# articles

feed_id: http://krebsonsecurity.com/?p=29643
title: Yet Another Emergency Flash Player Patch
uri: Yet-Another-Emergency-Flash-Player-Patch
url: http://krebsonsecurity.com/2015/01/yet-another-emergency-flash-player-patch/
content:
<p>For the second time in a week, <strong>Adobe</strong> has issued an emergency update to fix a critical security flaw that crooks are actively exploiting in its <strong>Flash Player</strong> software. Updates are available for Flash Player on <strong>Windows</strong> and <strong>Mac OS X</strong>.</p>
<p><a href="media/06f26f56.brokenflash-a.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2013/02/brokenflash-a.png"><img class="alignright  wp-image-18875" src="media/06f26f56.brokenflash-a.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2013/02/brokenflash-a.png" alt="brokenflash-a" width="196" height="167" /></a>Last week, Adobe <a title="http://krebsonsecurity.com/2015/01/flash-patch-targets-zero-day-exploit/" href="http://krebsonsecurity.com/2015/01/flash-patch-targets-zero-day-exploit/" target="_blank">released an out-of-band Flash Patch</a> to fix a dangerous bug that attackers were already exploiting. In that advisory, Adobe said it was aware of <a title="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0311" href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0311" target="_blank">yet another zero-day flaw</a> that also was being exploited, but that last week&#8217;s patch didn&#8217;t fix that flaw.</p>
<p>Earlier this week, Adobe began pushing out Flash <em>v. 16.0.0.296 </em>to address the outstanding zero-day flaw. Adobe said users who have enabled auto-update for Flash Player will be receiving the update automatically this week. Alternatively, users can manually update by downloading the latest version from <a title="https://www.adobe.com/products/flashplayer/distribution3.html" href="https://www.adobe.com/products/flashplayer/distribution3.html" target="_blank">this page</a>.</p>
<p>Adobe said it is working with its distribution partners to make the update available in <strong>Google Chrome</strong> and <strong>Internet Explorer 10</strong> and <strong>11</strong>. Google Chrome version <em>40.0.2214.93</em> includes this update, and is available now. To check for updates in Chrome, click the stacked three bars to the right of the address bar in Chrome, and look for a listing near the bottom that says &#8220;Update Chrome.&#8221;</p>
<p>To see which version of Flash you have installed, check <a title="https://www.adobe.com/software/flash/about/" href="https://www.adobe.com/software/flash/about/" target="_blank">this link</a>. Windows users who browse the Web with anything other than Internet Explorer may need to apply this patch twice, once with IE and again using the alternative browser (Firefox, Opera, e.g.).</p>


feed_id: http://krebsonsecurity.com/?p=29648
title: FBI: Businesses Lost $215M to Email Scams
uri: FBI-Businesses-Lost-215M-to-Email-Scams
url: http://krebsonsecurity.com/2015/01/fbi-businesses-lost-215m-to-email-scams/
content:
<p>It&#8217;s time once again to update my <a title="http://krebsonsecurity.com/2013/06/the-value-of-a-hacked-email-account/" href="http://krebsonsecurity.com/2013/06/the-value-of-a-hacked-email-account/" target="_blank">Value of a Hacked Email Account</a> graphic: According to a recent alert from the FBI, cyber thieves stole nearly $215 million from businesses in the last 14 months using a scam that starts when business executives or employees have their email accounts hijacked.</p>
<p>Federal investigators say the so-called &#8220;business email compromise&#8221; (BEC) swindle is a sophisticated and increasingly common scam targeting businesses working with foreign suppliers and/or businesses that regularly perform wire transfer payments.</p>
<p>According to new data from the <strong>Internet Crime Complaint Center</strong> (IC3) &#8212; a partnership between the <strong>National White Collar Crime Center</strong> and the FBI &#8212; the victims of BEC scams range from small to large businesses that may purchase or supply a variety of goods, such as textiles, furniture, food, and pharmaceuticals.</p>
<div id="attachment_29655" style="width: 610px" class="wp-caption aligncenter"><a href="media/9d8d8b9e.becstats.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/01/becstats.png"><img class="size-large wp-image-29655" src="media/580ff50c.becstats-600x201.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/01/becstats-600x201.png" alt="Image: IC3" width="600" height="201" /></a><p class="wp-caption-text">Image: IC3</p></div>
<p>One variation on the BEC scam, also known as &#8220;CEO fraud,&#8221; starts with the email account compromise for high-level business executives (CFO, CTO, etc). Posing as the executive, the fraudster sends a request for a wire transfer from the compromised account to a second employee within the company who is normally responsible for processing these requests.</p>
<p>&#8220;The requests for wire transfers are well-worded, specific to the business being victimized, and do not raise suspicions to the legitimacy of the request,&#8221; the agency warned. &#8220;In some instances a request for a wire transfer from the compromised account is sent directly to the financial institution with instructions to urgently send funds to bank &#8216;X&#8217; for reason &#8216;Y.'&#8221;</p>
<p>The IC3 notes that the fraudsters perpetrating these scams do their homework before targeting a business and its employees, monitoring and studying their selected victims prior to initiating the fraud.<span id="more-29648"></span></p>
<p>&#8220;Fraudulent e-mails received have coincided with business travel dates for executives whose e-mails were spoofed,&#8221; the IC3 alert <a title="http://www.ic3.gov/media/2015/150122.aspx" href="http://www.ic3.gov/media/2015/150122.aspx" target="_blank">warns</a>. &#8220;The subjects are able to accurately identify the individuals and protocol necessary to perform wire transfers within a specific business environment. Victims may also first receive &#8216;phishing&#8217; e-mails requesting additional details of the business or individual being targeted (name, travel dates, etc).&#8221;</p>
<p>The advisory urges businesses to adopt <a title="http://www.twofactorauth.org" href="http://www.twofactorauth.org" target="_blank">two-step or two-factor authentication</a> for email, where available, and/or to establish other communication channels &#8212; such as telephone calls &#8212; to verify significant transactions. Businesses are also advised to exercise restraint when publishing information about employee activities on their Web sites or through social media.</p>
<p>For more info on how to rethink the security of your inbox, check out <a href="http://krebsonsecurity.com/2013/06/the-value-of-a-hacked-email-account/" target="_blank">this post</a>.</p>
<div id="attachment_21036" style="width: 610px" class="wp-caption aligncenter"><a href="media/c00d893f.HE-1.jpg" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2013/06/HE-1.jpg"><img class="size-large wp-image-21036" src="media/68246a67.HE-1-600x333.jpg" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2013/06/HE-1-600x333.jpg" alt="Your email account may be worth far more than you imagine." width="600" height="333" /></a><p class="wp-caption-text">Your email account may be worth far more than you imagine.</p></div>


feed_id: http://krebsonsecurity.com/?p=29658
title: The Internet of Dangerous Things
uri: The-Internet-of-Dangerous-Things
url: http://krebsonsecurity.com/2015/01/the-internet-of-dangerous-things/
content:
<p>Distributed denial-of-service (DDoS) attacks designed to silence end users and sideline Web sites grew with alarming frequency and size last year, according to new data released this week. Those findings dovetail quite closely with the attack patterns seen against this Web site over the past year.</p>
<p><strong>Arbor Networks</strong>, a major provider of services to help block DDoS assaults, surveyed nearly 300 companies and found that 38% of respondents saw more than 21 DDoS attacks per month. That&#8217;s up from a quarter of all respondents reporting 21 or more DDoS attacks the year prior.</p>
<p>KrebsOnSecurity is squarely within that 38 percent camp: In the month of December 2014 alone, <strong>Prolexic</strong> (the <strong>Akamai</strong>-owned company that protects my site from DDoS attacks) logged 26 distinct attacks on my site. That&#8217;s almost one attack per day, but since many of the attacks spanned multiple days, the site was virtually under constant assault all month.</p>
<div id="attachment_29668" style="width: 610px" class="wp-caption aligncenter"><a class="lightbox" href="media/08d25530.atlaspeaks.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/01/atlaspeaks.png"><img class="size-large wp-image-29668" src="media/ac597d8f.atlaspeaks-600x268.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/01/atlaspeaks-600x268.png" alt="Source: Arbor Networks" width="600" height="268" /></a><p class="wp-caption-text">Source: Arbor Networks</p></div>
<p>Arbor also found that attackers continue to use reflection/amplification techniques to create gigantic attacks. The largest reported attack was 400 Gbps, with other respondents reporting attacks of 300 Gbps, 200 Gbps and 170 Gbps. Another six respondents reported events that exceeded the 100 Gbps threshold. In February 2014, I wrote about <a title="http://krebsonsecurity.com/2014/02/the-new-normal-200-400-gbps-ddos-attacks/" href="http://krebsonsecurity.com/2014/02/the-new-normal-200-400-gbps-ddos-attacks/" target="_blank">the largest attack to hit this site to date</a> &#8212; which clocked in at just shy of 200 Gbps.</p>
<p>According to Arbor,  the top three motivations behind attacks remain nihilism vandalism, online gaming and ideological hacktivism— all of which the company said have been in the top three for the past few years.</p>
<p>&#8220;Gaming has gained in percentage, which is no surprise given the number of high-profile, gaming-related attack campaigns this year,&#8221; the report concludes.</p>
<div id="attachment_29669" style="width: 610px" class="wp-caption aligncenter"><a class="lightbox" href="media/696ce575.akamai-report-kos.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/01/akamai-report-kos.png"><img class="size-large wp-image-29669" src="media/ae8dd121.akamai-report-kos-600x467.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/01/akamai-report-kos-600x467.png" alt="DDoS Attacks on KrebsOnSecurity.com, logged by Akamai/Prolexic between 10/17/14 - 1/26/15." width="600" height="467" /></a><p class="wp-caption-text">DDoS Attacks on KrebsOnSecurity.com, logged by Akamai/Prolexic between 10/17/14 &#8211; 1/26/15.</p></div>
<p>Longtime readers of this blog will probably recall that I&#8217;ve written <a title="http://krebsonsecurity.com/category/ddos-for-hire/" href="http://krebsonsecurity.com/category/ddos-for-hire/" target="_blank">plenty of stories</a> in the past year about the dramatic increase in DDoS-for-hire services (a.k.a. &#8220;booters&#8221; or &#8220;stressers&#8221;). In fact, on Monday, I published <a title="http://krebsonsecurity.com/2015/01/spreading-the-disease-and-selling-the-cure/" href="http://krebsonsecurity.com/2015/01/spreading-the-disease-and-selling-the-cure/" target="_blank">Spreading the Disease and Selling the Cure</a>, which profiled two young men who were running both multiple DDoS-for-hire services and selling services to help defend against such attacks.<span id="more-29658"></span></p>
<p>The vast majority of customers appear to be gamers using these DDoS-for-hire services to settle scores or grudges against competitors; many of these attack services have been hacked over the years, and the <a title="https://krebsonsecurity.com/2015/01/another-lizard-arrested-lizard-lair-hacked/" href="https://krebsonsecurity.com/2015/01/another-lizard-arrested-lizard-lair-hacked/" target="_blank">leaked back-end customer databases</a> almost always show a huge percentage of the attack targets are either individual Internet users or online gaming servers (particularly <strong>Minecraft</strong> servers). However, many of these services are capable of launching considerably large attacks &#8212; in excess of 75 Gbps to 100 Gpbs &#8212; against practically any target online.</p>
<p>As Arbor notes, some of the biggest attacks take advantage of Internet-based hardware &#8212; everything from gaming consoles to routers and modems &#8212; that ships with networking features that can easily be abused for attacks and that are turned on by default. Perhaps fittingly, the largest attacks that hit my site in the past four months are known as SSDP assaults because they take advantage of the <a title="http://en.wikipedia.org/wiki/Simple_Service_Discovery_Protocol" href="http://en.wikipedia.org/wiki/Simple_Service_Discovery_Protocol" target="_blank">Simple Service Discovery Protocol</a> &#8212; a component of the Universal Plug and Play (UPnP) standard that lets networked devices (such as gaming consoles) seamlessly connect with each other.</p>
<p>In <a title="http://www.akamai.com/html/about/press/releases/2014/press-101514-2.html" href="http://www.akamai.com/html/about/press/releases/2014/press-101514-2.html" target="_blank">an advisory released in October 2014</a>, Akamai warned of a spike in the number of UPnP-enabled devices that were being used to amplify what would otherwise be relatively small attacks into oversized online assaults.</p>
<p>Akamai said it found 4.1 million Internet-facing UPnP devices were potentially vulnerable to being employed in this type of reflection DDoS attack – <em>about 38 percent of the 11 million devices in use around the world</em>. The company said it was willing to share the list of potentially exploitable devices to members of the security community in an effort to collaborate with cleanup and mitigation efforts of this threat.</p>
<p>That&#8217;s exactly the response that we need, because there are new DDoS-for-hire services coming online every day, and there are tens of millions of misconfigured or ill-configured devices out there that can be similarly abused to launch devastating attacks. According to the <a title="http://openresolverproject.org/" href="http://openresolverproject.org/" target="_blank">Open Resolver Project</a>, a site that tracks devices which can be abused to help launch attacks online, there are currently more than 28 million Internet-connected devices that attackers can abuse for use in completely anonymous attacks.</p>
<p>Tech pundits and Cassandras of the world like to wring their hands and opine about the coming threat from the so-called &#8220;Internet of Things&#8221; &#8212; the possible security issues introduced by the proliferation of network-aware devices &#8212; from fitness trackers to Internet-connected appliances. But <span class="pullquote pqright">from where I sit, the real threat is from The Internet of Things We Already Have That Need Fixing Today.</span></p>
<p>To my mind, this a massive problem deserving of an international and coordinated response. We currently have global vaccination efforts to eradicate infectious and communicable but treatable diseases. Unfortunately, we probably need a similar type of response to deal with the global problem of devices that can be conscripted at a moment&#8217;s notice to join a virtual flash mob capable of launching attacks that can knock almost any target offline for hours or days on end.</p>
<p>Anyone who needs a reminder of just how bad the problem is need only look to the attacks of Christmas Day 2014 that <a title="http://krebsonsecurity.com/2014/12/cowards-attack-sony-playstation-microsoft-xbox-networks/" href="http://krebsonsecurity.com/2014/12/cowards-attack-sony-playstation-microsoft-xbox-networks/" target="_blank">took out the Sony Playstation and Microsoft Xbox gaming networks</a>. Granted, those companies were already dealing with tens of millions of new customers that very same day, but as <a title="http://krebsonsecurity.com/2015/01/lizard-stresser-runs-on-hacked-home-routers/" href="http://krebsonsecurity.com/2015/01/lizard-stresser-runs-on-hacked-home-routers/" target="_blank">I noted in my Jan. 9 exclusive</a>, the DDoS-for-hire service implicated in that attack (or at least the attackers) was built using a few thousand hijacked home Internet routers.</p>
<p>[Author&#8217;s note: The headline for this post was inspired by <strong>Glenn Fleishman</strong>&#8216;s excellent Jan. 13, 2015 piece in MIT Technology Review, <a title="http://www.technologyreview.com/news/534196/an-internet-of-treacherous-things/" href="http://www.technologyreview.com/news/534196/an-internet-of-treacherous-things/" target="_blank">An Internet of Treacherous Things</a>.]</p>


feed_id: http://krebsonsecurity.com/?p=29703
title: Target Hackers Hit Third Parking Service
uri: Target-Hackers-Hit-Third-Parking-Service
url: http://krebsonsecurity.com/2015/02/target-hackers-hit-third-parking-service/
content:
<p><strong>Book2Park.com</strong>, an online parking reservation service for airports across the United States, appears to be the latest victim of the hacker gang that stole more than a 100 million credit and debit cards from <strong>Target</strong> and <strong>Home Depot</strong>. Book2park.com is the third online parking service since December 2014 to fall victim to this cybercriminal group.</p>
<p><a href="media/e6d30659.book2park.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/02/book2park.png"><img class="alignright size-full wp-image-29718" src="media/e6d30659.book2park.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/02/book2park.png" alt="book2park" width="248" height="120" /></a>Last week, a new batch of credit card numbers [dubbed &#8220;<strong>Denarius</strong>&#8220;] went up for sale on <strong>Rescator[dot]cm</strong>, the cybercrime bazaar that earned infamy by selling tens of millions of cards stolen from Target and Home Depot. Multiple banks contacted by this author acquired a handful of cards from this new batch, and each of those financial institutions found the same pattern: All of the cards they bought had been issued to customers who recently made airport parking reservations at Book2Park.com.</p>
<p>Contacted about the apparent breach, Book2park.com owner <strong>Anna Infante</strong> said she was not aware that hundreds &#8212; if not thousands &#8212; of her customers cards were for sale online. But she said a technology firm the company contracts with did recently discover and remove malicious files that were somehow planted on Book2park&#8217;s Web server.</p>
<p>&#8220;We already took action on this, and we are totally on it,&#8221; Infante said. &#8220;We are taking all further steps in protecting our customers and reporting this to the proper authorities.&#8221;</p>
<p>In December, the same hacker gang began selling card accounts <a title="http://krebsonsecurity.com/2015/01/park-n-fly-onestopparking-confirm-breaches/" href="http://krebsonsecurity.com/2015/01/park-n-fly-onestopparking-confirm-breaches/" target="_blank">stolen from the Web sites of Park &#8216;N Fly and OneStopParking.com</a>. The card accounts stolen from OneStopParking and Park &#8216;N Fly sold for prices between $6 and $13, but the cards taken from Book2Park&#8217;s site mostly fetch prices ranging from $12 to $18. This may be because most of the cards were issued by European banks, which tend to sell for more (at least on Rescator&#8217;s site).<span id="more-29703"></span></p>
<p>Unlike card data stolen from main street retailers — which can be encoded onto new plastic and used to buy stolen goods in physical retail stores — cards stolen from online transactions can only be used by thieves for fraudulent online purchases. However, most online carding shops that sell stolen card data in underground stores market both types of cards, known in thief-speak as “dumps” and “CVVs,” respectively.</p>
<p>These e-commerce site hacks are not wholly unlike compromises on consumer/end user PCs. Malware gets planted on the server that watches for visitors to enter sensitive data into order forms. The malware then secretly copies that data from the transaction stream before it can be encrypted (I have no specific knowledge of the malware used, just trying to illustrate a concept in response to several readers who seem to believe that an ecommerce compromise that exposes card data automatically means the merchant is storing card data).</p>
<p>It&#8217;s unclear why these crooks are targeting online parking reservation systems. There is no clear connection between the three services hacked by this gang, either in their current or previous hosting infrastructures or Web technologies.</p>
<p>&nbsp;</p>


feed_id: http://krebsonsecurity.com/?p=29697
title: Banks: Card Thieves Hit White Lodging Again
uri: Banks-Card-Thieves-Hit-White-Lodging-Again
url: http://krebsonsecurity.com/2015/02/banks-card-thieves-hit-white-lodging-again/
content:
<p>For the second time in a year, multiple financial institutions are complaining of fraud on customer credit and debit cards that were all recently used at a string of <strong>Marriott</strong> properties run by hotel franchise firm <strong>White Lodging Services Corporation. </strong>White Lodging says it is investigating, but that so far it has found no signs of a new breach.</p>
<p><a href="media/2bfc356a.whitelodging.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/01/whitelodging.png"><img class="alignright size-full wp-image-24638" src="media/2bfc356a.whitelodging.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/01/whitelodging.png" alt="whitelodging" width="239" height="82" /></a>In January 31, 2014, this author <a title="http://krebsonsecurity.com/2014/01/hotel-franchise-firm-white-lodging-investigates-breach/" href="http://krebsonsecurity.com/2014/01/hotel-franchise-firm-white-lodging-investigates-breach/" target="_blank">first reported</a> evidence of a breach at some White Lodging locations. The Merrillville, Ind. based company <a title="http://www.whitelodging.com/about/payment-card-issues" href="http://www.whitelodging.com/about/payment-card-issues" target="_blank">confirmed a breach</a> three days later, saying hackers had installed malicious software on cash registers in food and beverage outlets at 14 locations nationwide, and that the intruders had been stealing customer card data from these outlets for approximately nine months.</p>
<p>Fast-forward to late January 2015, and KrebsOnSecurity again began hearing from several financial institutions who had traced a pattern of counterfeit card fraud back to accounts that were all used at Marriott properties across the country.</p>
<p>Banking sources say the cards that were compromised in this most recent incident look like they were stolen from many of the same White Lodging locations implicated in the 2014 breach, including hotels in Austin, Texas, Bedford Park, Ill., Denver, Indianapolis, and Louisville, Kentucky.  Those same sources said the compromises appear once again to be tied to hacked cash registers at food and beverage establishments within the White Lodging run hotels. The legitimate hotel transactions that predated fraudulent card charges elsewhere range from mid-September 2014 to January 2015.</p>
<p>Contacted about the findings, Marriott spokesman <strong>Jeff Flaherty</strong> said all of the properties cited by the banks as source of card fraud are run by White Lodging.</p>
<p>&#8220;We recently were made aware of the possibility of unusual credit card transactions at a number of hotels operated by one of our franchise management companies,&#8221; Flaherty said. &#8220;We understand the franchise company is looking into the matter. Because the suspected issue is related to systems that Marriott does not own or control, we do not have additional information to provide.&#8221;</p>
<p>I reached out to White Lodging on Jan. 31. In an emailed statement sent today, White Lodging spokesperson <strong>Kathleen Sebastian</strong> said the company engaged a security firm to investigate the reports, but so far that team has found no indication of a compromise.</p>
<p>&#8220;From your inquiry, we have engaged a full forensic audit of the properties in question,&#8221; Sebastian wrote. &#8220;We appreciate your concern, and we are taking this information very seriously. To this date, we have found no identifiable infection that would lead us to believe a breach has occurred. Our investigation is ongoing.&#8221;</p>
<p>Sebastian went on to say that in the past year, White Lodging has adopted a number of new security measures, including the installation of a third-party managed firewall system, dual-factor authentication for critical systems, and &#8220;various other systems as guided by our third-party cyber security service. While we have executed additional security protocols, we do not wish to specifically disclose full details of all security measure to the public.&#8221;<span id="more-29697"></span></p>
<p><span style="text-decoration: underline;">TOKENIZATION VS. ENCRYPTION</span></p>
<p>Flaherty said Marriott is nearing completing of a project to retrofit cash registers at Marriott-run properties with a technology called <a title="http://en.wikipedia.org/wiki/Tokenization_%28data_security%29" href="http://en.wikipedia.org/wiki/Tokenization_%28data_security%29" target="_blank">tokenization</a>, which substitutes card data with placeholder information that has no intrinsic or exploitable value for attackers.</p>
<p>&#8220;As this matter involves Marriott hotel brands, we want to provide assurance that Marriott has a long-standing commitment to protect the privacy of the personal information that our guests entrust to us and we will continue to monitor the situation closely,&#8221; he said. &#8220;Marriott is currently on track to have all our U.S. managed systems fully tokenized within the month or so.&#8221;</p>
<p>Pressed on whether White Lodging also was using tokenization, Sebastian said the front desk systems at all White Lodging-managed Marriott properties are fully tokenized, and that payment terminals at other parts of the hotel (including restaurants, bars and gift shops) &#8220;are transitioning to tokenization and are scheduled to be fully tokenized by the end of the second quarter.&#8221;</p>
<p>Tokenization as a card security solution tends to be most attractive to businesses that must keep customer card numbers on file until the transaction is finalized, such as hotels, bars and rental car services. A January 2015 report by <strong>Gartner Inc.</strong> fraud analyst <strong>Avivah Litan</strong> found that at least 50 percent of <a title="http://usa.visa.com/merchants/protect-your-business/cisp/merchant-pci-dss-compliance.jsp" href="http://usa.visa.com/merchants/protect-your-business/cisp/merchant-pci-dss-compliance.jsp" target="_blank">Level 1 through Level 3</a> U.S. merchants have already adopted or will adopt tokenization in the next year.</p>
<p>Merchants retain tokens because they need to hang on to a single unique identifier of the customer for things like recurring billing, loyalty programs, and chargebacks and disputes. But experts say tokenization itself does not solve the problem that has fueled most retail card breaches in recent years: Malware remotely installed on point-of-sale devices that steals customer card data before it can be tokenized.</p>
<p>Gartner&#8217;s Litan said an alternative and far more secure approach to handling card data involves <a title="https://www.pcisecuritystandards.org/documents/P2PE_Hardware_Solution_%20Requirements_Initial_Release.pdf" href="media/b18d085b.P2PE_Hardware_Solution_20Requirements_Initial_Release.pdf" data-original-source="https://www.pcisecuritystandards.org/documents/P2PE_Hardware_Solution_%20Requirements_Initial_Release.pdf" target="_blank">point-to-point encryption</a> &#8212; essentially installing card readers and other technology that ensures customer card data is never transmitted in plain text anywhere in the retail environment. But, she said, many businesses have chosen tokenization in favor of encryption because it is cheaper and less complicated to implement in the short run.</p>
<p>&#8220;Point-to-point encryption involves upgrading your card readers, because you want the encryption to happen not at the software level &#8212; where it can be hacked &#8212; but at the hardware level,&#8221; Litan said. &#8220;But it&#8217;s expensive and there aren&#8217;t a lot of <a title="https://www.pcisecuritystandards.org/approved_companies_providers/validated_p2pe_solutions.php" href="https://www.pcisecuritystandards.org/approved_companies_providers/validated_p2pe_solutions.php" target="_blank">approved vendors</a> to chose from if you want to pick a vendor who is in compliance&#8221; with <a title="https://www.pcicomplianceguide.org/pci-faqs-2/" href="https://www.pcicomplianceguide.org/pci-faqs-2/" target="_blank">Payment Card Industry</a> (PCI) standards, violations of which can come with fines and costly audits, she said.</p>
<p>Merchants that adopt point-to-point encryption may also find themselves locked into a single credit card processor, because the encryption technology built into the newer readers often only works with a specific processor, Litan said.</p>
<p>&#8220;You end up with vendor or processor lock-in, because now your equipment is locked in to one payment processor, and you can&#8217;t easily just change to another processor if you&#8217;re later unhappy with that arrangement because that means changing your equipment,&#8221; Litan said.</p>
<p>In the end, many businesses &#8212; particularly hotels &#8212; opt for tokenization because it can dramatically simplify their process of proving compliance with PCI standards. For example, merchants that hold onto customer card data for a period of time until a transaction is finalized may be required to complete a security assessment that demands proof of compliance with some 350 different PCI requirements, whereas merchants that do not store electronic cardholder data or have substituted that process through tokenization likely have about 90 percent fewer PCI requirements to satisfy.</p>
<p>&#8220;<span class="pullquote pqright">In a lot of cases, it’s really less about security and more about simplifying PCI compliance to reduce the scope of the audit, because you get big rewards when you don’t store credit card data,&#8221; Litan said.</span> &#8220;Unfortunately, the PCI standards don&#8217;t have the same kind of rewards when it comes to securing card data in-transit [across a retailer&#8217;s internal network and systems] which is what point-to-point encryption addresses.&#8221;</p>
<p>Merchants in the United States are gradually shifting to installing card readers that can accommodate <a title="http://krebsonsecurity.com/2014/10/chip-pin-vs-chip-signature/" href="http://krebsonsecurity.com/2014/10/chip-pin-vs-chip-signature/" target="_blank">more secure chip cards</a> that adhere to the Europay, MasterCard and Visa or EMV standard. These chip cards are designed to be far more expensive and difficult for thieves to counterfeit than regular credit cards that most U.S. consumers have in their wallets. Non-chip cards store cardholder data on a magnetic stripe, which can be trivially copied by point-of-sale malware.</p>
<p>Magnetic-stripe based cards are the primary target for hackers who have been breaking into retailers like <a title="http://krebsonsecurity.com/?s=target+breach&amp;x=0&amp;y=0" href="http://krebsonsecurity.com/?s=target+breach&amp;x=0&amp;y=0" target="_blank">Target</a> and <a title="http://krebsonsecurity.com/?s=home+depot+breach&amp;x=0&amp;y=0" href="http://krebsonsecurity.com/?s=home+depot+breach&amp;x=0&amp;y=0" target="_blank">Home Depot</a> and installing malicious software on the cash registers: The data is quite valuable to crooks because it can be sold to thieves who encode the information onto new plastic and go shopping at big box stores for stuff they can easily resell for cash (think high-dollar gift cards and electronics).</p>
<p>Newer, EMV/chip-based card readers can enable a range of additional payment and security options, including point-to-point encryption and mobile payments, such as <strong>Apple</strong>&#8216;s new Apple Pay system. But integrating EMV with existing tokenization schemes can also present challenges for merchants. For example, Apple Pay uses a separate EMV tokenization process.</p>
<p>&#8220;This means that merchants who use their own tokenization system and choose to accept Apple Pay payments will end up with multiple tokens for one card number, defeating a major reason why many merchants adopted tokenization in the first place,&#8221; Litan said.</p>


feed_id: http://krebsonsecurity.com/?p=29759
title: Data Breach at Health Insurer Anthem Could Impact Millions
uri: Data-Breach-at-Health-Insurer-Anthem-Could-Impact-Millions
url: http://krebsonsecurity.com/2015/02/data-breach-at-health-insurer-anthem-could-impact-millions/
content:
<p><strong>Anthem Inc.</strong>, the nation&#8217;s second largest health insurer, disclosed Wednesday that hackers had broken into its servers and stolen Social Security numbers and other personal data from all of its business lines. Given the company&#8217;s size, this breach could end up impacting tens of millions of Americans.</p>
<p><a href="media/f3febd52.anthem.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/02/anthem.png"><img class="alignright size-full wp-image-29762" src="media/f3febd52.anthem.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/02/anthem.png" alt="anthem" width="232" height="76" /></a>Anthem didn&#8217;t specify how many consumer records may have been breached, but it did say all of the company&#8217;s business units are affected. The <a title="http://www.antheminc.com/AboutAnthemInc/index.htm" href="http://www.antheminc.com/AboutAnthemInc/index.htm" target="_blank">figures from Anthem&#8217;s Web site</a> offer a glimpse at just how big this breach could be: &#8220;With nearly 69 million people served by its affiliated companies including more than 37 million enrolled in its family of health plans, Anthem is one of the nation’s leading health benefits companies.&#8221;</p>
<p>The company said it is conducting an extensive IT forensic investigation to determine what members are impacted.</p>
<p>&#8220;We are working around the clock to determine how many people have been impacted and will notify all Anthem members who are impacted through a written communication,&#8221; Anthem said in <a title="http://www.anthemfacts.com/faq" href="http://www.anthemfacts.com/faq" target="_blank">question and answer page</a> released about the breach.</p>
<p>Formerly known as <strong>Wellpoint Inc.</strong>, Anthem said in <a title="http://www.anthemfacts.com/" href="http://www.anthemfacts.com/" target="_blank">a statement</a> that the company was the target of a &#8220;very sophisticated external cyber attack&#8221; that exposed names, dates of birth, member ID/ Social Security numbers, addresses, phone numbers, email addresses and employment information. The company stressed that the exposed data did not include medical records or financial information.<span id="more-29759"></span></p>
<p>According to Athem&#8217;s statement, the impacted (plan/brands) include Anthem Blue Cross, Anthem Blue Cross and Blue Shield, Blue Cross and Blue Shield of Georgia, Empire Blue Cross and Blue Shield, Amerigroup, Caremore, Unicare, Healthlink, and DeCare. The company said impacted members will receive notice via mail which will advise them of the protections being offered to them as well as any next steps.</p>
<p>Anthem said once the attack was discovered, the company immediately made every effort to close the security vulnerability, contacted the FBI and began fully cooperating with their investigation.</p>
<p>More on this story as it develops. Stay tuned.</p>


feed_id: http://krebsonsecurity.com/?p=29713
title: Hacked Hotel Phones Fueled Bank Phishing Scams
uri: Hacked-Hotel-Phones-Fueled-Bank-Phishing-Scams
url: http://krebsonsecurity.com/2015/02/hacked-hotel-phones-fueled-bank-phishing-scams/
content:
<p>A recent phishing campaign targeting customers of several major U.S. banks was powered by text messages directing recipients to call hacked phone lines at <strong>Holiday Inn</strong> locations in the south. Such attacks are not new, but this one is a timely reminder that phishers increasingly are using lures blasted out via SMS as more banks turn to text messaging to communicate with customers about account activity.</p>
<p><a href="media/fcccd134.smish.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/02/smish.png"><img class="alignright size-medium wp-image-29752" src="media/b18afeb0.smish-285x253.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/02/smish-285x253.png" alt="smish" width="285" height="253" /></a>The above-mentioned phishing attacks were actually a mix of scams known as &#8220;SMiShing&#8221; &#8212; phishing lures sent via SMS text message &#8212; and voice phishing or &#8220;vishing,&#8221; where consumers are directed to call a number that answers with a voice prompt spoofing the bank and instructing the caller to enter his credit card number and expiration date.</p>
<p>Over the past two weeks, fraudsters have been blasting out SMS messages to hundreds of thousands of mobile users in the Houston, Texas area. The messages alerted recipients about supposed problems with their bank account, urging them to call a supplied number and follow the automated voice prompts to validate or verify their credit card account information.</p>
<p>On Saturday, Jan. 30, I called one of the numbers that was sent out in the smishing/vishing scam &#8212; <strong>281-866-0500</strong> &#8211; which is the main phone line for a Holiday Inn Express in Houston. At the time, calls to the number went straight to an automated voice prompt targeting <strong>Bank of America</strong> customers:</p>
<p>&#8220;Thank you for calling Bank of America. A text message has been sent to inform you that your debit card has been limited due to a security issue. To reactivate, please press one now.&#8221; After pressing one, the caller is prompted to enter the last four digits of their Social Security number, and then the full card number and expiration date.</p>
<p>My recording of the call was garbled, but <a title="https://soundcloud.com/numbercop/phone-fraud-robocall-vishing-38-example-key-bank" href="https://soundcloud.com/numbercop/phone-fraud-robocall-vishing-38-example-key-bank" target="_blank">here&#8217;s a copy of a very similar voice prompt</a> targeting <strong>Key Bank</strong> customers earlier in January that also was run off the fax line tied to a different Holiday Inn a few miles away in Houston [number: 832-237-8999], according to <a title="http://www.numbercop.com/" href="http://www.numbercop.com/" target="_blank">Numbercop</a>, a telephony threat intelligence firm.</p>
<p>Holiday Inn&#8217;s corporate office did not return calls seeking comment, but the company apparently got the message because the phone lines were answering normally on Monday. A front desk clerk who answered the line on Tuesday said the hotel received over 100 complaints from people who got text messages prompting them to call the hotel&#8217;s main number during the time it was hacked.</p>
<p>According to <strong>Jan Volzke</strong>, Numbercop&#8217;s chief executive, these scams typically start on a Saturday afternoon and run through the weekend when targeted banks are typically closed.</p>
<p>&#8220;Two separate Holiday Inns getting hijacked in such short time suggests there is a larger issue at work with their telephone system provider,&#8221; he said. &#8220;That phone line is probably sitting right next to the credit card machine of the Holiday Inn. In a way this is just another retail terminal, and if they can’t secure their phone lines, maybe you shouldn&#8217;t be giving them your credit card.&#8221;<span id="more-29713"></span></p>
<p>Volzke said the recipients of the phony texts in Houston were geo-targeted by area code.</p>
<p>&#8220;The texts were sent in bursts with varying bank affiliations, including Bank of America, Fifth Third Bank, and Susquehanna Bank,&#8221; he said. &#8220;The campaign last week was an identical case to one a week or so earlier that referenced Key Bank, Bank of America and Wells Fargo.&#8221;</p>
<p>Numbercop says the text message lures were sent using <a title="http://martinfitzpatrick.name/list-of-email-to-sms-gateways/" href="http://martinfitzpatrick.name/list-of-email-to-sms-gateways/" target="_blank">email-to-SMS gateways</a>, but that the company also has seen similar campaigns sent from regular in-network numbers (prepaid mobile phones e.g.), which can be harder to catch. In addition, Volzke said, phishers often will target <strong>AT&amp;T</strong> and <strong>Verizon</strong> users for use in furthering these schemes.</p>
<div id="attachment_29750" style="width: 609px" class="wp-caption aligncenter"><a href="media/1e40b16c.cloudmark-smsphish.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/02/cloudmark-smsphish.png"><img class="size-full wp-image-29750" src="media/1e40b16c.cloudmark-smsphish.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/02/cloudmark-smsphish.png" alt="Source: Cloudmark" width="599" height="207" /></a><p class="wp-caption-text">Source: Cloudmark</p></div>
<p>Many banks now offer their customers the ability to receive text message alerts about activity on their credit card accounts &#8212; such as recent transactions &#8212; so it&#8217;s not surprising that crooks are exploiting this medium. While vishing and SMiShing attacks are not new (see <a title="http://krebsonsecurity.com/2010/06/a-spike-in-phone-phishing-attacks/" href="http://krebsonsecurity.com/2010/06/a-spike-in-phone-phishing-attacks/" target="_blank">this story</a> from 2010), they are on the rise: According to <strong>Cloudmark</strong>, the incidence of SMS bank account phishing in the U.S. <a title="http://blog.cloudmark.com/2014/12/01/u-s-sms-phishing-attacks-on-the-rise-this-fall/" href="http://blog.cloudmark.com/2014/12/01/u-s-sms-phishing-attacks-on-the-rise-this-fall/" target="_blank">more than tripled in September 2014</a>. Cloudmark’s recently released <a title="https://www.cloudmark.com/en/s/trends/threat-reports" href="https://www.cloudmark.com/en/s/trends/threat-reports" target="_blank">Annual Threat Report</a> found more than one in four unsolicited SMS messages reported in 2014 attempted to steal the victim’s personal or financial information.</p>
<p>Volzke says it&#8217;s unfortunate that more financial institutions aren&#8217;t communicating with their customers via mobile banking apps.</p>
<p>&#8220;Banking apps are among the most frequently downloaded and used apps,&#8221; Volzke said. &#8220;If the user has an app from the bank installed, then if the bank really has something to say they should use the in-app messaging method, not text messages which can be spoofed and are not secure. And yet we see almost no bank making use of this.&#8221;</p>
<p>Regardless of whether you communicate with your bank via text message, avoid calling phone numbers or clicking links that appear to have been sent via text message from your bank. Also, be extremely wary of any incoming calls from someone calling from your bank. If you think there may be an issue with your account, your best bet is to simply call the number on the back of your credit or debit card.</p>


