# articles

feed_id: https://krebsonsecurity.com/?p=47305
title: Experts: Breach at IT Outsourcing Giant Wipro
uri: Experts-Breach-at-IT-Outsourcing-Giant-Wipro
url: https://krebsonsecurity.com/2019/04/experts-breach-at-it-outsourcing-giant-wipro/
content:
<p>Indian information technology (IT) outsourcing and consulting giant <strong>Wipro Ltd.</strong> [<a href="https://www.nasdaq.com/symbol/wit" target="_blank" rel="noopener">NYSE:WIT</a>] is investigating reports that its own IT systems have been hacked and are being used to launch attacks against some of the company&#8217;s customers, multiple sources tell KrebsOnSecurity. Wipro has refused to respond to questions about the alleged incident.</p>
<p><img class="alignright wp-image-47380" src="media/c8357d7c.wiprologo.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/04/wiprologo.jpg" alt="" width="258" height="205" />Earlier this month, KrebsOnSecurity heard independently from two trusted sources that <a href="https://en.wikipedia.org/wiki/Wipro" target="_blank" rel="noopener">Wipro</a> &#8212; India&#8217;s third-largest IT outsourcing company &#8212; was dealing with a multi-month intrusion from an assumed state-sponsored attacker.</p>
<p>Both sources, who spoke on condition of anonymity, said Wipro&#8217;s systems were seen being used as jumping-off points for digital fishing expeditions targeting at least a dozen Wipro customer systems.</p>
<p>The security experts said Wipro&#8217;s customers traced malicious and suspicious network reconnaissance activity back to partner systems that were communicating directly with Wipro&#8217;s network.</p>
<p>On April 9, KrebsOnSecurity reached out to Wipro for comment. That prompted an email on Apr. 10 from <strong>Vipin Nair</strong>, Wipro&#8217;s head of communications. Nair said he was traveling and needed a few days to gather more information before offering an official response.</p>
<p>On Friday, Apr. 12, Nair sent a statement that acknowledged none of the questions Wipro was asked about an alleged security incident involving attacks against its own customers.</p>
<p>&#8220;Wipro has a multilayer security system,&#8221; the company wrote. &#8220;The company has robust internal processes and a system of advanced security technology in place to detect phishing attempts and protect itself from such attacks. We constantly monitor our entire infrastructure at heightened level of alertness to deal with any potential cyber threat.&#8221;</p>
<p>Wipro has not responded to multiple additional requests for comment. Since then, two more sources with knowledge of the investigation have come forward to confirm the outlines of the incident described above.<span id="more-47305"></span></p>
<p>One source familiar with the forensic investigation at a Wipro customer said it appears at least 11 other companies were attacked, as evidenced from file folders found on the intruders&#8217; back-end infrastructure that were named after various Wipro clients. That source declined to name the other clients.</p>
<p>The other source said Wipro is now in the process of building out a new private email network because the intruders were thought to have compromised Wirpo&#8217;s corporate email system for some time. The source also said Wipro is now telling concerned clients about specific &#8220;indicators of compromise,&#8221; telltale clues about tactics, tools and procedures used by the bad guys that might signify an attempted or successful intrusion.</p>
<p>Wipro says it has more than 170,000 employees helping clients across six continents with Fortune 500 customers in healthcare, banking, communications and other industries. In March 2018, Wipro said it passed the $8 billion mark in annual IT services revenue.</p>
<p>The apparent breach comes amid shifting fortunes at Wipro. On March 5, the State of Nebraska abruptly canceled a contract with Wipro after spending $6 million with the company. In September 2018, the Nebraska Department of Health and Human Services issued a cease-and-desist letter to Wipro, ordering it to stop work on the upgrade to the state&#8217;s Medicaid enrollment system, and to vacate its state offices. Wipro is <a href="https://journalstar.com/news/state-and-regional/govt-and-politics/state-of-nebraska-cancels-contract-after-spending-m-company-sues/article_8c9eda53-c6a7-5398-a281-1eb5c30d7127.html" target="_blank" rel="noopener">now suing Nebraska</a>, saying its project was on schedule and on budget.</p>
<p>In August 2018, Wipro <a href="https://www.theregister.co.uk/2018/08/06/botched_sap_implementation_national_grid_wipro_settlement_75m/" target="_blank" rel="noopener">paid $75 million to settle a lawsuit</a> over a <a href="https://upperedge.com/sap/wipro-responds-to-national-grids-sap-implementation-billion-dollar-lawsuit/" target="_blank" rel="noopener">botched SAP implementation</a> that reportedly cost the National Grid US hundreds of millions of dollars to fix.</p>
<p>Another curious, if only coincidental, development: On April 4, 2019, the government of India sold &#8220;enemy&#8221; shares in Wipro worth approximately $166 million. According to <a href="https://www.business-standard.com/article/companies/govt-sells-rs-1-150-cr-enemy-wipro-shares-state-owned-firms-major-buyers-119040401303_1.html" target="_blank" rel="noopener">this article</a> in <em>The Business Standard</em>, enemy shares are so called because they were originally held by people who migrated to Pakistan or China and are not Indian citizens any longer.</p>
<p>&#8220;A total of 44.4 million shares, which were held by the Custodian of Enemy Property for India, were sold at Rs 259 apiece on the Bombay Stock Exchange,&#8221; The Business Standard reported. &#8220;The buyers were state-owned Life Insurance Corporation of India (LIC), New India Assurance and General Insurance Corporation. LIC&#8221;</p>
<p>Wipro is expected to announce its fourth-quarter earnings report on <a href="media/57eeca8f.quarter-ended-march-31-2019-to-be-announced-on-april-16-2019.pdf" data-original-source="https://www.wipro.com/content/dam/nexus/en/investor/news/2019/results-for-the-fourth-quarter-ended-march-31-2019-to-be-announced-on-april-16-2019.pdf" target="_blank" rel="noopener">Tuesday, April 16</a> (PDF).</p>


feed_id: https://krebsonsecurity.com/?p=47413
title: How Not to Acknowledge a Data Breach
uri: How-Not-to-Acknowledge-a-Data-Breach
url: https://krebsonsecurity.com/2019/04/how-not-to-acknowledge-a-data-breach/
content:
<p>I&#8217;m not a huge fan of stories about stories, or those that explore the ins and outs of reporting a breach. But occasionally I feel obligated to publish such accounts when companies respond to a breach report in such a way that it&#8217;s crystal clear they wouldn&#8217;t know what to do with a data breach if it bit them in the nose, let alone festered unmolested in some dark corner of their operations.</p>
<p><img class="alignright wp-image-47380" src="media/c8357d7c.wiprologo.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/04/wiprologo.jpg" alt="" width="254" height="202" />And yet, here I am again writing the second story this week about a possibly serious security breach at an Indian company that provides IT support and outsourcing for a ridiculous number of major U.S. corporations (spoiler alert: the second half of this story actually contains quite a bit of news about the breach investigation).</p>
<p>On Monday, KrebsOnSecurity <a href="https://krebsonsecurity.com/2019/04/experts-breach-at-it-outsourcing-giant-wipro/" target="_blank" rel="noopener">broke the news</a> that multiple sources were reporting a cybersecurity breach at <strong>Wipro</strong>, the third-largest IT services provider in India and a major trusted vendor of IT outsourcing for U.S. companies. The story cited reports from multiple anonymous sources who said Wipro&#8217;s trusted networks and systems were being used to launch cyberattacks against the company&#8217;s customers.</p>
<p>Wipro asked for <em>several days</em> to investigate the request and formulate a public comment. Three days after I reached out, the quote I ultimately got from them didn&#8217;t acknowledge any of the concerns raised by my sources. Nor did the statement even acknowledge a security incident.</p>
<p>Six hours after my story ran saying Wipro was in the throes of responding to a breach, the company was <a href="https://tech.economictimes.indiatimes.com/news/corporate/wipro-it-systems-may-have-been-hacked-and-used-to-attack-its-clients-report/68899479" target="_blank" rel="noopener">quoted in an Indian daily newspaper</a> acknowledging a phishing incident. The company&#8217;s statement claimed its sophisticated systems detected the breach internally and identified the affected employees, and that it had hired an outside digital forensics firm to investigate further.</p>
<p>Less than 24 hours after my story ran, Wipro executives were asked on a quarterly investor conference call to respond to my reporting. <strong>Wipro Chief Operating Officer Bhanu Ballapuram</strong> told investors that many of the details in my story were in error, and implied that the breach was limited to a few employees who got phished. The matter was characterized as handled, and other journalists on the call moved on to different topics.</p>
<p>At this point, I added a question to the queue on the earnings conference call and was afforded the opportunity to ask Wipro&#8217;s executives what portion(s) of my story was inaccurate. A Wipro executive then proceeded to read bits of <a href="https://twitter.com/Wipro/status/1118084262849171456" target="_blank" rel="noopener">a written statement</a> about their response to the incident, and the company&#8217;s chief operating officer agreed to have a one-on-one call with KrebsOnSecurity to address the stated grievances about my story. Security reporter <strong>Graham Cluley</strong> was kind enough to record that bit of the call and <a href="https://twitter.com/gcluley/status/1118203223528169474" target="_blank" rel="noopener">post it on Twitter</a>.</p>
<div align="center"><iframe src="https://www.youtube.com/embed/swtIOJivlTc" width="560" height="315" frameborder="0" allowfullscreen="allowfullscreen"></iframe></div>
<p>In the follow-up call with Wipro, Ballapuram<strong> </strong>took issue with my characterization that the breach had lasted &#8220;months,&#8221; saying it had only been a matter of weeks since employees at the company had been successfully phished by the attackers. I then asked when the company believed the phishing attacks began, and Ballapuram said he could not confirm the approximate start date of the attacks beyond &#8220;weeks.&#8221;</p>
<p>Ballapuram also claimed that his corporation was hit by a &#8220;zero-day&#8221; attack. Actual zero-day vulnerabilities involve somewhat infrequent and quite dangerous weaknesses in software and/or hardware that not even the maker of the product in question understands before the vulnerability is discovered and exploited by attackers for private gain.</p>
<p>Because zero-day flaws usually refer to software that is widely in use, it&#8217;s generally considered good form if one experiences such an attack to share any available details with the rest of the world about how the attack appears to work &#8212; in much the same way you might hope a sick patient suffering from some unknown, highly infectious disease might nonetheless choose to help doctors diagnose how the infection could have been caught and spread.</p>
<p>Wipro has so far ignored specific questions about the supposed zero-day, other than to say &#8220;based on our interim investigation, we have shared the relevant information of the zero-day with our AV [antivirus] provider and they have released the necessary signatures for us.&#8221;</p>
<p>My guess is that what Wipro means by &#8220;zero-day&#8221; is a malicious email attachment that went undetected by all commercial antivirus tools before it infected Wipro employee systems with malware.</p>
<p>Ballapuram added that Wipro has gathered and disseminated to affected clients a set of “indicators of compromise,” telltale clues about tactics, tools and procedures used by the bad guys that might signify an attempted or successful intrusion.</p>
<p>Hours after that call with Ballapuram, I heard from a major U.S. company that is partnering with Wipro (at least for now). The source said his employer opted to sever all online access to Wipro employees within days of discovering that these Wipro accounts were being used to target his company&#8217;s operations.</p>
<p>The source said the indicators of compromise that Wipro shared with its customers came from a Wipro customer who was targeted by the attackers, but that Wipro was sending those indicators to customers as if they were something Wipro&#8217;s security team had put together on its own.</p>
<p>So let&#8217;s recap Wipro&#8217;s public response so far:</p>
<p>-Ignore reporter&#8217;s questions for days and then pick nits in his story during a public investor conference call.<br />
-Question the stated timing of breach, but refuse to provide an alternative timeline.<br />
-Downplay the severity of the incident and characterize it as handled, even when they&#8217;ve only just hired an outside forensics firm.<br />
-Say the intruders deployed a &#8220;zero-day attack,&#8221; and then refuse to discuss details of said zero-day.<br />
-Claim the IoCs you&#8217;re sharing with affected clients were discovered by you when they weren&#8217;t.</p>
<h4>WHAT DID THE ATTACKERS DO?</h4>
<p>The criminals responsible for breaching Wipro appear to be after anything they can turn into cash fairly quickly. A source I spoke with at a large retailer and Wipro customer said the crooks who broke into Wipro used their access to perpetrate gift card fraud at the retailer&#8217;s stores.</p>
<p>I suppose that&#8217;s something of a silver lining for Wipro at least, if not also its customers: An intruder that was more focused on extracting intellectual property or other more strategic assets from Wipro&#8217;s customers probably could have gone undetected for a much longer period.</p>
<p>A source close to the investigation who asked not to be identified because he was not authorized to speak to the news media said the company hired by Wipro to investigate the breach dated the first phishing attacks back to March 11, when a single employee was phished.</p>
<p>The source said a subsequent phishing campaign between March 16 and 19 netted 22 additional Wipro employees, and that the vendor investigating the incident has so far discovered more than 100 Wipro endpoints that were seeded with ScreenConnect, a legitimate remote access tool sold by Connectwise.com. Investigators believe the intruders were using the ScreenConnect software on the hacked Wipro systems to connect remotely to Wipro client systems, which were then used to leverage further access into Wipro customer networks.</p>
<p>Additionally, investigators found at least one of the compromised endpoints was attacked with <a href="https://www.varonis.com/blog/what-is-mimikatz/" rel="noopener" target="_blank">Mimikatz</a>, an open source tool that can dump passwords stored in the temporary memory cache of a Microsoft Windows device.</p>
<p>The source also said the vendor is still discovering newly-hacked systems, <em>suggesting that Wipro&#8217;s systems are still compromised, and that additional hacked endpoints may still be undiscovered within Wipro.</em></p>
<p>Wipro has not yet responded to follow-up requests for comment.</p>
<p>I&#8217;m sure there are smart, well-meaning and capable people who care about security and happen to work at Wipro, but I&#8217;m not convinced any of those individuals are employed in leadership roles at the company. Perhaps Wipro&#8217;s actions in the wake of this incident merely reflect the reality that India <a href="https://webcache.googleusercontent.com/search?q=cache:13EmkS_vEqQJ:https://www.lexology.com/library/detail.aspx%3Fg%3Dea085538-f5c7-4d9f-b267-dd8d930ff1d0+&amp;cd=10&amp;hl=en&amp;ct=clnk&amp;gl=us" target="_blank" rel="noopener">currently has no laws requiring data owners or processors to notify individuals in the event of a breach</a>.</p>
<p>Overall, I&#8217;m willing to chalk this entire episode up to a complete lack of training in how to deal with the news media, but if I were a customer of Wipro I&#8217;d be more than a little concerned about the tone-deaf nature of the company&#8217;s response thus far.</p>
<p>As one follower on Twitter <a href="https://twitter.com/ThomLangford/status/1118182880998580225" target="_blank" rel="noopener">remarked</a>, &#8220;openness and transparency speaks of integrity and a willingness to learn from mistakes. Doing the exact opposite smacks of something else entirely.&#8221;</p>
<p>In the interests of openness, <a href="https://krebsonsecurity.com/wp-content/uploads/2019/04/wiproiocs.txt" target="_blank" rel="noopener">here are some indicators of compromise</a> that Wipro customers are distributing about this incident (I had to get these from one of Wipro&#8217;s partners as the company declined to share the IoCs directly with KrebsOnSecurity).</p>


feed_id: https://krebsonsecurity.com/?p=47453
title: Wipro Intruders Targeted Other Major IT Firms
uri: Wipro-Intruders-Targeted-Other-Major-IT-Firms
url: https://krebsonsecurity.com/2019/04/wipro-intruders-targeted-other-major-it-firms/
content:
<p>The crooks responsible for launching phishing campaigns that netted dozens of employees and more than 100 computer systems last month at <strong>Wipro</strong>, India&#8217;s third-largest IT outsourcing firm, also appear to have targeted a number of other competing providers, including <a href="https://www.infosys.com" target="_blank" rel="noopener">Infosys</a> and <a href="https://www.cognizant.com" target="_blank" rel="noopener">Cognizant</a>, new evidence suggests. The clues so far suggest the work of a fairly experienced crime group that is focused on perpetrating gift card fraud.</p>
<p>On Monday, KrebsOnSecurity <a href="https://krebsonsecurity.com/2019/04/experts-breach-at-it-outsourcing-giant-wipro/" target="_blank" rel="noopener">broke the news</a> that multiple sources were reporting a cybersecurity breach at Wipro, a major trusted vendor of IT outsourcing for U.S. companies. The story cited reports from multiple anonymous sources who said Wipro’s trusted networks and systems were being used to launch cyberattacks against the company’s customers.</p>
<p>In <a href="https://krebsonsecurity.com/2019/04/how-not-to-acknowledge-a-data-breach/" target="_blank" rel="noopener">a follow-up story Wednesday</a> on the tone-deaf nature of Wipro&#8217;s public response to this incident, KrebsOnSecurity published <a href="https://krebsonsecurity.com/wp-content/uploads/2019/04/wiproiocs.txt" target="_blank" rel="noopener">a list of &#8220;indicators of compromise&#8221; or IOCs</a>, telltale clues about tactics, tools and procedures used by the bad guys that might signify an attempted or successful intrusion.</p>
<p>If one examines the subdomains tied to just one of the malicious domains mentioned in the IoCs list (internal-message[.]app), one very interesting Internet address is connected to all of them &#8212; <a href="https://www.virustotal.com/en/ip-address/185.159.83.24/information/" target="_blank" rel="noopener">185.159.83[.]24</a>. This address is owned by <a href="https://krebsonsecurity.com/?s=%22king+servers%22&amp;x=0&amp;y=0" target="_blank" rel="noopener">King Servers</a>, a well-known bulletproof hosting company based in Russia.</p>
<p>According to records maintained by <a href="https://www.farsightsecurity.com" target="_blank" rel="noopener">Farsight Security</a>, that address is home to a number of other likely phishing domains:</p>
<p>securemail.pcm.com.internal-message[.]app<br />
secure.wipro.com.internal-message[.]app<br />
securemail.wipro.com.internal-message[.]app<br />
secure.elavon.com.internal-message[.]app<br />
securemail.slalom.com.internal-message[.]app<br />
securemail.avanade.com.internal-message[.]app<br />
securemail.infosys.com.internal-message[.]app<br />
securemail.searshc.com.internal-message[.]app<br />
securemail.capgemini.com.internal-message[.]app<br />
securemail.cognizant.com.internal-message[.]app<br />
secure.rackspace.com.internal-message[.]app<br />
securemail.virginpulse.com.internal-message[.]app<br />
secure.expediagroup.com.internal-message[.]app<br />
securemail.greendotcorp.com.internal-message[.]app<br />
secure.bridge2solutions.com.internal-message[.]app<br />
ns1.internal-message[.]app<br />
ns2.internal-message[.]app<br />
mail.internal-message[.]app<br />
ns3.microsoftonline-secure-login[.]com<br />
ns4.microsoftonline-secure-login[.]com<br />
tashabsolutions[.]xyz<br />
www.tashabsolutions[.]xyz</p>
<p>The subdomains listed above suggest the attackers may also have targeted American retailer <a href="https://www.sears.com" target="_blank" rel="noopener">Sears</a>; <a href="https://www.greendot.com" target="_blank" rel="noopener">Green Dot</a>, the world&#8217;s largest prepaid card vendor; payment processing firm <a href="https://www.elavon.com" target="_blank" rel="noopener">Elavon</a>; hosting firm <a href="https://www.rackspace.com" target="_blank" rel="noopener">Rackspace</a>; business consulting firm <a href="https://www.avanade.com" target="_blank" rel="noopener">Avanade</a>; IT provider <a href="http://www.pcm.com/n/About-Us/navLinks-151" target="_blank" rel="noopener">PCM</a>; and French consulting firm <a href="https://www.capgemini.com" target="_blank" rel="noopener">Capgemini</a>, among others. KrebsOnSecurity has reached out to all of these companies for comment, and will update this story in the event any of them respond with relevant information.</p>
<h4>WHAT ARE THEY AFTER?</h4>
<p>It appears the attackers in this case are targeting companies that in one form or another have access to either a ton of third-party company resources, and/or companies that can be abused to conduct gift card fraud.</p>
<p>Wednesday&#8217;s follow-up on the Wipro breach quoted an anonymous source close to the investigation saying the criminals responsible for breaching Wipro appear to be after anything they can turn into cash fairly quickly. That source, who works for a large U.S. retailer, said the crooks who broke into Wipro used their access to perpetrate gift card fraud at the retailer’s stores.</p>
<p>Another source said the investigation into the Wipro breach by a third party company has determined so far the intruders compromised more than 100 Wipro systems  and installed on each of them <strong>ScreenConnect</strong>, a legitimate remote access tool. Investigators believe the intruders were using the ScreenConnect software on the hacked Wipro systems to connect remotely to Wipro client systems, which were then used to leverage further access into Wipro customer networks.</p>
<p>This is remarkably similar to activity that was directed in 2016 and 2017 against Cognizant, one of Wipro&#8217;s competitors and likely the target of the same attackers. In May 2018, <strong>Maritz Holdings Inc.</strong>, a Missouri-based firm that handles customer loyalty and gift card programs for third-parties, <a href="media/ae65404b.cognizant.pdf" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/04/cognizant.pdf" target="_blank" rel="noopener">sued Cognizant</a> (PDF), saying a <a href="https://stlrecord.com/stories/511446468-maritz-sues-it-contractor-after-cyberattacks-in-2016-and-2017-related-to-rewards-card-programs" target="_blank" rel="noopener">forensic investigation</a> determined that hackers had broken into Cognizant&#8217;s systems and used them to pivot attacks into Maritz&#8217;s loyalty program and siphon more than $11 million in fraudulent eGift cards.<span id="more-47453"></span></p>
<p>That investigation determined the attackers also used ScreenConnect to access computers belonging to Maritz employees. &#8220;This was the same tool that was used to effectuate the cyber-attack in Spring 2016. Intersec [the forensic investigator] also determined that the attackers had run searches on the Maritz system for certain words and phrases connected to the Spring 2016 attack.&#8221;</p>
<p>According to the lawsuit by Maritz Holdings, investigators also determined that the &#8220;attackers were accessing the Maritz system using accounts registered to Cognizant. For example, in April 2017, someone using a Cognizant account utilized the “fiddler” hacking program to circumvent cyber protections that Maritz had installed several weeks earlier.&#8221;</p>
<p>Maritz said its forensic investigator found the attackers had run searches on the Maritz system for certain words and phrases connected to the Spring 2016 eGift card cashout. Likewise, my retailer source in the Wipro attack told KrebsOnSecurity that the attackers who defrauded them also searched their systems for specific phrases related to gift cards, and for clues about security systems the retailer was using.</p>
<p>It&#8217;s unclear if the work of these criminal hackers is tied to a specific, known threat group. But it seems likely that the crooks who hit Wipro have been targeting similar companies for some time now, and with a fair degree of success in translating their access to cash given the statements by my sources in the Wipro breach and this lawsuit against Cognizant.</p>
<p>What&#8217;s remarkable is how many antivirus companies still aren&#8217;t flagging as malicious many of the Internet addresses and domains listed in the IoCs, as evidenced by a search at <a href="https://www.virustotal.com" target="_blank" rel="noopener">virustotal.com</a>.</p>


feed_id: https://krebsonsecurity.com/?p=47490
title: Marcus “MalwareTech” Hutchins Pleads Guilty to Writing, Selling Banking Malware
uri: Marcus-MalwareTech-Hutchins-Pleads-Guilty-to-Writing-Selling-Ba
url:
https://krebsonsecurity.com/2019/04/marcus-malwaretech-hutchins-pleads-guilty-to-writing-selling-banking-malware/

content:
<p><strong>Marcus Hutchins,</strong> a 24-year-old blogger and malware researcher arrested in 2017 for allegedly authoring and selling malware designed to steal online banking credentials, has pleaded guilty to criminal charges of conspiracy and to making, selling or advertising illegal wiretapping devices.</p>
<div id="attachment_40551" style="width: 606px" class="wp-caption aligncenter"><img class=" wp-image-40551" src="media/83b44897.hutchins.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2017/09/hutchins.png" alt="" width="596" height="297" srcset="https://krebsonsecurity.com/wp-content/uploads/2017/09/hutchins.png 622w, https://krebsonsecurity.com/wp-content/uploads/2017/09/hutchins-580x289.png 580w" sizes="(max-width: 596px) 100vw, 596px" /><p class="wp-caption-text">Marcus Hutchins, just after he was revealed as the security expert who stopped the WannaCry worm. Image: twitter.com/malwaretechblog</p></div>
<p>Hutchins, who authors the popular blog <a href="https://www.malwaretech.com/" target="_blank" rel="noopener">MalwareTech</a>, was virtually unknown to most in the security community until May 2017 when the U.K. media revealed him as the “accidental hero” who inadvertently halted the global spread of <a href="https://en.wikipedia.org/wiki/WannaCry_ransomware_attack" target="_blank" rel="noopener">WannaCry</a>, a ransomware contagion that had taken the world by storm just days before.</p>
<p>In August 2017, Hutchins was arrested by FBI agents in Las Vegas on suspicion of authoring and/or selling “<a href="https://en.wikipedia.org/wiki/Kronos_(malware)" target="_blank" rel="noopener">Kronos</a>,” a strain of malware designed to steal online banking credentials. A British citizen, Hutchins has been barred from leaving the United States since his arrest.</p>
<p>Many of Hutchins&#8217; supporters and readers had trouble believing the charges against him, and in response KrebsOnSecurity <a href="https://krebsonsecurity.com/2017/09/who-is-marcus-hutchins/" target="_blank" rel="noopener">published a lengthy investigation</a> into activities tied to his various online personas over the years.</p>
<p>As I wrote in summary of that story, the clues suggested &#8220;Hutchins began developing and selling malware in his mid-teens &#8212; only to later develop a change of heart and earnestly endeavor to leave that part of his life squarely in the rearview mirror.&#8221; Nevertheless, there were a number of indications that Hutchins&#8217; alleged malware activity continued into his adulthood.</p>
<p>In <a href="https://www.malwaretech.com/public-statement" target="_blank" rel="noopener">a statement</a> posted to <a href="https://twitter.com/MalwareTechBlog" target="_blank" rel="noopener">his Twitter feed</a> and to malwaretech.com, Hutchins said today he had pleaded guilty to two charges related to writing malware in the years prior to his career in security.<span id="more-47490"></span></p>
<p>&#8220;I regret these actions and accept full responsibility for my mistakes,&#8221; Hutchins wrote. &#8220;Having grown up, I’ve since been using the same skills that I misused several years ago for constructive purposes. I will continue to devote my time to keeping people safe from malware attacks.&#8221;</p>
<p>Hutchins pleaded guilty to two of the 10 counts for which he was originally accused, including conspiracy charges and violating <a href="https://www.law.cornell.edu/uscode/text/18/2512" target="_blank" rel="noopener">U.S.C. Title 18, Section 2512</a>, which involves the manufacture, distribution, possession and advertising of devices for intercepting online communications.</p>
<p>Creating malware is a form of protect speech in the United States, but selling it and disseminating it is another matter. George Washington University Professor <strong>Orin Kerr</strong>&#8216;s <a href="https://www.washingtonpost.com/news/volokh-conspiracy/wp/2017/08/03/the-kronos-indictment-it-a-crime-to-create-and-sell-malware/" target="_blank" rel="noopener">2017 dissection of the government&#8217;s charges</a> is worth a read for a deep dive on this sticky legal issue.</p>
<p>According to a copy of Hutchins&#8217; plea agreement, both charges each carry a maximum of up to five years in prison, and up to a $250,000 fine, and up to one year of supervised release. However, those charges are likely to be substantially tempered by federal sentencing guidelines, and may take into account time already served in detention. It remains unclear when he will be sentenced.</p>
<p>The plea agreement is <a href="media/6ce67bd5.gov.uscourts.wied.77855.124.0.pdf" data-original-source="https://www.courtlistener.com/recap/gov.uscourts.wied.77855/gov.uscourts.wied.77855.124.0.pdf" target="_blank" rel="noopener">here</a> (PDF). &#8220;Attachment A&#8221; beginning on page 15 outlines the government&#8217;s case against Hutchins and an alleged co-conspirator. The government says between July 2012 and Sept. 2015, Hutchins helped create and sell <a href="https://research.checkpoint.com/deep-dive-upas-kit-vs-kronos/" target="_blank" rel="noopener">Kronos and a related piece of malware called UPAS Kit</a>.</p>
<p>Despite what many readers here have alleged, I hold no ill will against Hutchins. He and I spoke briefly in a friendly exchange after a chance encounter at last year&#8217;s DEF CON security conference in Las Vegas, and said at the time I was rooting for him to beat the charges. I sincerely hope he is able to keep his nose clean and put this incident behind him soon.</p>
<div id="attachment_47495" style="width: 564px" class="wp-caption aligncenter"><img class="size-full wp-image-47495" src="media/3482e327.mh-vegash.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/04/mh-vegash.jpg" alt="" width="554" height="772" /><p class="wp-caption-text">Yours Truly shaking hands with Marcus Hutchins in Las Vegas, August 2018.</p></div>


feed_id: https://krebsonsecurity.com/?p=47508
title: Who’s Behind the RevCode WebMonitor RAT?
uri: Who-s-Behind-the-RevCode-WebMonitor-RAT
url: https://krebsonsecurity.com/2019/04/whos-behind-the-revcode-webmonitor-rat/
content:
<p>The owner of a Swedish company behind a popular remote administration tool (RAT) implicated in thousands of malware attacks shares the same name as a Swedish man who pleaded guilty in 2015 to co-creating the <strong>Blackshades RAT</strong>, a similar product that was used to infect more than half a million computers with malware, KrebsOnSecurity has learned.</p>
<div id="attachment_47511" style="width: 605px" class="wp-caption aligncenter"><a class="lightbox" href="media/54b9937d.revcode.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/04/revcode.jpg"><img class="wp-image-47511" src="media/54b9937d.revcode.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/04/revcode.jpg" alt="" width="595" height="427" /></a><p class="wp-caption-text">An advertisement for RevCode WebMonitor.</p></div>
<p>At issue is a program called &#8220;<strong>WebMonitor</strong>,&#8221; which was designed to allow users to remotely control a computer (or multiple machines) via a Web browser. The makers of WebMonitor, a company in Sweden called &#8220;<strong>RevCode</strong>,&#8221; say their product is legal and legitimate software &#8220;that helps firms and personal users handle the security of owned devices.&#8221;</p>
<p>But critics say WebMonitor is far more likely to be deployed on &#8220;pwned&#8221; devices, or those that are surreptitiously hacked. The software is broadly classified as malware by most antivirus companies, likely thanks to an advertised feature list that includes dumping the remote computer&#8217;s temporary memory; retrieving passwords from dozens of email programs; snarfing the target&#8217;s Wi-Fi credentials; and viewing the target&#8217;s Webcam.</p>
<p>In <a href="https://unit42.paloaltonetworks.com/unit42-say-cheese-webmonitor-rat-comes-c2-service-c2aas/" target="_blank" rel="noopener">a writeup on WebMonitor published in April 2018</a>, researchers from security firm <strong>Palo Alto Networks</strong> noted that the product has been primarily advertised on underground hacking forums, and that its developers promoted several qualities of the software likely to appeal to cybercriminals looking to secretly compromise PCs.</p>
<p>For example, RevCode&#8217;s website touted the software&#8217;s compatibility with all &#8220;<a href="https://www.trendmicro.com/vinfo/us/security/definition/crypter" target="_blank" rel="noopener">crypters</a>,&#8221; software that can encrypt, obfuscate and manipulate malware to make it harder to detect by antivirus programs. Palo Alto also noted WebMonitor includes the option to suppress any notification boxes that may pop up when the RAT is being installed on a computer.</p>
<div id="attachment_47512" style="width: 609px" class="wp-caption aligncenter"><img class=" wp-image-47512" src="media/e0a15a14.webmonitor.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/04/webmonitor.jpg" alt="" width="599" height="240" /><p class="wp-caption-text">A screenshot of the WebMonitor builder panel.</p></div>
<p>RevCode maintains it is a legitimate company officially registered in Sweden that obeys all applicable Swedish laws. A few hours of searching online turned up <a href="https://translate.googleusercontent.com/translate_c?depth=1&amp;hl=en&amp;prev=search&amp;rurl=translate.google.com&amp;sl=sv&amp;sp=nmt4&amp;u=https://www.ratsit.se/900511ALKO00001-REVCODE&amp;xid=17259,15700002,15700022,15700186,15700190,15700253,15700256,15700259&amp;usg=ALkJrhho5bMKFXsDXE9sFGF1xQhyLBx1SQ" target="_blank" rel="noopener">an interesting record</a> at <a href="https://sv.wikipedia.org/wiki/Ratsit" target="_blank" rel="noopener">Ratsit AB</a>, a credit information service based in Sweden. That record indicates RevCode is owned by 28-year-old Swedish resident <strong>Alex Yücel</strong>.</p>
<p>In February 2015, a then 24-year-old Alex Yücel <a href="https://www.fbi.gov/contact-us/field-offices/newyork/news/press-releases/swedish-co-creator-of-blackshades-malware-that-enabled-users-around-the-world-to-secretly-and-remotely-control-victims-computers-sentenced-to-57-months-in-prison" target="_blank" rel="noopener">pleaded guilty in a U.S. court</a> to computer hacking and to creating, marketing and selling <a href="https://krebsonsecurity.com/2014/05/blackshades-trojan-users-had-it-coming/" target="_blank" rel="noopener">Blackshades</a>, a RAT that was used to compromise and spy on hundreds of thousands of computers. Arrested in Moldova in 2013 as part of a large-scale, international takedown against Blackshades and hundreds of customers, Yücel became the first person ever to be extradited from Moldova to the United States.<span id="more-47508"></span></p>
<p>Yücel was sentenced to 57 months in prison, but according to a record for Yücel at the <a href="https://www.bop.gov/inmateloc/" target="_blank" rel="noopener">U.S. Federal Bureau of Prisons</a>, he was released on Nov. 1, 2016. The first advertisements in hacker forums for the sale of WebMonitor began in mid-2017. RevCode was registered as an official Swedish company in 2018, according to Ratsit.</p>
<p>Until recently, RevCode published on its Web site a <a href="https://en.wikipedia.org/wiki/Value-added_tax" target="_blank" rel="noopener">value added tax</a> (VAT) number, an identifier used in many European countries for value added tax purposes. That VAT number &#8212; first noted by the blog <a href="https://krabsonsecurity.com/2019/03/10/some-interesting-notes-on-revcode/" target="_blank" rel="noopener">Krabsonsecurity.com</a> (which borrows heavily from this site&#8217;s design and banner but otherwise bears no relation to KrebsOnSecurity.com) &#8212; has since been removed from the RevCode Web site and from <a href="https://web.archive.org/web/2/https://revcode.se/" target="_blank" rel="noopener">historic records at The Internet Archive</a>. The <a href="http://www.vatnumber.net/?vat=SE900511095301&amp;submit=Check" target="_blank" rel="noopener">VAT number cited in that report</a> is registered to Alex Yücel, and matches the number listed for RevCode by Ratsit AB.</p>
<p>Yücel could not be immediately reached for comment. But an unnamed person responded to an email sent to the customer support address listed at RevCode&#8217;s site. Presented with the information and links referenced above, the person responding wrote, &#8220;nobody working for/with RevCode is in any way related to BlackShades. Anything else suggesting otherwise is nothing but rumors and attempts to degrade our company by means of defamation.&#8221;</p>
<p>The person responding from the RevCode support email address contended that the Alex Yücel listed as owner of the company was not the same Alex Yücel convicted of co-authoring Blackshades. However, unless the Ratsit record is completely wrong, this seems unlikely to be true.</p>
<p>According to the Ratsit listing, the Alex Yücel who heads RevCode currently lives in a suburb of Stockholm, Sweden with his parents Can and Rita Yücel. Both Can and Rita Yücel co-signed <a href="media/34b1ad01.49-1.pdf" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/04/49-1.pdf" target="_blank" rel="noopener">a letter</a> (PDF) in June 2015 testifying to a New York federal court regarding their son&#8217;s upstanding moral character prior to Yücel the younger&#8217;s sentencing for the Blackshades conviction, according to court records.</p>
<div id="attachment_47522" style="width: 608px" class="wp-caption aligncenter"><img class=" wp-image-47522" src="media/ebe08f6f.alex-letter-parents.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/04/alex-letter-parents.jpg" alt="" width="598" height="544" /><p class="wp-caption-text">A letter from Alex Yücel&#8217;s parents to the court in June 2016.</p></div>


feed_id: https://krebsonsecurity.com/?p=47216
title: P2P Weakness Exposes Millions of IoT Devices
uri: P2P-Weakness-Exposes-Millions-of-IoT-Devices
url: https://krebsonsecurity.com/2019/04/p2p-weakness-exposes-millions-of-iot-devices/
content:
<p>A peer-to-peer (P2P) communications technology built into millions of security cameras and other consumer electronics includes several critical security flaws that expose the devices to eavesdropping, credential theft and remote compromise, new research has found.</p>
<div id="attachment_47530" style="width: 609px" class="wp-caption aligncenter"><a class="lightbox" href="media/11130a37.i-lnk-map.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/04/i-lnk-map.jpg"><img class="wp-image-47530" src="media/11130a37.i-lnk-map.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/04/i-lnk-map.jpg" alt="" width="599" height="295" /></a><p class="wp-caption-text">A map showing the distribution of some 2 million iLinkP2P-enabled devices that are vulnerable to eavesdropping, password theft and possibly remote compromise, according to new research.</p></div>
<p>The security flaws involve <strong>iLnkP2P</strong>, software developed by China-based<strong> Shenzhen Yunni Technology</strong>. iLnkP2p is bundled with millions of Internet of Things (IoT) devices, including security cameras and Webcams, baby monitors, smart doorbells, and digital video recorders.</p>
<p>iLnkP2P is designed to allow users of these devices to quickly and easily access them remotely from anywhere in the world, without having to tinker with one&#8217;s firewall: Users simply download a mobile app, scan a barcode or enter the six-digit ID stamped onto the bottom of the device, and the P2P software handles the rest.</p>
<div id="attachment_47537" style="width: 601px" class="wp-caption aligncenter"><a class="lightbox" href="media/109e3861.ilnkcam.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/04/ilnkcam.jpg"><img class="wp-image-47537" src="media/109e3861.ilnkcam.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/04/ilnkcam.jpg" alt="" width="591" height="361" /></a><p class="wp-caption-text">A Webcam made by HiChip that includes the iLnkP2P software.</p></div>
<p>But according to an in-depth analysis shared with KrebsOnSecurity by security researcher <a href="https://www.twitter.com/PaulMarrapese" target="_blank" rel="noopener">Paul Marrapese</a>, iLnkP2P devices offer no authentication or encryption and can be easily enumerated, allowing potential attackers to establish a direct connection to these devices while bypassing any firewall restrictions.</p>
<p>Marrapese said a proof-of-concept script he built identified more than two million vulnerable devices around the globe (see map above). He found that 39 percent of the vulnerable IoT things were in China; another 19 percent are located in Europe; seven percent of them are in use in the United States.</p>
<p>Although it may seem impossible to enumerate more than a million devices with just a six-digit ID, Marrapese notes that each ID begins with a unique alphabetic prefix that identifies which manufacturer produced the device, and there are dozens of companies that white-label the iLnkP2P software.</p>
<p>For example, <a href="http://www.hichip.org" target="_blank" rel="noopener">HiChip</a> &#8212; a Chinese IoT vendor that Marrapese said accounts for nearly half of the vulnerable devices &#8212; uses the prefixes FFFF, GGGG, HHHH, IIII, MMMM, ZZZZ.</p>
<div id="attachment_47535" style="width: 604px" class="wp-caption aligncenter"><img class=" wp-image-47535" src="media/f221321b.ilinkp2pprefixes.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/04/ilinkp2pprefixes.jpg" alt="" width="594" height="468" /><p class="wp-caption-text">These prefixes identify different product lines and vendors that use iLnkP2P. If the code stamped on your IoT device begins with one of these, it is vulnerable.</p></div>
<p>&#8220;In theory, this allows them to support nearly 6 million devices for these prefixes alone,&#8221; Marrapese said. &#8220;In reality, enumeration of these prefixes has shown that the number of online devices was ~1,517,260 in March 2019. By enumerating all of the other vendor prefixes, that pushes the number toward 2 million.&#8221;</p>
<p>Marrapese said he also built a proof-of-concept attack that can steal passwords from devices by abusing their built-in &#8220;heartbeat&#8221; feature. Upon being connected to a network, iLnkP2P devices will regularly send a heartbeat or &#8220;here I am&#8221; message to their preconfigured P2P servers and await further instructions.</p>
<p>&#8220;A P2P server will direct connection requests to the origin of the most recently-received heartbeat message,&#8221; Marrapese said. &#8220;Simply by knowing a valid device UID, it is possible for an attacker to issue fraudulent heartbeat messages that will supersede any issued by the genuine device. Upon connecting, most clients will immediately attempt to authenticate as an administrative user in plaintext, allowing an attacker to obtain the credentials to the device.&#8221;<span id="more-47216"></span></p>
<p>To make matters worse, even if an attacker doesn&#8217;t want to bother intercepting device passwords, a great many of them will be running in their factory-default state with the factory-default password. The IoT malware <a href="https://krebsonsecurity.com/?s=Mirai&amp;x=0&amp;y=0" target="_blank" rel="noopener">Mirai</a> proved this conclusively, as it rapidly spread to millions of devices <a href="https://krebsonsecurity.com/2016/10/who-makes-the-iot-things-under-attack/" target="_blank" rel="noopener">using nothing more than the default credentials for IoT devices made by dozens of manufacturers</a>.</p>
<p>What&#8217;s more, as we saw with Mirai the firmware and software built into these IoT devices is often based on computer code that is many years old and replete with security vulnerabilities, meaning that anyone able to communicate directly with them is also likely to be able to remotely compromise them with malicious software.</p>
<p>Marrapese said despite attempts to notify <a href="http://www.cert.org.cn/publish/english/index.html" target="_blank" rel="noopener">China&#8217;s CERT</a>, iLnk and a half dozen major vendors whose products make up the bulk of the affected devices, none of them have responded to his reports &#8212; even though he first started reaching out to them more than four months ago. Neither HiChip nor iLnk responded to requests for comment sent by KrebsOnSecurity.</p>
<p>Interestingly, iLnk&#8217;s Web site (p1.i-lnk[.]com) currently appears to be non-functional, and a review of its HTML source code indicates the site is currently compromised by an obfuscated script that tries to redirect visitors to a Chinese gaming Web site.</p>
<p>Despite the widespread impact of these vulnerabilities, Marrapese&#8217;s research suggests that remediation from vendors is unlikely – and in fact, infeasible.</p>
<p>&#8220;The nature of these vulnerabilities makes them extremely difficult to remediate for several reasons,&#8221; Marrapese wrote. &#8220;Software-based remediation is unlikely due to the infeasibility of changing device UIDs, which are permanently assigned during the manufacturing process. Furthermore, even if software patches were issued, the likelihood of most users updating their device firmware is low. Physical device recalls are unlikely as well because of considerable logistical challenges. Shenzhen Yunni Technology is an upstream vendor with inestimable sub-vendors due to the practice of white-labeling and reselling.&#8221;</p>
<p>Marrapese said there is no practical way to turn off the P2P functionality on the affected devices. Many IoT devices can punch holes in firewalls using a feature built into hardware-based routers called <a href="https://en.wikipedia.org/wiki/Universal_Plug_and_Play" target="_blank" rel="noopener">Universal Plug and Play (UPnP)</a>. But simply turning off UPnP on one&#8217;s router won&#8217;t prevent the devices from establishing a P2P connection as they rely on a different communications technique called &#8220;<a href="https://en.wikipedia.org/wiki/UDP_hole_punching" target="_blank" rel="noopener">UDP hole punching</a>.&#8221;</p>
<p>Marrapese said it should be possible to block vulnerable devices from communicating with any P2P servers by setting up firewall rules that block traffic destined for UDP port 32100.</p>
<p>However, a much safer idea would be to simply avoid purchasing or using IoT devices that advertise <em>any</em> P2P capabilities. Previous research has unearthed similar vulnerabilities in the P2P functionality built into other IoT systems. For examples of this, see <a href="https://krebsonsecurity.com/2016/02/this-is-why-people-fear-the-internet-of-things/" target="_blank" rel="noopener">This is Why People Fear the Internet of Things</a>, and <a href="https://krebsonsecurity.com/2016/12/researchers-find-fresh-fodder-for-iot-attack-cannons/" target="_blank" rel="noopener">Researchers Find Fresh Fodder for IoT Attack Cannons</a>.</p>
<p>Marrapese documented his findings in more detail <a href="https://hacked.camera/" target="_blank" rel="noopener">here</a>. The enumeration vulnerability has been assigned CVE-2019-11219, and the man-in-the-middle vulnerability has been assigned CVE-2019-11220.</p>
<p>Additional reading: <a href="https://krebsonsecurity.com/2018/01/some-basic-rules-for-securing-your-iot-stuff/" target="_blank" rel="noopener">Some Basic Rules for Securing your IoT Stuff</a>.</p>


