way to get out of jail. The<em> New York Times</em> carried <a href="http://www.nytimes.com/2016/12/29/world/europe/how-russia-recruited-elite-hackers-for-its-cyberwar.html" target="_blank">a story</a> last month about how how Russian hackers like Bogachev often get recruited or coerced by the Russian government to work on foreign intelligence-gathering operations.</p>
<p>The story noted that while &#8220;much about Russia’s cyberwarfare program is shrouded in secrecy, details of the government’s effort to recruit programmers in recent years — whether professionals like&#8230;college students, or even criminals — are shedding some light on the Kremlin’s plan to create elite teams of computer hackers.&#8221;</p>
<p>According to Times reporter <strong>Andrew Kramer</strong>, a convicted hacker named <strong>Dmitry A. Artimovich</strong> was approached by Russian intelligence services while awaiting trial for building malware that was used in crippling online attacks. Artimovich told Kramer that in prison while awaiting trial he was approached by a cellmate who told Artimovich he could get out of jail if he agreed to work for the government.</p>
<p>Artimovich said he declined the offer. He was convicted of hacking and later spent a year in a Russian penal colony for his crimes. Artimovich also was a central figure in my book, <em><a href="https://www.amazon.com/Spam-Nation-Organized-Cybercrime-Epidemic/dp/1492603236" target="_blank">Spam Nation: The Inside Story of Organized Cybercrime, from Global Epidemic to Your Front Door</a></em>. His exploits, and that of his brother Igor, are partially detailed in <a href="https://krebsonsecurity.com/?s=artimovich&amp;x=0&amp;y=0" target="_blank">various posts on this blog</a>, but the long and the short of them is that Artimovich created a botnet that was used mainly for spam.</p>
<p>That is, until a friend of his hired him to launch a cyberattack against a company that provided payment processing services to Aeroflot, an airline that is 51 percent owned by the Russian government.</p>
<p>For many years, Artimovich used his botnet, dubbed &#8220;Festi&#8221; by security researchers, to pump spam promoting male enhancement drugs for a rogue online pharmacy operations called <strong>Rx-Promotion</strong>. <strong>Pavel Vrublevsky, </strong>RX-Promotion&#8217;s founder and the man who hired Artimovich to launch the cyberattack &#8212; also was convicted in the same trial, and sentenced to two years in a penal colony. However, Vrublevsky was inexplicably released after less than a year in Russia&#8217;s hinterlands.</p>
<p>Vrublevsky&#8217;s company <a href="https://krebsonsecurity.com/tag/chronopay/" target="_blank">ChronoPay</a> was indirectly featured in another <em>New York Times</em> <a href="http://www.nytimes.com/2016/09/28/world/europe/russia-hacker-vladimir-fomenko-king-servers.html" target="_blank">story</a> about the hacking of the DNC. In September, The Times profiled <strong>Vladimir M. Fomenko</strong>, the 26-year-old manager of the web hosting firm <strong>King Servers</strong>, which U.S. cybersecurity firm <strong>ThreatConnect</strong> concluded was &#8220;an &#8216;<a href="https://threatconnect.com/blog/state-board-election-rabbit-hole/" rel="noreferrer" data-ss1483479263="1">information nexus</a>&#8216; used by hackers suspected of working for Russian state security in cyberattacks on democratic processes in several countries, including Germany, Turkey and Ukraine, as well as the United States.&#8221; [Full disclosure: ThreatConnect has been an advertiser on this blog.]</p>
<div id="attachment_37466" style="width: 590px" class="wp-caption aligncenter"><img class="size-medium wp-image-37466" src="media/ad5402e0.chronoking-580x243.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/01/chronoking-580x243.png" alt="An image from ChronoPay's press release. " width="580" height="243" srcset="http://krebsonsecurity.com/wp-content/uploads/2017/01/chronoking-580x243.png 580w, http://krebsonsecurity.com/wp-content/uploads/2017/01/chronoking-768x321.png 768w, http://krebsonsecurity.com/wp-content/uploads/2017/01/chronoking-940x393.png 940w, http://krebsonsecurity.com/wp-content/uploads/2017/01/chronoking.png 1038w" sizes="(max-width: 580px) 100vw, 580px" /><p class="wp-caption-text">An image from ChronoPay&#8217;s press release.</p></div>
<p>To bring this full circle, on Sept. 15, 2016, Fomenko issued a statement about the ThreatConnect report. That statement, originally written in Russian, was translated from Russian into English by Vrublevsky, and <a href="https://chronopay.com/blog/2016/09/15/chronopay-pomogaet-king-servers-com/" target="_blank">reposted on ChronoPay&#8217;s Web site</a>.</p>
<p>“The analysis of the internal data allows King Servers to confidently refute any conclusions about the involvement of the Russian special services in this attack,” Fomenko said in his statement, which credits ChronoPay for the translation. &#8220;The company also reported that the attackers still owe the company $US290 for rental services and King Servers send an invoice for the payment to Donald Trump &amp; Vladimir Putin, as well as the company reserves the right to send it to any other person who will be accused by mass media of this attack.&#8221;</p>
<h4>FOREIGN INTELLIGENCE BOTNETS</h4>
<p>If indeed those who hacked the DNC were recruited from the ranks of the cybercriminal community focused mainly on financial crime, I would not be surprised in the least. The Russian source who first introduced me to much of the cyber underground told me exactly this when we first met some years ago. He had just left the Russian military for a job at a computer security firm in Russia, and his job was to build a presence on all of the Russian-language cybercrime forums and learn the real-life identities of the major power players in that space.</p>
<p>That source, who won&#8217;t be named here because it would compromise his current position and create legal problems for him, said he routinely saw Russian intelligence services recruiting hackers on cybercrime forums &#8212; particularly for research into potential vulnerabilities in the software and hardware that powers various national power grids and other energy infrastructure.</p>
<p>&#8220;All these guys had interest in hacking government resources, including Russian [targets],&#8221; my source told me. &#8220;Several years ago I got to know one of these hackers who worked for Russian government, [and] he operated his [cybercrime] forum as a government honeypot for hiring hackers. They were hiring hackers to work in official government organizations.&#8221;</p>