feed_id: http://krebsonsecurity.com/?p=29724
title: Yet Another Flash Patch Fixes Zero-Day Flaw
uri: Yet-Another-Flash-Patch-Fixes-Zero-Day-Flaw
url: http://krebsonsecurity.com/2015/02/yet-another-flash-patch-fixes-zero-day-flaw/
content:
<p>For the third time in two weeks, <strong>Adobe</strong> has issued an emergency security update for its <strong>Flash Player</strong> software to fix a dangerous zero-day vulnerability that hackers already are exploiting to launch drive-by download attacks.</p>
<p><a href="media/06f26f56.brokenflash-a.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2013/02/brokenflash-a.png"><img class="alignright size-full wp-image-18875" src="media/06f26f56.brokenflash-a.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2013/02/brokenflash-a.png" alt="brokenflash-a" width="211" height="180" /></a>The newest update, <em>version 16.0.0.305</em>, addresses a critical security bug (<a title="http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0313" href="http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-0313" target="_blank">CVE-2015-0313</a>) present in the version of Flash that Adobe <a title="http://krebsonsecurity.com/2015/01/yet-another-emergency-flash-player-patch/" href="http://krebsonsecurity.com/2015/01/yet-another-emergency-flash-player-patch/" target="_blank">released o</a>n Jan. 27 (<em>v. 16.0.0.296</em>). Adobe said it is are aware of reports that this vulnerability is being actively exploited in the wild via <a title="http://en.wikipedia.org/wiki/Drive-by_download" href="http://en.wikipedia.org/wiki/Drive-by_download" target="_blank">drive-by-download attacks</a> against systems running <strong>Internet Explorer</strong> and <strong>Firefox</strong> on <strong>Windows 8.1</strong> and below.</p>
<p>Adobe&#8217;s <a title="https://helpx.adobe.com/security/products/flash-player/apsa15-02.html" href="https://helpx.adobe.com/security/products/flash-player/apsa15-02.html" target="_blank">advisory</a> credits both <strong>Trend Micro</strong> and <strong>Microsoft</strong> with reporting this bug. Trend Micro published <a title="http://blog.trendmicro.com/trendlabs-security-intelligence/trend-micro-discovers-new-adobe-flash-zero-day-exploit-used-in-malvertisements/" href="http://blog.trendmicro.com/trendlabs-security-intelligence/trend-micro-discovers-new-adobe-flash-zero-day-exploit-used-in-malvertisements/" target="_blank">a blog post</a> three days ago warning that the flaw was being used in <a title="http://en.wikipedia.org/wiki/Malvertising" href="http://en.wikipedia.org/wiki/Malvertising" target="_blank">malvertising attacks</a> &#8211; booby-trapped ads uploaded by criminals to online ad networks. Trend also published <a title="http://blog.trendmicro.com/trendlabs-security-intelligence/a-closer-look-at-the-exploit-kit-in-cve-2015-0313-attack/" href="http://blog.trendmicro.com/trendlabs-security-intelligence/a-closer-look-at-the-exploit-kit-in-cve-2015-0313-attack/" target="_blank">a more in-depth post</a> examining this flaw&#8217;s use in the <strong>Hanjuan Exploit Ki</strong>t, a crimeware package made to be stitched into hacked Web sites and foist malware on visitors via browser plug-in flaws like this one.<span id="more-29724"></span></p>
<p>To see which version of Flash you have installed, check <a title="https://www.adobe.com/software/flash/about/" href="https://www.adobe.com/software/flash/about/" target="_blank">this link</a>. Windows users who browse the Web with anything other than Internet Explorer may need to apply this patch twice, once with IE and again using the alternative browser (Firefox, Opera, e.g.).</p>
<p>The most recent versions of Flash should be available from the <a title="http://get.adobe.com/flashplayer/" href="http://get.adobe.com/flashplayer/" target="_blank">Flash home page</a>, but beware potentially unwanted add-ons, like McAfee Security Scan. To avoid this, uncheck the pre-checked box before downloading, or grab your OS-specific Flash download from <a title="http://www.adobe.com/fr/products/flashplayer/distribution3.html" href="http://www.adobe.com/fr/products/flashplayer/distribution3.html" target="_blank">here</a>.</p>
<p>IE10/IE11 on Windows 8.x and Chrome should auto-update their versions of Flash. Google Chrome <a title="http://googlechromereleases.blogspot.com/2015/02/stable-channel-update.html" href="http://googlechromereleases.blogspot.com/2015/02/stable-channel-update.html" target="_blank">version <em>40.0.2214.111</em></a> includes this update, and is available now. To check for updates in Chrome, click the stacked three bars to the right of the address bar in Chrome, and look for a listing near the bottom that says “Update Chrome.”</p>
<p>As I noted in <a title="http://krebsonsecurity.com/2015/01/flash-patch-targets-zero-day-exploit/#more-29596" href="http://krebsonsecurity.com/2015/01/flash-patch-targets-zero-day-exploit/#more-29596" target="_blank">a previous Flash post</a>, short of removing Flash altogether &#8212; which may be impractical for some users &#8212; there are intermediate solutions. Script-blocking applications like <a title="https://noscript.net/" href="https://noscript.net/" target="_blank">Noscript</a> and <a title="https://chrome.google.com/webstore/detail/scriptsafe/oiigbmnaadbkfbmpbfijlflahbdbdgdf?hl=en" href="https://chrome.google.com/webstore/detail/scriptsafe/oiigbmnaadbkfbmpbfijlflahbdbdgdf?hl=en" target="_blank">ScriptSafe</a> are useful in blocking Flash content, but script blockers can be challenging for many users to handle.</p>
<p>My favorite in-between approach is <a title="http://krebsonsecurity.com/2013/03/help-keep-threats-at-bay-with-click-to-play/" href="http://krebsonsecurity.com/2013/03/help-keep-threats-at-bay-with-click-to-play/" target="_blank">click-to-play</a>, which is a feature available for most browsers (except IE, sadly) that blocks Flash content from loading by default, replacing the content on Web sites with a blank box. With click-to-play, users who wish to view the blocked content need only click the boxes to enable Flash content inside of them (click-to-play also blocks Java applets from loading by default).</p>
<p>Windows users also should take full advantage of the <a title="http://www.microsoft.com/en-us/download/details.aspx?id=43714" href="http://www.microsoft.com/en-us/download/details.aspx?id=43714" target="_blank" rel="noreferrer">Enhanced Mitigation Experience Toolkit</a>(EMET), a free tool from Microsoft that can <a title="http://krebsonsecurity.com/2013/06/windows-security-101-emet-4-0/" href="http://krebsonsecurity.com/2013/06/windows-security-101-emet-4-0/" target="_blank">help Windows users</a> beef up the security of third-party applications.</p>


feed_id: http://krebsonsecurity.com/?p=29778
title: China To Blame in Anthem Hack?
uri: China-To-Blame-in-Anthem-Hack
url: http://krebsonsecurity.com/2015/02/china-to-blame-in-anthem-hack/
content:
<p><strong>Bloomberg</strong> reports that U.S. federal investigators probing <a title="http://krebsonsecurity.com/2015/02/data-breach-at-health-insurer-anthem-could-impact-millions/" href="http://krebsonsecurity.com/2015/02/data-breach-at-health-insurer-anthem-could-impact-millions/" target="_blank">the theft of 80 million Social Security records</a> and other sensitive data from insurance giant <strong>Anthem Inc.</strong> are pointing the finger at state-sponsored hackers from China. Although unconfirmed, that suspicion would explain a confidential alert the <strong>FBI</strong> circulated last week warning that Chinese hackers were targeting personally identifiable information from U.S. commercial and government networks.</p>
<p>According to <a title="http://www.bloomberg.com/news/articles/2015-02-05/signs-of-china-sponsored-hackers-seen-in-anthem-attack" href="http://www.bloomberg.com/news/articles/2015-02-05/signs-of-china-sponsored-hackers-seen-in-anthem-attack" target="_blank">this story</a> from Bloomberg&#8217;s <strong>Michael Riley</strong> and <strong>Jordan Robertson</strong>, &#8220;the attack appears to follow a pattern of thefts of medical data by foreigners seeking a pathway into the personal lives and computers of a select group &#8212; defense contractors, government workers and others, according to a U.S. government official familiar with a more than year-long investigation into the evidence of a broader campaign.&#8221;</p>
<p>While the story is light on details, it adds a bit more context to an FBI &#8220;flash alert&#8221; that KrebsOnSecurity obtained independently last week. The alert said the FBI has received information regarding a group of cyber actors who have compromised and stolen sensitive business information and Personally Identifiable Information (PII) from US commercial and government networks through cyber espionage.&#8221;</p>
<p><a href="media/7a2cd52e.fbi-pandaflash.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/02/fbi-pandaflash.png"><img class="aligncenter size-large wp-image-29787" src="media/ea7faecd.fbi-pandaflash-600x499.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/02/fbi-pandaflash-600x499.png" alt="fbi-pandaflash" width="600" height="499" /></a></p>
<p>The alert notes that analysis of malware samples used in the attack indicate a significant amount of the computer network exploitation activities emanated from infrastructure located within China. The FBI said the tools used in the attack were referenced in open source reports on <strong>Deep Panda</strong>, a claim that also shows up in the Bloomberg piece. That story references data about Deep Panda from cybersecurity firm <strong>CrowdStrike</strong>, which specializes in attributing nation state-level attacks.</p>
<p>According to the FBI, Deep Panda has previously used <strong>Adobe Flash</strong> zero-day exploits in order to gain initial access to victim networks. While it may be unrelated, it&#8217;s worth noting that in the past two weeks alone, Adobe has shipped <a title="http://krebsonsecurity.com/2015/02/yet-another-flash-patch-fixes-zero-day-flaw/" href="http://krebsonsecurity.com/2015/02/yet-another-flash-patch-fixes-zero-day-flaw/" target="_blank">no fewer than three unscheduled, emergency updates</a> to address Flash Player vulnerabilities that were being exploited in active attacks at the time Adobe released patches.</p>
<p>The FBI&#8217;s flash advisory continues:</p>
<blockquote><p>&#8220;Information obtained from victims indicates that PII was a priority target. The FBI notes that stolen PII has been used in other instances to target or otherwise facilitate various malicious activities such as financial fraud though the FBI is not aware of such activity by this group. Any activity related to this group detected on a network should be considered an indication of a compromise requiring extensive mitigation and contact with law enforcement.&#8221;</p></blockquote>
<p><a href="media/408556e7.deeppanda-cs.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/02/deeppanda-cs.png"><img class="aligncenter size-large wp-image-29797" src="media/c52e4514.deeppanda-cs-600x358.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/02/deeppanda-cs-600x358.png" alt="deeppanda-cs" width="600" height="358" /></a></p>
<p>In its own writeup on Deep Panda from mid-2014, CrowdStrike notes that &#8220;for almost three years now, CrowdStrike has monitored DEEP PANDA targeting critical and strategic business verticals including: government, defense, financial, legal, and the telecommunications industries. At the think tanks, [we have] detected targeting of senior individuals involved in geopolitical policy issues, in particular in the China/Asia Pacific region. DEEP PANDA presents a very serious threat not just to think tanks, but also multinational financial institutions, law firms, defense contractors, and government agencies.&#8221;<span id="more-29778"></span></p>
<p>Leaving aside the question of whether state-sponsored Chinese hackers were in fact behind the Anthem breach, there are still many unanswered questions about this incident, such as when did Anthem find out about it? How long did the breach last? How did the attackers break in? What can other businesses learn from this incident to protect themselves?</p>
<p><strong>Steve Ragan</strong>, a journalist who writes the <a title="http://www.csoonline.com/article/2880352/disaster-recovery/anthem-confirms-data-breach-but-full-extent-remains-unknown.html" href="http://www.csoonline.com/article/2880352/disaster-recovery/anthem-confirms-data-breach-but-full-extent-remains-unknown.html" target="_blank">Salted Hash blog</a> for <strong>CSO Online</strong>, references a document he received from a trusted source that was reportedly sent as a memo from Anthem to its clients. That memo notes that the unauthorized activity seems to date back to at least December 10, 2014. That activity apparently continued undetected until January 27, 2015, meaning the attackers had access to Anthem&#8217;s customer database for more than a month before they were discovered.</p>
<div id="attachment_29792" style="width: 610px" class="wp-caption aligncenter"><a href="media/84dcacc1.ragan-anthem.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/02/ragan-anthem.png"><img class="size-large wp-image-29792" src="media/7d873efd.ragan-anthem-600x384.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/02/ragan-anthem-600x384.png" alt="A memo sent from Anthem to its associates. Credit: Salted Hash." width="600" height="384" /></a><p class="wp-caption-text">A memo sent from Anthem to its associates. Credit: Salted Hash.</p></div>
<p>The memo explains:</p>
<p>&#8220;On January 27, 2015, an Anthem associate, a database administrator, discovered suspicious activity – a database query running using the associate&#8217;s logon information. He had not initiated the query and immediately stopped the query and alerted Anthem&#8217;s Information Security department. It was also discovered the logon information for additional database administrators had been compromised.&#8221;</p>
<p>The notice from Anthem to its clients concludes that &#8220;the attacker had proficient understanding of the data platforms and successfully utilized valid databaes administrator logon information.&#8221;</p>
<p>As for how the attackers broke in, perhaps <a title="http://krebsonsecurity.com/wp-content/uploads/2015/02/FBI-Flash-Warning-Deep-Panda.pdf" href="media/a0c21bee.FBI-Flash-Warning-Deep-Panda.pdf" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/02/FBI-Flash-Warning-Deep-Panda.pdf" target="_blank">the FBI&#8217;s Flash warning on Deep Panda</a> (PDF) holds some clues.</p>
<p>Incidentally, infosec professionals take note: Anthem is hiring. On Feb. 4, the same day that Anthem disclosed a breach at its &#8220;database warehouse&#8221; may have affected as many as 80 million consumers, it also posted <a title="http://careers.antheminc.com/jobs/cloud-encryption-security-professional-richmond-virginia-job-93911/" href="http://careers.antheminc.com/jobs/cloud-encryption-security-professional-richmond-virginia-job-93911/" target="_blank">a help wanted ad</a> for a &#8220;Cloud Encryption Security Professional.&#8221;</p>


feed_id: http://krebsonsecurity.com/?p=29810
title: Citing Tax Fraud Spike, TurboTax Suspends State E-Filings
uri: Citing-Tax-Fraud-Spike-TurboTax-Suspends-State-E-Filings
url: http://krebsonsecurity.com/2015/02/citing-tax-fraud-spike-turbotax-suspends-state-e-filings/
content:
<p><strong>TurboTax</strong> owner <strong>Intuit Inc.</strong> said Thursday that it is temporarily suspending the transmission of state e-filed tax returns in response to a surge in complaints from consumers who logged into their TurboTax accounts only to find crooks had already claimed a refund in their name.</p>
<p><a href="media/de3883fd.dyot-copy2.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/02/dyot-copy2.png"><img class="alignright size-full wp-image-29811" src="media/de3883fd.dyot-copy2.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/02/dyot-copy2.png" alt="dyot copy2" width="273" height="350" /></a>&#8220;During this tax season, Intuit and some states have seen an increase in suspicious filings and attempts by criminals to use stolen identity information to file fraudulent state tax returns and claim tax refunds,&#8221; the company said in <a title="http://www.intuit.com/company/press-room/press-releases/2015/Intuit-working-with-state-governments-to-solve-tax-fraud-problem/" href="http://www.intuit.com/company/press-room/press-releases/2015/Intuit-working-with-state-governments-to-solve-tax-fraud-problem/" target="_blank">a statement</a>.</p>
<p>Intuit said a third-party security audit turned up no signs of a security breach with the company, and that the information used to file fraudulent returns appears to have been obtained from other sources outside the tax preparation process.</p>
<p>&#8220;As it worked with state governments to assess and resolve the recent issues, Intuit took the precautionary step Thursday, Feb. 5, of temporarily pausing its transmission of state e-filing tax returns,&#8221; the company&#8217;s statement continued.</p>
<p>&#8220;Intuit will be working with the states today to begin turning transmissions back on. Customers who have already filed their state tax returns using Intuit software during this temporary pause will have their returns transmitted as soon as possible. They do not need to take further action at this time. This action does not affect the filing of federal income tax returns, and is limited to those states that require residents to file returns.&#8221;</p>
<p>This is hardly a new problem, but I have no doubt we are seeing even more phony tax refund claims than last year (in which my own taxes were filed fraudulently). Cyber thieves have long sought stolen credentials for hijacked tax preparation accounts at TurboTax, H&amp;R Block and related services. Typically, the usernames and passwords for consumer accounts at these services are obtained via password-stealing malware that infects end-user PCs (see my <a title="http://krebsonsecurity.com/2012/10/the-scrap-value-of-a-hacked-pc-revisited/" href="http://krebsonsecurity.com/2012/10/the-scrap-value-of-a-hacked-pc-revisited/" target="_blank">Value of a Hacked PC graphic</a> for more such examples.)</p>
<p>Victims also can see their tax accounts hijacked if crooks assume control over their inboxes as well, since tax preparation services &#8212; like most sites &#8212; allow users to reset their passwords by requesting a password reset link via email (see my <a title="http://krebsonsecurity.com/2013/06/the-value-of-a-hacked-email-account/" href="http://krebsonsecurity.com/2013/06/the-value-of-a-hacked-email-account/" target="_blank">Value of a Hacked Email Account graphic</a> for additional examples like this). And of course phishers frequently impersonate tax preparation firms in a bid to steal credentials.</p>
<p>Stolen TurboTax or H&amp;R Block credentials are cheaper and more plentiful than most people probably would imagine. According to the below-pictured well-known seller on the Dark Web forum <strong>Evolution Market</strong>, hacked accounts currently can be had for .0002 bitcoins, which works out to about 4 cents apiece.</p>
<div id="attachment_29813" style="width: 610px" class="wp-caption aligncenter"><a href="media/6588446a.hackedtaxessale.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/02/hackedtaxessale.png"><img class="size-large wp-image-29813" src="media/6f62af10.hackedtaxessale-600x379.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/02/hackedtaxessale-600x379.png" alt="A seller of hacked accounts on the Dark Web community Evolution Market sells hacked TurboTax and H&amp;R Block accounts for pennies apiece." width="600" height="379" /></a><p class="wp-caption-text">A seller of hacked accounts on the Dark Web community Evolution Market sells hacked TurboTax and H&amp;R Block accounts for pennies apiece.</p></div>
<p><span id="more-29810"></span></p>
<p>Hacked accounts are extremely useful for tax fraudsters because they typically include information from previous years&#8217; returns. They also usually include the filer&#8217;s adjusted gross income, which is a piece of data the IRS uses to verify a filer&#8217;s identity.</p>
<p>Perhaps it&#8217;s finally time for Intuit to support two-factor or two-step authentication for its customers? This is a basic security precaution which involves the service sending its user a unique, one-time code &#8212; via text message or specialized mobile app &#8212; that must be entered along with the customer&#8217;s username and password when he or she signs up for the service and then anytime after that when the service detects those same credentials being used from an Internet address or computer that the service doesn&#8217;t recognize.</p>
<p>The beauty of this approach is that even if customers have their credentials stolen in an phishing or malware attack, the crooks still can&#8217;t log in without also hijacking the second factor. It&#8217;s not an insurmountable challenge for the bad guys, but two-step authentication can dramatically cut down on the incidence of account takeovers. Unfortunately for Intuit and its users, calls for the company to support two-factor authentication have fallen on deaf ears so far, at least according to <a title="http://twofactorauth.org" href="http://twofactorauth.org" target="_blank">twofactorauth.org</a>, a site that tracks which popular cloud-based services support the added security measure.</p>
<p><strong>Update, Feb. 7, 9:08 a.m. ET:</strong> Intuit <a title="http://www.intuit.com/company/press-room/press-releases/2015/TurboTax-resumes-efiling-for-states/" href="http://www.intuit.com/company/press-room/press-releases/2015/TurboTax-resumes-efiling-for-states/" target="_blank">says</a> it has turned the state e-filing spigot back on. It also says it is turning on multi-factor authentication for all TurboTax customers, although the company declined (in their press release and via email) to specify how that process will work.</p>


feed_id: http://krebsonsecurity.com/?p=29829
title: Phishers Pounce on Anthem Breach
uri: Phishers-Pounce-on-Anthem-Breach
url: http://krebsonsecurity.com/2015/02/phishers-pounce-on-anthem-breach/
content:
<p>Phishers and phone fraudsters are capitalizing on public concern over <a title="http://krebsonsecurity.com/2015/02/data-breach-at-health-insurer-anthem-could-impact-millions/" href="http://krebsonsecurity.com/2015/02/data-breach-at-health-insurer-anthem-could-impact-millions/" target="_blank">a massive data breach</a> announced this week at health insurance provider <strong>Anthem</strong> in a bid to steal financial and personal data from consumers.</p>
<p>The flood of phishing scams was unleashed just hours after Anthem announced publicly that a &#8220;very sophisticated cyberattack&#8221; on its systems had compromised the Social Security information and other personal details on some 80 million Americans.</p>
<p>In a question on its <a title="http://www.anthemfacts.com/faq" href="http://www.anthemfacts.com/faq" target="_blank">FAQ page</a> about whether it would be offering credit monitoring to affected customers, &#8220;Anthem said All impacted members will receive notice via mail which will advise them of the protections being offered to them as well as any next steps.&#8221; Unsurprisingly, phishers took that as an invitation to blast out variations on the scam pictured below, which spoofs Anthem and offers recipients a free year&#8217;s worth of credit monitoring services for those who click the embedded link.</p>
<div id="attachment_29832" style="width: 531px" class="wp-caption aligncenter"><a href="media/7edb5784.anthemphish.jpg" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/02/anthemphish.jpg"><img class="size-full wp-image-29832" src="media/7edb5784.anthemphish.jpg" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/02/anthemphish.jpg" alt="Don't click or respond to these phishing emails." width="521" height="702" /></a><p class="wp-caption-text">Don&#8217;t click or respond to these phishing emails.</p></div>
<p>According to Anthem, fraudsters also are busy perpetrating similar scams by cold-calling people via telephone. In a recording posted to its toll-free hotline for this breach (<strong>877-263-7995</strong>), Anthem said it is aware of outbound call scams targeting current and former Anthem members.</p>
<p>&#8220;These emails and calls are not from anthem and no notifications have been sent from anthem since the initial notification on Feb. 4, 2015,&#8221; Anthem said in a voice recording on the hotline.</p>
<p>It is likely that these phishing and phone scams are random and opportunistic, but there is always the possibility that the data stolen from Anthem has fallen into the hands of scam artists. According to Anthem, the information stolen includes the consumer&#8217;s name, date of birth, member ID, street address, email address, phone number and employment information. However, experts believe that the attack on Anthem was <a title="http://krebsonsecurity.com/2015/02/china-to-blame-in-anthem-hack/" href="http://krebsonsecurity.com/2015/02/china-to-blame-in-anthem-hack/" target="_blank">perpetrated by state-sponsored hackers from China</a> seeking information on specific individuals for espionage purposes, although that conclusion has not been independently confirmed.</p>
<p>The company says it will begin sending notifications to affected consumers via snail mail in the coming weeks. In the meantime, if you&#8217;re a current or former Anthem member, be aware that these types of scams are likely to escalate in the coming days and weeks.</p>
<p><strong>Update, Feb. 9, 6:15 p.m. ET: </strong>In a somewhat farcical turn of events, it appears that the image above is actually from a phishing education campaign created by a company that helps firms impress upon their employees the importance of cybersecurity. The image above, when clicked, brings users to <a title="http://audit.knowbe4.com/kb4.html?crid=271678467&amp;crun=291682" href="http://audit.knowbe4.com/kb4.html?crid=271678467&amp;crun=291682" target="_blank">this page</a>, which warns visitors they&#8217;ve clicked on a link design to test awareness. That page is run by <strong>Knowbe4, </strong>whose CEO <strong>Stu Sjouwerman</strong> said in response to an inquiry that the image was likely forwarded to Anthem by a cautious employee of one of Knowbe4&#8217;s customers who received the phishing test but did not click the link. Full disclosure: Knowbe4 is an advertiser on this blog.</p>


feed_id: http://krebsonsecurity.com/?p=29825
title: Anthem Breach May Have Started in April 2014
uri: Anthem-Breach-May-Have-Started-in-April-2014
url: http://krebsonsecurity.com/2015/02/anthem-breach-may-have-started-in-april-2014/
content:
<p>Analysis of open source information on the cybercriminal infrastructure likely used to siphon 80 million Social Security numbers and other sensitive data from health insurance giant <strong>Anthem</strong> suggests the attackers may have first gained a foothold in April 2014, nine months before the company says it discovered the intrusion.</p>
<p><em>The Wall Street Journal</em> reported last week that security experts involved in the ongoing forensics investigation into the breach say the servers and attack tools used in the attack on Anthem bear the hallmark of a state-sponsored Chinese cyber espionage group known by a number of names, including &#8220;<a title="http://blog.crowdstrike.com/deep-thought-chinese-targeting-national-security-think-tanks/" href="http://blog.crowdstrike.com/deep-thought-chinese-targeting-national-security-think-tanks/" target="_blank">Deep Panda</a>,&#8221; &#8220;<a title="https://www.novetta.com/2014/10/cyber-security-coalition-releases-full-report-on-large-scale-interdiction-of-chinese-state-sponsored-espionage-effort/" href="https://www.novetta.com/2014/10/cyber-security-coalition-releases-full-report-on-large-scale-interdiction-of-chinese-state-sponsored-espionage-effort/" target="_blank">Axiom</a>,&#8221; <a title="http://blogs.cisco.com/security/talos/threat-spotlight-group-72" href="http://blogs.cisco.com/security/talos/threat-spotlight-group-72" target="_blank">Group 72</a>,&#8221; and the &#8220;<a title="http://www.emc.com/collateral/white-papers/h12756-wp-shell-crew.pdf" href="media/6bd9c337.h12756-wp-shell-crew.pdf" data-original-source="http://www.emc.com/collateral/white-papers/h12756-wp-shell-crew.pdf" target="_blank">Shell_Crew</a>,&#8221; to name but a few.</p>
<p>Deep Panda is the name given to this group by security firm <a title="http://www.crowdstrike.com" href="http://www.crowdstrike.com" target="_blank">CrowdStrike</a>. In November 2014, Crowdstrike published a snapshot of a graphic showing the malware and malicious Internet servers used in what security experts at <strong>PriceWaterhouseCoopers</strong> dubbed the <a title="http://pwc.blogs.com/cyber_security_updates/2014/10/scanbox-framework-whos-affected-and-whos-using-it-1.html" href="http://pwc.blogs.com/cyber_security_updates/2014/10/scanbox-framework-whos-affected-and-whos-using-it-1.html" target="_blank">ScanBox Framework</a>, a suite of tools that have been used to launch a number of cyber espionage attacks.</p>
<div id="attachment_29844" style="width: 610px" class="wp-caption aligncenter"><a class="lightbox" href="media/ffc4fa2c.scanbox-CS.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/02/scanbox-CS.png"><img class="size-large wp-image-29844" src="media/0f49c7c3.scanbox-CS-600x373.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/02/scanbox-CS-600x373.png" alt="A Maltego transform published by CrowdStrike. The graphic is intended to illustrate some tools and Internet servers that are closely tied to a Chinese cyber espionage group that CrowdStrike calls &quot;Deep Panda.&quot;" width="600" height="373" /></a><p class="wp-caption-text">A Maltego transform published by CrowdStrike. The graphic is intended to illustrate some tools and Internet servers thought to be closely tied to a Chinese cyber espionage group that CrowdStrike calls &#8220;Deep Panda.&#8221;</p></div>
<p>Crowdstrike&#8217;s snapshot (produced with the visualization tool <a title="https://www.paterva.com/" href="https://www.paterva.com/" target="_blank">Maltego</a>) lists many of the tools the company has come to associate with activity linked to Deep Panda, including a password stealing Trojan horse program called <a title="http://www.microsoft.com/security/portal/threat/encyclopedia/entry.aspx?name=TROJANSPY:WIN32/DERUSBI.A" href="http://www.microsoft.com/security/portal/threat/encyclopedia/entry.aspx?name=TROJANSPY:WIN32/DERUSBI.A" target="_blank">Derusbi</a>, and an Internet address &#8212; 198[dot]200[dot]45[dot]112.</p>
<p>CrowdStrike&#8217;s image curiously redacts the resource tied to that Internet address (note the black box in the image above), but a variety of open source records indicate that this particular address was until very recently the home for a very interesting domain: <strong>we11point.com</strong>. The third and fourth characters in that domain name are the numeral one, <em>but it appears that whoever registered the domain was attempting to make it look like &#8220;Wellpoint,&#8221; the former name of Anthem before the company changed its corporate name in late 2014.</em></p>
<p>We11point[dot]com was registered on April 21, 2014 to a bulk domain registration service in China. <a title="http://krebsonsecurity.com/wp-content/uploads/2015/02/we11point-whoischanges.png" href="media/a794a2da.we11point-whoischanges.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/02/we11point-whoischanges.png" target="_blank">Eight minutes later</a>, someone changed the site&#8217;s registration records to remove any trace of a connection to China.</p>
<p>Intrigued by the fake Wellpoint domains,<strong> Rich Barger</strong>, chief information officer for Arlington, Va. security firm <a title="http://threatconnect.com" href="http://threatconnect.com" target="_blank">ThreatConnect Inc.</a>, dug deeper into so-called &#8220;passive DNS&#8221; records &#8212; historic records of the mapping between numeric Internet addresses and domain names. That digging revealed a host of other subdomains tied to the suspicious we11point[dot]com site. In the process, Barger <em>discovered that these subdomains &#8212; including<strong> myhr.we11point[dot]com</strong>, and <strong>hrsolutions.we11point[dot]com </strong>-<strong> </strong>mimicked components of Wellpoint&#8217;s actual network as it existed in April 2014.</em></p>
<p>&#8220;We were able to verify that the evil we11point infrastructure is constructed to masquerade as legitimate Wellpoint infrastructure,&#8221; Barger said.</p>
<p>Another fishy subdomain that Barger discovered was <strong>extcitrix.we11point[dot]com</strong>. The &#8220;citrix&#8221; portion of that domain likely refers to <a title="http://www.citrix.com/go/receiver.html" href="http://www.citrix.com/go/receiver.html" target="_blank">Citrix</a>, a software tool that many large corporations commonly use to allow employees remote access to internal networks over a virtual private network (VPN).</p>
<p>Interestingly, that extcitrix.we11point[dot]com domain, first put online on April 22, 2014, was referenced in a malware scan from a malicious file that someone uploaded to malware scanning service <strong>Virustotal.com</strong>. According to <a title="https://www.virustotal.com/en-gb/file/8d168092d5601ebbaed24ec3caeef7454c48cf21366cd76560755eb33aff89e9/analysis/" href="https://www.virustotal.com/en-gb/file/8d168092d5601ebbaed24ec3caeef7454c48cf21366cd76560755eb33aff89e9/analysis/" target="_blank">the writeup on that malware</a>, it appears to be a backdoor program masquerading as Citrix VPN software. The malware is digitally signed with a certificate issued to an organization called <strong>DTOPTOOLZ Co.</strong> According to CrowdStrike and other security firms, that digital signature is the calling card of the Deep Panda Chinese espionage group.<span id="more-29825"></span></p>
<p><span style="text-decoration: underline;">CONNECTIONS TO OTHER VICTIMS?</span></p>
<p>As noted in <a title="http://healthitsecurity.com/2015/02/06/lessons-learned-from-the-anthem-data-breach/" href="http://healthitsecurity.com/2015/02/06/lessons-learned-from-the-anthem-data-breach/" target="_blank">a story</a> in HealthITSecurity.com, Anthem has been sharing information about the attack with the <strong>Health Information Trust Alliance</strong> (HITRUST) and the <strong>National Health Information Sharing and Analysis Center</strong> (NH-ISAC), industry groups whose mission is to disseminate information about cyber threats to the healthcare industry.</p>
<p>A news alert published by HITRUST last week notes that Anthem has been sharing so-called &#8220;indicators of compromise&#8221; (IOCs) &#8212; Internet addresses, malware signatures and other information associated with the breach. &#8220;It was quickly determined that the IOCs were not found by other organizations across the industry and this attack was targeted a specific organization,&#8221; HITRUST wrote in its alert. &#8220;Upon further investigation and analysis it is believed to be a targeted advanced persistent threat (APT) actor. With that information, HITRUST determined it was not necessary to issue a broad industry alert.&#8221;</p>
<div id="attachment_29858" style="width: 610px" class="wp-caption aligncenter"><a class="lightbox" href="media/f7831c13.hitrustalert.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/02/hitrustalert.png"><img class="size-large wp-image-29858" src="media/db47b2f8.hitrustalert-600x457.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/02/hitrustalert-600x457.png" alt="An alert released by the Health Information Trust Alliance (HITRUST) about the APT attack on Anthem." width="600" height="457" /></a><p class="wp-caption-text">An alert released by the Health Information Trust Alliance (HITRUST) about the APT attack on Anthem.</p></div>
<p>But a variety of data points suggest that the same infrastructure used to attack Anthem may have been leveraged against a Reston, Va.-based information technology firm that primarily serves the Department of Defense.</p>
<p>A <a title="http://www.symantec.com/security_response/earthlink_writeup.jsp?docid=2015-020623-0740-99" href="http://www.symantec.com/security_response/earthlink_writeup.jsp?docid=2015-020623-0740-99" target="_blank">writeup</a> on a piece of malware that Symantec calls &#8220;Mivast&#8221; was produced on Feb. 6, 2015. It describes a backdoor Trojan that Symantec says may call out to one of a half-dozen domains, including the aforementioned extcitrix.we11point[dot]com domain and another &#8212; <strong>sharepoint-vaeit.com</strong>. Other domains on the same server include <strong>ssl-vaeit.com</strong>, and <strong>wiki-vaeit.com</strong>. Once again, it appears that we have a malware sample calling home to a domain designed to mimic the internal network of an organization &#8212; most likely <a title="http://vaeit.com/customers/government/" href="http://vaeit.com/customers/government/" target="_blank">VAE Inc.</a> (whose legitimate domain is vaeit.com).</p>
<p>Barger and his team at ThreatConnect discovered that the sharepoint-vaeit.com domain also was tied to a <a title="https://www.virustotal.com/en-gb/file/d4be6c9117db9de21138ae26d1d0c3cfb38fd7a19fa07c828731fa2ac756ef8d/analysis/" href="https://www.virustotal.com/en-gb/file/d4be6c9117db9de21138ae26d1d0c3cfb38fd7a19fa07c828731fa2ac756ef8d/analysis/" target="_blank">malware sample made to look like it was VPN software made by networking giant Juniper</a>. That malware was created in May 2014, and was also signed with the DTOPTOOLZ Co. digital certificate that CrowdStrike has tied to Deep Panda.</p>
<p><a class="lightbox" href="media/88a6d64f.dtoptools.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/02/dtoptools.png"><img class="aligncenter size-large wp-image-29857" src="media/4ed443d2.dtoptools-600x374.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/02/dtoptools-600x374.png" alt="dtoptools" width="600" height="374" /></a></p>
<p>In response to an inquiry from KrebsOnSecurity, VAE said it detected a targeted phishing attack in May 2014 that used malware which phoned home to those domains, but the company said it was not aware of any successful compromise of its users.</p>
<p>In any case, the Symantec writeup on Mivast also says the malware tries to contact the Internet address 192[dot]199[dot]254[dot]126, which resolved to just one Web domain: <strong>topsec2014[dot]com</strong>. That domain was registered on May 6, 2014 to a bulk domain reseller who immediately changed the registration records and assigned the domain to the email address <strong>topsec_2014@163.com</strong>. That address appears to be the personal email of one <a title="https://www.linkedin.com/pub/song-yubo/2b/285/43b?trk=pub-pbmap" href="https://www.linkedin.com/pub/song-yubo/2b/285/43b?trk=pub-pbmap" target="_blank">Song Yubo</a>, a professor with the <a title="http://translate.google.com/translate?hl=en&amp;sl=zh-CN&amp;u=http://infosec.seu.edu.cn/more.php%3Fsort%3D02%26flag%3Dpost%26tid%3D377&amp;prev=search" href="http://translate.google.com/translate?hl=en&amp;sl=zh-CN&amp;u=http://infosec.seu.edu.cn/more.php%3Fsort%3D02%26flag%3Dpost%26tid%3D377&amp;prev=search" target="_blank">Information Security Research Center</a> at the Southeast University in Nanjing, Jiangsu, China.</p>
<p>Yubo and his university were named in a March 2012 report, &#8220;<a title="http://www2.gwu.edu/~nsarchiv/NSAEBB/NSAEBB424/docs/Cyber-066.pdf" href="media/a6988f0e.Cyber-066.pdf" data-original-source="http://www2.gwu.edu/~nsarchiv/NSAEBB/NSAEBB424/docs/Cyber-066.pdf" target="_blank">Occupying the Information High Ground: Chinese Capabilities for Computer Network Operations and Cyber Espionage</a>,&#8221; (PDF) produced by U.S. defense contractor <strong>Northrop Grumman Corp.</strong> for the <strong>U.S.-China Economic and Security Review Commission</strong>. According to the report, Yubo&#8217;s center is one of a handful of civilian universities in China that receive funding from the Chinese government to conduct sensitive research and development with information security and information warfare applications.</p>
<p><span style="text-decoration: underline;">ANALYSIS</span></p>
<p>Of course, it could well be that this is all a strange coincidence, and/or that the basic information on Deep Panda is flawed. But that seems unlikely given the number of connections and patterns emerging in just this small data set.</p>
<p>It&#8217;s remarkable that the security industry so seldom learns from past mistakes. For example, one of the more confounding and long-running problems in the field of malware detection and prevention is the proliferation of varying names for the same threat. We&#8217;re seeing this once again with the nicknames assigned to various cyberespionage groups (see the second paragraph of this story for examples).</p>
<p>It&#8217;s also incredible that so many companies could see the outlines of a threat against such a huge target, and that it took until just this past week for the target to become aware of it. For its part, ThreatConnect <a title="https://twitter.com/ThreatConnect/status/533327104742809600" href="https://twitter.com/ThreatConnect/status/533327104742809600" target="_blank">tweeted about its findings</a> back in November 2014, and shared the information out to its user base.</p>
<p>CrowdStrike declined to confirm whether the resource blanked out in <a title="http://krebsonsecurity.com/wp-content/uploads/2015/02/scanbox-CS.png" href="media/ffc4fa2c.scanbox-CS.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/02/scanbox-CS.png" target="_blank">the above pictured graphic from November 2014</a> was in fact we11point[dot]com.</p>
<p>&#8220;What I can tell you is that this domain is a Deep Panda domain, and that we always try to alert victims whenever we discover them,&#8221; said <strong>Dmitri Alperovitch</strong>, co-founder of CrowdStrike.</p>
<p>Also, it&#8217;s myopic for an industry information sharing and analysis center (ISAC) to decide not to share indicators of compromise with other industry ISACs, let alone its own members. This should not be a siloed effort. Somehow, we need to figure out a better &#8212; more timely way &#8212; to share threat intelligence and information across industries.</p>
<p>Perhaps the answer is <a title="http://www.washingtonpost.com/blogs/innovations/wp/2015/02/05/crowdsourcing-americas-cybersecurity-is-an-idea-so-crazy-it-might-just-work/" href="http://www.washingtonpost.com/blogs/innovations/wp/2015/02/05/crowdsourcing-americas-cybersecurity-is-an-idea-so-crazy-it-might-just-work/" target="_blank">crowdsourcing threat intelligence</a>, or maybe it&#8217;s something we haven&#8217;t thought of yet. But one thing is clear: there is a yawning gap between the time it takes for an adversary to compromise a target and the length of time that typically passes before the victim figures out they&#8217;ve been had.</p>
<p>The most staggering and telling statistic included in <a title="http://www.verizonenterprise.com/DBIR/2014/" href="http://www.verizonenterprise.com/DBIR/2014/" target="_blank">Verizon&#8217;s 2014 Data Breach Investigations Report</a> (well worth a read) is the graphic showing the difference between the &#8220;time to compromise&#8221; and the &#8220;time to discovery.&#8221; TL;DR: That gap is not improving, but instead is widening.</p>
<p><a class="lightbox" href="media/cacb5145.timetocompromise.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/02/timetocompromise.png"><img class="aligncenter size-large wp-image-29861" src="media/b2d1d4f6.timetocompromise-600x483.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/02/timetocompromise-600x483.png" alt="timetocompromise" width="600" height="483" /></a></p>
<p>Then again, maybe this breach at Anthem isn&#8217;t as bad as it seems. After all, if the above data and pundits are to be believed, the attackers were likely looking for a needle in a haystack &#8212; searching for data on a few individuals that might give Chinese spies a way to better siphon military technology or infiltrate some U.S. defense program.</p>
<p>Perhaps, as Barger wryly observed, the Anthem breach was little more than the product of a class assignment &#8212; albeit an expensive and aggravating one for Anthem and its 80 million affected members. In May 2014, the aforementioned Southeast University Professor Song Yubo posted a <a title="http://translate.google.com/translate?hl=en&amp;sl=zh-CN&amp;u=http://infosec.seu.edu.cn/more.php%3Fsort%3D02%26flag%3Dpost%26tid%3D377&amp;prev=search" href="http://translate.google.com/translate?hl=en&amp;sl=zh-CN&amp;u=http://infosec.seu.edu.cn/more.php%3Fsort%3D02%26flag%3Dpost%26tid%3D377&amp;prev=search" target="_blank">&#8220;Talent Cup&#8221; tournament challenge to his information security students</a>.</p>
<p>&#8220;Just as the OSS [<a title="http://en.wikipedia.org/wiki/Office_of_Strategic_Services" href="http://en.wikipedia.org/wiki/Office_of_Strategic_Services" target="_blank">Office of Strategic Services</a>] and CIA used professors to recruit spies, it could be that this was all just a class project,&#8221; Barger mused.</p>