feed_id: https://krebsonsecurity.com/?p=47569
title: Data: E-Retail Hacks More Lucrative Than Ever
uri: Data-E-Retail-Hacks-More-Lucrative-Than-Ever
url: https://krebsonsecurity.com/2019/04/data-e-retail-hacks-more-lucrative-than-ever/
content:
<p>For many years and until quite recently, credit card data stolen from online merchants has been worth far less in the cybercrime underground than cards pilfered from hacked brick-and-mortar stores. But new data suggests that over the past year, the economics of supply-and-demand have helped to double the average price fetched by card-not-present data, meaning cybercrooks now have far more incentive than ever to target e-commerce stores.</p>
<p>Traditionally, the average price for card data nabbed from online retailers &#8212; referred to in the underground as &#8220;<strong>CVVs</strong>&#8221; &#8212; has ranged somewhere between $2 and $8 per account. CVVs are are almost exclusively purchased by criminals looking to make unauthorized purchases at online stores, a form of thievery known as &#8220;<strong>card not present</strong>&#8221; fraud.</p>
<p>In contrast, the value of &#8220;<strong>dumps</strong>&#8221; &#8212; hacker slang for card data swiped from compromised retail stores, hotels and restaurants with the help of malware installed on point-of-sale systems &#8212; has long hovered around $15-$20 per card. Dumps allow street thieves to create physical clones of debit and credit cards, which are then used to perpetrate so-called &#8220;<strong>card present</strong>&#8221; fraud at brick and mortar stores.</p>
<p>But according to <a href="https://geminiadvisory.io/" target="_blank" rel="noopener">Gemini Advisory</a>, a New York-based company that works with financial institutions to monitor dozens of underground markets trafficking in both types of data, over the past year the demand for CVVs has far outstripped supply, bringing prices for both CVVs and dumps roughly in line with each other.</p>
<div id="attachment_47578" style="width: 609px" class="wp-caption aligncenter"><a class="lightbox" href="media/809688d2.cp-cnp.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/04/cp-cnp.jpg"><img class="wp-image-47578" src="media/809688d2.cp-cnp.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/04/cp-cnp.jpg" alt="" width="599" height="236" /></a><p class="wp-caption-text">Median price of card not present (CNP) vs. card-present (CP) over the past year. Image: Gemini</p></div>
<p><strong>Stas Alforov</strong>, director of research and development at Gemini, says his company is currently monitoring most underground stores that peddle stolen card data &#8212; including such heavy hitters as <a href="https://krebsonsecurity.com/?s=joker%27s+stash&amp;x=0&amp;y=0" target="_blank" rel="noopener">Joker&#8217;s Stash</a>, <a href="https://krebsonsecurity.com/2017/05/trumps-dumps-making-dumps-great-again/" target="_blank" rel="noopener">Trump&#8217;s Dumps</a>, and <a href="media/c3559b4e.Screen-Shot-2015-04-14-at-12.23.29-AM-580x72.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2015/04/Screen-Shot-2015-04-14-at-12.23.29-AM-580x72.png" target="_blank" rel="noopener">BriansDump</a>.</p>
<p>Contrary to popular belief, when these shops sell a CVV or dump, that record is then removed from the inventory of items for sale, allowing companies that track such activity to determine roughly how many new cards are put up for sale and how many have sold. Underground markets that do otherwise quickly earn a reputation among criminals for selling unreliable card data and are soon forced out of business.</p>
<p>&#8220;We can see in pretty much real-time what&#8217;s being sold and which marketplaces are the most active or have the highest number of records and where the bad guys shop the most,&#8221; Alforov said. <span class="pullquote pqright">&#8220;The biggest trend we&#8217;ve seen recently is there appears to be a much greater demand than there is supply of card not present data being uploaded to these markets.&#8221;</span></p>
<p>Alforov said dumps are still way ahead in terms of the overall number of compromised records for sale. For example, over the past year Gemini has seen some 66 million new dumps show up on underground markets, and roughly half as many CVVs.</p>
<p>&#8220;The demand for card not present data remains strong while the supply is not as great as the bad guys need it to be, which means prices have been steadily going up,&#8221; Alforov said. &#8220;A lot of the bad guys who used to do card present fraud are now shifting to card-not-present fraud.&#8221;</p>
<p>One likely reason for that shift is the United States is the last of the G20 nations to make the transition to more secure chip-based payment cards, which is slowly making it more difficult and expensive for thieves to turn dumps into cold hard cash. This same increase in card-not-present fraud has occurred in virtually every other country that long ago made the chip card transition, including <a title="https://krebsonsecurity.com/wp-content/uploads/2015/03/australiacnp.png" href="media/bb75ed02.australiacnp.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2015/03/australiacnp.png" target="_blank" rel="noopener">Australia</a>, <a title="https://krebsonsecurity.com/wp-content/uploads/2015/03/CanadaCNP.png" href="media/f2952ab0.CanadaCNP.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2015/03/CanadaCNP.png" target="_blank" rel="noopener">Canada</a>, <a title="https://krebsonsecurity.com/wp-content/uploads/2015/03/frenchCNP.png" href="media/2b15ad7c.frenchCNP.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2015/03/frenchCNP.png" target="_blank" rel="noopener">France</a> and the <a title="https://krebsonsecurity.com/wp-content/uploads/2015/03/frenchCNP.png" href="media/2b15ad7c.frenchCNP.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2015/03/frenchCNP.png" target="_blank" rel="noopener">United Kingdom</a>.</p>
<p>The increasing value of CVV data may help explain why we&#8217;ve seen <a href="https://krebsonsecurity.com/2018/11/whos-in-your-online-shopping-cart/" target="_blank" rel="noopener">such a huge uptick</a> over the past year in e-commerce sites getting hacked. In a typical online retailer intrusion, the attackers will use vulnerabilities in content management systems, shopping cart software, or third-party hosted scripts to upload malicious code that snarfs customer payment details directly from the site before it can be encrypted and sent to card processors.<span id="more-47569"></span></p>
<p>Research <a href="https://dtr-retail.thalesesecurity.com/" target="_blank" rel="noopener">released</a> last year by <strong>Thales eSecurity</strong> found that 50 percent of all medium and large online retailers it surveyed acknowledged they&#8217;d been hacked. That figure was more than two and a half times higher than a year earlier.</p>
<h4>BIG BANG VS. LOW-AND-SLOW</h4>
<p>Much of the media&#8217;s attention has been focused on recent hacks against larger online retailers, such those at the Web sites of <a href="https://www.riskiq.com/blog/labs/magecart-british-airways-breach/" target="_blank" rel="noopener">British Airways</a>, <a href="https://www.riskiq.com/blog/labs/magecart-ticketmaster-breach/" target="_blank" rel="noopener">Ticketmaster</a>, and electronics giant <a href="https://www.riskiq.com/blog/labs/magecart-newegg/" target="_blank" rel="noopener">NewEgg</a>. But these incidents tend to overshadow a great number of &#8220;low-and-slow&#8221; compromises at much smaller online retailers &#8212; which often take far longer to realize they&#8217;ve been hacked.</p>
<p>For example, in March 2019 an analysis of Gemini&#8217;s data strongly suggested that criminals had compromised <strong>Ticketstorm.com</strong>, an Oklahoma-based business that sells tickets to a range of sporting events and concerts. Going back many months through its data, Gemini determined that the site has likely been hacked for more than two years &#8212; allowing intruders to extract around 4,000 CVVs from the site&#8217;s customers each month, and approximately 35,000 accounts in total since February 2017.</p>
<p>Ticketstorm.com did not respond to requests for comment, but an individual at the company who answered a call from KrebsOnSecurity confirmed Ticketstorm had recently heard from Gemini and from card fraud investigators with the U.S. Secret Service.</p>
<p>&#8220;It&#8217;s not just large sites getting popped, it&#8217;s mostly small to mid-sized organizations that are being compromised for long periods of time,&#8221; Alforov said. &#8220;Ticketstorm is just one of ten or twenty different breaches we&#8217;ve seen where the fraudsters sell what they collected and then come back and collect more over several years.&#8221;</p>
<p>In some ways, CVVs are more versatile for fraudsters than dumps. That&#8217;s because about 90 percent of dumps for sale in the underground do not come with other consumer data points needed to complete a various online transactions &#8212; such as the cardholder&#8217;s name or billing address, Gemini found.</p>
<p>This is particularly true when CVV data is collected or amended by phishing sites, which often ask unwitting consumers to give up other personal information that can aid in identity theft and new account fraud &#8212; including Social Security number, date of birth and mother&#8217;s maiden name.</p>
<p>All of which means e-commerce retailers need to be stepping up their game when it comes to staving off card thieves. <a href="https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/magecart-an-overview-and-defense-mechanisms/" target="_blank" rel="noopener">This in-depth report</a> from payment security firm <strong>Trustwave</strong> contains a number of useful suggestions that sites can consider for a defense-in-depth approach to combating an increasingly crowded field of criminal groups turning more of their attention toward stealing CVV data.</p>
<p>&#8220;There is a lot more incentive now than ever before for thieves to compromise e-commerce sites,&#8221; Alforov said.</p>


feed_id: https://krebsonsecurity.com/?p=47594
title: Credit Union Sues Fintech Giant Fiserv Over Security Claims
uri: Credit-Union-Sues-Fintech-Giant-Fiserv-Over-Security-Claims
url: https://krebsonsecurity.com/2019/05/credit-union-sues-fintech-giant-fiserv-over-security-claims/
content:
<p>A Pennsylvania credit union is suing financial industry technology giant <strong>Fiserv</strong>, alleging that &#8220;baffling&#8221; security vulnerabilities in the company&#8217;s software are &#8220;wreaking havoc&#8221; on its customers. The credit union said the investigation that fueled the lawsuit was prompted by a 2018 KrebsOnSecurity report about glaring security weaknesses in a Fiserv platform that exposed personal and financial details of customers across hundreds of bank Web sites.</p>
<p><img class="aligncenter wp-image-44816" src="media/f469fe28.fiserve.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/08/fiserve.png" alt="" width="591" height="299" /></p>
<p>Brookfield, Wisc.-based Fiserv [<a href="https://www.nasdaq.com/symbol/fisv" target="_blank" rel="noopener">NASDAQ:FISV</a>] is a Fortune 500 company with 24,000 employees and $5.8 billion in earnings last year. Its account and transaction processing systems power the Web sites for hundreds of financial institutions — mostly small community banks and credit unions.</p>
<p>In August 2018, in response to <a href="https://krebsonsecurity.com/2018/08/fiserv-flaw-exposed-customer-data-at-hundreds-of-banks/" target="_blank" rel="noopener">inquiries by KrebsOnSecurity</a>, Fiserv fixed a pervasive security and privacy hole in its online banking platform. The authentication weakness allowed bank customers to view account data for other customers, including account number, balance, phone numbers and email addresses.</p>
<p>In late April 2019, Fiserv was sued by <strong>Bessemer System Federal Credit Union</strong>, a comparatively tiny financial institution with just $38 million in assets. Bessemer said it was moved by that story to launch its own investigation into Fiserv&#8217;s systems, and it found a startlingly similar flaw: Firsev&#8217;s platform would let anyone reset the online banking password for a customer <em>just by knowing their account number and the last four digits of their Social Security number.</em></p>
<div id="attachment_47599" style="width: 600px" class="wp-caption aligncenter"><img class=" wp-image-47599" src="media/15820399.ssn-account.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/05/ssn-account.jpg" alt="" width="590" height="369" /><p class="wp-caption-text">Bessemer claims Fiserv&#8217;s systems let anyone reset a customer&#8217;s online banking password just by knowing their SSN and account number.</p></div>
<p>Recall that in my Aug 2018 report, Fiserv&#8217;s systems were exposing online banking account numbers for its customers. Thus, an attacker would only need to know a target&#8217;s SSN to reset that customer&#8217;s password, according to Bessemer. And that information is for sale in multiple places online and in the cybercrime underground for a few bucks per person.</p>
<p>Bessemer further alleges Fiserv&#8217;s systems had no checks in place to prevent automated attacks that might let thieves rapidly guess the last four digits of the customer&#8217;s SSN &#8212; such as limiting the number of times a user can submit a login request, or imposing a waiting period after a certain number of failed login attempts.</p>
<p>The lawsuit says the fix Fiserv scrambled to put in place after Bessemer complained was &#8220;pitifully deficient and ineffective:&#8221;</p>
<blockquote><p>&#8220;Fiserv attempted to fortify Bessemer&#8217;s online banking website by requiring users registering for an account to supply a member&#8217;s house number. This was ineffective because residential street addresses can be readily found on the internet and through other public sources. Moreover, this information can be guessed through a trial-and-error process. Most alarmingly, this security control was purely illusory. Because some servers were not enforcing this security check, it could be readily bypassed.&#8221;</p></blockquote>
<p><span id="more-47594"></span>Bessemer says instead of fixing these security problems and providing the requested assurances that information was being adequately safeguarded, Fiserv issued it a &#8220;notice of claims,&#8221; alleging the credit union&#8217;s security review <em>of its own online banking system</em> gave rise to civil and criminal claims.</p>
<p>The credit union says Fiserv demanded it not disclose information relating to the security review to any third parties, &#8220;including Fiserv&#8217;s other clients (who presumably were affected with the same security problems at their financial institutions) as well as media sources.&#8221;</p>
<p>Fiserv did not immediately respond to requests for comment. But Fiserv spokesperson <strong>Ann Cave</strong> was <a href="https://www.axios.com/fiserv-lawsuit-financial-technology-banking-software-803d88f9-b10d-4c44-9c26-c66fb71c4152.html" target="_blank" rel="noopener">quoted</a> in several publications saying, &#8220;We believe the allegations have no merit and will respond to the claims as part of the legal process.&#8221;</p>
<p><strong>Charles Nerko</strong>, the attorney representing Bessemer in the lawsuit, said to protect the credit union’s members, the credit union is replacing its core processing vendor, although Nerko would not specify where the credit union might be taking its business.</p>
<p>According to <a href="https://www.fedfis.com/" target="_blank" rel="noopener">FedFis.com</a>, Fiserv is by far the <a href="https://bankinnovation.net/2018/02/fiserv-has-largest-u-s-marketshare-of-top-bank-core-processors/" target="_blank" rel="noopener">top bank core processor</a>, with more than 37 percent market share. And it&#8217;s poised to soon get much bigger.</p>
<p>In January 2019, Fiserv announced it was acquiring payment processing giant First Data in a $22 billion all-stock deal. The deal is <a href="https://www.pymnts.com/news/partnerships-acquisitions/2019/first-data-fiserv-merger-doj/" target="_blank" rel="noopener">expected to close</a> in the second half of 2019, pending an antitrust review by the U.S. Justice Department.</p>
<p>That merger, should it go through, may not bode well for Fiserv&#8217;s customers, <a href="https://www.americanbanker.com/opinion/mergers-like-fiserv-first-data-are-a-red-flag-for-banks" target="_blank" rel="noopener">argues</a> <strong>Paul Schaus</strong> of <em>American Banker</em>.</p>
<p>&#8220;Banks should take this trend as a warning sign,&#8221; Schaus wrote. &#8220;Rather than delivering new innovations that banks and their customers crave, legacy vendors are looking to remain relevant by acquiring existing products and services that expand their portfolios into new areas of financial services. As emerging technologies grow more critical to everyday business, these legacy vendors, which banks have deep longstanding relationships with, likely won’t be on the leading edge in every product or channel. Instead, financial institutions will need to seek out newer vendors that have deeper commitments and focus in cutting-edge technologies that will drive industry change.&#8221;</p>


feed_id: https://krebsonsecurity.com/?p=47609
title: Feds Bust Up Dark Web Hub Wall Street Market
uri: Feds-Bust-Up-Dark-Web-Hub-Wall-Street-Market
url: https://krebsonsecurity.com/2019/05/feds-bust-up-dark-web-hub-wall-street-market/
content:
<p>Federal investigators in the United States, Germany and the Netherlands announced today the arrest and charging of three German nationals and a Brazilian man as the alleged masterminds behind the <strong>Wall Street Market</strong> (WSM), one of the world&#8217;s largest dark web bazaars that allowed vendors to sell illegal drugs, counterfeit goods and malware. Now, at least one former WSM administrator is reportedly trying to extort money from WSM vendors and buyers (supposedly including Yours Truly) &#8212; in exchange for not publishing details of the transactions.</p>
<div id="attachment_47615" style="width: 603px" class="wp-caption aligncenter"><a class="lightbox" href="media/5714f3df.wallstmkt.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/05/wallstmkt.jpg"><img class="wp-image-47615" src="media/5714f3df.wallstmkt.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/05/wallstmkt.jpg" alt="" width="593" height="317" /></a><p class="wp-caption-text">The now-defunct Wall Street Market (WSM). Image: Dark Web Reviews.</p></div>
<p>A complaint filed Wednesday in Los Angeles alleges that the three defendants, who currently are in custody in Germany, were the administrators of WSM, a sophisticated online marketplace available in six languages that allowed approximately 5,400 vendors to sell illegal goods to about 1.15 million customers around the world.</p>
<p>&#8220;Like other dark web marketplaces previously shut down by authorities – Silk Road and AlphaBay, for example – WSM functioned like a conventional e-commerce website, but it was a hidden service located beyond the reach of traditional internet browsers, accessible only through the use of networks designed to conceal user identities, such as the Tor network,&#8221; reads a Justice Department release issued Friday morning.</p>
<p>The complaint alleges that for nearly three years, WSM was operated on the dark web by three men who engineered an “exit scam” last month, absconding with all of the virtual currency held in marketplace escrow and user accounts. Prosecutors say they believe approximately $11 million worth of virtual currencies was then diverted into the three men&#8217;s own accounts.</p>
<p>The defendants charged in the United States and arrested Germany on April 23 and 24 include 23-year-old resident of Kleve, Germany; a 31-year-old resident of Wurzburg, Germany; and a 29-year-old resident of Stuttgart, Germany. The complaint charges the men with two felony counts – conspiracy to launder monetary instruments, and distribution and conspiracy to distribute controlled substances. These three defendants also face charges in Germany.</p>
<p>Signs of the dark market seizure first appeared Thursday when WSM&#8217;s site was replaced by a banner saying it had been seized by the German Federal Criminal Police Office (BKA).</p>
<div id="attachment_47625" style="width: 604px" class="wp-caption aligncenter"><img class=" wp-image-47625" src="media/72d356db.wsm-sieze.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/05/wsm-sieze.jpg" alt="" width="594" height="367" /><p class="wp-caption-text">The seizure message that replaced the homepage of the Wall Street Market on on May 2.</p></div>
<p>Writing for <a href="https://www.zdnet.com/article/law-enforcement-seizes-dark-web-market-after-moderator-leaks-backend-credentials/" target="_blank" rel="noopener">ZDNet&#8217;s Zero Day blog</a>, <strong>Catalin Cimpanu</strong> noted that &#8220;in this midst of all of this, one of the site&#8217;s moderators &#8211;named <strong>Med3l1n</strong>&#8212; <a href="https://twitter.com/5auth/status/1119710378504728578" target="_blank" rel="noopener noreferrer" data-ss1556894557="1">began blackmailing</a> WSM vendors and buyers, asking for 0.05 Bitcoin (~$280), and <a href="https://twitter.com/Patrick_Shortis/status/1120843564290904064" target="_blank" rel="noopener">threatening</a> to disclose to law enforcement the details of WSM vendors and buyers who made the mistake of sharing various details in support requests in an unencrypted form.</p>
<p>In a direct message sent to <a href="https://www.twitter.com/briankrebs" target="_blank" rel="noopener">my Twitter account</a> this morning, a Twitter user named <a href="https://twitter.com/feruccifrances" target="_blank" rel="noopener">@FerucciFrances</a> who claimed to be part of the exit scam demanded 0.05 bitcoin (~$286) to keep quiet about a transaction or transactions allegedly made in my name on the dark web market.<span id="more-47609"></span></p>
<p>&#8220;Make it public and things gonna be worse,&#8221; the message warned. &#8220;Investigations goes further once the whole site was crawled and saved and if you pay, include the order id on the dispute message so you can be removed. You know what I am talking about krebs.&#8221;</p>
<div id="attachment_47612" style="width: 608px" class="wp-caption aligncenter"><img class=" wp-image-47612" src="media/9fc93c7f.wsm-extort.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/05/wsm-extort.jpg" alt="" width="598" height="394" /><p class="wp-caption-text">A direct message from someone trying to extort money from me.</p></div>
<p>I did have at least one user account on WSM, although I don&#8217;t recall ever communicating on the forum with any other users, and I certainly never purchased or sold anything there. Like most other accounts on dark web shops and forums, it was created merely for lurking. I asked @FerucciFrances to supply more evidence of my alleged wrongdoing, but he has not yet responded.</p>
<p>The Justice Department said the MED3LIN moniker belongs to a fourth defendant linked to Wall Street Market &#8212; <strong>Marcos Paulo De Oliveira-Annibale</strong>, 29, of Sao Paulo, Brazil &#8212; who was charged Thursday in a criminal complaint filed in the U.S. District Court in Sacramento, California.</p>
<p>Oliviera-Annibale also faces federal drug distribution and money laundering charges for allegedly acting as a moderator on WSM, who, according to the charges, mediated disputes between vendors and their customers, and acted as a public relations representative for WSM by promoting it on various sites.</p>
<p>Prosecutors say they connected MED3LIN to his offline identity thanks to photos and other clues he left behind online years ago, suggesting once again that many alleged cybercriminals are not terribly good at <a href="https://krebsonsecurity.com/category/breadcrumbs/" target="_blank" rel="noopener">airgapping their online and offline selves</a>.</p>
<p>&#8220;We are on the hunt for even the tiniest of breadcrumbs to identify criminals on the dark web,&#8221; said <strong>McGregor W. Scott</strong>, United States Attorney for the Eastern District of California. “The prosecution of these defendants shows that even the smallest mistake will allow us to figure out a cybercriminal&#8217;s true identity. As with defendant Marcos Annibale, forum posts and pictures of him online from years ago allowed us to connect the dots between him and his online persona ‘Med3l1n.’ No matter where they live, we will investigative and prosecute criminals who create, maintain, and promote dark web marketplaces to sell illegal drugs and other contraband.&#8221;</p>
<p>A copy of the Justice Department&#8217;s criminal complaint in the case is <a href="media/4138ab8d.Wall-Street-Market-adminstrator-COMPLAINT.pdf" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/05/Wall-Street-Market-adminstrator-COMPLAINT.pdf" target="_blank" rel="noopener">here</a> (PDF).</p>


feed_id: https://krebsonsecurity.com/?p=47631
title: What’s Behind the Wolters Kluwer Tax Outage?
uri: What-s-Behind-the-Wolters-Kluwer-Tax-Outage
url: https://krebsonsecurity.com/2019/05/whats-behind-the-wolters-kluwer-tax-outage/
content:
<p>Early in the afternoon on Friday, May, 3, I asked a friend to relay a message to his security contact at <strong>CCH</strong>, the cloud-based tax division of the global information services firm <a href="https://en.wikipedia.org/wiki/Wolters_Kluwer" target="_blank" rel="noopener">Wolters Kluwer </a>in the Netherlands. The message was that the same file directories containing new versions of CCH&#8217;s software were open and writable by any anonymous user, and that there were suspicious files in those directories indicating some user(s) abused that access.</p>
<p>Shortly after that report, the CCH file directory for tax software downloads was taken offline. As of this publication, several readers have reported outages affecting multiple CCH Web sites. These same readers reported being unable to access their clients&#8217; tax data in CCH&#8217;s cloud because of the ongoing outages. A <a href="https://np.reddit.com/r/sysadmin/comments/blcswm/wolters_kluwer_cch_axcess_outage/" target="_blank" rel="noopener">Reddit thread</a> is full of theories.</p>
<div id="attachment_47636" style="width: 604px" class="wp-caption aligncenter"><img class=" wp-image-47636" src="media/15667088.wkia.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/05/wkia.jpg" alt="" width="594" height="600" /><p class="wp-caption-text">One of the many open and writable directories on CCH&#8217;s site before my report on Friday.</p></div>
<p>I do not have any information on whether my report about the world-writable file server had anything to do with the outages going on now at CCH. Nor did I see any evidence that any client data was exposed on the site.</p>
<p>What I did see in those CCH directories were a few odd PHP and text files, including one that seemed to be promoting two different and unrelated Russian language discussion forums.</p>
<p>I sent Wolters Kluwer an email asking how long the file server had been so promiscuous (allowing anyone to upload files to the server), and what the company was doing to validate the integrity of the software made available for download by CCH tax customers.</p>
<p><strong>Marisa Westcott</strong>, vice president of marketing and communications at Wolters Kluwer, told KrebsOnSecurity on Friday that she would &#8220;check with the team to see if we can get some answers to your questions.&#8221;</p>
<p>But subsequent emails and phone calls have gone unreturned. Calls to the company&#8217;s main support number (800-739-9998) generate the voice message, &#8220;We are currently experiencing technical difficulties. Please try your call again later.&#8221;</p>
<p>This morning, Wolters Kluwer released an update on the extensive outage this morning <a href="https://twitter.com/Wolters_Kluwer/status/1125773345281196032" target="_blank" rel="noopener">on Twitter, saying:</a></p>
<blockquote><p>&#8220;Since yesterday, May 6, we are experiencing network and service interruptions after certain Wolters Kluwer platforms and applications. Out of an abundance of caution, we proactively took offline a number of other applications and we immediately began our investigation and remediation efforts. The secure use of our products and services is our top priority. we have ben able to restore network and services for a number &#8211; but not all &#8212; of our systems.&#8221;</p></blockquote>
<p><em>Accounting Today</em> <a href="https://www.accountingtoday.com/news/the-wolters-kluwer-cch-outage-what-happened" target="_blank" rel="noopener">reports today</a> that a PR representative from Wolters Kluwer Tax &amp; Accounting, which makes the CCH products, confirmed the outage was the result of a malware attack:<span id="more-47631"></span></p>
<blockquote><p>“On Monday May 6, we started seeing technical anomalies in a number of our platforms and applications,” the statement given to<i> Accounting Today </i>reads. “We immediately started investigating and discovered the installation of malware. As a precaution, in parallel, we decided to take a broader range of platforms and applications offline. With this action, we aimed to quickly limit the impact this malware could have had, giving us the opportunity to investigate the issue with assistance from third-party forensics consultants and work on a solution. Unfortunately, this impacted our communication channels and limited our ability to share updates. On May 7, we were able to restore service to a number of applications and platforms.”</p></blockquote>
<p><em>Accounting Today</em> says the limited ability to share updates angered CCH users, many of whom took to social media to air their grievances against a cloud partner they perceive to be ill-prepared for maintaining ongoing service and proper security online.</p>
<p>&#8220;Despite CCH stating that a number of applications and platforms were up and running today, May 7, several users on a <u><a href="https://www.reddit.com/r/sysadmin/comments/blcswm/wolters_kluwer_cch_axcess_outage/" target="_blank" rel="noopener">Reddit thread</a></u> on the topic have stated that as of this morning in Florida, Maine, Texas, Pittsburgh and South Carolina, their CCH systems are still down,&#8221; Accounting Today wrote.</p>
<p>Special thanks to <strong>Alex Holden</strong> of <a href="https://www.holdsecurity.com" target="_blank" rel="noopener">Hold Security</a> for help in notifying CCH.</p>


feed_id: https://krebsonsecurity.com/?p=47650
title: Nine Charged in Alleged SIM Swapping Ring
uri: Nine-Charged-in-Alleged-SIM-Swapping-Ring
url: https://krebsonsecurity.com/2019/05/nine-charged-in-alleged-sim-swapping-ring/
content:
<p>Eight Americans and an Irishman have been charged with wire fraud this week for allegedly hijacking mobile phones through SIM-swapping, a form of fraud in which scammers bribe or trick employees at mobile phone stores into seizing control of the target&#8217;s phone number and diverting all texts and phone calls to the attacker&#8217;s mobile device. From there, the attackers simply start requesting password reset links via text message for a variety of accounts tied to the hijacked phone number.</p>
<p>All told, the government said this gang &#8212; allegedly known to its members as &#8220;<strong>The Community</strong>&#8221; &#8212; made more than $2.4 million stealing cryptocurrencies and extorting people for restoring access to social media accounts that were hijacked after a successful SIM-swap.</p>
<p><img class="aligncenter wp-image-40415" src="media/618d5447.phonefraudsmaller.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2017/08/phonefraudsmaller.png" alt="" width="598" height="302" srcset="https://krebsonsecurity.com/wp-content/uploads/2017/08/phonefraudsmaller.png 609w, https://krebsonsecurity.com/wp-content/uploads/2017/08/phonefraudsmaller-580x292.png 580w" sizes="(max-width: 598px) 100vw, 598px" /></p>
<p>Six of those <a href="https://www.justice.gov/usao-edmi/pr/nine-individuals-connected-hacking-group-charged-online-identity-theft-and-other" target="_blank" rel="noopener">charged this week in Michigan federal court</a> were alleged to have been members of The Community of serial SIM swappers. They face a fifteen count indictment, including charges of wire fraud, conspiracy and aggravated identity theft (a charge that carries a mandatory two-year sentence). A separate criminal complaint unsealed this week charges three former employees of mobile phone providers accused of collaborating with The Community&#8217;s members.</p>
<p>Several of those charged have been mentioned by this blog previously. In August 2018, KrebsOnSecurity <a href="https://krebsonsecurity.com/2018/08/florida-man-arrested-in-sim-swap-conspiracy/" target="_blank" rel="noopener">broke the news</a> that police in Florida arrested 25-year-old Pasco County, Fla. city employee <strong>Ricky Joseph Handschumacher</strong>, charging him with grand theft and money laundering. As I reported in that story, &#8220;<em>investigators allege Handschumacher was part of a group of at least nine individuals scattered across multiple states</em> who for the past two years have drained bank accounts via an increasingly common scheme involving mobile phone “&#8217;SIM swaps.&#8217;”</p>
<p>This blog also has featured <a href="https://krebsonsecurity.com/?s=phobia&amp;x=0&amp;y=0" target="_blank" rel="noopener">several stories</a> about the escapades of <strong>Ryan Stevenson</strong>, a 26-year-old West Haven, Conn. man who goes by the hacker name &#8220;Phobia.&#8221; Most recently, I wrote about how Mr. Stevenson earned a decent number of bug bounty rewards and public recognition from top telecom companies for finding and reporting security holes in their Web sites &#8212; all the while <a href="https://krebsonsecurity.com/2018/11/bug-bounty-hunter-ran-isp-doxing-service/" target="_blank" rel="noopener">secretly operating a service that leveraged these same flaws to sell their customers&#8217; personal data to people who were active in the SIM swapping community</a>.</p>
<p>One of the six men charged in the conspiracy &#8212; <strong>Colton Jurisic</strong>, 20 of, Dubuque, Iowa &#8212; has been more well known under his hacker alias &#8220;<strong>Forza</strong>,&#8221; and &#8220;<strong>ForazaTheGod</strong>.&#8221; In December 2016, KrebsOnSecurity heard from a woman who had her Gmail, Instagram, Facebook and LinkedIn accounts hijacked after a group of individuals led by Forza taunted her on Twitter as they took over her phone account.</p>
<p>&#8220;They failed to get [her three-letter Twitter account name, redacted] because I had two-factor authentication turned on for twitter, combined with a new phone number of which they were unaware,&#8221; the source said in an email to KrebsOnSecurity in 2016. &#8220;@forzathegod had the audacity to even tweet me to say I was about to be hacked.&#8221;<span id="more-47650"></span></p>
<p>Also part of the alleged Community of SIM swappers is <strong>Conor Freeman</strong>, 20, of Dublin, Ireland; <strong>Reyad Gafar Abbas</strong>, 19, of Rochester, New York; <strong>Garrett Endicott</strong>, 21, of Warrensburg, Missouri.</p>
<p>The three men criminally accused of working with the six through their employment at mobile phone stores are <strong>Fendley Joseph</strong>, 28, of Murrietta, Calif.; <strong>Jarratt White</strong>, 22, and <strong>Robert Jack</strong>, 22, both from Tucson, Ariz.</p>
<p>If convicted on the charge of conspiracy to commit wire fraud, each defendant faces a statutory maximum penalty of 20 years in prison.  The charges of wire fraud each carry a statutory maximum penalty of 20 years in prison.</p>
<p>Last month, 20-year-old college student and valedictorian <strong>Joel Ortiz</strong> became the first person ever to be sentenced for SIM swapping &#8212; pleading guilty to a ten year stint in prison for stealing more than $5 million in cryptocurrencies from victims and then <a href="https://krebsonsecurity.com/2019/02/more-alleged-sim-swappers-face-justice/" target="_blank" rel="noopener">spending it lavishly at elaborate club parties in Las Vegas and Los Angeles</a>.</p>
<p>A copy of the indictment against the six men is <a href="media/d5cfd815.ninesimswap.pdf" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/05/ninesimswap.pdf" target="_blank" rel="noopener">here</a> (PDF).</p>


feed_id: https://krebsonsecurity.com/?p=47682
title: Microsoft Patches ‘Wormable’ Flaw in Windows XP, 7 and Windows 2003
uri: Microsoft-Patches-Wormable-Flaw-in-Windows-XP-7-and-Windows-200
url:
https://krebsonsecurity.com/2019/05/microsoft-patches-wormable-flaw-in-windows-xp-7-and-windows-2003/

content:
<p><strong>Microsoft</strong> today is taking the unusual step of releasing security updates for unsupported but still widely-used <strong>Windows</strong> operating systems like <strong>XP</strong> and <strong>Windows 2003</strong>, citing the discovery of a &#8220;wormable&#8221; flaw that the company says could be used to fuel a fast-moving malware threat like the WannaCry ransomware attacks of 2017.</p>
<div id="attachment_47692" style="width: 603px" class="wp-caption aligncenter"><img class=" wp-image-47692" src="media/94255b79.wannacry-countries.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/05/wannacry-countries.jpg" alt="" width="593" height="273" /><p class="wp-caption-text">The May 2017 global malware epidemic WannaCry affected some 200,000 Windows systems in 150 countries. Source: Wikipedia.</p></div>
<p>The vulnerability (<a href="https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0708" target="_blank" rel="noopener">CVE-2019-0708</a>) resides in the &#8220;remote desktop services&#8221; component built into supported versions of Windows, including <strong>Windows 7</strong>, <strong>Windows Server 2008 R2</strong>, and <strong>Windows Server 2008</strong>. It also is present in computers powered by Windows XP and Windows 2003, operating systems for which Microsoft long ago stopped shipping security updates.</p>
<p>Microsoft said the company has not yet observed any evidence of attacks against the dangerous security flaw, but that it is trying to head off a serious and imminent threat.</p>
<p>&#8220;While we have observed no exploitation of this vulnerability, it is highly likely that malicious actors will write an exploit for this vulnerability and incorporate it into their malware,&#8221; wrote <strong>Simon Pope</strong>, director of incident response for the <strong>Microsoft Security Response Center</strong>.</p>
<p>&#8220;This vulnerability is pre-authentication and requires no user interaction,&#8221; Pope said. &#8220;In other words, the vulnerability is &#8216;wormable,&#8217; meaning that any future malware that exploits this vulnerability could propagate from vulnerable computer to vulnerable computer in a similar way as the WannaCry malware spread across the globe in 2017. It is important that affected systems are patched as quickly as possible to prevent such a scenario from happening.&#8221;</p>
<p>The <a href="https://en.wikipedia.org/wiki/WannaCry_ransomware_attack" target="_blank" rel="noopener">WannaCry ransomware threat</a> spread quickly across the world in May 2017 using <a href="https://en.wikipedia.org/wiki/EternalBlue" target="_blank" rel="noopener">a vulnerability</a> that was particularly prevalent among systems running Windows XP and older versions of Windows. Microsoft had already released a patch for the flaw, but many older and vulnerable OSes were never updated. Europol estimated at the time that WannaCry spread to some 200,000 computers across 150 countries.<span id="more-47682"></span></p>
<p>CVE-2019-0708 <em>does not affect</em> Microsoft&#8217;s latest operating systems &#8212; <strong>Windows 10</strong>, <strong>Windows 8.1</strong>, <strong>Windows 8</strong>, <strong>Windows Server 2019</strong>, <strong>Windows Server 2016</strong>, <strong>Windows Server 2012 R2</strong>, or <strong>Windows Server 2012</strong>.</p>
<p>More information on how to download and deploy the update for CVE-2019-0708 is <a href="https://support.microsoft.com/en-us/help/4500705" target="_blank" rel="noopener">here</a>.</p>
<p>This post will be updated throughout the day as more information about the rest of today&#8217;s Patch Tuesday updates becomes available.</p>


feed_id: https://krebsonsecurity.com/?p=47694
title: A Tough Week for IP Address Scammers
uri: A-Tough-Week-for-IP-Address-Scammers
url: https://krebsonsecurity.com/2019/05/a-tough-week-for-ip-address-scammers/
content:
<p>In the early days of the Internet, there was a period when Internet Protocol version 4 (IPv4) addresses (e.g. 4.4.4.4) were given out like cotton candy to anyone who asked. But these days companies are queuing up to obtain new IP space from the various regional registries that periodically dole out the prized digits. With the value of a single IP hovering between $15-$25, those registries are now fighting a wave of shady brokers who specialize in securing new IP address blocks under false pretenses and then reselling to spammers. Here&#8217;s the story of one broker who fought back in the courts, and lost spectacularly.</p>
<p><img class="aligncenter wp-image-47720" src="media/c1899999.ips.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/05/ips.jpg" alt="" width="591" height="406" /></p>
<p>On May 14, South Carolina U.S. Attorney <strong>Sherri Lydon</strong> filed criminal wire fraud charges against <strong>Amir Golestan</strong>, alleging he and his Charleston, S.C. based company <strong>Micfo LLC</strong> orchestrated an elaborate network of phony companies and aliases to secure more than 735,000 IPs from the <strong>American Registry for Internet Numbers</strong> (ARIN), a nonprofit which oversees IP addresses assigned to entities in the U.S., Canada, and parts of the Caribbean.</p>
<p>Interestingly, Micfo itself set this process in motion late last year when it sued ARIN. In December 2018, Micfo&#8217;s attorneys asked a federal court in Virginia to issue a temporary restraining order against ARIN, which had already told the company about its discovery of the phony front companies and was threatening to revoke some 735,000 IP addresses. That is, unless Micfo agreed to provide more information about its operations and customers.</p>
<p>At the time, many of the IP address blocks assigned to Micfo had been <a href="https://webcache.googleusercontent.com/search?q=cache:PgSPF4tZm1oJ:https://www.spamhaus.org/rokso/sbl_archived/SPM1292/the-powerhouse-network-ip.gold+&amp;cd=14&amp;hl=en&amp;ct=clnk&amp;gl=us" target="_blank" rel="noopener">freshly resold to spammers</a>. Micfo ultimately declined to provide ARIN the requested information, and as a result the court denied Micfo&#8217;s request (the <a href="media/3bd613fd.transcript-arin.pdf" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/05/transcript-arin.pdf" target="_blank" rel="noopener">transcript</a> of that hearing is instructive and amusing).</p>
<p>But by virtue of the contract Micfo signed with ARIN, any further dispute had to be settled via arbitration. On May 13, that arbitration panel ordered Micfo to pay $350,000 for ARIN&#8217;s legal fees and to cough up any of those 735,000 IPs the company hadn&#8217;t already sold.</p>
<p>According to the criminal indictment in South Carolina, in 2017 and 2018 Golestan sold IP addresses using a third party broker:</p>
<p>&#8220;Golestan sold 65,536 IPv4 addresses for $13 each, for a total of $851,896,&#8221; the indictment alleges. &#8220;Golestan also organized a second transaction for another 65,536 IP addresses, for another approximately $1 million. During this same time period, Golestan had a contract to sell 327,680 IP addresses at $19 per address, for a total of $6.22 million&#8221; [this last transaction would be blocked.]<span id="more-47694"></span></p>
<div id="attachment_47714" style="width: 600px" class="wp-caption aligncenter"><img class="wp-image-47714" src="media/de765089.counts-micfo.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/05/counts-micfo.jpg" alt="" width="590" height="644" /><p class="wp-caption-text">The various front companies alleged to have been run by Micfo and Amir Golestan.</p></div>
<p>Mr. Golestan could not be immediately reached for comment. Golestan&#8217;s attorney in Micfo&#8217;s lawsuit against ARIN declined to comment on either the criminal charges or the arbitration outcome. Calls to nearly a dozen of the front companies named in the dispute mostly just rang and rang with no answer, or went to voicemail boxes that were full.</p>
<p><strong>Stephen Ryan</strong> is a Washington, D.C.-based attorney who represented ARIN in the dispute filed by Micfo. Ryan said this was the first time ARIN&#8217;s decision to revoke IP address space resulted in a court battle &#8212; let alone arbitration.</p>
<p>&#8220;We have revoked addresses for fraud before, but that hasn&#8217;t previously resulted in litigation,&#8221; Ryan said. &#8220;The interesting thing here is that they litigated this for five months.&#8221;</p>
<p>According to <a href="https://www.prnewswire.com/news-releases/arin-wins-important-legal-case-and-precedent-against-fraud-300849070.html" target="_blank" rel="noopener">a press release</a> by ARIN, &#8220;Micfo obtained and utilized 11 shelf companies across the United States, and intentionally created false aliases purporting to be officers of those companies, to induce ARIN into issuing the fraudulently sought IPv4 resources and approving related transfers and reassignments of these addresses. The defrauding party was monetizing the assets obtained in the transfer market, and obtained resources under ARIN&#8217;s waiting list process.&#8221;</p>
<p>&#8220;This was an elaborate operation,&#8221; said Ryan, a former federal prosecutor. &#8220;All eleven of these front companies for Micfo are still up on the Web, where you see all these wonderful people who allegedly work there. And meanwhile we were receiving notarized affidavits in the names of people that were false. It made it much more interesting to do this case because it created 11 states where they&#8217;d violated the law.&#8221;</p>
<p>The <a href="media/e34857d9.Golstan-Indict-filed.pdf" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/05/Golstan-Indict-filed.pdf" target="_blank" rel="noopener">criminal complaint against Golestan and Micfo</a> (PDF) includes 20 counts of wire fraud associated with the phony companies allegedly set up by Micfo.</p>
<p><strong>John Levine</strong>, author of <a href="https://www.amazon.com/Internet-Dummies-John-R-Levine/dp/1118096142" target="_blank" rel="noopener">The Internet for Dummies</a> and a member of the security and stability advisory committee at <a href="https://en.wikipedia.org/wiki/ICANN" target="_blank" rel="noopener">ICANN</a>, said ARIN does not exactly have a strong reputation for going after the myriad IP address scammers allegedly operating in a similar fashion as Micfo.</p>
<p>&#8220;It is definitely the case that for a long time ARIN has not been very aggressive about checking the validity of IP address applications and transfers, and now it seems they are somewhat better than they used to be,&#8221; Levine said. &#8220;A lot of people have been frustrated that ARIN doesn&#8217;t act more like a regulator in this space. Given how increasingly valuable IPv4 space is, ARIN has to be more vigilant because the incentive for crooks to do this kind of thing is very high.&#8221;</p>
<p>Asked if ARIN would have the stomach and budget to continue the fight if other IP address scammers fight back in a similar way, Ryan said ARIN would not back down from the challenge.</p>
<p>&#8220;If we find a scheme or artifice to defraud and it&#8217;s a substantial number of addresses and its egregious fraud, then yes, we have a reserve set aside for litigation and we can and will use it for cases like this,&#8221; Ryan said, adding that he&#8217;d welcome anyone with evidence of similar schemes to come forward. &#8220;But a better strategy is not to issue it and never have to go back and revoke it, and we&#8217;re good at that now.&#8221;</p>