<p>Initially, he said, the hackers targeted U.S. military installations and U.S. news media outlets, but eventually they turned their attention to collecting government and corporate secrets full-time. The source said the teams routinely used botnets for foreign intelligence gathering and counterintelligence, and frequently sought to infiltrate botnets that were suspected of being co-opted for the same purposes by other countries.</p>
<p>&#8220;Then they started attacking foreign-only targets, and even started their own VPN (virtual private networking) service for English-speaking customers so they could capture corporate data,&#8221; he told me. &#8220;They also ran a service for checking stolen PDFs and other documents for [proprietary] data and classified information. If something like <a href="https://en.wikipedia.org/wiki/Stuxnet" target="_blank">Stuxnet</a> destroys some power plant, I will think about these guys first. Now I use them as a source of information about foreign intelligence botnets, so I really don&#8217;t want them to be uncovered.&#8221;</p>
<h4>ARE WE NOT ENTERTAINED?</h4>
<p>Perhaps it shouldn&#8217;t be surprising if many people remain unconvinced by the Joint Analysis Report released by the Obama administration. Fresh from an especially rancorous election muddled by the <a href="https://www.washingtonpost.com/business/economy/russian-propaganda-effort-helped-spread-fake-news-during-election-experts-say/2016/11/24/793903b6-8a40-4ca9-b712-716af66098fe_story.html?utm_term=.23d05d521f36" target="_blank">proliferation</a> of &#8220;fake news&#8221; websites, public trust in the news media on technology and politics has to be at a historic low.</p>
<p>Last Friday, <em>The Washington Post</em> <a href="http://web.archive.org/web/20161231011622/https://www.washingtonpost.com/world/national-security/russian-hackers-penetrated-us-electricity-grid-through-a-utility-in-vermont/2016/12/30/8fc90cc4-ceec-11e6-b8a2-8c2a61b0436f_story.html" target="_blank">reported</a> that Russian hackers penetrated the U.S. electricity grid through a utility in Vermont. The Post later <a href="http://web.archive.org/web/20161231030608/https:/www.washingtonpost.com/world/national-security/russian-hackers-penetrated-us-electricity-grid-through-a-utility-in-vermont/2016/12/30/8fc90cc4-ceec-11e6-b8a2-8c2a61b0436f_story.html" target="_blank">significantly revised</a> that story to clarify that malware tied to a Russian hacking group known to target companies in the energy sector had succeeded at infecting a single laptop at the utility, and that said laptop was never connected to the power grid.</p>
<p>To many already doubtful of the Obama administration&#8217;s claims about Russian hacking involvement in the election, The Post&#8217;s flub was yet another example of a left-leaning media establishment eager to capitalize on the Russian election-hacking narrative.</p>
<p>&#8220;From Russian hackers burrowed deep within the US electrical grid, ready to plunge the nation into darkness at the flip of a switch, an hour and a half later the story suddenly became that a single non-grid laptop had a piece of malware on it and that the laptop was not connected to the utility grid in any way,&#8221; <a href="http://www.forbes.com/sites/kalevleetaru/2017/01/01/fake-news-and-how-the-washington-post-rewrote-its-story-on-russian-hacking-of-the-power-grid/#27b35ac8291e" target="_blank">wrote</a> in <em>Forbes</em>.</p>
<p>Not that the American public is the best arbiter of truth and fiction. As <em>Rolling Stone</em> notes, despite the fact that election officials found virtually no voter fraud in the 2016 election, an <a href="https://today.yougov.com/news/2016/12/27/belief-conspiracies-largely-depends-political-iden/" target="_blank">Economist/YouGov poll</a> conducted last month suggests that 50 percent of all Clinton voters believe the Russians hacked vote tallies. Not to be outdone, 62 percent of Trump voters said they believe <a href="http://www.politico.com/story/2016/11/trump-illegal-voting-clinton-231860" target="_blank">Trump&#8217;s assertion</a> that &#8220;millions&#8221; of undocumented immigrants likely voted in the election.</p>
<p>The public might also be deeply suspicious of hacking claims from a government that practically invented the art of meddling in foreign elections. As <strong>Nina Agrawal</strong> <a href="http://www.latimes.com/nation/la-na-us-intervention-foreign-elections-20161213-story.html" target="_blank">observes</a> in <em>The Los Angeles Times</em>, the &#8220;U.S. has a long history of attempting to influence presidential elections in other countries – it’s done so as many as 81 times between 1946 and 2000, according to a database amassed by political scientist Dov Levin of Carnegie Mellon University.&#8221; Also, when it comes to hacking power plants, the U.S. and Israel have probably done more damage than anyone else with their incredibly complex Stuxnet virus, which was created as a weapon designed to delay Iran&#8217;s nuclear ambitions and opened a virtual Pandora&#8217;s Box.</p>
<p>In response to the alleged hacks, the Obama administration <a href="http://www.foxnews.com/politics/2016/12/30/obama-response-to-russian-hacking-does-not-go-far-enough-say-experts.html" target="_blank">has expelled 35 Russian intelligence officials</a> and imposed <a href="https://www.treasury.gov/resource-center/sanctions/OFAC-Enforcement/Pages/20161229.aspx" target="_blank">a series of economic sanctions</a> on individuals and companies the administration says are connected to the DNC intrusions. The administration&#8217;s response has been criticized as lackluster and ineffectual, but it&#8217;s not entirely clear what else the White House could do publicly without risking retaliation in kind or worse.</p>
<p>However, the operative word there is &#8220;publicly.&#8221; Just as the administration almost certainly is not releasing all of the intelligence data that lead to its conclusion, I suspect that some of the U.S. response will materialize in ways that won&#8217;t be publicly acknowledged by this outgoing administration.</p>


feed_id: https://krebsonsecurity.com/?p=37484
title: The FTC’s Internet of Things (IoT) Challenge
uri: The-FTC-s-Internet-of-Things-(IoT)-Challenge
url: https://krebsonsecurity.com/2017/01/the-ftcs-internet-of-things-iot-challenge/
content:
<p>One of the biggest cybersecurity stories of 2016 was the surge in online attacks caused by poorly-secured &#8220;<strong>Internet of Things</strong>&#8221; (IoT) devices such as Internet routers, security cameras, digital video recorders (DVRs) and smart appliances. Many readers here have commented with ideas about how to counter vulnerabilities caused by out-of-date software in IoT devices, so why not pitch your idea for money? Who knows, you could win up to $25,000 in a new contest put on by the <strong>U.S. Federal Trade Commission</strong> (FTC).</p>