feed_id: http://krebsonsecurity.com/?p=29823
title: Defense Contract Management Agency Probes Hack
uri: Defense-Contract-Management-Agency-Probes-Hack
url: http://krebsonsecurity.com/2015/02/defense-contract-management-agency-probes-hack/
content:
<p>The <strong>Defense Contract Management Agency</strong>, the U.S. federal government entity responsible for performing <a title="http://en.wikipedia.org/wiki/Defense_Contract_Management_Agency" href="http://en.wikipedia.org/wiki/Defense_Contract_Management_Agency" target="_blank">contract administration services</a> for the<strong> Department of Defense</strong>, is responding to a suspected cybersecurity breach and has pulled a number of its servers offline while the investigation continues, KrebsOnSecurity has learned.</p>
<div id="attachment_29873" style="width: 610px" class="wp-caption aligncenter"><a href="media/7766d059.dcma-outage.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/02/dcma-outage.png"><img class="size-large wp-image-29873" src="media/343bc608.dcma-outage-600x379.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/02/dcma-outage-600x379.png" alt="The public Web site for the DCMA has been offline for nearly two weeks. " width="600" height="379" /></a><p class="wp-caption-text">The public Web site for the DCMA has been offline for nearly two weeks.</p></div>
<p>A notice posted to the DCMA&#8217;s home page communicates little about the investigation, other than to note that &#8220;corrective action is in progress,&#8221; and that &#8220;work is being done to restore service as quickly as possible.&#8221;</p>
<p>Contacted about the outage, DCMA spokesman <strong>David Wray</strong> said suspicious activity was detected on a DCMA public-facing server January 28, resulting in an ongoing investigation.</p>
<p>&#8220;So far, no DCMA, DoD or Defense Industrial Base data nor any Personal Identification Information has been breached. A cyber protection team from Joint Forces Headquarters, Department of Defense Information Network, is working with DCMA to enhance network security. DCMA&#8217;s website has been intentionally taken offline while the team investigates the activity. All other network operations have proceeded as normal.&#8221;<span id="more-29823"></span></p>
<p>Wray declined to elaborate on the nature or extent of the intrusion. However, sources within the DCMA say the agency has been having &#8220;major system issues, including a number of internal systems.&#8221;</p>
<p>&#8220;We have been told it was due to issues with unscheduled maintenance, but the regular emails from [DCMA higher-ups] seem to indicate a larger, unspoken problem,&#8221; said one DCMA employee who asked to remain anonymous.</p>
<p>Sources say the problem relates not just to the DCMA&#8217;s main Web site but to resources that DCMA employees use for telework to review federal contracts between external companies and the Department of Defense.</p>
<p>Headquartered at <a class="mw-redirect" title="Fort Lee, VA" href="http://en.wikipedia.org/wiki/Fort_Lee,_VA">Fort Lee, VA</a>, the DCMA often handles <a title="Foreign Military Sales" href="http://en.wikipedia.org/wiki/Foreign_Military_Sales">Foreign Military Sales</a> contracts.</p>
<p>This is a developing story. More as it becomes available. Stay tuned.</p>


feed_id: http://krebsonsecurity.com/?p=29874
title: Microsoft Pushes Patches for Dozens of Flaws
uri: Microsoft-Pushes-Patches-for-Dozens-of-Flaws
url: http://krebsonsecurity.com/2015/02/microsoft-pushes-patches-for-dozens-of-flaws/
content:
<p><strong>Microsoft</strong> today released nine update bundles to plug at least 55 distinct security vulnerabilities in its <strong>Windows</strong> operating system and other software. Three of the patches fix bugs in Windows that Microsoft considers &#8220;critical,&#8221; meaning they can be exploited remotely to compromise vulnerable systems with little or no help from users, save for perhaps clicking a link or visiting a hostile Web site.</p>
<p><a href="media/d85cffb4.brokenwindows.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/07/brokenwindows.png"><img class="alignright size-full wp-image-26837" src="media/d85cffb4.brokenwindows.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/07/brokenwindows.png" alt="brokenwindows" width="229" height="240" /></a>The bulk of the flaws (41) addressed in this update apply to <strong>Internet Explorer</strong>, the default browser on Windows. This patch should obviously be a priority for any organizations that rely on IE. Other patches fix bugs in the Windows OS itself and in various versions of Microsoft Office. A full breakdown of the patches is available <a title="https://technet.microsoft.com/library/security/ms15-feb" href="https://technet.microsoft.com/library/security/ms15-feb" target="_blank">here</a>.</p>
<p>Among the more interesting critical patches is a fix for <a title="https://technet.microsoft.com/library/security/MS15-011" href="https://technet.microsoft.com/library/security/MS15-011" target="_blank">a vulnerability</a> in <strong>Microsoft Group Policy</strong> that could present unique threats for enterprises that rely on <a title="http://en.wikipedia.org/wiki/Active_Directory" href="http://en.wikipedia.org/wiki/Active_Directory" target="_blank">Active Directory</a>, the default authentication mechanism on corporate Windows networks.  The vulnerability is remotely exploitable and can be used to grant attackers administrator-level privileges on the targeted machine or device –  that means 10s of millions of PCS, kiosks and other devices, if left untreated.</p>
<p>Several readers who&#8217;ve already applied these updates report that doing so may require multiple restarts of Windows. Patches are available via Windows Update, the patching mechanism built into all recent and supported versions of Windows. For more granular information about these patches, check out <a title="https://community.qualys.com/blogs/laws-of-vulnerabilities/2015/02/10/patch-tuesday-february-2015" href="https://community.qualys.com/blogs/laws-of-vulnerabilities/2015/02/10/patch-tuesday-february-2015" target="_blank">this blog post</a> by <strong>Qualys </strong>as well as the always-useful <a title="https://isc.sans.edu/forums/diary/Microsoft+Update+Advisory+for+February+2015/19315/" href="https://isc.sans.edu/forums/diary/Microsoft+Update+Advisory+for+February+2015/19315/" target="_blank">roundup</a> at the <strong>SANS Internet Storm Center</strong>.</p>
<p>As always, if you experience any issues applying these patches or after applying them, please leave a note in the comments section below describing your experience.</p>


feed_id: http://krebsonsecurity.com/?p=29621
title: Fuel Station Skimmers: Primed at the Pump
uri: Fuel-Station-Skimmers-Primed-at-the-Pump
url: http://krebsonsecurity.com/2015/02/fuel-station-skimmers-primed-at-the-pump/
content:
<p>I recall the first time I encountered an armed security guard at a local store. I remember feeling a bit concerned about the safety of the place because I made a snap (and correct) assumption that it must have been robbed recently. I get a similar feeling each time I fuel up my car at a filling station and notice the pump and credit card reader festooned with security tape that conjures up images of police tape around a crime scene.</p>
<div id="attachment_29895" style="width: 490px" class="wp-caption aligncenter"><a class="lightbox" href="media/969c7a16.kangaroo2.jpg" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/02/kangaroo2.jpg"><img class="size-full wp-image-29895" src="media/969c7a16.kangaroo2.jpg" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/02/kangaroo2.jpg" alt="The security tape wrapped around this card reader at a Kangaroo station is intended to communicate that the credit card reader hasn't been altered." width="480" height="640" /></a><p class="wp-caption-text">The security tape wrapped around this card reader at a Kangaroo station is intended to communicate that the credit card reader hasn&#8217;t been altered.</p></div>
<p>It&#8217;s nice to know I&#8217;m not the only one who feels this way. A reader named Tyler recently shared the above image, along with his experience.</p>
<p>&#8220;I had my first encounter with tape across a gas station&#8217;s card reader the other day,&#8221; Tyler said. &#8220;I must say it led me to believe there was some sort of skimming device installed, as I have never seen this before. Further inspection showed it was actually a real attempt by the gas station to let consumers know if the device has been tampered with.&#8221;</p>
<div id="attachment_29912" style="width: 610px" class="wp-caption aligncenter"><a href="media/4c309613.fingertape.jpg" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/02/fingertape.jpg"><img class="size-large wp-image-29912" src="media/351b5526.fingertape-600x450.jpg" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/02/fingertape-600x450.jpg" alt="Of course, if you merely need to re-affix the tape to something else, that's not a high technical hurdle." width="600" height="450" /></a><p class="wp-caption-text">Of course, if you merely need to re-affix the tape to something else, that&#8217;s not a high technical hurdle.</p></div>
<p>Tyler wanted to know what would prevent a scammer from simply removing the tape from one reader and placing it back on top of a compromised reader? Or, since most people probably wouldn&#8217;t know to look for the presence of tape around the card reader, how about just placing the skimming device right on top? I wondered that as well.</p>
<p>The tape carries the bold yet misguided assurance, &#8220;securing your identity.&#8221; However, I&#8217;m guessing this security device is primarily meant to serve as a signal to gas station attendants when and if someone has monkeyed with a pump card reader.</p>
<p>The tape on the reader is intended to protect against pump reader skimmers, like the one pictured below, which sells in underground forums for upwards of USD $2,000 and is designed to be fit directly over top of the readers they have at many <a title="http://krebsonsecurity.com/wp-content/uploads/2015/02/esso-Gas-Station.jpg" href="media/afc89880.esso-Gas-Station.jpg" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/02/esso-Gas-Station.jpg" target="_blank">ESSO/Exxon fuel pumps</a>.</p>
<div id="attachment_29897" style="width: 610px" class="wp-caption aligncenter"><a class="lightbox" href="media/194609f7.gasraf1.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/02/gasraf1.png"><img class="size-large wp-image-29897" src="media/df1fd773.gasraf1-600x338.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/02/gasraf1-600x338.png" alt="A gas pump card skimmer marketed and sold in underground forums for more than $2,000." width="600" height="338" /></a><p class="wp-caption-text">The seller of a gas pump card skimmer shows off his wares, which he sells for more than $2,000.</p></div>
<p><span id="more-29621"></span>Of course, security tape wrapped around a card reader at a gas pump isn&#8217;t going to stop most pump skimming attacks, which start when <a title="http://krebsonsecurity.com/?s=pump+skimmer&amp;x=0&amp;y=0" href="http://krebsonsecurity.com/?s=pump+skimmer&amp;x=0&amp;y=0" target="_blank">someone with a master key for the pump opens it up and fiddles with the guts of the machine</a>. The crooks figured out a long time ago that only a handful of master keys are needed to open the majority of the gas pumps in use today. So, rather than retrofit each one of these pumps with a more custom and secure locking mechanism, most stations just put security tape on the pump door.</p>
<p><a class="lightbox" href="media/8d33c34c.kangaroo1.jpg" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/02/kangaroo1.jpg"><img class="aligncenter size-large wp-image-29898" src="media/dc3db95a.kangaroo1-600x450.jpg" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/02/kangaroo1-600x450.jpg" alt="kangaroo1" width="600" height="450" /></a></p>
<p>I don’t worry too much about gas pump skimmers; I always use my credit card, and know that I am not liable for unauthorized charges on my card as long as I report it to my bank or credit card company. But I would urge readers to avoid paying at the pump using a debit card. Having your checking account emptied of cash while your bank sorts out the situation can be a huge hassle and create secondary problems (bounced checks, for instance).</p>


feed_id: http://krebsonsecurity.com/?p=29921
title: The Great Bank Heist, or Death by 1,000 Cuts?
uri: The-Great-Bank-Heist-or-Death-by-1-000-Cuts
url: http://krebsonsecurity.com/2015/02/the-great-bank-heist-or-death-by-1000-cuts/
content:
<p>I received a number of media requests and emails from readers over the weekend to comment on a front-page <em>New York Times</em> <a title="http://www.nytimes.com/2015/02/15/world/bank-hackers-steal-millions-via-malware.html?partner=socialflow&amp;smid=tw-nytimes&amp;_r=1" href="http://www.nytimes.com/2015/02/15/world/bank-hackers-steal-millions-via-malware.html?partner=socialflow&amp;smid=tw-nytimes&amp;_r=1" target="_blank">story</a> about an organized gang of cybercriminals pulling off &#8220;one of the largest bank heists ever.&#8221; Turns out, I reported on this gang&#8217;s activities in December 2014, although my story ran minus many of the superlatives in the Times piece.</p>
<p>The Times&#8217; story, &#8220;Bank Hackers Steal Millions Via Malware,&#8221; looks at the activities of an Eastern European cybercrime group that Russian security firm <strong>Kaspersky Lab</strong> calls the &#8220;Carbanak&#8221; gang. According to Kaspersky, this group deployed malware via phishing scams to get inside of computers at more than 100 banks and steal upwards of USD $300 million &#8212; possibly as high as USD $1 billion.</p>
<div id="attachment_29937" style="width: 610px" class="wp-caption aligncenter"><a href="media/e82a20f7.cvmap.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/02/cvmap.png"><img class="size-large wp-image-29937" src="media/c4a989e5.cvmap-600x486.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/02/cvmap-600x486.png" alt="Image: Kaspersky" width="600" height="486" /></a><p class="wp-caption-text">Image: Kaspersky</p></div>
<p>Such jaw-dropping numbers were missing from a story I wrote in December 2014 about this same outfit, <a title="http://krebsonsecurity.com/2014/12/gang-hacked-atms-from-inside-banks/" href="http://krebsonsecurity.com/2014/12/gang-hacked-atms-from-inside-banks/" target="_blank">Gang Hacked ATMs From Inside Banks</a>. That piece was based on similar research <a title="http://www.group-ib.com/files/Anunak_APT_against_financial_institutions.pdf" href="media/fa4a0aed.Anunak_APT_against_financial_institutions.pdf" data-original-source="http://www.group-ib.com/files/Anunak_APT_against_financial_institutions.pdf" target="_blank">published</a> (PDF) jointly by Dutch security firm <strong>Fox-IT</strong> and by <strong>Group-IB</strong>, a Russian computer forensics company. Fox-IT and Group-IB called the crime group &#8220;Anunak,&#8221; and described how the crooks sent malware laced <strong>Microsoft Office</strong> attachments in spear phishing attacks to compromise specific users inside targeted banks.</p>
<p>&#8220;Most cybercrime targets consumers and businesses, stealing account information such as passwords and other data that lets thieves cash out hijacked bank accounts, as well as credit and debit cards,&#8221; my December 2014 story observed. &#8220;But this gang specializes in hacking into banks directly, and then working out ingenious ways to funnel cash directly from the financial institution itself.&#8221;</p>
<p>I also noted that a source told me this group of hackers is thought to be the same criminal gang responsible for several credit and debit card breaches at major retailers across the United States, including women’s clothier <a title="http://krebsonsecurity.com/2014/12/banks-credit-card-breach-at-bebe-stores/" href="http://krebsonsecurity.com/2014/12/banks-credit-card-breach-at-bebe-stores/" target="_blank">Bebe Stores Inc.</a>, western wear store <a title="http://www.kansascity.com/news/business/article2169946.html" href="http://www.kansascity.com/news/business/article2169946.html" target="_blank" rel="noreferrer">Sheplers</a>, and office supply store <a title="http://krebsonsecurity.com/?s=staples&amp;x=0&amp;y=0" href="http://krebsonsecurity.com/?s=staples&amp;x=0&amp;y=0" target="_blank">Staples Inc</a>.</p>
<p><strong>Andy Chandler</strong>, Fox-IT&#8217;s general manager and senior vice president, said the group profiled in its December report and in the Kaspersky study are the same.</p>
<p>“Anunak or Carbanak are the same,&#8221; Chandler said. &#8220;We continue to track this organization but there are no major revelations since December. So far in 2015, the financial industry have been kept busy by other more creative criminal groups,&#8221; such as those responsible for spreading the <a title="http://www.secureworks.com/cyber-threat-intelligence/threats/dyre-banking-trojan/" href="http://www.secureworks.com/cyber-threat-intelligence/threats/dyre-banking-trojan/" target="_blank">Dyre</a> and <a title="http://researchcenter.paloaltonetworks.com/2014/10/dridex-banking-trojan-distributed-word-documents/" href="http://researchcenter.paloaltonetworks.com/2014/10/dridex-banking-trojan-distributed-word-documents/" target="_blank">Dridex</a> banking malware, he said.<span id="more-29921"></span></p>
<p><span style="text-decoration: underline;">ANALYSIS</span></p>
<p>Certainly, learning that this group stole possibly close to USD $1 billion advances the story, even if the Kaspersky report is a couple of months late, or generous to the attackers by a few hundred million bucks. The Kaspersky report also references (but doesn&#8217;t name) victim banks in the United States, although the New York Times story notes that the majority of the targeted financial institutions were in Russia. The Group-IB/Fox-IT report did not mention US banks as victims.</p>
<p>Two readers at different financial institutions asked whether The Times was accurate in stating that employees at victim banks had their computers infected merely after opening booby-trapped emails. &#8220;The cybercriminals sent their victims infected emails — a news clip or message that appeared to come from a colleague — as bait,&#8221; The  Times&#8217; story reads. &#8220;When the bank employees clicked on the email, they inadvertently downloaded malicious code.&#8221;</p>
<p>As the Kaspersky report (and my earlier reporting) notes, the attackers leveraged vulnerabilities in Microsoft Office products for which Microsoft had already produced patches many months prior &#8212; targeting organizations that had fallen behind on patching. Victims had to open booby trapped attachments within spear phishing emails.</p>
<p>&#8220;Despite increased awareness of cybercrime within the financial services sector, it appears that spear phishing attacks and old exploits (for which patches have been disseminated) remain effective against larger companies,&#8221; Kaspersky&#8217;s report concludes. &#8220;Attackers always use this minimal effort approach in order to bypass a victim&#8217;s defenses.&#8221;</p>
<p><em>Minimal effort.</em> That&#8217;s an interesting choice of words to describe the activities of crime groups like this one. <span class="pullquote pqright">The Kaspersky report is titled &#8220;The Great Bank Robbery,&#8221; but the work of this gang could probably be more accurately described as &#8220;Death by 1,000 cuts.&#8221;</span></p>
<p>Why should crime groups like this one expend more than minimal effort? After all, there are thousands of financial institutions here in the United States alone, and it&#8217;s a fair bet that on any given day a decent number of those banks are months behind on installing security updates. They&#8217;re mostly running IT infrastructure entirely based on Microsoft Windows, and probably letting employees browse the Web with older versions of Internet Explorer from the same computers used to initiate wire transfers (I witnessed this firsthand just last week at the local branch of a major U.S. bank). It&#8217;s worth noting that most of the crime gang&#8217;s infrastructure appears to be Linux-based.</p>
<p>This isn&#8217;t intended as a dig at Microsoft, but to illustrate a point: Most organizations &#8212; even many financial institutions &#8212; aren&#8217;t set up to defeat skilled attackers; their network security is built around ease-of-use, compliance, and/or defeating auditors and regulators. Organizations architected around security (particularly banks) are expecting these sorts of attacks, assuming that attackers are going to get in, and focusing their non-compliance efforts on breach response. <a title="http://krebsonsecurity.com/wp-content/uploads/2014/11/SecurityMaturity.png" href="media/4f995330.SecurityMaturity.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/11/SecurityMaturity.png" target="_blank">This &#8220;security maturity&#8221; graphic</a> nicely illustrates the gap between these two types of organizations.</p>
<p>As I wrote in my December story, the attacks from the Anunak/Carbanak gang showcase once again how important it is for organizations to refocus more resources away from preventing intrusions toward detecting intrusions as quickly as possible and stopping the bleeding. According to the Fox-IT/Group-IB report, the average time from the moment this group breaks into bank internal networks and the successful theft of cash is a whopping 42 days.</p>
<p>Kaspersky&#8217;s report notes a similar time range: &#8220;There is evidence indicating that in most cases the network was compromised for between two to four months, and that many hundreds of computers within a single victim organization may have been infected.&#8221; Both the Kaspersky and Group-IB/Fox-IT reports contain pages and pages of threat indicators, including digital signatures and network infrastructure used by this group.</p>
<p>So those are some takeaways for financial institutions, but what about banking customers? Sadly, these developments should serve as yet another wake-up call for small to mid-sized businesses based in the U.S. and banking online. While consumers in the United States are shielded by law against unauthorized online banking transactions, businesses have no such protection.</p>
<p>Russian hacking gangs like this one have stolen hundreds of millions of dollars from small- to mid-sized businesses in the U.S. and Europe over the past five years (for dozens of examples, see my series, <a title="http://krebsonsecurity.com/category/smallbizvictims/" href="http://krebsonsecurity.com/category/smallbizvictims/" target="_blank">Target: Small Businesses</a>). In the vast majority of those cyberheists, the malware that thieves used to empty business accounts was on the victim organization&#8217;s computers &#8212; not the bank&#8217;s.</p>
<p>Now, add to that risk the threat of the business&#8217;s bank getting compromised from within and the inability of the institution to detect the breach for months on end.</p>
<p>&#8220;Advanced control and fraud detection systems have been used for years by the financial services industry,&#8221; the Kaspersky report observed. &#8220;However, these focus on fraudulent transactions within customer accounts. The Carbanak attackers bypassed these protections, by for example, using the industry-wide funds transfer (the SWIFT network), updating balances of account holders and using disbursement mechanisms (the ATM network). In neither of these cases did the attackers exploit a vulnerability within the service. Instead, they studied the victim´s internal procedures and pinpointed who they should impersonate locally in order to process fraudulent transactions through the aforementioned services. It is clear that the attackers were very familiar with financial services software and networks.&#8221;</p>
<p>Do you run your own business and bank online but are unwilling to place all of your trust in your bank’s security? Consider adopting some of the advice I laid out in <a title="http://krebsonsecurity.com/online-banking-best-practices-for-businesses/" href="http://krebsonsecurity.com/online-banking-best-practices-for-businesses/" target="_blank">Online Banking Best Practices for Businesses</a> and <a title="http://krebsonsecurity.com/2012/07/banking-on-a-live-cd/" href="http://krebsonsecurity.com/2012/07/banking-on-a-live-cd/" target="_blank">Banking on a Live CD</a>.</p>
<p><strong>Update, 3:45 p.m. ET:</strong> A copy of the Kaspersky report on the Carbanak gang is <a title="http://krebsonsecurity.com/wp-content/uploads/2015/02/Carbanak_APT_eng.pdf" href="media/3bf2977e.Carbanak_APT_eng.pdf" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/02/Carbanak_APT_eng.pdf" target="_blank">here</a> (PDF). Also, Fox-IT has <a title="https://www.fox-it.com/en/press-releases/anunak-aka-carbanak-update/" href="https://www.fox-it.com/en/press-releases/anunak-aka-carbanak-update/" target="_blank">released a Q&amp;A</a> on the differences and commonalities between their December report and Kaspersky&#8217;s this week.</p>


feed_id: http://krebsonsecurity.com/?p=29960
title: ‘Spam Nation’ Wins PROSE Award
uri: Spam-Nation-Wins-PROSE-Award
url: http://krebsonsecurity.com/2015/02/spam-nation-wins-prose-award/
content:
<p>I am pleased to announce that my new book, <a title="http://www.amazon.com/Spam-Nation-Organized-Cybercrime---Epidemic/dp/1402295618/ref=sr_1_1?ie=UTF8&amp;qid=1400765293&amp;sr=8-1&amp;keywords=spam+nation" href="http://www.amazon.com/Spam-Nation-Organized-Cybercrime---Epidemic/dp/1402295618/ref=sr_1_1?ie=UTF8&amp;qid=1400765293&amp;sr=8-1&amp;keywords=spam+nation" target="_blank"><em>Spam Nation: The Inside Story of Organized Cybercrime, from Global Epidemic to Your Front Door</em></a>, has been honored with a <strong>2015 PROSE Award</strong> in the Media &amp; Cultural Studies category.</p>
<p><a href="media/17cf02db.proseawards.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/02/proseawards.png"><img class="alignright size-medium wp-image-29961" src="media/7cefc953.proseawards-285x149.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/02/proseawards-285x149.png" alt="proseawards" width="285" height="149" /></a>The PROSE Awards are given by the Professional and Scholarly Publishing Division of the <strong>Association of American Publishers. </strong></p>
<p>From the AAP&#8217;s site: &#8220;The awards annually recognize the very best in professional and scholarly publishing by bringing attention to distinguished books, journals, and electronic content in over 40 categories. Judged by peer publishers, librarians, and medical professionals since 1976, the PROSE Awards are extraordinary for their breadth and depth.&#8221;</p>
<p>I am grateful to the AAP for this honor. According to the AAP, the 2015 PROSE Awards received a record-breaking 540 entries this year &#8211; more than ever before in their 39-year history &#8211; from more than 70 publishers around the world. &#8221; Other 2015 PROSE Awards winners are listed at <a title="http://proseawards.com/current-winners.html" href="http://proseawards.com/current-winners.html" target="_blank">this page</a>.</p>


feed_id: http://krebsonsecurity.com/?p=29919
title: The Rise in State Tax Refund Fraud
uri: The-Rise-in-State-Tax-Refund-Fraud
url: http://krebsonsecurity.com/2015/02/the-rise-in-state-tax-refund-fraud/
content:
<h4>Intuit: Anti-fraud Improvements by IRS Fuel Up To 3700 Percent Rise in Phony State Filings</h4>
<p>Scam artists stole billions of dollars last year from the U.S. Treasury by filing phony federal tax refund requests on millions of Americans. But as Uncle Sam has made this type of fraud harder for thieves to profit from, the crooks have massively shifted their focus to conducting refund fraud at the state level. Or at least according to <strong>Intuit Inc.</strong>, the makers of <strong>TurboTax</strong>: The company says it believes that shift is responsible for <em>a whopping 3700 percent increase in fraudulent state tax refund filings this year in some states.</em></p>
<div id="attachment_25751" style="width: 257px" class="wp-caption alignright"><a href="media/7f282dfb.taxfraud.jpg" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/04/taxfraud.jpg"><img class=" wp-image-25751" src="media/964c2000.taxfraud-285x285.jpg" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/04/taxfraud-285x285.jpg" alt="File 'em Before the Bad Guys Can" width="247" height="247" /></a><p class="wp-caption-text">File &#8216;em Before the Bad Guys Can</p></div>
<p>Earlier this month, TurboTax was <a title="http://krebsonsecurity.com/2015/02/citing-tax-fraud-spike-turbotax-suspends-state-e-filings/" href="http://krebsonsecurity.com/2015/02/citing-tax-fraud-spike-turbotax-suspends-state-e-filings/http://krebsonsecurity.com/2015/02/citing-tax-fraud-spike-turbotax-suspends-state-e-filings/" target="_blank">forced to briefly suspend state tax refund filings</a> while it investigated the source of the unprecedented fraud spike. To learn more about the run-up to this extraordinary step and other tax fraud trends this year, I talked with <strong>Indu Kodukula</strong>, chief information security officer at Intuit.</p>
<p>Kodukula explained that in years past the dominant form of tax return scams the company has dealt with stemmed from phony federal tax refund requests. But this tax season, things changed dramatically.</p>
<p>&#8220;The IRS has gotten much better than a few years ago from the perspective of fighting fraud,&#8221; Kodukula said. &#8220;We think what&#8217;s happening is that as a result the fraudsters are starting to target the states.&#8221;</p>
<p>The data released by the <strong>Treasury Inspector General for Tax Administration</strong> (TIGTA), which oversees the work of the IRS, suggests the IRS does indeed appear to have improved at flagging and ultimately denying fraudulent federal tax returns. In <a title="http://www.treasury.gov/tigta/auditreports/2014reports/201440029_oa_highlights.html" href="http://www.treasury.gov/tigta/auditreports/2014reports/201440029_oa_highlights.html" target="_blank">an interim report</a> on the 2014 tax filing season, TIGTA said the IRS identified and confirmed 28,076 fraudulent tax returns involving identity theft. That was down significantly from <a title="http://www.treasury.gov/tigta/auditreports/2013reports/201340035fr.pdf" href="media/1db7db60.201340035fr.pdf" data-original-source="http://www.treasury.gov/tigta/auditreports/2013reports/201340035fr.pdf" target="_blank">a year earlier</a> (PDF), when the IRS identified and confirmed 85,385 fraudulent tax returns involving identity theft.</p>
<p><span style="text-decoration: underline;">THE ROLE OF UNLINKED RETURNS</span></p>
<p>Kodukula said tax fraudsters have evolved in response to increased information sharing by the IRS with state revenue departments about phony tax returns received at the federal level. He described a process that began about three years ago, when Intuit and TurboTax received express permission from the IRS to share information about suspected bogus tax refund requests.</p>
<p><a href="media/de3883fd.dyot-copy2.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/02/dyot-copy2.png"><img class="alignleft  wp-image-29811" src="media/de3883fd.dyot-copy2.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/02/dyot-copy2.png" alt="dyot copy2" width="231" height="296" /></a>&#8220;It has been our understanding that this information is in turn being shared with [state treasury departments], Kodukula said. &#8220;But there are 46 states in the Union where taxpayers can file what&#8217;s called an &#8216;<strong>unlinked return</strong>,&#8217; meaning they can file a state return without having a file a federal return at the same time. So when the [tax fraudsters] file an unlinked return, it leaves the state at its own disposal to fight this fraud, and we think that&#8217;s what has taken the states by surprise this year.&#8221;</p>
<p>States allow unlinked returns because most taxpayers owe taxes at the federal level but are due refunds from their state. Thus, unlinked returns allow taxpayers who owe money to the IRS to pay some or all of that off with state refund money.</p>
<p>Unlinked returns typically have made up a very small chunk of Intuit&#8217;s overall returns, Kodukula said. However, so far in this year&#8217;s tax filing season, Intuit has seen between three and 37-fold increases in unlinked, state-only returns. Convinced that most of those requests are fraudulent, the company now blocks users from filing unlinked returns via TurboTax.</p>
<p>&#8220;It&#8217;s very hard to imagine a fundamental demographic shift that could cause that kind of pattern,&#8221; Kodukula said. &#8220;Our thought is that the vast majority of this is clearly not legitimate activity.&#8221;</p>
<p><span style="text-decoration: underline;">ACCOUNT TAKEOVERS FUELED BY PASSWORD RE-USE</span></p>
<p>Not only have the fraudsters shifted from attacking the IRS to robbing state coffers, but the methods they use to steal taxpayer data also are evolving. Kodukula explained that traditionally most of the bogus refund requests were the result of what the company calls &#8220;stolen identity refund fraud&#8221; or SIRF. In SIRF scams, the thieves gather pieces of data about taxpayers from outside means &#8212; through phishing attacks or <a title="http://krebsonsecurity.com/?s=identity+theft+service&amp;x=0&amp;y=0" href="http://krebsonsecurity.com/?s=identity+theft+service&amp;x=0&amp;y=0" target="_blank">identity theft services in the underground</a>, for example &#8212; then create accounts at TurboTax in the victims&#8217; names and file fraudulent tax refund claims with the IRS.</p>
<p>But Kodukula said that over the past 18 months, Intuit has watched fraudsters shift from SIRF to account takeovers, wherein scammers compromise TurboTax credentials by exploiting human nature: The tendency for people to re-use passwords across multiple sites.  This technique works because a fair percentage of users re-use passwords at multiple sites. When a breach at one site exposes the email addresses and passwords of its users, fraudsters will invariably try the stolen account credentials at other sites, knowing that a small percentage of them will work.<span id="more-29919"></span></p>
<p><a href="media/e7e837fd.passcrack.jpg" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2012/06/passcrack.jpg"><img class="alignright size-medium wp-image-15419" src="media/67d1a1f1.passcrack-285x189.jpg" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2012/06/passcrack-285x189.jpg" alt="passcrack" width="285" height="189" /></a>&#8220;Over the past one-and-a-half years, we started to see much more of this type type of account takeover attack, where a customer&#8217;s TurboTax credentials were compromised at another site,&#8221; Kodukula said, describing wave after wave of attempts by fraudsters to log in at TurboTax using huge lists of credentials leaked in the wake of breaches at other companies.</p>
<p>Currently, about 60 percent of the returns flagged as likely fraudulent by Intuit appear to come from SIRF, while the other 40 percent are the result of account takeovers, Kodukula said. But the account takeover attacks are definitely growing in frequency and intensity, he said.</p>
<p>&#8220;From the list validation attacks we’ve seen, we know the credentials came from somewhere else,&#8221; he added. &#8220;When you look at credentials that have never been used in our system [trying to log in] it&#8217;s a pretty good indicator that those are credentials not from our space.&#8221;</p>
<p>Security experts (including this author) have long called on  TurboTax to implement two-step authentication for customers to help address the account takeover the problem of password re-use by consumers. Earlier this month, Intuit announced it would be implementing this very feature, although the company&#8217;s choice of approaches may fall short of what many security experts think of when they talk about real two-step or two-factor authentication.</p>
<p>Kodukula said TurboTax began rolling that Feb. 13, and that the company is currently evaluating customer logins &#8212; requiring additional authentication for returning customers who log in from a computer or device the company has never seen previously associated with that customer&#8217;s account. Those users will be forced to re-login using one of three additional authentication methods of the customer&#8217;s choosing: Email verification; enter a special code sent via text message; or a series of <a title="http://en.wikipedia.org/wiki/Knowledge-based_authentication" href="http://en.wikipedia.org/wiki/Knowledge-based_authentication" target="_blank">knowledge-based authentication</a> (KBA) questions from big-three credit bureau <strong>Experian</strong>.</p>
<p>&#8220;We&#8217;re currently challenging about 20 percent of returning users [from the previous tax season] who are logging in, which is fairly standard,&#8221; Kodukula said. &#8220;Our current MFA approach is to provide a challenge to devices we don&#8217;t recognize and we have a 15-month history of devices. Our intent is to clear that backlog over the coming weeks so that we essentially clean out our entire portfolio of devices over the next few weeks.&#8221;</p>
<p><span style="text-decoration: underline;">WHAT TO DO IF YOU&#8217;RE A VICTIM</span></p>
<p>If you file your state taxes this year and discover that your state return has already been filed, you should report the matter to your state revenue agency. For a list of state agencies, their hotlines and Web sites, see the second half of <a title="http://www.efile.com/tax-return-identity-theft-and-refund-fraud/" href="http://www.efile.com/tax-return-identity-theft-and-refund-fraud/" target="_blank">this page</a>.</p>
<p>Intuit is encouraging all previous and current TurboTax customers to log into their accounts to see if there has been a return fraudulently filed. The company also is encouraging users to verify their bank account information and be sure that hasn&#8217;t been changed, as well as any other contact information associated with the account. Customers who detect errant changes can call TurboTax customer service at 800-944-8596. The company says it&#8217;s also offering free credit monitoring service for customers that have had account compromises.</p>
<p>If you become the victim of identity theft outside of the tax system or believe you may be at risk due to a lost/stolen purse or wallet, questionable credit card activity or credit report, etc., you are encouraged to contact the IRS at the Identity Protection Specialized Unit, toll-free at 1-800-908-4490 so that the IRS can take steps to further secure your account.</p>
<p>That process is likely to involve the use of taxpayer-specific PINs for people that have had issues with identity theft. If approved, the PIN is required on any tax return filed for that consumer before a return can be accepted. To start the process of applying for a tax return PIN from the IRS, check out the steps at <a title="http://www.irs.gov/uac/Identity-Protection" href="http://www.irs.gov/uac/Identity-Protection" target="_blank">this link</a>. You will almost certainly need to file an <a title="http://www.irs.gov/pub/irs-pdf/f14039.pdf" href="media/bfc069d5.f14039.pdf" data-original-source="http://www.irs.gov/pub/irs-pdf/f14039.pdf" target="_blank">IRS form 14039</a> (PDF), and provide scanned or photocopied records, such a drivers license or passport.</p>
<p>Also, consider placing a fraud alert or freeze on your file at the major credit bureaus. If crooks have enough of your personal information to file a fraudulent tax return in your name, those same lowlifes can use that data to commit other crimes. Placing a fraud alert on your credit file every 90 days is the cheapest (as in free) way to block creditors from granting new lines of credit in your name, and from unnecessarily dinging your credit score.</p>
<p>You are entitled to a free copy of your credit report from each of the three major credit bureaus annually. The only site you need to obtain this free copy is <a title="https://www.annualcreditreport.com/index.action" href="https://www.annualcreditreport.com/index.action" target="_blank">annualcreditreport.com</a>, or by phone via 877-322-8228. Everywhere else will try to sell you a report, or offer a “free” report if you agree to sign up for some kind of subscription service — usually credit monitoring.</p>
<p>If you have been the victim of identity theft, or if you don’t anticipate needing to take out a loan or apply for new lines of credit anytime soon and you’d rather not deal with fraud alerts, placing a freeze on your credit file may be the smarter option.</p>
<p>A security freeze gives consumers the choice to “freeze” or lock access to their credit file against anyone trying to open up a new account or to get new credit in their name. As <strong>Consumers Union</strong> writes, “when a security freeze is in place at all three major credit bureaus, an identity thief cannot open a new account because the potential creditor or seller of services will not be able to check the credit file. When the consumer is applying for credit, he or she can lift the freeze temporarily using a PIN so legitimate applications for credit or services can be processed.”</p>
<p>Forty-nine states and the District of Columbia now have laws on the books allowing consumers to freeze their credit (Michigan is the holdout). Many of these laws allow the placement of a freeze for free if the consumer has a police report documenting an identity theft episode; for those without an ID theft scare notched on their belt, most states allow for the placement of a freeze for a $10 fee. See <a title="http://defendyourdollars.org/document/guide-to-security-freeze-protection" href="http://defendyourdollars.org/document/guide-to-security-freeze-protection" target="_blank">this site</a> for more details on the various state freeze laws and instructions on how to obtain them.</p>
<p>Consumers also can reduce their exposure to identity theft by opting out of unsolicited credit card or insurance offers. Doing this, via www.optoutprescreen.com, or 888-5OPT-OUT, should block most unsolicited applications and reduce the incidence of identity theft. Doing so removes your name, address and personal identifiers from lists supplied by the <strong>Equifax</strong>, <strong>Experian</strong>, <strong>TransUnion</strong> and<strong> Innovis</strong> credit reporting agencies that are used for preapproved and pre-screened offers of credit or insurance.</p>
<p>Many consumers turn to credit monitoring services to protect them and their loved ones from identity thieves. Before you shell out good money for such a service, check out <a title="http://krebsonsecurity.com/2014/03/are-credit-monitoring-services-worth-it/" href="http://krebsonsecurity.com/2014/03/are-credit-monitoring-services-worth-it/" target="_blank">the primer I wrote about the uses and limitations of credit monitoring services</a>.</p>
<p>Also, check to see if an organization that stores your information has potentially jeopardized in a recent data breach. Chances are they are already offering credit monitoring to you for free. For example, some 80 million+ Americans are likely to get this offer from <strong>Anthem</strong>, the health insurance giant that <a title="http://krebsonsecurity.com/?s=anthem&amp;x=0&amp;y=0" href="http://krebsonsecurity.com/?s=anthem&amp;x=0&amp;y=0" target="_blank">recently announced</a> that it would be notifying affected members by snail mail about credit monitoring offers. Some 56 million <strong>Home Depot</strong> shoppers also are eligible thanks to their data breach in Sept. 2014.</p>
<p>Virtually any company listed in the past year in my <a title="http://krebsonsecurity.com/category/data-breaches/" href="http://krebsonsecurity.com/category/data-breaches/" target="_blank">Data Breaches category</a> is offering it, but my site is hardly an exhaustive list. California&#8217;s Office of the Attorney General has <a title="http://oag.ca.gov/ecrime/databreach/list" href="http://oag.ca.gov/ecrime/databreach/list" target="_blank">a searchable list</a> of companies that have recently reported data breaches, and nearly all of those firms are offering free monitoring services for affected consumers.</p>