feed_id: https://krebsonsecurity.com/?p=47736
title: Feds Target $100M ‘GozNym’ Cybercrime Network
uri: Feds-Target-100M-GozNym-Cybercrime-Network
url: https://krebsonsecurity.com/2019/05/feds-target-100m-goznym-cybercrime-network/
content:
<p>Law enforcement agencies in the United States and Europe today unsealed charges against 11 alleged members of the <strong>GozNym</strong> malware network, an international cybercriminal syndicate suspected of stealing $100 million from more than 41,000 victims with the help of a stealthy banking trojan by the same name.</p>
<div id="attachment_47737" style="width: 606px" class="wp-caption aligncenter"><img class=" wp-image-47737" src="media/eb857eec.GozNymNetwork.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/05/GozNymNetwork.jpg" alt="" width="596" height="337" /><p class="wp-caption-text">The locations of alleged GozNym cybercrime group members. Source: DOJ</p></div>
<p>The indictments <a href="https://www.justice.gov/opa/pr/goznym-cyber-criminal-network-operating-out-europe-targeting-american-entities-dismantled" target="_blank" rel="noopener">unsealed</a> in a Pennsylvania court this week stem from a slew of cyber heists carried out between October 2015 and December 2016. They&#8217;re also related to the 2016 arrest of <strong>Krasimir Nikolov</strong>, a 47-year-old Bulgarian man who <a href="https://www.justice.gov/usao-wdpa/pr/bulgarian-charged-goznym-malware-attacks-us" target="_blank" rel="noopener">was extradited to the United States</a> to face charges for allegedly cashing out bank accounts that were compromised by the GozNym malware.</p>
<p>Prosecutors say Nikolov, a.k.a. &#8220;pablopicasso,&#8221; &#8220;salvadordali,&#8221; and &#8220;karlo,&#8221; was key player in the GozNym crime group who used stolen online banking credentials captured by GozNym malware to access victims’ online bank accounts and attempt to steal their money through electronic funds transfers into bank accounts controlled by fellow conspirators.</p>
<p>According to the indictment, the GozNym network exemplified the concept of &#8216;cybercrime as a service,&#8217; in that the defendants advertised their specialized technical skills and services on underground, Russian-language, online criminal forums. The malware was dubbed GozNym because it combines the stealth of a previous malware strain called <a href="https://www.proofpoint.com/us/threat-insight/post/nymaim-config-decoded" target="_blank" rel="noopener">Nymaim</a> with the capabilities of the powerful <a href="https://krebsonsecurity.com/?s=gozi&amp;x=0&amp;y=0" target="_blank" rel="noopener">Gozi banking trojan</a>.</p>
<p>The feds say the ringleader of the group was <strong>Alexander Konovolov</strong>, 35, of Tbilisi, Georgia, who controlled more than 41,000 victim computers infected with GozNym and recruited various other members of the cybercrime team.</p>
<p><strong>Vladimir Gorin</strong>, a.k.a “Voland,”  “mrv,” and “riddler,” of Orenburg, Russia allegedly was a malware developer who oversaw the creation, development, management, and leasing of GozNym.</p>
<p>The indictment alleges 32-year-old <strong>Eduard Malancini</strong>, a.k.a. &#8220;JekaProf&#8221; and &#8220;procryptgroup&#8221; from Moldova, specialized in &#8220;crypting&#8221; or obfuscating the GozNym malware to evade detection by antivirus software.</p>
<p>Four other men named in the indictment were accused of recruiting and managing &#8220;<a href="https://krebsonsecurity.com/tag/money-mules/" target="_blank" rel="noopener">money mules</a>,&#8221; willing or unwitting people who can be used to receive stolen funds on behalf of the criminal syndicate. One of those alleged mule managers &#8212; <strong>Farkhad Rauf Ogly Manokhim</strong> (a.k.a. &#8220;frusa&#8221;) of Volograd, Russia was arrested in 2017 in Sri Lanka on an international warrant from the United States, but escaped and fled back to Russia while on bail awaiting extradition.</p>
<p>Also charged was 28-year-old Muscovite <strong>Konstantin Volchkov</strong>, a.k.a. &#8220;elvi,&#8221;  who allegedly provided the spamming service used to disseminate malicious links that tried to foist GozNym on recipients who clicked.</p>
<p>The malicious links referenced in those spam emails were served via the <strong>Avalanche bulletproof hosting service</strong>, a distributed, cloud-hosting network that for seven years was rented out to hundreds of fraudsters for use in launching malware and phishing attacks. Avalanche was <a href="https://krebsonsecurity.com/2016/12/avalanche-global-fraud-ring-dismantled/" target="_blank" rel="noopener">dismantled in Dec. 2016</a> by a similar international law enforcement action.</p>
<p>The alleged administrator of the Avalanche bulletproof network &#8212; 36-year-old <strong>Gennady Kapkanov</strong> from Poltova, Ukraine &#8212; has eluded justice in prior scrapes with the law: During the Avalanche takedown in Dec. 2016, Kapkanov <a href="https://krebsonsecurity.com/2016/12/avalanche-crime-ring-leader-eludes-justice/" target="_blank" rel="noopener">fired an assault rifle at Ukrainian police who were trying to raid his apartment</a>.<span id="more-47736"></span></p>
<p>After that incident, Ukrainian police arrested Kapkanov and booked him on cybercrime charges. But a judge later ordered him to be released, saying the prosecution had failed to file the proper charges. The Justice Department says Kapkanov is now facing prosecution in Ukraine for his role in providing bulletproof hosting services to the GozNym criminal network.</p>
<p>The five Russian nationals charged in the case remain at large. The FBI has released <a href="https://www.justice.gov/opa/press-release/file/1163076/download" target="_blank" rel="noopener">a &#8220;wanted&#8221; poster</a> with photos and more details about them. The Justice Department says it is working with authorities in Georgia, Ukraine and Moldova to build prosecutions against the defendants in those countries.</p>
<p>Nikolov entered a guilty plea in federal court in Pittsburgh on charges relating to his participation in the GozNym conspiracy on April 10, 2019.  He is scheduled to be sentenced on Aug. 30, 2019.</p>
<p>It&#8217;s good to see this crime network being torn apart, even if many of its key members have yet to be apprehended. These guys caused painful losses for many companies &#8212; mostly small businesses &#8212; that got infected with their malware. Their activities and structure are remarkably similar to that of the <a href="https://krebsonsecurity.com/2010/10/ukraine-detains-5-individuals-tied-to-70-million-in-ebanking-heists/" target="_blank" rel="noopener">&#8220;Jabberzeus&#8221; crime gang in Ukraine</a> that siphoned $70 million – out of an attempted $220 million — from hundreds of U.S.-based small to mid-sized businesses several years ago.</p>
<p>The financial losses brought about by that gang&#8217;s string of cyberheists &#8212; or at least the few dozen heists documented in my series <a href="https://krebsonsecurity.com/category/smallbizvictims/" target="_blank" rel="noopener">Target: Small Business</a> &#8212; often caused victim companies to lay off employees, and in some cases go out of business entirely.</p>
<p>A copy of the GozNym indictment is <a href="https://www.justice.gov/opa/press-release/file/1163066/download" target="_blank" rel="noopener">here</a> (PDF).</p>


feed_id: https://krebsonsecurity.com/?p=47748
title: Account Hijacking Forum OGusers Hacked
uri: Account-Hijacking-Forum-OGusers-Hacked
url: https://krebsonsecurity.com/2019/05/account-hijacking-forum-ogusers-hacked/
content:
<p><strong>Ogusers[.]com</strong> &#8212; a forum popular among people involved in hijacking online accounts and conducting <a href="https://krebsonsecurity.com/?s=sim+swap&amp;x=0&amp;y=0" target="_blank" rel="noopener">SIM swapping attacks</a> to seize control over victims&#8217; phone numbers &#8212; has itself been hacked, exposing the email addresses, hashed passwords, IP addresses and private messages for nearly 113,000 forum users.</p>
<p>On May 12, the administrator of OGusers explained an outage to forum members by saying a hard drive failure had erased several months&#8217; worth of private messages, forum posts and prestige points, and that he&#8217;d restored a backup from January 2019. Little did the administrators of OGusers know at the time, but that May 12 incident coincided with the theft of the forum&#8217;s user database, and the wiping of forum hard drives.</p>
<p>On May 16, the administrator of rival hacking community <strong>RaidForums</strong> announced he&#8217;d uploaded the OGusers database for anyone to download for free.</p>
<div id="attachment_47751" style="width: 605px" class="wp-caption aligncenter"><a class="lightbox" href="media/a94c0413.raidforums-ogu.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/05/raidforums-ogu.jpg"><img class="wp-image-47751" src="media/a94c0413.raidforums-ogu.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/05/raidforums-ogu.jpg" alt="" width="595" height="329" /></a><p class="wp-caption-text">The administrator of the hacking community Raidforums on May 16 posted the database of passwords, email addresses, IP addresses and private messages of more than 113,000 users of Ogusers[.]com.</p></div>
<p>&#8220;On the 12th of May 2019 the forum ogusers.com was breached [and] 112,988 users were affected,&#8221; the message from RaidForums administrator Omnipotent reads. &#8220;I have uploaded the data from this database breach along with their website source files. Their hashing algorithm was the default salted MD5 which surprised me, anyway the website owner has acknowledged data corruption but not a breach so I guess I&#8217;m the first to tell you the truth. According to his statement he didn&#8217;t have any recent backups so I guess I will provide one on this thread lmfao.&#8221;</p>
<p>The database, a copy of which was obtained by KrebsOnSecurity, appears to hold the usernames, email addresses, hashed passwords, private messages and IP address at the time of registration for approximately 113,000 users (although many of these nicknames are likely the same people using different aliases).<span id="more-47748"></span></p>
<p>The publication of the OGuser database has caused much consternation and drama for many in the community, which has become infamous for attracting people involved in hijacking phone numbers as a method of taking over the victim&#8217;s social media, email and financial accounts, and then reselling that access for hundreds or thousands of dollars to others on the forum.</p>
<p>Several threads on OGusers quickly were filled with responses from anxious users concerned about being exposed by the breach. Some complained they were already receiving phishing emails targeting their OGusers accounts and email addresses. <a class="lightbox" href="media/020a7309.rip-ogu.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/05/rip-ogu.jpg"><img class="aligncenter wp-image-47753" src="media/020a7309.rip-ogu.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/05/rip-ogu.jpg" alt="" width="595" height="472" /></a></p>
<p>Meanwhile, the official Discord chat channel for OGusers has been flooded with complaints and expressions of disbelief at the hack. Members vented their anger at the main forum administrator, who uses the nickname &#8220;Ace,&#8221; claiming he altered the forum functionality after the hack to prevent users from removing their accounts. One user on the Discord chat summed it up:</p>
<p>&#8220;Ace be like:</p>
<p>-not replace broken hard drives, causing the site to time warp back four months<br />
&#8211; not secure website, causing user info to be leaked<br />
&#8211; disable selfban so people can&#8217;t leave&#8221;<a class="lightbox" href="media/685f38a9.ogu-discord.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/05/ogu-discord.jpg"><br />
<img class="aligncenter wp-image-47757" src="media/685f38a9.ogu-discord.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/05/ogu-discord.jpg" alt="" width="596" height="354" /></a></p>
<p>It’s difficult not to admit feeling a bit of <a href="https://en.wikipedia.org/wiki/Schadenfreude" target="_blank" rel="noopener">schadenfreude</a> in response to this event. It’s gratifying to see such a comeuppance for a community that has largely specialized in hacking others. Also, federal and state law enforcement investigators going after SIM swappers are likely to have a field day with this database, and my guess is this leak will fuel even more arrests and charges for those involved.</p>


feed_id: https://krebsonsecurity.com/?p=47793
title: Legal Threats Make Powerful Phishing Lures
uri: Legal-Threats-Make-Powerful-Phishing-Lures
url: https://krebsonsecurity.com/2019/05/legal-threats-make-powerful-phishing-lures/
content:
<p>Some of the most convincing email phishing and malware attacks come disguised as nastygrams from a law firm. Such scams typically notify the recipient that he/she is being sued, and instruct them to review the attached file and respond within a few days &#8212; or else. Here&#8217;s a look at a recent spam campaign that peppered more than 100,000 business email addresses with fake legal threats harboring malware.</p>
<p><img src="media/6cdd7528.suingyou.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/05/suingyou.jpg" alt="" width="588" height="388" class="aligncenter size-full wp-image-47805" /></p>
<p>On or around May 12, at least two antivirus firms began detecting booby-trapped Microsoft Word files that were sent along with some various of the following message:</p>
<blockquote>
<p>{Pullman &#038; Assoc. | Wiseman &#038; Assoc.| Steinburg &#038; Assoc. | Swartz &#038; Assoc. | Quartermain &#038; Assoc.} <legal@wpslaw.com></p>
<p>Hi,</p>
<p>The following {e-mail | mail} is to advise you that you are being charged by the city. </p>
<p>Our {legal team | legal council | legal departement} has prepared a document explaining the {litigation | legal dispute | legal contset}.</p>
<p>Please download and read the attached encrypted document carefully. </p>
<p>You have 7 days to reply to this e-mail or we will be forced to step forward with this action.</p>
<p>Note: The password for the document is 123456</p></blockquote>
<p>The template above was part of a phishing kit being traded on the underground, and the user of this kit decides which of the options in brackets actually get used in the phishing message. </p>
<p>Yes, the spelling/grammar is poor and awkward (e.g., the salutation), but so is the overall antivirus detection rate of the attached malicious Word document. This phishing kit included five booby-trapped Microsoft Word documents to choose from, and none of those files are detected as malicious by more than three of the five dozen or so antivirus products that scanned the Word docs on May 22 &#8212; 10 days after they were spammed out.</p>
<p>According to both <strong>Fortinet</strong> and <strong>Sophos</strong>, the attached Word documents include a trojan that is typically used to drop additional malware on the victim&#8217;s computer. Previous detections of this trojan have been associated with ransomware, but the attackers in this case can use the trojan to install malware of their choice.</p>
<p>Also part of the phishing kit was a text document containing some 100,000 business email addresses &#8212; most of them ending in Canadian (.ca) domains &#8212; although there were also some targets at companies in the northeastern United States. If only a tiny fraction of the recipients of this scam were unwary enough to open the attachment, it would still be a nice payday for the phishers.<span id="more-47793"></span></p>
<p>The law firm domain spoofed in this scam &#8212; wpslaw.com &#8212; now redirects to the Web site for RWC LLC, a legitimate firm based in Connecticut. A woman who answered the phone at RWC said someone had recently called to complain about a phishing scam, but beyond that the firm didn&#8217;t have any knowledge of the matter.</p>
<p>As phishing kits go, this one is pretty basic and not terribly customized or convincing. But I could see a kit that tried only slightly harder to get the grammar right and more formally address the recipient doing quite well: Legitimate-looking legal threats have a way of making some people act before they think.</p>
<p>Don&#8217;t be like those people. Never open attachments in emails you were not expecting. <em>When in doubt, toss it out</em>. If you&#8217;re worried it may be legitimate, research the purported sender(s) and reach out to them over the phone if need be. And resist the urge to respond to these spammers; doing so may only serve to encourage further &#8220;mailious&#8221; correspondence. </p>
<p>KrebsOnSecurity would like to thank <a href="https://www.holdsecurity.com" rel="noopener" target="_blank">Hold Security</a> for a heads up on this phishing kit.</p>


feed_id: https://krebsonsecurity.com/?p=47813
title: First American Financial Corp. Leaked Hundreds of Millions of Title Insurance Records
uri: First-American-Financial-Corp-Leaked-Hundreds-of-Millions-of-Title-In
url:
https://krebsonsecurity.com/2019/05/first-american-financial-corp-leaked-hundreds-of-millions-of-title-insurance-records/

content:
<p>The Web site for Fortune 500 real estate title insurance giant <strong>First American Financial Corp.</strong> [<a href="https://www.marketbeat.com/stocks/NYSE/FAF/" target="_blank" rel="noopener">NYSE:FAF</a>] leaked hundreds of millions of documents related to mortgage deals going back to 2003, until notified this week by KrebsOnSecurity. The digitized records &#8212; including bank account numbers and statements, mortgage and tax records, Social Security numbers, wire transaction receipts, and drivers license images &#8212; were available without authentication to anyone with a Web browser.</p>
<div id="attachment_47830" style="width: 607px" class="wp-caption aligncenter"><img class=" wp-image-47830" src="media/e0ba395a.firstamericanfinancial.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/05/firstamericanfinancial.jpg" alt="" width="597" height="355" /><p class="wp-caption-text">First American Financial Corp. Image: Linkedin.</p></div>
<p>Santa Ana, Calif.-based <a href="https://en.wikipedia.org/wiki/First_American_Corporation" target="_blank" rel="noopener">First American</a> is a leading provider of title insurance and settlement services to the real estate and mortgage industries. It employs some 18,000 people and brought in <a href="http://fortune.com/fortune500/first-american-financial/" target="_blank" rel="noopener">more than $5.7 billion in 2018</a>.</p>
<p>Earlier this week, KrebsOnSecurity was contacted by a real estate developer in Washington state who said he&#8217;d had little luck getting a response from the company about what he found, which was that a portion of its Web site (firstam.com) was leaking tens if not hundreds of millions of records. He said anyone who knew the URL for a valid document at the Web site could view other documents just by modifying a single digit in the link.</p>
<p>And this would potentially include anyone who&#8217;s ever been sent a document link via email by First American.</p>
<p>KrebsOnSecurity confirmed the real estate developer&#8217;s findings, which indicate that First American&#8217;s Web site exposed approximately 885 million files, the earliest dating back more than 16 years. No authentication was required to read the documents.</p>
<p>Many of the exposed files are records of wire transactions with bank account numbers and other information from home or property buyers and sellers. <strong>Ben Shoval</strong>, the developer who notified KrebsOnSecurity about the data exposure, said that&#8217;s because First American is one of the most widely-used companies for real estate title insurance and for closing real estate deals &#8212; where both parties to the sale meet in a room and sign stacks of legal documents.</p>
<p>&#8220;Closing agencies are supposed to be the only neutral party that doesn&#8217;t represent someone else&#8217;s interest, and you&#8217;re required to have title insurance if you have any kind of mortgage,&#8221; Shoval said.</p>
<p>&#8220;The title insurance agency collects all kinds of documents from both the buyer and seller, including Social Security numbers, drivers licenses, account statements, and even internal corporate documents if you&#8217;re a small business. <span class="pullquote pqright">You give them all kinds of private information and you expect that to stay private.</span>&#8221;</p>
<p>Shoval shared a document link he&#8217;d been given by First American from a recent transaction, which referenced a record number that was nine digits long and dated April 2019. Modifying the document number in his link by numbers in either direction yielded other peoples&#8217; records before or after the same date and time, indicating the document numbers may have been issued sequentially.</p>
<p>The earliest document number available on the site &#8211; 000000075 &#8212; referenced a real estate transaction from 2003. From there, the dates on the documents get closer to real time with each forward increment in the record number.</p>
<div id="attachment_47843" style="width: 595px" class="wp-caption aligncenter"><a class="lightbox" href="media/49e128d0.sample-fa.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/05/sample-fa.jpg"><img class="wp-image-47843" src="media/49e128d0.sample-fa.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/05/sample-fa.jpg" alt="" width="585" height="478" /></a><p class="wp-caption-text">A redacted screenshot of one of many millions of sensitive records exposed by First American&#8217;s Web site.</p></div>
<p>As of the morning of May 24, firstam.com was returning documents up to the present day (885,000,000+), including many PDFs and post-dated forms for upcoming real estate closings. By 2 p.m. ET Friday, the company had disabled the site that served the records. It&#8217;s not yet clear how long the site remained in its promiscuous state, but archive.org shows documents available from the site dating back to at least March 2017.</p>
<p>First American wouldn&#8217;t comment on the overall number of records potentially exposed via their site, or how long those records were publicly available. But a spokesperson for the company did share the following statement:</p>
<blockquote><p>&#8220;First American has learned of a design defect in an application that made possible unauthorized access to customer data.  At First American, security, privacy and confidentiality are of the highest priority and we are committed to protecting our customers’ information. The company took immediate action to address the situation and shut down external access to the application. We are currently evaluating what effect, if any, this had on the security of customer information. We will have no further comment until our internal review is completed.&#8221;</p></blockquote>
<p>I should emphasize that these documents were merely available from First American&#8217;s Web site; I do not have any information on whether this fact was known to fraudsters previously, nor do I have any information to suggest the documents were somehow mass-harvested (although a low-and-slow or distributed indexing of this data would not have been difficult for even a novice attacker).<span id="more-47813"></span></p>
<p>Nevertheless, the information exposed by First American would be a virtual gold mine for phishers and scammers involved in so-called Business Email Compromise (BEC) scams, which often impersonate real estate agents, closing agencies, title and escrow firms in a bid to <a href="https://krebsonsecurity.com/2017/04/blind-trust-in-email-could-cost-you-your-home/" target="_blank" rel="noopener">trick property buyers into wiring funds to fraudsters</a>. According to the FBI, BEC scams are the most costly form of cybercrime today.</p>
<p>Armed with a single link to a First American document, BEC scammers would have an endless supply of very convincing phishing templates to use. A database like this also would give fraudsters a constant feed of new information about upcoming real estate financial transactions &#8212; <em>including the email addresses, names and phone numbers of the closing agents and buyers</em>.</p>
<p>As noted in past stories here, these types of data exposures are some of the most common yet preventable. In December 2018, the parent company of <strong>Kay Jewelers</strong> and <strong>Jared Jewelers</strong> fixed a weakness in their site that <a href="https://krebsonsecurity.com/2018/12/jared-kay-jewelers-parent-fixes-data-leak/" target="_blank" rel="noopener">exposed the order information for all of their online customers</a>.</p>
<p>In August 2018, financial industry giant <strong>Fiserv Inc.</strong> <a href="https://krebsonsecurity.com/2018/08/fiserv-flaw-exposed-customer-data-at-hundreds-of-banks/" target="_blank" rel="noopener">fixed a bug reported by KrebsOnSecurity</a> that exposed personal and financial details of countless customers across hundreds of bank Web sites.</p>
<p>In July 2018, identity theft protection service <strong>LifeLock</strong> corrected an information disclosure flaw that <a href="https://krebsonsecurity.com/2018/07/lifelock-bug-exposed-millions-of-customer-email-addresses/" target="_blank" rel="noopener">exposed the email address of millions of subscribers</a>. And in April 2018, PaneraBread.com <a href="https://krebsonsecurity.com/2018/04/panerabread-com-leaks-millions-of-customer-records/" target="_blank" rel="noopener">remedied a weakness</a> exposing millions of customer names, email and physical addresses, birthdays and partial credit card numbers.</p>


feed_id: https://krebsonsecurity.com/?p=45964
title: Should Failing Phish Tests Be a Fireable Offense?
uri: Should-Failing-Phish-Tests-Be-a-Fireable-Offense
url: https://krebsonsecurity.com/2019/05/should-failing-phish-tests-be-a-fireable-offense/
content:
<p>Would your average Internet user would be any more vigilant against phishing scams if he or she faced the real possibility of losing their job after falling for one too many of these emails? Recently, I met someone at a conference who said his employer had in fact terminated employees for such repeated infractions. As this was the first time I&#8217;d ever heard of an organization actually doing this, I asked some phishing experts what they thought (spoiler alert: they&#8217;re not fans of this particular teaching approach).</p>
<p><strong><img class="alignright wp-image-37128 size-full" src="media/d6565fd1.athook.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2016/12/athook.png" alt="" width="194" height="375" />John LaCour</strong> is founder and chief technology officer of <a href="https://www.phishlabs.com/" target="_blank" rel="noopener">PhishLabs</a>, a Charleston, S.C. based firm that helps companies educate and test employees on how not to fall for phishing scams. The company&#8217;s training courses offer customers a way to track how many employees open the phishing email tests and how many fall for the lure.</p>
<p>LaCour says enacting punitive measures for employees who repeatedly fall for phishing tests is counterproductive.</p>
<p>&#8220;We&#8217;ve heard from some of our clients in the financial industry that have similar programs where there are real consequences when people fail the tests, but it&#8217;s pretty rare across all types of businesses to have a policy that extreme,&#8221; LaCour said.</p>
<p>&#8220;There are a lot of things that organizations can do that aren&#8217;t as draconian and still have the desired effect of making security posture stronger,&#8221; he said. &#8220;We&#8217;ve seen companies require classroom training on the first failure, to a manager has to sit through it with you on the second time, to revoking network access in some cases.&#8221;</p>
<p>LaCour said one of the most common mistakes he sees is companies that purchase a tool to launch simulated phishing campaigns just to play &#8220;gotcha&#8221; with employees.</p>
<p>&#8220;It really demotivates people, and it doesn&#8217;t really teach them anything about how to be more diligent about phishing attacks,&#8221; he said. &#8220;Each phishing simulation program needs to be accompanied by a robust training program, where you teach employees what to do when they see something phishy. Otherwise, it just creates resentment among employees.&#8221;</p>
<p><strong>Rohyt Belani</strong>, CEO of Leesburg, Va.-based security firm <a href="https://cofense.com/" target="_blank" rel="noopener">Cofense</a> (formerly <strong>PhishMe</strong>), said anti-phishing education campaigns that employ strongly negative consequences for employees who repeatedly fall for phishing tests usually create tension and distrust between employees and the company&#8217;s security team.</p>
<p>&#8220;It can create an environment of animosity for the security team because they suddenly become viewed as working for Human Resources instead of trying to improve security,&#8221; Belani said. &#8220;Threatening people usually backfires, and they end up becoming more defiant and uncooperative.&#8221;</p>
<p>Cofense provides a phish reporting system and encourages customers to have their employees flag suspected phishing attacks (and tests), and Belani said those employee reports can often stymie real phishing attacks.</p>
<p>&#8220;So what happens a lot of times is a person may click on link in a real phishing email, and three seconds later realize, &#8216;Oops, I shouldn&#8217;t have clicked, let me report it anyway&#8217;,&#8221; Belani said. &#8220;But if that person knew there was a punitive angle to doing so, they&#8217;re more likely not to report it and to say, &#8216;You know what, I didn&#8217;t do it. Where&#8217;s the proof I clicked on the link?'&#8221;<span id="more-45964"></span></p>
<p>LaCour says PhishLabs encourages clients to use positive reinforcement in their employee training campaigns.</p>
<p>&#8220;Recognition &#8212; where employees and departments that do especially well are acknowledged &#8212; is very common,&#8221; LaCour said. &#8220;We also see things like small gifts or other things that companies would typically use to reward employees, such as gift cards or small bonuses for specific departments or people.&#8221;</p>
<p>LaCour said his offices make a game out of it.</p>
<p>&#8220;We make it competitive where we post the scores of each department and the lowest scoring department has to buy lunch for the rest of the department,&#8221; he said. &#8220;It teaches people there are real consequences and that we all need to be diligent when it comes to phishing.&#8221;</p>
<p>What about you, dear readers? Does your employer do phishing awareness training and testing? What incentives or disincentives are tied to those programs? Sound off in the comments below.</p>


feed_id: https://krebsonsecurity.com/?p=47856
title: Canada Uses Civil Anti-Spam Law in Bid to Fine Malware Purveyors
uri: Canada-Uses-Civil-Anti-Spam-Law-in-Bid-to-Fine-Malware-Purveyors
url:
https://krebsonsecurity.com/2019/05/canada-uses-civil-anti-spam-law-in-bid-to-fine-malware-purveyors/

content:
<p>Canadian government regulators are using the country&#8217;s powerful new anti-spam law to pursue hefty fines of up to a million dollars against Canadian citizens suspected of helping to spread malicious software.</p>
<p><img class="aligncenter wp-image-47892" src="media/0ae10a4c.casl.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/05/casl.jpg" alt="" width="595" height="130" /></p>
<p>In March 2019, the <a href="https://crtc.gc.ca/eng/home-accueil.htm" target="_blank" rel="noopener">Canadian Radio-television and Telecommunications Commission</a> (CRTC) &#8212; Canada&#8217;s equivalent of the <a href="https://en.wikipedia.org/wiki/Federal_Communications_Commission" target="_blank" rel="noopener">U.S. Federal Communications Commission</a> (FCC), executed a search warrant in tandem with the <a href="https://en.wikipedia.org/wiki/Royal_Canadian_Mounted_Police" target="_blank" rel="noopener">Royal Canadian Mounted Police</a> (RCMP) at the home of <a href="https://krebsonsecurity.com/2019/04/canadian-police-raid-orcus-rat-author/" target="_blank" rel="noopener">a Toronto software developer behind the Orcus RAT</a>, a product that’s been marketed on underground forums and used in countless malware attacks since its creation in 2015.</p>
<p>The CRTC was flexing relatively new administrative muscles gained from the passage of <a href="https://laws-lois.justice.gc.ca/eng/acts/E-1.6/index.html" target="_blank" rel="noopener">Canada&#8217;s Anti-Spam Legislation</a> (CASL), which covers far more than just junk email. Section 7 of CASL deals with the alteration of transmission data, including botnet activity. Section 8 involves the surreptitious installation of computer programs on computers or networks including malware and spyware.</p>
<p>And Section 9 prohibits an individual or organization from aiding, inducing, procuring or causing to be procured the doing of any of the above acts.</p>
<p>CRTC Director <strong>Neil Barratt</strong> said this allows his agency to target intermediaries who, through their actions or through inaction, facilitate the commission of CASL violations. Businesses found to be in violation of CASL can be fined up to $10 million; individuals can face up to a $1 million fine.</p>
<p>&#8220;We&#8217;re dealing with a lower burden of proof than a criminal conviction, and CASL gives us a little more leeway to get bad actors off our networks in Canada and to ultimately improve security for people here and hopefully elsewhere,&#8221; Barratt said in an interview with KrebsOnSecurity.</p>
<p>&#8220;CASL defines spam as commercial electronic messages without consent or the installation of software without consent or the intercepting of electronic messages,&#8221; Barratt said. &#8220;The installation of software is under Section 8, and this is one of the first major investigations under that statute.&#8221;<span id="more-47856"></span></p>
<p>Barratt added that the CRTC also was counting on CASL to help tidy up the reputation of the Canadian Web hosting industry.</p>
<p>&#8220;We&#8217;ve been trying to make sure that service providers operating in Canada &#8212; whether or not they are Canadian &#8212; are not unduly contributing to the infection of machines and hosting malware,&#8221; Barratt said. &#8220;We have great power in CASL and Section 9 makes it a violation to aid in the doing of a violation. And this extends quite broadly, across email service providers and various intermediaries.&#8221;</p>
<p>The enforcement division of the CRTC <a href="https://www.lexology.com/library/detail.aspx?g=4a823564-c402-4528-89ad-ec1b2859b844" target="_blank" rel="noopener">recently took action</a> against two companies &#8212; Datablocks Inc. and Sunlight Media Network Inc &#8212; for having violated CASL section 9 by disseminating online ads that caused malicious computer programs to be downloaded onto the computers of unsuspecting victims.</p>
<p>Under CASL, and for the purposes of verifying compliance or determining whether any of sections 6 to 9 were violated, the CRTC may compel individuals and organizations to provide any information in their possession or control, and ask a justice of the peace to issue a warrant authorizing entry into a place of residence.</p>
<p>It&#8217;s good to see a civil anti-spam law being used to go after people involved in selling malware couched as legitimate software, as seems to be the case with the Orcus RAT investigation. A relatively competent remote access trojan author can earn a tidy income selling their wares, but CASL may give Canadians interested in this line of a work a reason to reconsider if the end result is a million dollar fine.</p>
<p>More to the point, Canada (anecdotally at least) seems to have far more than its fair share of computer criminals, and yet unfortunately far less appetite than many other western countries for prosecuting those individuals criminally. In this regard, CASL offers a welcome alternative.</p>
<p>&#8220;One of the key takeaways of CASL was that it wasn&#8217;t just about emails that were annoying people, but also the use of email as a vector to mislead or defraud people and cause harm to computers and computer networks,&#8221; Barratt said. &#8220;Our parliamentarians decided to ensure the legislature covered a broad ambit. The search warrant executed in this case was a great example of criminal and civil law enforcement working together by using our unique tools and powers under the act to achieve the greatest good we could.&#8221;</p>


feed_id: https://krebsonsecurity.com/?p=47899
title: NY Investigates Exposure of 885 Million Mortgage Documents
uri: NY-Investigates-Exposure-of-885-Million-Mortgage-Documents
url: https://krebsonsecurity.com/2019/05/ny-investigates-exposure-of-885-million-mortgage-documents/
content:
<p>New York regulators are investigating a weakness that exposed 885 million mortgage records at <strong>First American Financial Corp.</strong> [NYSE:FAF] as the first test of the state&#8217;s strict new cybersecurity regulation. That measure, which went into effect in March 2019 and is considered among the toughest in the nation, requires financial companies to regularly audit and report on how they protect sensitive data, and provides for fines in cases where violations were reckless or willful.</p>
<p>On May 24, KrebsOnSecurity <a href="https://krebsonsecurity.com/2019/05/first-american-financial-corp-leaked-hundreds-of-millions-of-title-insurance-records/" target="_blank" rel="noopener">broke the news</a> that First American had just fixed a weakness in its Web site that exposed approximately 885 million documents &#8212; many of them with Social Security and bank account numbers &#8212; going back at least 16 years. No authentication was needed to access the digitized records.</p>
<p>On May 29, <em>The New York Times</em> <a href="https://www.nytimes.com/2019/05/29/business/mortgage-data-breach-investigation.html" target="_blank" rel="noopener">reported</a> that the inquiry by New York&#8217;s <strong>Department of Financial Services</strong> is likely to be followed by other investigations from regulators and law enforcement.</p>
<p>First American says it has hired a third-party security firm to investigate, and that it shut down external access to the records.</p>
<p>The Times says few people outside the real estate industry are familiar with First American, but millions have entrusted their data to the company when they go to close the deal on buying or selling a new home.</p>
<p>&#8220;First American provides title insurance and settlement services for property sales, which typically require buyers to hand over extensive financial records to other parties in their transactions,&#8221; wrote <strong>Stacy Cowley</strong>. &#8220;The company is one of the largest insurers in the United States, handling around one in every four transactions, according to the American Land Title Association.&#8221;</p>
<p>News also emerged this week that First American is <a href="https://www.bloomberg.com/news/articles/2019-05-28/first-american-financial-sued-over-alleged-client-data-breach" target="_blank" rel="noopener">now the target of a class action lawsuit</a> alleging the Fortune 500 mortgage industry giant &#8220;failed to implement even rudimentary security measures.&#8221;</p>


feed_id: https://krebsonsecurity.com/?p=47916
title: Report: No ‘Eternal Blue’ Exploit Found in Baltimore City Ransomware
uri: Report-No-Eternal-Blue-Exploit-Found-in-Baltimore-City-Ransomwa
url:
https://krebsonsecurity.com/2019/06/report-no-eternal-blue-exploit-found-in-baltimore-city-ransomware/

content:
<p>For almost the past month, key computer systems serving the government of Baltimore, Md. have been held hostage by a ransomware strain known as &#8220;<strong>Robbinhood</strong>.&#8221; Media publications have cited sources saying the Robbinhood version that hit Baltimore city computers was powered by &#8220;<strong>Eternal Blue</strong>,&#8221; a hacking tool developed by the <strong>U.S. National Security Agency</strong> (NSA) and leaked online in 2017. But new analysis suggests that while Eternal Blue could have been used to spread the infection, the Robbinhood malware itself contains no traces of it.</p>
<p>On May 25, <em>The New York Times</em> <a href="https://www.nytimes.com/2019/05/25/us/nsa-hacking-tool-baltimore.html?module=inline" target="_blank" rel="noopener">cited</a> unnamed security experts briefed on the attack who blamed the ransomware&#8217;s spread on the Eternal Blue exploit, which was linked to the global <a href="https://en.wikipedia.org/wiki/WannaCry_ransomware_attack" target="_blank" rel="noopener">WannaCry ransomware outbreak in May 2017</a>.</p>
<p>That story prompted <a href="https://www.nytimes.com/2019/05/31/us/nsa-baltimore-ransomware.html" target="_blank" rel="noopener">a denial from the NSA</a> that Eternal Blue was somehow used in the Baltimore attack. It also moved Baltimore City Council President <strong>Brandon Scott</strong> to write the Maryland governor <a href="media/1c6bc5c1.baltimore-disaster-640x844.jpeg" data-original-source="https://cdn.arstechnica.net/wp-content/uploads/2019/05/baltimore-disaster-640x844.jpeg" target="_blank" rel="noopener">asking for federal disaster assistance</a> and reimbursement as a result.</p>
<p>But according to <strong>Joe Stewart</strong>, a seasoned malware analyst now consulting with security firm <a href="https://www.armor.com" target="_blank" rel="noopener">Armor</a>, the malicious software used in the Baltimore attack does not contain any Eternal Blue exploit code. Stewart said he obtained a sample of the malware that he was able to confirm was connected to the Baltimore incident.</p>
<p><span class="pullquote pqright">&#8220;We took a look at it and found a pretty vanilla ransomware binary,&#8221; Stewart said. &#8220;It doesn&#8217;t even have any means of spreading across networks on its own.&#8221;</span></p>
<p>Stewart said while it&#8217;s still possible that the Eternal Blue exploit was somehow used to propagate the Robbinhood ransomware, it&#8217;s not terribly likely. Stewart said in a typical breach that leads to a ransomware outbreak, the intruders will attempt to leverage a single infection and use it as a jumping-off point to compromise critical systems on the breached network that would allow the malware to be installed on a large number of systems simultaneously.</p>
<p>&#8220;It certainly wouldn&#8217;t be the go-to exploit if your objective was to identify critical systems and then only when you&#8217;re ready launch the attack so you can do it all at once,&#8221; Stewart said. &#8220;At this point, Eternal Blue is probably going to be detected by internal [security systems] systems, or the target might already be patched for it.&#8221;</p>
<p>It is not known who is behind the Baltimore ransomware attack, but Armor said it was confident that the bad actor(s) in this case were the same individual(s) using the <a href="https://webcache.googleusercontent.com/search?q=cache:OGi4du1hQYMJ:https://twitter.com/robihkjn+&amp;cd=1&amp;hl=en&amp;ct=clnk&amp;gl=us" target="_blank" rel="noopener">now-suspended twitter account @Robihkjn (Robbinhood)</a>. Until it was suspended at around 3:00 p.m. ET today (June 3), the @Robihkjn account had been taunting the mayor of Baltimore and city council members, who have refused to pay <a href="https://www.baltimoresun.com/news/maryland/politics/bs-md-ci-it-outage-20190507-story.html" target="_blank" rel="noopener">the ransom demand of 13 bitcoin</a> &#8212; approximately $100,000.</p>
<p>In several of those tweets, the Twitter account could be seen posting links to documents allegedly stolen from Baltimore city government systems, ostensibly to both prove that those behind the Twitter account were responsible for the attack, and possibly to suggest what may happen to more of those documents if the city refuses to pay up by the payment deadline set by the extortionists &#8212; currently June 7, 2019 (the attackers postponed that deadline once already).</p>
<div id="attachment_47920" style="width: 607px" class="wp-caption aligncenter"><img class=" wp-image-47920" src="media/892b0260.robihkjn-twitter.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/06/robihkjn-twitter.jpg" alt="" width="597" height="526" /><p class="wp-caption-text">Some of @robihkjn&#8217;s tweets taunting Baltimore city leaders over non-payment of the $100,000 ransomware demand. The tweets included links to images of documents allegedly stolen by the intruders.</p></div>
<p>Over the past few days, however, the tweets from @Robinhkjn have grown more frequent and profanity-laced, directed at Baltimore&#8217;s leaders. The account also began tagging dozens of reporters and news organizations on Twitter.</p>
<p>Stewart said the @Robinhkjn Twitter account may be part of an ongoing campaign by the attackers to promote their own Robbinhood ransomware-as-a-service offering. According to Armor&#8217;s analysis, Robbinhood comes with multiple HTML templates that can be used to substitute different variables of the ransom demand, such as the ransom amount and the .onion address that victims can use to negotiate with the extortionists or pay a ransom demand.<span id="more-47916"></span></p>
<p>&#8220;We&#8217;ve come to the conclusion Robbinhood was set up to be a multi-tenant ransomware-as-a-service offering,&#8221; Stewart said. &#8220;And we&#8217;re wondering if maybe this is all an effort to raise the name recognition of the malware so the authors can then go on the Dark Web and advertise it.&#8221;</p>
<div id="attachment_47921" style="width: 609px" class="wp-caption aligncenter"><a class="lightbox" href="media/c957e9a8.robbinhood-panel.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/06/robbinhood-panel.jpg"><img class="wp-image-47921" src="media/c957e9a8.robbinhood-panel.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/06/robbinhood-panel.jpg" alt="" width="599" height="321" /></a><p class="wp-caption-text">This redacted message is present on the Dark Web panel set up by the extortionists to accept payment for the Baltimore ransomware incident and to field inquiries or pleas from them. The message repeats the last tweet from the @robihkjn Twitter account and conclusively ties that account to the attackers. Image: Armor.</p></div>
<p>There was one other potential &#8212; albeit likely intentional &#8212; clue that Stewart said he found in his analysis of the malware: Its code included the text string &#8220;Valery.&#8221; While this detail by itself is not particularly interesting, Stewart said an earlier version of the <strong>GandCrab</strong> ransomware strain would place a photo of a Russian man named <a href="https://www.linkedin.com/in/val-valery-sinyaev-235b3919/" target="_blank" rel="noopener">Valery Sinyaev</a> in every existing folder where it would encrypt files. <strong>PCRisk.com</strong>, the company that <a href="https://www.pcrisk.com/removal-guides/13841-gandcrab-504-ransomware" target="_blank" rel="noopener">blogged about this connection to the GandCrab variant</a>, asserts Mr. Sinyaev is a respectable finance professional who has nothing to do with GandCrab.</p>
<p>Finally, since we&#8217;re on the subject of major ransomware attacks and scary exploits, it&#8217;s a good time to remind readers about the importance of applying the latest security updates from Microsoft, which took the unusual step of releasing security updates for unsupported but still widely-used <strong>Windows</strong> operating systems like <strong>XP</strong> and <strong>Windows 2003. </strong>Microsoft did this to head off another WannaCry-like outbreak from mass-exploitation of a newly discovered flaw that <a href="https://krebsonsecurity.com/2019/05/microsoft-patches-wormable-flaw-in-windows-xp-7-and-windows-2003/" target="_blank" rel="noopener">Redmond called</a> imminently &#8220;wormable.&#8221;</p>
<p>That vulnerability exists in Windows XP, Windows 2003, Windows 7, Windows Server 2008 R2, and Windows Server 2008. In a reminder about the urgency of patching this bug, Microsoft on May 30 <a href="https://blogs.technet.microsoft.com/msrc/2019/05/30/a-reminder-to-update-your-systems-to-prevent-a-worm/" target="_blank" rel="noopener">published a post</a> saying while it hasn&#8217;t seen any widespread exploitation of the flaw yet, it took about two months after Microsoft released a fix for the Eternal Blue exploit in March 2017 for WannaCry to surface.</p>
<p>&#8220;Almost two months passed between the release of fixes for the EternalBlue vulnerability and when ransomware attacks began,&#8221; Microsoft warned. &#8220;Despite having nearly 60 days to patch their systems, many customers had not. A significant number of these customers were infected by the ransomware.&#8221;</p>


feed_id: https://krebsonsecurity.com/?p=47937
title: LabCorp: 7.7 Million Consumers Hit in Collections Firm Breach
uri: LabCorp-7-7-Million-Consumers-Hit-in-Collections-Firm-Breach
url: https://krebsonsecurity.com/2019/06/labcorp-7-7m-consumers-hit-in-collections-firm-breach/
content:
<p>Medical testing giant <strong>LabCorp.</strong> said today personal and financial data on some 7.7 million consumers were exposed by a breach at a third-party billing collections firm. That third party &#8212; the <strong>American Medical Collection Agency</strong> (AMCA) &#8212; also recently notified competing firm <strong>Quest Diagnostics</strong> that an intrusion in its payments Web site exposed personal, financial and medical data on nearly 12 million Quest patients.</p>
<p><img class="alignright wp-image-47952" src="media/6d0f5b1e.labcorp.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/06/labcorp.jpg" alt="" width="273" height="70" />Just a few days ago, the news was all about how Quest had suffered a major breach. But today&#8217;s disclosure by LabCorp. suggests we are nowhere near done hearing about other companies with millions of consumers victimized because of this incident: The AMCA is a New York company with a storied history of aggressively collecting debt for a broad range of businesses, including medical labs and hospitals, direct marketers, telecom companies, and state and local traffic/toll agencies.</p>
<p>In a filing today with the <strong>U.S. Securities and Exchange Commission</strong>, LabCorp. said it learned that the breach at AMCA persisted between Aug. 1, 2018 and March 30, 2019. It said the information exposed could include first and last name, date of birth, address, phone, date of service, provider, and balance information.</p>
<p>&#8220;AMCA’s affected system also included credit card or bank account information that was provided by the consumer to AMCA (for those who sought to pay their balance),&#8221; the filing reads. &#8220;LabCorp provided no ordered test, laboratory results, or diagnostic information to AMCA. AMCA has advised LabCorp that Social Security Numbers and insurance identification information are not stored or maintained for LabCorp consumers.&#8221;</p>
<p>LabCorp further said the AMCA has informed LabCorp &#8220;it is in the process of sending notices to approximately 200,000 LabCorp consumers whose credit card or bank account information may have been accessed. AMCA has not yet provided LabCorp a list of the affected LabCorp consumers or more specific information about them.&#8221;</p>
<p>The LabCorp disclosure comes just days after competing lab testing firm <strong>Quest Diagnostics</strong> <a href="https://www.nbcnewyork.com/news/local/Quest-Diagnostics-12-Million-People-Data-Breach-510754611.html" target="_blank" rel="noopener">disclosed</a> that the hack of AMCA exposed the personal, financial and medical data on approximately 11.9 million patients.</p>
<p>Quest said it first heard from the AMCA about the breach on May 14, but that it wasn&#8217;t until two weeks later that AMCA disclosed the number of patients affected and what information was accessed, which includes financial information (e.g., credit card numbers and bank account information), medical information and Social Security Numbers.</p>
<p>Quest says it has since stopped doing business with the AMCA and has hired a security firm to investigate the incident. Much like LabCorp, Quest also alleges the AMCA still hasn&#8217;t said which 11.9 million patients were impacted and that the company was withholding information about the incident.</p>
<p>The AMCA declined to comment for this story, and instead referred requests for comment to an outside PR firm. Representatives with that firm declined to answer any questions about whether the breach of the AMCA&#8217;s payment&#8217;s page impacted anyone who entered payment data into the company&#8217;s site during the breach.</p>
<p>&#8220;We are investigating a data incident involving an unauthorized user accessing the American Medical Collection Agency system,&#8221; reads a written statement attributed to the ACMA. &#8220;Upon receiving information from a security compliance firm that works with credit card companies of a possible security compromise, we conducted an internal review, and then took down our web payments page.&#8221;</p>
<p>The statement continues:</p>
<p>&#8220;We hired a third-party external forensics firm to investigate any potential security breach in our systems, migrated our web payments portal services to a third-party vendor, and retained additional experts to advise on, and implement, steps to increase our systems’ security. We have also advised law enforcement of this incident. We remain committed to our system’s security, data privacy, and the protection of personal information.&#8221;<span id="more-47937"></span></p>
<h4>ANALYSIS</h4>
<p>The AMCA also does business under the name &#8220;<strong>Retrieval-Masters Credit Bureau</strong>,&#8221; a company that has been in business since 1977. Retrieval-Masters also has an atrocious reputation for allegedly harassing consumers for debts they never owed.</p>
<p>A search on the company&#8217;s name at the complaints page of the <strong>Consumer Financial Protection Bureau</strong> (CFPB) <a href="https://www.consumerfinance.gov/data-research/consumer-complaints/search/?from=0&amp;searchField=all&amp;searchText=Retrieval%20Masters&amp;size=25&amp;sort=created_date_desc" target="_blank" rel="noopener">turns up almost 700 complaints for Retrieval-Masters</a>. The company has an abysmal &#8220;F&#8221; rating from the <strong>Better Business Bureau</strong>, with <a href="https://www.bbb.org/us/ny/elmsford/profile/collections-agencies/retrieval-masters-creditors-bureau-inc-0121-2590/complaints" target="_blank" rel="noopener">60 complaints closed against it in the last three years</a>.</p>
<p>Reviewing a number of those complaints reveals some of the AMCA&#8217;s other current and/or previous clients, including New Jersey&#8217;s <strong>EZPass</strong> system. Recent consumer complaints about the AMCA also invoke the name of <a href="https://www.atsol.com/media-center/" target="_blank" rel="noopener">American Traffic Solutions</a>, which services rental car fleets and processes some 50 million toll transactions per year. ATS did not respond to requests for comment.</p>
<p>My guess is we will soon hear about many other companies and millions more consumers impacted by this breach at the AMCA. Certainly, companies like Quest and LabCorp. have a duty to ensure contractors are properly safeguarding their patients&#8217; personal, medical and financial information.</p>
<p>But this AMCA incident is the latest example of a breach at a little-known company that nevertheless holds vast quantities of sensitive data that was being shared or stored in ways that were beyond the control of affected consumers.</p>
<p>On May 24, KrebsOnSecurity <a href="https://krebsonsecurity.com/2019/05/ny-investigates-exposure-of-885-million-mortgage-documents/" target="_blank" rel="noopener">broke the news</a> that the Web site for Fortune 500 real estate title insurance giant First American Financial [NYSE:FAF] leaked 885 million documents related to mortgage deals going back to 2003, until notified by KrebsOnSecurity. The digitized records — including bank account numbers and statements, mortgage and tax records, Social Security numbers, wire transaction receipts, and drivers license images — were available without authentication to anyone with a Web browser.</p>
<p>Many readers wrote in to say they&#8217;d never heard of First American, but it is the largest title insurance company in the United States. Title insurance is generally required for all home mortgages, and it protects the buyer from any previously unknown claims against the property. First American currently handles about one in every four title insurance transactions &#8212; usually as part of the mortgage closing process &#8212; which means tens of millions of Americans were potentially exposed by the company&#8217;s inexplicably lax security.</p>