<div id="attachment_37488" style="width: 564px" class="wp-caption aligncenter"><img class="size-full wp-image-37488" src="media/70b9c317.100percentwifi.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/01/100percentwifi.png" alt="Electronics giant LG said at the Consumer Electronics Show (CES) today that all of its devices from now on will have Wi-Fi built in. Image: @Karissabe" width="554" height="412" /><p class="wp-caption-text">Electronics giant LG said today at the Consumer Electronics Show (CES) that all of its appliances from now on will have Wi-Fi built in and be connected to the cloud. Image: Mashable</p></div>
<p>The FTC&#8217;s <strong>IoT Home Inspector Challenge</strong> is seeking ideas for a tool of some sort that would address <a href="https://krebsonsecurity.com/?s=iot&amp;x=0&amp;y=0" target="_blank">the burgeoning IoT mess</a>. The agency says it&#8217;s offering a cash prize of up to $25,000 for the best technical solution, with up to $3,000 available for as many as three honorable mention winner(s).<span id="more-37484"></span></p>
<p>The FTC said an ideal tool &#8220;might be a physical device that the consumer can add to his or her home network that would check and install updates for other IoT devices on that home network, or it might be an app or cloud-based service, or a dashboard or other user interface. Contestants also have the option of adding features such as those that would address hard-coded, factory default or easy-to-guess passwords.&#8221;</p>
<p>According to <a href="https://www.ftc.gov/iot-home-inspector-challenge" target="_blank">the contest&#8217;s home page</a>, submissions will be accepted as early as <span class="aBn" tabindex="0" data-term="goog_320009905"><span class="aQJ">March 1, 2017</span></span> and are due <span class="aBn" tabindex="0" data-term="goog_320009906"><span class="aQJ">May 22, 2017 at 12:00 p.m. EDT</span></span>. Winners will be announced on or about <span class="aBn" tabindex="0" data-term="goog_320009907"><span class="aQJ">July 27, 2017</span></span>.</p>
<p>I&#8217;m glad to see the FTC engaging the public on this important issue. <strong>Gartner Inc.</strong> <a href="http://www.gartner.com/newsroom/id/3165317" target="_blank">forecasts</a> that 6.4 billion connected things will be in use worldwide in 2016, up 30 percent from 2015, and will reach 20.8 billion by 2020. In 2016, 5.5 million new things will get connected each day, Gartner estimates. If only a fraction of these new IoT devices are shipped with sloppy security defaults &#8212; such as <a href="https://krebsonsecurity.com/2016/10/who-makes-the-iot-things-under-attack/" target="_blank">hard-coded accounts and passwords</a> &#8212; the IoT problem is going to get a lot worse in the coming years.</p>


feed_id: https://krebsonsecurity.com/?p=37497
title: Stolen Passwords Fuel Cardless ATM Fraud
uri: Stolen-Passwords-Fuel-Cardless-ATM-Fraud
url: https://krebsonsecurity.com/2017/01/stolen-passwords-fuel-cardless-atm-fraud/
content:
<p>Some financial institutions are now offering so-called &#8220;cardless ATM&#8221; transactions that allow customers to withdraw cash using nothing more than their mobile phones. But as the following story illustrates, this new technology also creates an avenue for thieves to quickly and quietly convert stolen customer bank account usernames and passwords into cold hard cash. Worse still, fraudulent cardless ATM withdrawals may prove more difficult for customers to dispute because they place the victim at the scene of the crime.</p>
<div id="attachment_37512" style="width: 268px" class="wp-caption alignright"><a class="lightbox" href="media/5c1ad7ce.markula.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/01/markula.png"><img class="wp-image-37512" src="media/b2ec6b6d.markula-580x715.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/01/markula-580x715.png" alt="A portion of the third rejection letter that Markula received from Chase about her $2,900 fraud claim. The bank ultimately reversed itself and refunded the money after being contacted by KrebsOnsecurity, stating that Markula's account was one of several that were pilfered by a crime gang that has since been arrested by authorities." width="258" height="318" srcset="http://krebsonsecurity.com/wp-content/uploads/2017/01/markula-580x715.png 580w, http://krebsonsecurity.com/wp-content/uploads/2017/01/markula.png 693w" sizes="(max-width: 258px) 100vw, 258px" /></a><p class="wp-caption-text">A portion of the third rejection letter that Markula received from Chase about her $2,900 fraud claim.</p></div>
<p>San Francisco resident <strong>Kristina Markula</strong> told KrebsOnSecurity that it wasn&#8217;t until shortly after a vacation in Cancun, Mexico in early November 2016 that she first learned that <strong>Chase Bank </strong>even offered cardless ATM access. Markula said that while she was still in Mexico she tried to view her bank balance using a Chase app on her smartphone, but that the app blocked her from accessing her account.</p>
<p>Markula said she thought at the time that Chase had blocked her from using the app because the request came from an unusual location. After all, she didn&#8217;t have an international calling or data plan and was trying to access the account via Wi-Fi at her hotel in Mexico.</p>
<p>Upon returning to the United States, Markula called the number on the back of her card and was told she needed to visit the nearest Chase bank branch and present two forms of identification. At a Chase branch in San Francisco, she handed the teller a California driver&#8217;s license and her passport. The branch manager told her that someone had used her Chase online banking username and password to add a new mobile phone number to her account, and then move $2,900 from her savings to her checking account.</p>
<p>The manager told Markula that whoever made the change then requested that a new mobile device be added to the account, and changed the contact email address for the account. Very soon after, that same new mobile device was used to withdraw $2,900 in cash from her checking account at the <a href="https://locator.chase.com/search/fl/pembroke+pines" target="_blank">Chase Bank ATM in Pembroke Pines, Fla</a>.</p>
<p>A handful of U.S. banks, including Chase, have deployed ATMs that are capable of dispensing cash without requiring an ATM card. In the case of Chase ATMs, the customer approaches the cash machine with a smart phone that is already associated with a Chase account. Associating an account with the mobile app merely requires the customer to supply the app with their online banking username and password.</p>