feed_id: http://krebsonsecurity.com/?p=30425
title: Convicted Tax Fraudster & Fugitive Caught
uri: Convicted-Tax-Fraudster-Fugitive-Caught
url: http://krebsonsecurity.com/2015/03/convicted-tax-fraudster-fugitive-caught/
content:
<p>Lance Ealy, an Ohio man who fled home confinement last year just prior to his conviction on charges of filing phony tax refund requests on more than 150 Americans, was apprehended in a pre-dawn raid by federal marshals in Atlanta on Wednesday.</p>
<div id="attachment_28760" style="width: 249px" class="wp-caption alignright"><a href="media/e03bc509.ealydope.jpg" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/11/ealydope.jpg"><img class=" wp-image-28760" src="media/f0e26199.ealydope-285x378.jpg" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/11/ealydope-285x378.jpg" alt="Lance Ealy, in self-portrait he uploaded to twitter before absconding." width="239" height="317" /></a><p class="wp-caption-text">Lance Ealy, in self-portrait he uploaded to twitter before absconding.</p></div>
<p>Ealy, 28, of Dayton, Ohio, was the subject of no fewer than <a title="http://krebsonsecurity.com/tag/lance-ealy/" href="http://krebsonsecurity.com/tag/lance-ealy/" target="_blank">three previous posts on this blog</a>. Ealy <a title="http://krebsonsecurity.com/2014/04/an-allegation-of-harm/" href="http://krebsonsecurity.com/2014/04/an-allegation-of-harm/" target="_blank">reached out to me</a> in February 2014, after being arrested by the <strong>U.S. Secret Service</strong> for using his email account to purchase Social Security numbers and other personal information from an online identity theft service run by a guy named <strong>Hieu Minh Ngo.</strong></p>
<p>Ngo is a Vietnamese national who, for several years, ran an online identity theft service called <strong>Superget.info</strong>. Shortly after <a title="http://krebsonsecurity.com/2011/11/how-much-is-your-identity-worth/" href="http://krebsonsecurity.com/2011/11/how-much-is-your-identity-worth/" target="_blank">my 2011 initial story about his service</a>, Ngo tauntingly renamed his site to <strong>findget.me</strong>. The Secret Service took him up on that challenge, and succeeded in luring him out of Vietnam into Guam, where he was arrested and brought to New Hampshire for trial. He pleaded guilty last year to running the ID theft service, and the government has been working on rounding up his customers ever since.</p>
<p>Mr. Ealy was one of several individuals found guilty of identity theft charges after buying from Ngo’s service, which relied in part on data obtained <a title="http://krebsonsecurity.com/2013/10/experian-sold-consumer-data-to-id-theft-service/" href="http://krebsonsecurity.com/2013/10/experian-sold-consumer-data-to-id-theft-service/" target="_blank">through a company owned by big-three credit bureau <strong>Experian</strong></a>.</p>
<p>After being indicted on 46 counts of fraudulent activity, Ealy fired his attorney and chose to represent himself in court. In mid-November 2014 &#8212; just days before the jury in his trial was to issue its guilty verdict &#8212; Ealy <a title="http://krebsonsecurity.com/2014/11/convicted-id-thief-tax-fraudster-now-fugitive/" href="http://krebsonsecurity.com/2014/11/convicted-id-thief-tax-fraudster-now-fugitive/" target="_blank">slipped his ankle monitor and skipped town</a>, but not before posting a <a title="http://krebsonsecurity.com/wp-content/uploads/2014/11/ealydope.jpg" href="media/e03bc509.ealydope.jpg" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/11/ealydope.jpg" target="_blank">taunting selfie</a> to his Twitter account.</p>
<p>In the four months since his disappearance, investigators caught glimpses of Ealy jumping online as he made his way south to Atlanta. Incredibly, Ealy took time to file several <a title="http://ia601200.us.archive.org/3/items/gov.uscourts.ohsd.167646/gov.uscourts.ohsd.167646.173.0.pdf" href="media/1a641630.gov.uscourts.ohsd.167646.173.0.pdf" data-original-source="http://ia601200.us.archive.org/3/items/gov.uscourts.ohsd.167646/gov.uscourts.ohsd.167646.173.0.pdf" target="_blank">lengthy pro se legal arguments</a> (PDF) stating why the judge in the case was not impartial and that he deserved a retrial. When federal officials prosecuting his case <a title="http://ia601200.us.archive.org/3/items/gov.uscourts.ohsd.167646/gov.uscourts.ohsd.167646.187.0.pdf" href="media/69419888.gov.uscourts.ohsd.167646.187.0.pdf" data-original-source="http://ia601200.us.archive.org/3/items/gov.uscourts.ohsd.167646/gov.uscourts.ohsd.167646.187.0.pdf" target="_blank">responded</a> (PDF) incredulously to his request, Ealy took it upon himself to <a title="http://ia601200.us.archive.org/3/items/gov.uscourts.ohsd.167646/gov.uscourts.ohsd.167646.188.0.pdf" href="media/d20f51e5.gov.uscourts.ohsd.167646.188.0.pdf" data-original-source="http://ia601200.us.archive.org/3/items/gov.uscourts.ohsd.167646/gov.uscourts.ohsd.167646.188.0.pdf" target="_blank">file a response</a> (PDF) to their motion for dismissal &#8212; all while on the lam.</p>
<p>Investigators close to the case say Ealy continued filing false tax refund requests while on the run from the law. But instead of turning to an underground identity theft service as he did previously, investigators say Ealy appears to have paid numerous inmates serving time in Ohio prisons for permission to file tax refund requests on their behalf with the Internal Revenue Service (IRS) &#8212; topping up the inmates&#8217; commissary funds to the tune of $100 per filing while pocketing the rest of the fraudulent refunds.</p>
<p>According to <a title="http://www.whio.com/news/news/crime-law/dayton-fugitive-arrested-in-atlanta/nkY9K/" href="http://www.whio.com/news/news/crime-law/dayton-fugitive-arrested-in-atlanta/nkY9K/" target="_blank">whio.com</a>, Ealy remains in the Northern District of Georgia until he can be extradited.</p>


feed_id: http://krebsonsecurity.com/?p=30379
title: OpenSSL Patch to Plug Severe Security Holes
uri: OpenSSL-Patch-to-Plug-Severe-Security-Holes
url: http://krebsonsecurity.com/2015/03/openssl-patch-to-plug-severe-security-holes/
content:
<p>The world is about to get another reminder about just how much of the Internet runs on technology maintained by a handful of coders working on a shoestring budget. <strong>OpenSSL</strong> &#8212; the software used by thousands of companies to encrypt online communications &#8212; is set to get a security makeover this week: The <strong>OpenSSL project</strong> <a title="http://marc.info/?l=openssl-announce&amp;m=142653572011212&amp;w=2" href="http://marc.info/?l=openssl-announce&amp;m=142653572011212&amp;w=2" target="_blank">said</a> it plans to release new versions of its code to fix a number of security weaknesses, including some classified as &#8220;high&#8221; severity.</p>
<p><a href="media/fc2f4214.iheart.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/03/iheart.png"><img class="alignright size-medium wp-image-30411" src="media/9829e347.iheart-285x62.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/03/iheart-285x62.png" alt="iheart" width="285" height="62" /></a>OpenSSL is deployed at countless organizations, including at Web giants like <strong>Facebook, Google</strong> and <strong>Yahoo</strong> &#8212; as well as broadly across U.S. federal government networks. As its name suggests, OpenSSL implements <a title="http://en.wikipedia.org/wiki/Transport_Layer_Security" href="http://en.wikipedia.org/wiki/Transport_Layer_Security" target="_blank">Secure Sockets Layer</a> (SSL) encryption (also known as &#8220;transport layer security&#8221; or TLS) for Web sites and associated networks, ensuring that the data cannot be read by untrusted parties.</p>
<p>The patch is likely to set off a mad scramble by security teams at organizations that rely on OpenSSL. That&#8217;s because security updates &#8212; particularly those added to open-source software like OpenSSL that anyone can view &#8212; give cybercriminals a road map toward finding out where the fixed vulnerabilities lie and insight into how to exploit those flaws.</p>
<p>Indeed, while the OpenSSL project plans to issue the updates on Thursday, Mar. 19, the organization isn&#8217;t pre-releasing any details about the fixes. <strong>Steve Marquess</strong>, a founding partner at the OpenSSL Software Foundation, said that information will only be shared in advance with the major operating system vendors.</p>
<p>&#8220;We&#8217;d like to let everyone know so they can be prepared and so forth, but we have been slowly driven to a pretty brutal policy of no [advance] disclosure,&#8221; Marquess said. &#8220;One of our main revenue sources is support contracts, and we don&#8217;t even give them advance notice.&#8221;</p>
<p>Advance notice helps not only defenders, but attackers as well. Last year, ne&#8217;er-do-wells pounced on <a title="http://krebsonsecurity.com/2014/04/heartbleed-bug-exposes-passwords-web-site-encryption-keys/" href="http://krebsonsecurity.com/2014/04/heartbleed-bug-exposes-passwords-web-site-encryption-keys/" target="_blank">Heartbleed</a>, the nickname given to an extremely critical flaw in OpenSSL that allowed anyone to extract passwords, cookies and other sensitive data from servers that were running vulnerable versions of OpenSSL. <a title="http://www.theage.com.au/it-pro/security-it/heartbleed-disclosure-timeline-who-knew-what-and-when-20140415-zqurk.html" href="http://www.theage.com.au/it-pro/security-it/heartbleed-disclosure-timeline-who-knew-what-and-when-20140415-zqurk.html" target="_blank">This Heartbleed disclosure timeline</a> explains a great deal about how that process unfolded in a less-than-ideal manner.<span id="more-30379"></span></p>
<p>In the wake of Heartbleed, media organizations asked how such a bug &#8212; which many security experts said was a fairly obvious blunder in hindsight &#8212; could have gone undetected in the guts of the open-source code for so long. Marquess <a title="http://veridicalsystems.com/blog/of-money-responsibility-and-pride/" href="http://veridicalsystems.com/blog/of-money-responsibility-and-pride/" target="_blank">took to his blog</a> to explain, posting an open letter requesting additional financial support for the OpenSSL project and pointing out the stark fact that so much of the Internet runs on top of software that is maintained by a tiny team with a shoestring budget.</p>
<p>&#8220;So the mystery is not that a few overworked volunteers missed this bug; the mystery is why it hasn’t happened more often,&#8221; said of the Heartbleed bug.</p>
<p>In an interview with KrebsOnSecurity, Marquess said the updates to be released tomorrow are partly the product of a spike in donations and funding the organization received in the wake of Heartbleed.</p>
<p>In that brief glare of publicity, the OpenSSL Foundation landed two Linux Foundation fellowships &#8212; meaning the group gained two new people who are paid for three years to work full-time on improving the security and stability of OpenSSL. Using donations and some commercial revenues, the foundation also is self-funding two additional people to maintain the code.</p>
<p>&#8220;We have four people working full-time on OpenSSL doing just what needs to be done, as opposed to working on stuff that brings in revenue,&#8221; Marquess said. &#8220;We have a lot more manpower resources, and one of the reasons you&#8217;re seeing all these bug and vulnerability fixes coming out now is that not only are outsiders looking for problems but we are too. &#8220;We’re also doing a major overhaul of the source code, in conjunction with what is going to be probably the biggest crypto audit ever.&#8221;</p>


feed_id: http://krebsonsecurity.com/?p=30397
title: Dark Web’s ‘Evolution Market’ Vanishes
uri: Dark-Web-s-Evolution-Market-Vanishes
url: http://krebsonsecurity.com/2015/03/dark-webs-evolution-market-vanishes/
content:
<p>The <strong>Evolution Market</strong>, an online black market that sells everything contraband &#8212; from marijuana, heroin and ecstasy to stolen identities and malicious hacking services &#8212; appears to have vanished in the last 24 hours with little warning. Much to the chagrin of countless merchants hawking their wares in the underground market, the curators of the project have reportedly absconded with the community&#8217;s bitcoins &#8212; a stash that some Evolution merchants reckon is worth more than USD $12 million.</p>
<div id="attachment_27941" style="width: 295px" class="wp-caption alignright"><a href="media/729d7670.evolution-fraud.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/09/evolution-fraud.png"><img class="size-medium wp-image-27941" src="media/0cfcedc4.evolution-fraud-285x173.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/09/evolution-fraud-285x173.png" alt="The &quot;Fraud Related&quot; section of the Evolution Market before it vanished." width="285" height="173" /></a><p class="wp-caption-text">The &#8220;Fraud Related&#8221; section of the Evolution Market before it vanished.</p></div>
<p>Reachable only via the <a title="https://www.torproject.org/" href="https://www.torproject.org/" target="_blank">Tor network</a> (a.k.a. the &#8220;dark web&#8221; or &#8220;darknet&#8221;), Evolution Market quickly emerged as the go-to online bazaar for buyers and sellers of illicit goods following the shutdown of the infamous <strong>Silk Road</strong> marketplaces <a title="http://krebsonsecurity.com/2013/10/feds-take-down-online-fraud-bazaar-silk-road-arrest-alleged-mastermind/" href="http://krebsonsecurity.com/2013/10/feds-take-down-online-fraud-bazaar-silk-road-arrest-alleged-mastermind/" target="_blank">in 2013</a> and again <a title="http://krebsonsecurity.com/2014/11/feds-arrest-alleged-silk-road-2-admin-seize-servers/" href="http://krebsonsecurity.com/2014/11/feds-arrest-alleged-silk-road-2-admin-seize-servers/" target="_blank">late last year</a>.</p>
<p>Evolution operates on an escrow system, allowing buyers and sellers to more confidently and successfully consummate sales of dodgy goods. But that means the market&#8217;s administrators at any given time have direct access to a tempting amount of virtually untraceable currency.</p>
<p>Denizens of the darkweb community say the moderators in charge of Evolution (known as just &#8220;Evo&#8221; by vendors and buyers alike) had in the past few days instituted long delays in responding to and processing withdrawal requests from the marketplace&#8217;s myriad vendors.</p>
<p>According to chatter from the Evolution <a title="http://www.reddit.com/r/EvolutionMarket/comments/2zezlq/evolution_admins_exit_scamming/" href="http://www.reddit.com/r/EvolutionMarket/comments/2zezlq/evolution_admins_exit_scamming/" target="_blank">discussion page on Reddit</a>, Evo&#8217;s administrators &#8212; who go by the handles &#8220;<strong>Kimble</strong>&#8221; and &#8220;<strong>Verto</strong>&#8221; &#8212; initially blamed the delays on an unexpected influx of huge withdrawal requests that the community&#8217;s coffers could not satisfy all at once. The administrators assured anxious vendors that the issue would be resolved within 24 hours.</p>
<p>But before that 24 hours could elapse, the Evo community &#8212; its marketplace and user discussion forum &#8212; went offline. Now, volunteer moderators from those communities are posting to Reddit that the administrators have &#8220;exit scammed,&#8221; &#8212; essentially taken all the money and run.<span id="more-30397"></span></p>
<p>One inconvenienced Evo aficionado who described himself as &#8220;an occasional buyer&#8221; and spoke to KrebsOnSecurity on condition of anonymity said the apparent exit scam probably should have been expected: Kimble and Verto also designed and operated the <a title="http://krebsonsecurity.com/tag/tor-carding-forum/" href="http://krebsonsecurity.com/tag/tor-carding-forum/" target="_blank">Tor Carding Forum</a>, a now-defunct site that specialized in credit card fraud.</p>
<p>The Evo buyer said he expects that the <a title="http://www.coindesk.com/price/" href="http://www.coindesk.com/price/" target="_blank">market value of bitcoins</a> will drop considerably over the next 24 hours as a result of the apparent mass ripoff.</p>
<p>&#8220;Bitcoin will take a big hit in its value over the next day or two as more Europeans wake up,&#8221; he said.</p>
<p>The value of one bitcoin fell 2.04 percent on Mar. 17, settling at USD $284.46, according to the price index at <strong>Coindesk.com</strong>.</p>
<p>If confirmed, the closure of Evolution Market will likely force many buyers and sellers to seek business at <strong>Agora Marketplace</strong>, a similar but slightly more exclusive darknet bazaar that is still thriving.</p>


feed_id: http://krebsonsecurity.com/?p=30380
title: Premera Blue Cross Breach Exposes Financial, Medical Records
uri: Premera-Blue-Cross-Breach-Exposes-Financial-Medical-Records
url: http://krebsonsecurity.com/2015/03/premera-blue-cross-breach-exposes-financial-medical-records/
content:
<p><strong>Premera Blue Cross</strong>, a major provider of health care services, disclosed today that an intrusion into its network may have resulted in the breach of financial and medical records of 11 million customers. Although Premera isn&#8217;t saying so just yet, there are indicators that this intrusion is once again the work of state-sponsored espionage groups based in China.</p>
<p><a href="media/ce0fe6aa.premera.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/03/premera.png"><img class="alignright  wp-image-30382" src="media/ce0fe6aa.premera.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/03/premera.png" alt="premera" width="312" height="101" /></a>In a statement posted on a Web site set up to share information about the breach &#8212; <a title="http://premeraupdate.com" href="http://premeraupdate.com" target="_blank">premeraupdate.com</a> &#8212; the company said that it learned about the attack on January 29, 2015. Premera said its investigation revealed that the initial attack occurred on May 5, 2014.</p>
<p>&#8220;This incident affected Premera Blue Cross, Premera Blue Cross Blue Shield of Alaska, and our affiliate brands Vivacity and Connexion Insurance Solutions, Inc,&#8221; the company said. Their statement continues:</p>
<blockquote><p>&#8220;Our investigation determined that the attackers may have gained unauthorized access to applicants and members’ information, which could include member name, date of birth, email address, address, telephone number, Social Security number, member identification numbers, bank account information, and claims information, including clinical information. This incident also affected members of other Blue Cross Blue Shield plans who sought treatment in Washington or Alaska.</p>
<p>&#8220;Individuals who do business with us and provided us with their email address, personal bank account number or social security number are also affected. The investigation has not determined that any such data was removed from our systems.  We also have no evidence to date that such data has been used inappropriately.&#8221;</p></blockquote>
<p>Premera said it will be notifying affected customers in letters sent out via postal mail, and that it will be offering two years of free credit monitoring services through big-three credit bureau <strong>Experian</strong>.</p>
<p><span style="text-decoration: underline;">ANOTHER STATE-SPONSORED ATTACK?</span></p>
<p>The health care provider said it is working with security firm <strong>Mandiant</strong> and the <strong>FBI</strong> in the investigation. Mandiant specializes in tracking and blocking attacks from state-sponsored hacking groups, particularly those based in China. Asked about clues that would suggest a possible actor involved in the breach, Premera deferred to the FBI.</p>
<p>An official with the FBI&#8217;s Seattle field office confirmed that the agency is investigating, but declined to discuss details of its findings thus far, citing &#8220;the ongoing nature of the investigation.&#8221;</p>
<p>&#8220;Cybercrime remains a significant threat and the FBI will continue to devote substantial resources and efforts to bringing cyber criminals to justice,&#8221; the FBI said in an emailed statement.</p>
<p>There are indications that this may be the work of the Chinese espionage group tied to <a title="http://krebsonsecurity.com/2015/02/data-breach-at-health-insurer-anthem-could-impact-millions/" href="http://krebsonsecurity.com/2015/02/data-breach-at-health-insurer-anthem-could-impact-millions/" target="_blank">the breach disclosed earlier this year at <strong>Anthem</strong></a>, an intrusion that affected some 78 million Americans.<span id="more-30380"></span></p>
<p>On Feb. 9, 2015, KrebsOnSecurity carried <a title="http://krebsonsecurity.com/2015/02/anthem-breach-may-have-started-in-april-2014/" href="http://krebsonsecurity.com/2015/02/anthem-breach-may-have-started-in-april-2014/" target="_blank">an exclusive story</a> pointing to clues in the Anthem breach which suggested that the attackers blamed for that breach &#8212; a Chinese state-sponsored hacking group known variously as &#8220;<a title="http://blog.crowdstrike.com/deep-thought-chinese-targeting-national-security-think-tanks/" href="http://blog.crowdstrike.com/deep-thought-chinese-targeting-national-security-think-tanks/" target="_blank">Deep Panda</a>,&#8221; &#8220;<a title="https://www.novetta.com/2014/10/cyber-security-coalition-releases-full-report-on-large-scale-interdiction-of-chinese-state-sponsored-espionage-effort/" href="https://www.novetta.com/2014/10/cyber-security-coalition-releases-full-report-on-large-scale-interdiction-of-chinese-state-sponsored-espionage-effort/" target="_blank">Axiom</a>,&#8221; &#8220;<a title="http://blogs.cisco.com/security/talos/threat-spotlight-group-72" href="http://blogs.cisco.com/security/talos/threat-spotlight-group-72" target="_blank">Group 72</a>,&#8221; and the &#8220;<a title="http://www.emc.com/collateral/white-papers/h12756-wp-shell-crew.pdf" href="media/6bd9c337.h12756-wp-shell-crew.pdf" data-original-source="http://www.emc.com/collateral/white-papers/h12756-wp-shell-crew.pdf" target="_blank">Shell_Crew</a>&#8221; &#8212; began chipping away at Anthem&#8217;s defenses in late April 2014. The evidence revolved around an Internet address that researchers had tied to Deep Panda hacking activity, and that address was used to host a site called we11point.com (Anthem was previously known as Wellpoint prior to its corporate name change in late 2014).</p>
<p>As that story noted, Arlington, Va. based security firm <strong>ThreatConnect Inc.</strong> tied that Wellpoint look-alike domain to a series of targeted attacks launched in May 2014 that appeared designed to trick Wellpoint employees into downloading malicious software tied to the Deep Panda hacking gang.</p>
<p>On Feb. 27, 2015, ThreatConnect researchers <a title="http://www.threatconnect.com/news/the-anthem-hack-all-roads-lead-to-china/" href="http://www.threatconnect.com/news/the-anthem-hack-all-roads-lead-to-china/" target="_blank">published more information</a> tying the same threat actors and modus operandi to a domain called &#8220;prennera.com&#8221; (notice the use of the double &#8220;n&#8221; there to mimic the letter &#8220;m&#8221;.</p>
<p>&#8220;It is believed that the prennera[.]com domain may have been impersonating the Healthcare provider <a href="http://www.premera.com/" rel="noreferrer">Premera Blue Cross</a>, where the attackers used the same character replacement technique by replacing the &#8216;m&#8217; with two &#8216;n&#8217; characters within the faux domain, the same technique that would be seen five months later with the we11point[.]com command and control infrastructure,&#8221; ThreatConnect wrote in a blog post three weeks ago.</p>
<p>More on this story as it develops. Stay tuned.</p>


feed_id: http://krebsonsecurity.com/?p=30366
title: Door Skimmer + Hidden Camera = Profit
uri: Door-Skimmer-Hidden-Camera-Profit
url: http://krebsonsecurity.com/2015/03/door-skimmer-hidden-camera-profit/
content:
<p>If an ATM you&#8217;d like to use is enclosed in a vestibule that requires a card swipe at the door, it might be a good idea to go find another machine, or at least use something other than a payment card to gain entry. Thieves frequently add skimmers to these key card locks and then hide cameras above or beside such ATMs, allowing them to steal your PIN and card data without ever actually tampering with the cash machine itself.</p>
<p>One recent skimming incident began when fraudsters placed a card skimmer directly on top of this key card &#8220;dip&#8221; device, which managed access to a bank ATM vestibule:</p>
<div id="attachment_30368" style="width: 610px" class="wp-caption aligncenter"><a class="lightbox" href="media/85fa6543.skimmeddoor.jpg" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/03/skimmeddoor.jpg"><img class="size-large wp-image-30368" src="media/2e9a7521.skimmeddoor-600x800.jpg" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/03/skimmeddoor-600x800.jpg" alt="Locks secured by mag stripe readers typically aren't very discriminating or physically secure." width="600" height="800" /></a><p class="wp-caption-text">Locks secured by mag stripe readers typically aren&#8217;t very discriminating or physically secure.</p></div>
<p>The attackers in this incident then placed a hidden camera in a false panel above the ATM.</p>
<div id="attachment_30369" style="width: 610px" class="wp-caption aligncenter"><a class="lightbox" href="media/07329594.skimmeraboveatm-Copy_edited-1-Copy.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/03/skimmeraboveatm-Copy_edited-1-Copy.png"><img class="size-large wp-image-30369" src="media/65bc0ebf.skimmeraboveatm-Copy_edited-1-Copy-600x450.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/03/skimmeraboveatm-Copy_edited-1-Copy-600x450.png" alt="A tiny pinhole lets the hidden video camera record customers entering their PINs." width="600" height="450" /></a><p class="wp-caption-text">A tiny pinhole lets the hidden video camera record customers entering their PINs.</p></div>
<p>Here&#8217;s the backside of the phony door card reader the thieves placed on top of the legitimate card reader:<span id="more-30366"></span></p>
<div id="attachment_30370" style="width: 610px" class="wp-caption aligncenter"><a class="lightbox" href="media/77a5f705.skimmedmachineback.jpg" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/03/skimmedmachineback.jpg"><img class="size-large wp-image-30370" src="media/fbf526f1.skimmedmachineback-600x450.jpg" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/03/skimmedmachineback-600x450.jpg" alt="Skimming devices aren't just for ATMs!" width="600" height="450" /></a><p class="wp-caption-text">Skimming devices aren&#8217;t just for ATMs!</p></div>
<p>Take a gander at the technology stuffed into the false overhead panel, which appears to have been powered by a disassembled Casio digital camera:</p>
<div id="attachment_30371" style="width: 610px" class="wp-caption aligncenter"><a class="lightbox" href="media/6f0db401.skimmedmachine.jpg" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/03/skimmedmachine.jpg"><img class="size-large wp-image-30371" src="media/ed6b0b97.skimmedmachine-600x450.jpg" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/03/skimmedmachine-600x450.jpg" alt="A hidden pinhole camera made from a cannibalized Casio digital camera." width="600" height="450" /></a><p class="wp-caption-text">A hidden pinhole camera made from a disassembled Casio digital camera.</p></div>
<p>Pro tip: These door security devices aren&#8217;t too smart, and most of them will happily accept just about any card with a magnetic stripe. But don&#8217;t take my word for it: Next time you pass one of these ATM vestibules on the street, whip out your library card or ID card and see for yourself.</p>
<p>Sometimes crooks will remove the door card readers and actually tinker with the technology inside the reader, as I detailed in <a title="http://krebsonsecurity.com/2011/01/atm-skimmers-that-never-touch-the-atm/" href="http://krebsonsecurity.com/2011/01/atm-skimmers-that-never-touch-the-atm/" target="_blank">a skimmer story from 2011</a>. In that incident, the hidden camera was stuck behind a mirror that was affixed to the wall several inches above the actual ATM. The thieves in this case might have done the same, as the dip card device appears to have been affixed to the door with little more than two Phillips-head screws.</p>
<p>If you enjoyed this post and are fascinated by skimming devices, there are more than three dozen other skimming stories in this ongoing series &#8212; <a title="http://krebsonsecurity.com/all-about-skimmers/" href="http://krebsonsecurity.com/all-about-skimmers/" target="_blank">All About Skimmers</a>.</p>


feed_id: http://krebsonsecurity.com/?p=30337
title: ‘AntiDetect’ Helps Thieves Hide Digital Fingerprints
uri: AntiDetect-Helps-Thieves-Hide-Digital-Fingerprints
url: http://krebsonsecurity.com/2015/03/antidetect-helps-thieves-hide-digital-fingerprints/
content:
<p>As a greater number of banks in the United States shift to issuing more secure credit and debit cards with embedded chip technology, fraudsters are going to direct more of their attacks against online merchants. No surprise, then, that thieves increasingly are turning to an emerging set of software tools to help them evade fraud detection schemes employed by many e-commerce companies.</p>
<p>Every browser has a relatively unique &#8220;fingerprint&#8221; that is shared with Web sites. That signature is derived from dozens of qualities, including the computer&#8217;s operating system type, various plugins installed, the browser&#8217;s language setting and its time zone. Banks can leverage fingerprinting to flag transactions that occur from a browser the bank has never seen associated with a customer&#8217;s account.</p>
<p>Payment service providers and online stores often use browser fingerprinting to block transactions from browsers that have previously been associated with unauthorized sales (or a high volume of sales for the same or similar product in a short period of time).</p>
<p>In January, several media outlets <a title="http://www.csoonline.com/article/2871248/fraud-prevention/this-tool-may-make-it-easier-for-thieves-to-empty-bank-accounts.html?phint=newt%3Dnetworkworld_security_alert&amp;phint=idg_eid%3Db8b9a9eb03467551845d84fe2c50ee95#tk.NWWNLE_nlt_security_2015-01-20" href="http://www.csoonline.com/article/2871248/fraud-prevention/this-tool-may-make-it-easier-for-thieves-to-empty-bank-accounts.html?phint=newt%3Dnetworkworld_security_alert&amp;phint=idg_eid%3Db8b9a9eb03467551845d84fe2c50ee95#tk.NWWNLE_nlt_security_2015-01-20" target="_blank">wrote</a> about a crimeware tool called <strong>FraudFox</strong>, which is <a title="https://cryptothrift.com/auctions/download-software/fraudfox-vm-fake-browser-fingerprint-banks-paypal/" href="https://cryptothrift.com/auctions/download-software/fraudfox-vm-fake-browser-fingerprint-banks-paypal/">marketed</a> as a way to help crooks sidestep browser fingerprinting. However, FraudFox is merely the latest competitor to emerge in a fairly established marketplace of tools aimed at helping thieves cash out stolen cards at online merchants.</p>
<p>Another fraudster-friendly tool that&#8217;s been around the underground hacker forums even longer is called <strong>Antidetect</strong>. Currently in version <em>6.0.0.1</em>, Antidetect allows users to very quickly and easily change components of the their system to avoid browser fingerprinting, including the browser type (Safari, IE, Chrome, etc.), version, language, user agent, Adobe Flash version, number and type of other plugins, as well as operating system settings such as OS and processor type, time zone and screen resolution.</p>
<div id="attachment_30354" style="width: 610px" class="wp-caption aligncenter"><a class="lightbox" href="media/ba024022.browserantidetect.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/03/browserantidetect.png"><img class="size-large wp-image-30354" src="media/96fa290d.browserantidetect-600x258.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/03/browserantidetect-600x258.png" alt="Antidetect is marketed to fraudsters involved in ripping off online stores." width="600" height="258" /></a><p class="wp-caption-text">Antidetect is marketed to fraudsters involved in ripping off online stores.</p></div>
<p>The seller of this product shared the video below of someone using Antidetect along with a stolen credit card to buy three different downloadable software titles from gaming giant <strong>Origin.com</strong>. That video has been edited for brevity and to remove sensitive information; my version also includes captions to describe what&#8217;s going on throughout the video.<span id="more-30337"></span></p>
<p>In it, the fraudster uses Antidetect to generate a fresh, unique browser configuration, and then uses a bundled tool that makes it simple to proxy communications through one of a hundreds of compromised systems around the world. He picks a proxy in Ontario, Canada, and then changes the time zone on his virtual machine to match Ontario&#8217;s.</p>
<p>Then our demonstrator goes to a carding shop and buys a credit card stolen from a woman who lives in Ontario. After he checks to ensure the card is still valid, he heads over the origin.com and uses the card to buy more than $200 in downloadable games that can be easily resold for cash. When the transactions are complete, he uses Antidetect to create a new browser configuration, and restarts the entire process &#8212; (which takes about 5 minutes from browser generation and proxy configuration to selecting a new card and purchasing software with it). Click the icon in the bottom right corner of the video player for the full-screen version.</p>
<div style="text-align: center;"><iframe src="https://www.youtube.com/embed/ZQN7CyCXh90" width="420" height="315" frameborder="0" allowfullscreen="allowfullscreen"></iframe></div>
<p>I think it&#8217;s safe to say we can expect to see more complex anti-fingerprinting tools come on the cybercriminal market as fewer banks in the United States issue chipless cards. There is also no question that card-not-present fraud will spike as more banks in the US issue chipped cards; this same increase in card-not-present fraud has occurred in virtually every country that made the chip card transition, including <a title="http://krebsonsecurity.com/wp-content/uploads/2015/03/australiacnp.png" href="media/09ff4000.australiacnp.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/03/australiacnp.png" target="_blank">Australia</a>, <a title="http://krebsonsecurity.com/wp-content/uploads/2015/03/CanadaCNP.png" href="media/267e0515.CanadaCNP.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/03/CanadaCNP.png" target="_blank">Canada</a>, <a title="http://krebsonsecurity.com/wp-content/uploads/2015/03/frenchCNP.png" href="media/2fdd7f0c.frenchCNP.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/03/frenchCNP.png" target="_blank">France</a> and the <a title="http://krebsonsecurity.com/wp-content/uploads/2015/03/frenchCNP.png" href="media/2fdd7f0c.frenchCNP.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/03/frenchCNP.png" target="_blank">United Kingdom</a>. The only question is: Are online merchants ready for the coming e-commerce fraud wave?</p>
<p>Hat tip to Alex Holden of <a title="http://www.holdsecurity.com" href="http://www.holdsecurity.com" target="_blank">Hold Security</a> for bringing this video and innovation to my attention.</p>
<p>Update: The graphics linked to in the paragraph above on chip card transitions in other countries are from Doug King’s <a href="https://frbatlanta.org/-/media/Documents/rprf/rprf_pubs/120111wp.pdf?la=en" target="_blank" rel="noreferrer">January 2012 white paper “Chip-and-PIN: Success and Challenge in Reducing Fraud”</a> (PDF).</p>


feed_id: http://krebsonsecurity.com/?p=30332
title: Adobe Flash Update Plugs 11 Security Holes
uri: Adobe-Flash-Update-Plugs-11-Security-Holes
url: http://krebsonsecurity.com/2015/03/adobe-flash-update-plugs-11-security-holes/
content:
<p><strong>Adobe</strong> has released an update for its <strong>Flash Player</strong> software that fixes at least 11 separate, critical security vulnerabilities in the program. If you have Flash installed, please take a moment to ensure your systems are updated.</p>
<p><a href="media/06f26f56.brokenflash-a.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2013/02/brokenflash-a.png"><img class="alignright  wp-image-18875" src="media/06f26f56.brokenflash-a.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2013/02/brokenflash-a.png" alt="brokenflash-a" width="183" height="156" /></a>Not sure whether your browser has Flash installed or what version it may be running? Browse to <a title="https://www.adobe.com/software/flash/about/" href="https://www.adobe.com/software/flash/about/" target="_blank">this link</a>. The newest, patched version is <em>17.0.0.134</em> for <strong>Windows</strong> and <strong>Mac</strong> users. Adobe Flash Player installed with <strong>Google Chrome</strong>, as well as <strong>Internet Explorer</strong> on <strong>Windows 8.x</strong>, should automatically update to version 17.0.0.134.</p>
<p>The most recent versions of Flash should be available from the <a title="http://get.adobe.com/flashplayer/" href="http://get.adobe.com/flashplayer/" target="_blank">Flash home page</a>, but beware potentially unwanted add-ons, like <strong>McAfee Security Scan</strong>. To avoid this, uncheck the pre-checked box before downloading, or grab your OS-specific Flash download from <a title="https://www.adobe.com/products/flashplayer/distribution3.html" href="https://www.adobe.com/products/flashplayer/distribution3.html" target="_blank">here</a>. Windows users who browse the Web with anything other than Internet Explorer may need to apply this patch twice, once with IE and again using the alternative browser (<strong>Firefox</strong>, <strong>Opera</strong>, e.g.).</p>
<p>The <a title="http://krebsonsecurity.com/2015/02/yet-another-flash-patch-fixes-zero-day-flaw/" href="http://krebsonsecurity.com/2015/02/yet-another-flash-patch-fixes-zero-day-flaw/" target="_blank">last few Flash updates</a> from Adobe have been in response to zero-day threats targeting previously unknown vulnerabilities in the program. But Adobe says it is not aware of any exploits in the wild for the issues addressed in this update. Adobe&#8217;s advisory on this patch is available <a title="https://helpx.adobe.com/security/products/flash-player/apsb15-05.html" href="https://helpx.adobe.com/security/products/flash-player/apsb15-05.html" target="_blank">here</a>.</p>


feed_id: http://krebsonsecurity.com/?p=30322
title: MS Update 3033929 Causing Reboot Loop
uri: MS-Update-3033929-Causing-Reboot-Loop
url: http://krebsonsecurity.com/2015/03/ms-update-3033929-causing-reboot-loop/
content:
<p>One of the operating system updates Microsoft released on Tuesday of this week &#8212; <strong>KB3033929</strong> &#8212; is causing a reboot loop for a fair number of Windows 7 users, according to postings on multiple help forums. The update in question does not appear to address a pressing security vulnerability, so users who have not  yet installed it should probably delay doing so until Microsoft straightens things out.<span id="more-30322"></span></p>
<p><a href="media/d85cffb4.brokenwindows.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/07/brokenwindows.png"><img class="alignright size-full wp-image-26837" src="media/d85cffb4.brokenwindows.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/07/brokenwindows.png" alt="brokenwindows" width="229" height="240" /></a>Various tech help forums ares starting to fill up with requests from Windows 7 users who are experiencing a reboot loop after applying <a title="https://support.microsoft.com/kb/3033929" href="https://support.microsoft.com/kb/3033929" target="_blank">the glitchy patch</a>, which is a &#8220;code signing&#8221; update that improves the ability of Windows 7 and Windows Server 2008 R2 systems to validate the integrity and authenticity of programs running on top of the operating system.</p>
<p>At this time, none of the tech help forums seem to have a solution for the problem. If that changes (or if Microsoft pulls and re-issues this patch) I&#8217;ll update this post with a solution. For now, it&#8217;s best for Windows users to delay installing KB3033929.</p>
<p>Further reading:</p>
<p><a title="https://social.technet.microsoft.com/Forums/windows/en-US/a08ad884-6b05-4632-8f28-2568eb97b636/update-kb3033929-fails-with-error-code-80004005?forum=w7itprosecurity" href="https://social.technet.microsoft.com/Forums/windows/en-US/a08ad884-6b05-4632-8f28-2568eb97b636/update-kb3033929-fails-with-error-code-80004005?forum=w7itprosecurity" target="_blank">Microsoft&#8217;s Technet Forum</a></p>
<p><a title="http://answers.microsoft.com/en-us/windows/forum/windows_7-windows_update/kb3033929-fails-to-install-and-cause-a-minor/4c56d5d5-a66c-4865-8ccb-d36f7c314c33" href="http://answers.microsoft.com/en-us/windows/forum/windows_7-windows_update/kb3033929-fails-to-install-and-cause-a-minor/4c56d5d5-a66c-4865-8ccb-d36f7c314c33" target="_blank">Microsoft&#8217;s Answers forum</a></p>
<p><a title="http://h30434.www3.hp.com/t5/Other-Desktop-PC-Questions/Security-Update-for-Windows-7-for-x64-based-Systems/td-p/4927846" href="http://h30434.www3.hp.com/t5/Other-Desktop-PC-Questions/Security-Update-for-Windows-7-for-x64-based-Systems/td-p/4927846" target="_blank">HP Support Forums</a></p>