feed_id: https://krebsonsecurity.com/?p=47982
title: Microsoft Patch Tuesday, June 2019 Edition
uri: Microsoft-Patch-Tuesday-June-2019-Edition
url: https://krebsonsecurity.com/2019/06/microsoft-patch-tuesday-june-2019-edition/
content:
<p><strong>Microsoft</strong> on Tuesday released updates to fix 88 security vulnerabilities in its <strong>Windows</strong> operating systems and related software. The most dangerous of these include four flaws for which there is already exploit code available. There&#8217;s also a scary bug affecting all versions of <strong>Microsoft Office</strong> that can be triggered by a malicious link or attachment. And of course <strong>Adobe</strong> has its customary monthly security update for <strong>Flash Player</strong>.</p>
<p><img class="alignright size-full wp-image-26837" src="media/863df0f6.brokenwindows.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2014/07/brokenwindows.png" alt="" width="229" height="240" />Microsoft says it has so far seen no exploitation against any of the four flaws that were disclosed publicly prior to their patching this week &#8212; nor against any of the 88 bugs quashed in this month&#8217;s release. All four are privilege escalation flaws: <a href="https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1064" target="_blank" rel="noopener">CVE-2019-1064</a> and <a href="https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1069" target="_blank" rel="noopener">CVE-2019-1069</a> affect <strong>Windows 10</strong> and later; <a href="https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1053" target="_blank" rel="noopener">CVE-2019-1053</a> and <a href="https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0973" target="_blank" rel="noopener">CVE-2019-0973</a> both affect all currently supported versions of Windows.</p>
<p>Most of the critical vulnerabilities &#8212; those that can be exploited by malware or miscreants to infect systems without any action on the part of the user &#8212; are present in Microsoft&#8217;s browsers <strong>Internet Explorer</strong> and <strong>Edge</strong>.</p>
<p>According to <strong>Allan Liska</strong>, senior solutions architect at <strong>Recorded Future</strong>, serious vulnerabilities in this month&#8217;s patch batch reside in <strong>Microsoft Word</strong> (<a href="https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1034" target="_blank" rel="noopener">CVE-2019-1034</a> and <a href="https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1035" target="_blank" rel="noopener">CVE-2019-1035</a>).</p>
<p>&#8220;This is another memory corruption vulnerability that requires an attacker to send a specially crafted Microsoft Word document for a victim to open, alternatively an attacker could convince a victim to click on a link to a website hosting a malicious Microsoft Word document,&#8221; Liska wrote. &#8220;This vulnerability affects all versions of Microsoft Word on Windows and Mac as well as Office 365. Given that Microsoft Word Documents are a favorite exploitation tool of cybercriminals, if this vulnerability is reverse engineered it could be widely exploited.&#8221;<span id="more-47982"></span></p>
<p>Microsoft also pushed an update to plug <a href="https://helpx.adobe.com/security/products/flash-player/apsb19-30.html" target="_blank" rel="noopener">a single critical security hole</a> in Adobe&#8217;s Flash Player software, which is waning in use but it still is a target for malware purveyors. <strong>Google Chrome </strong>auto-updates Flash but also is now making users explicitly enable Flash every time they want to use it. By the summer of 2019 Google will <a href="https://nakedsecurity.sophos.com/2018/09/03/chrome-flash-is-almost-almost-almost-dead/" target="_blank" rel="noopener">make Chrome users go into their settings to enable it</a> every time they want to run it.</p>
<p>Firefox also forces users with the Flash add-on installed to click in order to play Flash content; instructions for disabling or removing Flash from Firefox are <a href="https://support.mozilla.org/en-US/kb/disable-or-remove-add-ons" target="_blank" rel="noopener">here</a>. Adobe will stop supporting Flash at the end of 2020.</p>
<p>Note that <strong>Windows 10</strong> likes to install patches all in one go and reboot your computer on its own schedule. Microsoft doesn’t make it easy for Windows 10 users to change this setting, <a href="https://www.howtogeek.com/224471/how-to-prevent-windows-10-from-automatically-downloading-updates/" target="_blank" rel="noopener">but it is possible</a>. For all other Windows OS users, if you’d rather be alerted to new updates when they’re available so you can choose when to install them, there’s a setting for that in <strong>Windows Update</strong>. To get there, click the Windows key on your keyboard and type &#8220;windows update&#8221; into the box that pops up.</p>
<p>Staying up-to-date on Windows patches is good. Updating only after you’ve backed up your important data and files is even better. A good backup means you’re not pulling your hair out if the odd buggy patch causes problems booting the system. So do yourself a favor and backup your files before installing any patches.</p>
<p>As always, if you experience any problems installing any of the patches this month, please feel free to leave a comment about it below; there’s a good chance other readers have experienced the same and may even chime in here with some helpful tips.</p>
<p>Additional reading:</p>
<p><a href="https://www.ghacks.net/2019/06/11/microsoft-windows-security-updates-june-2019-overview/" target="_blank" rel="noopener">Martin Brinkmann&#8217;s take at Ghacks.net</a></p>
<p><a href="https://blog.qualys.com/laws-of-vulnerabilities/2019/06/11/june-2019-patch-tuesday-88-vulns-21-critical-hyper-v-escape-adobe-vulns" target="_blank" rel="noopener">Qualys on Patch Tuesday</a></p>
<p><a href="https://isc.sans.edu/forums/diary/MSFT+June+2019+Patch+Tuesday/25024/" target="_blank" rel="noopener">SANS&#8217;s quick reference by severity</a></p>


feed_id: https://krebsonsecurity.com/?p=48031
title: Collections Firm Behind LabCorp, Quest Breaches Files for Bankruptcy
uri: Collections-Firm-Behind-LabCorp-Quest-Breaches-Files-for-Bankruptcy
url:
https://krebsonsecurity.com/2019/06/collections-firm-behind-labcorp-quest-breaches-files-for-bankruptcy/

content:
<p>A medical billing firm responsible for a recent eight-month data breach that exposed the personal information on nearly 20 million Americans has filed for bankruptcy, citing &#8220;enormous expenses&#8221; from notifying affected consumers and the loss of its four largest customers.</p>
<p>The filing, first reported by Bloomberg, comes from the <a href="https://www.consumerfinance.gov/data-research/consumer-complaints/search/?from=0&amp;searchField=all&amp;searchText=Retrieval%20Masters&amp;size=25&amp;sort=created_date_desc" target="_blank" rel="noopener">Retrieval-Masters Creditors Bureau</a>, the parent company of the <strong>American Medical Collection Agency </strong>(AMCA). Earlier this month, medical testing firm <strong>Quest Diagnostics</strong> said a breach at the AMCA between Aug. 1, 2018 and March 30, 2019 led to the theft of personal and medical information on 11.9 million patients.</p>
<p><img class="aligncenter wp-image-48036" src="media/02e28a1e.rmcb.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/06/rmcb.jpg" alt="" width="585" height="120" /></p>
<p>On June 4, KrebsOnSecurity <a href="https://krebsonsecurity.com/2019/06/labcorp-7-7m-consumers-hit-in-collections-firm-breach/" target="_blank" rel="noopener">broke the news</a> that another major AMCA client &#8212; <strong>LabCorp</strong> &#8212; was blaming the company for a breach affecting 7.7 million of its patients.</p>
<p>According to a bankruptcy filing, LabCorp and Quest Diagnostics both stopped sending the AMCA business after the breach disclosure, as did the AMCA&#8217;s two other biggest customers &#8212; <strong>Conduent Inc.</strong> and <strong>CareCentrix Inc.</strong></p>
<p>Bloomberg reports the data breach created a &#8220;cascade of events,&#8221; which incurred &#8220;enormous expenses that were beyond the ability of the debtor to bear.&#8221;</p>
<p>&#8220;Those expenses included more than $3.8 million spent on mailing more than 7 million individual notices to people whose information had been potentially hacked,&#8221; <a href="https://www.bloomberg.com/news/articles/2019-06-17/american-medical-collection-agency-parent-files-for-bankruptcy" target="_blank" rel="noopener">wrote</a> <strong>Jeremy Hill</strong>. Retrieval Masters <strong>CEO Russell H. Fuchs</strong> &#8220;personally lent the company $2.5 million to help pay for those mailings, he said in the declaration. In addition, IT professionals and consultants hired in connection with the breach had cost Retrieval-Masters about $400,000 by the time of the filing.&#8221;</p>
<p>Retrieval Masters said it learned of the breach after a significant number of credit cards people used to pay their outstanding medical bills via the company&#8217;s site ended up with fraud charges on them soon after. The company also reportedly slashed its staff from 113 to 25 at the end of 2018.</p>
<p>The bankruptcy filing may also be something of a preemptive strike: Retrieval-Masters is already facing at least three class-action lawsuits from plaintiffs in New York and California.</p>
<p>A copy of the bankruptcy filing is available <a href="media/4b236311.RMCB-bank.pdf" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/06/RMCB-bank.pdf" target="_blank" rel="noopener">here</a> (PDF).</p>


feed_id: https://krebsonsecurity.com/?p=47962
title: Tracing the Supply Chain Attack on Android
uri: Tracing-the-Supply-Chain-Attack-on-Android
url: https://krebsonsecurity.com/2019/06/tracing-the-supply-chain-attack-on-android/
content:
<p>Earlier this month, <strong>Google</strong> <a href="https://security.googleblog.com/2019/06/pha-family-highlights-triada.html" target="_blank" rel="noopener">disclosed</a> that a supply chain attack by one of its vendors resulted in malicious software being pre-installed on millions of new budget Android devices. Google didn&#8217;t exactly name those responsible, but said it believes the offending vendor uses the nicknames &#8220;<strong>Yehuo</strong>&#8221; or &#8220;<strong>Blazefire</strong>.&#8221; What follows is a deep dive into the identity of that Chinese vendor, which appears to have a long and storied history of pushing the envelope on mobile malware.</p>
<p><img class="aligncenter wp-image-47972" src="media/1e135e27.googgraphic.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/06/googgraphic.jpg" alt="" width="594" height="281" /></p>
<p>&#8220;Yehuo&#8221; (<a href="https://chinese.yabla.com/chinese-english-pinyin-dictionary.php?define=%E9%87%8E" data-ss1561470531="1">野</a><a href="https://chinese.yabla.com/chinese-english-pinyin-dictionary.php?define=%E7%81%AB" data-ss1561470531="1">火</a>) is Mandarin for &#8220;<strong>wildfire</strong>,&#8221; so one might be forgiven for concluding that Google was perhaps using another dictionary than most Mandarin speakers. But Google was probably just being coy: The vendor in question appears to have used both &#8220;blazefire&#8221; and &#8220;wildfire&#8221; in two of many corporate names adopted for the same entity.</p>
<p>An online search for the term &#8220;yehuo&#8221; reveals an account on the <strong>Chinese Software Developer Network</strong> which uses that same nickname and references the domain <strong>blazefire[.]com</strong>. More searching points to a Yehuo user on <strong>gamerbbs[.]cn</strong> who advertises a mobile game called &#8220;Xiaojun Junji,&#8221; and says the game is available at blazefire[.]com.</p>
<p>Research on blazefire[.]com via <a href="https://www.domaintools.com" target="_blank" rel="noopener">Domaintools.com</a> shows the domain was assigned in 2015 to a company called &#8220;<strong>Shanghai Blazefire Network Technology Co. Ltd.</strong>&#8221; just a short time after it was registered by someone using the email address &#8220;<strong>tosaka1027@gmail.com</strong>&#8220;.</p>
<p>The Shanghai Blazefire Network is part of a group of similarly-named Chinese entities in the &#8220;mobile phone pre-installation business and in marketing for advertisers&#8217; products to install services through mobile phone installed software.&#8221;</p>
<p>&#8220;At present, pre-installed partners cover the entire mobile phone industry chain, including mobile phone chip manufacturers, mobile phone design companies, mobile phone brand manufacturers, mobile phone agents, mobile terminal stores and major e-commerce platforms,&#8221; reads a descriptive blurb about the company.</p>
<p>A historic records search at Domaintools on that tosaka1027@gmail.com address says it was used <a href="https://krebsonsecurity.com/wp-content/uploads/2019/06/reverse-on-tosaka.txt" target="_blank" rel="noopener">to register 24 Internet domain names</a>, including at least seven that have been conclusively tied to the spread of powerful Android mobile malware.</p>
<p>Two of those domains registered to tosaka1027@gmail.com &#8212; <a href="https://blog.angelalonso.es/2016/03/triada-malware-hitting-android-core_22.html" target="_blank" rel="noopener">elsyzsmc[.]com and rurimeter[.]com</a> &#8212; were implicated in propagating the <a href="https://www.kaspersky.com/blog/triada-trojan/11481/" target="_blank" rel="noopener">Triada malware</a>. Triada is the very same malicious software Google said was found pre-installed on many of its devices and being used to install spam apps that display ads.</p>
<p>In July 2017, Russian antivirus vendor <strong>Dr.Web</strong> <a href="https://news.drweb.com/show/?i=11390&amp;lng=en" target="_blank" rel="noopener">published research</a> showing that Triada had been installed by default on at least four low-cost Android models. In 2018, Dr.Web <a href="https://www.bleepingcomputer.com/news/security/banking-trojan-found-in-over-40-models-of-low-cost-android-smartphones/" target="_blank" rel="noopener">expanded its research</a> when it discovered the Triada malware installed on 40 different models of Android devices.</p>
<p>At least another five of the domains registered to tosaka1027@gmail.com &#8212; <a href="media/8bc3cfe7.HummerTrojan-IOCs.pdf" data-original-source="https://blog.zimperium.com/wp-content/uploads/2016/08/HummerTrojan-IOCs.pdf" target="_blank" rel="noopener">99youx[.]com</a>, <a href="media/8bc3cfe7.HummerTrojan-IOCs.pdf" data-original-source="https://blog.zimperium.com/wp-content/uploads/2016/08/HummerTrojan-IOCs.pdf" target="_blank" rel="noopener">buydudu[.]com</a>, <a href="https://www.reverse.it/sample/d6f8bf6b55aa81aa6ca549081faf3153d06fef794656a384c5ee0ac2187efda7?environmentId=100" target="_blank" rel="noopener">kelisrim[.]com</a>, <a href="https://www.virustotal.com/gui/file/3b548b5aa8f071a02738c180b915af337d5296e422f779dbe81d215e75df951a/detection3b548b5aa8f071a02738c180b915af337d5296e422f779dbe81d215e75df951a" target="_blank" rel="noopener">opnixi[.]com</a> and <a href="media/8bc3cfe7.HummerTrojan-IOCs.pdf" data-original-source="https://blog.zimperium.com/wp-content/uploads/2016/08/HummerTrojan-IOCs.pdf" target="_blank" rel="noopener">sonyba[.]com</a> &#8212; <a href="https://www.cmcm.com/blog/en/security/2016-06-29/995.html" target="_blank" rel="noopener">were seen as early as 2016 as distribution points for the Hummer Trojan</a>, a potent strain of Android malware often bundled with games that completely compromises the infected device.<span id="more-47962"></span></p>
<p>A records search at Domaintools for &#8220;Shanghai Blazefire Network Technology Co&#8221; returns 11 domains, including blazefire[.]net, which is registered to a <strong>yehuo@blazefire.net</strong>. For the remainder of this post, we&#8217;ll focus on the bolded domain names below:</p>
<p>Domain Name      Create Date   Registrar<br />
<strong>2333youxi[.]com</strong> 2016-02-18 ALIBABA CLOUD COMPUTING (BEIJING) CO., LTD<br />
52gzone[.]com 2012-11-26 ALIBABA CLOUD COMPUTING (BEIJING) CO., LTD<br />
91gzonep[.]com 2012-11-26 ALIBABA CLOUD COMPUTING (BEIJING) CO., LTD<br />
<strong>blazefire[.]com</strong> 2000-08-24 ALIBABA CLOUD COMPUTING (BEIJING) CO., LTD<br />
<strong>blazefire[.]net</strong> 2010-11-22 ALIBABA CLOUD COMPUTING (BEIJING) CO., LTD<br />
<strong>hsuheng[.]com</strong> 2015-03-09 GODADDY.COM, LLC<br />
jyhxz.net 2013-07-02 &#8212;<br />
<strong>longmen[.]com</strong> 1998-06-19 GODADDY.COM, LLC<br />
longmenbiaoju[.]com 2012-12-09 ALIBABA CLOUD COMPUTING (BEIJING) CO., LTD<br />
oppayment[.]com 2013-10-09 ALIBABA CLOUD COMPUTING (BEIJING) CO., LTD<br />
<strong>tongjue[.]net</strong> 2014-01-20 ALIBABA CLOUD COMPUTING (BEIJING) CO., LTD</p>
<p>Following the breadcrumbs from some of the above domains we can see that &#8220;Blazefire&#8221; is a sprawling entity with multiple business units and names. For example, <strong>2333youxi[.]com</strong> is the domain name for <strong>Shanghai Qianyou Network Technology Co., Ltd.</strong>, a firm that says it is &#8220;dedicated to the development and operation of Internet mobile games.&#8221;</p>
<p>Like the domain blazefire[.]com, 2333youxi[.]com also was initially registered to tosaka1027@gmail.com and soon changed to Shanghai Blazefire as the owner.</p>
<p>The offices of Shanghai Quianyou Network &#8212; at Room 344, 6th Floor, Building 10, No. 196, Ouyang Rd, Shanghai, China &#8212; are just down the hall from <strong>Shanghai Wildfire Network Technology Co., Ltd., </strong>reportedly at Room 35, 6th Floor, Building 10, No. 196, Ouyang Rd, Shanghai.</p>
<p>The domain tongjue[.]net is the Web site for <strong>Shanghai Bronze Network Technology Co., Ltd.</strong>, which appears to be either another name for or a sister company to <strong>Shanghai Tongjue Network Technology Co., Ltd.</strong>  According to its marketing literature, Shanghai Tongjue is situated one door down from the above-mentioned Shanghai Quianyou Network &#8212; at Room 36, 6th Floor, Building 10, No. 196, Ouyang Road.</p>
<p><a class="lightbox" href="media/dafb5584.tongjue-dot-net.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/06/tongjue-dot-net.jpg"><img class="aligncenter wp-image-47975" src="media/dafb5584.tongjue-dot-net.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/06/tongjue-dot-net.jpg" alt="" width="595" height="453" /></a></p>
<p>&#8220;It has developed into a large domestic wireless Internet network application,&#8221; reads a help wanted ad published by Tongjue in 2016.  &#8220;The company is mainly engaged in mobile phone pre-installation business.&#8221;</p>
<p>That particular help wanted ad was for a &#8220;client software development&#8221; role at Tongjue. The ad said the ideal candidate for the position would have experience with &#8220;Windows Trojan, Virus or Game Plug-ins.&#8221; Among the responsibilities for this position were:</p>
<p>-Crack the restrictions imposed by the manufacturer on the mobile phone.<br />
-Research and master the android [operating] system<br />
-Reverse the root software to study the root of the android mobile phone<br />
-Research the anti-brushing and provide anti-reverse brushing scheme</p>
<h4>WHO IS BLAZEFIRE/YEHUO?</h4>
<p>Many of the domains mentioned above have somewhere in their registration history the name &#8220;Hsu Heng&#8221; and the email address yehuo@blazefire.net. Based on an analysis via cyber intelligence firm <a href="https://www.4iq.com" target="_blank" rel="noopener">4iq.com</a> of passwords and email addresses exposed in multiple data breaches in years past, the head of Blazefire goes by the nickname &#8220;Hagen&#8221; or &#8220;Haagen&#8221; and uses the email &#8220;<strong>chuda@blazefire.net</strong>&#8220;.</p>
<p>Searching on the phrase &#8220;chuda&#8221; in Mandarin turns up <a href="http://www.youxiguancha.com/chuangyeguanli/24454.html" target="_blank" rel="noopener">a 2016 story</a> at the Chinese gaming industry news site Youxiguancha.com that features numerous photos of Blazefire employees and their offices. That story also refers to the co-founder and CEO of Blazefire variously as &#8220;Chuda&#8221; and &#8220;Chu da&#8221;.</p>
<p>&#8220;Wildfire CEO Chuda is a tear-resistant boss with both sports (Barcelona hardcore fans) and literary genre (playing a good guitar),&#8221; the story gushes. &#8220;With the performance of leading the wildfire team and the wildfire product line in 2015, Chu has won the top ten new CEO awards from the first Black Rock Award of the Hardcore Alliance.&#8221;</p>
<p>Interestingly, the registrant name &#8220;Chu Da&#8221; shows up in the historical domain name records for <a href="https://web.archive.org/web/20160325045051/http://www.longmen.com/" target="_blank" rel="noopener">longmen[.]com</a>, perhaps Shanghai Wildfire&#8217;s oldest and most successful mobile game ever. That record, from April 2015, lists Chu Da&#8217;s email address as yehuo@blazefire.com.</p>
<div id="attachment_47969" style="width: 579px" class="wp-caption aligncenter"><img class="wp-image-47969 size-full" src="media/b1d9612a.chuda.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/06/chuda.jpg" alt="" width="569" height="374" /><p class="wp-caption-text">The CEO of Wildfire/Blazefire, referred to only as &#8220;Chuda&#8221; or &#8220;Hagen.&#8221;</p></div>
<p>It&#8217;s not clear if Chuda is all or part of the CEO&#8217;s real name, or just a nickname; the vice president of the company lists their name simply as &#8220;Hua Wei,&#8221; which could be a real name or a pseudonymous nod to the <a href="https://www.cnbc.com/2019/06/07/pentagon-huawei-is-too-close-to-the-government.html" target="_blank" rel="noopener">embattled Chinese telecom giant by the same name</a>.</p>
<p>According to <a href="https://webcache.googleusercontent.com/search?q=cache:W7Xcals_ElYJ:https://www.tianyancha.com/human/2023620582-c3223835591+&amp;cd=18&amp;hl=en&amp;ct=clnk&amp;gl=us" target="_blank" rel="noopener">this cached document from Chinese business lookup service TianYanCha.com</a>, Chuda also is a senior executive at six other companies.</p>
<p>Google declined to elaborate on its blog post. Shanghai Wildfire did not respond to multiple requests for comment.</p>
<p>It&#8217;s perhaps worth noting that while Google may be wise to what&#8217;s cooking over at Shanghai Blazefire/Wildfire Network Technology Co., Apple <a href="https://itunes.apple.com/cn/developer//id848782271?mt=8" target="_blank" rel="noopener">still has several of the company&#8217;s apps available for download from the iTunes store</a>, as well as <a href="https://itunes.apple.com/us/developer/shanghai-qianyou-network-technology-co-ltd/id1120623601" target="_blank" rel="noopener">others from Shanghai Qianyou Network Technology</a>.</p>


feed_id: https://krebsonsecurity.com/?p=48061
title: Tracing the Supply Chain Attack on Android
uri: 2019-06-25-Tracing-the-Supply-Chain-Attack-on-Android
url: https://krebsonsecurity.com/2019/06/tracing-the-supply-chain-attack-on-android-2/
content:
<p>Earlier this month, <strong>Google</strong> <a href="https://security.googleblog.com/2019/06/pha-family-highlights-triada.html" target="_blank" rel="noopener">disclosed</a> that a supply chain attack by one of its vendors resulted in malicious software being pre-installed on millions of new budget Android devices. Google didn&#8217;t exactly name those responsible, but said it believes the offending vendor uses the nicknames &#8220;<strong>Yehuo</strong>&#8221; or &#8220;<strong>Blazefire</strong>.&#8221; What follows is a deep dive into the identity of that Chinese vendor, which appears to have a long and storied history of pushing the envelope on mobile malware.</p>
<p><img class="aligncenter wp-image-47972" src="media/1e135e27.googgraphic.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/06/googgraphic.jpg" alt="" width="594" height="281" /></p>
<p>&#8220;Yehuo&#8221; (<a href="https://chinese.yabla.com/chinese-english-pinyin-dictionary.php?define=%E9%87%8E" data-ss1561470531="1">野</a><a href="https://chinese.yabla.com/chinese-english-pinyin-dictionary.php?define=%E7%81%AB" data-ss1561470531="1">火</a>) is Mandarin for &#8220;<strong>wildfire</strong>,&#8221; so one might be forgiven for concluding that Google was perhaps using another dictionary than most Mandarin speakers. But Google was probably just being coy: The vendor in question appears to have used both &#8220;blazefire&#8221; and &#8220;wildfire&#8221; in two of many corporate names adopted for the same entity.</p>
<p>An online search for the term &#8220;yehuo&#8221; reveals an account on the <strong>Chinese Software Developer Network</strong> which uses that same nickname and references the domain <strong>blazefire[.]com</strong>. More searching points to a Yehuo user on <strong>gamerbbs[.]cn</strong> who advertises a mobile game called &#8220;Xiaojun Junji,&#8221; and says the game is available at blazefire[.]com.</p>
<p>Research on blazefire[.]com via <a href="https://www.domaintools.com" target="_blank" rel="noopener">Domaintools.com</a> shows the domain was assigned in 2015 to a company called &#8220;<strong>Shanghai Blazefire Network Technology Co. Ltd.</strong>&#8221; just a short time after it was registered by someone using the email address &#8220;<strong>tosaka1027@gmail.com</strong>&#8220;.</p>
<p>The Shanghai Blazefire Network is part of a group of similarly-named Chinese entities in the &#8220;mobile phone pre-installation business and in marketing for advertisers&#8217; products to install services through mobile phone installed software.&#8221;</p>
<p>&#8220;At present, pre-installed partners cover the entire mobile phone industry chain, including mobile phone chip manufacturers, mobile phone design companies, mobile phone brand manufacturers, mobile phone agents, mobile terminal stores and major e-commerce platforms,&#8221; reads a descriptive blurb about the company.</p>
<p>A historic records search at Domaintools on that tosaka1027@gmail.com address says it was used <a href="https://krebsonsecurity.com/wp-content/uploads/2019/06/reverse-on-tosaka.txt" target="_blank" rel="noopener">to register 24 Internet domain names</a>, including at least seven that have been conclusively tied to the spread of powerful Android mobile malware.</p>
<p>Two of those domains registered to tosaka1027@gmail.com &#8212; <a href="https://blog.angelalonso.es/2016/03/triada-malware-hitting-android-core_22.html" target="_blank" rel="noopener">elsyzsmc[.]com and rurimeter[.]com</a> &#8212; were implicated in propagating the <a href="https://www.kaspersky.com/blog/triada-trojan/11481/" target="_blank" rel="noopener">Triada malware</a>. Triada is the very same malicious software Google said was found pre-installed on many of its devices and being used to install spam apps that display ads.</p>
<p>In July 2017, Russian antivirus vendor <strong>Dr.Web</strong> <a href="https://news.drweb.com/show/?i=11390&amp;lng=en" target="_blank" rel="noopener">published research</a> showing that Triada had been installed by default on at least four low-cost Android models. In 2018, Dr.Web <a href="https://www.bleepingcomputer.com/news/security/banking-trojan-found-in-over-40-models-of-low-cost-android-smartphones/" target="_blank" rel="noopener">expanded its research</a> when it discovered the Triada malware installed on 40 different models of Android devices.</p>
<p>At least another five of the domains registered to tosaka1027@gmail.com &#8212; <a href="media/8bc3cfe7.HummerTrojan-IOCs.pdf" data-original-source="https://blog.zimperium.com/wp-content/uploads/2016/08/HummerTrojan-IOCs.pdf" target="_blank" rel="noopener">99youx[.]com</a>, <a href="media/8bc3cfe7.HummerTrojan-IOCs.pdf" data-original-source="https://blog.zimperium.com/wp-content/uploads/2016/08/HummerTrojan-IOCs.pdf" target="_blank" rel="noopener">buydudu[.]com</a>, <a href="https://www.reverse.it/sample/d6f8bf6b55aa81aa6ca549081faf3153d06fef794656a384c5ee0ac2187efda7?environmentId=100" target="_blank" rel="noopener">kelisrim[.]com</a>, <a href="https://www.virustotal.com/gui/file/3b548b5aa8f071a02738c180b915af337d5296e422f779dbe81d215e75df951a/detection3b548b5aa8f071a02738c180b915af337d5296e422f779dbe81d215e75df951a" target="_blank" rel="noopener">opnixi[.]com</a> and <a href="media/8bc3cfe7.HummerTrojan-IOCs.pdf" data-original-source="https://blog.zimperium.com/wp-content/uploads/2016/08/HummerTrojan-IOCs.pdf" target="_blank" rel="noopener">sonyba[.]com</a> &#8212; <a href="https://www.cmcm.com/blog/en/security/2016-06-29/995.html" target="_blank" rel="noopener">were seen as early as 2016 as distribution points for the Hummer Trojan</a>, a potent strain of Android malware often bundled with games that completely compromises the infected device.<span id="more-48061"></span></p>
<p>A records search at Domaintools for &#8220;Shanghai Blazefire Network Technology Co&#8221; returns 11 domains, including blazefire[.]net, which is registered to a <strong>yehuo@blazefire.net</strong>. For the remainder of this post, we&#8217;ll focus on the bolded domain names below:</p>
<p>Domain Name      Create Date   Registrar<br />
<strong>2333youxi[.]com</strong> 2016-02-18 ALIBABA CLOUD COMPUTING (BEIJING) CO., LTD<br />
52gzone[.]com 2012-11-26 ALIBABA CLOUD COMPUTING (BEIJING) CO., LTD<br />
91gzonep[.]com 2012-11-26 ALIBABA CLOUD COMPUTING (BEIJING) CO., LTD<br />
<strong>blazefire[.]com</strong> 2000-08-24 ALIBABA CLOUD COMPUTING (BEIJING) CO., LTD<br />
<strong>blazefire[.]net</strong> 2010-11-22 ALIBABA CLOUD COMPUTING (BEIJING) CO., LTD<br />
<strong>hsuheng[.]com</strong> 2015-03-09 GODADDY.COM, LLC<br />
jyhxz.net 2013-07-02 &#8212;<br />
<strong>longmen[.]com</strong> 1998-06-19 GODADDY.COM, LLC<br />
longmenbiaoju[.]com 2012-12-09 ALIBABA CLOUD COMPUTING (BEIJING) CO., LTD<br />
oppayment[.]com 2013-10-09 ALIBABA CLOUD COMPUTING (BEIJING) CO., LTD<br />
<strong>tongjue[.]net</strong> 2014-01-20 ALIBABA CLOUD COMPUTING (BEIJING) CO., LTD</p>
<p>Following the breadcrumbs from some of the above domains we can see that &#8220;Blazefire&#8221; is a sprawling entity with multiple business units and names. For example, <strong>2333youxi[.]com</strong> is the domain name for <strong>Shanghai Qianyou Network Technology Co., Ltd.</strong>, a firm that says it is &#8220;dedicated to the development and operation of Internet mobile games.&#8221;</p>
<p>Like the domain blazefire[.]com, 2333youxi[.]com also was initially registered to tosaka1027@gmail.com and soon changed to Shanghai Blazefire as the owner.</p>
<p>The offices of Shanghai Quianyou Network &#8212; at Room 344, 6th Floor, Building 10, No. 196, Ouyang Rd, Shanghai, China &#8212; are just down the hall from <strong>Shanghai Wildfire Network Technology Co., Ltd., </strong>reportedly at Room 35, 6th Floor, Building 10, No. 196, Ouyang Rd, Shanghai.</p>
<p>The domain tongjue[.]net is the Web site for <strong>Shanghai Bronze Network Technology Co., Ltd.</strong>, which appears to be either another name for or a sister company to <strong>Shanghai Tongjue Network Technology Co., Ltd.</strong>  According to its marketing literature, Shanghai Tongjue is situated one door down from the above-mentioned Shanghai Quianyou Network &#8212; at Room 36, 6th Floor, Building 10, No. 196, Ouyang Road.</p>
<p><a class="lightbox" href="media/dafb5584.tongjue-dot-net.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/06/tongjue-dot-net.jpg"><img class="aligncenter wp-image-47975" src="media/dafb5584.tongjue-dot-net.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/06/tongjue-dot-net.jpg" alt="" width="595" height="453" /></a></p>
<p>&#8220;It has developed into a large domestic wireless Internet network application,&#8221; reads a help wanted ad published by Tongjue in 2016.  &#8220;The company is mainly engaged in mobile phone pre-installation business.&#8221;</p>
<p>That particular help wanted ad was for a &#8220;client software development&#8221; role at Tongjue. The ad said the ideal candidate for the position would have experience with &#8220;Windows Trojan, Virus or Game Plug-ins.&#8221; Among the responsibilities for this position were:</p>
<p>-Crack the restrictions imposed by the manufacturer on the mobile phone.<br />
-Research and master the android [operating] system<br />
-Reverse the root software to study the root of the android mobile phone<br />
-Research the anti-brushing and provide anti-reverse brushing scheme</p>
<h4>WHO IS BLAZEFIRE/YEHUO?</h4>
<p>Many of the domains mentioned above have somewhere in their registration history the name &#8220;Hsu Heng&#8221; and the email address yehuo@blazefire.net. Based on an analysis via cyber intelligence firm <a href="https://www.4iq.com" target="_blank" rel="noopener">4iq.com</a> of passwords and email addresses exposed in multiple data breaches in years past, the head of Blazefire goes by the nickname &#8220;Hagen&#8221; or &#8220;Haagen&#8221; and uses the email &#8220;<strong>chuda@blazefire.net</strong>&#8220;.</p>
<p>Searching on the phrase &#8220;chuda&#8221; in Mandarin turns up <a href="http://www.youxiguancha.com/chuangyeguanli/24454.html" target="_blank" rel="noopener">a 2016 story</a> at the Chinese gaming industry news site Youxiguancha.com that features numerous photos of Blazefire employees and their offices. That story also refers to the co-founder and CEO of Blazefire variously as &#8220;Chuda&#8221; and &#8220;Chu da&#8221;.</p>
<p>&#8220;Wildfire CEO Chuda is a tear-resistant boss with both sports (Barcelona hardcore fans) and literary genre (playing a good guitar),&#8221; the story gushes. &#8220;With the performance of leading the wildfire team and the wildfire product line in 2015, Chu has won the top ten new CEO awards from the first Black Rock Award of the Hardcore Alliance.&#8221;</p>
<p>Interestingly, the registrant name &#8220;Chu Da&#8221; shows up in the historical domain name records for <a href="https://web.archive.org/web/20160325045051/http://www.longmen.com/" target="_blank" rel="noopener">longmen[.]com</a>, perhaps Shanghai Wildfire&#8217;s oldest and most successful mobile game ever. That record, from April 2015, lists Chu Da&#8217;s email address as yehuo@blazefire.com.</p>
<div id="attachment_47969" style="width: 579px" class="wp-caption aligncenter"><img class="wp-image-47969 size-full" src="media/b1d9612a.chuda.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/06/chuda.jpg" alt="" width="569" height="374" /><p class="wp-caption-text">The CEO of Wildfire/Blazefire, referred to only as &#8220;Chuda&#8221; or &#8220;Hagen.&#8221;</p></div>
<p>It&#8217;s not clear if Chuda is all or part of the CEO&#8217;s real name, or just a nickname; the vice president of the company lists their name simply as &#8220;Hua Wei,&#8221; which could be a real name or a pseudonymous nod to the <a href="https://www.cnbc.com/2019/06/07/pentagon-huawei-is-too-close-to-the-government.html" target="_blank" rel="noopener">embattled Chinese telecom giant by the same name</a>.</p>
<p>According to <a href="https://webcache.googleusercontent.com/search?q=cache:W7Xcals_ElYJ:https://www.tianyancha.com/human/2023620582-c3223835591+&amp;cd=18&amp;hl=en&amp;ct=clnk&amp;gl=us" target="_blank" rel="noopener">this cached document from Chinese business lookup service TianYanCha.com</a>, Chuda also is a senior executive at six other companies.</p>
<p>Google declined to elaborate on its blog post. Shanghai Wildfire did not respond to multiple requests for comment.</p>
<p>It&#8217;s perhaps worth noting that while Google may be wise to what&#8217;s cooking over at Shanghai Blazefire/Wildfire Network Technology Co., Apple <a href="https://itunes.apple.com/cn/developer//id848782271?mt=8" target="_blank" rel="noopener">still has several of the company&#8217;s apps available for download from the iTunes store</a>, as well as <a href="https://itunes.apple.com/us/developer/shanghai-qianyou-network-technology-co-ltd/id1120623601" target="_blank" rel="noopener">others from Shanghai Qianyou Network Technology</a>.</p>


feed_id: https://krebsonsecurity.com/?p=48069
title: Breach at Cloud Solution Provider PCM Inc.
uri: Breach-at-Cloud-Solution-Provider-PCM-Inc
url: https://krebsonsecurity.com/2019/06/breach-at-cloud-solution-provider-pcm-inc/
content:
<p>A digital intrusion at <strong>PCM Inc.</strong>, a major U.S.-based cloud solution provider, allowed hackers to access email and file sharing systems for some of the company&#8217;s clients, KrebsOnSecurity has learned.</p>
<p>El Segundo, Calif. based <a href="http://www.pcm.com/home" target="_blank" rel="noopener">PCM</a> [<a href="https://www.nasdaq.com/symbol/pcmi" target="_blank" rel="noopener">NASDAQ:PCMI</a>] is a provider of technology products, services and solutions to businesses as well as state and federal governments. PCM has nearly 4,000 employees, more than 2,000 customers, and generated approximately $2.2 billion in revenue in 2018.</p>
<p><img class="aligncenter wp-image-48073" src="media/a2d02d36.pcm.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/06/pcm.jpg" alt="" width="590" height="355" /></p>
<p>Sources say PCM discovered the intrusion in mid-May 2019. Those sources say the attackers stole administrative credentials that PCM uses to manage client accounts within <strong>Office 365</strong>, a cloud-based file and email sharing service run by <strong>Microsoft Corp</strong>.</p>
<p>One security expert at a PCM customer who was recently notified about the incident said the intruders appeared primarily interested in stealing information that could be used to conduct gift card fraud at various retailers and financial institutions.</p>
<p>In that respect, the motivations of the attackers seem similar to the goals of intruders <a href="https://krebsonsecurity.com/2019/04/experts-breach-at-it-outsourcing-giant-wipro/" target="_blank" rel="noopener">who breached Indian IT outsourcing giant Wipro Ltd.</a> earlier this year. In April, KrebsOnSecurity broke the news that the Wipro intruders appeared to be after anything they could quickly turn into cash, and used their access <a href="https://krebsonsecurity.com/2019/04/how-not-to-acknowledge-a-data-breach/" target="_blank" rel="noopener">to harvest gift card information from a number of the company&#8217;s customers.</a></p>
<p>It&#8217;s unclear whether PCM was a follow-on victim from the Wipro breach, or if it was attacked separately. As noted in that April story, PCM was one of the companies targeted by the same hacking group that compromised Wipro.<span id="more-48069"></span></p>
<p>The intruders who hacked into Wipro set up a number of domains that appeared visually similar to that of Wipro customers, and many of those customers responded to the April Wipro breach story with additional information about those attacks.</p>
<p>PCM never did respond to requests for comment on that story. But in a statement shared with KrebsOnSecurity today, PCM said the company &#8220;recently experienced a cyber incident that impacted certain of its systems.&#8221;</p>
<p>&#8220;From its investigation, impact to its systems was limited and the matter has been remediated,&#8221; the statement reads. &#8220;The incident did not impact all of PCM customers; in fact, investigation has revealed minimal-to-no impact to PCM customers. To the extent any PCM customers were potentially impacted by the incident, those PCM customers have been made aware of the incident and PCM worked with them to address any concerns they had.&#8221;</p>
<p>On June 24, <a href="https://www.businesswire.com/news/home/20190624005168/en/Insight-Enterprises-Acquire-PCM" target="_blank" rel="noopener">PCM announced</a> it was in the process of being acquired by global IT provider <strong>Insight Enterprises</strong> [NASDAQ:NSIT]. Insight has not yet responded to requests for comment.</p>
<p>Earlier this week, cyber intelligence firm <strong>RiskIQ</strong> published <a href="https://www.riskiq.com/research/gift-cardsharks/" target="_blank" rel="noopener">a lengthy analysis</a> of the hacking group that targeted Wipro, among many other companies. RiskIQ says this group has been active since at least 2016, and posits that the hackers may be targeting gift card providers because they provide access to liquid assets outside of the traditional western financial system.</p>
<p>The breach at PCM is just the latest example of how cybercriminals increasingly are targeting employees who work at cloud data providers and technology consultancies that manage vast IT resources for many clients. On Wednesday, Reuters published a lengthy story on &#8220;<a href="https://www.reuters.com/investigates/special-report/china-cyber-cloudhopper/" target="_blank" rel="noopener">Cloud Hopper</a>,&#8221; the nickname given to a network of Chinese cyber spies that hacked into eight of the world&#8217;s biggest IT suppliers between 2014 and 2017.</p>


feed_id: https://krebsonsecurity.com/?p=48089
title: Microsoft to Require Multi-Factor Authentication for Cloud Solution Providers
uri: Microsoft-to-Require-Multi-Factor-Authentication-for-Cloud-Solution-Pr
url:
https://krebsonsecurity.com/2019/06/microsoft-to-require-multi-factor-authentication-for-cloud-solution-providers/