<p>Users then tell the Chase app how much they want to withdraw, and the app creates a unique 7-digit code that needs to be entered at the Chase ATM (instead of numeric code, some banks offering cardless ATM withdrawals will have the app display a QR code that needs to be read by a scanner on the ATM). Assuming the code checks out, the machine dispenses the requested cash and the transaction is complete. At no time is the Chase customer asked to enter his or her 4-digit ATM card PIN.</p>
<p>Most financial institutions will limit traditional ATM customers to withdrawing $300-$600 per transaction, but some banks have set cardless transaction limits at much higher amounts under certain circumstances. For example, at the time Markula&#8217;s fraud occurred, the limit was set at $3,000 for withdrawals during normal bank business hours and made at Chase ATMs located at Chase branches.</p>
<p>Markula said the bank employees helped her close the account and file a claim to dispute the withdrawal. She said the teller and the bank manager reviewed her passport and confirmed that the disputed transaction took place during the time between which her passport was stamped by U.S. and Mexican immigration authorities. However, Markula said Chase repeatedly denied her claims.</p>
<p>&#8220;We wanted to thank you for providing your information while we thoroughly researched your dispute,&#8221; Chase&#8217;s customer claims department wrote in the third rejection letter sent to Markula, dated January 5, 2017. &#8220;We confirmed that the disputed charges were correct and we will not be making an adjustment to your account.&#8221;</p>
<p>Markula said she was dumbfounded by the rejection letter because the last time she spoke with a fraud claims manager at Chase, the manager told her that the transaction had all of the hallmarks of an account takeover.</p>
<p>&#8220;I&#8217;m pretty frustrated at the process so far,&#8221; said Markula, who shared with this author a detailed timeline of events before and after the disputed transaction. &#8220;Not captured in this timeline are the countless phone calls to the fraud department which is routed overseas. The time it takes to reach someone and poor communication seems designed to make one want to give up.&#8221;</p>
<p>KrebsOnSecurity contacted Chase today about Markula&#8217;s case. Chase spokesman <strong>Mike Fusco</strong> said Markula&#8217;s rejection letter was incorrect, and that further investigation revealed she had been victimized by a group of a half-dozen fraudsters who were caught using the above-described technique to empty out Chase bank accounts.</p>
<p>Fusco forwarded this author <a href="http://myfox28columbus.com/news/local/upper-arlington-police-arrest-6-people-in-multi-state-bank-fraud-scheme" target="_blank">a link to a Fox28 story</a> about six men from Miami, Fla. who were arrested late last year in Columbus, Ohio in connection with what authorities there called a &#8220;multi-state crime spree&#8221; targeting Chase accounts.<span id="more-37497"></span></p>
<p>&#8220;We escalated it and reviewed her issue and determined she did have fraud on her account,&#8221; Fusco said.  &#8220;We&#8217;re reimbursing her and we&#8217;re really sorry. This small pilot we ran allowed a limited number of customers to access cash at Chase ATMs without a card. During the pilot we detected some fraudulent activity where a group of people were able to go online and change the customer&#8217;s information and get the one-time access code, and we immediately notified the authorities.&#8221;</p>
<p>Chase declined to say how many like Markula were victimized this gang. Unfortunately, somehow Chase neglected to notify victims, as Markula&#8217;s case shows.</p>
<p>&#8220;It makes you wonder how many other people didn&#8217;t dispute the charges,&#8221; she said. &#8220;Thankfully, I don&#8217;t give up easily.&#8221;</p>
<p>Fusco said Chase had made changes to better detect these types of fraudulent transactions going forward, and that it had lowered the withdrawal limit for these types of transactions &#8212; although for security reasons Fusco declined to say what the new limit was.</p>
<p>Fusco also said the bank&#8217;s system should have sent out an email alert to the original email on file in the event that the email on the account is changed, but Markula said she&#8217;s confident no such email ever landed in her inbox.</p>
<p><strong>Avivah Litan</strong>, a fraud analyst at <strong>Gartner Inc.</strong>, says many banks see mobile authentication as the way of the future for online banking and ATM transactions. She said most banks would love to be able to move away from physical bank cards, which often need to be replaced several times a year in response to data breaches at various retailers.</p>
<p>&#8220;A lot of banks see cardless transactions as a great way to reduce fraud and speed up transactions, but not many are offering it yet as a feature to customers,&#8221; Litan said.</p>
<p>Litan said Markula&#8217;s case echoes the <a href="https://krebsonsecurity.com/2015/03/apple-pay-bridging-online-and-big-box-fraud/" target="_blank">spike in fraud that some banks saw after Apple debuted its Apple Pay platform</a>. Many banks chose to adopt Apple Pay without also beefing up security around how they validate new customers and new mobile devices. As a result, this allowed fraudsters to take stolen credit card numbers and expiration dates &#8212; data that previously was only good for fraudulent online transactions &#8212; tie those cards to iPhones, and use the phones to commit card fraud at brick-and-mortar stores that accepted Apple Pay.</p>
<p>&#8220;Identity proofing remains the weakest point in mobile banking,&#8221; Litan said. &#8220;Asking for the customer&#8217;s username and password to on-board a new mobile device isn&#8217;t enough.&#8221;</p>
<p>Litan said Chase should require customers who wish to conduct cardless ATM transactions to enter their PIN in addition to the one-time code. But she said even that was not enough.</p>
<p>Litan said Chase should have flagged the transaction as highly suspicious from the get-go, given that the fraudsters accessed her account from a new location, changed her contact email address, added a new device and withdrew just under the daily maximum &#8212; all in a very short span of time.</p>
<p>&#8220;ATM transactions should have much stronger fraud controls because consumers don’t have as strong protections as they do with other transactions,&#8221; Litan said. &#8220;If a customer&#8217;s card is used fraudulently at a retailer, for example, the consumer is protected by Visa and MasterCard&#8217;s zero liability rule, and they can generally expect to get their money back. But when you withdraw cash from an ATM, you&#8217;re not protected by those rules. It&#8217;s down to Regulation E and your bank&#8217;s policies.&#8221;</p>