feed_id: http://krebsonsecurity.com/?p=30298
title: Apple Pay: Bridging Online and Big Box Fraud
uri: Apple-Pay-Bridging-Online-and-Big-Box-Fraud
url: http://krebsonsecurity.com/2015/03/apple-pay-bridging-online-and-big-box-fraud/
content:
<p>Lost amid the media firestorm these past few weeks about fraudsters turning to <strong>Apple Pay</strong> is this stark and rather unsettling reality: Apple Pay makes it possible for cyber thieves to buy high-priced merchandise from brick-and-mortar stores using stolen credit and debit card numbers that were heretofore only useful for online fraud.</p>
<p><a href="media/85fcd9f4.applepay.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/03/applepay.png"><img class="alignright size-full wp-image-30305" src="media/85fcd9f4.applepay.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/03/applepay.png" alt="applepay" width="183" height="99" /></a>To understand what&#8217;s going on here, a quick primer on card fraud is probably in order. If you&#8217;re a fraudster and you wish to walk into a Best Buy store and walk out with a big screen TV or xBox console on someone else&#8217;s dime, you&#8217;re going to buy &#8220;<strong>dumps</strong>,&#8221; which are data stolen straight off the magnetic stripe on the backs of cards.</p>
<p>Typically, dumps are stolen via malware planted on point-of-sale devices, as in the breaches at brick-and-mortar stores like <a title="http://krebsonsecurity.com/?s=target+breach&amp;x=0&amp;y=0" href="http://krebsonsecurity.com/?s=target+breach&amp;x=0&amp;y=0" target="_blank">Target</a>, <a title="http://krebsonsecurity.com/?s=home+depot+breach&amp;x=0&amp;y=0" href="http://krebsonsecurity.com/?s=home+depot+breach&amp;x=0&amp;y=0" target="_blank">Home Depot</a> and <a title="http://krebsonsecurity.com/category/data-breaches/" href="http://krebsonsecurity.com/category/data-breaches/" target="_blank">countless others</a> over the past year. Dumps buyers encode the data onto new plastic, which they then use &#8220;in-store&#8221; at retailers and walk out with armloads full of high-priced goods that can be easily resold for cash. The average price of a single dump is between $10-$30, but the payoff in stolen merchandise per card is often many times that amount.</p>
<p>When fraudsters want to order something online using stolen credit cards, they go buy what the crooks call &#8220;<strong>CVV</strong>s&#8221; &#8212; i.e., card data stolen from hacked <em>online</em> stores. CVV stands for &#8220;card verification code,&#8221; and refers to the three-digit code on the back of cards that&#8217;s required for most online transactions. Fraudsters buying CVVs get the credit card number, the expiration date, the card verification code, as well as the cardholder&#8217;s name, address and phone number. Because they&#8217;re less versatile than dumps, CVVs cost quite a bit less &#8212; typically around $1-$5 per stolen account.</p>
<p>So in summary, <strong>dumps</strong> are stolen from main-street merchants, and are sought after by crooks mainly for use at main street merchants. <strong>CVVs</strong>, on the other hand, are stolen from online stores, and are useful only for fraud against online stores.</p>
<p><em>Enter Apple Pay, which potentially erases that limitation of CVVs because it allows users to sign up online for an in-store payment method using little more than a hacked iTunes account and CVVs. That&#8217;s because most banks that are enabling Apple Pay for their customers do little, if anything, to require that customers prove they have the physical card in their possession.</em></p>
<p><strong>Avivah Litan</strong>, a fraud analyst with <strong>Gartner Inc</strong>. explained <a title="http://blogs.gartner.com/avivah-litan/2015/03/02/applepay-fraud-points-to-looming-problems-with-mobile-payments/#comments" href="http://blogs.gartner.com/avivah-litan/2015/03/02/applepay-fraud-points-to-looming-problems-with-mobile-payments/#comments" target="_blank">a blog post</a> published earlier this month that Apple provides banks with a fair amount of data to aid banks in their efforts at &#8220;<strong>identity proofing</strong>&#8221; the customer, such as device name, its current geographic location, and whether or not the customer has a long history of transactions with iTunes.</p>
<p>All useful data points, of course, unless the iTunes account that all of this information is based on is hijacked by fraudsters. And as we know from previous stories on this blog, there is a robust trade in the cybercrime underground for hijacked iTunes accounts, which <a title="http://krebsonsecurity.com/2013/06/the-value-of-a-hacked-email-account/" href="http://krebsonsecurity.com/2013/06/the-value-of-a-hacked-email-account/" target="_blank">retail for about $8 per account</a>.</p>
<p><span id="more-30298"></span></p>
<p>Litan&#8217;s column continues:</p>
<blockquote><p>Interestingly, neither Apple nor the banks get any useful identity information out of the mobile carriers – at least that I know or heard of. And mobile carrier data could be particularly helpful with identity proofing. For example the banks could compare the mobile service’s billing address with the card account holder’s billing address.</p>
<p>For years, we have been briefed by vendors offering a plethora of innovative and strong user authentication solutions for mobile payments and commerce. And for years, we have been asking the vendors touting them how they know their mobile app is being provisioned to a legitimate user rather than a fraudster. That always appeared to me to be the weakest link in mobile commerce –making sure you provide the app to the right person instead of a crook.</p>
<p>Identity proofing in a non-face-to-face environment is anything but easy but there are some decent solutions around that can be stitched together to significantly narrow down the population of fraudulent transactions and identities. The key is reducing reliance on static data – much of which is PII data that has been compromised by the crooks – and increasing reliance on dynamic data, like reputation, behavior and relationships between non-PII data elements.</p>
<p>This problem is only going to get worse as Samsung/LoopPay and the MCX/CurrentC (supported by Walmart, BestBuy and many other major retailers) release their mobile payment systems, without the customer data advantages Apple has in their relatively closed environment.</p></blockquote>
<p>Sure, the banks could pressure Apple Pay to make their users take a picture of their credit cards with the iPhone and upload that data before signing up. That might work for a short while to deter fraud, at least until the people at <a title="http://krebsonsecurity.com/2010/12/reintroducing-scanlab-a-k-a-scamlab/" href="http://krebsonsecurity.com/2010/12/reintroducing-scanlab-a-k-a-scamlab/" target="_blank">underground document forgery sites like <strong>Scanlab</strong></a> see a new market for their services.</p>
<p>But in the end, most banks coming online with Apple Pay are still using customer call centers to validate new users, leveraging data that can be purchased very cheaply from underground identity theft sites. If any of you doubt how easy it is to buy personal data on just about anyone, check out <a title="http://krebsonsecurity.com/2014/12/toward-a-breach-canary-for-data-brokers/" href="http://krebsonsecurity.com/2014/12/toward-a-breach-canary-for-data-brokers/" target="_blank">the story I wrote in December 2014</a>, wherein I was able to find the name, address, Social Security number, previous address and phone number on all current members of the <strong>U.S. Senate Commerce Committee</strong>.</p>
<p><span class="pullquote pqleft">The irony here is that while Apple Pay has been touted as a more secure alternative to paying with a credit card, the way Apple and the banks have implemented it actually makes card fraud cheaper and easier for fraudsters.</span></p>
<p>Even more deliciously ironic, as noted in <strong>Cherian Abraham</strong>&#8216;s <a title="http://www.droplabs.co/?p=1231%E2%80%9C" href="http://www.droplabs.co/?p=1231%E2%80%9C" target="_blank">insightful column</a> at <strong>Droplabs, </strong>is how much of the fraud stemming from crooks signing up stolen credit cards with Apple Pay <em>was tied to purchases of high-dollar Apple products at Apple&#8217;s own brick-and-mortar stores! </em>That banks end up eating the fraud costs from this activity is just the cherry on top.</p>
<p>Abraham said the banks are in this mess because they didn&#8217;t demand more transparency and traceability from Apple <em>before</em> rushing to sign customers up (or &#8220;provision&#8221; them, in banker-speak) for Apple Pay.</p>
<p>&#8220;One of the biggest gripes I have heard from issuers is the lack of transparency from Apple (<em>what did they expect?</em>) and the makeshift reporting provided to issuers that is proving to be woefully inadequate,&#8221; Abaraham wrote. &#8220;As long as issuers fall back on measures easily circumvented by freely available PII – this problem will continue to leech trust and large sums of cash. And alongside of the latter, there is much blame to go around as well.&#8221;</p>
<p>Both Abraham and Gartner&#8217;s Litan say banks need to take a step back and take the time to develop more robust, thoughtful and scalable solutions to identity proofing customers, particularly as other mobile providers begin rolling out their mobile payment systems without the customer data advantages that Apple has in their relatively closed environment.</p>
<p>&#8220;The vendors in the mobile user authentication space have consistently answered that they are leaving account provisioning policies to the banks or other consumer service providers provisioning the apps,&#8221; Litan wrote. &#8220;Well maybe it’s time for them to reconsider and start helping their client banks and service providers by supporting identity proofing solutions built into their apps. Whoever does this well is surely going to win lots of customer support… and revenue.&#8221;</p>


feed_id: http://krebsonsecurity.com/?p=30177
title: Microsoft Fixes Stuxnet Bug, Again
uri: Microsoft-Fixes-Stuxnet-Bug-Again
url: http://krebsonsecurity.com/2015/03/microsoft-fixes-stuxnet-bug-again/
content:
<p><strong>Microsoft</strong> today shipped a bundle of security updates to address more than three dozen vulnerabilities in <strong>Windows</strong> and associated software. Included in the batch is a fix for a flaw first patched in 2010 &#8212; the very same vulnerability that led to the discovery of the infamous cyberweapon known as Stuxnet. Turns out, the patch that Microsoft shipped to fix that flaw in 2010 didn&#8217;t quite do the trick, leaving Windows users dangerously exposed all this time.</p>
<p><a href="media/d85cffb4.brokenwindows.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/07/brokenwindows.png"><img class="alignright size-full wp-image-26837" src="media/d85cffb4.brokenwindows.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/07/brokenwindows.png" alt="brokenwindows" width="229" height="240" /></a>On this, the third Patch Tuesday of 2015, Microsoft pushed 14 update bundles to address at least 43 separate vulnerabilities in <strong>Internet Explorer</strong>, <strong>Exchange, Office</strong> and a host of other components.</p>
<p>Five of the the patches released today fix flaws that Microsoft has assigned its most serious &#8220;critical&#8221; label, meaning the vulnerabilities these patches fix can be exploited to compromise vulnerable systems through little or no action on the part of the user &#8212; save for perhaps opening a booby-trapped file or visiting a hacked/malicious Web site.</p>
<p>One of the more curious critical fixes is <a title="https://technet.microsoft.com/en-us/library/security/ms15-020.aspx" href="https://technet.microsoft.com/en-us/library/security/ms15-020.aspx" target="_blank">MS15-020</a>, which according to <strong>HP&#8217;s Zero Day Initiative </strong>researchers addresses the same vulnerability that Microsoft patched in August 2010. That vulnerability &#8212; <a title="http://krebsonsecurity.com/2010/07/experts-warn-of-new-windows-shortcut-flaw/" href="http://krebsonsecurity.com/2010/07/experts-warn-of-new-windows-shortcut-flaw/" target="_blank">first revealed in a post on this blog July 15, 2010</a> &#8212; was later discovered to have been one of four zero-day flaws used in <a title="http://en.wikipedia.org/wiki/Stuxnet" href="http://en.wikipedia.org/wiki/Stuxnet" target="_blank">Stuxnet</a>, a weapon of unprecedented sophistication that is now widely considered to have been a joint U.S. and Israeli project aimed at delaying Iran&#8217;s nuclear ambitions. The folks at <strong>HP TippingPoint</strong> have published <a title="http://h30499.www3.hp.com/t5/HP-Security-Products-Blog/StuxNOT-Zero-Day-Protection-from-HP-TippingPoint/ba-p/6718453" href="http://h30499.www3.hp.com/t5/HP-Security-Products-Blog/StuxNOT-Zero-Day-Protection-from-HP-TippingPoint/ba-p/6718453" target="_blank">a blog post</a> on their work in uncovering the failed fix, and how the original 2010 patch missed the mark. For more on Stuxnet, check out <strong>Kim Zetter</strong>&#8216;s excellent new book, <a title="http://www.amazon.com/Countdown-Zero-Day-Stuxnet-Digital-ebook/dp/B00KEPLC08" href="http://www.amazon.com/Countdown-Zero-Day-Stuxnet-Digital-ebook/dp/B00KEPLC08" target="_blank">Countdown To Zero Day</a>.<span id="more-30177"></span></p>
<p>Two other patches address security issues that have received a great deal of media attention of late: The <strong>Superfish</strong> malware and the <strong>FREAK SSL</strong> vulnerability. Freak is a flaw that allows an attacker who controls the local network to downgrade your computer&#8217;s encrypted communications to a much weaker (and crackable) level of security &#8212; potentially allowing attackers to eavesdrop on your browsing and modify or redirect your communications.</p>
<p>As security expert and cryptologist <strong>Matthew Green</strong> <a title="http://blog.cryptographyengineering.com/2015/03/attack-of-week-freak-or-factoring-nsa.html" href="http://blog.cryptographyengineering.com/2015/03/attack-of-week-freak-or-factoring-nsa.html" target="_blank">noted</a>, the FREAK vulnerability is thought to stem from efforts by the National Security Agency to weaken encryption technology allowed to be shipped overseas. Ironically, several researchers have shown how the NSA&#8217;s own Web site was made vulnerable by this flaw; check out <a title="https://www.smacktls.com/" href="https://www.smacktls.com/" target="_blank">SmackTLS.com</a> for more on that.</p>
<p>Microsoft also blogged that on Feb. 19 it released an update to its Malicious Software Removal Tool which searches for and removes Superfish, an adware program that was recently discovered to have factory-shipped with many consumer PCs made by <strong>Lenovo</strong>. Superfish also has been shown to undermine the SSL encryption on systems with the invasive program installed, as demonstrated by researcher Robert Graham <a title="http://blog.erratasec.com/2015/02/extracting-superfish-certificate.html" href="http://blog.erratasec.com/2015/02/extracting-superfish-certificate.html" target="_blank">in this post</a>. Lenovo has said it is no longer shipping Superfish with PCs, and has <a title="http://support.lenovo.com/en/product_security/superfish_uninstall" href="http://support.lenovo.com/en/product_security/superfish_uninstall" target="_blank">released a tool</a> to help remove the program.</p>
<p>For the first time in a while, there are no fixes from <strong>Adobe</strong> on Patch Tuesday, although one of the critical patches Microsoft released today addresses <a title="https://technet.microsoft.com/library/security/MS15-021" href="https://technet.microsoft.com/library/security/MS15-021" target="_blank">a dangerous bug</a> in the Adobe Font Driver on most versions of Windows. For more on today&#8217;s Microsoft updates, check out the roundups published by <a title="https://community.qualys.com/blogs/laws-of-vulnerabilities/2015/03/10/patch-tuesday-march-2015" href="https://community.qualys.com/blogs/laws-of-vulnerabilities/2015/03/10/patch-tuesday-march-2015" target="_blank">Qualys</a> and <a title="http://blog.shavlik.com/march-2015-patch-tuesday/" href="http://blog.shavlik.com/march-2015-patch-tuesday/" target="_blank">Shavlik</a>. Links to the individual bulletins released today are <a title="https://technet.microsoft.com/library/security/ms15-mar" href="https://technet.microsoft.com/library/security/ms15-mar" target="_blank">here</a>.</p>


feed_id: http://krebsonsecurity.com/?p=30433
title: Hilton Honors Flaw Exposed All Accounts
uri: Hilton-Honors-Flaw-Exposed-All-Accounts
url: http://krebsonsecurity.com/2015/03/hilton-honors-flaw-exposed-all-accounts/
content:
<p>Hospitality giant <strong>Hilton Hotels &amp; Resorts</strong> recently started offering <strong>Hilton HHonors Awards</strong> members 1,000 free awards points to those who agreed to change their passwords for the online service prior to April 1, 2015, when the company said the change would become mandatory. Ironically, that same campaign led to the discovery of a simple yet powerful flaw in the site that let anyone hijack a Hilton Honors account just by knowing or guessing its valid 9-digit Hilton Honors account number.</p>
<div id="attachment_30434" style="width: 610px" class="wp-caption aligncenter"><a href="media/f0a818c1.hiltonchangepwd.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/03/hiltonchangepwd.png"><img class="size-large wp-image-30434" src="media/bbfacd60.hiltonchangepwd-600x144.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/03/hiltonchangepwd-600x144.png" alt="Until it was notified by KrebsOnSecurity about a dangerous flaw in its site, Hilton was offering 1,000 points to customers who changed their passwords before April 1, 2015." width="600" height="144" /></a><p class="wp-caption-text">Until it was notified by KrebsOnSecurity about a dangerous flaw in its site, Hilton was offering 1,000 points to customers who changed their passwords before April 1, 2015.</p></div>
<p>The vulnerability was uncovered by <strong>Brandon Potter </strong>and <strong>JB Snyder</strong>, technical security consultant and founder, respectively, at security consulting and testing firm <a title="http://www.bancsec.com" href="http://www.bancsec.com" target="_blank">Bancsec</a>. The two found that once they&#8217;d logged into a Hilton Honors account, they could hijack any other account just by knowing its account number. All it took was a small amount of changing the site&#8217;s HTML content and then reloading the page.</p>
<p>After that, they could see and do everything available to the legitimate holder of that account, such as changing the account password; viewing past and upcoming travel; redeeming Hilton Honors points for travel or hotel reservations worldwide; or having the points sent as cash to prepaid credit cards or transferred to other Hilton Honors accounts. The vulnerability also exposed the customer&#8217;s email address, physical address and the last four digits of any credit card on file.</p>
<p>I saw this vulnerability in action after giving Snyder and Potter my own Hilton Honors account number, and seconds later seeing screen shots of them logged into my account. Hours after this author alerted Hilton of the discovery, the Hilton Honors site temporarily stopped allowing users to reset their passwords. The flaw they discovered now appears to be fixed.</p>
<p>“Hilton Worldwide recently confirmed a vulnerability on a section of our Hilton HHonors website, and we took immediate action to remediate the vulnerability,&#8221; Hilton wrote in an emailed statement. &#8220;As always, we encourage Hilton HHonors members to review their accounts and update their online passwords regularly as a precaution. Hilton Worldwide takes information security very seriously and we are committed to safeguarding our guests’ personal information.”<span id="more-30433"></span></p>
<p>Snyder said the problem stemmed from a common Web application weakness called a <a title="https://www.owasp.org/index.php/Cross-Site_Request_Forgery_%28CSRF%29" href="https://www.owasp.org/index.php/Cross-Site_Request_Forgery_%28CSRF%29" target="_blank">cross-site request forgery</a> (CSRF) vulnerability, a type of attack that occurs when a malicious Web site, email, blog, instant message, or program causes a user&#8217;s Web browser to perform an unwanted action on a trusted site for which the user is currently authenticated.</p>
<p>The CSRF flaw was doubly dangerous because Hilton&#8217;s site didn&#8217;t require logged-in users to re-enter their current passwords before picking a new one.</p>
<p>&#8220;If they have so much personal information on people, they should be required to do Web application testing before publishing changes to the internet,&#8221; Snyder said. &#8220;Especially if they have millions of users like I’m sure they do.&#8221;</p>
<p>Snyder said attackers could easily enumerate Hilton Honors account numbers using the company&#8217;s Web site, which relies on a PIN reset page that will tell you whether any 9-digit number is a valid account.</p>
<p>&#8220;There are a billion combinations, but this testing on the PIN reset page could be easily automated,&#8221; Snyder said.</p>
<p>Hilton no longer allows users to pick a PIN as a password, and those who try to reset their password after logging in with the their PIN are told to pick a password of at least eight characters in length, containing at least one uppercase letter and a number or special character. Subsequent password changes, however, still do not require users to enter their existing password.</p>
<p>It is likely that the offer of 1,000 points for customers who voluntarily changed their passwords before April 1, 2015 was an effort to get more customers to ditch their 4-digit PINs. Hilton&#8217;s reliance on a 4-digit PIN to secure customer loyalty accounts was blamed last year for <a title="http://krebsonsecurity.com/2014/11/thieves-cash-out-rewards-points-accounts/" href="http://krebsonsecurity.com/2014/11/thieves-cash-out-rewards-points-accounts/" target="_blank">a spike in account takeovers</a> in which customers logged in to find that thieves had cashed out or otherwise stolen their award points.</p>
<p>Many airlines that offer awards programs also still allow customers to log in with nothing more than a member number and a PIN, including <strong>Qantas</strong> and <strong>United</strong>.</p>


feed_id: http://krebsonsecurity.com/?p=30264
title: Kreditech Investigates Insider Breach
uri: Kreditech-Investigates-Insider-Breach
url: http://krebsonsecurity.com/2015/03/kreditech-investigates-insider-breach/
content:
<p><strong>Kreditech</strong>, a consumer finance startup that specializes in lending to &#8220;unbanked&#8221; consumers with little or no credit rating, is investigating a data breach that came to light after malicious hackers posted thousands of applicants&#8217; personal and financial records online.</p>
<div id="attachment_30440" style="width: 295px" class="wp-caption alignright"><a class="lightbox" href="media/4dfc4825.kreditechhp.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/03/kreditechhp.png"><img class="size-medium wp-image-30440" src="media/04a98ae0.kreditechhp-285x235.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/03/kreditechhp-285x235.png" alt="A screen shot of the Tor site that links to the documents stolen from Kreditech." width="285" height="235" /></a><p class="wp-caption-text">A screen shot of the Tor site that links to the documents stolen from Kreditech.</p></div>
<p>Earlier this month, a source pointed KrebsOnSecurity to a Web site reachable only via <a title="http://en.wikipedia.org/wiki/Tor_(anonymity_network)" href="http://en.wikipedia.org/wiki/Tor_(anonymity_network)" target="_blank">Tor</a>, a software package that directs Internet traffic through a free, global network of relays. That page, pictured in screen shot to the right, included links to countless documents, scanned passports, drivers licenses, national IDs and credit agreements apparently taken from Kreditech&#8217;s servers.</p>
<p>The site announced that a group of hackers calling itself &#8220;A4&#8243; put the information online after finding &#8220;hundreds of gigabytes&#8221; of Kreditech&#8217;s documents, including what appear to be configuration files from the company&#8217;s Intranet and internal servers.</p>
<p>&#8220;The company, getting multimillion investments, probably decided to spend them for anything but security of their clients&#8217; data,&#8221; the hacker group wrote. &#8220;As explain by a member of A4, not that the company&#8217;s security is at a low level, it is absent as such.All data to which the group А4 got access will be put online in open access although its curb price is rather considerable.&#8221;</p>
<p><strong>Anna Friedrich</strong>, head of communications at the Hamburg, Germany-based lender, acknowledged that the company had an &#8220;isolated internal security incident&#8221; in November 2014, and that Hamburg police are investigating.</p>
<p>Friedrich said Kreditech believes the data was stolen not from customers but only from credit applicants. She added that Kreditech believes the information was leaked from within by someone who worked at the company &#8212; although she declined to say whether the suspect was a current or former employee.</p>
<p>&#8220;There is no access to any customer data,&#8221; Friedrich said. &#8220;This incident stemmed from a form on our Web site that was stored data in a caching system that deleted data every few days. What happened was that a subset of application data was affected. We are collaborating with the police, but unfortunately there is no more further information that I have to share. &#8221;</p>
<p><a title="http://www.twitter.com/flanvel" href="http://www.twitter.com/flanvel" target="_blank">Corey Wells</a>, the 19-year-old security researcher from West Virginia who alerted this author to the compromise, said he discovered the breach after building a crawler to identify and index Web sites on the Tor network.</p>
<p>The hacker group didn&#8217;t say how it obtained the documents. Wells said the leaked data includes raw logs from a system that appears to have been running <a title="http://en.wikipedia.org/wiki/MongoDB" href="http://en.wikipedia.org/wiki/MongoDB" target="_blank">MongoDB</a>, a cross-platform <a title="Document-oriented database" href="http://en.wikipedia.org/wiki/Document-oriented_database">document-oriented database</a>. Those logs include a date and time stamp of Aug. 19. 2014, suggesting the breach may have started seven months ago.<span id="more-30264"></span></p>
<p>Wells said he doesn&#8217;t buy Kreditech&#8217;s version of events, and that files leaked from the company and posted for download from the Tor Web site suggest at least some were from existing customers.</p>
<p>&#8220;There are bank sums, amounts that are in the transaction and the amount left in the accounts,&#8221; Wells said. &#8220;Some of these look like people who already have accounts with them.&#8221;</p>
<p>Unlike traditional lenders, which rely heavily the applicant&#8217;s payment and credit history, Kreditech is one of several lenders tapping into social networking data to determine the risk of lending to people who have a tough time getting credit. Kreditech says it <a title="http://www.kreditech.com/blog/ceo-redefined-scoring-logics-from-5-to-15000-data-points/" href="http://www.kreditech.com/blog/ceo-redefined-scoring-logics-from-5-to-15000-data-points/" target="_blank">uses up to 15,000 data points</a> when assessing an application for a loan.</p>
<p>The company recently secured some credit of its own, receiving <span class="s1">a $200 million credit line from</span> <strong>Victory Park Capital</strong>. According to <a title="http://techcrunch.com/2015/01/22/kreditech-gets-200m-credit-line-to-fuel-its-big-data-based-consumer-lending-business/" href="http://techcrunch.com/2015/01/22/kreditech-gets-200m-credit-line-to-fuel-its-big-data-based-consumer-lending-business/" target="_blank">a January 2015 story at TechCrunch</a>, that deal was one of the largest in the history of online lending services.</p>
<p>While Victory Park Capital is a private investment firm based in Chicago, Kreditech doesn&#8217;t appear to operate in the United States, nor in Germany where it is based. According to a cursory overview of the documents leaked online, the bulk of Kreditech&#8217;s customers/applicants are from Brazil, the Czech Republic, Dominican Republic, Mexico, Poland, Russia, Spain and Romania.</p>
<p><strong>Update, Mar. 28, 9:40 a.m.: </strong>Kreditech&#8217;s lawyers sent me <a title="http://krebsonsecurity.com/wp-content/uploads/2015/03/2015.03.27-Letter-to-B.-Krebs.pdf" href="media/ac67ed49.2015.03.27-Letter-to-B.-Krebs.pdf" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/03/2015.03.27-Letter-to-B.-Krebs.pdf" target="_blank">a letter</a> (PDF) demanding an immediate correction on several aspects of the story. Mostly, the letter disagrees with statements made not by this author but by others quoted in the story. The company does dispute that any data from applicants in the Dominican Republic could have been compromised because the company did not start operations there until after the breach occurred. Kreditech also said it has not launched operations yet in Brazil or Romania.</p>


feed_id: http://krebsonsecurity.com/?p=30338
title: Tax Fraud Advice, Straight from the Scammers
uri: Tax-Fraud-Advice-Straight-from-the-Scammers
url: http://krebsonsecurity.com/2015/03/tax-fraud-advice-straight-from-the-scammers/
content:
<p>Some of the most frank and useful information about how to fight fraud comes directly from the mouths of the crooks themselves. Online cybercrime forums play a critical role here, allowing thieves to compare notes about how to evade new security roadblocks and steer clear of fraud tripwires. And few topics so reliably generate discussion on crime forums around this time of year as tax return fraud, as we&#8217;ll see in the conversations highlighted in this post.</p>
<div id="attachment_25751" style="width: 268px" class="wp-caption alignright"><a href="media/7f282dfb.taxfraud.jpg" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/04/taxfraud.jpg"><img class=" wp-image-25751" src="media/964c2000.taxfraud-285x285.jpg" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/04/taxfraud-285x285.jpg" alt="File 'em Before the Bad Guys Can" width="258" height="258" /></a><p class="wp-caption-text">File &#8216;em Before the Bad Guys Can</p></div>
<p>As several stories these past few months have noted, those involved in tax refund fraud <a title="http://krebsonsecurity.com/2015/02/citing-tax-fraud-spike-turbotax-suspends-state-e-filings/" href="http://krebsonsecurity.com/2015/02/citing-tax-fraud-spike-turbotax-suspends-state-e-filings/" target="_blank">shifted more of their activities away from the Internal Revenue Service and toward state tax filings</a>. This shift is broadly reflected in discussions on several fraud forums from 2014, in which members lament the apparent introduction of new fraud &#8220;filters&#8221; by the IRS that reportedly made perpetrating this crime at the federal level more challenging for some scammers.</p>
<p>One outspoken and unrepentant tax fraudster &#8212; a ne&#8217;er-do-well using the screen name &#8220;<strong>Peleus</strong>&#8221; &#8212; reported that he had far more luck filing phony returns at the state level last year. Peleus posted the following experience to a popular fraud forum in February 2014:</p>
<blockquote><p>&#8220;Just wanted to share a bit of my results to see if everyone is doing so bad or it just me&#8230;Federal this year has been a pain in the ass. I have about 35 applications made for federal with only 2 paid refunds&#8230;I started early in January (15-20) on TT [TurboTax] and HR [H&amp;R Block] and made about 35 applications on Federal and State..My stats are as follows:</p>
<p>Federal: 35 applications (less than 10% approval rate) &#8211; average per return $2500</p>
<p>State: 35 apps &#8211; 15 approved (average per return $1600). State works just as great as last year, their approval rate is nearly 50% and processing time no more than 10 &#8211; 12 days.</p>
<p>I know that the IRS has new check filters this year but federals suck big time this year, i only got 2 refunds approved from 35 applications &#8230;all my federals are between $2300 &#8211; $2600 which is the average refund amount in the US so i wouldn&#8217;t raise any flags&#8230;I also put a small yearly salary like 25-30k&#8230;.All this precautions and my results still suck big time compared to last year when i had like 30%- 35% approval rate &#8230;what the fuck changed this year? Do they check the EIN from last year&#8217;s return so you need his real employer information?&#8221;</p></blockquote>
<div id="attachment_30482" style="width: 610px" class="wp-caption aligncenter"><a class="lightbox" href="media/0cfb79f4.peleus1.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/03/peleus1.png"><img class="size-large wp-image-30482" src="media/a5b3826a.peleus1-600x131.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/03/peleus1-600x131.png" alt="A seasoned tax return fraudster discusses strategy." width="600" height="131" /></a><p class="wp-caption-text">A seasoned tax return fraudster discusses strategy.</p></div>
<p>Several seasoned members of this fraud forum responded that the IRS had indeed become more strict in validating whether the W2 information supplied by the filer had the proper <a title="http://www.irs.gov/Businesses/Small-Businesses-&amp;-Self-Employed/Employer-ID-Numbers-EINs" href="http://www.irs.gov/Businesses/Small-Businesses-&amp;-Self-Employed/Employer-ID-Numbers-EINs" target="_blank">Employer Identification Number</a> (EIN), a unique tax ID number assigned to each company. The fraudsters then proceeded to discuss various ways to mine social networking sites like LinkedIn for victims&#8217; employer information.</p>
<p><span style="text-decoration: underline;">GET YER EINs HERE</span></p>
<p>A sidebar is probably in order here. EINs are not exactly state secrets. Public companies publish their EINs on the first page of their annual <a title="http://en.wikipedia.org/wiki/Form_10-K" href="http://en.wikipedia.org/wiki/Form_10-K" target="_blank">10-K filings</a> with the Securities and Exchange Commission. Still, EINs for millions of small companies here in the United States are not so easy to find, and many small business owners probably treat this information as confidential.</p>
<p>Nevertheless, a number of organizations specialize in selling access to EINs. One of the biggest is <strong>Dun &amp; Bradstreet</strong>, which, as I detailed in a 2013 exposé, <a title="http://krebsonsecurity.com/2013/09/data-broker-giants-hacked-by-id-theft-service/" href="http://krebsonsecurity.com/2013/09/data-broker-giants-hacked-by-id-theft-service/" target="_blank">Data Broker Giants Hacked by ID Theft Service</a>, was compromised for six months by a service selling Social Security numbers and other data to identity thieves like Peleus.</p>
<p>Last year, I heard from a source close to the investigation into the Dun &amp; Bradstreet breach who said the <em>thieves responsible made off with more than six million EINs</em>. In December 2014, I asked Dun &amp;Bradstreet about the veracity of this claim, and received a blanket statement that did not address the six million figure, but stressed that EINs are not personally identifiable information and are available to the public.<span id="more-30338"></span></p>
<p><span style="text-decoration: underline;">THE PREPAID MESS</span></p>
<p>By May of 2014, Peleus reported that he&#8217;d more or less worked out the best ways to avoid the IRS&#8217;s fraud filters, and was finding great success at the state level. The key, he said, was having the bogus refund sent to a unique prepaid debit card account for each filing. In this case, he found success with <strong>Green Dot</strong> &#8212; a widely-used prepaid card.</p>
<p>&#8220;The season is over, and my stats improved A LOT once I used one Greendot for one refund, instead of 1 checking account for 10 refunds,&#8221; he wrote.</p>
<p>The prepaid card industry has been an indispensable tool of tax fraudsters for several years, and remains one of the favorite means of cashing out phony refunds &#8212; as well as the proceeds from a broad range of other cybercrime activity.</p>
<p>At <a title="http://www.finance.senate.gov/hearings/hearing/?id=06a4fff7-5056-a032-5288-4d577f5e99b4" href="http://www.finance.senate.gov/hearings/hearing/?id=06a4fff7-5056-a032-5288-4d577f5e99b4" target="_blank">a March 12, 2015 hearing</a> on the tax refund fraud epidemic, <strong>Utah State Tax Commission Chairman John Valentine</strong> told the <strong>U.S. Senate Finance Committee</strong> that all of the suspicious returns it has seen so far this year had the direct deposit information changed from the previous year&#8217;s bank account to prepaid debit cards &#8212; often Green Dot brand debit cards.</p>
<p>&#8220;<span class="pullquote pqleft">Once the funds are transferred to such cards, they cannot easily be traced or recovered, a perfect vehicle to commit fraud</span>,&#8221; Valentine told the panel. &#8220;Prepaid debit cards appear to be preferable to fraudsters because the identity thief doesn&#8217;t have to bother with banks, credit unions or check-cashing stores that may become suspicious when one person starts bringing in multiple tax refund checks to be cashed or deposited.&#8221;</p>
<p>Valentine said one problem his state ran into when trying to isolate filings involving prepaid cards was that there is currently no uniformity in numbering that distinguishes traditional checking and savings accounts from prepaid debit cards.</p>
<p>&#8220;For example, a prepaid reloadable debit card sold by Green Dot appears to be linked to a bank account even though the debit card had no actual checking or savings account associated with it,&#8221; he said in his <a title="http://www.finance.senate.gov/imo/media/doc/John%20Valentine%20Testimony.pdf" href="media/9198c6e7.John20Valentine20Testimony.pdf" data-original-source="http://www.finance.senate.gov/imo/media/doc/John%20Valentine%20Testimony.pdf" target="_blank">prepared remarks</a> (PDF). &#8220;A simple fix would be to require a different series, letter or additional numbers to distinguish these cards from cards connected to bank or credit union checking and savings accounts.&#8221;</p>
<p><span style="text-decoration: underline;">SAFE MONEY &amp; FREQUENT FILERS</span></p>
<p>Judging from his fraud forum postings, our tax scammer Peleus was having more luck filing bogus refund requests with both the IRS and the states in this year&#8217;s tax season, which appears to have started in mid- to late January for phony filers.</p>
<p>Peleus&#8217; 2015 tax tips for fellow fraudsters center around which payment instruments and banks to use and which to avoid like the plague. Peleus said prepaids are great, but getting your phony refunds deposited in a <strong>Suntrust</strong> account remains the safest option, while certain banks &#8212; particularly <strong>Wells Fargo</strong> &#8212; are to be avoided like the plague.</p>
<p>&#8220;Wells Fargo is old news and sucks big time,&#8221; Peleus wrote in a January 14, 2015 post. &#8220;It is one of the strictest banks and I do not recommend it. <span class="pullquote pqright">Try and get Suntrust. If Suntrust works like last year, you should have 5-7 refunds per account easy. They don&#8217;t seem to give a fuck.&#8221;</span></p>
<p>Peleus and other fraudsters continue to report strong success filing phony tax refund requests through <strong>TurboTax</strong>, the largest of the online tax preparation services &#8212; with nearly 30 million customers. Peleus urges like-minded crooks to consider asking TurboTax to credit the fraudulent refund amount as an Amazon gift code, which is apparently all the rage this year:</p>
<p>&#8220;You don&#8217;t even need your own bank accounts, you can use company checking accounts from Google or checking accounts from your older spam,&#8221; Peleus enthuses. &#8220;Basically, you need just an email to receive the Amazon code. Sure, it&#8217;s hard to sell it on eBay or Craigslist, but it works and they never get blocked, so it&#8217;s safe money.&#8221;</p>
<p>[In case you missed my recent series on how lax security and adherence to &#8220;know-your-customer&#8221; basics at TurboTax has contributed to the tax fraud epidemic, check out <a title="http://krebsonsecurity.com/?s=turbotax&amp;x=0&amp;y=0" href="http://krebsonsecurity.com/?s=turbotax&amp;x=0&amp;y=0" target="_blank">these stories</a>.]</p>
<p>While the states and the IRS are becoming more vigilant about filtering out phony refund requests, the fraudsters are clearly responding by upping the volume of bogus filings. At least, that&#8217;s according to our virtual Virgil of the tax underworld:</p>
<p>&#8220;People, the secret still stays in numbers, so file as many applications as you can,&#8221; Peleus advises his fraudster friends. &#8220;No matter how accurate your tax info is, if you fly under the radar with small refunds (e.g. the average US refund was $2400 last year) you will be making money. Stop asking for $9k per refund you should make 3 of 3k, more refunds is better. Next year it will be harder I am sure, but we will all be smarter and fewer.&#8221;</p>
<p><span style="text-decoration: underline;">ANALYSIS</span></p>
<p>Given the amount of cyber fraud that is committed with the help of the anonymity afforded to prepaid card users,  the Utah State Tax Commissioner&#8217;s suggestion about requiring a unique identifier for prepaid card account numbers seems like a sound one. Certainly, the prepaid card and tax preparation industries can up their game. As I&#8217;ve noted in previous stories, both industries probably need more encouragement from federal lawmakers and/or regulators to proactively institute more robust and effective &#8220;know-your-customer&#8221; policies.</p>
<p>Even so, tax refund fraud is a complex problem, with many core weaknesses contributing to the overall epidemic. Not least of which is that the IRS is required to process refund requests within a very short period of receiving the filing. Very often, the IRS has to make this decision even before companies finish sending out W2 information.</p>
<p>In <a title="http://www.gao.gov/products/GAO-14-633" href="http://www.gao.gov/products/GAO-14-633" target="_blank" rel="noreferrer">an August 2014 report to Congress</a> on the tax refund fraud epidemic, the <strong>Government Accountability Office</strong> said that for 2014, the IRS informed taxpayers that it would generally issue refunds in <em>less than 21 days after receiving a tax return</em> — primarily because the IRS is required by law to pay interest if it takes longer than 45 days after the due date of the return to issue a refund.</p>
<p>According to a January 2015 GAO <a title="http://www.gao.gov/assets/670/667965.pdf" href="media/8a0a3798.667965.pdf" data-original-source="http://www.gao.gov/assets/670/667965.pdf" target="_blank" rel="noreferrer">report</a> (PDF), the IRS estimated it prevented $24.2 billion in fraudulent identity theft refunds in 2013.  Unfortunately, the IRS also paid $5.8 billion that year for refund requests later determined to be fraud. The GAO noted that because of the difficulties in knowing the amount of undetected fraud, the actual amount could far exceed those estimates.</p>
<p>Further reading:</p>
<p><a title="http://krebsonsecurity.com/what-tax-fraud-victims-can-do/" href="http://krebsonsecurity.com/what-tax-fraud-victims-can-do/" target="_blank">What Tax Fraud Victims Can Do</a>.</p>
<p><a title="http://krebsonsecurity.com/?s=tax+return+fraud&amp;x=0&amp;y=0" href="http://krebsonsecurity.com/?s=tax+return+fraud&amp;x=0&amp;y=0" target="_blank">All KrebsOnSecurity stories about tax refund fraud</a>.</p>
<p><strong>Update, Mar. 26, 4:56 p.m. ET:</strong> A previous version of this story incorrectly stated that Green Dot was managed by GE Money Bank. The latter sold part of its pre-praid business (Wal-Mart Money Card) to Green Dot back in 2013.</p>