content:
<p>It might be difficult to fathom how this isn&#8217;t already mandatory, but <strong>Microsoft Corp.</strong> says it will soon force all Cloud Solution Providers (CSPs) that help companies manage their <strong>Office365</strong> accounts to use multi-factor authentication. The move comes amid a noticeable uptick in phishing and malware attacks targeting CSP employees and contractors.</p>
<p><img class="aligncenter size-full wp-image-48090" src="media/52678f94.cloudrain.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/06/cloudrain.jpg" alt="" width="596" height="373" /></p>
<p>When an organization buys Office365 licenses from a reseller partner, the partner is granted administrative privileges in order to help the organization set up the tenant and establish the initial administrator account. Microsoft says customers can remove that administrative access if they don&#8217;t want or need the partner to have access after the initial setup.</p>
<p>But many companies partner with a CSP simply to gain more favorable pricing on software licenses &#8212; not necessarily to have someone help manage their Azure/O365 systems. And those entities are more likely to be unaware that just by virtue of that partnership they are giving someone at their CSP (or perhaps even outside contractors working for the CSP) full access to all of their organization&#8217;s email and files stored in the cloud.</p>
<p>This is exactly what happened with a company whose email systems were <a href="https://krebsonsecurity.com/2019/06/breach-at-cloud-solution-provider-pcm-inc/" target="_blank" rel="noopener">rifled through by intruders who broke into PCM Inc.</a>, the world&#8217;s sixth-largest CSP. The firm had partnered with PCM because doing so was far cheaper than simply purchasing licenses directly from Microsoft, but its security team was unaware that a PCM employee or contractor maintained full access to all of their employees&#8217;email and documents in Office365.</p>
<p>As it happened, the PCM employee was not using multi-factor authentication. And when that PCM employee&#8217;s account got hacked, so too did many other PCM customers.</p>
<p>KrebsOnSecurity pinged Microsoft this week to inquire whether there was anything the company could be doing to better explain this risk to customers and CSP partners. In response, Microsoft said while its guidance has always been for partners to enable and require multi-factor authentication for all administrators or agent users in the partner tenants, it would soon be making it mandatory.<span id="more-48089"></span></p>
<p>&#8220;To help safeguard customers and partners, we are introducing new mandatory security requirements for the partners participating in the Cloud Solution Provider (CSP) program, Control Panel Vendors, and Advisor partners,&#8221; Microsoft said in a statement provided to KrebsOnSecurity.</p>
<p>&#8220;This includes enforcing multi-factor authentication for all users in the partner tenants and adopting secure application model for their API integration with Microsoft,&#8221; the statement continues. &#8220;We have notified partners of these changes and enforcement will roll out over the next several months.&#8221;</p>
<p>Microsoft said customers can check or remove a partner’s delegated administration privileges from their tenants at any time, and that guidance on how do do this is available <a href="https://docs.microsoft.com/en-us/partner-center/customers_revoke_admin_privileges" target="_blank" rel="noopener">here</a> and <a href="https://docs.microsoft.com/en-us/microsoft-store/work-with-partner-microsoft-store-business" target="_blank" rel="noopener">here</a>.</p>
<p>This is a welcome &#8212; if long overdue &#8212; change. Countless data breaches are tied to weak or default settings. Whether we&#8217;re talking about unnecessary software features turned on, hard-coded passwords, or key security settings that are optional, defaults matter tremendously because far too many people never change them &#8212; or they simply aren&#8217;t aware that they exist.</p>


feed_id: https://krebsonsecurity.com/?p=48100
title: Who’s Behind the GandCrab Ransomware?
uri: Who-s-Behind-the-GandCrab-Ransomware
url: https://krebsonsecurity.com/2019/07/whos-behind-the-gandcrab-ransomware/
content:
<p>The crooks behind an affiliate program that paid cybercriminals to install the destructive and wildly successful <strong>GandCrab</strong> ransomware strain announced on May 31, 2019 they were terminating the program after allegedly having earned more than $2 billion in extortion payouts from victims. What follows is a deep dive into who may be responsible for recruiting new members to help spread the contagion.</p>
<div id="attachment_48119" style="width: 606px" class="wp-caption aligncenter"><img class=" wp-image-48119" src="media/f78922a2.gandcrab.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/07/gandcrab.jpg" alt="" width="596" height="219" /><p class="wp-caption-text">Image: Malwarebytes.</p></div>
<p>Like most ransomware strains, the GandCrab ransomware-as-a-service offering held files on infected systems hostage unless and until victims agreed to pay the demanded sum. But GandCrab far eclipsed the success of competing ransomware affiliate programs largely because its authors worked assiduously to update the malware so that it could evade antivirus and other security defenses.</p>
<p>In the 15-month span of the GandCrab affiliate enterprise <a href="https://krebsonsecurity.com/wp-content/uploads/2019/07/gandcrab-raas-ad.txt" target="_blank" rel="noopener">beginning in January 2018</a>, its curators shipped five major revisions to the code, each corresponding with sneaky new features and bug fixes aimed at thwarting the efforts of computer security firms to stymie the spread of the malware.</p>
<p>&#8220;In one year, people who worked with us have earned over US $2 billion,&#8221; read the farewell post by the eponymous GandCrab identity on the cybercrime forum <strong>Exploit[.]in</strong>, where the group recruited many of its distributors. &#8220;Our name became a generic term for ransomware in the underground. The average weekly income of the project was equal to US $2.5 million.&#8221;</p>
<p>The message continued:</p>
<blockquote><p>&#8220;We ourselves have earned over US $150 million in one year. This money has been successfully cashed out and invested in various legal projects, both online and offline ones. It has been a pleasure to work with you. But, like we said, all things come to an end. We are getting a well-deserved retirement. We are a living proof that you can do evil and get off scot-free. We have proved that one can make a lifetime of money in one year. We have proved that you can become number one by general admission, not in your own conceit.&#8221;</p></blockquote>
<p>Evil indeed, when one considers the damage inflicted on so many individuals and businesses hit by GandCrab &#8212; easily the most rapacious and predatory malware of 2018 and well into 2019.</p>
<p>The GandCrab identity on Exploit[.]in periodically posted updates about victim counts and ransom payouts. For example, in late July 2018, GandCrab crowed that a single affiliate of the ransomware rental service had infected 27,031 victims in the previous month alone, receiving about $125,000 in commissions.</p>
<p>The following month, GandCrab bragged that the program in July 2018 netted almost 425,000 victims and extorted more than one million dollars worth of cryptocurrencies, much of which went to affiliates who helped to spread the infections.</p>
<p>Russian security firm <strong>Kaspersky Lab</strong> estimated that by the time the program ceased operations, GandCrab accounted for up to half of the global ransomware market.</p>
<h4>ONEIILK2</h4>
<p>It remains unclear how many individuals were active in the core GandCrab malware development team. But KrebsOnSecurity located a number of clues that point to the real-life identity of a Russian man who appears to have been put in charge of recruiting new affiliates for the program.</p>
<p>In November 2018, a GandCrab affiliate posted a screenshot on the Exploit[.]in cybercrime forum of a private message between himself and a forum member known variously as &#8220;<strong>oneiilk2</strong>&#8221; and &#8220;<strong>oneillk2</strong>&#8221; that showed the latter was in charge of recruiting new members to the ransomware earnings program.</p>
<p>Oneiilk2 also was a successful GandCrab affiliate in his own right. In May 2018, he could be seen in multiple Exploit[.]in threads asking for urgent help obtaining access to hacked businesses in South Korea. These solicitations go on for several weeks that month &#8212; with Oneiilk2 saying he&#8217;s willing to pay top dollar for the requested resources. At the same time, Oneiilk2 can be seen on Exploit asking for help figuring out how to craft a convincing malware lure using the Korean alphabet.</p>
<p>Later in the month, Oneiilk2 says he no longer needs assistance on that request. Just a few weeks later, security firms began warning that attackers were staging a spam campaign to target <a href="https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/-egg-files-in-spam-delivers-gandcrab-v4-3-ransomware-to-south-korean-users" target="_blank" rel="noopener">South Korean businesses with version 4.3 of GandCrab</a>.<span id="more-48100"></span></p>
<h4>HOTTABYCH</h4>
<p>When Oneiilk2 registered on Exploit in January 2015, he used the email address <strong>hottabych_k2@mail.ru</strong>. That email address and nickname had been used since 2009 to register multiple identities on more than a half dozen cybercrime forums.</p>
<p>In 2010, the hottabych_k2 address was used to register the domain name <strong>dedserver[.]ru</strong>, a site which marketed dedicated Web servers to individuals involved in various cybercrime projects. That domain registration record included the Russian phone number <strong>+7-951-7805896</strong>, which mail.ru&#8217;s password recovery function says is indeed the phone number used to register the hottabych_k2 email account.</p>
<p>At least four posts made in 2010 to the hosting review service makeserver.ru advertise Dedserver and include images watermarked with the nickname &#8220;oneillk2.&#8221;</p>
<p>Dedserver also heavily promoted a virtual private networking (VPN) service called <strong>vpn-service[.]us</strong> to help users obfuscate their true online locations. It&#8217;s unclear how closely connected these businesses were, although a cached copy of the Dedserver homepage at Archive.org from 2010 suggests the site&#8217;s owners claimed it as their own.</p>
<p>Vpn-service[.]us was registered to the email address <strong>sec-service@mail.ru</strong> by an individual who used the nickname (and sometimes password) &#8212; &#8220;<strong>Metall2</strong>&#8221; &#8212; across multiple cybercrime forums.</p>
<p>Around the same time the GandCrab affiliate program was kicking into high gear, Oneiilk2 had emerged as one of the most trusted members of Exploit and several other forums. This was evident by measuring the total &#8220;reputation points&#8221; assigned to him, which are positive or negative feedback awarded by other members with whom the member has previously transacted.</p>
<p>In late 2018, Oneiilk2 was one of the top 20 highest-rated members among thousands of denizens on the Exploit forum, thanks in no small part to his association with the GandCrab enterprise.</p>
<p>Searching on Oneiilk2&#8217;s registration email address hottabych_k2@mail.ru via sites that track hacked or leaked databases turned up some curious results. Those records show this individual routinely re-used the same password across multiple accounts: 16061991.</p>
<p>For instance, that email address and password shows up in hacked password databases for an account &#8220;oneillk2&#8221; at <strong>zismo[.]biz</strong>, a Russian-language forum dedicated to news about various online money-making affiliate programs.</p>
<p>In <a href="ttps://zismo.biz/topic/938698-nuzhna-pomosch-po-raskrutke-gruppy/" target="_blank" rel="noopener">a post made on Zismo in 2017</a>, Oneiilk2 states that he lives in a small town with a population of around 400,000, and is engaged in the manufacture of furniture.</p>
<h4>HEAVY METALL</h4>
<p>Further digging revealed that the hottabych_k2@mail.ru address had also been used to register at least two accounts on the social networking site <strong>Vkontakte</strong>, the Russian-language equivalent of Facebook.</p>
<p>One of those accounts was registered to a &#8220;Igor Kashkov&#8221; from <a href="https://en.wikipedia.org/wiki/Magnitogorsk" target="_blank" rel="noopener">Magnitogorsk, Russia</a>, a metal-rich industrial town in southern Russia of around 410,000 residents which is home to the largest iron and steel works in the country.</p>
<p>The Kashkov account used the password &#8220;hottabychk2,&#8221; the phone number <strong>890808981338</strong>, and at one point provided the alternative email address &#8220;<strong>prokopenko_k2@bk.ru</strong>.&#8221; However, this appears to have been simply an abandoned account, or at least there are only a couple of sparse updates to the profile.</p>
<p>The <a href="https://vk.com/id11842857" target="_blank" rel="noopener">more interesting Vkontakte account</a> tied to the hottabych_k2@mail.ru address belongs to a profile under the name &#8220;<strong>Igor Prokopenko</strong>,&#8221; who says he also lives in Magnitogorsk. The Igor Prokopenko profile says he has studied and is interested in various types of metallurgy.</p>
<p>There is also a Skype voice-over-IP account tied to an &#8220;Igor&#8221; from Magnitogorsk whose listed birthday is June 16, 1991. In addition, there is a fairly active Youtube account dating back to 2015 &#8212; <a href="https://www.youtube.com/user/Oneillk2/videos" target="_blank" rel="noopener">youtube.com/user/Oneillk2</a> &#8212; that belongs to an Igor Prokopenko from Magnitogorsk.</p>
<p>That Youtube account includes mostly short videos of Mr. Prokopenko angling for fish in a local river and diagnosing problems with his <a href="https://en.wikipedia.org/wiki/Lada_Kalina" target="_blank" rel="noopener">Lada Kalina</a> &#8212; a Russian-made automobile line that is quite common across Russia. An account created in January 2018 using the Oneillk2 nickname on <a href="http://www.lkforum.ru/showthread.php?p=6820879" target="_blank" rel="noopener">a forum for Lada enthusiasts</a> says its owner is 28 years old and lives in Magnitogorsk.</p>
<p>Sources with the ability to check Russian citizenship records identified an <strong>Igor Vladimirovich Prokopenko</strong> from Magnitogorsk who was born on June 16, 1991.  Recall that &#8220;16061991&#8221; was the password used by countless online accounts tied to both hottabych_k2@mail.ru and the Oneiilk2/Oneillk2 identities.</p>
<p>To bring all of the above research full circle, Vkontakte&#8217;s password reset page shows that the Igor Prokopenko profile is tied to the mobile phone number <b>+7-951-7805896</b>, which is the same number used to set up the email account <strong>hottabych_k2@mail.ru </strong>almost 10 years ago.</p>
<p>Mr. Prokopenko did not respond to multiple requests for comment.</p>
<p>It is entirely possible that whoever is responsible for operating the GandCrab affiliate program developed an elaborate, years-long disinformation campaign to lead future would-be researchers to an innocent party.</p>
<p>At the same time, it is not uncommon for many Russian malefactors to do little to hide their true identities &#8212; at least early on in their careers &#8212; perhaps in part because they perceive that there is little likelihood that someone will bother connecting the dots later on, or because maybe they don&#8217;t fear arrest and/or prosecution while they reside in Russia. Anyone doubtful about this dynamic would do well to consult the <a href="https://krebsonsecurity.com/category/breadcrumbs/" target="_blank" rel="noopener">Breadcrumbs series on this blog</a>, which used similar methods as described above to unmask dozens of other major malware purveyors.</p>
<p>It should be noted that the GandCrab affiliate program took measures to prevent the installation of its ransomware on computers residing in Russia or in any of the countries that were previously part of the Soviet Union &#8212; referred to as the Commonwealth of Independent States and including Armenia, Belarus, Kazakhstan, Kyrgyzstan, Moldova, Russia, Tajikistan, Turkmenistan, Ukraine and Uzbekistan. This is a typical precaution taken by cybercriminals running malware operations from one of those countries, as they try to avoid making trouble in their own backyards that might attract attention from local law enforcement.</p>
<p>KrebsOnSecurity would like to thank <a href="https://www.domaintools.com" target="_blank" rel="noopener">domaintools.com</a> (an advertiser on this site), as well as cyber intelligence firms <a href="https://intel471.com" target="_blank" rel="noopener">Intel471</a>, <a href="https://www.holdsecurity.com" target="_blank" rel="noopener">Hold Security</a> and <a href="https://4iq.com" target="_blank" rel="noopener">4IQ</a> for their assistance in researching this post.</p>


feed_id: https://krebsonsecurity.com/?p=48140
title: Patch Tuesday Lowdown, July 2019 Edition
uri: Patch-Tuesday-Lowdown-July-2019-Edition
url: https://krebsonsecurity.com/2019/07/patch-tuesday-lowdown-july-2019-edition/
content:
<p><strong>Microsoft</strong> today released software updates to plug almost 80 security holes in its <strong>Windows</strong> operating systems and related software. Among them are fixes for two zero-day flaws that are actively being exploited in the wild, and patches to quash four other bugs that were publicly detailed prior to today, potentially giving attackers a head start in working out how to use them for nefarious purposes.</p>
<p><img class="alignright size-full wp-image-26837" src="media/863df0f6.brokenwindows.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2014/07/brokenwindows.png" alt="" width="229" height="240" />Zero-days and publicly disclosed flaws aside for the moment, probably the single most severe vulnerability addressed in this month&#8217;s patch batch (at least for enterprises) once again resides in the component of Windows responsible for automatically assigning Internet addresses to host computers &#8212; a function called the &#8220;<strong>Windows DHCP client</strong>.&#8221;</p>
<p>The DHCP weakness (<a href="https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0785" target="_blank" rel="noopener">CVE-2019-0785</a>) exists in most supported versions of Windows server, from <strong>Windows Server 2012</strong> through <strong>Server 2019</strong>.</p>
<p>Microsoft said an unauthenticated attacker could use the DHCP flaw to seize total, remote control over vulnerable systems simply by sending a specially crafted data packet to a Windows computer. For those keeping count, this is the fifth time this year that Redmond has addressed such a critical flaw in the Windows DHCP client.</p>
<p>All told, only 15 of the 77 flaws fixed today earned Microsoft&#8217;s most dire &#8220;critical&#8221; rating, a label assigned to flaws that malware or miscreants could exploit to commandeer computers with little or no help from users. It should be noted that 11 of the 15 critical flaws are present in or are a key component of the browsers built into Windows &#8212; namely, <strong>Edge</strong> and <strong>Internet <span style="text-decoration: line-through;">Exploder</span> Explorer</strong>.<span id="more-48140"></span></p>
<p>One of the zero-day flaws &#8212; <a href="https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1132" target="_blank" rel="noopener">CVE-2019-1132</a> &#8212; affects <strong>Windows 7</strong> and <strong>Server 2008</strong> systems. The other &#8212; <a href="https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0880" target="_blank" rel="noopener">CVE-2019-0880</a> &#8212; is present in <strong>Windows 8.1</strong>, <strong>Server 2012</strong> and later operating systems. Both would allow an attacker to take complete control over an affected system, although each is what&#8217;s known as an &#8220;elevation of privilege&#8221; vulnerability, meaning an attacker would already need to have some level of access to the targeted system.</p>
<p><a href="https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0865" target="_blank" rel="noopener">CVE-2019-0865</a> is a denial-of-service bug in a Microsoft open-source cryptographic library that could be used to tie up system resources on an affected Windows 8 computer. It was publicly disclosed a month ago by <strong>Google&#8217;s Project Zero</strong> bug-hunting operation after Microsoft <a href="https://www.zdnet.com/article/google-warns-this-unpatched-bug-could-quickly-take-down-a-windows-fleet/" target="_blank" rel="noopener">reportedly</a> failed to address it within Project Zero&#8217;s stated 90-day disclosure deadline.</p>
<p>The other flaw publicly detailed prior to today is <a href="https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0887" target="_blank" rel="noopener">CVE-2019-0887</a>, which is a remote code execution flaw in the <strong>Remote Desktop Services (RDP)</strong> component of Windows. However, this bug also would require an attacker to already have compromised a target system.</p>
<p>Mercifully, there do not appear to be any security updates for <strong>Adobe Flash Player</strong> this month.</p>
<p>Standard disclaimer: Patching is important, but it usually doesn&#8217;t hurt to wait a few days before Microsoft irons out any wrinkles in the fixes, which sometimes introduce stability or usability issues with Windows after updating (KrebsOnSecurity will endeavor to update this post in the event that any big issues with these patches emerge).</p>
<p>As such, it&#8217;s a good idea to get in the habit of backing up your system &#8212; or at the very least your data &#8212; before applying any updates. The thing is, newer versions of Windows (e.g. Windows 10+) by default will go ahead and decide for you when that should be done (often this is in the middle of the night). But that setting <a href="https://www.howtogeek.com/224471/how-to-prevent-windows-10-from-automatically-downloading-updates/" target="_blank" rel="noopener">can be changed</a>.</p>
<p>If you experience any problems installing any of the patches this month, please feel free to leave a comment about it below; there’s a better-than-even chance that other readers have experienced the same and may even chime in with some helpful advice and tips.</p>
<p>Further reading:</p>
<p><a href="https://blog.qualys.com/laws-of-vulnerabilities/2019/07/09/july-2019-patch-tuesday-77-vulns-15-critical-dhcp-rce-exploited-privesc-sql-adobe-vulns" target="_blank" rel="noopener">Qualys Patch Tuesday Blog</a></p>
<p><a href="https://blog.rapid7.com/2019/07/09/patch-tuesday-july-2019/" target="_blank" rel="noopener">Rapid7</a></p>
<p><a href="https://www.tenable.com/blog/microsoft-s-july-2019-patch-tuesday-what-you-need-to-know" target="_blank" rel="noopener">Tenable</a> [full disclosure: Tenable is an advertiser on this blog].</p>


feed_id: https://krebsonsecurity.com/?p=48067
title: FEC: Campaigns Can Use Discounted Cybersecurity Services
uri: FEC-Campaigns-Can-Use-Discounted-Cybersecurity-Services
url: https://krebsonsecurity.com/2019/07/fec-campaigns-can-use-discounted-cybersecurity-services/
content:
<p>The <strong>U.S. Federal Election Commission</strong> (FEC) said today political campaigns can accept discounted cybersecurity services from companies without running afoul of existing campaign finance laws, <em>provided those companies already do the same for other non-political entities</em>. The decision comes amid much jostling on Capitol Hill over election security at the state level, and fresh warnings from U.S. intelligence agencies about impending cyber attacks targeting candidates in the lead up to the 2020 election.</p>
<p><img class="aligncenter wp-image-48167" src="media/40ecf883.fec.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/07/fec.png" alt="" width="596" height="297" /></p>
<p>Current campaign finance law prohibits corporate contributions to campaigns, and election experts have worried this could give some candidates pause about whether they can legally accept low- to no-cost services from cybersecurity companies.</p>
<p>But at an FEC meeting today, the commission issued <a href="media/44384adf.mtgdoc_19-28-A.pdf" data-original-source="https://www.fec.gov/resources/cms-content/documents/mtgdoc_19-28-A.pdf" target="_blank" rel="noopener">an advisory opinion</a> (PDF) that such assistance does not constitute an in-kind contribution, as long as the cybersecurity firm already offers discounted solutions to similarly situated non-political organizations, such as small nonprofits.</p>
<p>The FEC&#8217;s ruling comes in response to a petition by California-based <a href="https://area1security.com/" target="_blank" rel="noopener">Area 1 Security</a>, whose core offering focuses on helping clients detect and block phishing attacks. The company said it asked the FEC&#8217;s opinion on the matter after several campaigns that had reached out about teaming up expressed hesitation given the commission&#8217;s existing rules.</p>
<p>In June, Area 1 petitioned the FEC for clarification on the matter, saying it currently offers free and low-cost services to certain clients which are capped at $1,337. The FEC responded with a draft opinion indicating such offering likely would amount to an in-kind contribution that might curry favor among politicians, and urged the company to resubmit its request focusing on the capped-price offering.</p>
<p>Area 1 did so, and at today&#8217;s hearing the FEC said &#8220;because Area 1 is proposing to charge qualified federal candidates and political committees the same as it charges its qualified non-political clients, the Commission concludes that its proposal is consistent with Area 1’s ordinary business practices and therefore would not result in Area 1 making prohibited in-kind contributions to such federal candidates and political committees.&#8221;</p>
<h4>POLICY BY PIECEMEAL</h4>
<p>The decision is the latest in a string of somewhat narrowly tailored advisories from the FEC related to cybersecurity offerings aimed at federal candidates and political committees. Most recently, the commission ruled that the nonprofit organization <strong>Defending Digital Campaigns</strong> could provide free cybersecurity services to candidates, but according to <a href="https://www.nytimes.com/2019/06/06/technology/ftc-rules-cyberattacks.html" target="_blank" rel="noopener">The New York Times</a> that decision only applied to nonpartisan, nonprofit groups that offer the same services to all campaigns.</p>
<p>Last year, the FEC granted a similar exemption to <strong>Microsoft Corp.</strong>, ruling that the software giant could offer &#8220;enhanced online account security services to its election-sensitive customers at no additional cost&#8221; because Microsoft would be shoring up defenses for its existing customers and not seeking to win favor among political candidates.</p>
<p><strong>Dan Petalas</strong> is a former general counsel at the FEC who represents Area 1 as an attorney at the law firm <strong>Garvey Schubert Barer</strong>. Petalas praised today&#8217;s ruling, but said action by Congress is probably necessary to clarify the matter once and for all.</p>
<p>&#8220;Congress could take the uncertainty away by amending the law to say security services provided to campaigns to do not constitute an in-kind contribution,&#8221; Petalas said. &#8220;These candidates are super vulnerable and not well prepared to address cybersecurity threats, and I think that would be a smart thing for Congress to do given the situation we&#8217;re in now.&#8221;<span id="more-48067"></span></p>
<h4>&#8216;A RECIPE FOR DISASTER&#8217;</h4>
<p>The FEC&#8217;s decision comes as federal authorities are issuing increasingly dire warnings that the Russian phishing attacks, voter database probing, and disinformation campaigns that marked the election cycles in 2016 and 2018 were merely a dry run for what campaigns could expect to face in 2020.</p>
<p>In April, <strong>FBI Director Christopher Wray</strong> warned that Russian election meddling posed an ongoing &#8220;significant counterintelligence threat,&#8221; and that the shenanigans from 2016 &#8212; including the hacking of the Democratic National Committee and the phishing of Hillary Clinton&#8217;s campaign chairman and the subsequent mass leak of internal emails &#8212; were just &#8220;a dress rehearsal for the big show in 2020.&#8221;</p>
<p><strong>Adav Noti</strong>, a former FEC general counsel who is now senior director of the nonprofit, nonpartisan <a href="https://campaignlegal.org/" target="_blank" rel="noopener">Campaign Legal Center</a>, said the commission is &#8220;incredibly unsuited to the danger that the system is facing,&#8221; and that Congress should be taking a more active roll.</p>
<p><span class="pullquote pqright">&#8220;The FEC is an agency that can&#8217;t even do the most basic things properly and timely, and to ask them to solve this problem quickly before the next election in an area where they don&#8217;t really have any expertise is a recipe for disaster,&#8221; Noti said.</span> &#8220;Which is why we see these weird advisory opinions from them with no real legal basis or rationale. They&#8217;re sort of making it up as they go along.&#8221;</p>
<p>In May, <strong>Sen. Ron Wyden</strong> (D-Ore.) introduced the <a href="https://www.wyden.senate.gov/download/federal-campaign-cybersecurity-assistance-act-of-2019-bill-text" target="_blank" rel="noopener">Federal Campaign Cybersecurity Assistance Act</a>, which would allow national party committees to provide cybersecurity assistance to state parties, individuals running for office and their campaigns.</p>
<p>Sen. Wyden also has joined at least a dozen other senators &#8212; including many who are currently running as Democratic candidates in the 2020 presidential race &#8212; in introducing the &#8220;<a href="https://thehill.com/policy/cybersecurity/443809-senate-dems-introduce-election-security-bill-requiring-paper-ballots" target="_blank" rel="noopener">Protecting American Votes and Elections (PAVE) Act</a>,&#8221; which would mandate the use of paper ballots in U.S. elections and ban all internet, Wi-Fi and mobile connections to voting machines in order to limit the potential for cyber interference.</p>
<p>As <em>Politico</em> <a href="https://thehill.com/policy/cybersecurity/443809-senate-dems-introduce-election-security-bill-requiring-paper-ballots" target="_blank" rel="noopener">reports</a>, Wyden&#8217;s bill also would give the <strong>Department of Homeland Security</strong> the power to set minimum cybersecurity standards for U.S. voting machines, authorize a one-time $500 million grant program for states to buy ballot-scanning machines to count paper ballots, and require states to conduct risk-limiting audits of all federal elections in order to detect any cyber hacks.</p>
<h4>BIPARTISAN BLUES</h4>
<p>Earlier this week, FBI Director Wray and <strong>Director of National Intelligence Dan Coats</strong> briefed lawmakers in the House and Senate on threats to the 2020 election in classified hearings. But so far, action on any legislative measures to change the status quo has been limited.</p>
<p>Democrats blame <strong>Senate Majority Leader Mitch McConnell</strong> for blocking any action on the bipartisan bills to address election security. Prior to meeting with intelligence officials, McConnell took to the Senate floor Wednesday to allege Democrats had &#8220;already made up their minds before we hear from the experts today that a brand-new, sweeping Washington, D.C. intervention is just what the doctor ordered.&#8221;</p>
<p>&#8220;Make no mistake,&#8221; McConnell said. &#8220;Many of the proposals labeled by Democrats to be &#8216;election security&#8217; measures are indeed election reform measures that are part of the left&#8217;s wish list I&#8217;ve called the Democrat Politician Protection Act.&#8221;</p>
<p>But as <em>Politico </em>reporter <strong>Eric Geller</strong> <a href="https://twitter.com/ericgeller/status/1148966166104330240" target="_blank" rel="noopener">tweeted</a> yesterday, if lawmakers are opposed to requiring states to follow the almost universally agreed-upon best practices for election security, they should just say so.</p>
<p>&#8220;Experts have been urging Congress to adopt tougher standards for years,&#8221; Geller said. &#8220;Suggesting that the jury is still out on what those best practices are is factually inaccurate.&#8221;</p>
<p>Noti said he had hoped election security would emerge as a rare bipartisan issue in this Congress. After all, no candidate wants to have their campaign hacked or elections tampered with by foreign powers &#8212; which could well call into question the results of a race for both sides.</p>
<p>These days he&#8217;s not so sanguine.</p>
<p>&#8220;This is a matter of national security, which is one of the core functions of the federal government,&#8221; Noti said. &#8220;Members of Congress are aware of this issue and there is a desire to do something about it. But right now the prospect of Congress doing something &#8212; even if most lawmakers would agree with it &#8212; is small.&#8221;</p>


feed_id: https://krebsonsecurity.com/?p=48177
title: Is ‘REvil’ the New GandCrab Ransomware?
uri: Is-REvil-the-New-GandCrab-Ransomware
url: https://krebsonsecurity.com/2019/07/is-revil-the-new-gandcrab-ransomware/
content:
<p>The cybercriminals behind the <strong>GandCrab</strong> ransomware-as-a-service (RaaS) offering recently announced they were closing up shop and retiring after having <a href="https://krebsonsecurity.com/2019/07/whos-behind-the-gandcrab-ransomware/" target="_blank" rel="noopener">allegedly earned more than $2 billion in extortion payments from victims</a>. But a growing body of evidence suggests the GandCrab team have instead quietly regrouped behind a more exclusive and advanced ransomware program known variously as &#8220;<strong>REvil</strong>,&#8221; &#8220;<strong>Sodin</strong>,&#8221; and &#8220;<strong>Sodinokibi</strong>.&#8221;</p>
<p>&#8220;We are getting a well-deserved retirement,&#8221; the GandCrab administrator(s) wrote in their farewell message on May 31. &#8220;We are a living proof that you can do evil and get off scot-free.&#8221;</p>
<p>However, it now appears the GandCrab team had already begun preparations to re-brand under a far more private ransomware-as-a-service offering months before their official &#8220;retirement.&#8221;</p>
<p>In late April, researchers at <strong>Cisco Talos</strong> <a href="https://blog.talosintelligence.com/2019/04/sodinokibi-ransomware-exploits-weblogic.html" target="_blank" rel="noopener">spotted a new ransomware strain dubbed Sodinokibi</a> that was used to deploy GandCrab, which encrypts files on infected systems unless and until the victim pays the demanded sum. A month later, GandCrab would announce its closure.</p>
<div id="attachment_48195" style="width: 604px" class="wp-caption aligncenter"><img class="wp-image-48195" src="media/59a374df.decryptor-top.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/07/decryptor-top.jpg" alt="" width="594" height="609" /><p class="wp-caption-text">A payment page for a victim of REvil, a.k.a. Sodin and Sodinokibi.</p></div>
<p>Meanwhile, in the first half of May an individual using the nickname &#8220;<strong>Unknown</strong>&#8221; began making deposits totaling more than USD $130,000 worth of virtual currencies on two top cybercrime forums. The down payments were meant to demonstrate the actor meant business in his offer to hire just a handful of affiliates to drive a new, as-yet unnamed ransomware-as-a-service offering.</p>
<p>&#8220;We are not going to hire as many people as possible,&#8221; Unknown told forum members in announcing the new RaaS program. &#8220;Five affiliates more can join the program and then we&#8217;ll go under the radar. Each affiliate is guaranteed USD 10,000. Your cut is 60 percent at the beginning and 70 percent after the first three payments are made. Five affiliates are guaranteed [USD] 50,000 in total. We have been working for several years, specifically five years in this field. We are interested in professionals.&#8221;</p>
<p>Asked by forum members to name the ransomware service, Unknown said it had been mentioned in media reports but that he wouldn&#8217;t be disclosing technical details of the program or its name for the time being.<span id="more-48177"></span></p>
<p>Unknown said it was forbidden to install the new ransomware strain on any computers in the Commonwealth of Independent States (CIS), which includes Armenia, Belarus, Kazakhstan, Kyrgyzstan, Moldova, Russia, Tajikistan, Turkmenistan, Ukraine and Uzbekistan.</p>
<p>The prohibition against spreading malware in CIS countries has long been a staple of various pay-per-install affiliate programs that are operated by crooks residing in those nations. The idea here is not to attract attention from local law enforcement responding to victim complaints (and/or perhaps to stay off the radar of tax authorities and extortionists in their hometowns).</p>
<p>But <strong>Kaspersky Lab</strong> discovered that Sodinokobi/REvil also includes one other nation on its list of countries that affiliates should avoid infecting: Syria. Interestingly, latter versions of GandCrab took the same unusual step.</p>
<p>What&#8217;s the significance of the Syria connection? In October 2018, a Syrian man <a href="https://twitter.com/kvbNDtxL0kmIqRU/status/1052075557112942592?ref_src=twsrc%5Etfw" target="_blank" rel="noopener">tweeted</a> that he had lost access to all pictures of his deceased children after his computer got infected with GandCrab.</p>
<p>&#8220;They want 600 dollars to give me back my children, that&#8217;s what they&#8217;ve done, they&#8217;ve taken my boys away from me for a some filthy money,&#8221; the victim wrote. &#8220;How can I pay them 600 dollars if I barely have enough money to put food on the table for me and my wife?&#8221;</p>
<p><img class="aligncenter size-full wp-image-48197" src="media/5d95a0fc.gctweet-syria.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/07/gctweet-syria.jpg" alt="" width="573" height="416" /></p>
<p>That heartfelt appeal apparently struck a chord with the developer(s) of GandCrab, who soon after released a decryption key that let all GandCrab victims in Syria unlock their files for free.</p>
<p>But this rare display of mercy probably cost the GandCrab administrators and its affiliates a pretty penny. That&#8217;s because a week after GandCrab released decryption keys for all victims in Syria, the <a href="https://www.nomoreransom.org/" rel="noopener" target="_blank">No More Ransom project</a> released a free GandCrab decryption tool developed by Romanian police in collaboration with law enforcement offices from a number of countries and security firm <strong>Bitdefender</strong>. </p>
<p>The GandCrab operators later told affiliates that the release of the decryption keys for Syrian victims allowed the entropy used by the random number generator for the ransomware&#8217;s master key to be calculated. Approximately 24 hours after NoMoreRansom released its free tool, the GandCrab team shipped an update that rendered it unable to decrypt files.</p>
<p>There are also similarities between the ways that both GandCrab and REvil generate URLs that are used as part of the infection process, according <a href="https://www.tesorion.nl/aconnection-between-the-sodinokibi-and-gandcrab-ransomware-families/" target="_blank" rel="noopener">a recent report</a> from Dutch security firm <strong>Tesorion</strong>.</p>
<p>&#8220;Even though the code bases differ significantly, the lists of strings that are used to generate the URLs are very similar (although not identical), and there are some striking similarities in how this specific part of the code works, e.g., in the somewhat far-fetched way that the random length of the filename is repeatedly recalculated,&#8221; Tesorion observed.</p>
<p>My guess is the GandCrab team has not retired, and has simply regrouped and re-branded due to the significant amount of attention from security researchers and law enforcement investigators. It seems highly unlikely that such a successful group of cybercriminals would just walk away from such an insanely profitable enterprise.</p>


feed_id: https://krebsonsecurity.com/?p=48214
title: Meet the World’s Biggest ‘Bulletproof’ Hoster
uri: Meet-the-World-s-Biggest-Bulletproof-Hoster
url: https://krebsonsecurity.com/2019/07/meet-the-worlds-biggest-bulletproof-hoster/
content:
<p>For at least the past decade, a computer crook variously known as &#8220;<strong>Yalishanda</strong>,&#8221; &#8220;<strong>Downlow</strong>&#8221; and &#8220;<strong>Stas_vl</strong>&#8221; has run one of the most popular &#8220;bulletproof&#8221; Web hosting services catering to a vast array of phishing sites, cybercrime forums and malware download servers. What follows are a series of clues that point to the likely real-life identity of a Russian man who appears responsible for enabling a ridiculous amount of cybercriminal activity on the Internet today.</p>
<div id="attachment_48241" style="width: 606px" class="wp-caption aligncenter"><img class=" wp-image-48241" src="media/a52b3654.bphgraphic.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/07/bphgraphic.png" alt="" width="596" height="160" /><p class="wp-caption-text">Image: Intel471</p></div>
<p>KrebsOnSecurity began this research after reading a new academic paper on the challenges involved in dismantling or disrupting bulletproof hosting services, which are so called because they can be depended upon to ignore abuse complaints and subpoenas from law enforcement organizations. We&#8217;ll get to that paper in a moment, but for now I mention it because it prompted me to check and see if one of the more infamous bulletproof hosters from a decade ago was still in operation.</p>
<p>Sure enough, I found that Yalishanda was actively advertising on cybercrime forums, and that his infrastructure was being used to host hundreds of dodgy sites. Those include a large number of cybercrime forums and stolen credit card shops, ransomware download sites, <a href="https://krebsonsecurity.com/tag/magecart/" target="_blank" rel="noopener">Magecart-related infrastructure</a>, and a metric boatload of phishing Web sites mimicking dozens of retailers, banks and various government Web site portals.</p>
<p>I first encountered Yalishanda back in 2010, after <a href="https://krebsonsecurity.com/2011/09/whos-behind-the-tdss-botnet/" target="_blank" rel="noopener">writing about &#8220;Fizot,&#8221;</a> the nickname used by another miscreant who helped customers anonymize their cybercrime traffic by routing it through a global network of Microsoft Windows computers infected with a powerful malware strain called <a href="https://en.wikipedia.org/wiki/Alureon" target="_blank" rel="noopener">TDSS</a>.</p>
<p>After that Fizot story got picked up internationally, KrebsOnSecurity heard from a source who suggested that Yalishanda and Fizot shared some of the same infrastructure.</p>
<p>In particular, the source pointed to a domain that was live at the time called <strong>mo0be-world[.]com</strong>, which was registered in 2010 to an <strong>Aleksandr Volosovyk</strong> at the email address <strong>stas_vl@mail.ru</strong>. Now, normally cybercriminals are not in the habit of using their real names in domain name registration records, particularly domains that are to be used for illegal or nefarious purposes. But for whatever reason, that is exactly what Mr. Volosovyk appears to have done.</p>
<h4>WHO IS YALISHANDA?</h4>
<p>The one or two domain names registered to Aleksandr Volosovyk and that mail.ru address state that he resides in Vladivostok, which is a major Pacific port city in Russia that is close to the borders with China and North Korea. The nickname Yalishanda means &#8220;Alexander&#8221; in Mandarin (亚历山大).</p>
<p>Here&#8217;s a snippet from one of Yalishanda&#8217;s advertisements to a cybercrime forum in 2011, when he was running a bulletproof service under the domain real-hosting[.]biz:</p>
<blockquote><p>-Based in Asia and Europe.<br />
-It is allowed to host: ordinary sites, doorway pages, satellites, codecs, adware, tds, warez, pharma, spyware, exploits, zeus, IRC, etc.<br />
-Passive SPAM is allowed (you can spam sites that are hosted by us).<br />
-Web spam is allowed (Hrumer, A-Poster &#8230;.)</p>
<p>-Forbidden: Any outgoing Email spam, DP, porn, phishing (exclude phishing email, social networks)</p>
<p>There is a server with instant activation under botnets (zeus) and so on. The prices will pleasantly please you! The price depends on the specific content!!!!</p></blockquote>
<p>Yalishanda would re-brand and market his pricey bulletproof hosting services under a variety of nicknames and cybercrime forums over the years, including one particularly long-lived abuse-friendly project aptly named <strong>abushost[.]ru</strong>.</p>
<p>In <a href="https://www.youtube.com/watch?v=PGTTRN6Vs-Y" target="_blank" rel="noopener">a talk given at the Black Hat security conference in 2017</a>, researchers from cyber intelligence firm <a href="https://www.intel471.com" target="_blank" rel="noopener">Intel471</a> labeled Yalishanda as one the &#8220;top tier&#8221; bulletproof hosting providers worldwide, noting that in just one 90-day period in 2017 his infrastructure was seen hosting sites tied to some of the most advanced malware contagions at the time, including the <a href="https://krebsonsecurity.com/?s=dridex&amp;x=0&amp;y=0" target="_blank" rel="noopener">Dridex</a> and <a href="https://krebsonsecurity.com/?s=zeus+trojan&amp;x=0&amp;y=0" target="_blank" rel="noopener">Zeus</a> banking trojans, as well as a slew of ransomware operations.</p>
<div style="text-align: center;"><iframe src="https://www.youtube.com/embed/PGTTRN6Vs-Y" width="560" height="315" frameborder="0" allowfullscreen="allowfullscreen"></iframe></div>
<p>&#8220;Any of the actors that can afford his services are somewhat more sophisticated than say the bottom feeders that make up the majority of the actors in the underground,&#8221; said <strong>Jason Passwaters</strong>, Intel471&#8217;s chief operating officer. &#8220;Bulletproof hosting is probably the biggest enabling service that you find in the underground. If there&#8217;s any one group operation or actor that touches more cybercriminals, it&#8217;s the bulletproof hosters.&#8221;</p>
<p>Passwaters told Black Hat attendees that Intel471 wasn&#8217;t convinced Alex was Yalishanda&#8217;s real name. I circled back with Intel471 this week to ask about their ongoing research into this individual, and they confided that they knew at the time Yalishanda was in fact Alexander Volosovyk, but simply didn&#8217;t want to state his real name in a public setting.</p>
<p>KrebsOnSecurity uncovered strong evidence to support a similar conclusion. In 2010, this author received a massive data dump from a source that had hacked into or otherwise absconded with more than four years of email records from <a href="https://krebsonsecurity.com/tag/chronopay/" target="_blank" rel="noopener">ChronoPay</a> &#8212; at the time a major Russian online payment provider whose CEO and co-founders were the chief subjects of my 2014 book, <a href="https://www.amazon.com/Spam-Nation-Organized-Cybercrime-Epidemic-ebook/dp/B00L5QGBL0/ref=dp_kinw_strp_1" target="_blank" rel="noopener"><em>Spam Nation: The Inside Story of Organized Cybercrime</em></a>.</p>
<p>Querying those records on Yalishanda&#8217;s primary email address &#8212; stas_vl@mail.ru &#8212; reveal that this individual in 2010 sought payment processing services from ChronoPay for a business he was running which sold counterfeit designer watches.</p>
<p>As part of his application for service, the person using that email address forwarded six documents to ChronoPay managers, including business incorporation and banking records for companies he owned in China, as well as a full scan of his Russian passport.</p>
<p>That passport, pictured below, indicates that Yalishanda&#8217;s real name is <strong>Alexander Alexandrovich Volosovik</strong>. The document shows he was born in Ukraine and is approximately 36 years old.</p>
<div id="attachment_48194" style="width: 608px" class="wp-caption aligncenter"><img class=" wp-image-48194" src="media/21463a62.volosovik-passport.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/07/volosovik-passport.png" alt="" width="598" height="800" /><p class="wp-caption-text">The passport for Alexander Volosovyk, a.k.a. &#8220;Yalishandra,&#8221; a major operator of bulletproof hosting services.</p></div>
<p><span id="more-48214"></span>According to Intel471, Yalishanda lived in Beijing prior to establishing a residence in Vladivostok (that passport above was issued by the Russian embassy in Beijing). The company says he moved to St. Petersburg, Russia approximately 18 months ago.</p>
<p>His current bulletproof hosting service is called <strong>Media Land LLC</strong>. This finding is supported by documents maintained by <a href="https://www.rusprofile.ru/id/10187866" target="_blank" rel="noopener">Rusprofile.ru</a>, which states that an Alexander Volosovik is indeed the director of a St. Petersburg company by the same name.</p>
<h4><a class="lightbox" href="media/50df60e1.medialand.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/07/medialand.png"><img class="aligncenter wp-image-48245" src="media/50df60e1.medialand.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/07/medialand.png" alt="" width="595" height="325" /></a></h4>
<h4>ARMOR-PIERCING BULLETS?</h4>
<p>Bulletproof hosting administrators operating from within Russia probably are not going to get taken down or arrested, provided they remain within that country (or perhaps within the confines of the former republics of the Soviet Union, known as the <a href="https://en.wikipedia.org/wiki/Commonwealth_of_Independent_States" target="_blank" rel="noopener">Commonwealth of Independent States</a>).</p>
<p>That&#8217;s doubly so for bulletproof operators who are careful to follow the letter of the law in those regions &#8212; i.e., setting up official companies that are required to report semi-regularly on various aspects of their business, as Mr. Volosovik clearly has done.</p>
<p>However, occasionally big-time bulletproof hosters from those CIS countries do get disrupted and/or apprehended. On July 11, law enforcement officials in Ukraine <a href="https://www.gp.gov.ua/ua/news.html?_m=publications&amp;_t=rec&amp;id=254839" target="_blank" rel="noopener">announced they&#8217;d conducted 29 searches and detained two individuals</a> in connection with a sprawling bulletproof hosting operation.</p>
<p>The press release from the Ukrainian prosecutor general&#8217;s office doesn&#8217;t name the individuals arrested, but sources tell KrebsOnSecurity that one of them was <strong>Mikhail Rytikov</strong>, a man U.S. authorities say was a well-known bulletproof hoster who operated under the nickname &#8220;AbdAllah.&#8221;</p>
<div id="attachment_48234" style="width: 570px" class="wp-caption aligncenter"><img class="size-full wp-image-48234" src="media/832657ff.abdallah-servers.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/07/abdallah-servers.jpg" alt="" width="560" height="361" /><p class="wp-caption-text">Servers allegedly tied to AbdAllah&#8217;s bulletproof hosting network. Image: Gp.gov.ua.</p></div>
<p>In 2015, the <strong>U.S. Justice Department</strong> <a href="https://www.justice.gov/opa/pr/russian-national-charged-largest-known-data-breach-prosecution-extradited-united-states" target="_blank" rel="noopener">named Rytikov as a key infrastructure provider for two Russian hackers</a> &#8212; <a href="https://krebsonsecurity.com/2013/07/hacker-ring-stole-160-million-credit-cards/" target="_blank" rel="noopener">Vladimir Drinkman and Alexandr Kalinin</a> &#8212; in a cybercrime spree the government called the largest known data breach at the time.</p>
<p>According to the Justice Department, Drinkman and his co-defendants were responsible for hacks and digital intrusions against NASDAQ, 7-Eleven, Carrefour, JCP, Hannaford, Heartland, Wet Seal, Commidea, Dexia, JetBlue, Dow Jones, Euronet, Visa Jordan, Global Payment, Diners Singapore and Ingenicard.</p>
<p>Whether AbdAllah ever really faces justice for his alleged crimes remains to be seen. Ukraine does not extradite citizens, as the U.S. authorities have requested in this case. And we have seen time and again how major cybercriminals get raided and detained by local and federal authorities there, only to quickly re-emerge and resume operations shortly thereafter, while the prosecution against them goes nowhere.</p>
<p>Some examples of this include <a href="https://krebsonsecurity.com/2010/09/19-arrested-in-multi-million-dollar-zeus-heists/" target="_blank" rel="noopener">several Ukrainian men arrested in 2010</a> and accused of running an international crime and money laundering syndicate that used a custom version of the Zeus trojan to siphon tens of millions of dollars from hacked small businesses in the U.S. and Europe. To my knowledge, none of the Ukrainian men that formed the core of that operation were ever prosecuted, reportedly because they were connected to influential figures in the Ukrainian government and law enforcement.</p>
<p>Intel471&#8217;s Passwater said something similar happened in December 2016, when authorities in the U.S., U.K. and Europe <a href="https://krebsonsecurity.com/2016/12/avalanche-global-fraud-ring-dismantled/" target="_blank" rel="noopener">dismantled Avalanche</a>, a distributed, cloud-hosting network that was rented out as a bulletproof hosting enterprise for countless malware and phishing attacks.</p>
<p>Prior to that takedown, Passwater said, somehow the core actor behind the Avalanche hosting network &#8212; an individual who went by the nickname &#8220;<strong>Sosweet</strong>&#8221; &#8212; got a tip about an impending raid.</p>
<p>&#8220;Sosweet was raided in December right before Avalanche was taken down, [and] we know that he was tipped off because of corruption [because] 24 hours later the guy was back in service and has all his stuff back up,&#8221; Passwater said.</p>
<p>The same also <a href="https://www.nytimes.com/2019/06/29/opinion/sunday/conficker-worm-ukraine.html" target="_blank" rel="noopener">appears to be true</a> for several Ukrainian men arrested in 2011 on suspicion of building and <a href="https://krebsonsecurity.com/2011/06/72m-scareware-ring-used-conficker-worm/" target="_blank" rel="noopener">disseminating Conficker</a>, a malware strain that infected millions of computers worldwide and prompted an unprecedented global response from the security industry.</p>
<p>So if a majority of bulletproof hosting businesses operate primarily out of countries where the rule of law is not strong and/or where corruption is endemic, is there any hope for disrupting these dodgy businesses?</p>
<p>Here we come full circle to the academic report mentioned briefly at the top of this story: The answer seems to be &#8212; like most things related to cybercrime &#8212; &#8220;maybe,&#8221; provided the focus is on attempting to interfere with their ability to profit from such activities.</p>
<p>That paper, titled <em>Platforms in Everything: Analyzing Ground-Truth Data on the Anatomy and Economics of Bulletproof Hosting</em>, was authored by researchers at <strong>New York University</strong>, <strong>Delft University of Technology</strong>, <strong>King Saud University</strong> and the <strong>Dutch National High-Tech Crimes Unit</strong>. Unfortunately, it has not yet been released publicly, and KrebsOnSecurity does not have permission yet to publish it.</p>
<p>The study examined the day-to-day operations of <strong>MaxiDed</strong>, a bulletproof hosting operation based in The Netherlands that was <a href="https://www.bleepingcomputer.com/news/security/police-seize-servers-of-bulletproof-provider-known-for-hosting-malware-ops/" target="_blank" rel="noopener">dismantled last summer</a> after authorities seized its servers. The paper&#8217;s core findings suggest that because profit margins for bulletproof hosting (BPH) operations are generally very thin, even tiny disruptions can quickly push these businesses into the red.</p>
<p>&#8220;We demonstrate the BPH landscape to have further shifted from agile resellers towards marketplace platforms with an oversupply of resources originating from hundreds of legitimate upstream hosting providers,&#8221; the researchers wrote. &#8220;We find the BPH provider to have few choke points in the supply chain amenable to intervention, though proﬁt margins are very slim, so even a marginal increase in operating costs might already have repercussions that render the business unsustainable.&#8221;</p>