<p>Under the <a href="http://www.dca.ca.gov/publications/legal_guides/cr-6.shtml" target="_blank">Federal Regulation E</a>, if a retail banking customer reports fraud, the bank must investigate the first statement of the activity plus 60 days from the date the statement was mailed by the financial institution. Unless the institution can prove the transaction wasn&#8217;t fraud, it must reimburse the consumer. However, any activity that takes place outside of the aforementioned timeframe carries unlimited liability to the consumer, as the financial institution may have been able to prevent the loss had it been reported in a timely manner.</p>
<p>Fusco added that consumers should beware of phishing scams, and consider asking their financial institution to secure their accounts with a special passphrase or code that needs to be supplied when authenticating with the bank over the telephone (a precaution I have long advised).</p>
<p>Also, if your bank offers two-step or two-factor authentication &#8212; such as the requirement to send a text-message with a one-time code to your mobile device if someone attempts to log in from an unknown device or location &#8212; please take advantage of that feature. <a href="https://twofactorauth.org" target="_blank">Twofactorauth.org</a> has a list of banks that offer this additional security feature.</p>
<p>Also, as the Regulation E paragraph I hope makes clear, do not count on your bank to block fraudulent transfers, and remember that ultimately you are responsible for spotting and reporting fraudulent transactions.</p>
<p>Litan said she won&#8217;t be surprised if this incident gives more banks pause about moving to cardless ATM transactions.</p>
<p>&#8220;This is the first case I&#8217;m aware of in the United States where this type of fraud has been an issue,&#8221; she said. &#8220;I&#8217;m guessing this will slow the banks down a bit in adopting the technology because they&#8217;ll see now how easy it is for criminals to take advantage of it.&#8221;</p>


feed_id: https://krebsonsecurity.com/?p=37542
title: DNI: Putin Led Cyber, Propaganda Effort to Elect Trump, Denigrate Clinton
uri: DNI-Putin-Led-Cyber-Propaganda-Effort-to-Elect-Trump-Denigrate-Clin
url:
https://krebsonsecurity.com/2017/01/dni-putin-led-cyberattack-propaganda-effort-to-elect-trump-denigrate-clinton/

content:
<p><strong>Russian President Vladimir Putin</strong> directed a massive propaganda and cyber operation aimed at discrediting <strong>Hillary Clinton</strong> and getting <strong>Donald Trump</strong> elected, the top U.S. intelligence agencies said in a remarkable yet unshocking report released on Friday.</p>
<div id="attachment_37553" style="width: 261px" class="wp-caption alignright"><img class=" wp-image-37553" src="media/d6e4f446.VPofRT.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/01/VPofRT.png" alt="Russian President Vladimir Putin tours RT facilities. Image: DNI" width="251" height="273" /><p class="wp-caption-text">Russian President Vladimir Putin tours RT facilities. Image: DNI</p></div>
<p>The 25-page dossier from the <strong>Office of the Director of National Intelligence</strong> stopped short of saying the Russians succeeded at influencing the outcome of the election, noting that the report did not attempt to make an assessment on that front. But it makes the case that &#8220;Russia’s intelligence services conducted cyber operations against targets associated with the 2016 US presidential election, including targets associated with both major US political parties.&#8221;</p>
<p>&#8220;We assess with high confidence that Russian military intelligence (General Staff Main Intelligence Directorate or GRU) used the <strong>Guccifer 2.0</strong> persona and <strong>DCLeaks.com</strong> to release US victim data obtained in cyber operations publicly and in exclusives to media outlets and relayed material to WikiLeaks,&#8221; the DNI report reads.</p>
<p>The report is a quick and fascinating read. One example: It includes a fairly detailed appendix which concludes that the U.S.-based but Kremlin-financed media outlet <strong>RT</strong> (formerly <strong>Russia Today</strong>) is little more than a propaganda machine controlled by Russian intelligence agencies.</p>
<p>&#8220;Moscow’s influence campaign followed a Russian messaging strategy that blends covert intelligence operations—such as cyber activity—with overt efforts by Russian Government agencies, state-funded media, third-party intermediaries, and paid social media users or &#8216;trolls,'&#8221; reads the report.</p>
<p>The DNI report is remarkable for several reasons. First, it publicly accuses Russia&#8217;s President of trying to meddle with the U.S. election and to hack both political parties. Also, as <em>The New York Times</em> observed, it offers &#8220;a virtually unheard-of, real-time revelation by the American intelligence agencies that undermined the legitimacy of the president who is about to direct them.&#8221;</p>
<p>However, those who&#8217;ve been <a href="https://krebsonsecurity.com/2017/01/the-download-on-the-dnc-hack/" target="_blank">clamoring for more technical evidence</a> to support a conclusion that Russian intelligence agencies were behind the <a href="https://wikileaks.org/podesta-emails/emailid/36355" target="_blank">phishing</a>, malware attacks and email leaks at The <strong>Democratic National Committee</strong> (DNC) and Clinton campaign likely will be unmoved by this report. Those details will remain safely hidden from public view in the classified version of the report.</p>
<p>Last week, the<strong> FBI</strong> and <strong>Department of Homeland Security</strong> issued a <a href="media/1bfbb69b.JAR_16-20296A_GRIZZLY20STEPPE-2016-1229.pdf" data-original-source="https://www.us-cert.gov/sites/default/files/publications/JAR_16-20296A_GRIZZLY%20STEPPE-2016-1229.pdf" target="_blank">joint report</a> (PDF) on some of the malware and Internet resources used in the DNC intrusion. But many experts criticized it as a <a href="http://www.robertmlee.org/critiques-of-the-dhsfbis-grizzly-steppe-report/" target="_blank">poorly-written</a>, jumbled collection of threat indicators and digital clues that didn&#8217;t all quite lead where they should.</p>
<p>Others were perplexed by the high confidence level the agencies assigned to the findings in their unclassified report, noting that neither the FBI nor DHS examined the DNC hard drives that were compromised in the break-in (that work was done by private security firm <strong>Crowdstrike</strong>).</p>