feed_id: http://krebsonsecurity.com/?p=30431
title: Who Is the Antidetect Author?
uri: Who-Is-the-Antidetect-Author
url: http://krebsonsecurity.com/2015/03/who-is-the-antidetect-author/
content:
<p>Earlier this month I <a title="http://krebsonsecurity.com/2015/03/antidetect-helps-thieves-hide-digital-fingerprints/" href="http://krebsonsecurity.com/2015/03/antidetect-helps-thieves-hide-digital-fingerprints/" target="_blank">wrote about Antidetect</a>, a commercial tool designed to help thieves evade fraud detection schemes employed by many e-commerce companies. That piece walked readers through <a title="https://youtu.be/ZQN7CyCXh90" href="https://youtu.be/ZQN7CyCXh90" target="_blank">a sales video</a> for Antidetect showing the software being used to buy products online with stolen credit cards. Today, we&#8217;ll take a closer look at clues to a possible real-life identity of this tool&#8217;s creator.</p>
<p>The author of Antidetect uses the nickname &#8220;Byte Catcher,&#8221; and advertises on several crime forums that he can be reached at the ICQ address 737084, and at the jabber instant messaging handles &#8220;byte.catcher@xmpp.ru&#8221; and &#8220;byte.catcher@0nl1ne.at&#8221;. His software is for sale at <strong>antidetect[dot]net</strong> and <strong>antidetect[dot]org</strong>.</p>
<div id="attachment_30354" style="width: 610px" class="wp-caption aligncenter"><a class="lightbox" href="media/ba024022.browserantidetect.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/03/browserantidetect.png"><img class="size-large wp-image-30354" src="media/96fa290d.browserantidetect-600x258.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/03/browserantidetect-600x258.png" alt="Antidetect is marketed to fraudsters involved in ripping off online stores." width="600" height="258" /></a><p class="wp-caption-text">Antidetect is marketed to fraudsters involved in ripping off online stores.</p></div>
<p>Searching on that ICQ number turns up <a title="http://forum.sources.ru/index.php?showtopic=160140" href="http://forum.sources.ru/index.php?showtopic=160140" target="_blank">a post on a Russian forum from 2006</a>, wherein a fifth-year computer science student posting under the name &#8220;pavelvladimirovich&#8221; says he is looking for a job and that he can be reached at the following contact points:</p>
<p>ICQ: 737084</p>
<p>Skype name: pavelvladimirovich1</p>
<p>email: gpvx@yandex.ru</p>
<p>According to a reverse WHOIS lookup ordered from <a title="http://www.domaintools.com" href="http://www.domaintools.com" target="_blank">Domaintools.com</a>, that email address is the same one used to register the aforementioned antidetect[dot]org, as well as <strong>antifraud[dot]biz</strong> and hwidspoofer[dot]com (HWID is short for hardware identification, a common method that software makers use to ensure a given program license can only be used on one computer).</p>
<p>These were quite recent registrations (mid-2014), but that gpvx@yandex.ru email also was used to register domains in 2007, including <strong>allfreelance[dot]org</strong> and a domain called <strong>casinohackers[dot]com</strong>. Interestingly, one of the main uses that Byte Catcher advertises for his Antidetect software is to help beat fraud detection mechanisms used by online casinos. As we can see from <a title="https://web.archive.org/web/20120119155106/http://www.casinohackers.com/anti-detect-patch.html" href="https://web.archive.org/web/20120119155106/http://www.casinohackers.com/anti-detect-patch.html" target="_blank">this page at archive.org</a>, a subsection of casinohackers.com was at one time dedicated to advertising <strong>Antidetect Patch</strong> &#8212; a version that comes with its own virtual machine.</p>
<p>That ICQ number is tied to a user named &#8220;collisionsoftware&#8221; at the Russian cybercrime forum <strong>antichat[dot]ru</strong>, in which the seller is advertising software that routes the user&#8217;s Internet connection through hacked PCs. He directs interested buyers to the web site <strong>cn[dot]viamk[dot]com</strong>, which is no longer online. But an archived version of that page at archive.org shows the same &#8220;collision&#8221; name and the words &#8220;freelance team.&#8221; The <a title="https://web.archive.org/web/20060712233815/http://cn.viamk.com/contacts.php" href="https://web.archive.org/web/20060712233815/http://cn.viamk.com/contacts.php" target="_blank">contact form</a> on this site also lists the above-referenced ICQ number and email gpvx@yandex.ru, and even includes <a title="https://web.archive.org/web/20060712233518/http://cn.viamk.com/resume.php" href="https://web.archive.org/web/20060712233518/http://cn.viamk.com/resume.php" target="_blank">a résumé</a> of the site&#8217;s owner.</p>
<p>Another domain connected to that antichat profile is <strong>cnsoft[dot]ru</strong>, the <a title="https://web.archive.org/web/20061102024831/http://www.cnsoft.ru/" href="https://web.archive.org/web/20061102024831/http://www.cnsoft.ru/" target="_blank">now defunct domain for Collision Software</a>, which bills itself as a firm that can be hired to write software. The homepage lists the same ICQ number (737084).</p>
<p>The <a title="http://www.icq.com/people/737084" href="http://www.icq.com/people/737084" target="_blank">ICQ.com profile page</a> for that number includes links to accounts on Russian fraud forums that are all named &#8220;Mysterious Killer.&#8221; In one of those accounts, on the fraud forum <strong>exploit[dot]in</strong>, Mysterious Killer lists the same Jabber and ICQ addresses, and offers a variety of services, including a tool to mass-check PayPal account credentials, as well as a full instructional course on click-fraud.</p>
<div id="attachment_30530" style="width: 610px" class="wp-caption aligncenter"><a class="lightbox" href="media/986f644e.ad-support.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/03/ad-support.png"><img class="size-large wp-image-30530" src="media/bd51c8e4.ad-support-600x456.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/03/ad-support-600x456.png" alt="Antidetect retails for between $399 and $999, and includes live support." width="600" height="456" /></a><p class="wp-caption-text">Antidetect retails for between $399 and $999, and includes (somewhat unreliable) live support.</p></div>
<p>Both antifraud[dot]biz and allfreelance[dot]org were originally registered by an individual in Kaliningrad, Russia named <strong>Pavel V. Golub</strong>. Note that this name matches the initials in the email address gpvx@yandex.ru. KrebsOnSecurity has yet to receive a response to inquiries sent to that email and to the above-referenced Skype profile. <strong>Update, 1:05 p.m.:</strong> Pavel replied to my email, denying that he produced the video selling his software. &#8220;My software was cracked few years ago and then it as spreaded, selled by other people,&#8221; he wrote. Meanwhile, someone has started deleting photos and other items linked in this story.</p>
<p><em>Original story:</em></p>
<p>A little searching turns up <a title="http://ok.ru/profile/365165602543" href="http://ok.ru/profile/365165602543" target="_blank">this profile</a> on Russian social networking giant <strong>Odnoklassniki.ru</strong> for one Pavel Golub, a 29-year-old male from Koenig, Russia. Written in Russian as &#8220;Кениг,&#8221; this is Russian slang for Kaliningrad and refers to the city&#8217;s previous German name.</p>
<p>One of Pavel&#8217;s five friends on Odnoklassniki is 27-year-old <a title="http://ok.ru/profile/356447129245" href="http://ok.ru/profile/356447129245" target="_blank">Vera Golub</a>, also of Kaliningrad. A search of &#8220;Vera Golub, Kaliningrad&#8221; on vkontakte.com &#8212; Russia&#8217;s version of Facebook &#8212; reveals <a title="http://vk.com/club14313381" href="http://vk.com/club14313381" target="_blank">a vk.com group</a> in Kaliningrad about artificial fingernails that has two contacts: Vera Ivanova (referred to as &#8220;master&#8221; in this group), and Pavel Vladimirovich (listed as &#8220;husband&#8221;).<span id="more-30431"></span></p>
<p>The Vkontakte <a title="http://vk.com/id12540751" href="http://vk.com/id12540751" target="_blank">profile linked to Pavel&#8217;s name</a> on that group has been deleted, but &#8220;Vera Ivanova&#8221; is the same face as Vera Golub from Pavel&#8217;s Odnoklassniki profile.</p>
<p>A profile of one of Vera&#8217;s friends &#8211; one <a title="http://vk.com/photos1776577" href="http://vk.com/photos1776577" target="_blank">Natalia Kulikova</a> &#8211; shows some photos of Pavel from 2009, where he&#8217;s tagged as &#8220;Pavel Vladimirovich&#8221; and with the l<a title="http://vk.com/id1254075" href="http://vk.com/id1254075" target="_blank">ink to Pavel&#8217;s deleted Vkontakte profile</a>.  Also, it shows his previous car, which appears to be a Mitsubishi Galant.</p>
<div id="attachment_30517" style="width: 610px" class="wp-caption aligncenter"><a class="lightbox" href="media/c2ddf841.pavel-natka.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/03/pavel-natka.png"><img class="size-large wp-image-30517" src="media/b5bf5ecd.pavel-natka-600x666.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/03/pavel-natka-600x666.png" alt="Pavel, posing with his Mitsubishi Galant" width="600" height="666" /></a><p class="wp-caption-text">Pavel, posing with his Mitsubishi Galant in 2008.</p></div>
<p>A search on the phone number &#8220;79527997034,&#8221; referenced in the WHOIS site registration records for Pavel&#8217;s domains &#8212; antifraud[dot]biz and hwidspoofer[dot]com &#8212; turns up <a title="http://www.akham.ru/i.aspx?phone=9527997034" href="http://www.akham.ru/i.aspx?phone=9527997034" target="_blank">a listing on a popular auto sales Web site</a> wherein the seller (from Kaliningrad) is offering a 2002 Mitsubishi Galant. That same seller sold a 2002 BMW last year.</p>
<p>On one level, it&#8217;s amusing that a guy who sells software to help Web criminals evade detection is so easily found on the Internet. Then again, as my <a title="http://krebsonsecurity.com/category/breadcrumbs/" href="http://krebsonsecurity.com/category/breadcrumbs/" target="_blank">Breadcrumbs series</a> demonstrates, many individuals involved in writing malware or selling fraud tools either do not care or don&#8217;t take too many precautions to hide their identities &#8212; probably because they face so little chance of getting into trouble over their activities as long as they remain in Russia.</p>
<p>The above photo of Pavel in his Mitsubishi isn&#8217;t such a clear one. Here are a couple more from Kulikova&#8217;s Vkontakte pictures.</p>
<div id="attachment_30515" style="width: 279px" class="wp-caption alignleft"><a class="lightbox" href="media/e499138a.pavel-vera.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/03/pavel-vera.png"><img class=" wp-image-30515" src="media/dbfa17ec.pavel-vera-285x368.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/03/pavel-vera-285x368.png" alt="Vera and Pavel Golub in April 2012." width="269" height="347" /></a><p class="wp-caption-text">Vera and Pavel Golub in April 2012.</p></div>
<div id="attachment_30516" style="width: 273px" class="wp-caption alignright"><a class="lightbox" href="media/c16b2596.pavelcamping.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/03/pavelcamping.png"><img class=" wp-image-30516" src="media/6727721e.pavelcamping-285x309.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/03/pavelcamping-285x309.png" alt="Pavel V. Golub, in 2009." width="263" height="285" /></a><p class="wp-caption-text">Pavel V. Golub, in 2009.</p></div>


feed_id: http://krebsonsecurity.com/?p=30547
title: Sign Up at irs.gov Before Crooks Do It For You
uri: Sign-Up-at-irs-gov-Before-Crooks-Do-It-For-You
url: http://krebsonsecurity.com/2015/03/sign-up-at-irs-gov-before-crooks-do-it-for-you/
content:
<p>If you&#8217;re an American and haven’t yet created an account at <strong>irs.gov</strong>, you may want to take care of that before tax fraudsters <a title="http://www.irs.gov/Individuals/Get-Transcript" href="http://www.irs.gov/Individuals/Get-Transcript" target="_blank">create an account</a> in your name and steal your personal and tax data in the process.</p>
<p><a href="media/d005bf3a.Screenshot-2015-03-29-14.22.55.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/03/Screenshot-2015-03-29-14.22.55.png"><img class="alignright size-full wp-image-30558" src="media/d005bf3a.Screenshot-2015-03-29-14.22.55.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/03/Screenshot-2015-03-29-14.22.55.png" alt="Screenshot 2015-03-29 14.22.55" width="171" height="158" /></a>Recently, KrebsOnSecurity heard from <strong>Michael Kasper</strong>, a 35-year-old reader who tried to obtain a copy of his most recent tax transcript with the <strong>Internal Revenue Service</strong> (IRS). Kasper said he sought the transcript after trying to file his taxes through the desktop version of <strong>TurboTax</strong>, and being informed by TurboTax that the IRS had rejected the request because his return had already been filed.</p>
<p>Kasper said he phoned the IRS’s identity theft hotline (<strong>800-908-4490</strong>) and was told a direct deposit was being made <em>that very same da</em>y for his tax refund — a request made with his Social Security number and address but to be deposited into a bank account that he didn’t recognize.</p>
<p>“Since I was alerting them that this transaction was fraudulent, their privacy rules prevented them from telling me any more information, such as the routing number and account number of that deposit,” Kasper said. “They basically admitted this was to protect the privacy of the criminal, not because they were going to investigate right away. In fact, they were very clear that the matter would not be investigated further until a fraud affidavit and accompanying documentation were processed by mail.”</p>
<p>In the following weeks, Kasper contacted the IRS, who told him they had no new information on his case. When he tried to get a transcript of the fraudulent return using the “Get Transcript” function on IRS.gov, <em><span class="pullquote pqleft">he learned that someone had already registered through the IRS&#8217;s site using his Social Security number and an unknown email address.</span></em></p>
<p>“When I called the IRS to fix this, and spent another hour on hold, they explained they could not tell me what the email address was due to privacy regulations,” Kasper recalled. “They also said they could not change the email address, all they could do was ban access to eServices for my account, which they did. It was something at least.”</p>
<p><span style="text-decoration: underline;">FORM 4506</span></p>
<p>Undeterred, Kasper researched further and discovered that he could still obtain a copy of the fraudulent return by filling out the <a title="http://www.irs.gov/pub/irs-pdf/f4506.pdf" href="media/4e1bff1c.f4506.pdf" data-original-source="http://www.irs.gov/pub/irs-pdf/f4506.pdf" target="_blank">IRS Form 4506</a> (PDF) and paying a $50 processing fee. Several days later, the IRS mailed Kasper a photocopy of the fraudulent return filed in his name — <em>complete with the bank routing and account number that received the $8,936 phony refund filed in his name</em>.</p>
<div>
<p>&#8220;That’s right, $50 just for the right to see my own return,&#8221; Kasper said. &#8220;And once again the right hand does not know what the left hand is doing, because it cost me just $50 to get them to ignore their own privacy rules. The most interesting thing about this strange rule is that the IRS also refuses to look at the account data itself until it is fully investigated. Banks are required by law to report suspicious refund deposits, but the IRS does not even bother to contact banks to let them know a refund deposit was reported fraudulent, at least in the case of individual taxpayers who call, confirm their identity and report it, just like I did.&#8221;</p>
<p>Kasper said the transcript indicates the fraudsters filed his refund request using the <a title="http://www.freefilefillableforms.com" href="http://www.freefilefillableforms.com" target="_blank">IRS web site&#8217;s own free e-file website</a> for those with incomes over $60,000. It also showed the routing number for <strong>First National Bank</strong> of Pennsylvania and the checking account number of the individual who got the deposit plus the date that they filed: January 31, 2015.</p>
<p>The transcript suggests that the fraudsters who claimed his refund had done so by copying all of the data from his previous year&#8217;s W2, and by increasing the previous year&#8217;s amounts slightly. <span class="pullquote pqright">Kasper said he can&#8217;t prove it, but <em>he believes the scammers obtained that W2 data directly from the IRS itself</em>, after creating an account at the IRS portal in his name (but using a different email address) and requesting his transcript.</span></p>
<p>&#8220;The person who submitted it somehow accessed my tax return from the previous year 2013 in order to list my employer and salary from that year, 2013, then use it on the 2014 return, instead,&#8221; Kasper said. &#8220;In addition, they also submitted a corrected W-2 that increased the withholding amount by exactly $6,000 to increase their total refund due to $8,936.&#8221;</p>
<p><span style="text-decoration: underline;">MONEY MULING</span></p>
<p>On Wednesday, March 18, 2015, Kasper contacted First National Bank of Pennsylvania whose routing number was listed in the phony tax refund request, and reached their head of account security. That person confirmed a direct deposit by the IRS for $8,936.00 was made on February 9, 2015 into an individual checking account specifying Kasper&#8217;s full name and SSN in the metadata with the deposit.</p>
<p>&#8220;She told me that she could also see transactions were made at one or more branches in the city of Williamsport, PA to disburse or withdraw those funds and that several purchases were made by debit card in the city of Williamsport as well, so that at this point a substantial portion of the funds were gone,&#8221; Kasper said. &#8220;She further told me that no one from the IRS had contacted her bank to raise any questions about this account, despite my fraud report filed February 9, 2015.&#8221;</p>
<p>The head of account security at the bank stated that she would be glad to cooperate with the Williamsport Police if they provided the required legal request to allow her to release the name, address, and account details. The bank officer offered Kasper her office phone number and cell phone to share with the cops. The First National employee also mentioned that the suspect lived in the city of Williamsport, PA, and that this individual seemed to still be using the account.</p>
<p>Kasper said the local police in his New York hometown hadn&#8217;t bothered to respond to his request for assistance, but that the lieutenant at the Williamsport police department who heard his story took pity on him and asked him to write an email about the incident to his captain, which Kasper said he sent later that morning.</p>
<p>Just two hours later, he received a call from an investigator who had been assigned to the case. The detective then interviewed the individual who held the account the same day and told Kasper that the bank’s fraud department was investigating and had asked the person to return the cash.</p>
<p>&#8220;My tax refund fraud case had gone from stuck in the mud to an open case, almost overnight,&#8221; Kasper sad. &#8220;Or at least it seemed to be that simple. It turned out to be much more complex.&#8221;</p>
<p>For starters, the woman who owned the bank account that received his phony refund &#8212; a student at a local Pennsylvania university &#8212; said she got the transfer after responding to a Craigslist ad for a moneymaking opportunity.</p>
<p>Kasper said the detective learned that money was deposited into her account, and that she sent the money out to locations in Nigeria via Western Union wire transfer, keeping some as a profit, and apparently never suspecting that she might be doing something illegal.</p>
<p>&#8220;She has so far provided a significant amount of information, and I’m inclined to believe her story,&#8221; Kasper said. &#8220;Who would be crazy enough to deposit a fraudulent tax refund in their own checking account, as opposed to an untraceable debit card they could get at a convenience store. At the same time, wouldn’t somebody who could pull this off also have an explanation like this ready?&#8221;</p>
<p>The woman in question, whose name is being withheld from this story, declined multiple requests to speak with KrebsOnSecurity, threatening to file harassment claims if I didn&#8217;t stop trying to contact her. Nevertheless, she appears to have been an unwitting &#8212; if not unwilling &#8212; money mule in a scam that seeks to recruit the unwary for moneymaking schemes. <span id="more-30547"></span></p>
<p><span style="text-decoration: underline;">ANALYSIS</span></p>
<p>The IRS&#8217;s process for verifying people requesting transcripts is vulnerable to exploitation by fraudsters because it relies on static identifiers and so-called &#8220;knowledge-based authentication&#8221; (KBA)  &#8212; i.e., challenge questions that can be easily defeated with information widely available for sale in the cybercrime underground and/or with a small amount of searching online.</p>
<p>To obtain a copy of your most recent tax transcript, the IRS requires the following information: The applicant&#8217;s name, date of birth, Social Security number and filing status. After that data is successfully supplied, the IRS uses a service from credit bureau <strong>Equifax</strong> that asks four KBA questions. Anyone who succeeds in supplying the correct answers can see the applicant&#8217;s full tax transcript, including prior W2s, current W2s and more or less everything one would need to fraudulently file for a tax refund.</p>
<p>The KBA questions &#8212; which involve multiple choice, &#8220;out of wallet&#8221; questions such as previous address, loan amounts and dates &#8212; can be successfully enumerated with random guessing. But in practice it is far easier, said <strong>Nicholas Weaver</strong>, a researcher at the <strong>International Computer Science Institute</strong> (ICSI) and at the <strong>University of California, Berkeley</strong>.</p>
<p>&#8220;I did it twice, and the first time it was related to my current address, one old address question, and one &#8216;which credit card did you get&#8217; question,&#8221; Weaver said. &#8220;The second time it was two questions related to my current address, and two related to a car loan I paid off in 2007.&#8221;</p>
<p>The second time round, Weaver said a few minutes on Zillow.com gave him all the answers he needed for the KBA questions. Spokeo solved the &#8220;old address&#8221; questions for him with 100% accuracy.</p>
<p>&#8220;Zillow with my address answered all four of them, if you just assume &#8216;moved when I bought the house&#8217;,&#8221; he said. &#8220;In fact, I NEEDED to use Zillow the second time around, because damned if I remember when my house was built.  So with Zillow and Spokeo data, it isn&#8217;t even 1 in 256, it&#8217;s 1 in 4 the first time around and 1 in 16 the second, and you don&#8217;t need to guess blind either with a bit more Google searching.&#8221;</p>
<p>If any readers here doubt how easy it is to buy personal data on just about anyone, check out <a title="http://krebsonsecurity.com/2014/12/toward-a-breach-canary-for-data-brokers/" href="http://krebsonsecurity.com/2014/12/toward-a-breach-canary-for-data-brokers/" target="_blank">the story I wrote in December 2014</a>, wherein I was able to find the name, address, Social Security number, previous address and phone number on all current members of the <strong>U.S. Senate Commerce Committee</strong>. This information is no longer secret (nor are the answers to KBA-based questions), and we are all made vulnerable to identity theft as long as institutions continue to rely on static information as authenticators. See <a title="http://krebsonsecurity.com/2015/03/apple-pay-bridging-online-and-big-box-fraud/" href="http://krebsonsecurity.com/2015/03/apple-pay-bridging-online-and-big-box-fraud/" target="_blank">my recent story on Apple Pay</a> for another reminder of this fact.</p>
<p>Unfortunately, the IRS is not the only government agency whose reliance on static identifiers actually makes them complicit in facilitating identity theft against Americans. The same process described to obtain a tax transcript at irs.gov works to obtain a free credit report from <strong>annualcreditreport.com</strong>, a Web site mandated by Congress. In addition, Americans who have not already created an account at the <strong>Social Security Administration</strong> under their Social Security number are vulnerable to crooks hijacking SSA benefits now or in the future. For more on how crooks are siphoning Social Security benefits via government sites, check out <a title="http://krebsonsecurity.com/2013/09/crooks-hijack-retirement-funds-via-ssa-portal/" href="http://krebsonsecurity.com/2013/09/crooks-hijack-retirement-funds-via-ssa-portal/" target="_blank">this story</a>.</p>
<p>Kasper said he&#8217;s grateful for the police report he was able to obtain from the the Pennsylvania authorities because it allows him to get a freeze on his credit file without paying the customary $5 fee in New York to place and thaw a freeze.</p>
<p>Credit freezes prevent would-be creditors from approving new lines of credit in your name &#8212; and indeed from even being able to view or &#8220;pull&#8221; your credit file &#8212; but a freeze will not necessarily block fraudsters from filing phony tax returns in your name.</p>
<p>Unless, of course, the scammers in question are counting on obtaining your tax transcripts through the IRS&#8217;s own Web site. According to the IRS, people with a credit freeze on their file must lift the freeze (with Equifax, at least) before the agency is able to continue with the KBA questions as part of its verification process.</p>
<p><strong>Update, 10:46 p.m., ET: </strong>The link included in the first paragraph of this story directing readers to create an account with the IRS is currently returning the message: &#8220;We are currently experiencing technical issues and unable to process new registrations.&#8221;</p>
</div>


feed_id: http://krebsonsecurity.com/?p=29711
title: ‘Revolution’ Crimeware & EMV Replay Attacks
uri: Revolution-Crimeware-EMV-Replay-Attacks
url: http://krebsonsecurity.com/2015/04/revolution-crimeware-emv-replay-attacks/
content:
<p>In October 2014, KrebsOnSecurity <a title="http://krebsonsecurity.com/2014/10/replay-attacks-spoof-chip-card-charges/" href="http://krebsonsecurity.com/2014/10/replay-attacks-spoof-chip-card-charges/" target="_blank">examined a novel &#8220;replay&#8221; attack</a> that sought to exploit implementation weaknesses at U.S. financial institutions that were in the process of transitioning to more secure chip-based credit and debit cards. Today&#8217;s post looks at one service offered in the cybercrime underground to help thieves perpetrate this type of fraud.</p>
<p>Several U.S. financial institutions last year reported receiving tens of thousands of dollars in fraudulent credit and debit card transactions coming from Brazil and hitting card accounts stolen in recent retail heists, principally cards compromised as part of the <a title="http://krebsonsecurity.com/?s=home+depot&amp;x=0&amp;y=0" href="http://krebsonsecurity.com/?s=home+depot&amp;x=0&amp;y=0" target="_blank">October 2014 breach at Home Depot</a>. The affected banks were puzzled by the attacks because the fraudulent transactions were all submitted through <strong>Visa</strong> and <strong>MasterCard</strong>‘s networks as chip-enabled transactions, even though the banks that issued the cards in question hadn&#8217;t yet begun sending customers chip-enabled cards.</p>
<div id="attachment_29893" style="width: 610px" class="wp-caption aligncenter"><a href="media/63845b28.revolutionsoftwrae.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/01/revolutionsoftwrae.png"><img class="size-large wp-image-29893" src="media/313c09dd.revolutionsoftwrae-600x275.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/01/revolutionsoftwrae-600x275.png" alt="Seller in underground forum describes his &quot;Revolution&quot; software to conduct  EMV card fraud against banks that haven't implemented EMV correctly ." width="600" height="275" /></a><p class="wp-caption-text">Seller in underground forum describes his &#8220;Revolution&#8221; software to conduct EMV card fraud against banks that haven&#8217;t implemented EMV fully.</p></div>
<p>Fraud experts said the most likely explanation for the activity was that crooks were pushing regular magnetic stripe transactions through the card network as chip card purchases using a technique known as a “replay” attack. According to one bank interviewed at the time, MasterCard officials explained that the thieves were likely in control of a payment terminal and had the ability to manipulate data fields for transactions put through that terminal. After capturing traffic from a real chip-based chip card transaction, the thieves could insert stolen card data into the transaction stream, while modifying the merchant and acquirer bank account data on-the-fly.</p>
<p>Recently, KrebsOnSecurity encountered a fraudster in a popular cybercrime forum selling a fairly sophisticated software-as-a-service package to do just that. The seller, a hacker who reportedly specializes in selling skimming products to help thieves steal card data from ATMs and point-of-sale devices, calls his product &#8220;Revolution&#8221; and offers to provide buyers with a list of U.S. financial institutions that have not fully or properly implemented systems for accepting and validating chip-card transactions.<span id="more-29711"></span></p>
<p>First, a bit of background on chip-based cards is in order. Chip cards are synonymous with a standard called EMV (short for <a title="http://en.wikipedia.org/wiki/EMV" href="http://en.wikipedia.org/wiki/EMV" target="_blank">Europay, MasterCard and Visa</a>), a global payment system that has already been adopted by every other G20 nation as a more secure alternative to cards that simply store account holder data on a card’s magnetic stripe. EMV cards contain a secure microchip that is designed to make the cards very difficult and expensive to counterfeit.</p>
<p>There are several checks that banks can use to validate the authenticity of chip card transactions. The chip stores encrypted data about the cardholder account, as well as a “cryptogram” that allows banks to tell whether a card or transaction has been modified in any way. The chip <em>also includes an internal &#8220;counter&#8221; mechanism that gets incremented with each sequential transaction</em>, so that a duplicate counter value or one that skips ahead may indicate data copying or other fraud to the bank that issued the card.</p>
<p>It appears that the Evolution software is designed to target banks that are in the process of architecting their payment networks to handle EMV transactions, but that nevertheless aren&#8217;t yet properly checking the EMV cryptogram and/or counter for these transactions. It also seems that some banks have inexplicably lowered their fraud controls on EMV transactions, even though they are not yet taking advantage of the added security protections offered by chip-based cards.</p>
<p>&#8220;The reason I think they bother to fake EMV transactions is that they know the EMV card issuing banks relax their fraud controls on them and don’t have it implemented properly and therefore they do not properly check the dynamic EMV data,&#8221; said <strong>Avivah Litan</strong>, a fraud analyst with <a title="http://blogs.gartner.com/avivah-litan/" href="http://blogs.gartner.com/avivah-litan/" target="_blank">Gartner Inc</a>.</p>
<p>That&#8217;s precisely what the fraudster selling Evolution points out in his somewhat awkwardly-worded sales thread for his product, which he said relies on <a title="http://en.wikipedia.org/wiki/Java_Card" href="http://en.wikipedia.org/wiki/Java_Card" target="_blank">Java card</a> software capable of writing to chip and mag-stripe based cards.  Java Card refers to a software technology that allows Java-based applications (applets) to be run securely on smart cards and similar small memory footprint devices. Java Card is the tiniest of Java platforms targeted for embedded devices, and was originally developed for the purpose of securing sensitive information stored on <a title="Smart card" href="http://en.wikipedia.org/wiki/Smart_card">smart cards</a>.</p>
<p>&#8220;The good news is that USA is shifting to EMV,” he writes. “ This software works with Java cards work with static EMV security not with dynamic. Static means the [counter] remains the same every transaction. The thing to add is that I will provide from a lot of banks that uses static some of them that has been tested on it after purchase. Imagine how many banks using STATIC!“</p>
<p>This same fraudster appears to be the operator of an online store called &#8220;Last Carding,&#8221; which sells stolen credit cards and includes a number of tutorials on how to conduct card fraud. The crook running this site says he&#8217;s online twice a day, but that he takes Sundays off. Interestingly, the clock on his Web store says he operates on Central America time (-06:00 GMT).</p>
<div id="attachment_30056" style="width: 610px" class="wp-caption aligncenter"><a href="media/e2ccd79e.lastcarding.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/02/lastcarding.png"><img class="size-large wp-image-30056" src="media/0a59100c.lastcarding-600x358.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/02/lastcarding-600x358.png" alt="The &quot;Last Carding&quot; store sells stolen cards, tutorials and software for perpetrating card fraud." width="600" height="358" /></a><p class="wp-caption-text">The &#8220;Last Carding&#8221; store sells stolen cards, tutorials and software for perpetrating card fraud.</p></div>


feed_id: http://krebsonsecurity.com/?p=30364
title: Hacking ATMs, Literally
uri: Hacking-ATMs-Literally
url: http://krebsonsecurity.com/2015/04/hacking-atms-literally/
content:
<p>Most of the ATM skimming attacks written about on this blog conclude with security personnel intervening before the thieves manage to recover their skimmers along with the stolen card data and PINs. However, an increasingly common form of ATM fraud &#8212; physical destruction &#8212; costs banks plenty, even when crooks walk away with nothing but bruised egos and sore limbs.</p>
<p>An ATM technician and KrebsOnSecurity reader shared photos of a recent attack in which three would-be robbers went to town on a wall-mounted cash machine with crowbars and hammers.</p>
<div id="attachment_30597" style="width: 480px" class="wp-caption aligncenter"><a class="lightbox" href="media/73b00302.outofservice.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/04/outofservice.png"><img class="size-full wp-image-30597" src="media/73b00302.outofservice.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/04/outofservice.png" alt="Thieves with crowbars did massive and costly damage to this ATM, but were thwarted in cracking the safe." width="470" height="548" /></a><p class="wp-caption-text">Thieves with crowbars did massive and costly damage to this ATM, but were thwarted in cracking the safe.</p></div>
<p>According to the technician, the burglars ruined a $13,000 cash acceptor, a $5,000 check scanner, a $900 monitor, and a $700 card reader, among many other pricey items. Hardly any part of the machine escaped damage.</p>
<div id="attachment_30598" style="width: 604px" class="wp-caption aligncenter"><a class="lightbox" href="media/262dca84.wherestheatm.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/04/wherestheatm.png"><img class="size-full wp-image-30598" src="media/262dca84.wherestheatm.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/04/wherestheatm.png" alt="This thief-ravaged ATM is totaled." width="594" height="596" /></a><p class="wp-caption-text">This thief-ravaged ATM is totaled.</p></div>
<p>The carnage from this incident looks like something out of a bad Transformers movie.</p>
<div id="attachment_30599" style="width: 590px" class="wp-caption aligncenter"><a class="lightbox" href="media/a0cb021a.transformatm.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/04/transformatm.png"><img class="size-medium wp-image-30599" src="media/3b2a7d6e.transformatm-580x473.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/04/transformatm-580x473.png" alt="Decepticons, attack!" width="580" height="473" /></a><p class="wp-caption-text">Decepticons, attack!</p></div>
<p><span id="more-30364"></span></p>
<p>For all their work, the closest that the crooks got to the money was chipping the safe hinge.</p>
<div id="attachment_30600" style="width: 531px" class="wp-caption aligncenter"><a class="lightbox" href="media/7ec62aee.safehinge.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/04/safehinge.png"><img class="size-full wp-image-30600" src="media/7ec62aee.safehinge.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/04/safehinge.png" alt="Turns out, ATM cash safes are pretty tough." width="521" height="574" /></a><p class="wp-caption-text">Turns out, ATM cash safes are pretty tough.</p></div>
<p>The thieves in this case clearly didn&#8217;t have the right tools for the job. The real pros come armed with thermal tools to cut into the thick metal parts, as described in a recent update from the <strong>European ATM Security Team</strong> (EAST). As shown in the images below, the crooks draped flame-retardant cloth around the ATM while they set to work cutting into the cash machine with a gas-powered torch.</p>
<div id="attachment_30477" style="width: 610px" class="wp-caption aligncenter"><a class="lightbox" href="media/026d2a3c.east-skim-cover.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/03/east-skim-cover.png"><img class="size-large wp-image-30477" src="media/ab683d8a.east-skim-cover-600x246.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/03/east-skim-cover-600x246.png" alt="Source: European ATM Security Team (EAST)" width="600" height="246" /></a><p class="wp-caption-text">Real pros bring the proper tools for the job.</p></div>
<p>In December 2014, I wrote about a spike in attacks on ATMs in Europe in which thieves <a title="http://krebsonsecurity.com/2014/12/more-on-wiretapping-atm-skimmers/" href="http://krebsonsecurity.com/2014/12/more-on-wiretapping-atm-skimmers/" target="_blank">attempt to blast open the cash machines with explosive gas</a>. Since then, <strong>Bloomberg Business</strong> has published &#8220;<a title="http://www.bloomberg.com/graphics/2015-atm-bombers/" href="http://www.bloomberg.com/graphics/2015-atm-bombers/" target="_blank">Boom</a>,&#8221; a detailed look at the growth of explosive gas attacks on ATMs since 2013.</p>


feed_id: http://krebsonsecurity.com/?p=30622
title: FBI Warns of Fake Govt Sites, ISIS Defacements
uri: FBI-Warns-of-Fake-Govt-Sites-ISIS-Defacements
url: http://krebsonsecurity.com/2015/04/fbi-warns-of-fake-govt-sites-isis-defacements/
content:
<p>The <strong>Federal Bureau of Investigation</strong> (FBI) is warning that individuals sympathetic to the <strong>Islamic State of Iraq and al-Shams</strong> (ISIS) are mass-defacing Websites using known vulnerabilities in <strong>WordPress</strong>. The FBI also issued an alert advising that criminals are hosting fraudulent government Web sites in a bid to collect personal and financial information from unwitting Web searchers.</p>
<p><a href="media/ed4af362.fbilogo.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/04/fbilogo.png"><img class="alignright  wp-image-30632" src="media/5d17518c.fbilogo-150x150.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/04/fbilogo-150x150.png" alt="fbilogo" width="239" height="239" /></a>According to the FBI, ISIS sympathizers are targeting WordPress Web sites and the communication platforms of news organizations, commercial entities, religious institutions, federal/state/local governments, foreign governments, and a variety of other domestic and international sites. The agency said the attackers are mainly exploiting known flaws in WordPress plug-ins for which security updates are already available.</p>
<p>The <a title="http://www.ic3.gov/media/2015/150407-1.aspx" href="http://www.ic3.gov/media/2015/150407-1.aspx" target="_blank">public service announcement</a> (PSA) coincides with a less public alert that the FBI released to its <a title="https://www.infragard.org/" href="https://www.infragard.org/" target="_blank">InfraGard</a> members, a partnership between the FBI and private industry partners. That alert noted that several extremist hacking groups indicated they would participate in an operation dubbed #OpIsrael, which will target Israeli and Jewish Web sites to coincide with Holocaust Remembrance Day (Apr .15-16).</p>
<p>&#8220;The FBI assesses members of at least two extremist hacking groups are currently recruiting participants for the second anniversary of the operation, which started on 7 April 2013, and coincides with Holocaust Remembrance Day,&#8221; the InfraGard alert notes. &#8220;These groups, typically located in the Middle East and North Africa, routinely conduct pro-extremist, anti-Israeli, and anti-Western cyber operations.&#8221;</p>
<p><a title="http://www.nbcnews.com/news/us-news/isis-hackers-almost-certainly-not-isis-hackers-n320296" href="http://www.nbcnews.com/news/us-news/isis-hackers-almost-certainly-not-isis-hackers-n320296" target="_blank">Experts say</a> there may be no actual relationship between these defacements and Islamist militants. In any case, if you run a Web site powered by WordPress &#8212; or any other content management system (CMS) &#8212; please take a few moments today to ensure that the CMS itself is up-to-date with the latest patches, and apply all available fixes for any installed plug-ins.<span id="more-30622"></span></p>
<p>The FBI also issued <a title="http://www.ic3.gov/media/2015/150407-2.aspx" href="http://www.ic3.gov/media/2015/150407-2.aspx" target="_blank">an unrelated PSA</a> advising people to be wary of fake government Web sites set up to take advantage of search engine optimization techniques that try to get the sites listed prominently in search results when searching for government services online. The FBI explains the scam thusly:</p>
<p>&#8220;Victims use a search engine to search for government services such as obtaining an Employer Identification Number (EIN) or replacement social security card. The fraudulent criminal websites are the first to appear in search results, prompting the victims to click on the fraudulent government services website. The victim completes the required fraudulently posted forms for the government service they need. The victim submits the form online, believing they are providing their PII to government agencies such as the Internal Revenue Service, Social Security Administration, or similar agency based on the service they need.&#8221;</p>
<p>&#8220;Once the forms are completed and submitted, the fraudulent website usually requires a fee to complete the service requested. The fees typically range from $29 to $199 based on the government service requested. Once the fees are paid the victim is notified they need to send their birth certificate, driver’s license, employee badge, or other personal items to a specified address. The victim is then told to wait a few days to several weeks for processing.&#8221;</p>
<p>&#8220;By the time the victim realizes it is a scam, they may have had extra charges billed to their credit/debit card, had a third-party designee added to their EIN card, and never received the service(s) or documents requested. Additionally, all of their PII data has been compromised by the criminals running the websites and can be used for any number of illicit purposes. The potential harm gets worse for those who send their birth certificate or other government-issued identification to the perpetrator.&#8221;</p>
<p>The FBI advises consumers to use search engines or other websites to research the advertised services or person/company you plan to deal with. Search the Internet for any negative feedback or reviews on the government services company, their Web site, their e-mail addresses, telephone numbers, or other searchable identifiers. Fly-by-night scam Web sites often have little or no reputation &#8212; i.e., they haven&#8217;t been online that long. A simple <a title="https://whois.domaintools.com/" href="https://whois.domaintools.com/" target="_blank">WHOIS Web site registration record search</a> will often reveal scam domains as just recently having been put online.</p>