feed_id: https://krebsonsecurity.com/?p=48260
title: Party Like a Russian, Carder’s Edition
uri: Party-Like-a-Russian-Carder-s-Edition
url: https://krebsonsecurity.com/2019/07/party-like-a-russian-carders-edition/
content:
<p><center><em>&#8220;It takes a certain kind of man with a certain reputation<br />
To alleviate the cash from a whole entire nation&#8230;&#8221;</em></center></p>
<p>KrebsOnSecurity has seen some creative yet truly bizarre ads for dodgy services in the cybercrime underground, but the following animated advertisement for a popular credit card fraud shop likely takes the cake.</p>
<p>The name of this particular card shop won&#8217;t be mentioned here, and its various domain names featured in the video have been pixelated so as not to further promote the online store in question.</p>
<p>But points for knowing your customers, and understanding how to push emotional buttons among a clientele that mostly views America&#8217;s financial system as one giant ATM that never seems to run out of cash.</p>
<p>WARNING: Some viewers may find this video disturbing. Also, it is almost certainly Not Safe for Work.</p>
<p><iframe src="https://player.vimeo.com/video/348641478" width="600" height="320" frameborder="0" allow="autoplay; fullscreen" allowfullscreen></iframe></p>
<p>The above commercial is vaguely reminiscent of <a href="https://www.youtube.com/watch?v=EtcKavgS_2k" rel="noopener" target="_blank">the slick ads</a> produced for and promoted by convicted Ukrainian credit card fraudster <a href="https://en.wikipedia.org/wiki/Vladislav_Horohorin" rel="noopener" target="_blank">Vladislav &#8220;BadB&#8221; Horohorin</a>, who was sentenced in 2013 to serve 88 months in prison for his role in the theft of more than $9 million from RBS Worldpay, an Atlanta-based credit card processor. (In February 2017, Horohorin was released and deported from the United States. He now works as a private cybersecurity consultant). </p>
<p>The clip above is loosely based on the 2016 music video, &#8220;<a href="https://www.youtube.com/watch?v=MdYGQ7B0Vew" rel="noopener" target="_blank">Party Like a Russian</a>,&#8221; produced by British singer-songwriter <strong>Robbie Williams</strong>. </p>
<p>Tip of the hat to Alex Holden of <a href="https://www.holdsecurity.com" rel="noopener" target="_blank">Hold Security</a> for finding and sharing this video.</p>


feed_id: https://krebsonsecurity.com/?p=48277
title: QuickBooks Cloud Hosting Firm iNSYNQ Hit in Ransomware Attack
uri: QuickBooks-Cloud-Hosting-Firm-iNSYNQ-Hit-in-Ransomware-Attack
url: https://krebsonsecurity.com/2019/07/quickbooks-cloud-hosting-firm-insynq-hit-in-ransomware-attack/
content:
<p>Cloud hosting provider <a href="https://www.insynq.com" target="_blank" rel="noopener">iNSYNQ</a> says it is trying to recover from a ransomware attack that shut down its network and has left customers unable to access their accounting data for the past three days. Unfortunately for iNSYNQ, the company appears to be turning a deaf ear to the increasingly anxious cries from its users for more information about the incident.</p>
<div id="attachment_48281" style="width: 602px" class="wp-caption aligncenter"><img class=" wp-image-48281" src="media/bfa5be3b.insync-message.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/07/insync-message.png" alt="" width="592" height="362" /><p class="wp-caption-text">A message from iNSYNQ to customers.</p></div>
<p>Gig Harbor, Wash.-based iNSYNQ specializes in providing cloud-based <strong>QuickBooks</strong> accounting software and services. In a statement posted to its status page, iNSYNQ said it experienced a ransomware attack on July 16, and took its network offline in a bid to contain the spread of the malware.</p>
<p>&#8220;The attack impacted data belonging to certain iNSYNQ clients, rendering such data inaccessible,&#8221; the company said. &#8220;As soon as iNSYNQ discovered the attack, iNSYNQ took steps to contain it. This included turning off some servers in the iNSYNQ environment.&#8221;</p>
<p>iNSYNQ said it has engaged outside cybersecurity assistance and to determine whether any customer data was accessed without authorization, but that so far it has no estimate for when those files might be available again to customers.</p>
<p>Meanwhile, iNSYNQ&#8217;s customers &#8212; many of them accountants who manage financial data for a number of their own clients &#8212; have taken to Twitter to vent their frustration over a lack of updates since that initial message to users.</p>
<p><img class="aligncenter wp-image-48284" src="media/8bfe5d70.insynq-rage.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/07/insynq-rage.png" alt="" width="593" height="569" /></p>
<p>In response, the company appears to have simply deleted or deactivated its Twitter account (a cached copy from June 2019 is available <a href="https://webcache.googleusercontent.com/search?q=cache:PlKsZdXr6a0J:https://twitter.com/insynq+&amp;cd=1&amp;hl=en&amp;ct=clnk&amp;gl=us" target="_blank" rel="noopener">here</a>). Several customers venting about the outage on Twitter also accused the company of unpublishing negative comments about the incident from <a href="https://www.facebook.com/Insynqcloud/" target="_blank" rel="noopener">its Facebook page</a>.</p>
<p>Some of those customers also said iNSYNQ initially blamed the outage on an alleged problem with U.S.-based nationwide cable ISP giant Comcast. Meanwhile, competing cloud hosting providers have been piling on to the tweetstorms about the iNSYNQ outage by marketing their own services, claiming <em>they</em> would never subject their customers to a three-day outage.</p>
<p>iNSYNQ has not yet responded to requests for comment.<span id="more-48277"></span></p>
<p>There is no question that a ransomware infestation at any business &#8212; let alone a cloud data provider &#8212; can quickly turn into an all-hands-on-deck, hair-on-fire emergency that diverts all attention to fixing the problem as soon as possible.</p>
<p>But that is no excuse for leaving customers in the dark, and for not providing frequent and transparent updates about what the victim organization is doing to remediate the matter. Particularly when the cloud provider in question posts constantly <a href="https://blog.insynq.com/blog" target="_blank" rel="noopener">to its blog</a> about how companies can minimize their risk from such incidents by trusting it with their data.</p>
<p>Ransomware victims perhaps in the toughest spot include those providing cloud data hosting and software-as-service offerings, as these businesses are completely unable to serve their customers while a ransomware infestation is active.</p>
<p>The FBI and multiple <a href="https://us.norton.com/internetsecurity-malware-7-tips-to-prevent-ransomware.html" target="_blank" rel="noopener">security firms</a> have advised victims not to pay any ransom demands, as doing so just encourages the attackers and in any case may not result in actually regaining access to encrypted files.</p>
<p>In practice, however, many cybersecurity consulting firms are quietly urging their customers that paying up is the fastest route back to business-as-usual. It’s not hard to see why: Having customer data ransomed or stolen can send many customers scrambling to find new providers. As a result, the temptation to simply pay up may become stronger with each passing day.</p>
<p>That&#8217;s exactly what happened in February, when cloud payroll data provider <strong>Apex Human Capital Management</strong> was <a href="https://krebsonsecurity.com/2019/02/payroll-provider-gives-extortionists-a-payday/" target="_blank" rel="noopener">knocked offline for three days</a> following a ransomware infestation.</p>
<p>On Christmas Eve 2018, cloud hosting provider <strong>Dataresolution.net</strong> <a href="https://krebsonsecurity.com/2019/01/cloud-hosting-provider-dataresolution-net-battling-christmas-eve-ransomware-attack/" target="_blank" rel="noopener">took its systems offline</a> in response to a ransomware outbreak on its internal networks. The company was adamant that it would not pay the ransom demand, but it ended up taking several weeks for customers to fully regain access to their data.</p>
<p>KrebsOnSecurity will endeavor to update this story as more details become available. Any iNSYNQ affected by the outage is welcome to contact this author <a href="https://www.twitter.com/briankrebs" target="_blank" rel="noopener">via Twitter</a> (my direct messages are open to all) or at krebsonsecurity @ gmail.com.</p>


feed_id: https://krebsonsecurity.com/?p=48297
title: What You Should Know About the Equifax Data Breach Settlement
uri: What-You-Should-Know-About-the-Equifax-Data-Breach-Settlement
url: https://krebsonsecurity.com/2019/07/what-you-should-know-about-the-equifax-data-breach-settlement/
content:
<p>Big-three credit bureau<strong> Equifax</strong> has reportedly agreed to pay at least $650 million to settle lawsuits stemming from a 2017 breach that let intruders steal personal and financial data on roughly 148 million Americans. Here&#8217;s a brief primer that attempts to break down what this settlement means for you, and what it says about the value of your identity.</p>
<p><img class="aligncenter wp-image-40776" src="media/28462754.equifax-hq.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2017/09/equifax-hq.png" alt="" width="593" height="393" srcset="https://krebsonsecurity.com/wp-content/uploads/2017/09/equifax-hq.png 770w, https://krebsonsecurity.com/wp-content/uploads/2017/09/equifax-hq-580x384.png 580w, https://krebsonsecurity.com/wp-content/uploads/2017/09/equifax-hq-768x509.png 768w" sizes="(max-width: 593px) 100vw, 593px" /></p>
<p><strong>Q: What happened?</strong></p>
<p>A: If the terms of the settlement are approved by a court, the <strong>Federal Trade Commission</strong> <a href="https://www.ftc.gov/enforcement/cases-proceedings/refunds/equifax-data-breach-settlement" target="_blank" rel="noopener">says</a> Equifax will be required to spend up to $425 million helping consumers who can demonstrate they were financially harmed by the breach. The company also will provide up to 10 years of free credit monitoring to those who had their data exposed.</p>
<p><strong>Q: What about the rest of the money in the settlement?</strong></p>
<p>A: An as-yet undisclosed amount will go to pay lawyers fees for the plaintiffs.</p>
<p><strong>Q: $650 million seems like a lot. Is that some kind of record?</strong></p>
<p>A: If not, it&#8217;s pretty close. <em>The New York Times</em> reported earlier today that it was thought to be the largest settlement ever paid by a company over a data breach, but that statement doesn&#8217;t appear anywhere <a href="https://www.nytimes.com/2019/07/22/business/equifax-data-breach-claim.html" target="_blank" rel="noopener">in their current story</a>.</p>
<p><strong>Q: Hang on&#8230;148 million affected consumers&#8230;out of that $425 million pot that comes to just $2.87 per victim, right?</strong></p>
<p>A: That&#8217;s one way of looking at it. But as always, the devil is in the details. You won&#8217;t see a penny or any other benefit unless you do something about it, and how much you end up costing the company (within certain limits) is up to you.</p>
<p><em>The Times</em> reports that <em>the proposed settlement assumes that only around seven million people will sign up for their credit monitoring offers</em>. &#8220;If more do, Equifax&#8217;s costs for providing it could rise meaningfully,&#8221; the story observes.</p>
<p><strong>Q: Okay. What can I do?</strong></p>
<p>A: You can visit <a href="https://www.equifaxbreachsettlement.com/" target="_blank" rel="noopener">www.equifaxbreachsettlement.com</a>, although none of this will be official or on offer until a court approves the settlement.</p>
<p><strong>Q: Uh, that doesn&#8217;t look like Equifax&#8217;s site&#8230;</strong></p>
<p>A: Good eyes! It&#8217;s not. It&#8217;s run by a third party. But we should probably just be grateful for that; given <a href="https://krebsonsecurity.com/2017/09/equifax-breach-response-turns-dumpster-fire/" target="_blank" rel="noopener">Equifax&#8217;s total dumpster fire of a public response to the breach</a>, the company has shown itself incapable of operating (let alone securing) a properly functioning Web site.</p>
<p><strong>Q: What can I get out of this?</strong></p>
<p>A: In a nutshell, affected consumers are eligible to apply for one or more remedies, including:</p>
<p>&#8211;<strong>Free credit monitoring:</strong> At least three years of credit monitoring via all three major bureaus simultaneously, including Equifax, <strong>Experian</strong> and <strong>Trans Union</strong>. The settlement also envisions up to six more years of single bureau monitoring through Experian. Or, if you don&#8217;t want to take advantage of the credit monitoring offers, you can opt instead for a $125 cash payment. You can&#8217;t get both.</p>
<p>&#8211;<strong>Reimbursement:</strong> &#8230;For the time you spent remedying identity theft or misuse of your personal information caused by the breach, or purchasing credit monitoring or credit reports. This is capped at 20 total hours at $25 per hour ($500). Total cash reimbursement payment will not exceed $20,000 per consumer.</p>
<p>&#8211;<strong>Help with ongoing identity theft issues:</strong> Up to seven years of &#8220;free assisted identity restoration services.&#8221; Again, the existing breach settlement page is light on specifics there.</p>
<p><strong>Q: Does this cover my kids/dependents, too?</strong></p>
<p>A: The FTC says if you were a minor in May 2017 (when Equifax first learned of the breach), you are eligible for a total of 18 years of free credit monitoring.</p>
<p><strong>Q: How do I take advantage of any of these?</strong></p>
<p>A: You can&#8217;t yet. The settlement has to be approved first. The settlement Web site says to check back again later. In addition to checking the breach settlement site periodically, consumers can <a href="https://public.govdelivery.com/accounts/USFTC/subscriber/new?topic_id=USFTC_109" target="_blank" rel="noopener">sign up with the FTC</a> to receive email updates about this settlement.</p>
<p>The settlement site said consumers also can call <strong>1-833-759-2982</strong> for more information. Press #2 on your phone&#8217;s keypad if you want to skip the 1-minute preamble and get straight into the queue to speak with a real person.</p>
<p>KrebsOnSecurity dialed in to ask for more details on the &#8220;free assisted identity restoration services,&#8221; and the person who took my call said they&#8217;d need to have some basic information about me in order to proceed. He said they needed my name, address and phone number to proceed. I gave him a number and a name, and after checking with someone he came back and said the restoration services would be offered by Equifax, but confirmed that affected consumers would still have to apply for it.</p>
<p>He added that the Equifaxbreachsettlement.com site will soon include a feature that lets visitors check to see if they&#8217;re eligible, but also confirmed that just checking eligibility won&#8217;t entitle one to any of the above benefits: Consumers will still need to file a claim through the site (when it&#8217;s available to do so).<span id="more-48297"></span></p>
<h4>ANALYSIS</h4>
<p>We&#8217;ll see how this unfolds, but I&#8217;ll be amazed if anything related to taking advantage of this settlement is painless. I still can&#8217;t even get a free copy of my credit report from Equifax, as I&#8217;m entitled to under the law for free each year. I&#8217;ve even requested a copy by mail, according to their instructions. So far nothing.</p>
<p>But let&#8217;s say for the sake of argument that our questioner is basically right &#8212; that this settlement breaks down to about $3 worth of flesh extracted from Equifax for each affected person. The thing is, this figure probably is less than what Equifax makes selling your credit history to potential creditors each year.</p>
<p>In a <a href="https://krebsonsecurity.com/2017/09/equifax-breach-setting-the-record-straight/" target="_blank" rel="noopener">2017 story about the Equifax breach</a>, I quoted financial fraud expert <strong>Avivah Litan</strong> saying the credit bureaus make about $1 every time they sell your credit file to a potential creditor (or identity thief posing as you). According to recent stats from the <a href="https://www.marketwatch.com/story/people-requested-the-lowest-number-of-credit-checks-since-2003-why-thats-a-red-flag-2019-02-12" target="_blank" rel="noopener">New York Federal Reserve</a>, there were around 145 million hard credit pulls in the fourth quarter of 2018 (it&#8217;s not known how many of those were legitimate or desired).</p>
<p>But there is something you can do to stop the Equifax and the other bureaus from profiting this way: Freeze your credit files with them.</p>
<p><img class="aligncenter wp-image-45129" src="media/4ccd7a38.freezeme-ed.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/09/freezeme-ed.png" alt="" width="596" height="122" /></p>
<p>A security freeze essentially blocks any potential creditors from being able to view or “pull” your credit file, unless you affirmatively unfreeze or thaw your file beforehand. With a freeze in place on your credit file, ID thieves can apply for credit in your name all they want, but they will not succeed in getting new lines of credit in your name because few if any creditors will extend that credit without first being able to gauge how risky it is to loan to you. And it&#8217;s now free for all Americans.</p>
<p><a href="https://krebsonsecurity.com/2018/09/credit-freezes-are-free-let-the-ice-age-begin/" target="_blank" rel="noopener">This post</a> explains in detail what&#8217;s involved in freezing your files; how to place, thaw or remove a freeze; the limitations of a freeze and potential side effects; and alternatives to freezes.</p>
<p>What&#8217;s wrong with just using credit monitoring, you might ask? These services do not prevent thieves from using your identity to open new lines of credit, and from damaging your good name for years to come in the process. The most you can hope for is that credit monitoring services will alert you soon after an ID thief <em>does</em> steal your identity.</p>
<p>If past experience is any teacher, anyone with a freeze on their credit file will need to briefly thaw their file(s) at Equifax before successfully signing up for the service when it&#8217;s offered. Since a law mandating free freezes across the land went into effect, all three bureaus have made it significantly easier to place and lift security freezes.</p>
<p>Probably too easy, in fact. Especially for people who had freezes in place before Equifax revamped its freeze portal. Those folks were issued a numeric PIN to lift, thaw or remove a freeze, but Equifax no longer lets those users do any of those things online with just the PIN.</p>
<p>These days, that PIN doesn&#8217;t play a role in any freeze or thaw process. To create an account at the <a href="https://www.equifax.com/personal/credit-report-services/" target="_blank" rel="noopener">MyEquifax portal</a>, one need only supply name, address, Social Security number, date of birth, any phone number  (all data points exposed in the Equifax breach, and in any case widely available for sale in the cybercrime underground) and answer 4 multiple-guess questions whose answers are often available in public records or on social media.</p>
<p>And so this is yet another reason why you should freeze your credit: <a href="https://krebsonsecurity.com/2019/03/myequifax-com-bypasses-credit-freeze-pin/" target="_blank" rel="noopener">If you don&#8217;t sign up as you at MyEquifax, someone else might do it for you</a>.</p>
<p>What else can you do in the meantime? Be wary of any phone calls or emails you didn&#8217;t sign up for that invoke this data breach settlement and ask you to provide personal and/or financial information.</p>
<p>And if you haven&#8217;t done so lately, go get a free copy of your credit report from <a href="https://www.annualcreditreport.com" target="_blank" rel="noopener">annualcreditreport.com</a>; by law all Americans are entitled to a free report from each of the major bureaus annually. You can opt for one report, or all three at once. Either way, make sure to read the report(s) closely and dispute anything that looks amiss.</p>
<p>It has long been my opinion that the big three bureaus are massively stifling innovation and offering consumers so little choice or say in the bargain that’s being made on the backs of their hard work, integrity and honesty. The real question is, if someone or something eventually serves to dis-intermediate the big three and throw the doors wide open to competition, what would be the net effect of that on consumers?</p>
<p>Obviously, there is no way to know for sure, but a company that truly offered to pay consumers anywhere near what their data is actually worth would probably wipe these digital dinosaurs from the face of the earth.</p>
<p>That is, if the banks could get on board. After all, the banks and their various fingers are what drive the credit industry. And these giants don’t move very nimbly. They’re massively hard to turn on the simplest changes. And they&#8217;re not known for quickly warming to an entirely new model of doing business (i.e. huge cost investments).</p>
<p>My hometown <strong>Sen. Mark Warner</strong> (D-Va.) seems to suggest the $650 million settlement was about half what it should be.</p>
<blockquote><p>&#8220;Americans don’t choose to have companies like Equifax collecting their data – by the nature of their business models, credit bureaus collect your personal information whether you want them to or not. In light of that, the penalties for failing to secure that data should be appropriately steep. While I’m happy to see that customers who have been harmed as a result of Equifax’s shoddy cybersecurity practices will see some compensation, we need structural reforms and increased oversight of credit reporting agencies in order to make sure that this never happens again.&#8221;</p></blockquote>
<p>Sen. Warner sponsored a bill along with Sen. Elizabeth Warren (D-Ma.) called &#8220;<a href="https://www.congress.gov/bill/115th-congress/senate-bill/2289/text" rel="noopener" target="_blank">The Data Breach Prevention and Compensation Act</a>,&#8221; which calls for &#8220;robust compensation to consumers for stolen data; mandatory penalties on credit reporting agencies (CRAs) for data breaches; and giving the FTC more direct supervisory authority over data security at CRAs. </p>
<p>&#8220;Had the bill been in effect prior to the 2017 Equifax breach, the company would have had to pay at least $1.5 billion for their failure to protect Americans’ personal information,&#8221; Warner&#8217;s statement concludes.</p>
<p><strong>Update, 4:44 pm:</strong> Added statement from Sen. Warner.</p>


feed_id: https://krebsonsecurity.com/?p=48332
title: Neo-Nazi SWATters Target Dozens of Journalists
uri: Neo-Nazi-SWATters-Target-Dozens-of-Journalists
url: https://krebsonsecurity.com/2019/07/neo-nazi-swatters-target-dozens-of-journalists/
content:
<p>Nearly three dozen journalists at a broad range of major publications have been targeted by a far-right group that maintains a Deep Web database listing the personal information of people who threaten their views. This group specializes in encouraging others to harass those targeted by their ire, and has claimed responsibility for dozens of bomb threats and &#8220;swatting&#8221; incidents, where police are tricked into visiting potentially deadly force on the target&#8217;s address.</p>
<p><img class="aligncenter wp-image-48340" src="media/d7a9969e.doxbin.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/07/doxbin.png" alt="" width="594" height="327" /></p>
<p>At issue is a site called the &#8220;<strong>Doxbin</strong>,&#8221; which hosts the names, addresses, phone number and often known IP addresses, Social Security numbers, dates of birth and other sensitive information on hundreds of people &#8212; and in some cases the personal information of the target&#8217;s friends and family.</p>
<p>A significant number of the 400+ entries on the Doxbin are for journalists (32 at last count, including Yours Truly), although the curators of Doxbin have targeted everyone from federal judges to executives at major corporations. In January 2019, the group behind Doxbin claimed responsibility for doxing and <a href="https://www.mercurynews.com/2019/01/09/facebook-exec-targeted-by-hoax-call-drawing-heavy-police-response/" target="_blank" rel="noopener"> swatting a top Facebook executive</a>.</p>
<p>At least two of the journalists listed on the Doxbin have been swatted in the past six months, including Pulitzer prize winning columnist <a href="https://eu.usatoday.com/story/news/2019/07/01/fake-911-call-columnist-leonard-pitts-targeted-swatting-incident/1616269001" target="_blank" rel="noopener"><strong>Leonard G. Pitts Jr.</strong></a></p>
<p>In some cases, as in the entries for reporters from <strong>CNN</strong>, <strong>Politico, ProPublica</strong> and <strong>Vox</strong>, no reason is mentioned for their inclusion. But in many others, the explanation seems connected to stories the journalist has published dealing with race or the anti-fascist (antifa) movement.</p>
<p>&#8220;Anti-white race/politics writer,&#8221; reads the note next to Pitts&#8217; entry in the Doxbin.</p>
<p>Many of those listed on the site soon find themselves on the receiving end of extended threats and harassment. <strong>Carey Holzman</strong>, a computer technician who runs <a href="https://www.youtube.com/user/CareyHolzman" target="_blank" rel="noopener">a Youtube channel on repairing and modding computers</a>, was <a href="https://www.youtube.com/watch?v=ecY0ExtzOEo" target="_blank" rel="noopener">swatted</a> in January, at about the same time his personal information showed up on the Doxbin.</p>
<p>More recently, his tormentors started calling his mobile phone at all hours of the night, threatening to hire a hit man to kill him. They even promised to have drugs ordered off the Dark Web and sent to his home, as part of a plan to get him arrested for drug possession.</p>
<p>&#8220;They said they were going to send me three grams of cocaine,&#8221; Holzman told KrebsOnSecurity.</p>
<p>Sure enough, earlier this month a small vial of white powder arrived via the U.S. Postal Service. Holzman said he didn&#8217;t open the vial, but instead handed it over to the local police for testing.<span id="more-48332"></span></p>
<p>On the bright side, Holzman said, he is now on a first-name basis with some of the local police, which isn&#8217;t a bad idea for anyone who is being threatened with swatting attacks.</p>
<p>&#8220;When I told one officer who came out to my house that they threatened to send me drugs, he said &#8216;Okay, well just let me know when the cocaine arrives,'&#8221; Holzman recalled. &#8220;It was pretty funny because the other responding officer approached us and only caught the last thing his partner said, and suddenly looked at the other officer with deadly seriousness.&#8221;</p>
<p>The Doxbin is tied to an open <a href="https://en.wikipedia.org/wiki/Internet_Relay_Chat" target="_blank" rel="noopener">IRC chat</a> channel in which the core members discuss alt-right and racist tropes, doxing and swatting people, and posting videos or audio news recordings of their attacks.</p>
<p>The individual who appears to maintain the Doxbin is a fixture of this IRC channel, and he&#8217;s stated that he also was responsible for maintaining SiegeCulture, a white supremacist Web site that glorifies the writings of <a href="https://www.counterextremism.com/extremists/james-mason" target="_blank" rel="noopener">neo-Nazi James Mason</a>.</p>
<p>Mason&#8217;s various written works call on followers to start a violent race war in the United States. Those works have become the de facto bible for the <a href="https://en.wikipedia.org/wiki/Atomwaffen_Division" target="_blank" rel="noopener">Atomwaffen Division</a>, an extremist group whose members are suspected of having committed multiple murders in the U.S. since 2017.</p>
<p><strong>Courtney Radsch</strong>, advocacy director at the nonprofit <a href="https://www.cpj.org" target="_blank" rel="noopener">Committee to Protect Journalists</a>, said lists that single out journalists for harassment unfortunately are not uncommon.</p>
<p>&#8220;We saw in the Ukraine, for example, there were lists of journalists compiled that led to harassment and threats against reporters there,&#8221; Radsch said. &#8220;We saw it in Malta where there were reports that the prime minister was part of a secret Facebook group used to coordinate harassment campaigns against a journalist who was later murdered. And we&#8217;ve seen the American government &#8212; the Customs and Border Protection &#8212; compiling lists of reporters and activists who&#8217;ve been singled out for questioning.&#8221;</p>
<p>Radsch said when CPJ became aware that the personal information of several journalists were listed on a doxing site, they reached out and <a href="https://cpj.org/safety-notes/" target="_blank" rel="noopener">provided information on relevant safety resources</a>.</p>
<p>&#8220;It does seem that some of these campaigns by extremist groups are being coordinated in secret chat groups or dark web forums, where they can talk about the messaging before they bring it out into the public sphere,&#8221; she said.</p>
<p>In some ways, the Doxbin represents a far more extreme version of <a href="https://krebsonsecurity.com/2013/03/credit-reports-sold-for-cheap-in-the-underweb/" target="_blank" rel="noopener">Exposed[.]su</a>, a site erected briefly in 2013 by a gang of online hoodlums that doxed and swatted celebrities and public figures. The core members of that group were later arrested and charged with various crimes &#8212; including <a href="https://krebsonsecurity.com/2013/04/swatting-incidents-tied-to-id-theft-sites/" target="_blank" rel="noopener">numerous swatting attacks</a>.</p>
<p>One of the men in that group &#8212; <a href="https://krebsonsecurity.com/2016/07/serial-swatter-stalker-and-doxer-mir-islam-gets-just-1-year-in-jail/" target="_blank" rel="noopener">convicted serial swatter and stalker Mir Islam</a> &#8212; was <a href="https://krebsonsecurity.com/2016/07/serial-swatter-stalker-and-doxer-mir-islam-gets-just-1-year-in-jail/" target="_blank" rel="noopener">arrested last year in the Philippines and charged with murder</a> after he and an associate allegedly dumped the body of a friend in a local river.</p>
<p>Swatting attacks can quickly turn deadly. In March 2019, 26-year-old serial swatter Tyler Barriss <a href="https://krebsonsecurity.com/2019/03/man-behind-fatal-swatting-gets-20-years/" target="_blank" rel="noopener">was sentenced to 20 years in prison</a> for making a phony emergency call to police in late 2017 that led to the shooting death of an innocent Kansas resident.</p>
<p>My hope is that law enforcement officials can shut down this Doxbin gang before someone else gets killed.</p>


feed_id: https://krebsonsecurity.com/?p=48370
title: The Unsexy Threat to Election Security
uri: The-Unsexy-Threat-to-Election-Security
url: https://krebsonsecurity.com/2019/07/the-unsexy-threat-to-election-security/
content:
<p>Much has been written about the need to further secure our elections, from ensuring the integrity of voting machines to combating fake news. But according to a report quietly issued by a California grand jury this week, more attention needs to be paid to securing social media and email accounts used by election officials at the state and local level.</p>
<p><img class="aligncenter wp-image-48374" src="media/f2e7b0f5.voting.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/07/voting.png" alt="" width="595" height="358" /></p>
<p>California has <a href="https://www.courts.ca.gov/civilgrandjury.htm" target="_blank" rel="noopener">a civil grand jury system</a> designed to serve as an independent oversight of local government functions, and each county impanels jurors to perform this service annually. On Wednesday, a grand jury from <a href="https://en.wikipedia.org/wiki/San_Mateo_County,_California" target="_blank" rel="noopener">San Mateo County</a> in northern California released a report which envisions the havoc that might be wrought on the election process if malicious hackers were able to hijack social media and/or email accounts and disseminate false voting instructions or phony election results.</p>
<p>&#8220;Imagine that a hacker hijacks one of the County’s official social media accounts and uses it to report false results on election night and that local news outlets then redistribute those fraudulent election results to the public,&#8221; the report reads.</p>
<p>&#8220;Such a scenario could cause great confusion and erode public confidence in our elections, even if the vote itself is actually secure,&#8221; the report continues. &#8220;Alternatively, imagine that a hacker hijacks the County’s elections website before an election and circulates false voting instructions designed to frustrate the efforts of some voters to participate in the election. In that case, the interference could affect the election outcome, or at least call the results into question.&#8221;</p>
<p>In San Mateo County, the office of the <a href="http://smcacre.org" target="_blank" rel="noopener">Assessor-County Clerk-Recorder and Elections</a> (ACRE) is responsible for carrying out elections and announcing local results. The ACRE sends election information to some 43,000 registered voters who&#8217;ve subscribed to receive sample ballots and voter information, and its Web site publishes voter eligibility information along with instructions on how and where to cast ballots.</p>
<p>The report notes that concerns about the security of these channels is hardly theoretical: In 2010, intruders hijacked ACRE&#8217;s election results Web page, and in 2016, cyber thieves successfully breached several county employee email accounts in a spear-phishing attack.</p>
<p>In the wake of the 2016 attack, San Mateo County instituted two-factor authentication for its email accounts &#8212; requiring each user to log in with a password and a one-time code sent via text message to their mobile device. However, the ACRE uses its own <strong>Twitter</strong>, <strong>Facebook</strong>, <strong>Instagram</strong> and <strong>YouTube</strong> accounts to share election information, and these accounts are not currently secured by two-factor authentication, the report found.<span id="more-48370"></span></p>
<p>&#8220;The Grand Jury finds that the security protections against hijacking of ACRE’s website, email, and social media accounts are not adequate to protect against the current cyber threats. These vulnerabilities expose the public to potential disinformation by hackers who could hijack an ACRE online communication platform to mislead voters before an election or sow confusion afterward. Public confidence is at stake, even if the vote itself is secure.&#8221;</p>
<p>The jury recommended the county take full advantage of the most secure two-factor authentication now offered by all of these social media platforms: The use of <a href="https://krebsonsecurity.com/2018/07/google-security-keys-neutralized-employee-phishing/" target="_blank" rel="noopener">a FIDO physical security key</a>, a small hardware device which allows the user to complete the login process simply by inserting the USB device and pressing a button. The key works without the need for any special software drivers [full disclosure: <strong>Yubico</strong>, a major manufacturer of security keys, is currently an advertiser on this site.]</p>
<p>Additionally, the report urges election officials to migrate away from one-time codes sent via text message, as these can be intercepted via man-in-the-middle (MitM) and <a href="https://krebsonsecurity.com/?s=sim+swapping&amp;x=0&amp;y=0" target="_blank" rel="noopener">SIM-swapping attacks.</a>  MitM attacks use counterfeit login pages to steal credentials and one-time codes.</p>
<p><img class="aligncenter wp-image-48373" src="media/9294b940.smsjack.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/07/smsjack.png" alt="" width="595" height="529" /></p>
<p>An unauthorized SIM swap is an increasingly rampant form of fraud in which scammers bribe or trick employees at mobile phone stores into seizing control of the target’s phone number and diverting all texts and phone calls to the attacker’s mobile device.</p>
<p><img class="aligncenter wp-image-48372" src="media/a8266821.simjack.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/07/simjack.png" alt="" width="596" height="495" /></p>
<p><strong>Samy Tarazi</strong> is a sergeant with the sheriff&#8217;s office in nearby Santa Clara County and a supervisor with the <strong>REACT Task Force</strong>, a team of law enforcement officers that has been <a href="https://krebsonsecurity.com/2018/11/busting-sim-swappers-and-sim-swap-myths/" target="_blank" rel="noopener">tracking down individuals perpetrating SIM swapping attacks</a>. Tarazi said he fully expects SIM swapping to emerge as a real threat to state and local election workers, as well as to staff and volunteers working for candidates.</p>
<p>&#8220;I wouldn&#8217;t be surprised if some major candidate or their staff has an email or social media account with tons of important stuff on there [whose password] can be reset with just a text message,&#8221; Tarazi told KrebsOnSecurity. &#8220;I hope that doesn&#8217;t happen, but politicians are regular people who use the same tools we use.&#8221;</p>
<p>A copy of the San Mateo County grand jury report is available <a href="media/1cd3e575.elections.pdf" data-original-source="https://www.sanmateocourt.org/documents/grand_jury/2018/elections.pdf" target="_blank" rel="noopener">here</a> (PDF).</p>


feed_id: https://krebsonsecurity.com/?p=48369
title: No Jail Time for “WannaCry Hero”
uri: No-Jail-Time-for-WannaCry-Hero
url: https://krebsonsecurity.com/2019/07/no-jail-time-for-wannacry-hero/
content:
<p><strong>Marcus Hutchins</strong>, the &#8220;accidental hero&#8221; who helped arrest the spread of the global WannaCry ransomware outbreak in 2017, will receive no jail time for his admitted role in authoring and selling malware that helped cyberthieves steal online bank account credentials from victims, a federal judge ruled Friday.</p>
<div id="attachment_40551" style="width: 608px" class="wp-caption aligncenter"><img class=" wp-image-40551" src="media/83b44897.hutchins.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2017/09/hutchins.png" alt="" width="598" height="298" srcset="https://krebsonsecurity.com/wp-content/uploads/2017/09/hutchins.png 622w, https://krebsonsecurity.com/wp-content/uploads/2017/09/hutchins-580x289.png 580w" sizes="(max-width: 598px) 100vw, 598px" /><p class="wp-caption-text">Marcus Hutchins, just after he was revealed as the security expert who stopped the WannaCry worm. Image: twitter.com/malwaretechblog</p></div>
<p>The British security enthusiast enjoyed instant fame after the U.K. media revealed he&#8217;d registered and <a href="https://en.wikipedia.org/wiki/DNS_sinkhole" target="_blank" rel="noopener">sinkholed</a> a domain name that researchers later understood served as a hidden &#8220;kill switch&#8221; inside <a href="https://en.wikipedia.org/wiki/WannaCry_ransomware_attack" target="_blank" rel="noopener">WannaCry</a>, a fast-spreading, highly destructive strain of ransomware which propagated through <a href="https://en.wikipedia.org/wiki/EternalBlue" target="_blank" rel="noopener">a Microsoft Windows exploit</a> developed by and subsequently stolen from the U.S. National Security Agency.</p>
<p>In August 2017, FBI agents arrested then 23-year-old Hutchins on suspicion of authoring and spreading the &#8220;<strong>Kronos</strong>&#8221; banking trojan and a related malware tool called <strong>UPAS Kit</strong>. Hutchins was released shortly after his arrest, but ordered to remain in the United States pending trial.</p>
<p>Many in the security community leaped to his defense at the time, noting that the FBI&#8217;s case appeared flimsy and that Hutchins had worked tirelessly through his blog to expose cybercriminals and their malicious tools. Hundreds of people donated to his legal defense fund.</p>
<p>In September 2017, KrebsOnSecurity <a href="https://krebsonsecurity.com/2017/09/who-is-marcus-hutchins/" target="_blank" rel="noopener">published research</a> which strongly suggested Hutchins&#8217; dozens of alter egos online had a fairly lengthy history of developing and selling various malware tools and services. In April 2019, Hutchins <a href="https://krebsonsecurity.com/2019/04/marcus-malwaretech-hutchins-pleads-guilty-to-writing-selling-banking-malware/" target="_blank" rel="noopener">pleaded guilty</a> to criminal charges of conspiracy and to making, selling or advertising illegal wiretapping devices.</p>
<p>At his sentencing hearing July 26, <strong>U.S. District Judge Joseph Peter Stadtmueller</strong> said Hutchins&#8217; action in halting the spread of WannaCry was far more consequential than the two malware strains he admitted authoring, and sentenced him to time served plus one year of supervised release. <span id="more-48369"></span></p>
<p><strong>Marcy Wheeler</strong>, an independent journalist who <a href="https://twitter.com/emptywheel/status/1154789624843329536" target="_blank" rel="noopener">live-tweeted</a> and <a href="https://www.emptywheel.net/2019/07/26/after-two-years-malwaretech-is-a-free-man/" target="_blank" rel="noopener">blogged about</a> the sentencing hearing last week, observed that prosecutors failed to show convincing evidence of specific financial losses tied to any banking trojan victims, virtually all of whom were overseas &#8212; particularly in Hutchins&#8217; home in the U.K.</p>
<p>“When it comes to matter of loss or gain,” Wheeler wrote, quoting Judge Stadtmeuller. &#8220;the most striking is comparison between you passing Kronos and WannaCry, if one looks at loss &amp; numbers of infections, over 8B throughout world w/WannaCry, and &gt;120M in UK.”</p>
<p>&#8220;This case should never have been prosecuted in the first place,&#8221; Wheeler wrote. &#8220;And when Hutchins tried to challenge the details of the case — most notably the one largely ceded today, that the government really doesn’t have evidence that 10 computers were damaged by anything Hutchins did — the government doubled down and issued a superseding indictment that, because of the false statements charge, posed a real risk of conviction.&#8221;</p>
<p>Hutchins&#8217; conviction means he will no longer be allowed to stay in or visit the United States, although Judge Stadtmeuller reportedly suggested Hutchins should seek a presidential pardon, which would enable him to return and work here.</p>
<p>&#8220;Incredibly thankful for the understanding and leniency of the judge, the wonderful character letter you all sent, and everyone who helped me through the past two years, both financially and emotionally,&#8221; Hutchins <a href="https://twitter.com/MalwareTechBlog/status/1154820057085677570" target="_blank" rel="noopener">tweeted</a> immediately after the sentencing. &#8220;Once t[h]ings settle down I plan to focus on educational blog posts and livestreams again.&#8221;</p>