<p>Former black-hat hacker turned <em>Wired</em> and <em>Daily Beast</em> contributing editor <strong>Kevin Poulsen</strong> <a href="http://www.thedailybeast.com/articles/2017/01/06/how-the-u-s-enabled-russian-hack-truthers.html" target="_blank">slammed</a> the FBI/DHS report as &#8220;so aimless that it muddies the clear public evidence that Russia hacked the Democratic Party to affect the election, and so wrong it enables the Trump-friendly conspiracy theorists trying to explain away that evidence.&#8221;</p>
<p>Granted, trying to reconstruct a digital crime scene absent some of the most important pieces of evidence is a bit like attempting to assemble a jigsaw puzzle with only half of the pieces. But as digital forensics and security expert <strong>Jonanthan Zdziarksi </strong><a href="https://twitter.com/JZdziarski/status/817759784992702465" target="_blank">noted</a> via Twitter last night, good old fashioned spying and human intelligence seems to have played a bigger role in pinning the DNC hack on the Russians.</p>
<p>&#8220;The DNI report subtly implied that more weight was put on our intelligence coming from espionage operations than on cyber warfare,&#8221; Zdziarski wrote. &#8220;As someone who’s publicly called out the FBI over misleading the public and the court system, I believe the DNI report to be reliable. I also believe @CrowdStrike’s findings to be reliable based on the people there and their experience with threat intelligence.&#8221;</p>
<div id="attachment_37554" style="width: 590px" class="wp-caption aligncenter"><img class="size-medium wp-image-37554" src="media/0c123d79.russinfl-580x743.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/01/russinfl-580x743.png" alt="Key findings from the DNI report. " width="580" height="743" srcset="http://krebsonsecurity.com/wp-content/uploads/2017/01/russinfl-580x743.png 580w, http://krebsonsecurity.com/wp-content/uploads/2017/01/russinfl.png 635w" sizes="(max-width: 580px) 100vw, 580px" /><p class="wp-caption-text">Key findings from the DNI report.</p></div>
<p><span id="more-37542"></span>My take? Virtually nothing in the DNI report is dispositive of anything in the FBI/DHS report. In other words, the DNI report probably won&#8217;t change anyone&#8217;s minds. I&#8217;m sure that many smart U.S. intelligence analysts spent a great deal of time on this, but none of it was particularly surprising at all: The DNI report describes precisely the kind of cloak and dagger stuff that one might expect the Kremlin to be doing to the United States, day-in and day-out.</p>
<p>What makes these kinds of cyber espionage and propaganda campaigns so worthwhile is that even if the Kremlin cannot always get its favorite candidate elected, Moscow may still consider it a success if it can continuously sow doubt in the minds of Americans about the legitimacy of the U.S. election process and other tenets of democracy.</p>
<p>It&#8217;s also exactly the sort of thing the U.S. government has been doing to other countries for decades. In fact, the U.S. has done so as many as 81 times between 1946 and 2000, according to a database amassed by political scientist Dov Levin of Carnegie Mellon University, <a href="http://www.latimes.com/nation/la-na-us-intervention-foreign-elections-20161213-story.html" target="_blank">writes</a> <strong>Nina Agrawal</strong> for The Los Angeles Times.</p>
<p>Anyone shocked by the Kremlin-funded news station RT in all of this probably never heard of <a href="https://en.wikipedia.org/wiki/Voice_of_America" target="_blank">Voice of America</a>, a U.S. government-funded news service that broadcast the American response to Soviet propaganda during the Cold War.</p>
<p>President-elect Trump has publicly mocked American intelligence assessments that Russia meddled with the U.S. election on his behalf, and said recently that he doubts the U.S. government can be certain it was hackers backed by the Russian government who hacked and leaked emails from the DNC.</p>
<p>Mr. Trump issued a statement last night only loosely acknowledging Russian involvement, saying that &#8220;while Russia, China, other countries, outside groups and people are consistently trying to break through the cyber institutions, businesses and organizations including the Democrat [sic] National Committee, there was absolutely no effect on the outcome of the election including the fact that there was no tampering whatsoever with the voting machines.&#8221;</p>
<p>Trump also has called for a review of the nation’s plans to stop cyberattacks, which he said will be completed within 90 days of his taking office on Jan. 20.</p>
<p>“Whether it is our government, organizations, associations or businesses we need to aggressively combat and stop cyberattacks,” Trump said. “I will appoint a team to give me a plan within 90 days of taking office. The methods, tools and tactics we use to keep America safe should not be a public discussion that will benefit those who seek to do us harm. Two weeks from today I will take the oath of office and America’s safety and security will be my number one priority.”</p>
<p>Time will tell if Mr. Trump&#8217;s team can do anything to slow the frequency of data breaches in the United States. But I hope we can all learn from this report. It&#8217;s open season out there for sure, but there are some fairly simple, immutable truths that each of us should keep in mind, truths that apply equally to political parties, organizations and corporations alike:</p>
<p>-If you connect it to the Internet, someone will try to hack it.</p>
<p>-If what you put on the Internet has value, someone will invest time and effort to steal it.</p>
<p>-Even if what is stolen does not have immediate value to the thief, he can easily find buyers for it.</p>
<p>-The price he secures for it will almost certainly be a tiny slice of its true worth to the victim.</p>
<p>-Organizations and individuals unwilling to spend a small fraction of what those assets are worth to secure them against cybercrooks can expect to eventually be relieved of said assets.</p>
<p>&#8220;We assess Moscow will apply lessons learned from its Putin-ordered campaign aimed at the US presidential election to future influence efforts worldwide, including against US allies and their election processes,&#8221; the DNI report concludes.</p>
<p>Yeah, no kidding. The question is: Will political and corporate leaders begin applying those lessons to their own operations, and gird themselves for full-on, 24/7 cyberattacks from every direction, before, during and after each election? How many more examples do we need to understand that maybe we&#8217;re really not taking this cybersecurity stuff seriously enough given what&#8217;s at stake?</p>