feed_id: http://krebsonsecurity.com/?p=30636
title: Don’t Be Fodder for China’s ‘Great Cannon’
uri: Don-t-Be-Fodder-for-China-s-Great-Cannon
url: http://krebsonsecurity.com/2015/04/dont-be-fodder-for-chinas-great-cannon/
content:
<p class="p1">China has been actively diverting unencrypted Web traffic destined for its top online search service &#8212; <strong>Baidu.com</strong> &#8212; so that some visitors from outside of the country were unwittingly enlisted in a novel and unsettling series of denial-of-service attacks aimed at sidelining sites that distribute anti-censorship tools, according to research released this week.</p>
<p class="p1">The findings, published in a joint paper today by researchers with <a title="https://citizenlab.org/" href="https://citizenlab.org/" target="_blank">University of Toronto&#8217;s Citizen Lab</a>, the <a title="http://www.icsi.berkeley.edu/icsi/" href="http://www.icsi.berkeley.edu/icsi/" target="_blank" rel="noreferrer">International Computer Science Institute</a> (ICSI) and the <strong>University of California, Berkeley, </strong>track a remarkable development in China&#8217;s increasingly public display of its evolving cyber warfare prowess.</p>
<p class="p1">&#8220;Their willingness to be so public mystifies me,&#8221; said <strong>Nicholas Weaver</strong>, a researcher at the ICSI who helped dig through the clues about the mysterious attack. &#8220;But it does appear to be a very public statement about their capabilities.&#8221;</p>
<p class="p1"><a href="media/e0d75986.greatcannon.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/04/greatcannon.png"><img class="aligncenter size-medium wp-image-30649" src="media/a4eab858.greatcannon-580x412.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/04/greatcannon-580x412.png" alt="greatcannon" width="580" height="412" /></a></p>
<p class="p1">Earlier this month, <a title="https://github.com" href="https://github.com" target="_blank">Github</a> &#8212; an open-source code repository &#8212; and greatfire.org, which distributes software to help Chinese citizens evade censorship restrictions enacted by the so-called &#8220;Great Firewall of China,&#8221; found themselves on the receiving end of a massive and constantly-changing attack apparently designed to prevent people from being able to access the sites.</p>
<p class="p1">Experts have long known that China&#8217;s Great Firewall is capable of blocking Web surfers from within the country from accessing online sites that host content which is deemed prohibited by the Chinese government. But according to researchers, this latest censorship innovation targeted Web surfers from outside the country who were requesting various pages associated with Baidu, such that Internet traffic from a small percentage of surfers outside the country was quietly redirected toward Github and greatfire.org.</p>
<p class="p1">This attack method, which the researchers have dubbed the &#8220;Great Cannon,&#8221; works by intercepting non-Chinese traffic to Baidu Web properties, Weaver explained.</p>
<p class="p1">&#8220;It only intercepts traffic to a certain set of Internet addresses, and then only looks for specific script requests. About 98 percent of the time it sends the Web request straight on to Baidu, but about two percent of the time it says, &#8216;Okay, I&#8217;m going to drop the request going to Baidu,&#8217; and instead it directly provides the malicious reply, replying with a bit of Javascript which causes the user&#8217;s browser to participate in a DOS attack, Weaver said.<span id="more-30636"></span></p>
<p class="p1">The researchers said they tracked the attack for several days after Github apparently figured out how to filter the malicious traffic, which relied on malicious Javascript files that were served to visitors outside of China that were browsing various Baidu properties.</p>
<p class="p1">Chillingly, the report concludes that Chinese censors could just have easily served malicious code to exploit known Web browser vulnerabilities.</p>
<p class="p1">&#8220;With a minor tweak in the code, they could have provided exploits to targeted [Internet addresses], so that instead of intercepting all traffic to Baidu, they would serve malware attacks to those visitors,&#8221; Weaver said.</p>
<p class="p1">Interestingly, this type of attack is not unprecedented. According to documents leaked by National Security Agency whistleblower Edward Snowden, the NSA and British intelligence services used a system dubbed &#8220;QUANTUM&#8221; to <a title="https://www.schneier.com/blog/archives/2013/10/how_the_nsa_att.html" href="https://www.schneier.com/blog/archives/2013/10/how_the_nsa_att.html" target="_blank">inject content</a> and modify Web results for individual targets that appeared to be coming from a pre-selected range of Internet addresses.</p>
<p class="p1">&#8220;The Chinese government can credibly say the United States has done similar things in the past,&#8221; Weaver said. &#8220;They can’t say we’ve done large scale DDoS attacks, but the Chinese government can honestly state that the U.S. has modified traffic in-flight to attack and exploit systems.&#8221;</p>
<p class="p1">Weaver said the attacks from the Great Cannon don&#8217;t succeed when people are browsing Chinese sites with a Web address that begins with &#8220;https://&#8221;, meaning that regular Internet users can limit their exposure to these attacks by insisting that all Internet communications are routed over &#8220;https&#8221; versus unencrypted &#8220;http://&#8221; connections in their browsers. A number of third-party browser plug-ins &#8212; such as https-everywhere &#8212; can help people accomplish this goal.</p>
<p class="p1">&#8220;The lesson here is encrypt all the things all the time always,&#8221; Weaver said. &#8220;If you have to worry about a nation state adversary and if they can see an unencrypted web request that they can tie to your identity, they can use that as a vehicle for attack. This has always been the case, but it’s now practice.&#8221;</p>
<p class="p1">But <b>Bill Marczak,</b><b> </b>a research fellow with Citizen Lab, said relying on an always-on encryption strategy is not a foolproof counter to this attack, because plug-ins like https-everywhere will still serve regular unencrypted content when Web sites refuse to or don&#8217;t offer the same content over an encrypted connection. What&#8217;s more, many Web sites draw content from a variety of sources online, meaning that the Great Cannon attack could succeed merely by drawing on resources provided by online ad networks that serve ads on a variety of Web sites from a dizzying array of sources.</p>
<p class="p1">&#8220;Some of the scripts being injected in this attack are from online ad networks,&#8221; Marczak said. &#8220;But certainly this kind of attack suggests a far more aggressive use of https where available.&#8221;</p>
<p class="p1">For a deep dive into the research referenced in this story, check out <a title="https://citizenlab.org/2015/04/chinas-great-cannon/" href="https://citizenlab.org/2015/04/chinas-great-cannon/" target="_blank">this link</a>.</p>


feed_id: http://krebsonsecurity.com/?p=30657
title: White Lodging Confirms Second Breach
uri: White-Lodging-Confirms-Second-Breach
url: http://krebsonsecurity.com/2015/04/white-lodging-confirms-second-breach/
content:
<p>In February 2015, KrebsOnSecurity reported that for the second time in a year, multiple financial institutions were complaining of fraud on customer credit and debit cards that were all recently used at a string of hotel properties run by hotel franchise firm <strong>White Lodging Services Corporation. </strong>The company said at the time that it had no evidence of a new breach, but last week White Lodging finally acknowledged a &#8220;suspected&#8221; breach of point-of-sale systems at 10 locations.</p>
<p><a href="media/2bfc356a.whitelodging.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/01/whitelodging.png"><img class="alignright size-full wp-image-24638" src="media/2bfc356a.whitelodging.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/01/whitelodging.png" alt="whitelodging" width="239" height="82" /></a>Banking sources back in February 2015 told this author that the cards compromised in this most recent incident looked like they were stolen from many of the same White Lodging locations implicated in the 2014 breach, including hotels in Austin, Texas, Bedford Park, Ill., Denver, Indianapolis, and Louisville, Kentucky.  Those sources said the compromises appear once again to be tied to hacked cash registers at food and beverage establishments within the White Lodging run hotels. The sources said the fraudulent card charges that stemmed from the breach ranged from mid-September 2014 to January 2015.</p>
<p>In <a title="http://www.prnewswire.com/news-releases/white-lodging-releases-information-about-data-breach-investigation-at-select-food-and-beverage-outlets-300062065.html" href="http://www.prnewswire.com/news-releases/white-lodging-releases-information-about-data-breach-investigation-at-select-food-and-beverage-outlets-300062065.html" target="_blank">a press release</a> issued April 8, 2015, White Lodging announced the &#8220;suspected breach of <b>point of sales systems at food and beverage outlets,</b> such as restaurants and lounges, from the period <span class="xn-chron">July 3, 2014</span> through <span class="xn-chron">February 6, 2015</span> at 10 properties.</p>
<p>While it acknowledged some of the locations breached this time around <a title="https://web.archive.org/web/20140308062128/http://whitelodging.com/about/payment-card-issues" href="https://web.archive.org/web/20140308062128/http://whitelodging.com/about/payment-card-issues" target="_blank">were the same as last year&#8217;s victim locations</a>, the company emphasized that this was a separate breach.</p>
<p>“After suffering a malware incident in 2014, we took various actions to prevent a recurrence, including engaging a third party security firm to provide security technology and managed services,” wrote <strong><span class="xn-person">Dave Sibley</span></strong>, White Lodging president and CEO, Hospitality Management. “These security measures were unable to stop the current malware occurrence on point of sale systems at food and beverage outlets in 10 hotels that we manage.  We continue to remain committed to investing in the measures necessary to protect the personal information entrusted to us by our valuable guests.  We deeply regret and apologize for this situation.”</p>
<p>White Lodging said the stolen data includes names printed on customers&#8217; credit or debit cards, credit or debit card numbers, and the security code and card expiration dates. Naturally, White Lodging is offering a year&#8217;s worth of credit protection services for customers impacted by the breach, from <a title="http://krebsonsecurity.com/?s=experian&amp;x=0&amp;y=0" href="http://krebsonsecurity.com/?s=experian&amp;x=0&amp;y=0" target="_blank">Experian</a>.</p>


feed_id: http://krebsonsecurity.com/?p=30672
title: Critical Updates for Windows, Flash, Java
uri: Critical-Updates-for-Windows-Flash-Java
url: http://krebsonsecurity.com/2015/04/critical-updates-for-windows-flash-java/
content:
<p>Get your patch chops on people, because chances are you&#8217;re running software from <strong>Microsoft</strong>, <strong>Adobe</strong> or <strong>Oracle</strong> that received critical security updates today. Adobe released a <strong>Flash Player</strong> update to fix at least 22 flaws, including one flaw that is being actively exploited. Microsoft pushed out 11 update bundles to fix more than two dozen bugs in Windows and associated software, including one that was publicly disclosed this month. And Oracle has an update for its <strong>Java</strong> software that addresses at least 15 flaws, all of which are exploitable remotely without any authentication.</p>
<p><a href="media/06f26f56.brokenflash-a.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2013/02/brokenflash-a.png"><img class="alignright  wp-image-18875" src="media/06f26f56.brokenflash-a.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2013/02/brokenflash-a.png" alt="brokenflash-a" width="185" height="158" /></a>Adobe&#8217;s <a title="https://helpx.adobe.com/security/products/flash-player/apsb15-06.html" href="https://helpx.adobe.com/security/products/flash-player/apsb15-06.html" target="_blank">patch</a> includes a fix for a zero-day bug (CVE-2015-3043) that the company warns is already being exploited. Users of the Adobe Flash Player for Windows and Macintosh should update to Adobe Flash Player <em>17.0.0.169</em> (the current versions other OSes is listed in the chart below).</p>
<p>If you&#8217;re unsure whether your browser has Flash installed or what version it may be running, browse to <a title="https://www.adobe.com/software/flash/about/" href="https://www.adobe.com/software/flash/about/" target="_blank">this link</a>. Adobe Flash Player installed with <strong>Google Chrome</strong>, as well as <strong>Internet Explorer</strong> on <strong>Windows 8.x</strong>, should automatically update to version 17.0.0.169.</p>
<p>Google has <a title="http://googlechromereleases.blogspot.com/2015/04/stable-channel-update_14.html" href="http://googlechromereleases.blogspot.com/2015/04/stable-channel-update_14.html" target="_blank">an update</a> available for Chrome that fixes a slew of flaws, and I assume it includes this Flash update, although the Flash checker pages only report that I now have version 17.0.0 installed after applying the Chrome update and restarting (the Flash update <a title="http://krebsonsecurity.com/2015/03/adobe-flash-update-plugs-11-security-holes/" href="http://krebsonsecurity.com/2015/03/adobe-flash-update-plugs-11-security-holes/" target="_blank">released last month</a> put that version at 17.0.0.134, so this is not particularly helpful). To force the installation of an available update, click the triple bar icon to the right of the address bar, select &#8220;About Google&#8221; Chrome, click the apply update button and restart the browser.</p>
<p>The most recent versions of Flash should be available from the <a title="http://get.adobe.com/flashplayer/" href="http://get.adobe.com/flashplayer/" target="_blank">Flash home page</a>, but beware potentially unwanted add-ons, like <strong>McAfee Security Scan</strong>. To avoid this, uncheck the pre-checked box before downloading, or grab your OS-specific Flash download from <a title="https://www.adobe.com/products/flashplayer/distribution3.html" href="https://www.adobe.com/products/flashplayer/distribution3.html" target="_blank">here</a>. Windows users who browse the Web with anything other than Internet Explorer may need to apply this patch twice, once with IE and again using the alternative browser (<strong>Firefox</strong>, <strong>Opera</strong>, e.g.).</p>
<p><a href="media/d85cffb4.brokenwindows.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/07/brokenwindows.png"><img class="alignleft  wp-image-26837" src="media/d85cffb4.brokenwindows.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/07/brokenwindows.png" alt="brokenwindows" width="191" height="200" /></a>Microsoft has released 11 security bulletins this month, four of which are marked &#8220;critical,&#8221; meaning attackers or malware can exploit them to break into vulnerable systems with no help from users, save for perhaps visiting a booby-trapped or malicious Web site. The Microsoft patches fix flaws in Windows, Internet Explorer (IE), Office, and .NET</p>
<p>The critical updates apply to two Windows bugs, IE, and Office. .NET updates have a history of taking forever to apply and introducing issues when applied with other patches, so I&#8217;d suggest Windows users apply all other updates, restart and then install the .NET update (if available for your system).<span id="more-30672"></span></p>
<p>Oracle&#8217;s quarterly &#8220;critical patch update&#8221; plugs 15 security holes. If you have Java installed, please update it as soon as possible. Windows users can check for the program in the Add/Remove Programs listing in Windows, or visit Java.com and click the “Do I have Java?” link on the homepage. Updates also should be available via the <a title="http://www.java.com/en/download/help/javaconsole.xml" href="http://www.java.com/en/download/help/javaconsole.xml" target="_blank" rel="noreferrer">Java Control Panel</a> or from<a title="http://www.java.com" href="http://www.java.com/" target="_blank" rel="noreferrer">Java.com</a>.</p>
<p>If you really need and use Java for specific Web sites or applications, take a few minutes to update this software. In the past, updating via the control panel auto-selected the installation of third-party software, so be sure to look for any pre-checked “add-ons” before proceeding with an update through the Java control panel. Also, Java 7 users should note that Oracle has ended support for Java 7 after this update. The company has been quietly migrating Java 7 users to Java 8, but if this hasn&#8217;t happened for you yet and you really need Java installed in the browser, <a title="https://www.java.com/en/download/manual.jsp" href="https://www.java.com/en/download/manual.jsp" target="_blank">grab a copy of Java 8</a>. The recommended version is <em>Java 8 Update 45.</em></p>
<p><a href="media/f6d0854d.javamess.jpg" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2013/03/javamess.jpg"><img class="alignright size-medium wp-image-19243" src="media/5c15b877.javamess-285x226.jpg" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2013/03/javamess-285x226.jpg" alt="javamess" width="285" height="226" /></a>Otherwise, seriously consider removing Java altogether. I have long urged end users to junk Java unless they have a specific use for it (this advice does not scale for businesses, which often have legacy and custom applications that rely on Java). This widely installed and powerful program is riddled with security holes, and is a top target of malware writers and miscreants.</p>
<p>If you have an affirmative use or need for Java, there is a way to have this program installed while minimizing the chance that crooks will exploit unknown or unpatched flaws in the program: unplug it from the browser unless and until you’re at a site that requires it (or at least take advantage of <a title="http://krebsonsecurity.com/2013/03/help-keep-threats-at-bay-with-click-to-play/" href="http://krebsonsecurity.com/2013/03/help-keep-threats-at-bay-with-click-to-play/" target="_blank">click-to-play</a>, which can block Web sites from displaying both Java and Flash content by default). The latest versions of Java let users <a title="http://www.java.com/en/download/help/disable_browser.xml" href="http://www.java.com/en/download/help/disable_browser.xml" target="_blank" rel="noreferrer">disable Java content in web browsers</a> through the <a title="http://www.java.com/en/download/help/javaconsole.xml" href="http://www.java.com/en/download/help/javaconsole.xml" target="_blank" rel="noreferrer">Java Control Panel</a>. Alternatively, consider a dual-browser approach, unplugging Java from the browser you use for everyday surfing, and leaving it plugged in to a second browser that you only use for sites that require Java.</p>
<p>Many people confuse Java with <strong> JavaScript</strong>, a powerful scripting language that helps make sites interactive. Unfortunately, a huge percentage of Web-based attacks use JavaScript tricks to foist malicious software and exploits onto site visitors. For more about ways to manage JavaScript in the browser, check out my tutorial <a title="http://krebsonsecurity.com/tools-for-a-safer-pc/" href="http://krebsonsecurity.com/tools-for-a-safer-pc/" target="_blank">Tools for a Safer PC</a>.</p>


feed_id: http://krebsonsecurity.com/?p=30585
title: POS Providers Feel Brunt of PoSeidon Malware
uri: POS-Providers-Feel-Brunt-of-PoSeidon-Malware
url: http://krebsonsecurity.com/2015/04/pos-providers-feel-brunt-of-poseidon-malware/
content:
<p class="p1"><span class="s1">&#8220;PoSeidon,&#8221; a new strain of malicious software designed to steal credit and debit card data from hacked point-of-sale (POS) devices, has been implicated in a number of recent breaches involving companies that provide POS services primarily to restaurants, bars and hotels. The shift by the card thieves away from targeting major retailers like Target and Home Depot to attacking countless, smaller users of POS systems is giving financial institutions a run for their money as they struggle to figure out which merchants are responsible for card fraud.</span></p>
<div id="attachment_30669" style="width: 272px" class="wp-caption alignright"><a href="media/a61fd441.poseidon.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/04/poseidon.png"><img class=" wp-image-30669" src="media/5e9e9e04.poseidon-150x150.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/04/poseidon-150x150.png" alt="Image: Cisco." width="262" height="262" /></a><p class="wp-caption-text">Image: Cisco.</p></div>
<p class="p1"><span class="s1">One basic tool that banks use to learn the source of card data theft involves determining a &#8220;common point-of-purchase&#8221; (CPP) among a given set of customer cards that experience fraud. When a new batch of cards goes on sale at an online crime shop, banks will often purchase a very small number of their stolen cards to determine if the victim customers all shopped at the same merchant across a specific time period. </span></p>
<p class="p1"><span class="s1">This same CPP analysis was critical to banks helping this reporter identify some of the biggest retail breaches on record in recent years, and it is a method heavily relied upon by law enforcement agencies to identify breach victims.</span></p>
<p class="p1"><span class="s1">But the CPP approach usually falls flat if all of the cards purchased from the fraud shop fail to reveal a common merchant. More seasoned fraud shops have sought to achieve this confusion and confound investigators by &#8220;making sausage&#8221; &#8212; i.e., methodically mixing cards stolen from multiple victims into any single new batch of stolen cards that they offer for sale.</span></p>
<p class="p1"><span class="s1">Increasingly, however, fraudsters selling stolen cards don’t need to make sausage: The victims that are leaking card data are already subsets of restaurant franchises or retail establishments whose only commonality is the branded point-of-sale device which they rely upon to process customer card transactions. </span></p>
<p class="p1"><span style="text-decoration: underline;"><span class="s1">NEXTEP</span></span></p>
<p class="p1"><span class="s1">Card breaches involving POS devices sold by the same vendor are notoriously hard for financial institutions to diagnose because the banks very often have a direct relationship with neither the POS vendor nor the breached restaurant or bar whose customers’ cards were stolen. </span></p>
<p class="p1"><span class="s1"><a href="media/b68d82d7.nextep.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/03/nextep.png"><img class="alignleft size-full wp-image-30267" src="media/b68d82d7.nextep.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/03/nextep.png" alt="nextep" width="197" height="96" /></a>What’s more, POS-specific breaches frequently tie back to a subset of customers of a POS vendor who in turn rely on local IT company to install and support the POS systems. The commonality among breached restaurants and bars tends to be those who have relied on a support firm that invariably enables remote access to the POS systems via tools like pcAnywhere or LogMeIn using the same or easily-guessed username and password across many customer systems. Once remotely authenticated to the targeted systems, thieves can upload malware like POSeidon, which is capable of capturing all card data processed by the victim POS.</span></p>
<p class="p1"><span class="s1">A few weeks ago, this reporter <a title="http://krebsonsecurity.com/2015/03/point-of-sale-vendor-nextep-probes-breach/" href="http://krebsonsecurity.com/2015/03/point-of-sale-vendor-nextep-probes-breach/" target="_blank">broke the news</a> that multiple systems run by POS vendor <strong>NEXTEP</strong> had experienced a breach. The banks were only able to pinpoint NEXTEP systems as the source because the overwhelming number of merchants impacted in that breached happened to be NEXTEP customers who also were part of the <strong>Zoup</strong> chain of soup restaurants.</span></p>
<p>&#8220;You may have seen the discussions of the &#8216;PoSeidon&#8217; malware that specifically targeted point of sale systems,&#8221; NEXTEP CEO <strong>Tommy Woycik</strong> said in a follow-up email. &#8220;Within thirty-six hours of the point that we learned of the problem we were able to internally use our resources to block further data compromise with most of our customers.  We retained and worked with two different sets of consultants to fix all remaining problems and to evaluate, on an ongoing basis, the effectiveness of the fixes.&#8221;</p>
<p>Woycik said the company also is investigating why the vast majority of its customers had no compromise of information, but that the hack was limited to a few identified locations. Part of the problem was that some of the breached locations relied on point-of-sale management firms that refused to cooperate in the investigation.</p>
<p>&#8220;We have been somewhat hampered in our investigation because some parties involved in the locations that we believe may have been affected have been unwilling to provide us with critical data,&#8221; he said.</p>
<p><span id="more-30585"></span></p>
<p><span style="text-decoration: underline;">Bevo POS</span></p>
<p class="p1"><span class="s1">More recently, KrebsOnSecurity has heard from multiple banks about suspicions that systems sold and maintained by another POS vendor &#8211; Naples, Fla.- based <a title="http://www.bevopos.com/" href="http://www.bevopos.com/" target="_blank">Bevo POS</a> — was likely the source of fraud for more than a dozen restaurants and bars in and around Florida.</span></p>
<p class="p1"><span class="s1"><a href="media/33c6427e.bevo.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/04/bevo.png"><img class="alignright  wp-image-30682" src="media/33c6427e.bevo.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/04/bevo.png" alt="bevo" width="266" height="65" /></a>Reached for comment about these allegations, Bevo POS CEO <b>Onur Haytac</b> responded by acknowledging that a very small subset of its customers were indeed the victim of PoSeidon.</span></p>
<p class="p1"><span class="s1">“Was Bevo POS ever breached?<span class="Apple-converted-space">  </span>No, however, Windows was. Bevo POS is Point of Sale application (not cloud based) that is both PCI compliant and encrypts all credit card data,” he explained. “The malware identified, PoSeidon, which pushes itself with DLL injection and backdoor Trojans, is a keylogger with memory scraping that breached Windows, and as I’m sure you are aware, Microsoft’s security essentials anti-virus and windows updates do not recognize or stop many of the newer more unique threats. The same day we were alerted to a possible compromise, our engineers found an executable that had been recently installed in Windows at that location, called ‘Winhost.exe.’”</span></p>
<p class="p1"><span class="s1">According to Haytac, the company learned of the incidents on March 15. He said the breach occurred with memory scraping as the data passed through while Windows was sending the data to the Bevo application, basically capitalizing on a ‘millisecond gap’ between the systems.<span class="Apple-converted-space">   </span></span></p>
<p class="p1"><span class="s1">“A mere 0.26% of customers (13 out of 6,500) were effected and we not only identified the malware within 24 hours (5 days before it was publicly reported by the security experts), we had created a PoSeidon killer tool, and swept every customers machine within a week.<span class="Apple-converted-space">  </span>Actual Windows breaches of our customers only occurred over a two day period.”</span></p>
<p class="p1"><span class="s1">Haytac said the most frustrating aspect of the ordeal so far is that all of its customers have some form of Windows anti-virus software and that none of these applications were able to recognize the malware.<span class="Apple-converted-space"> </span></span></p>
<p class="p1"><span class="s1">&#8220;So to prevent future possibilities of this &#8216;gap&#8217; in the system being tapped again by relentless hackers, we have made an agreement with Comodo to create a new-age containment software that includes anti-virus,&#8221; he said.<span class="Apple-converted-space"> &#8220;</span>We are pushing this to all our customers, closing the gap between these breach techniques and Windows OS. We are due to ship this weekend as we are in final stages of testing. Windows is obviously not our product to protect, however our customers are, so we are doing it regardless and without cost to them.&#8221;</span></p>
<p class="p1"><span style="text-decoration: underline;">RESCATOR REVISITED</span></p>
<p class="p1">For several months following revelations that fraudsters had stolen 56 million cards from customers of Home Depot, the card shop principally responsible for selling those cards &#8212; Rescator[dot]cm (the same hackers thought to be responsible for the Target intrusion) &#8212; inexplicably stopped selling new cards stolen from main-street merchants and retailers.</p>
<p class="p1">This hiatus continued for an unprecedented six months until March 10, 2015, when Rescator and his merry band of thieves advertised the &#8220;American Dream&#8221; batch of credit cards. Days later, the Rescator shop pushed out millions of cards in rapid-fire batches variously named &#8220;Breakthrough,&#8221; &#8220;American Dream,&#8221; &#8220;Imperium Romanum&#8221; and &#8220;Spring Awakening.&#8221;</p>
<div id="attachment_30680" style="width: 590px" class="wp-caption aligncenter"><a href="media/e0d7d535.imperium.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/04/imperium.png"><img class="size-medium wp-image-30680" src="media/b4ea4e8b.imperium-580x389.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/04/imperium-580x389.png" alt="One of the many newer &quot;dumps&quot; batches added to the Rescator fraud shop in recent weeks." width="580" height="389" /></a><p class="wp-caption-text">One of the many newer &#8220;dumps&#8221; batches added to the Rescator fraud shop in recent weeks.</p></div>
<p class="p1">Multiple financial institutions contacted by this author purchased handfuls of their cards from these batches, but were unable to find a single common point-of-purchase among any of them. However, each bank said they saw within each batch a strong preponderance of small restaurants and bars that they&#8217;d been watching for months as a suspected source of stolen cards. The banks reported to KrebsOnSecurity that the bulk of these establishments are centered around cities in Colorado, Texas, Florida and the Washington, D.C. metropolitan area &#8212; including Virginia and Maryland.</p>
<p class="p1"><span style="text-decoration: underline;">BRIAN&#8217;S DUMP</span></p>
<p class="p1">The above-mentioned trend away from selling cards stolen from major retail chains toward attacking smaller bars and restaurants is hardly unique to the Rescator shop. Earlier this year, several security experts pointed out that a relative newcomer to the fraud scene &#8212; a card shop that markets its wares by capitalizing on the name and likeness of this author (briansdump[dot]ru) &#8212; also was pushing fairly large batches of stolen cards onto its shelves.</p>
<div id="attachment_30668" style="width: 590px" class="wp-caption aligncenter"><a href="media/b2ae4070.Screen-Shot-2015-04-14-at-12.23.29-AM.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/04/Screen-Shot-2015-04-14-at-12.23.29-AM.png"><img class="size-medium wp-image-30668" src="media/5cd3e322.Screen-Shot-2015-04-14-at-12.23.29-AM-580x72.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/04/Screen-Shot-2015-04-14-at-12.23.29-AM-580x72.png" alt="An advertisement for the carding shop &quot;briansdump[dot]ru&quot; promotes &quot;dumps from the  legendary Brian Krebs. Needless to say, this is not an endorsed site." width="580" height="72" /></a><p class="wp-caption-text">An advertisement for the carding shop &#8220;briansdump[dot]ru&#8221; promotes &#8220;dumps from the legendary Brian Krebs.&#8221; Needless to say, this is not an endorsed site.</p></div>
<p class="p1">KrebsOnSecurity worked with three different banks who each acquired multiple customer cards from all of the batches of cards that showed up for sale on Briansdump. Eerily enough, <strong>all of the merchants</strong> identified were from small restaurants and bars in and around the Washington, D.C. area, the hometown of Yours Truly.</p>
<p class="p1"><span style="text-decoration: underline;">OTHER SOLUTIONS</span></p>
<p class="p1">Security vendors have long recommended &#8220;end-to-end&#8221; or &#8220;point-to-point&#8221; encryption products and services to sidestep threats like PoSeidon. The idea being that if the card data never traverses the local network or point-of-sale device in an unencrypted format, any card-stealing malware that makes its way to the point-of-sale systems will have nothing to steal but worthless gibberish.</p>
<p>The problem is that many merchants &#8212; particularly smaller ones &#8212; don&#8217;t seem particularly interested in or incentivized to invest in these technologies, which tend to require more up-front costs and on-going maintenance fees to security vendors, said <strong>Rich Stuppy</strong>, chief operating officer at <strong>Kount</strong>, a payments security firm based in Boise, Idaho.</p>
<p>&#8220;It’s a fundamental redrawing of how the bits are transmitted, and that also tends to redraw a lot of power into another end of the network, either to a card brand or to a point of sale company, and it dramatically changes who’s got the power in this situation,&#8221; Stuppy said.</p>
<p>As for why more smaller merchants don&#8217;t turn to solutions like point-to-point and end-to-end encryption, Stuppy said it&#8217;s a numbers game that favors the attackers.</p>
<p>&#8220;I think the bigger [merchants] could maybe put up the fence around this such that it gets harder and harder, but the little guys aren’t going to do that. With these widely distributed point-of-sale systems, the bad guys are looking to just plug in the malware once, and it doesn’t matter if you have to get the big guys once to get 50 million cards, or you have to get 1,000 cards from 50,000 compromised merchants.&#8221;</p>
<p>For a deep dive into PoSeidon malware, check out <a title="http://blogs.cisco.com/security/talos/poseidon" href="http://blogs.cisco.com/security/talos/poseidon" target="_blank">this Mar. 25, 2015 blog post</a> from researchers at <strong>Cisco</strong>.</p>


feed_id: http://krebsonsecurity.com/?p=30685
title: Taking Down Fraud Sites is Whac-a-Mole
uri: Taking-Down-Fraud-Sites-is-Whac-a-Mole
url: http://krebsonsecurity.com/2015/04/taking-down-fraud-sites-is-whac-a-mole/
content:
<p>I&#8217;ve been doing quite a bit of public speaking lately &#8212; usually about cybercrime and underground activity &#8212; and there’s one question that nearly always comes from the audience: &#8220;Why are these fraud Web sites allowed to operate, and not simply taken down?&#8221; This post is intended to serve as the go-to spot for answering that question.</p>
<p><strong>Q: Why not take down the hundreds of sites now selling stolen credit cards and identity data?</strong></p>
<p><strong><a href="media/1ac45320.Screen-Shot-2015-04-19-at-11.53.35-PM.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/04/Screen-Shot-2015-04-19-at-11.53.35-PM.png"><img class="alignright  wp-image-30708" src="media/1ac45320.Screen-Shot-2015-04-19-at-11.53.35-PM.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/04/Screen-Shot-2015-04-19-at-11.53.35-PM.png" alt="Screen Shot 2015-04-19 at 11.53.35 PM" width="220" height="216" /></a>A:</strong> For starters, it&#8217;s not always so easy to take these sites offline. Many of them rely on domain name registrars that routinely ignore abuse requests. The same goes for the organizations hosting a number of these unsavory markets. What&#8217;s more, most crime shops have a slew of new domain variations at a variety of hosting providers and registrars that they can turn to if they do get shut down.</p>
<p>More importantly, fraud shops don&#8217;t often get shut down because they are quite useful to law enforcement, banks and researchers alike. Stolen data that has value among computer crooks will always find a way onto illicit markets; it benefits the aforementioned parties if those markets aren&#8217;t so exclusive that the crooks can no longer easily view or buy the data for sale.</p>
<p>As I&#8217;ve discussed in several articles, banks and law enforcement often use these services to figure out which merchant has been hacked; to help stanch the flow of new stolen data; and, effectively, stop the breach.</p>
<p><strong>Q: Why are there so many of these card shops hosted in the clear Web, instead of via Tor, I2P or some other anonymization technology that allows the shop to hide its true Internet address? </strong></p>
<p><strong>A:</strong> Most card shops sell only a tiny fraction (think single-digit percentages) of the cards they have for sale at any one time. As <a title="http://krebsonsecurity.com/2014/10/seleznev-arrest-explains-2pac-downtime/" href="http://krebsonsecurity.com/2014/10/seleznev-arrest-explains-2pac-downtime/" target="_blank">I noted in the second half of this piece</a>, the thieves in charge of the shop primarily responsible for selling cards stolen from Target and Home Depot only sold a very small percentage of the more than 100 million credit and debit cards they stole from those two companies. Russian computer forensics firm Group-IB found similar single-digit sales figures at swipe[dot]su, a long running card shop that they hacked last year.</p>
<p>In short, stolen cards are not like fine wines: They don’t age well. The minute they are put up for sale, their value starts to decline. And there are many times more stolen cards available than there are crooks to absorb anywhere near double-digit percentages of cards stolen from a given merchant. Hence, it behooves the card vendors to make their shops as accessible and easy-to-use as possible.</p>
<p><strong>Q: How come law enforcement officials can&#8217;t just put these guys and others out of business or behind bars for this activity?</strong></p>
<p><strong>A:</strong> Occasionally, the proprietors of these card shops do get arrested and jailed. But a great many of the sites are run by individuals living in Russia and Ukraine. Neither nation has shown itself particularly anxious to arrest cyber crooks within its borders, so long as those crooks are mainly picking on targets outside of their home country. Also, cybercrooks based in Russia and Ukraine who don&#8217;t steal from their own generally have little to fear from foreign law enforcement and governments provided they don&#8217;t travel to Western-friendly nations.<span id="more-30685"></span></p>
<p><strong>Q: Okay, but can&#8217;t we all achieve a certain catharsis from taking these sites offline?</strong></p>
<p><strong>A:</strong> Sure, but those fraud sites will be back online before you can say &#8220;where&#8217;s my debit card.&#8221; Most experienced card shops list on their home pages several &#8212; if not dozens &#8212; of alternate domains that customers can use in the event that the current one gets shut down. While this certainly presents a ripe target list for anyone wishing to take these sites offline, see the answer to the first question above for why this generally gets harder with every successive takedown.</p>
<p><strong>Q: So is there nothing we can do to disrupt these crime shops that isn&#8217;t also disruptive to security folk looking to gain intelligence about who&#8217;s hacked?</strong></p>
<p>A: Most of the top card fraud shops have redesigned their business models around creating a smoother customer experience. Gone are the days when a serious card shop could ignore customer complaints and still do a brisk and loyal business. It&#8217;s all about reputation. Creating a positive customer experience is the key to the way these guys establish legitimacy and loyalty among customers. But interfere with that customer experience &#8212; and seller reputation &#8212; enough, and that business may very well die on the vine.</p>


feed_id: http://krebsonsecurity.com/?p=28831
title: What’s Your Security Maturity Level?
uri: What-s-Your-Security-Maturity-Level
url: http://krebsonsecurity.com/2015/04/whats-your-security-maturity-level/
content:
<p>Not long ago, I was working on a speech and found myself trying to come up with a phrase that encapsulates the difference between organizations that really make cybersecurity a part of their culture and those that merely pay it lip service and do the bare minimum (think &#8216;<a title="https://vimeo.com/102830089" href="https://vimeo.com/102830089" target="_blank">15 pieces of flair</a>&#8216;). When the phrase &#8220;security maturity&#8221; came to mind, I thought for sure I&#8217;d conceived of an original idea and catchy phrase.</p>
<p>It turns out this is already a thing. And a really notable thing at that. The graphic below, produced last year by the <a title="http://www.esg-global.com/" href="http://www.esg-global.com/" target="_blank">Enterprise Strategy Group</a>, does a nice job of explaining why some companies just don&#8217;t get it when it comes to taking effective measures to manage cyber risks and threats.</p>
<p><a class="lightbox" href="media/4f995330.SecurityMaturity.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/11/SecurityMaturity.png"><img class="aligncenter size-large wp-image-29580" src="media/7d31f913.SecurityMaturity-600x416.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/11/SecurityMaturity-600x416.png" alt="SecurityMaturity" width="600" height="416" /></a></p>
<p>Very often, experience is the best teacher here: Data breaches have a funny way of forcing organizations &#8212; kicking and screaming &#8212; from one vertical column to another in the Security Maturity matrix. Much depends on whether the security professionals in the breached organization have a plan (ideally, in advance of the breach) and the clout for capitalizing on the brief post-breach executive attention on security to ask for changes and resources that can assist the organization in learning from its mistakes and growing.</p>
<p>But the Security Maturity matrix doesn&#8217;t just show how things are broken: It also provides a basic roadmap for organizations that wish to change that culture. Perhaps unsurprisingly, entities that are able to manage that transition typically have a leadership that is invested in and interested in making security a core priority. The real trick is engineering ways to influence the leadership, with or without the fleeting momentum offered by a breach.<span id="more-28831"></span></p>
<p>At last week&#8217;s <strong>RSA Security Conference</strong> in San Francisco, I had a chance to meet up with <strong>Demetrios &#8220;Laz&#8221; Lazarikos</strong>, the former chief information security officer at <strong>Sears</strong>. Now founder of the security consultancy <a href="http://blue-lava.net" target="_blank">blue-lava.net</a>, Laz spends a great deal of time trying to impress upon his clients the need to take the security maturity model seriously. Here&#8217;s his sliding scale, which measures maturity in terms of preparedness and expectations.</p>
<div id="attachment_30726" style="width: 590px" class="wp-caption aligncenter"><a href="media/1581a3a7.Screen-Shot-2015-04-23-at-9.41.03-AM.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/04/Screen-Shot-2015-04-23-at-9.41.03-AM.png"><img class="size-medium wp-image-30726" src="media/e65959e6.Screen-Shot-2015-04-23-at-9.41.03-AM-580x384.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/04/Screen-Shot-2015-04-23-at-9.41.03-AM-580x384.png" alt="Source: Blue Lava" width="580" height="384" /></a><p class="wp-caption-text">Source: Blue Lava</p></div>
<p>I like Laz&#8217;s models because they&#8217;re customized to every organization, breaking down each business unit into its own security maturity score. The abbreviations in the graphic below &#8212; SDLC and PMO &#8212; stand for &#8220;security development life cycle&#8221; and &#8220;project management office,&#8221; respectively. Dark red boxes (marked with a &#8220;1&#8221;) indicate areas where the organization&#8217;s business unit needs the most work.</p>
<div id="attachment_30727" style="width: 590px" class="wp-caption aligncenter"><a href="media/317d237d.matmodels.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/04/matmodels.png"><img class="size-medium wp-image-30727" src="media/ffea803e.matmodels-580x368.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/04/matmodels-580x368.png" alt="Source: Blue Lava Consulting" width="580" height="368" /></a><p class="wp-caption-text">Source: Blue Lava Consulting</p></div>
<p>Laz&#8217;s security maturity hierarchy includes five levels:</p>
<ul>
<li><strong>Level 1</strong> – Information Security processes are unorganized, and may be unstructured. Success is likely to depend on individual efforts and is not considered to be repeatable or scalable. This is because processes would not be sufficiently defined and documented to allow them to be replicated.</li>
<li><strong>Level 2</strong> – Information Security efforts are at a repeatable level where basic project management techniques are established and successes can be repeated. This is due to processes being established, defined, and documented.</li>
<li><strong>Level 3</strong> – Information Security efforts have greater attention to documentation, standardization, and maintenance support.</li>
<li><strong>Level 4</strong> &#8211; At this level, an organization monitors and controls its own Information Security processes through data collection and analysis.</li>
<li><strong>Level 5</strong> – This is an optimizing level where Information Security processes are constantly being improved through monitoring feedback from existing processes and introducing new processes to better serve the organization&#8217;s particular needs.</li>
</ul>
<p>Where does your organization fit in these models? Are they a useful way for getting a handle on security and increasing maturity within your organization? Has your employer recently moved from one security maturity level to another? If so, tell us what you think prompted that shift? Sound off on these or any other thoughts on this subject in the comments below, please.</p>