feed_id: https://krebsonsecurity.com/?p=48393
title: Capital One Data Theft Impacts 106M People
uri: Capital-One-Data-Theft-Impacts-106M-People
url: https://krebsonsecurity.com/2019/07/capital-one-data-theft-impacts-106m-people/
content:
<p>Federal prosecutors this week charged a Seattle woman with stealing data from more than 100 million credit applications made with <strong>Capital One Financial Corp</strong>. Incredibly, much of this breach played out publicly over several months on social media and other open online platforms. What follows is a closer look at the accused, and what this incident may mean for consumers and businesses.</p>
<div id="attachment_48399" style="width: 273px" class="wp-caption alignright"><img class="size-full wp-image-48399" src="media/ef2b7876.paige.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/07/paige.png" alt="" width="263" height="350" /><p class="wp-caption-text">Paige &#8220;erratic&#8221; Thompson, in an undated photo posted to her Slack channel.</p></div>
<p>On July 29, FBI agents arrested <strong>Paige A. Thompson</strong> on suspicion of downloading nearly 30 GB of Capital One credit application data from a rented cloud data server. Capital One said the incident affected approximately 100 million people in the United States and six million in Canada.</p>
<p>That data included approximately 140,000 Social Security numbers and approximately 80,000 bank account numbers on U.S. consumers, and roughly 1 million Social Insurance Numbers (SINs) for Canadian credit card customers.</p>
<p>&#8220;Importantly, no credit card account numbers or log-in credentials were compromised and over 99 percent of Social Security numbers were not compromised,&#8221; Capital One said in <a href="https://www.capitalone.com/facts2019/" target="_blank" rel="noopener">a statement posted to its site</a>.</p>
<p>&#8220;The largest category of information accessed was information on consumers and small businesses as of the time they applied for one of our credit card products from 2005 through early 2019,&#8221; the statement continues. &#8220;This information included personal information Capital One routinely collects at the time it receives credit card applications, including names, addresses, zip codes/postal codes, phone numbers, email addresses, dates of birth, and self-reported income.&#8221;</p>
<p>The FBI says Capital One learned about the theft from a tip sent via email on July 17, which alerted the company that some of its leaked data was being stored out in the open on the software development platform Github. That Github account was for a user named &#8220;<strong>Netcrave</strong>,&#8221; which includes the resume and name of one Paige A. Thompson.</p>
<div id="attachment_48409" style="width: 606px" class="wp-caption aligncenter"><a class="lightbox" href="media/5f05ddf2.caponealert.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/07/caponealert.png"><img class="wp-image-48409" src="media/5f05ddf2.caponealert.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/07/caponealert.png" alt="" width="596" height="206" /></a><p class="wp-caption-text">The tip that alerted Capital One to its data breach.</p></div>
<p>The complaint doesn&#8217;t explicitly name the cloud hosting provider from which the Capital One credit data was taken, but it does say the accused&#8217;s resume states that she worked as a systems engineer at the provider between 2015 and 2016. That resume, available on Gitlab <a href="https://gitlab.com/netcrave/Resume/blob/master/cv/experience.tex" target="_blank" rel="noopener">here</a>, reveals Thompson&#8217;s most recent employer was <strong>Amazon Inc.</strong></p>
<p>Further investigation revealed that Thompson used the nickname <a href="https://twitter.com/0xA3A97B6C/with_replies" target="_blank" rel="noopener">&#8220;erratic&#8221; on Twitter</a>, where she spoke openly over several months about finding huge stores of data intended to be secured on various Amazon instances.</p>
<div id="attachment_48398" style="width: 606px" class="wp-caption aligncenter"><img class="size-full wp-image-48398" src="media/0bf2cd27.erratic-twitter.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/07/erratic-twitter.png" alt="" width="596" height="356" /><p class="wp-caption-text">The Twitter user &#8220;erratic&#8221; posting about tools and processes used to access various Amazon cloud instances.</p></div>
<p>According to the FBI, Thompson also used a public <a href="https://www.meetup.com" target="_blank" rel="noopener">Meetup</a> group under the same alias, where she invited others to join a <a href="https://www.slack.com" target="_blank" rel="noopener">Slack</a> channel named &#8220;<strong>Netcrave Communications</strong>.&#8221;</p>
<p>KrebsOnSecurity was able to join this open Slack channel Monday evening and review many months of postings apparently made by Erratic about her personal life, interests and online explorations. One of the more interesting posts by Erratic on the Slack channel is a June 27 comment listing various databases she found by hacking into improperly secured Amazon cloud instances.</p>
<p>That posting suggests Erratic may also have located tens of gigabytes of data belonging to other major corporations:</p>
<div id="attachment_48400" style="width: 609px" class="wp-caption aligncenter"><a class="lightbox" href="media/2166dc45.instances.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/07/instances.png"><img class="wp-image-48400" src="media/2166dc45.instances.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/07/instances.png" alt="" width="599" height="585" /></a><p class="wp-caption-text">According to Erratic&#8217;s posts on Slack, the two items in the list above beginning with &#8220;ISRM-WAF&#8221; belong to Capital One.</p></div>
<p><span id="more-48393"></span></p>
<p>Erratic also posted frequently to Slack about her struggles with gender identity, lack of employment, and persistent suicidal thoughts. In several conversations, Erratic makes references to running a botnet of sorts, although it is unclear how serious those claims were. Specifically, Erratic mentions one botnet involved in cryptojacking, which uses snippets of code installed on Web sites &#8212; often surreptitiously &#8212; designed to mine cryptocurrencies.</p>
<p>None of Erratic&#8217;s postings suggest Thompson sought to profit from selling the data taken from various Amazon cloud instances she was able to access. But it seems likely that at least some of that data could have been obtained by others who may have followed her activities on different social media platforms.</p>
<p><strong>Ray Watson</strong>, a cybersecurity researcher at cloud security firm <a href="https://www.masergy.com" target="_blank" rel="noopener">Masergy</a>, said the Capital One incident contains the hallmarks of many other modern data breaches.</p>
<p>&#8220;The attacker was a former employee of the web hosting company involved, which is what is often referred to as insider threats,&#8221; Watson said. &#8220;She allegedly used web application firewall credentials to obtain privilege escalation. Also the use of Tor and an offshore VPN for obfuscation are commonly seen in similar data breaches.”</p>
<p>“The good news, however, is that Capital One Incidence Response was able to move quickly once they were informed of a possible breach via their Responsible Disclosure program, which is something a lot of other companies struggle with,&#8221; he continued.</p>
<p>In Capital One&#8217;s statement about the breach, company chairman and <strong>CEO Richard D. Fairbank</strong> said the financial institution fixed the configuration vulnerability that led to the data theft and promptly began working with federal law enforcement.</p>
<p>&#8220;Based on our analysis to date, we believe it is unlikely that the information was used for fraud or disseminated by this individual,&#8221; Fairbank said. &#8220;While I am grateful that the perpetrator has been caught, I am deeply sorry for what has happened. I sincerely apologize for the understandable worry this incident must be causing those affected and I am committed to making it right.&#8221;</p>
<p>Capital One says it will notify affected individuals via a variety of channels, and make free credit monitoring and identity protection available to everyone affected.</p>
<p><em>Bloomberg</em> <a href="https://www.bloomberg.com/news/articles/2019-07-29/capital-one-data-systems-breached-by-seattle-woman-u-s-says" target="_blank" rel="noopener">reports</a> that in court on Monday, Thompson broke down and laid her head on the defense table during the hearing. She is charged with a single count of computer fraud and faces a maximum penalty of five years in prison and a $250,000 fine. Thompson will be held in custody until her bail hearing, which is set for August 1.</p>
<p>A copy of the complaint against Thompson is available <a href="https://www.justice.gov/usao-wdwa/press-release/file/1188626/download" target="_blank" rel="noopener">here</a>.</p>


feed_id: https://krebsonsecurity.com/?p=48424
title: What We Can Learn from the Capital One Hack
uri: What-We-Can-Learn-from-the-Capital-One-Hack
url: https://krebsonsecurity.com/2019/08/what-we-can-learn-from-the-capital-one-hack/
content:
<p>On Monday, a former <strong>Amazon</strong> employee was arrested and charged with <a href="https://krebsonsecurity.com/2019/07/capital-one-data-theft-impacts-106m-people/" target="_blank" rel="noopener">stealing more than 100 million consumer applications for credit from Capital One</a>. Since then, many have speculated the breach was perhaps the result of a previously unknown &#8220;zero-day&#8221; flaw, or an &#8220;insider&#8221; attack in which the accused took advantage of access surreptitiously obtained from her former employer. But new information indicates the methods she deployed have been well understood for years.</p>
<p><img class="aligncenter size-full wp-image-48436" src="media/de7e93fe.capone.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/08/capone.png" alt="" width="568" height="377" /></p>
<p>What follows is based on interviews with almost a dozen security experts, including one who is privy to details about the ongoing breach investigation. Because this incident deals with somewhat jargon-laced and esoteric concepts, much of what is described below has been dramatically simplified. Anyone seeking a more technical explanation of the basic concepts referenced here should explore some of the many links included in this story.</p>
<p>According to a source with direct knowledge of the breach investigation, the problem stemmed in part from a misconfigured <a href="https://en.wikipedia.org/wiki/ModSecurity" target="_blank" rel="noopener">open-source Web Application Firewall</a> (WAF) that Capital One was using as part of its operations hosted in the cloud with Amazon Web Services (AWS).</p>
<p>Known as &#8220;<a href="https://en.wikipedia.org/wiki/ModSecurity" target="_blank" rel="noopener">ModSecurity</a>,&#8221; this WAF is deployed along with the open-source <strong>Apache</strong> Web server to provide protections against <a href="http://www.modsecurity.org/crs/" target="_blank" rel="noopener">several classes of vulnerabilities</a> that attackers most commonly use to compromise the security of Web-based applications.</p>
<p>The misconfiguration of the WAF allowed the intruder to trick the firewall into relaying requests to a key back-end resource on the AWS platform. This resource, known as the <a href="https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-instance-metadata.html" target="_blank" rel="noopener">&#8220;metadata&#8221; service</a>, is responsible for handing out temporary information to a cloud server, including current credentials sent from a security service to access any resource in the cloud to which that server has access.</p>
<p>In AWS, exactly what those credentials can be used for hinges on the permissions assigned to <a href="https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-roles-for-amazon-ec2.html" target="_blank" rel="noopener">the resource that is requesting them</a>. In Capital One&#8217;s case, the misconfigured WAF for whatever reason was assigned too many permissions, i.e. it was allowed to list all of the files in any buckets of data, and to read the contents of each of those files.</p>
<p>The type of vulnerability exploited by the intruder in the Capital One hack is a well-known method called a &#8220;<a href="https://www.hackerone.com/blog-How-To-Server-Side-Request-Forgery-SSRF" target="_blank" rel="noopener">Server Side Request Forgery</a>&#8221; (SSRF) attack, in which a server (in this case, CapOne&#8217;s WAF) can be tricked into running commands that it should never have been permitted to run, including those that allow it to talk to the metadata service.</p>
<p><a href="https://www.linkedin.com/in/ejcxx/" target="_blank" rel="noopener">Evan Johnson</a>, manager of the product security team at <strong>Cloudflare</strong>, recently <a href="https://ejj.io/blog/capital-one" target="_blank" rel="noopener">penned an easily digestible column</a> on the Capital One hack and the challenges of detecting and blocking SSRF attacks targeting cloud services. Johnson said it&#8217;s worth noting that SSRF attacks are not among <a href="http://www.modsecurity.org/crs/" target="_blank" rel="noopener">the dozen or so attack methods</a> for which detection rules are shipped by default in the WAF exploited as part of the Capital One intrusion.</p>
<p><span class="pullquote pqright">&#8220;SSRF has become the most serious vulnerability facing organizations that use public clouds,&#8221; Johnson wrote.</span> &#8220;The impact of SSRF is being worsened by the offering of public clouds, and the major players like AWS are not doing anything to fix it. The problem is common and well-known, but hard to prevent and does not have any mitigations built into the AWS platform.&#8221;</p>
<p>Johnson said AWS could address this shortcoming by including extra identifying information in any request sent to the metadata service, as Google has already done with its cloud hosting platform. He also acknowledged that doing so could break a lot of backwards compatibility within AWS.</p>
<p>&#8220;There&#8217;s a lot of specialized knowledge that comes with operating a service within AWS, and to someone without specialized knowledge of AWS, [SSRF attacks are] not something that would show up on any critical configuration guide,&#8221; Johnson said in an interview with KrebsOnSecurity.</p>
<p>&#8220;You have to learn how EC2 works, understand Amazon&#8217;s Identity and Access Management (IAM) system, and how to authenticate with other AWS services,&#8221; he continued. &#8220;A lot of people using AWS will interface with dozens of AWS services and write software that orchestrates and automates new services, but in the end people really lean into AWS a ton, and with that comes a lot of specialized knowledge that is hard to learn and hard to get right.&#8221;</p>
<p>In a statement provided to KrebsOnSecurity, Amazon said it is inaccurate to argue that the Capital One breach was caused by AWS IAM, the instance metadata service, or the AWS WAF in any way.</p>
<p>&#8220;The intrusion was caused by a misconfiguration of a web application firewall and not the underlying infrastructure or the location of the infrastructure,&#8221; the statement reads. &#8220;AWS is constantly delivering services and functionality to anticipate new threats at scale, offering more security capabilities and layers than customers can find anywhere else including within their own datacenters, and when broadly used, properly configured and monitored, offer unmatched security—and the track record for customers over 13+ years in securely using AWS provides unambiguous proof that these layers work.&#8221;</p>
<p>Amazon pointed to several (mostly a la carte) services it offers AWS customers to help mitigate many of the threats that were key factors in this breach, including:</p>
<p>&#8211;<a href="https://aws.amazon.com/about-aws/whats-new/2019/06/now-use-iam-access-advisor-with-aws-organizations-to-set-permission-guardrails-confidently/" target="_blank" rel="noopener">Access Advisor</a>, which helps identify and scope down AWS roles that may have more permissions than they need;<br />
&#8211;<a href="https://aws.amazon.com/guardduty/" target="_blank" rel="noopener">GuardDuty</a>, designed to raise alarms when someone is scanning for potentially vulnerable systems or moving unusually large amounts of data to or from unexpected places;<br />
&#8211;<a href="https://aws.amazon.com/waf/" target="_blank" rel="noopener">The AWS WAF</a>, which Amazon says can detect common exploitation techniques, including SSRF attacks;<br />
&#8211;<a href="https://aws.amazon.com/macie/" target="_blank" rel="noopener">Amazon Macie</a>, designed to automatically discover, classify and protect sensitive data stored in AWS.</p>
<p><a href="https://www.linkedin.com/in/william-bengtson/" target="_blank" rel="noopener">William Bengston</a>, formerly a senior security engineer at <strong>Netflix</strong>, wrote a series of blog posts last year on how Netflix built its own systems for <a href="https://medium.com/netflix-techblog/netflix-cloud-security-detecting-credential-compromise-in-aws-9493d6fd373a" target="_blank" rel="noopener">detecting</a> and <a href="https://medium.com/netflix-techblog/netflix-information-security-preventing-credential-compromise-in-aws-41b112c15179" target="_blank" rel="noopener">preventing</a> credential compromises in AWS. Interestingly, Bengston was hired roughly two months ago to be director of cloud security for Capital One. My guess is Capital One now wishes they had somehow managed to lure him away sooner.<span id="more-48424"></span></p>
<p><a href="https://www.linkedin.com/in/richmogull/" target="_blank" rel="noopener">Rich Mogull</a> is founder and chief technology officer with <a href="https://disruptops.com/breaking-attacker-kill-chains-in-aws-iam-roles/" target="_blank" rel="noopener">DisruptOPS</a>, a firm that helps companies secure their cloud infrastructure. Mogull said one major challenge for companies moving their operations from sprawling, expensive physical data centers to the cloud is that very often the employees responsible for handling that transition are application and software developers who may not be as steeped as they should in security.</p>
<p>&#8220;There is a basic skills and knowledge gap that everyone in the industry is fighting to deal with right now,&#8221; Mogull said. &#8220;For these big companies making that move, they have to learn all this new stuff while maintaining their old stuff. I can get you more secure in the cloud more easily than on-premise at a physical data center, but there&#8217;s going to be a transition period as you&#8217;re acquiring that new knowledge.&#8221;</p>
<div id="attachment_48457" style="width: 602px" class="wp-caption aligncenter"><img class=" wp-image-48457" src="media/c1a5a4e8.devops.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/08/devops.png" alt="" width="592" height="377" /><p class="wp-caption-text">Image: Capital One</p></div>
<p>Since news of the Capital One breach broke on Monday, KrebsOnSecurity has received numerous emails and phone calls from security executives who are desperate for more information about how they can avoid falling prey to the missteps that led to this colossal breach (indeed, those requests were part of the impetus behind this story).</p>
<p>Some of those people included executives at big competing banks that haven&#8217;t yet taken the plunge into the cloud quite as deeply as Capital One has. But it&#8217;s probably not much of a stretch to say they&#8217;re all lining up in front of the diving board.</p>
<p>It&#8217;s been interesting to watch over the past couple of years how various cloud providers have responded to major outages on their platforms &#8212; very often soon after publishing detailed post-mortems on the underlying causes of the outage and what they are doing to prevent such occurrences in the future. In the same vein, it would be wonderful if this kind of public accounting extended to other big companies in the wake of a massive breach.</p>
<p>I&#8217;m not holding out much hope that we will get such detail officially from Capital One, which declined to comment on the record and referred me to <a href="https://www.capitalone.com/facts2019/" target="_blank" rel="noopener">their statement on the breach</a> and to the <a href="https://www.justice.gov/usao-wdwa/press-release/file/1188626/download" target="_blank" rel="noopener">Justice Department&#8217;s complaint</a> against the hacker. That&#8217;s probably to be expected, seeing as the company is <a href="https://finance.yahoo.com/news/capital-one-had-ample-warnings-of-weaknesses-and-risks-lawsuit-181832372.html" target="_blank" rel="noopener">already facing a class action lawsuit over the breach</a> and is likely to be targeted by more lawsuits going forward.</p>
<p>But as long as the public and private response to data breaches remains orchestrated primarily by attorneys (which is certainly the case now at most major corporations), everyone else will continue to lack the benefit of being able to learn from and avoid those same mistakes.</p>


feed_id: https://krebsonsecurity.com/?p=48391
title: The Risk of Weak Online Banking Passwords
uri: The-Risk-of-Weak-Online-Banking-Passwords
url: https://krebsonsecurity.com/2019/08/the-risk-of-weak-online-banking-passwords/
content:
<p>If you bank online and choose weak or re-used passwords, there&#8217;s a decent chance your account could be pilfered by cyberthieves &#8212; even if your bank offers multi-factor authentication as part of its login process. This story is about how crooks increasingly are abusing third-party financial aggregation services like <a href="https://www.mint.com" target="_blank" rel="noopener">Mint</a>, <a href="https://www.plaid.com" target="_blank" rel="noopener">Plaid</a>, <a href="https://www.yodlee.com" target="_blank" rel="noopener">Yodlee</a><strong>, </strong><a href="https://www.youneedabudget.com/" target="_blank" rel="noopener">YNAB</a> and others to surveil and drain consumer accounts online.</p>
<p>Crooks are constantly probing bank Web sites for customer accounts protected by weak or recycled passwords. Most often, the attacker will use lists of email addresses and passwords stolen en masse from hacked sites and then try those same credentials to see if they permit online access to accounts at a range of banks.</p>
<div id="attachment_48470" style="width: 592px" class="wp-caption aligncenter"><img class=" wp-image-48470" src="media/ecb9675f.chasebrute-ed2.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/08/chasebrute-ed2.png" alt="" width="582" height="342" /><p class="wp-caption-text">A screenshot of a password-checking tool being used to target Chase Bank customers who re-use passwords from other sites. Image: Hold Security.</p></div>
<p>From there, thieves can take the list of successful logins and feed them into apps that rely on application programming interfaces (API)s from one of several personal financial data aggregators which help users track their balances, budgets and spending across multiple banks.</p>
<p>A number of banks that do offer customers multi-factor authentication &#8212; such as a one-time code sent via text message or an app &#8212; have chosen to allow these aggregators the ability to view balances and recent transactions without requiring that the aggregator service supply that second factor. That&#8217;s according to <a href="https://www.linkedin.com/in/brian-costello-7115677/" target="_blank" rel="noopener">Brian Costello</a>, vice president of data strategy at Yodlee, one of the largest financial aggregator platforms.</p>
<p>Costello said while some banks have implemented processes which pass through multi-factor authentication (MFA) prompts when consumers wish to link aggregation services, many have not.</p>
<p>&#8220;Because we have become something of a known quantity with the banks, we&#8217;ve set up turning off MFA with many of them,&#8221; Costello said.  &#8220;Many of them are substituting coming from a Yodlee IP or agent as a factor because banks have historically been relying on our security posture to help them out.&#8221;</p>
<p>Such reconnaissance helps lay the groundwork for further attacks: If the thieves are able to access a bank account via an aggregator service or API, they can view the customer&#8217;s balance(s) and decide which customers are worthy of further targeting.</p>
<p>This targeting can occur in at least one of two ways. The first involves spear phishing attacks to gain access to that second authentication factor, which can be made much more convincing once the attackers have access to specific details about the customer&#8217;s account &#8212; such as recent transactions or account numbers (even partial account numbers).</p>
<p>The second is through <a href="https://krebsonsecurity.com/?s=sim+swap&amp;x=0&amp;y=0" target="_blank" rel="noopener">an unauthorized SIM swap</a>, a form of fraud in which scammers bribe or trick employees at mobile phone stores into seizing control of the target’s phone number and diverting all texts and phone calls to the attacker’s mobile device.</p>
<p>But beyond targeting customers for outright account takeovers, the data available via financial aggregators enables a far more insidious type of fraud: <em>The ability to link the target&#8217;s bank account(s) to other accounts that the attackers control.</em></p>
<p>That&#8217;s because <strong>PayPal</strong>, <strong>Zelle</strong>, and a number of other pure-play online financial institutions allow customers to link accounts by verifying the value of microdeposits. For example, if you wish to be able to transfer funds between PayPal and a bank account, the company will first send a couple of tiny deposits  &#8212; a few cents, usually &#8212; to the account you wish to link. Only after verifying those exact amounts will the account-linking request be granted.<span id="more-48391"></span></p>
<p><strong>Alex Holden</strong> is founder and chief technology officer of <a href="https://www.holdsecurity.com" target="_blank" rel="noopener">Hold Security</a>, a Milwaukee-based security consultancy. Holden and his team closely monitor the cybercrime forums, and he said the company has seen a number of cybercriminals discussing how the financial aggregators are useful for targeting potential victims.</p>
<p>Holden said it&#8217;s not uncommon for thieves in these communities to resell access to bank account balance and transaction information to other crooks who specialize in cashing out such information.</p>
<p>&#8220;The price for these details is often very cheap, just a fraction of the monetary value in the account, because they&#8217;re not selling &#8216;final&#8217; access to the account,&#8221; Holden said. &#8220;If the account is active, hackers then can go to the next stage for 2FA phishing or social engineering, or linking the accounts with another.&#8221;</p>
<p>Currently, the major aggregators and/or applications that use those platforms store bank logins and interactively log in to consumer accounts to periodically sync transaction data. But most of the financial aggregator platforms are slowly shifting toward using the <a href="https://en.wikipedia.org/wiki/OAuth" target="_blank" rel="noopener">OAuth standard</a> for logins, which can give banks a greater ability to enforce their own fraud detection and transaction scoring systems when aggregator systems and apps are initially linked to a bank account.</p>
<p>That&#8217;s according to <a href="https://www.linkedin.com/in/doncardinal/" target="_blank" rel="noopener">Don Cardinal</a>, managing director of the <strong>Financial Data Exchange </strong>(FDX), which is seeking to <span class="lt-line-clamp__line">unite the financial industry around a common, interoperable, and </span><span class="lt-line-clamp__line lt-line-clamp__line--last">royalty-free standard for secure consumer and business access to their financial data.</span></p>
<p>&#8220;This is where we&#8217;re going,&#8221; Cardinal said. &#8220;The way it works today, you the aggregator or app stores the credentials encrypted and presents them to the bank. What we&#8217;re moving to is [an account linking process] that interactively loads the bank&#8217;s Web site, you login there, and the site gives the aggregator an OAuth token. In that token granting process, all the bank&#8217;s fraud controls are then direct to the consumer.&#8221;</p>
<p><strong>Alissa Knight</strong>, a senior analyst with the <a href="https://www.aitegroup.com" target="_blank" rel="noopener">Aite Group</a>, a financial and technology analyst firm, said such attacks highlight the need to get rid of passwords altogether. But until such time, she said, more consumers should take full advantage of <a href="https://twofactorauth.org/#banking" target="_blank" rel="noopener">the strongest multi-factor authentication option offered by their bank(s)</a>, and consider using a password manager, which helps users pick and remember strong and unique passwords for each Web site.</p>
<p>&#8220;This is just more empirical data around the fact that passwords just need to go away,&#8221; Knight said. &#8220;For now, all the standard precautions we&#8217;ve been giving consumers for years still stand: Pick strong passwords, avoid re-using passwords, and get a password manager.&#8221;</p>
<p>Some of the most popular password managers include <a href="https://1password.com/sign-up/" target="_blank" rel="noopener">1Password</a>, <a href="https://www.dashlane.com/plans" target="_blank" rel="noopener">Dashlane</a>, <a href="https://www.lastpass.com/pricing" target="_blank" rel="noopener">LastPass</a> and <a href="https://keepassxc.org/download/" target="_blank" rel="noopener">Keepass</a>. <em>Wired.com</em> recently <a href="https://www.wired.com/story/best-password-managers/" target="_blank" rel="noopener">published a worthwhile writeup</a> which breaks down each of these based on price, features and usability.</p>


feed_id: https://krebsonsecurity.com/?p=48512
title: Who Owns Your Wireless Service? Crooks Do.
uri: Who-Owns-Your-Wireless-Service-Crooks-Do
url: https://krebsonsecurity.com/2019/08/who-owns-your-wireless-service-crooks-do/
content:
<p>Incessantly annoying and fraudulent robocalls. Corrupt wireless company employees taking hundreds of thousands of dollars in bribes to unlock and hijack mobile phone service. Wireless providers selling real-time customer location data, despite repeated promises to the contrary. A noticeable uptick in SIM-swapping attacks that lead to multi-million dollar cyberheists.</p>
<p>If you are somehow under the impression that you &#8212; the customer &#8212; are in control over the security, privacy and integrity of your mobile phone service, think again. And you&#8217;d be forgiven if you assumed the major wireless carriers or federal regulators had their hands firmly on the wheel.</p>
<p><img class="aligncenter wp-image-40415" src="media/618d5447.phonefraudsmaller.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2017/08/phonefraudsmaller.png" alt="" width="591" height="298" srcset="https://krebsonsecurity.com/wp-content/uploads/2017/08/phonefraudsmaller.png 609w, https://krebsonsecurity.com/wp-content/uploads/2017/08/phonefraudsmaller-580x292.png 580w" sizes="(max-width: 591px) 100vw, 591px" /></p>
<p>No, a series of recent court cases and unfortunate developments highlight the sad reality that the wireless industry today has all but ceded control over this vital national resource to cybercriminals, scammers, corrupt employees and plain old corporate greed.</p>
<p>On Tuesday, Google announced that an unceasing deluge of automated robocalls had doomed a feature of its <a href="https://voice.google.com" target="_blank" rel="noopener">Google Voice</a> service that sends transcripts of voicemails via text message.</p>
<p>Google <a href="https://twitter.com/briankrebs/status/1158755866247663616" target="_blank" rel="noopener">said</a> &#8220;certain carriers&#8221; are blocking the delivery of these messages because all too often the transcripts resulted from unsolicited robocalls, and that as a result the feature would be discontinued by Aug. 9. This is especially rich given that one big reason people use Google Voice in the first place is to screen unwanted communications from robocalls, mainly because the major wireless carriers have shown themselves incapable or else unwilling to do much to stem the tide of robocalls targeting their customers.</p>
<p>AT&amp;T in particular has had a rough month. In July, the <a href="https://www.eff.org" target="_blank" rel="noopener">Electronic Frontier Foundation</a> (EFF) filed a class action lawsuit on behalf of AT&amp;T customers in California to stop the telecom giant and two data location aggregators from allowing numerous entities &#8212; including bounty hunters, car dealerships, landlords and stalkers &#8212; to <a href="https://krebsonsecurity.com/2018/05/why-is-your-location-data-no-longer-private/" target="_blank" rel="noopener">access wireless customers&#8217; real-time locations without authorization</a>.</p>
<p>And on Monday, the <strong>U.S. Justice Department</strong> revealed that a Pakistani man was <a href="https://www.justice.gov/usao-wdwa/pr/leader-conspiracy-illegally-unlock-cell-phones-profit-extradited-hong-kong" target="_blank" rel="noopener">arrested and extradited to the United States</a> to face charges of bribing numerous <strong>AT&amp;T</strong> call-center employees to install malicious software and unauthorized hardware as part of a scheme to fraudulently unlock cell phones.</p>
<p>Ars Technica <a href="https://arstechnica.com/tech-policy/2019/08/att-employees-took-bribes-to-unlock-phones-and-plant-malware-doj-says/" target="_blank" rel="noopener">reports</a> the scam resulted in millions of phones being removed from AT&amp;T service and/or payment plans, and that the accused allegedly paid insiders hundreds of thousands of dollars to assist in the process.</p>
<p>We should all probably be thankful that the defendant in this case wasn&#8217;t using his considerable access to aid criminals who specialize in conducting <a href="https://krebsonsecurity.com/?s=sim+swap&amp;x=0&amp;y=0" target="_blank" rel="noopener">unauthorized SIM swaps</a>, an extraordinarily invasive form of fraud in which scammers bribe or trick employees at mobile phone stores into seizing control of the target’s phone number and diverting all texts and phone calls to the attacker’s mobile device.</p>
<p>Late last month, a federal judge in New York <a href="https://thenextweb.com/hardfork/2019/07/23/att-sim-swap-cryptocurrency-truglia-terpin-federal-court-judge-224m-lawsuit/" target="_blank" rel="noopener">rejected a request by AT&amp;T</a> to dismiss <a href="https://krebsonsecurity.com/2018/08/hanging-up-on-mobile-in-the-name-of-security/" target="_blank" rel="noopener">a $224 million lawsuit over a SIM-swapping incident that led to $24 million in stolen cryptocurrency</a>.</p>
<p>The defendant in that case, <a href="https://krebsonsecurity.com/2019/01/stole-24-million-but-still-cant-keep-a-friend/" target="_blank" rel="noopener">21-year-old Manhattan resident Nicholas Truglia</a>, is alleged to have stolen more than $80 million from victims of SIM swapping, but he is only one of many individuals involved in this incredibly easy, increasingly common and lucrative scheme. The plaintiff in that case alleges that he was SIM-swapped on two different occasions, both allegedly involving crooked or else clueless employees at AT&amp;T wireless stores.</p>
<p>And let&#8217;s not forget about <a href="https://motherboard.vice.com/en_us/article/wjx3e4/t-mobile-website-allowed-hackers-to-access-your-account-data-with-just-your-phone-number" target="_blank" rel="noopener">all the</a> <a href="https://www.vice.com/en_us/article/a3qpk5/t-mobile-hack-data-breach-api-customer-data?utm_source=reddit.com" target="_blank" rel="noopener">times</a> various hackers figured out ways to <a href="https://krebsonsecurity.com/2018/11/bug-bounty-hunter-ran-isp-doxing-service/" target="_blank" rel="noopener">remotely use a carrier&#8217;s own internal systems</a> for looking up personal and account information on wireless subscribers.</p>
<p>So what the fresh hell is going on here? And is there any hope that lawmakers or regulators will do anything about these persistent problems? <strong>Gigi Sohn</strong>, a distinguished fellow at the <a href="https://www.georgetowntech.org/" target="_blank" rel="noopener">Georgetown Institute for Technology Law and Policy</a>, said the answer &#8212; at least in this administration &#8212; is probably a big &#8220;no.&#8221;</p>
<p>&#8220;The takeaway here is the complete and total abdication of any oversight of the mobile wireless industry,&#8221; Sohn told KrebsOnSecurity. &#8220;Our enforcement agencies aren&#8217;t doing anything on these topics right now, and we have a complete and total breakdown of oversight of these incredibly powerful and important companies.&#8221;<span id="more-48512"></span></p>
<p><strong>Aaron Mackey</strong>, a staff attorney at the EFF, said that on the location data-sharing issue, federal law already bars the wireless carriers from sharing this with third parties without the expressed consent of consumers.</p>
<p>&#8220;What we&#8217;ve seen is the <strong>Federal Communications Commission</strong> (FCC) is well aware of this ongoing behavior about location data sales,&#8221; Mackey said. &#8220;The FCC has said it&#8217;s under investigation, but there has been no public action taken yet and this has been going on for more than a year. The major wireless carriers are not only violating federal law, but they&#8217;re also putting people in harm&#8217;s way. There are countless stories of folks being able to pretend to be law enforcement and gaining access to information they can use to assault and harass people based on the carriers making location data available to a host of third parties.&#8221;</p>
<p>On the issue of illegal SIM swaps, Wired recently ran a column pointing to a solution that many carriers in Africa have implemented which makes it much more difficult for SIM swap thieves to ply their craft.</p>
<p>&#8220;The carrier would set up a system to let the bank query phone records for any recent SIM swaps associated with a bank account before they carried out a money transfer,&#8221; <a href="https://www.wired.com/story/sim-swap-fix-carriers-banks/" target="_blank" rel="noopener">wrote</a> Wired&#8217;s <strong>Andy Greenberg</strong> in April. &#8220;If a SIM swap had occurred in, say, the last two or three days, the transfer would be blocked. Because SIM swap victims can typically see within minutes that their phone has been disabled, that window of time let them report the crime before fraudsters could take advantage.&#8221;</p>
<p>So far, there is zero indication that the U.S.-based mobile carriers are paying any attention.</p>
<p>In terms of combating the deluge of robocalls, Sohn says we already have a workable approach to arresting these nuisance calls: It&#8217;s an authentication procedure known as &#8220;<a href="http://nymag.com/intelligencer/2018/05/how-to-stop-spam-robocalls-with-stir-shaken.html" target="_blank" rel="noopener">SHAKEN/STIR</a>,&#8221; and it is premised on the idea that every phone has a certificate of authenticity attached to it that can be used to validate if the call is indeed originating from the number it appears to be calling from.</p>
<p>Under a SHAKEN/STIR regime, anyone who is spoofing their number (and most of these robocalls are spoofed to appear as though they come from a number that is in the same prefix as yours) gets automatically blocked.</p>
<p>Unfortunately, Sohn said, the FCC has allowed the wireless carriers to adopt this approach voluntarily. And &#8212; shocker &#8212; most of them haven&#8217;t, or else they are charging a premium for it.</p>
<p>&#8220;The FCC could make the carriers provide robocall apps for free to customers, but they&#8217;re not,&#8221; Sohn said. &#8220;The carriers instead are turning around and charging customers extra for this service. There was a fairly strong anti-robocalls bill that passed the House, but it&#8217;s now stuck in the legislative graveyard that is the Senate.&#8221;</p>
<p>What about the prospects of any kind of major overhaul to the privacy laws in this country that might give consumers more say over who can access their private data and what recourse they may have when companies entrusted with that information screw up?</p>
<p>Sohn said there are few signs that anyone in Congress is seriously championing consumer privacy as a major legislative issue. Most of the nascent efforts to bring privacy laws in the United States into the 21st Century she said are interminably bogged down on two sticky issues: Federal preemption of stronger state laws, and the ability of consumers to bring a private right of civil action in the courts against companies that violate those provisions.</p>
<p>&#8220;It&#8217;s way past time we had a federal privacy bill,&#8221; Sohn said. &#8220;Companies like Facebook and others are practically begging for some type of regulatory framework on consumer privacy, yet this congress can&#8217;t manage to put something together. To me it&#8217;s incredible we don&#8217;t even have a discussion draft yet. There&#8217;s not even a bill that&#8217;s being discussed and debated. That is really pitiful, and the closer we get to elections, the less likely it becomes because nobody wants to do anything that upsets their corporate contributions. And, frankly, that&#8217;s shameful.&#8221;</p>


feed_id: https://krebsonsecurity.com/?p=48532
title: iNSYNQ Ransom Attack Began With Phishing Email
uri: iNSYNQ-Ransom-Attack-Began-With-Phishing-Email
url: https://krebsonsecurity.com/2019/08/insynq-ransom-attack-began-with-phishing-email/
content:
<p>A ransomware outbreak that hit <a href="https://krebsonsecurity.com/2019/07/quickbooks-cloud-hosting-firm-insynq-hit-in-ransomware-attack/" target="_blank" rel="noopener">QuickBooks cloud hosting firm iNSYNQ in mid-July</a> appears to have started with an email phishing attack that snared an employee working in sales for the company, KrebsOnSecurity has learned. It also looks like the intruders spent roughly ten days rooting around iNSYNQ&#8217;s internal network to properly stage things before unleashing the ransomware. iNSYNQ ultimately declined to pay the ransom demand, and it is still working to completely restore customer access to files.</p>
<p><img class="aligncenter size-full wp-image-48090" src="media/52678f94.cloudrain.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/06/cloudrain.jpg" alt="" width="596" height="373" /></p>
<p>Some of this detail came in a virtual &#8220;town hall&#8221; meeting held August 8, in which iNSYNQ chief executive <strong>Elliot Luchansky</strong> briefed customers on how it all went down, and what the company is doing to prevent such outages in the future.</p>
<p>A great many iNSYNQ&#8217;s customers are accountants, and when the company took its network offline on July 16 in response to the ransomware outbreak, some of those customers took to social media to complain that iNSYNQ was stonewalling them.</p>
<p>&#8220;We could definitely have been better prepared, and it&#8217;s totally unacceptable,&#8221; Luchansky told customers. &#8220;I take full responsibility for this. People waiting ridiculous amounts of time for a response is unacceptable.&#8221;</p>
<p>By way of explaining iNSYNQ&#8217;s initial reluctance to share information about the particulars of the attack early on, Luchansky told customers the company had to assume the intruders were watching and listening to everything iNSYNQ was doing to recover operations and data in the wake of the ransomware outbreak.</p>
<p>&#8220;That was done strategically for a good reason,&#8221; he said. &#8220;There were human beings involved with [carrying out] this attack in real time, and we had to assume they were monitoring everything we could say. And that posed risks based on what we did say publicly while the ransom negotiations were going on. It could have been used in a way that would have exposed customers even more. That put us in a really tough bind, because transparency is something we take very seriously. But we decided it was in our customers&#8217; best interests to not do that.&#8221;</p>
<div id="attachment_48541" style="width: 609px" class="wp-caption aligncenter"><img class="size-full wp-image-48541" src="media/224da4fb.insynq-ad.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/08/insynq-ad.png" alt="" width="599" height="104" /><p class="wp-caption-text">A paid ad that comes up prominently when one searches for &#8220;insynq&#8221; in Google.</p></div>
<p>Luchansky did not say how much the intruders were demanding, but he mentioned two key factors that informed the company&#8217;s decision not to pay up.</p>
<p>&#8220;It was a very substantial amount, but we had the money wired and were ready to pay it in cryptocurrency in the case that it made sense to do so,&#8221; he told customers. &#8220;But we also understood [that paying] would put a target on our heads in the future, and even if we actually received the decryption key, that wasn&#8217;t really the main issue here. Because of the quick reaction we had, we were able to contain the encryption part&#8221; to roughly 50 percent of customer systems, he said.</p>
<p>Luchansky said the intruders seeded its internal network with <strong>MegaCortex</strong>, a potent new ransomware strain first spotted just a couple of months ago that is being used in targeted attacks on enterprises. He said the attack appears to have been carefully planned out in advance and executed &#8220;with human intervention all the way through.&#8221;</p>
<p>&#8220;They decided they were coming after us,&#8221; he said. &#8220;It&#8217;s one thing to prepare for these sorts of events but it&#8217;s an entirely different experience to deal with first hand.&#8221;</p>
<p>According to <a href="https://www.accenture.com/us-en/blogs/blogs-megacortex-business-disruption" target="_blank" rel="noopener">an analysis of MegaCortex published this week by Accenture iDefense</a>, the crooks behind this ransomware strain are targeting businesses &#8212; not home users &#8212; and demanding ransom payments in the range of two to 600 bitcoins, which is roughly $20,000 to $5.8 million.</p>
<p>&#8220;We are working for profit,&#8221; reads the ransom note left behind by the latest version of MegaCortex. &#8220;The core of this criminal business is to give back your valuable data in the original form (for ransom of course).”</p>
<div id="attachment_48536" style="width: 603px" class="wp-caption aligncenter"><img class=" wp-image-48536" src="media/b6022b0a.megacortexnote.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/08/megacortexnote.png" alt="" width="593" height="392" /><p class="wp-caption-text">A portion of the ransom note left behind by the latest version of MegaCortex. Image: Accenture iDefense.</p></div>
<p><span id="more-48532"></span>Luchansky did not mention in the town hall meeting exactly when the initial phishing attack was thought to have occurred, noting that iNSYNQ is still working with California-based <a href="https://www.crowdstrike.com" target="_blank" rel="noopener">CrowdStrike</a> to gain a more complete picture of the attack.</p>
<p>But <strong>Alex Holden</strong>, founder of Milwaukee-based cyber intelligence firm <a href="https://www.holdsecurity.com" target="_blank" rel="noopener">Hold Security</a>, showed KrebsOnSecurity information obtained from monitoring dark web communications which suggested the problem started on July 6, after an employee in iNSYNQ&#8217;s sales division fell for a targeted phishing email.</p>
<p><span class="pullquote pqleft">&#8220;This shows that even after the initial infection, if companies act promptly they can still detect and stop the ransomware,&#8221; Holden said. &#8220;For these infections hackers take sometimes days, weeks, or even months to encrypt your data.&#8221;</span></p>
<p>iNSYNQ did not respond to requests for comment on Hold Security&#8217;s findings.</p>
<p>Asked whether the company had backups of customer data and &#8212; if so &#8212; why iNSYNQ decided not to restore from those, Luchansky said there were backups but that some of those were also infected.</p>
<p>&#8220;The backup system is backing up the primary system, and that by definition entails some level of integration,&#8221; Luchansky explained. &#8220;The way our system was architected, the malware had spread into the backups as well, at least a little bit. So [by] just turning the backups back on, there was a good chance the the virus would then start to spread through the backup system more. So we had to treat the backups similarly to how we were treating the primary systems.&#8221;</p>
<p>Luchansky said their backup system has since been overhauled, and that if a similar attack happened in the future it would take days instead of weeks to recover. However, he declined to get into specifics about exactly what had changed, which is too bad because in every ransomware attack story I&#8217;ve written this seems to be the detail most readers are interested in and arguing about.</p>
<p>The CEO added that iNSYNQ also will be partnering with a company that helps firms detect and block targeted phishing attacks, and that it envisioned being able to offer this to its customers at a discounted rate. It wasn&#8217;t clear from Luchansky&#8217;s responses to questions whether the cloud hosting firm was also considering any kind of <a href="https://krebsonsecurity.com/2019/05/should-failing-phish-tests-be-a-fireable-offense/" target="_blank" rel="noopener">employee anti-phishing education and/or testing service</a>.</p>
<p>Luchansky said iNSYNQ was about to restore access to more than 90 percent of customer files by Aug. 2 &#8212; roughly two weeks after the ransomware outbreak &#8212; and that the company would be offering customers a two month credit as a result of the outage.</p>


feed_id: https://krebsonsecurity.com/?p=48545
title: SEC Investigating Data Leak at First American Financial Corp.
uri: SEC-Investigating-Data-Leak-at-First-American-Financial-Corp
url: https://krebsonsecurity.com/2019/08/sec-investigating-data-leak-at-first-american-financial-corp/
content:
<p>The <strong>U.S. Securities and Exchange Commissio</strong>n (SEC) is investigating a security failure on the Web site of real estate title insurance giant <strong>First American Financial Corp.</strong> that exposed more than 885 million personal and financial records tied to mortgage deals going back to 2003, KrebsOnSecurity has learned.</p>
<div id="attachment_47830" style="width: 605px" class="wp-caption aligncenter"><img class=" wp-image-47830" src="media/e0ba395a.firstamericanfinancial.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/05/firstamericanfinancial.jpg" alt="" width="595" height="354" /><p class="wp-caption-text">First American Financial Corp.</p></div>
<p>In May, KrebsOnSecurity broke the news that the Web site for Santa Ana, Calif.-based First American [<a href="https://www.marketbeat.com/stocks/NYSE/FAF/" target="_blank" rel="noopener">NYSE:FAF</a>] <a href="https://krebsonsecurity.com/2019/05/first-american-financial-corp-leaked-hundreds-of-millions-of-title-insurance-records/" target="_blank" rel="noopener">exposed some 885 million documents</a> related to real estate closings over the past 16 years, including bank account numbers and statements, mortgage and tax records, Social Security numbers, wire transaction receipts and drivers license images. No authentication was required to view the documents.</p>
<p>The initial tip on that story came from <strong>Ben Shoval</strong>, a real estate developer based in Seattle. Shoval said he recently received a letter from the SEC&#8217;s enforcement division which stated the agency was investigating the data exposure to determine if First American had violated federal securities laws.</p>
<p>In its letter, the SEC asked Shoval to preserve and share any documents or evidence he had related to the data exposure.</p>
<p>&#8220;This investigation is a non-public, fact-finding inquiry,&#8221; the letter explained. &#8220;The investigation does not mean that we have concluded that anyone has violated the law.&#8221;</p>
<p><img class="aligncenter wp-image-48565" src="media/f6c899bf.sec-faf-red.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/08/sec-faf-red.png" alt="" width="595" height="462" /></p>
<p>The SEC did not respond to requests for comment.</p>
<p>Word of the SEC investigation comes weeks after <a href="https://krebsonsecurity.com/2019/05/ny-investigates-exposure-of-885-million-mortgage-documents/" target="_blank" rel="noopener">regulators in New York said they were investigating the company</a> in what could turn out to be the first test of the state&#8217;s strict new cybersecurity regulation, which requires financial companies to periodically audit and report on how they protect sensitive data, and provides for fines in cases where violations were reckless or willful. First American also is now <a href="https://www.bloomberg.com/news/articles/2019-05-28/first-american-financial-sued-over-alleged-client-data-breach" target="_blank" rel="noopener">the target of a class action lawsuit</a> that alleges it &#8220;failed to implement even rudimentary security measures.&#8221;<span id="more-48545"></span></p>
<p>First American has issued a series of statements over the past few months that seem to downplay the severity of the data exposure, which the company said was the result of a &#8220;design defect&#8221; in its Web site.</p>
<p>On June 18, First American <a href="https://www.firstam.com/incidentupdate/update20190618.html" target="_blank" rel="noopener">said</a> a review of system logs by an outside forensic firm, &#8220;based on guidance from the company, identified 484 files that likely were accessed by individuals without authorization. The company has reviewed 211 of these files to date and determined that only 14 (or 6.6%) of those files contain non-public personal information. The company is in the process of notifying the affected consumers and will offer them complimentary credit monitoring services.&#8221;</p>
<p>In a statement on July 16, First American said its now-completed investigation <a href="https://www.firstam.com/incidentupdate/update20190716.html" target="_blank" rel="noopener">identified just 32 consumers</a> whose non-public personal information likely was accessed without authorization.</p>
<p>&#8220;These 32 consumers have been notified and offered complimentary credit monitoring services,&#8221; the company said.</p>
<p>First American has not responded to questions about how long this &#8220;design defect&#8221; persisted on its site, how far back it maintained access logs, or how far back in those access logs the company&#8217;s review extended.</p>