<p>The DNI report is available <a href="media/8bbd792c.ICA_2017_01.pdf" data-original-source="https://www.dni.gov/files/documents/ICA_2017_01.pdf" target="_blank">here</a> (PDF).</p>


feed_id: https://krebsonsecurity.com/?p=37573
title: Krebs’s Immutable Truths About Data Breaches
uri: Krebs-s-Immutable-Truths-About-Data-Breaches
url: https://krebsonsecurity.com/2017/01/krebss-immutable-truths-about-data-breaches/
content:
<p>I&#8217;ve had several requests for a fresh blog post to excerpt something that got crammed into the corner of <a href="https://krebsonsecurity.com/2017/01/dni-putin-led-cyberattack-propaganda-effort-to-elect-trump-denigrate-clinton/" target="_blank">a lengthy story published here Sunday</a>: A list of immutable truths about data breaches, cybersecurity and the consequences of inaction.</p>
<p>Here&#8217;s the excerpt requested from yesterday&#8217;s story:</p>
<p><img class="alignright wp-image-37585" src="media/6f073727.coecopy.jpg" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/01/coecopy.jpg" alt="coecopy" width="244" height="213" />&#8220;There are some fairly simple, immutable truths that each of us should keep in mind, truths that apply equally to political parties, organizations and corporations alike:</p>
<p>-If you connect it to the Internet, someone will try to hack it.</p>
<p>-If what you put on the Internet has value, someone will invest time and effort to steal it.</p>
<p>-Even if what is stolen does not have immediate value to the thief, he can easily find buyers for it.</p>
<p>-The price he secures for it will almost certainly be a tiny slice of its true worth to the victim.</p>
<p>-Organizations and individuals unwilling to spend a small fraction of what those assets are worth to secure them against cybercrooks can expect to eventually be relieved of said assets.&#8221;</p>
<p>They may not be complete, but as a set of truisms these tenets probably will age pretty well. After all, taken as a whole they are practically a model <em>Cybercriminal Code of Ethics</em>, or a cybercrook&#8217;s social contract.<span id="more-37573"></span></p>
<p>Nevertheless, these tenets might be even more powerful if uttered in the voice of the crook himself. That may be more in keeping with the theme of this blog overall, which seeks to explain cybersecurity and cybercrime concepts through the lens of the malicious attacker (often this is a purely economic perspective).</p>
<p>So let&#8217;s rifle through this ne&#8217;er-do-well&#8217;s bag of tricks, tools and tells. Let us borrow from his literary perspective. I imagine a <em>Cybercriminal Code of Ethics</em> might go something like this (again, in the voice of a seasoned crook):</p>
<blockquote><p>-If you hook it up to the Internet, we&#8217;re gonna hack at it.</p>
<p>-If what you put on the Internet is worth anything, one of us is gonna try to steal it.</p>
<p>-Even if we can&#8217;t use what we stole, it&#8217;s no big deal. There&#8217;s no hurry to sell it. Also, we know people.</p>
<p>-We can&#8217;t promise to get top dollar for what we took from you, but hey &#8212; it&#8217;s a buyer&#8217;s market. Be glad we didn&#8217;t just publish it all online.</p>
<p>-If you can&#8217;t or won&#8217;t invest a fraction of what your stuff is worth to protect it from the likes of us, don&#8217;t worry: You&#8217;re our favorite type of customer!</p></blockquote>


feed_id: https://krebsonsecurity.com/?p=37597
title: Extortionists Wipe Thousands of Databases, Victims Who Pay Up Get Stiffed
uri: Extortionists-Wipe-Thousands-of-Databases-Victims-Who-Pay-Up-Get-Stif
url:
https://krebsonsecurity.com/2017/01/extortionists-wipe-thousands-of-databases-victims-who-pay-up-get-stiffed/

content:
<p>Tens of thousands of personal and possibly proprietary databases that were left accessible to the public online have just been wiped from the Internet, replaced with ransom notes demanding payment for the return of the files. Adding insult to injury, it appears that virtually none of the victims have paid the ransom have gotten their files back because multiple fraudsters are now wise to the extortion attempts and are competing to replace each other&#8217;s ransom notes.</p>
<p>At the eye of this developing data destruction maelstrom is an online database platform called <a href="https://en.wikipedia.org/wiki/MongoDB" target="_blank">MongoDB</a><strong>. </strong>Tens of thousands of organizations use MongoDB to store data, but it is easy to misconfigure and leave the database exposed online. If installed on a server with the default settings, for example, MongoDB allows anyone to browse the databases, download them, or even write over them and delete them.</p>
<div id="attachment_37598" style="width: 590px" class="wp-caption aligncenter"><a class="lightbox" href="media/882e6258.shodanmongo.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/01/shodanmongo.png"><img class="wp-image-37598 size-medium" src="media/8277f0be.shodanmongo-580x328.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/01/shodanmongo-580x328.png" alt="Shodan, a specialized search engine designed to find things that probably won't be picked up by Google, lists the number of open, remotely accessible MongDB databases available as of Jan. 10, 2017." width="580" height="328" srcset="http://krebsonsecurity.com/wp-content/uploads/2017/01/shodanmongo-580x328.png 580w, http://krebsonsecurity.com/wp-content/uploads/2017/01/shodanmongo-768x435.png 768w, http://krebsonsecurity.com/wp-content/uploads/2017/01/shodanmongo-940x532.png 940w" sizes="(max-width: 580px) 100vw, 580px" /></a><p class="wp-caption-text">Shodan, a specialized search engine designed to find things that probably won&#8217;t be picked up by Google, lists the number of open, remotely accessible MongDB databases available as of Jan. 10, 2017.</p></div>
<p>This blog has featured <a href="https://krebsonsecurity.com/?s=mongodb&amp;x=0&amp;y=0" target="_blank">several stories</a> over the years about companies accidentally publishing user data via incorrectly configured MongoDB databases. In March 2016, for example, KrebsOnSecurity broke the news that <strong>Verizon Enterprise Solutions</strong> managed to <a href="https://krebsonsecurity.com/2016/03/crooks-steal-sell-verizon-enterprise-customer-data/" target="_blank">leak the contact information on some 1.5 million customers</a> because of a publicly accessible MongoDB installation.</p>
<p>Point is, this is a known problem, and almost once a week some security researcher is Tweeting that he&#8217;s discovered another huge open MongoDB database. There are simple queries that anyone can run via search engines like <a href="https://shodan.io" target="_blank">Shodan</a> that will point to all of the open MongoDB databases out there at any given time. For example, the latest query via Shodan (see image above) shows that there are more than 52,000 publicly accessible MongoDB databases on the Internet right now. The largest share of open MongoDB databases are here in the United States.</p>