feed_id: https://krebsonsecurity.com/?p=48618
title: Patch Tuesday, August 2019 Edition
uri: Patch-Tuesday-August-2019-Edition
url: https://krebsonsecurity.com/2019/08/patch-tuesday-august-2019-edition/
content:
<p>Most <strong>Microsoft Windows</strong> (ab)users probably welcome the monthly ritual of applying security updates about as much as they look forward to going to the dentist: It always seems like you were there just yesterday, and you never quite know how it&#8217;s all going to turn out. Fortunately, this month&#8217;s patch batch from Redmond is mercifully light, at least compared to last month.</p>
<p><img class="alignright size-full wp-image-26837" src="media/863df0f6.brokenwindows.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2014/07/brokenwindows.png" alt="" width="229" height="240" />Okay, maybe a trip to the dentist&#8217;s office is still preferable. In any case, today is the second Tuesday of the month, which means it&#8217;s once again Patch Tuesday (or &#8212; depending on your setup and when you&#8217;re reading this post &#8212; Reboot Wednesday). Microsoft today released patches to fix some 93 vulnerabilities in Windows and related software, 35 of which affect various <strong>Server</strong> versions of Windows, and another 70 that apply to the <strong>Windows 10</strong> operating system.</p>
<p>Although there don&#8217;t appear to be any zero-day vulnerabilities fixed this month &#8212; i.e. those that get exploited by cybercriminals before an official patch is available &#8212; there are several issues that merit attention.</p>
<p>Chief among those are patches to address four moderately terrifying flaws in Microsoft&#8217;s <strong>Remote Desktop Service</strong>, a feature which allows users to remotely access and administer a Windows computer as if they were actually seated in front of the remote computer. Security vendor <strong>Qualys</strong> says two of these weaknesses can be exploited remotely without any authentication or user interaction.</p>
<p>&#8220;According to Microsoft, at least two of these vulnerabilities (<a href="https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1181" target="_blank" rel="noopener">CVE-2019-1181</a> and <a href="https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1182">CVE-2019-1182</a>) can be considered &#8216;wormable&#8217; and [can be equated] to BlueKeep,&#8221; referring to <a href="https://krebsonsecurity.com/2019/05/microsoft-patches-wormable-flaw-in-windows-xp-7-and-windows-2003/" target="_blank" rel="noopener">a dangerous bug patched earlier this year</a> that Microsoft warned could be used to spread another <a href="https://en.wikipedia.org/wiki/WannaCry_ransomware_attack" target="_blank" rel="noopener">WannaCry-like ransomware outbreak</a>. &#8220;It is highly likely that at least one of these vulnerabilities will be quickly weaponized, and patching should be prioritized for all Windows systems.&#8221;</p>
<p>Fortunately, Remote Desktop is disabled by default in Windows 10, and as such these flaws are more likely to be a threat for enterprises that have enabled the application for various purposes. For those keeping score, this is the fourth time in 2019 Microsoft has had to fix critical security issues with its Remote Desktop service.</p>
<p>For all you Microsoft Edge and Internet <del>Exploiter</del> Explorer users, Microsoft has issued the usual panoply of updates for flaws that could be exploited to install malware after a user merely visits a hacked or booby-trapped Web site. Other equally serious flaws patched in Windows this month could be used to compromise the operating system just by convincing the user to open a malicious file (regardless of which browser the user is running).<span id="more-48618"></span></p>
<p>As crazy as it may seem, this is the second month in a row that <strong>Adobe</strong> hasn&#8217;t issued a security update for its <strong>Flash Player</strong> browser plugin, which is bundled in IE/Edge and Chrome (although now hobbled by default in Chrome). However, Adobe did release important updates for its <a href="https://helpx.adobe.com/security/products/acrobat/apsb19-41.html" target="_blank" rel="noopener">Acrobat and free PDF reader products</a>.</p>
<p>If the tone of this post sounds a wee bit cantankerous, it might be because at least one of the updates I installed last month totally hosed my Windows 10 machine. I consider myself an equal OS abuser, and maintain multiple computers powered by a variety of operating systems, including Windows, Linux and MacOS.</p>
<p>Nevertheless, it is frustrating when being diligent about applying patches introduces so many unfixable problems that you&#8217;re forced to completely reinstall the OS and all of the programs that ride on top of it. On the bright side, my newly-refreshed Windows computer is a bit more responsive than it was before crash hell.</p>
<p>So, three words of advice. First off, don&#8217;t let Microsoft decide when to apply patches and reboot your computer. On the one hand, it&#8217;s nice Microsoft gives us a predictable schedule when it&#8217;s going to release patches. On the other, Windows 10 will by default download and install patches whenever it pleases, and then reboot the computer.</p>
<p>Unless you change that setting. <a href="https://www.howtogeek.com/224471/how-to-prevent-windows-10-from-automatically-downloading-updates/" target="_blank" rel="noopener">Here&#8217;s a tutorial</a> on how to do that. For all other Windows OS users, if you’d rather be alerted to new updates when they’re available so you can choose when to install them, there’s a setting for that in <strong>Windows Update</strong>.</p>
<p>Secondly, it doesn&#8217;t hurt to wait a few days to apply updates.  Very often fixes released on Patch Tuesday have glitches that cause problems for an indeterminate number of Windows systems. When this happens, Microsoft then patches their patches to minimize the same problems for users who haven&#8217;t yet applied the updates, but it sometimes takes a few days for Redmond to iron out the kinks.</p>
<p>Finally, please have some kind of system for backing up your files <em>before</em> applying any updates. You can use third-party software for this, or just the options built into Windows 10. At some level, it doesn&#8217;t matter. Just make sure you&#8217;re backing up your files, preferably following <a href="https://blog.malwarebytes.com/101/2017/04/3-2-1-go-make-backups-of-your-data/" target="_blank" rel="noopener">the 3-2-1 backup rule</a>. Thankfully, I&#8217;m vigilant about backing up my files.</p>
<p>And, as ever, if you experience any problems installing any of these patches this month, please feel free to leave a comment about it below; there’s a good chance other readers have experienced the same and may even chime in here with some helpful tips.</p>


feed_id: https://krebsonsecurity.com/?p=48568
title: Meet Bluetana, the Scourge of Pump Skimmers
uri: Meet-Bluetana-the-Scourge-of-Pump-Skimmers
url: https://krebsonsecurity.com/2019/08/meet-bluetana-the-scourge-of-pump-skimmers/
content:
<p>&#8220;<strong>Bluetana</strong>,&#8221; a new mobile app that looks for Bluetooth-based payment card skimmers hidden inside gas pumps, is helping police and state employees more rapidly and accurately locate compromised fuel stations across the nation, a study released this week suggests. Data collected in the course of the investigation also reveals some fascinating details that may help explain why these pump skimmers are so lucrative and ubiquitous.</p>
<p>The new app, now being used by agencies in several states, is the brainchild of computer scientists from the <strong>University of California San Diego</strong> and the <strong>University of Illinois Urbana-Champaign</strong>, who say they developed the software in tandem with technical input from the <strong>U.S. Secret Service</strong> (the federal agency most commonly called in to investigate pump skimming rings).</p>
<div id="attachment_48612" style="width: 607px" class="wp-caption aligncenter"><img class=" wp-image-48612" src="media/5060a553.bluetana.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/08/bluetana.png" alt="" width="597" height="321" /><p class="wp-caption-text">The Bluetooth pump skimmer scanner app &#8216;Bluetana&#8217; in action.</p></div>
<p>Gas pumps are a perennial target of skimmer thieves for several reasons. They are usually unattended, and in too many cases a handful of master keys will open a great many pumps at a variety of filling stations.</p>
<p>The skimming devices can then be attached to electronics inside the pumps in a matter of seconds, and because they&#8217;re also wired to the pump&#8217;s internal power supply the skimmers can operate indefinitely without the need of short-lived batteries.</p>
<p>And increasingly, these pump skimmers are fashioned to relay stolen card data and PINs via Bluetooth wireless technology, meaning the thieves who install them can periodically download stolen card data just by pulling up to a compromised pump and remotely connecting to it from a Bluetooth-enabled mobile device or laptop.</p>
<p>According to the study, some 44 volunteers  &#8212; mostly law enforcement officials and state employees &#8212; were equipped with Bluetana over a year-long experiment to test the effectiveness of the scanning app.</p>
<p>The researchers said their volunteers collected Bluetooth scans at 1,185 gas stations across six states, and that Bluetana detected a total of 64 skimmers across four of those states. All of the skimmers were later collected by law enforcement, including two that were reportedly missed in manual safety inspections of the pumps six months earlier.</p>
<p>While several other Android-based apps designed to find pump skimmers are already available, the researchers said Bluetana was developed with an eye toward eliminating false-positives that some of these other apps can fail to distinguish.</p>
<p>&#8220;Bluetooth technology used in these skimmers are also used for legitimate products commonly seen at and near gas stations such as speed-limit signs, weather sensors and fleet tracking systems,&#8221; said <strong>Nishant Bhaskar</strong>, UC San Diego Ph.D. student and principal author of the study. &#8220;These products can be mistaken for skimmers by existing detection apps.&#8221;<span id="more-48568"></span></p>
<h4>BLACK MARKET VALUE</h4>
<p>The fuel skimmer study also helps explain how quickly these hidden devices can generate huge profits for the organized gangs that typically deploy them. The researchers found the skimmers their app found collected data from roughly 20 -25 payment cards each day &#8212; evenly distributed between debit and credit cards (although they note estimates from payment fraud prevention companies and the Secret Service that put the average figure closer to 50-100 cards daily per compromised machine).</p>
<p>The academics also studied court documents which revealed that skimmer scammers often are only able to &#8220;cashout&#8221; stolen cards &#8212; either through selling them on the black market or using them for fraudulent purchases &#8212; a little less than half of the time. This can result from the skimmers sometimes incorrectly reading card data, daily withdrawal limits, or fraud alerts at the issuing bank.</p>
<p><em>&#8220;Based on the prior figures, we estimate the range of per-day revenue from a skimmer is $4,253 (25 cards per day, cashout of $362 per card, and 47% cashout success rate), and our high end estimate is $63,638 (100 cards per day per day, $1,354 cashout per card, and cashout success rate of 47%),&#8221; the study notes.</em></p>
<p>Not a bad haul either way, considering these skimmers typically cost about $25 to produce.</p>
<p>Those earnings estimates assume an even distribution of credit and debit card use among customers of a compromised pump: The more customers pay with a debit card, the more profitable the whole criminal scheme may become. Armed with your PIN and debit card data, skimmer thieves or those who purchase stolen cards can clone your card and pull money out of your account at an ATM.</p>
<p>&#8220;Availability of a PIN code with a stolen debit card in particular, can increase its value five-fold on the black market,&#8221; the researchers wrote.</p>
<p>This highlights a warning that KrebsOnSecurity has relayed to readers in many previous stories on pump skimming attacks: Using a debit card at the pump can be way riskier than paying with cash or a credit card.</p>
<div id="attachment_48614" style="width: 604px" class="wp-caption aligncenter"><img class=" wp-image-48614" src="media/b8ee179b.pumpskimvalue.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/08/pumpskimvalue.png" alt="" width="594" height="640" /><p class="wp-caption-text">The black market value, impact to consumers and banks, and liability associated with different types of card fraud.</p></div>
<p>And as the above graphic from the report illustrates, there are different legal protections for fraudulent transactions on debit vs. credit cards. With a credit card, your maximum loss on any transactions you report as fraud is $50; with a debit card, that protection only extends for within two days of the unauthorized transaction. After that, the maximum consumer liability can increase to $500 within 60 days, and to an unlimited amount after 60 days.</p>
<p>In practice, your bank or debit card issuer may still waive additional liabilities, and many do. But even then, having your checking account emptied of cash while your bank sorts out the situation can still be a huge hassle and create secondary problems (bounced checks, for instance).</p>
<p>Interestingly, this advice against using debit cards at the pump often runs counter to the messaging pushed by fuel station owners themselves, many of whom offer lower prices for cash or debit card transactions. That’s because credit card transactions typically are more expensive to process.</p>
<p>For all its skimmer-skewering prowess, Bluetana will not be released to the public. The researchers said they the primary reason for this is highlighted in the core findings of the study.</p>
<p>&#8220;There are many legitimate devices near gas stations that look exactly like skimmers do in Bluetooth scans,&#8221; said UCSD Assistant Professor <strong>Aaron Schulman</strong>, in an email to KrebsOnSecurity. &#8220;Flagging suspicious devices in Bluetana is a only a way of notifying inspectors that they need to gather more data around the gas station to determine if the Bluetooth transmissions appear to be emanating from a device inside of of the pumps. If it does, they can then open the pump door and confirm that the signal strength rises, and begin their visual inspection for the skimmer.&#8221;</p>
<p>One of the best tips for avoiding fuel card skimmers is to favor filling stations that have updated security features, such as custom keys for each pump, better compartmentalization of individual components within the machine, and tamper protections that physically shut down a pump if the machine is improperly accessed.</p>
<p>How can you spot a gas station with these updated features, you ask? As noted in last summer&#8217;s story, <a href="https://krebsonsecurity.com/2018/06/how-to-avoid-card-skimmers-at-the-pump/" target="_blank" rel="noopener">How to Avoid Card Skimmers at the Pumps</a>, these newer-model machines typically feature a horizontal card acceptance slot along with a raised metallic keypad. In contrast, older, less secure pumps usually have a vertical card reader a flat, membrane-based keypad.</p>
<div id="attachment_44334" style="width: 609px" class="wp-caption aligncenter"><img class="size-full wp-image-44334" src="media/6306da19.newerpump.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/06/newerpump.png" alt="" width="599" height="454" /><p class="wp-caption-text">Newer, more tamper-resistant fuel pumps include pump-specific key locks, raised metallic keypads, and horizontal card readers.</p></div>
<p>The researchers will present their work on Bluetana later today at the USENIX Security 2019 conference in Santa Clara, Calif. A copy of their paper is available <a href="media/66e5258c.sec19-bluetana.pdf" data-original-source="http://cseweb.ucsd.edu/~schulman/docs/sec19-bluetana.pdf" target="_blank" rel="noopener">here</a> (PDF).</p>
<p>If you enjoyed this story, check out my series on all things skimmer-related: <a href="https://krebsonsecurity.com/all-about-skimmers/" target="_blank" rel="noopener">All About Skimmers</a>. Looking for more information on fuel pump skimming? Have a look at <a href="https://krebsonsecurity.com/?s=fuel+skimming&amp;x=0&amp;y=0" target="_blank" rel="noopener">some of these stories</a>.</p>


feed_id: https://krebsonsecurity.com/?p=47789
title: The Rise of “Bulletproof” Residential Networks
uri: The-Rise-of-Bulletproof-Residential-Networks
url: https://krebsonsecurity.com/2019/08/the-rise-of-bulletproof-residential-networks/
content:
<p>Cybercrooks increasingly are anonymizing their malicious traffic by routing it through residential broadband and wireless data connections. Traditionally, those connections have been mainly hacked computers, mobile phones, or home routers. But this story is about so-called &#8220;bulletproof residential VPN services&#8221; that appear to be built by purchasing or otherwise acquiring discrete chunks of Internet addresses from some of the world&#8217;s largest ISPs and mobile data providers.</p>
<p>In late April 2019, KrebsOnSecurity received a tip from an online retailer who&#8217;d seen an unusual number of suspicious transactions originating from a series of Internet addresses assigned to a relatively new Internet provider based in Maryland called <strong>Residential Networking Solutions LLC</strong>.</p>
<p>Now, this in itself isn&#8217;t unusual; virtually every provider has the occasional customers who abuse their access for fraudulent purposes. But upon closer inspection, several factors caused me to look more carefully at this company, also known as &#8220;<strong>Resnet</strong>.&#8221;</p>
<p>An examination of <a href="https://bgp.he.net/AS46723#_prefixes" target="_blank" rel="noopener">the IP address ranges assigned to Resnet</a> shows that it maintains an impressive stable of IP blocks &#8212; <em>totaling almost 70,000 IPv4 addresses</em> &#8212; many of which had until <a href="https://www.google.com/search?q=%222026+Pickens+Way%22&amp;rlz=1C1SQJL_enUS858US858&amp;oq=%222026+Pickens+Way%22&amp;aqs=chrome..69i57j69i60.799j0j4&amp;sourceid=chrome&amp;ie=UTF-8" target="_blank" rel="noopener">quite recently</a> been assigned to someone else.</p>
<p>Most interestingly, about ten percent of those IPs &#8212; more than 7,000 of them &#8212; had until late 2018 been under the control of <strong>AT&amp;T Mobility</strong>. Additionally, the WHOIS registration records for each of these mobile data blocks suggest Resnet has been somehow reselling data services for major mobile and broadband providers, including <strong>AT&amp;T,</strong> <strong>Verizon,</strong> and <strong>Comcast Cable</strong>.</p>
<div id="attachment_48499" style="width: 605px" class="wp-caption aligncenter"><img class=" wp-image-48499" src="media/5e98cfb3.resnet-he.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/08/resnet-he.png" alt="" width="595" height="730" /><p class="wp-caption-text">The WHOIS records for one of several networks associated with Residential Networking Solutions LLC.</p></div>
<p>Drilling down into the tracts of IPs assigned to <a href="https://bgp.he.net/AS46723#_prefixes" target="_blank" rel="noopener">Resnet&#8217;s core network</a> indicates those 7,000+ mobile IP addresses under Resnet&#8217;s control were given the label  &#8220;<strong>Service Provider Corporation</strong>&#8221; &#8212; <a href="media/6588b320.he-spc.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/08/he-spc.png" target="_blank" rel="noopener">mostly those beginning with IPs in the range 198.228.x.x</a>.</p>
<p>An Internet search reveals this IP range is administered by the <a href="https://wirelessdataspco.org/" target="_blank" rel="noopener">Wireless Data Service Provider Corporation</a> (WDSPC), a non-profit formed in the 1990s to manage IP address ranges that could be handed out to various licensed mobile carriers in the United States.</p>
<p>Back when the WDSPC was first created, there were quite a few mobile wireless data companies. But today the vast majority of the IP space managed by the WDSPC is leased by <strong>AT&amp;T Mobility</strong> and <strong>Verizon Wireless</strong> &#8212; which have gradually acquired most of their competing providers over the years.</p>
<p>A call to the WDSPC revealed the nonprofit hadn&#8217;t leased any new wireless data IP space in more than 10 years. That is, until the organization received a communication at the beginning of this year that it believed was from AT&amp;T, which recommended Resnet as a customer who could occupy some of the company&#8217;s mobile data IP address blocks.</p>
<p>&#8220;I&#8217;m afraid we got duped,&#8221; said the person answering the phone at the WDSPC, while declining to elaborate on the precise nature of the alleged duping or the medium that was used to convey the recommendation.</p>
<p>AT&amp;T declined to discuss its exact relationship with Resnet  &#8212; or if indeed it ever had one to begin with. It responded to multiple questions about Resnet with a short statement that said, “We have taken steps to terminate this company’s services and have referred the matter to law enforcement.”</p>
<p>Why exactly AT&amp;T would forward the matter to law enforcement remains unclear. But it&#8217;s not unheard of for hosting providers to forge <a href="https://www.bandwidth.com/glossary/letter-of-authorization-loa/" target="_blank" rel="noopener">certain documents</a> in their quest for additional IP space, and anyone caught doing so via email, phone or fax could be charged with <a href="https://criminal.findlaw.com/criminal-charges/wire-fraud.html" target="_blank" rel="noopener">wire fraud</a>, which is a federal offense that carries punishments of up to $500,000 in fines and as much as 20 years in prison.</p>
<h4>WHAT IS RESNET?</h4>
<p>The WHOIS registration records for Resnet&#8217;s main Web site, <strong>resnetworking[.]com</strong>, are hidden behind domain privacy protection. However, a cursory Internet search on that domain turned up plenty of references to it on <strong>Hackforums[.]net</strong>, a sprawling community that hosts a seemingly never-ending supply of up-and-coming hackers seeking affordable and anonymous ways to monetize various online moneymaking schemes.</p>
<p>One user in particular &#8212; a Hackforums member who goes by the nickname &#8220;<strong>Profitvolt</strong>&#8221; &#8212; has spent several years advertising resnetworking[.]com and a number of related sites and services, including &#8220;unlimited&#8221; AT&amp;T 4G/LTE data services, and the immediate availability of more than 1 million residential IPs that he suggested were &#8220;perfect for botting, shoe buying.&#8221;</p>
<div id="attachment_48500" style="width: 607px" class="wp-caption aligncenter"><img class=" wp-image-48500" src="media/d4a31965.1.2milproxypool.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/08/1.2milproxypool.png" alt="" width="597" height="392" /><p class="wp-caption-text">The Hackforums user &#8220;Profitvolt&#8221; advertising residential proxies.</p></div>
<p>Profitvolt advertises his mobile and residential data services as ideal for anyone who wishes to run &#8220;various bots,&#8221; or &#8220;advertising campaigns.&#8221; Those services are meant to provide anonymity when customers are doing things such as automating ad clicks on platforms like <strong>Google Adsense</strong> and <strong>Facebook</strong>; generating new <strong>PayPal</strong> accounts; <a href="https://www.gq.com/story/war-against-sneaker-bots" target="_blank" rel="noopener">sneaker bot activity;</a> <a href="https://en.wikipedia.org/wiki/Credential_stuffing" target="_blank" rel="noopener">credential stuffing attacks</a>; and different types of social media spam.</p>
<p>For readers unfamiliar with this term, &#8220;shoe botting&#8221; or &#8220;sneaker bots&#8221; refers to the use of automated bot programs and services that aid in the rapid acquisition of limited-release, highly sought-after designer shoes that can then be resold at a profit on secondary markets. All too often, it seems, the people who profit the most in this scheme are using <a href="media/45e7bff2.curity-credential-stuffing-attacks-and-economies-report-2019.pdf" data-original-source="https://www.akamai.com/us/en/multimedia/documents/state-of-the-internet/soti-security-credential-stuffing-attacks-and-economies-report-2019.pdf" target="_blank" rel="noopener">multiple sets of compromised credentials from consumer accounts</a> at online retailers, and/or stolen payment card data.</p>
<p>To say shoe botting has become a thorn in the side of online retailers and regular consumers alike would be a major understatement: A <a href="media/5131e203.internet-security-retail-attacks-and-api-traffic-report-2019.pdf" data-original-source="https://www.akamai.com/us/en/multimedia/documents/state-of-the-internet/state-of-the-internet-security-retail-attacks-and-api-traffic-report-2019.pdf" target="_blank" rel="noopener">recent State of The Internet Security Report</a> (PDF) from <strong>Akamai</strong> (an advertiser on this site) noted that such automated bot activity<em> now accounts for almost half of the Internet bandwidth directed at online retailers</em>. The prevalance of shoe botting also might help explain <strong>Footlocker</strong>&#8216;s <a href="https://www.gq.com/story/foot-locker-invests-100-million-goat-thats-a-lot-of-sneakers" target="_blank" rel="noopener">recent $100 million investment in goat.com</a>, the largest secondary shoe resale market on the Web.</p>
<p>In other discussion threads, Profitvolt advertises he can rent out an &#8220;unlimited number&#8221; of so-called &#8220;residential proxies,&#8221; a term that describes home or mobile Internet connections that can be used to anonymously relay Internet traffic for a variety of dodgy deals.</p>
<p>From a ne&#8217;er-do-well&#8217;s perspective, the beauty of routing one&#8217;s traffic through residential IPs is that few online businesses will bother to block malicious or suspicious activity emanating from them.</p>
<p>That&#8217;s because in general the pool of IP addresses assigned to residential or mobile wireless connections cycles intermittently from one user to the next, meaning that blacklisting one residential IP for abuse or malicious activity may only serve to then block legitimate traffic (and e-commerce) from the next user who gets assigned that same IP.<span id="more-47789"></span></p>
<h4>A BULLETPROOF PLAN?</h4>
<p>In one early post on Hackforums, Profitvolt laments the untimely demise of various &#8220;bulletproof&#8221; hosting providers over the years, from the <a href="http://voices.washingtonpost.com/securityfix/2007/11/russian_business_network_down.html" target="_blank" rel="noopener">Russian Business Network</a> and <a href="http://voices.washingtonpost.com/securityfix/2008/10/spam_volumes_plummet_after_atr.html" target="_blank" rel="noopener">Atrivo/Intercage</a>, to <a href="http://voices.washingtonpost.com/securityfix/2009/11/a_year_later_a_look_back_at_mc.html" target="_blank" rel="noopener">McColo</a>, <a href="http://voices.washingtonpost.com/securityfix/2009/06/ftc_sues_shuts_down_n_calif_we.html" target="_blank" rel="noopener">3FN</a> and <a href="https://krebsonsecurity.com/2010/03/researchers-map-multi-network-cybercrime-infrastructure/" target="_blank" rel="noopener">Troyak</a>, among others.</p>
<p>All of these Internet providers had one thing in common: They specialized in cultivating customers who used their networks for nefarious purposes &#8212; from operating botnets and spamming to hosting malware. They were known as &#8220;bulletproof&#8221; because they generally ignored abuse complaints, or else blamed any reported abuse on a reseller of their services.</p>
<p>In that Hackforums post, Profitvolt bemoans that &#8220;mediums which we use to distribute [are] locking us out and making life unnecessarily hard.&#8221;</p>
<p>&#8220;It&#8217;s still sketchy, so I am not going all out to reveal my plans, but currently I am starting off with a 32 GB RAM server with a 1 GB unmetered up-link in a Caribbean country,&#8221; Profitvolt told forum members, while asking in different Hackforums posts whether there are any other users from the dual-island Caribbean nation of <a href="https://en.wikipedia.org/wiki/Trinidad_and_Tobago" target="_blank" rel="noopener">Trinidad and Tobago</a> on the forum.</p>
<p>&#8220;To be quite honest, the purpose of this is to test how far we can stretch the leniency before someone starts asking questions, or we start receiving emails,&#8221; Profitvolt continued.</p>
<div id="attachment_48494" style="width: 601px" class="wp-caption aligncenter"><a class="lightbox" href="media/dca23f9b.BPhosting.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/08/BPhosting.jpg"><img class="wp-image-48494" src="media/dca23f9b.BPhosting.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/08/BPhosting.jpg" alt="" width="591" height="375" /></a><p class="wp-caption-text">Hackforums user Profitvolt says he plans to build his own &#8220;bulletproof&#8221; hosting network catering to fellow forum users who might want to rent his services for a variety of dodgy activities.</p></div>
<p>KrebsOnSecurity started asking questions of Resnet after stumbling upon several indications that this company was enabling different types of online abuse in bite-sized monthly packages. The site resnetworking[.]com appears normal enough on the surface, but a review of the customer packages advertised on it suggests the company has courted a very specific type of client.</p>
<p>&#8220;No bullshit, just proxies,&#8221; reads one (<a href="media/28745eb1.nobullshit.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/08/nobullshit.png" target="_blank" rel="noopener">now hidden or removed</a>) area of the site&#8217;s shopping cart. Other promotions advertise the use of residential proxies to promote &#8220;growth services&#8221; on multiple social media platforms including <strong>Craigslist</strong>, <strong>Facebook</strong>, <strong>Google</strong>, <strong>Instagram</strong>, <strong>Spotify</strong>, <strong>Soundcloud</strong> and <strong>Twitter</strong>.</p>
<p><img class="aligncenter wp-image-48501" src="media/529acfc9.resnet-goso.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/08/resnet-goso.png" alt="" width="592" height="404" /></p>
<p>Resnet also peers with or partners with several other interesting organizations, including:</p>
<p>&#8211;<strong>residential-network[.]com</strong>, also known as &#8220;<a href="https://twitter.com/iastaff" target="_blank" rel="noopener">IAPS Security Services</a>&#8221; (formerly <strong>intl-alliance[.]com</strong>), which advertises the sale of residential VPNs and mobile 4G/<a href="https://en.wikipedia.org/wiki/IPv6" target="_blank" rel="noopener">IPv6</a> proxies aimed at helping customers avoid being blocked while automating different types of activity, from mass-creating social media and email accounts to bulk message sending on platforms like <strong>WhatsApp</strong> and <strong>Facebook</strong>.</p>
<p><img class="aligncenter wp-image-48558" src="media/95d2825e.resnet-ipv6peers.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/08/resnet-ipv6peers.png" alt="" width="596" height="193" /></p>
<p>&#8211;<strong>Laksh Cybersecurity and Defense LLC</strong>, which maintains <a href="https://twitter.com/HEX_PROXY" target="_blank" rel="noopener"><strong>Hexproxy[.]com</strong></a>, another residential proxy service that largely courts customers involved in shoe botting.</p>
<p><img class="aligncenter wp-image-48559" src="media/2329ebb6.resnetpeers-v4-lak.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/08/resnetpeers-v4-lak.png" alt="" width="595" height="237" /></p>
<p>-Several chunks of IP space from a Russian provider variously known by the names &#8220;<strong>SERVERSGET</strong>&#8221; and &#8220;<strong>Men Danil Valentinovich</strong>,&#8221; which has been associated with numerous instances of <a href="https://www.ripe.net/ripe/mail/archives/db-wg/2018-August/005978.html" target="_blank" rel="noopener">hijacking vast swaths of IP addresses</a> from other organizations quite recently.</p>
<div id="attachment_48579" style="width: 606px" class="wp-caption aligncenter"><a class="lightbox" href="media/ec7f9ee9.profitvolt-hf-postings.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/08/profitvolt-hf-postings.jpg"><img class="wp-image-48579" src="media/ec7f9ee9.profitvolt-hf-postings.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/08/profitvolt-hf-postings.jpg" alt="" width="596" height="313" /></a><p class="wp-caption-text">Some of Profitvolt&#8217;s discussion threads on Hackforums.</p></div>
<h4>WHO IS RESNET?</h4>
<p>Resnetworking[.]com lists on its home page the contact phone number <strong>202-643-8533</strong>. That number is tied to the registration records for several domains, including resnetworking[.]com, <strong>residentialvpn[.]info</strong>, and <strong>residentialvpn[.]org</strong>. All of those domains also have in their historic WHOIS records the name <strong>Joshua Powder</strong> and Residential Networking Solutions LLC.</p>
<p>Running a reverse WHOIS lookup via <a href="https://www.domaintools.com" target="_blank" rel="noopener">Domaintools.com</a> on &#8220;Joshua Powder&#8221; turns up almost <a href="https://krebsonsecurity.com/wp-content/uploads/2019/08/joshua-powder-gmail.txt" target="_blank" rel="noopener">60 domain names</a> &#8212; most of them tied to the email address <strong>joshua.powder@gmail.com</strong>. Among those are resnetworking[.]info, resvpn[.]com/net/org/info, tobagospeaks[.]com, <strong>tthack[.]com</strong> and <strong>profitvolt[.]com</strong>. Recall that &#8220;Profitvolt&#8221; is the nickname of the Hackforums user advertising resnetworking[.]com.</p>
<p>The email address josh@tthack.com was used to register an account on the scammer-friendly site blackhatworld[.]com under the nickname &#8220;BulletProofWebHost.&#8221; <a href="https://krebsonsecurity.com/wp-content/uploads/2019/08/reverse-josh-tthack.txt" target="_blank" rel="noopener">Here&#8217;s a list of domains</a> registered to this email address.</p>
<p>A search on the Joshua Powder and tthack email addresses at <a href="https://hyas.com/" target="_blank" rel="noopener">Hyas</a>, a startup that specializes in combining data from a number of sources to <a href="https://fortune.com/2018/08/02/microsoft-cybercrime-startup-invest/" target="_blank" rel="noopener">provide attribution of cybercrime activity</a>, further associates those to mafiacloud@gmail.com and to the phone number <strong>868-360-9983</strong>, which is a mobile number assigned by Digicel Trinidad and Tobago Ltd. A full list of domains tied to that 868- number is <a href="https://krebsonsecurity.com/wp-content/uploads/2019/08/reverse-868-360-9983.txt" target="_blank" rel="noopener">here</a>.</p>
<p>Hyas&#8217;s service also pointed to <a href="https://www.facebook.com/PGCEDC/posts/team-edc-is-excited-to-welcome-josh-powder-founder-and-ceo-of-residential-networ/1591417627563850/" target="_blank" rel="noopener">this post</a> on the Facebook page of the Prince George&#8217;s County Economic Development Corporation in Maryland, which appears to include a 2017 photo of Mr. Powder posing with county officials.</p>
<h4>&#8216;A GLORIFIED SOLUTIONS PROVIDER&#8217;</h4>
<p>Roughly three weeks ago, KrebsOnSecurity called the 202 number listed at the top of resnetworking[.]com. To my surprise, a man speaking in a lovely Caribbean-sounding accent answered the call and identified himself as Josh Powder. When I casually asked from where he&#8217;d acquired that accent, Powder said he was a native of New Jersey but allowed that he has family members who now live in Trinidad and Tobago.</p>
<p>Powder said Residential Networking Solutions LLC is &#8220;a normal co-location Internet provider&#8221; that has been in operation for about three years and employs some 65 people.</p>
<p>&#8220;You&#8217;re not the first person to call us about residential VPNs,&#8221; Powder said. &#8220;In the past, we did have clients that did host VPNs, but it&#8217;s something that&#8217;s been discontinued since 2017. All we are is a glorified solutions provider, and we broker and lease Internet lines from different companies.&#8221;</p>
<p>When asked about the various &#8220;botting&#8221; packages for sale on Resnetworking[.]com, Powder replied that the site hadn&#8217;t been updated in a while and that these were inactive offers that resulted from a now-discarded business model.</p>
<p>&#8220;When we started back in 2016, we were really inexperienced, and hired some SEO [search engine optimization] firms to do marketing,&#8221; he explained. &#8220;Eventually we realized that this was creating a shitstorm, because it started to make us look a specific way to certain people. So we had to really go through a process of remodeling. That process isn&#8217;t complete, and the entire web site is going to retire in about a week&#8217;s time.&#8221;</p>
<p>Powder maintains that his company does have a contract with AT&amp;T to resell LTE and 4G data services, and that he has a similar arrangement with Sprint. He also suggested that one of the aforementioned companies which partnered with Resnet &#8212; IAPS Security Services &#8212; was responsible for much of the dodgy activity that previously brought his company abuse complaints and strange phone calls about VPN services.</p>
<p>&#8220;That guy reached out to us and he leased service from us and nearly got us into a lot of trouble,&#8221; Powder said. &#8220;He was doing a lot of illegal stuff, and I think there is an ongoing matter with him legally. That&#8217;s what has caused us to be more vigilant and really look at what we do and change it. It attracted too much nonsense.&#8221;</p>
<p>Interestingly, when one visits IAPS Security Services&#8217; old domain &#8212; intl-alliance[.]com &#8212; it now forwards to resvpn[.]com, which is <a href="https://krebsonsecurity.com/wp-content/uploads/2019/08/joshua-powder-gmail.txt" target="_blank" rel="noopener">one of the domains registered to Joshua Powder</a>.</p>
<p>Shortly after our conversation, the monthly packages I asked Powder about that were for sale on resnetworking[.]com disappeared from the site, or were hidden behind a login. Also, Resnet&#8217;s IPv6 prefixes (a la IAPS Security Services) were removed from the company&#8217;s list of addresses. At the same time, a large number of Profitvolt&#8217;s posts prior to 2018 were deleted from Hackforums.</p>
<h4>EPILOGUE</h4>
<p>It appears that the future of low-level abuse targeting some of the most popular Internet destinations is tied to the increasing willingness of the world&#8217;s biggest ISPs to resell discrete chunks of their address space to whomever is able to pay for them.</p>
<p>Earlier this week, I had a Skype conversation with an individual who responded to my requests for more information from residential-network[.]com, and this person told me that plenty of mobile and land-line ISPs are more than happy to sell huge amounts of IP addresses to just about anybody.</p>
<p>&#8220;Mobile providers also sell mass services,&#8221; the person who responded to my Skype request offered. &#8220;Rogers in Canada just opened a new package for unlimited 4G data lines and we&#8217;re currently in negotiations with them for that service as well. The UK also has 4G providers that have unlimited data lines as well.&#8221;</p>
<p>The person responding to my Skype messages said they bought most of their proxies from a reseller at customproxysolutions[.]com, which advertises &#8220;the world&#8217;s largest network of 4G LTE modems in the United States.&#8221;</p>
<p><a class="lightbox" href="media/0ef96efa.customproxysolutions.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/08/customproxysolutions.png"><img class="aligncenter wp-image-48649" src="media/0ef96efa.customproxysolutions.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/08/customproxysolutions.png" alt="" width="597" height="383" /></a></p>
<p>He added that &#8220;Rogers in Canada has a special offer that if you buy more than 50 lines you get a reduced price lower than the $75 Canadian Dollar price tag that they would charge for fewer than 50 lines. So most mobile ISPs want to sell mass lines instead of single lines.&#8221;</p>
<p>It remains unclear how much of the Internet address space claimed by these various residential proxy and VPN networks has been acquired legally or through other means. But it seems that Resnet and its business associates are in fact on the cutting edge of what it means to be a bulletproof Internet provider today.</p>


feed_id: https://krebsonsecurity.com/?p=48673
title: Forced Password Reset? Check Your Assumptions
uri: Forced-Password-Reset-Check-Your-Assumptions
url: https://krebsonsecurity.com/2019/08/forced-password-reset-check-your-assumptions/
content:
<p>Almost weekly now I hear from an indignant reader who suspects a data breach at a Web site they frequent that has just asked the reader to reset their password. Further investigation almost invariably reveals that the password reset demand was not the result of a breach but rather the site&#8217;s efforts to identify customers who are reusing passwords from other sites that have already been hacked.</p>
<p>But ironically, many companies taking these proactive steps soon discover that their explanation as to why they&#8217;re doing it can get misinterpreted as more evidence of lax security. This post attempts to unravel what&#8217;s going on here.</p>
<p>Over the weekend, a follower on Twitter included me in <a href="https://twitter.com/MiamiPaisa/status/1162530551691206659" target="_blank" rel="noopener">a tweet</a> sent to California-based job search site <a href="https://www.glassdoor.com" target="_blank" rel="noopener">Glassdoor</a>, which had just sent him the following notice:</p>
<p><img class="aligncenter size-full wp-image-48690" src="media/100ca3d4.glassdoor.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/08/glassdoor.png" alt="" width="437" height="725" /></p>
<p>The Twitter follower expressed concern about this message, because it suggested to him that in order for Glassdoor to have done what it described, the company would have had to be storing its users&#8217; passwords in plain text. I replied that this was in fact not an indication of storing passwords in plain text, and that many companies are now testing their users&#8217; credentials against lists of hacked credentials that have been leaked and made available online.</p>
<p>The reality is <a href="https://krebsonsecurity.com/2016/06/password-re-user-get-to-get-busy/" rel="noopener" target="_blank">Facebook, Netflix and a number of many big-name companies</a> are regularly combing through huge data leak troves for credentials that match those of their customers, and then forcing a password reset for those users. Some are even checking for password re-use on all new account signups.</p>
<p>The idea here is to stymie a massively pervasive problem facing <em>all</em> companies that do business online today: Namely, &#8220;credential-stuffing attacks,&#8221; in which attackers take millions or even billions of email addresses and corresponding cracked passwords from compromised databases and see how many of them work at other online properties.</p>
<p>So how does the defense against this daily deluge of credential stuffing work? A company employing this strategy will first extract from these leaked credential lists any email addresses that correspond to their current user base.</p>
<p>From there, the corresponding cracked (plain text) passwords are fed into the same process that the company relies upon when users log in: That is, the company feeds those plain text passwords through its own password &#8220;hashing&#8221; or scrambling routine.</p>
<p>Password hashing is designed to be a one-way function which scrambles a plain text password so that it produces a long string of numbers and letters. Not all hashing methods are created equal, and some of the most commonly used methods &#8212; <a href="https://en.wikipedia.org/wiki/MD5" target="_blank" rel="noopener">MD5</a> and <a href="https://en.wikipedia.org/wiki/SHA-1" target="_blank" rel="noopener">SHA-1</a>, for example &#8212; can be far less secure than others, depending on how they&#8217;re implemented (more on that in a moment). Whatever the hashing method used, it&#8217;s the hashed output that gets stored, not the password itself.</p>
<p>Back to the process: If a user&#8217;s plain text password from a hacked database matches the output of what a company would expect to see after running it through their own internal hashing process, then that user is then prompted to change their password to something truly unique.<span id="more-48673"></span></p>
<p>Now, password hashing methods can be made more secure by amending the password with what&#8217;s known as a &#8220;salt&#8221; &#8212; or random data added to the input of a hash function to guarantee a unique output. And many readers of the Twitter thread on Glassdoor&#8217;s approach reasoned that the company couldn&#8217;t have been doing what it described without also forgoing this additional layer of security.</p>
<p>My <a href="https://twitter.com/briankrebs/status/1162561022676389889" target="_blank" rel="noopener">tweeted explanatory reply</a> as to why Glassdoor was doing this was (in hindsight) incomplete and in any case not as clear as it should have been. Fortunately, Glassdoor&#8217;s chief information officer <strong>Anthony Moisant</strong> <a href="https://twitter.com/amoisant/status/1162762469644754945" target="_blank" rel="noopener">chimed in</a> to the Twitter thread to explain that the salt is in fact added as part of the password testing procedure.</p>
<p>&#8220;In our [user] database, we&#8217;ve got three columns &#8212; username, salt value and scrypt hash,&#8221; Moisant explained in an interview with KrebsOnSecurity. &#8220;We apply the salt that&#8217;s stored in the database and the hash [function] to the plain text password, and that resulting value is then checked against the hash in the database we store. For whatever reason, some people have gotten it into their heads that there&#8217;s no possible way to do these checks if you salt, but that&#8217;s not true.&#8221;</p>
<h4>CHECK YOUR ASSUMPTIONS</h4>
<p>You &#8212; the user &#8212; can&#8217;t be expected to know or control what password hashing methods a given site uses, <a href="https://plaintextoffenders.com/" target="_blank" rel="noopener">if indeed they use them at all</a>. But you can control the quality of the passwords you pick.</p>
<p>I can&#8217;t stress this enough: Do not re-use passwords. And don&#8217;t recycle them either. Recycling involves rather lame attempts to make a reused password unique by simply adding a digit or changing the capitalization of certain characters. Crooks who specialize in password attacks are wise to this approach as well.</p>
<p>If you have trouble remembering complex passwords (and this describes most people), consider relying instead on password length, which is a far more important determiner of whether a given password can be cracked by available tools in any timeframe that might be reasonably useful to an attacker.</p>
<p>In that vein, it&#8217;s safer and wiser to focus on picking passphrases instead of passwords. Passphrases are collections of multiple (ideally unrelated) words mushed together. Passphrases are not only generally more secure, they also have the added benefit of being easier to remember.</p>
<p>According to <a href="https://techcommunity.microsoft.com/t5/Azure-Active-Directory-Identity/Your-Pa-word-doesn-t-matter/ba-p/731984" target="_blank" rel="noopener">a recent blog entry</a> by <strong>Microsoft</strong> group program manager <strong>Alex Weinert</strong>, none of the above advice about password complexity amounts to a hill of beans from the attacker&#8217;s standpoint.</p>
<p>Weinert&#8217;s post makes a compelling argument that as long as we&#8217;re stuck with passwords, taking full advantage of the most robust form of <a href="https://en.wikipedia.org/wiki/Two-factor_authentication" target="_blank" rel="noopener">multi-factor authentication</a> (MFA) offered by a site you frequent is the best way to deter attackers. <a href="https://www.twofactorauth.org" target="_blank" rel="noopener">Twofactorauth.org</a> has a handy list of your options here, broken down by industry.</p>
<p>&#8220;Your password doesn’t matter, but MFA does,&#8221; Weinert wrote. &#8220;Based on our studies, your account is more than 99.9% less likely to be compromised if you use MFA.&#8221;</p>
<p>Glassdoor&#8217;s Moisant said the company doesn&#8217;t currently offer MFA for its users, but that is planning to roll that out later this year to both consumer and business users.</p>
<p>Password managers also can be useful for those who feel encumbered by having to come up with passphrases or complex passwords. If you&#8217;re uncomfortable with entrusting a third-party service or application to handle this process for you, there&#8217;s absolutely nothing wrong with writing down your passwords, provided a) you do not store them in a file on your computer or taped to your laptop or screen or whatever, and b) that your password notebook is stored somewhere relatively secure, i.e. not in your purse or car, but something like a locked drawer or safe.</p>
<p>Although many readers will no doubt take me to task on that last bit of advice, as in all things security related it&#8217;s important not to let the perfect become the enemy of the good. Many people (think moms/dads/grandparents) can&#8217;t be bothered to use password managers  &#8212; even when you go through the trouble of setting them up on their behalf. Instead, without an easier, non-technical method they will simply revert back to reusing or recycling passwords.</p>