<p>Normally, when one runs a query on Shodan to list all available MongoDB databases, what one gets in return is a list of variously-named databases, and many databases with default filenames like &#8220;local.&#8221;</p>
<p>But when researcher <a href="https://twitter.com/0xDUDE" target="_blank">Victor Gevers</a> ran that same query earlier this week, he noticed that far too many of the database listings returned by the query had names like &#8220;readme,&#8221; &#8220;readnow,&#8221; &#8220;encrypted&#8221; and &#8220;readplease.&#8221; Inside each of these databases is exactly one file: a database file that includes a contact email address and/or a bitcoin address and a payment demand.</p>
<p>Researcher <a href="https://twitter.com/nmerrigan" target="_blank">Niall Merrigan</a>, a solutions architect for French consulting giant <strong>Cap Gemini</strong>, has been working with Gevers to help victims on his personal time, and to help maintain a public document that&#8217;s live-chronicling the damage from the now widespread extortion attack. Merrigan said it seems clear that multiple actors are wise to the scam because if you wait a few minutes after running the Shodan query and then re-run the query, you&#8217;ll find the same Internet addresses that showed up in the database listings from the previous query, but you&#8217;ll also notice that many now have a different database title and a new ransom note.</p>
<p>Merrigan and Gevers are maintaining <a href="https://docs.google.com/spreadsheets/d/1QonE9oeMOQHVh8heFIyeqrjfKEViL0poLnY8mAakKhM/edit#gid=2122582863" target="_blank">a public Google Drive document</a> (read-only) that is tracking the various victims and ransom demands. Merrigan said it appears that at least 29,000 MongoDB databases that were previously published online are now erased. Worse, hardly anyone who&#8217;s paid the ransom demands has yet received their files back.</p>
<div id="attachment_37599" style="width: 590px" class="wp-caption aligncenter"><a class="lightbox" href="media/099b13c2.victs.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/01/victs.png"><img class="wp-image-37599 size-medium" src="media/c6adaee7.victs-580x300.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/01/victs-580x300.png" alt="A screen shot of the Google Drive document that Merrigan is maintaining to track the various ransom campaigns. This tab lists victims by industry. As we can see, many have paid the ransom but none have reported receiving their files back." width="580" height="300" srcset="http://krebsonsecurity.com/wp-content/uploads/2017/01/victs-580x300.png 580w, http://krebsonsecurity.com/wp-content/uploads/2017/01/victs-768x397.png 768w, http://krebsonsecurity.com/wp-content/uploads/2017/01/victs-940x486.png 940w" sizes="(max-width: 580px) 100vw, 580px" /></a><p class="wp-caption-text">A screen shot of the Google Drive document that Merrigan is maintaining to track the various ransom campaigns. This tab lists victims by industry. As we can see, many have paid the ransom but none have reported receiving their files back.</p></div>
<p>&#8220;It&#8217;s like the kidnappers keep delivering the ransom notes, but you don&#8217;t know who has the actual original data,&#8221; Merrigan said. &#8220;That&#8217;s why we&#8217;re tracking the notes, so that if we see the [databases] are being exfiltrated by the thieves, we can know the guys who should actually get paid if they want to get their data back.&#8221;<span id="more-37597"></span></p>
<p>For now, Merrigan is advising victims not to pay the ransom. He encouraged those inclined to do so anyway to demand &#8220;proof of life&#8221; from the extortionists &#8212; i.e., request that they share one or two of the deleted files to prove that they can restore the entire cache.</p>
<p>Merrigan said the attackers appear to be following the plan of attack. Use Shodan to scan for open MongoDB databases, connect using anonymous access, and then list all available databases. The attacker may or may not download the data before deleting it, leaving in its place a single database file with the extortionists contact and payment info and ransom note.</p>
<p>Merrigan said it&#8217;s unclear what prompted this explosion in extortion attacks on MongoDB users, but he suspects someone developed a &#8220;method&#8221; for extorting others that was either shared, sold or leaked to other ne&#8217;er-do-wells, who then began competing to scam each other &#8212; leaving victims in the lurch.</p>
<p>&#8220;It&#8217;s like the early 1800s gold rush in the United States, everyone is just going west at the same time,&#8221; Merrigan said. &#8220;The problem is, everyone was sold the same map.&#8221;</p>
<p><strong>Zach Wikholm</strong>, a research developer at New York City-based security firm Flashpoint said he&#8217;s confirmed that at least 20,000 databases have been deleted &#8212; possibly permanently.</p>
<p>&#8220;You&#8217;re looking at over 20,000 databases that have gone from being useful to being encrypted and held for ransom,&#8221; Wikholm said. <span class="pullquote pqright">&#8220;I&#8217;m not sure the Internet as a whole has ever experienced anything like this at one time.</span> The fact that we can pull down the number of databases that have been compromised and are still compromised is not a good sign. It means that most victims are unaware what has happened, or they&#8217;re not sure how it&#8217;s happened or what to do about it.&#8221;</p>
<p>Normally, I don&#8217;t have great timing, but yesterday&#8217;s posts on <a href="https://krebsonsecurity.com/2017/01/krebss-immutable-truths-about-data-breaches/" target="_blank">Immutable Truths About Data Breaches</a> seems almost prescient given this developing attack. Truth 1: &#8220;If you connect it to the Internet, someone will try to hack it.&#8221; Truth 2: &#8220;If what you put on the Internet has value, someone will invest time and effort to steal it.&#8221; Truth 3: &#8220;Organizations and individuals unwilling to spend a small fraction of what those assets are worth to secure them against cybercrooks can expect to eventually be relieved of said assets.”</p>
<p><em>H/T to <a href="https://www.grahamcluley.com/author/grahamcluley/" target="_blank">Graham Cluley</a> for a heads-up on this situation.</em></p>
<p><strong>Update, 1:55 p.m. ET:</strong> Clarified the default settings of a MongoDB installation. Also clarified story to note that Gevers discovered the extortion attempts.</p>