feed_id: http://krebsonsecurity.com/?p=30749
title: A Day in the Life of a Stolen Healthcare Record
uri: A-Day-in-the-Life-of-a-Stolen-Healthcare-Record
url: http://krebsonsecurity.com/2015/04/a-day-in-the-life-of-a-stolen-healthcare-record/
content:
<p>When your credit card gets stolen because a merchant you did business with got hacked, it&#8217;s often quite easy for investigators to figure out which company was victimized. The process of divining the provenance of stolen healthcare records, however, is far trickier because these records typically are processed or handled by a gauntlet of third party firms, most of which have no direct relationship with the patient or customer ultimately harmed by the breach.</p>
<p>I was reminded of this last month, after receiving a tip from a source at a cyber intelligence firm based in California who asked to remain anonymous. My source had discovered a seller on the <a href="http://www.deepdotweb.com/marketplace-directory/listing/alphabay" target="_blank">darknet marketplace AlphaBay</a> who was posting stolen healthcare data into a subsection of the market called &#8220;Random DB ripoffs,&#8221; (&#8220;DB,&#8221; of course, is short for &#8220;database&#8221;).</p>
<p>Eventually, this same fraudster leaked a large text file titled, &#8220;Tenet Health Hilton Medical Center,&#8221; which contained the name, address, Social Security number and other sensitive information on dozens of physicians across the country.</p>
<p><a href="media/a96af417.AlphaBayHealth.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2015/04/AlphaBayHealth.png"><img class="aligncenter size-medium wp-image-30787" src="media/4d618295.AlphaBayHealth-580x541.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2015/04/AlphaBayHealth-580x541.png" alt="AlphaBayHealth" width="580" height="541" /></a>Contacted by KrebsOnSecurity, <strong>Tenet Health</strong> officials said the data was not stolen from its databases, but rather from a company called <strong>InCompass Healthcare</strong>. Turns out, InCompass disclosed a breach in August 2014, which reportedly occurred after a subcontractor of one of the company&#8217;s service providers failed to secure a computer server containing account information. The affected company was <strong>24 ON Physicians</strong>, an affiliate of InCompass Healthcare.</p>
<p>&#8220;The breach affected approximately 10,000 patients treated at 29 facilities throughout the U.S. and approximately 40 employed physicians,&#8221; wrote <strong>Rebecca Kirkham</strong>, a spokeswoman for InCompass.</p>
<p>&#8220;As a result, a limited amount of personal information may have been exposed to the Internet between December 1, 2013 and April 17, 2014, Kirkham wrote in an emailed statement. Information that may have been exposed included patient names, invoice numbers, procedure codes, dates of service, charge amounts, balance due, policy numbers, and billing-related status comments. Patient social security number, home address, telephone number and date of birth were not in the files that were subject to possible exposure. Additionally, no patient medical records or bank account information were put at risk. The physician information that may have been exposed included physician name, facility, provider number and social security number.&#8221;</p>
<p>Kirkham said up until being contacted by this reporter, InCompass &#8220;had received no indication that personal information has been acquired or used maliciously.&#8221;</p>
<p>So who was the subcontractor that leaked the data? According to <a href="http://www.phiprivacy.net/mckesson-subsidiary-exposed-over-10000-patients-information-via-google-search-data-exposed-for-more-than-4-months/" target="_blank">PHIprivacy.net</a> (and now confirmed by InCompass), the subcontractor responsible was <strong>PST Services</strong>, a <strong>McKesson</strong> subsidiary providing medical billing services, which left more than 10,000 patients’ information exposed via Google search for over four months.</p>
<p>As this incident shows, a breach at one service provider or healthcare billing company can have a broad impact across the healthcare system, but can be quite challenging to piece together.<span id="more-30749"></span></p>
<p>Still, not all breaches involving health information are difficult to backtrack to the source. In September 2014, I discovered a fraudster on the <a href="http://krebsonsecurity.com/2015/03/dark-webs-evolution-market-vanishes/" target="_blank">now-defunct Evolution Market</a> dark web community who was selling life insurance records <a href="http://krebsonsecurity.com/2014/09/medical-records-for-sale-in-underground-stolen-from-texas-life-insurance-firm/" target="_blank">for less than $7 apiece</a>. That breach was fairly easily tied back to <strong>Torchmark Corp.</strong>, an insurance holding company based in Texas; the name of the company&#8217;s subsidiary was plastered all over stolen records listing applicants&#8217; medical histories.</p>
<p><span style="text-decoration: underline;">HEALTH RECORDS GET AROUND</span></p>
<p>Health records are huge targets for fraudsters because they typically contain all of the information thieves would need to conduct mischief in the victim&#8217;s name &#8212; from fraudulently opening new lines of credit to filing phony tax refund requests with the Internal Revenue Service. Last year, a great many physicians in multiple states came forward to say they&#8217;d been <a href="http://krebsonsecurity.com/?s=physicians&amp;x=0&amp;y=0" target="_blank">apparently targeted by tax refund fraudsters</a>, but could not figure out the source of the leaked data. Chances are, the scammers stole it from hacked medical providers like PST Services and others.</p>
<p>In March 2015, <a href="http://www.healthcareitnews.com/news/list-biggest-hipaa-data-breaches-2009-2015" target="_blank">HealthCare IT News</a> published a list of healthcare providers that experienced data breaches since 2009, using information from the Department of Health and Human Services. That data includes HIPAA breaches reported by 1,149 covered entities and business associates, and covers some 41 million Americans. Curiously, the database does not mention some 80 million Social Security numbers and other data jeopardized in the <a href="http://krebsonsecurity.com/2015/02/data-breach-at-health-insurer-anthem-could-impact-millions/" target="_blank">Anthem breach</a> that went public in February 2015 (nor 11 million records lost in <a href="http://krebsonsecurity.com/2015/03/premera-blue-cross-breach-exposes-financial-medical-records/" target="_blank">the Premera breach</a> that came to light in mid-March 2015).</p>
<p>Sensitive stolen data posted to cybercrime forums can rapidly spread to miscreants and ne&#8217;er-do-wells around the globe. In <a href="http://www.bitglass.com/company/news/press_releases/bitglasswheresyourdata" target="_blank">an experiment</a> conducted earlier this month, security firm <strong>Bitglass</strong> synthesized 1,568 fake names, Social Security numbers, credit card numbers, addresses and phone numbers that were saved in an Excel spreadsheet. The spreadsheet was then transmitted through the company&#8217;s proxy, which automatically watermarked the file. The researchers set it up so that each time the file was opened, the persistent watermark (which Bitglass says survives copy, paste and other file manipulations), “called home” to record view information such as IP address, geographic location and device type.</p>
<p>The company posted the spreadsheet of manufactured identities anonymously to cyber-crime marketplaces on the Dark Web. The result was that in less than two weeks, the file had traveled to 22 countries on five continents, was accessed more than 1,100 times. &#8220;Additionally, time, location, and IP address analysis uncovered a high rate of activity amongst two groups of similar viewers, indicating the possibility of two cyber crime syndicates, one operating within Nigeria and the other in Russia,&#8221; the report concluded.</p>
<div id="attachment_30776" style="width: 590px" class="wp-caption aligncenter"><a href="media/9a34e8c2.bitglass.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2015/04/bitglass.png"><img class="size-medium wp-image-30776" src="media/e0a65c95.bitglass-580x301.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2015/04/bitglass-580x301.png" alt="Source: Bitglass" width="580" height="301" /></a><p class="wp-caption-text">Source: Bitglass</p></div>


feed_id: http://krebsonsecurity.com/?p=30760
title: SendGrid: Employee Account Hacked, Used to Steal Customer Credentials
uri: SendGrid-Employee-Account-Hacked-Used-to-Steal-Customer-Credentials
url:
http://krebsonsecurity.com/2015/04/sendgrid-employee-account-hacked-used-to-steal-customer-credentials/

content:
<p><strong>Sendgrid</strong>, an email service used by tens of thousands of companies &#8212; including Silicon Valley giants as well as Bitcoin exchange <strong>Coinbase</strong> &#8212; said attackers compromised a Sendgrid employee&#8217;s account, which was then used to steal the usernames, email addresses and (hashed) passwords of customer and employee accounts. The announcement comes several weeks after Sendgrid sought to assure customers that the breach was limited to a single customer account.</p>
<p><a href="media/9ec96c63.sg1.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2015/04/sg1.png"><img class="alignright size-full wp-image-30770" src="media/9ec96c63.sg1.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2015/04/sg1.png" alt="sg1" width="305" height="94" /></a>On April 9, <em>The New York Times</em> <a href="http://bits.blogs.nytimes.com/2015/04/09/sendgrid-email-breach-was-used-to-attack-coinbase-a-bitcoin-exchange/?_r=0" target="_blank">reported</a> that Coinbase had its Sendgrid credentials compromised, and that thieves were apparently using the access to launch phishing attacks against Bitcoin-related businesses. Sendgrid took issue with the Times piece for implying that SendGrid had incurred a platform-wide breach. &#8220;The story has now been updated to reflect that only a single SendGrid customer account was compromised,&#8221; Sendgrid wrote in <a href="https://sendgrid.com/blog/phishing-attack-rocks-the-btc-community/" target="_blank">a blog post</a> published that same day.</p>
<p>Today, Sendgrid <a href="https://sendgrid.com/blog/update-on-security-incident-and-additional-security-measures/" target="_blank">published another post</a> walking that statement back a bit, saying it now had more information about the extent of the intrusion thanks to assistance from data breach investigators:</p>
<p>&#8220;After further investigation in collaboration with law enforcement and FireEye’s (Mandiant) Incident Response Team, we became aware that a SendGrid employee’s account had been compromised by a cyber criminal and used to access several of our internal systems on three separate dates in February and March 2015,&#8221; wrote <strong>David Campbell</strong>, Sendgrid&#8217;s chief security officer.  Campbell continues:</p>
<blockquote><p>&#8220;These systems contained usernames, email addresses, and (salted and iteratively hashed) passwords for SendGrid customer and employee accounts. In addition, evidence suggests that the cyber criminal accessed servers that contained some of our customers’ recipient email lists/addresses and customer contact information. We have not found any forensic evidence that customer lists or customer contact information was stolen. However, as a precautionary measure, we are implementing a system-wide password reset. Because SendGrid does not store customer payment cards we do know that payment card information was not involved.&#8221;</p></blockquote>
<p>Sendgrid is urging customers to change their passwords, and to take advantage of the company&#8217;s <a href="https://sendgrid.com/docs/User_Guide/two_factor_authentication.html" target="_blank">multi-factor authentication offering</a>. Sendgrid also said it is working to add more authentication methods for its two-factor security, and to expedite the release of special &#8220;API keys&#8221; that will allow customers to use keys instead of passwords for sending email through its systems.</p>
<p>Sendgrid manages billions of emails for some big brand names, including Pinterest, Spotify and Uber. This reach makes them a major target of fraudsters and spammers, who would like nothing more than to control whitelisted accounts capable of blasting out so much email each day.</p>
<p>In March 2015, U.S. prosecutors <a href="http://krebsonsecurity.com/2015/03/feds-indict-three-in-2011-epsilon-hack/" target="_blank">indicted three men</a> in connection with the April 2011 compromise of commercial email giant <strong>Epsilon</strong>. Days after that break-in, customers at dozens of Fortune 500 companies <a title="http://krebsonsecurity.com/2011/04/spammers-target-kroger-customers/" href="http://krebsonsecurity.com/2011/04/spammers-target-kroger-customers/" target="_blank">began complaining of receiving spam</a> to email addresses they’d created specifically for use with the companies directly served by Epsilon and its network of email providers.</p>


feed_id: http://krebsonsecurity.com/?p=30782
title: China Censors Facebook.net, Blocks Sites With “Like” Buttons
uri: China-Censors-Facebook-net-Blocks-Sites-With-Like-Buttons
url: http://krebsonsecurity.com/2015/04/china-censors-facebook-net-blocks-sites-with-like-buttons/
content:
<p>Chinese government censors at the helm of the &#8220;Great Firewall of China&#8221; appear to have inadvertently blocked Chinese Web surfers from visiting pages that call out to <em>connect.facebook.net</em>, a resource used by <a href="https://developers.facebook.com/docs/javascript/quickstart/v2.3" target="_blank">Facebook&#8217;s &#8220;like&#8221; buttons</a>. While the apparent screw-up was quickly fixed, the block was cached by many Chinese networks &#8212; effectively blocking millions of Chinese Web surfers from visiting a huge number of sites that are not normally censored.</p>
<p><a href="media/13595b64.fblikeunlike.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2015/04/fblikeunlike.png"><img class="aligncenter size-medium wp-image-30803" src="media/2ffa20f5.fblikeunlike-580x240.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2015/04/fblikeunlike-580x240.png" alt="fblikeunlike" width="580" height="240" /></a></p>
<p>Sometime in the last 24 hours, Web requests from within China for a large number of websites were being redirected to <a href="http://wpkg.org/" target="_blank">wpkg.org</a>, an apparently innocuous site hosting an open-source, automated software deployment, upgrade and removal program for Windows.</p>
<p>One KrebsOnSecurity reader living in China who was inconvenienced by the glitch said he discovered the problem just by trying to access the regularly non-blocked UK newspapers online. He soon noticed a large swath of other sites were also being re-directed to the same page.</p>
<p>&#8220;It has the feel of a cyber attack rather than a new addition to the Great Firewall,&#8221; said the reader, who asked not to be identified by name. &#8220;I thought it might be malware on my laptop, but then I got an email from the IT services at my university saying the issue was nation-wide, which made me curious. It&#8217;s obviously very normal for sites to be blocked here in China, but the scale and the type of sites being blocked (and the fact that we&#8217;re being re-directed instead of the usual 404 result) suggests a problem with the Internet system itself. It doesn&#8217;t seem like the kind of thing the Chinese gov would do intentionally, which raises some interesting questions.&#8221;</p>
<p><strong>Nicholas Weaver</strong>, a researcher who has delved deeply into Chinese censorship tools in his role at the <a title="http://www.icsi.berkeley.edu/icsi/" href="http://www.icsi.berkeley.edu/icsi/" target="_blank" rel="noreferrer">International Computer Science Institute</a> (ICSI) and the <strong>University of California, Berkeley,</strong> agrees that the blocking of connect.facebook.net by censors inside the country was likely a mistake.</p>
<p class="p1"><span class="s1">&#8220;Any page that had a Facebook Connect element on it that was unencrypted and visited from within China would instead get this thing which would reload the main page of wpkg.org,&#8221; Weaver said, noting that while Facebook.com always encrypts users&#8217; connections, sites that rely on Facebook &#8220;like&#8221; buttons and related resources draw those from connect.facebook.net. &#8220;That screw-up seems to have been fairly quickly corrected, but the effect of it has lingered because it got into peoples’ <a href="http://en.wikipedia.org/wiki/Domain_Name_System" target="_blank">domain name system</a> (DNS) caches.&#8221; </span></p>
<p class="p1"><span class="s1">In short, a brief misstep in censorship can have lasting and far flung repercussions. But w</span><span class="s1">hy should this be considered a screw-up by Chinese censors? For one thing, it was corrected quickly, Weaver said. </span></p>
<p class="p1"><span class="s1">&#8220;Also, the Chinese censors don’t benefit from it, because this caused a huge amount of disruption to Chinese web surfers on pages that the government doesn&#8217;t want to censor,&#8221; he said.</span><span id="more-30782"></span></p>
<p>Such screw-ups are not unprecedented. In January 2014, Chinese censors attempting to block Greatfire.org &#8212; a site that hosts tools and instructions for people to circumvent restrictions erected by the Great Firewall &#8212; <a href="https://en.greatfire.org/blog/2014/jan/internet-outage-china-jan-21" target="_blank">inadvertently blocked all Chinese Web surfers from accessing most of the Internet</a>.</p>
<p>Doing censorship right &#8212; without introducing the occasional routing calamities and unintended consequences &#8212; is hard, Weaver said. And China isn&#8217;t the only nation that&#8217;s struggled with censorship goofs. The United Kingdom <a href="http://www.economist.com/blogs/economist-explains/2013/07/economist-explains-17" target="_blank">filters its providers&#8217; Internet traffic</a> for requests to known child pornography material. In 2008, a filtering system run by the U.K-based <a href="http://en.wikipedia.org/wiki/Internet_Watch_Foundation" target="_blank">Internet Watch Foundation</a> flagged <a href="http://en.wikipedia.org/wiki/Virgin_Killer" target="_blank">the cover art for the album Virgin Killers</a> by the rock band Scorpions as potential child porn. As a result, the system placed several pages from <strong>Wikipedia</strong> on its Internet black list.</p>
<p>The child porn filtering system checked for requests to images flagged as indecent by proxying the traffic through a specific system. So when many U.K. residents tried to edit Wiki pages following the blacklisting, Wikipedia saw those requests as huge numbers of users all trying to edit Wiki pages from the same Internet addresses, and blocked the proxy address &#8212; effectively cutting off U.K. users from editing all Wiki pages for several days.</p>
<p>Suggested further reading:</p>
<p><a href="http://krebsonsecurity.com/2015/04/dont-be-fodder-for-chinas-great-cannon/" target="_blank">Don&#8217;t Be Fodder for China&#8217;s &#8216;Great Cannon&#8217;</a></p>
<p><a href="https://en.greatfire.org/" target="_blank">Greatfire.org</a></p>


feed_id: http://krebsonsecurity.com/?p=30823
title: Harbortouch is Latest POS Vendor Breach
uri: Harbortouch-is-Latest-POS-Vendor-Breach
url: http://krebsonsecurity.com/2015/05/harbortouch-is-latest-pos-vendor-breach/
content:
<p>Last week, Allentown, Pa. based point-of-sale (POS) maker <a href="http://www.harbortouch.com" target="_blank">Harbortouch</a> disclosed that a breach involving &#8220;a small number&#8221; of its restaurant and bar customers were impacted by malicious software that allowed thieves to siphon customer card data from affected merchants. KrebsOnSecurity has recently heard from a major U.S. card issuer that says the company is radically downplaying the scope of the breach, and that the compromise appears to have impacted more than 4,200 Harbortouch customers nationwide.</p>
<p><a href="media/c49af04a.harbortouch.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2015/04/harbortouch.png"><img class="alignright  wp-image-30829" src="media/c49af04a.harbortouch.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2015/04/harbortouch.png" alt="harbortouch" width="273" height="123" /></a>In the weeks leading up to the Harbortouch disclosure, many sources in the financial industry speculated that there was possibly a breach at a credit card processing company. This suspicion usually arises whenever banks start feeling a great deal of card fraud pain that they can&#8217;t easily trace back to one specific merchant (for more on why POS vendor breaches are difficult to pin down, check out <a href="http://krebsonsecurity.com/2015/04/pos-providers-feel-brunt-of-poseidon-malware/" target="_blank">this post</a>.</p>
<p>Some banks were so anxious about the unexplained fraud spikes as stolen cards were used to buy goods at big box stores that they instituted dramatic changes to the way they processed debit card transactions. Glastonbury, Ct. based <a href="https://www.bankatunited.com/Contact-Us" target="_blank">United Bank</a> recently included a red-backgrounded notice conspicuously at the top of their home page stating: &#8220;In an effort to protect our customers after learning of a spike in fraudulent transactions in grocery stores as well as similar stores such as WalMart and Target, we have instituted a block in which customers will now be required to select &#8216;Debit&#8217; and enter their &#8216;PIN&#8217; for transactions at these stores when using their United Bank debit card.&#8221;</p>
<div id="attachment_30824" style="width: 590px" class="wp-caption aligncenter"><a href="media/311339de.QA.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2015/04/QA.png"><img class="size-medium wp-image-30824" src="media/3f30d0ae.QA-580x356.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2015/04/QA-580x356.png" alt="A notice to customers of United Bank." width="580" height="356" /></a><p class="wp-caption-text">A notice to customers of United Bank.</p></div>
<p>In a statement released last week to KrebsOnSecurity, Harbortouch said it has &#8220;identified and contained an incident that affected a small percentage of our merchants.&#8221;</p>
<p>&#8220;The incident involved the installation of malware on certain point of sale (POS) systems,&#8221; Harbortouch said in a written statement. &#8220;The advanced malware was designed to avoid detection by the antivirus program running on the POS System. Within hours of detecting the incident, Harbortouch identified and removed the malware from affected systems. We have engaged Mandiant, a leading forensic investigator, to assist in our ongoing investigation.&#8221;</p>
<p>The company said the incident did not affect Harbortouch&#8217;s own network, nor was it the result of any vulnerability in the PA-DSS validated POS software.</p>
<p>&#8220;Harbortouch does not directly process or store cardholder data,&#8221; the company explained. &#8220;It is important to note that only a small percentage of our merchants were affected and over a relatively short period of time. We are working with the appropriate parties to notify the card issuing banks that were potentially impacted. Those banks can then conduct heightened monitoring of transactions to detect and prevent unauthorized charges. We are also coordinating our efforts with law enforcement to assist them in their investigation.&#8221;</p>
<p>However, according to sources at a top 10 card-issuing bank here in the United States that shared voluminous fraud data with this author on condition of anonymity, the breach extends to at least 4,200 stores that run Harbortouch&#8217;s point-of-sale software.<span id="more-30823"></span></p>
<p>Reached for comment about this claim, Harbortouch reiterated that the malware incident impacted a small percentage of its merchants.</p>
<p>&#8220;It was nowhere near all of our customers, that is simply a false statement&#8221; said <strong>Nate Hirshberg</strong>, marketing director at Harbortouch, declining to answer questions about how many locations the company serves. &#8220;This malware incident impacted individual merchant locations, not Harbortouch. Harbortouch is not a processing platform, not a gateway and we do not store any cardholder data. This is not an ongoing incident and the malware was eliminated rapidly upon detection.&#8221;</p>
<p>One thing is for sure: POS providers &#8212; and their myriad customers &#8212; have a massive target on their backs, and there are almost certainly many other POS companies that are dealing with similar problems. Stay tuned for further updates.</p>


feed_id: http://krebsonsecurity.com/?p=30817
title: Foiling Pump Skimmers With GPS
uri: Foiling-Pump-Skimmers-With-GPS
url: http://krebsonsecurity.com/2015/05/foiling-pump-skimmers-with-gps/
content:
<p>Credit and debit card skimmers secretly attached to gas pumps are an increasingly common scourge throughout the United States. But the tables can be turned when these fraud devices are discovered, as evidenced by one California police department that has eschewed costly and time-consuming stakeouts in favor of affixing GPS tracking devices to the skimmers and then waiting for thieves to come collect their bounty.</p>
<p>One morning last year the Redlands, Calif. police department received a call about a skimming device that was found attached to a local gas pump. This wasn&#8217;t the first call of the day about such a discovery, but Redlands police didn&#8217;t exactly have time to stake out the compromised pumps. Instead, they attached a specially-made GPS tracking device to the pump skimmer.</p>
<div id="attachment_30840" style="width: 590px" class="wp-caption aligncenter"><a href="media/72586f11.skimwithgps.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2015/05/skimwithgps.png"><img class="size-medium wp-image-30840" src="media/74ad9745.skimwithgps-580x565.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2015/05/skimwithgps-580x565.png" alt="A gas pump skimmer retrofitted with a GPS tracking device. Image: 3VR's Crimedex Alert System." width="580" height="565" /></a><p class="wp-caption-text">A gas pump skimmer retrofitted with a GPS tracking device. Image: 3VR&#8217;s Crimedex Alert System.</p></div>
<p>At around 5 a.m. the next morning, a computer screen at the Redlands PD indicated that the compromised skimming device was on the move. The GPS device that the cops had hidden inside the skimmer was beaconing its location every six seconds, and the police were quickly able to determine that the skimmer was heading down a highway adjacent to the gas station and traveling at more than 50 MPH. Using handheld radios to pinpoint the exact location of the tracker, the police were able to locate the suspects, who were caught with several other devices implicating them in an organized crime ring.</p>
<div id="attachment_30841" style="width: 484px" class="wp-caption aligncenter"><a href="media/2905628f.3vspumpskimgps.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2015/05/3vspumpskimgps.png"><img class="size-full wp-image-30841" src="media/2905628f.3vspumpskimgps.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2015/05/3vspumpskimgps.png" alt="A GPS tracking device manufactured by 3SI Security Systems (3sisecurity.com)" width="474" height="794" /></a><p class="wp-caption-text">A GPS tracking device manufactured by 3SI Security Systems (3sisecurity.com)</p></div>
<p><a href="http://cops.usdoj.gov/html/dispatch/10-2014/gps_and_credit_card_skimming.asp" target="_blank">This story</a> in October 2014 the <strong>U.S. Justice Department</strong>&#8216;s &#8220;COPS Office&#8221; indicates that the Redlands PD has taken the lead in using GPS technology to solve a variety of crimes, and had credited the technology with helping secure at least 139 arrests.<span id="more-30817"></span></p>
<p>According to <a href="http://www.3vr.com/" target="_blank">3VR Inc</a>., a San Francisco based surveillance and security firm, the Redlands PD has used the GPS technology to apprehend offender committing armed robberies, vehicle burglary, pharmaceutical burglary and robbery, cell store burglary and robbery, bike theft, laptop theft, constructions site theft, fire hydrant theft, metal theft, wire theft, 3rd row seat theft, cemetery theft, vending machine theft, mail theft, UPS parcel theft, residential burglary, tire theft, vehicle theft, cigarette theft, etc. &#8220;The technology has also been used to voluntarily track informants by sewing a unit into a purse,&#8221; 3VR wrote in a recent newsletter.</p>
<p>3VR notes that the GPS device used by the Redlands PD in the pump skimmer case runs for about six hours on a full battery, meaning cops have about six hours to locate the device before the GPS stops transmitting. However, the devices can be tweaked to extend the battery life, by allowing them to switch on only in the event the device actually is moved, and by decreasing the frequency with which the device beacons home.</p>
<p>One increasingly common type of gas pump skimmer &#8212; those equipped with <a href="http://krebsonsecurity.com/2014/01/gang-rigged-pumps-with-bluetooth-skimmers/" target="_blank">Bluetooth</a> <a href="http://krebsonsecurity.com/2010/07/skimmers-siphoning-card-data-at-the-pump/" target="_blank">technology</a> &#8212; might not be as susceptible to these kinds of police tricks. Bluetooth skimmers are equipped to tap directly into the pump&#8217;s power supply, and to allow thieves to <a href="http://krebsonsecurity.com/2013/07/dont-get-sucker-pumped/" target="_blank">retrieve stolen card data wirelessly</a>, just by pulling up to the compromised pump with a Bluetooth enabled laptop or smartphone and downloading the data without ever leaving the vehicle.</p>
<p>Unlike ATM skimmers, skimming devices attached to gas pumps usually are impossible for the average customer to spot because the skimmers are not stuck to the outside of the machine, but rather hidden inside after thieves gain access to the pump&#8217;s insides. I wouldn&#8217;t worry too much about pump skimmers, unless you&#8217;re accustomed to paying for fuel with a debit card: Having your checking account emptied of cash while your bank sorts out the situation can be a huge hassle and create secondary problems (bounced checks, for instance). Use a credit card instead.</p>
<p>How common are pump skimmers?  Thieves tend to attack multiple filling stations along a major interstate, as detailed in <a href="http://krebsonsecurity.com/2010/07/skimmers-siphoning-card-data-at-the-pump/" target="_blank">this July 2010 story</a> about pump skimmer scammers. More recently, a law enforcement sweep of 6,100 gas stations in Florida last month <a href="http://www.miamiherald.com/news/business/article19302153.html" target="_blank">turned up skimmers at 81 locations</a>.</p>
<p>If you&#8217;re as fascinated by ATM and pump skimmers as I am, check out the rest of my skimmer series, <a href="http://krebsonsecurity.com/all-about-skimmers/" target="_blank">All About Skimmers</a>.</p>


feed_id: http://krebsonsecurity.com/?p=30835
title: Sally Beauty Card Breach, Part Deux?
uri: Sally-Beauty-Card-Breach-Part-Deux
url: http://krebsonsecurity.com/2015/05/sally-beauty-card-breach-part-deux/
content:
<p>For the second time in a year, nationwide beauty products chain <strong>Sally Beauty Holdings Inc.</strong> says it is investigating reports of unusual credit and debit card activity at some of its U.S. stores.</p>
<p>Last week, KrebsOnSecurity began hearing from multiple financial institutions about a pattern of fraudulent charges on cards that were all recently<a href="media/ec34a33a.sally.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2015/05/sally.png"><img class="alignright size-full wp-image-30852" src="media/ec34a33a.sally.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2015/05/sally.png" alt="sally" width="261" height="205" /></a> used at Sally Beauty locations in various states. Reached for comment on Sunday about the fraud pattern suggesting yet another card breach at the beauty products chain, Sally Beauty issued the following statement this morning:</p>
<p>&#8220;Sally Beauty Holdings, Inc. is currently investigating reports of unusual activity involving payment cards used at some of our U.S. Sally Beauty stores. Since learning of these reports, we have been working with law enforcement and our credit card processor and have launched a comprehensive investigation with the help of a leading third-party forensics expert to aggressively gather facts while working to ensure our customers are protected. Until this investigation is completed, it is difficult to determine with certainty the scope or nature of any potential incident, but we will continue to work vigilantly to address any potential issues that may affect our customers.&#8221;</p>
<p>Their statement continues: &#8220;Consistent with our &#8216;Love it or Return It&#8217; policy, customer security and confidence remains our number one priority. As a result, we encourage any customer who is concerned about the security of their payment cards to call our Customer Service Hotline at 1-866-234-9442, so that we can assist them in addressing any potential concerns. Sally Beauty will, as appropriate, provide updates as we learn more from our investigation.&#8221;</p>
<p>In addition, the company also sent out an urgent alert today to its employees, asking associates to direct any customers with credit card issues to the Sally Beauty Web site or to call customer service. &#8220;We hadn&#8217;t gotten an email like that since last year when we had our breach,&#8221; the Sally Beauty employee said on condition of anonymity.<span id="more-30835"></span></p>
<p>On March 5, 2014, this publication <a href="http://krebsonsecurity.com/2014/03/sally-beauty-hit-by-credit-card-breach/" target="_blank">first reported</a> that a batch of more than 282,000 cards that went up for sale on Rescator[dotc]cc &#8212; the same site that was first to sell cards stolen in the Home Depot and Target breaches &#8212; all traced back to customers who&#8217;d shopped at Sally Beauty locations nationwide. Asked about that pattern at the time, a company spokesperson said Sally Beauty had recently detected an intrusion into its network, but that neither its information technology experts nor an outside forensics firm could find evidence that customer card data had been stolen from the company’s systems.</p>
<p>But on March 17, 2014, Sally Beauty officially <a href="http://krebsonsecurity.com/2014/03/sally-beauty-confirms-card-data-breach/" target="_blank">confirmed a breach</a> of its network, but said its investigation determined that fewer than 25,000 card accounts were removed from its network. Nevertheless, a subsequent, <a href="http://krebsonsecurity.com/2014/03/zip-codes-show-extent-of-sally-beauty-breach/" target="_blank">exhaustive analysis</a> of the Sally Beauty store ZIP codes listed in the cards for sale on Rescator&#8217;s site indicated that the 2014 breach impacted virtually all 2,600+ Sally Beauty locations nationwide.</p>
<p>Sally Beauty is not alone in dealing with separate card compromise incidents in a short period of time. Last month, hotel franchise management firm White Lodging <a href="http://krebsonsecurity.com/2015/04/white-lodging-confirms-second-breach/" target="_blank">disclosed</a> that for the second time in a year, hackers had broken into point-of-sale systems at food and beverage outlets inside of many of its franchise locations.</p>
<p>It is possible that Sally Beauty locations are feeling the brunt of a large number of <a href="http://krebsonsecurity.com/2015/04/pos-providers-feel-brunt-of-poseidon-malware/" target="_blank">compromises at point-of-sale vendors</a>, such as the recently announced breach among <a href="http://krebsonsecurity.com/2015/05/harbortouch-is-latest-pos-vendor-breach/" target="_blank">Harbortouch</a> POS customers. However, at least two banks contacted by this author say the cards they were alerted to by Visa and MasterCard that correspond to the Harbortouch incident have very little overlap with the customer cards that were hit with fraudulent charges in the wake of their use at Sally Beauty locations recently.</p>


feed_id: http://krebsonsecurity.com/?p=30733
title: PayIvy Sells Your Online Accounts Via PayPal
uri: PayIvy-Sells-Your-Online-Accounts-Via-PayPal
url: http://krebsonsecurity.com/2015/05/payivy-sells-your-online-accounts-via-paypal/
content:
<p>Normally, if one wishes to buy stolen account credentials for paid online services like <strong>Netflix</strong>, <strong>Hulu</strong>, <strong>XBox</strong> <strong>Live</strong> or <strong>Spotify</strong>, the buyer needs to visit a cybercrime forum or drop into a dark Web marketplace that only accepts <strong>Bitcoin</strong> as payment. Increasingly, however, these accounts are showing up for sale at <strong>Payivy[dot]com</strong>, an open Web marketplace that happily accepts <strong>PayPal</strong> in exchange for a variety of stolen accounts.</p>
<div id="attachment_30866" style="width: 590px" class="wp-caption aligncenter"><a href="media/f8fedeb0.PayIvy-Netflix.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2015/05/PayIvy-Netflix.png"><img class="size-medium wp-image-30866" src="media/11833147.PayIvy-Netflix-580x376.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2015/05/PayIvy-Netflix-580x376.png" alt="A PayIvy seller advertising Netflix accounts for a dollar apiece." width="580" height="376" /></a><p class="wp-caption-text">A PayIvy seller advertising Netflix accounts for a dollar apiece. Unlike most sites selling hacked accounts, this one takes PayPal.</p></div>
<p>Marketed and sold by a <a href="http://krebsonsecurity.com/?s=hackforums&amp;x=0&amp;y=0" target="_blank">Hackforums</a> user named &#8220;<strong>Sh1eld</strong>&#8221; as a supposed method of selling ebooks and collecting payments for <a href="http://webcache.googleusercontent.com/search?q=cache:18Vj6BRy0okJ:www.hackforums.net/showthread.php%3Ftid%3D4514064+&amp;cd=9&amp;hl=en&amp;ct=clnk&amp;gl=us" target="_blank">affiliate marketers</a>, PayIvy has instead become a major conduit for hawking stolen accounts and credentials for a range of top Web services.</p>
<p>There is no central index of items for sale via PayIvy per se, but <a href="https://www.google.com/search?q=%22https%3A%2F%2Fpayivy.com%2Fv%2F%22&amp;rlz=1C1CHFX_enUS568US568&amp;oq=%22https%3A%2F%2Fpayivy.com%2Fv%2F%22&amp;aqs=chrome..69i57.519j0j4&amp;sourceid=chrome&amp;es_sm=93&amp;ie=UTF-8" target="_blank">this catalog of cached sales threads</a> offers a fairly representative glimpse: License keys for <strong>Adobe</strong> and <strong>Microsoft</strong> software products, user account credentials in bulk for services like Hulu, Netflix, Spotify, <strong>DirecTV</strong> and <strong>HBO Go</strong>, as well as a raft of gaming accounts at <strong>Origin</strong>, <strong>Steam</strong>, <strong>PlayStation</strong> and XBox Live. Other indexes at <a href="https://archive.is/payivy.com" target="_blank">archive.is</a> and <a href="http://www.reddit.com/domain/payivy.com/" target="_blank">PayIvy&#8217;s page at Reddit</a> reveal similar results.</p>
<p>It&#8217;s not clear how or why PayPal isn&#8217;t shutting down most of these merchants, but some of the sellers clearly are testing things to see how far they can push it: In just five minutes of searching online, I found several PayIvy sellers who were accepting PayPal payments via PayIvy for&#8230;wait for it&#8230;hijacked PayPal accounts! The fact that PayIvy takes PayPal as payment means that buyers can purchase hacked accounts with [stolen] credit cards &#8212; or, worse yet, stolen PayPal accounts.</p>
<p><strong>Jack Christin, Jr.</strong>, associate general counsel at PayPal, said while the site itself is not in violation of its Acceptable Use Policies (AUP), there have been cases where PayPal has identified accounts selling goods that violate its policy and in those cases, the company has exited those merchants from its system. <span id="more-30733"></span></p>
<p>&#8220;PayPal proactively monitors sellers with PayPal accounts who use the Paylvy platform to ensure the products they are selling are in compliance with our AUP, and we take appropriate action when violations are discovered,&#8221; Christin said.</p>
<p>The proprietor of PayIvy (quite possibly <a href="https://fbi.yt/dox/doxviewer.php?dox=Sh1eld_HF_UID_608523" target="_blank">this guy</a>, according to many of his fellow Hackforums users) <a href="http://webcache.googleusercontent.com/search?q=cache:czn75VCtREAJ:www.hackforums.net/printthread.php%3Ftid%3D4688501+&amp;cd=1&amp;hl=en&amp;ct=clnk&amp;gl=us" target="_blank">makes money</a> off of the service by selling &#8220;premium&#8221; accounts, which apparently offer repeat sellers a way to better track and manage their sales. Appropriately enough, among his ebook offerings via PayIvy is <a href="http://webcache.googleusercontent.com/search?q=cache:T9K1iebVazsJ:www.hackforums.net/archive/index.php/thread-4789593.html+&amp;cd=1&amp;hl=en&amp;ct=clnk" target="_blank">a tutorial</a> on how to avoid getting one&#8217;s account banned or limited by PayPal. PayIvy did not respond to requests for comment.</p>
<p>Sh1eld makes clear how he feels about his users selling hacked accounts to pay services via his site <a href="http://webcache.googleusercontent.com/search?q=cache:dYhrleB9Bw8J:www.hackforums.net/archive/index.php/thread-4701163.html+&amp;cd=1&amp;hl=en&amp;ct=clnk&amp;gl=us" target="_blank">in this thread</a>, where he posts about takedown requests from a company representing Netflix.</p>
<p>&#8220;We are not under any obligation to follow any site&#8217;s TOS [terms of service],&#8221; he wrote. &#8220;However, we will take actions regarding copyrighted content, malicious files, or child pornography.&#8221;</p>
<p>I wonder how this individual would feel about people selling stolen PayIvy premium accounts?</p>
<p>If you&#8217;re curious about the underground&#8217;s interest in and valuation of your online accounts, take a look at my primers on this subject, including <a href="http://krebsonsecurity.com/2013/06/the-value-of-a-hacked-email-account/" target="_blank">The Value of a Hacked Email Account</a> and the <a href="http://krebsonsecurity.com/2012/10/the-scrap-value-of-a-hacked-pc-revisited/" target="_blank">Value of a Hacked PC</a>. Want pointers on how to avoid becoming the next victim? Check out my <a href="http://krebsonsecurity.com/tools-for-a-safer-pc/" target="_blank">Tools for a Safer PC tutorial</a>.</p>
<p><strong>Update, 10:33 a.m. ET:</strong> PayIvy just sent the following message to all of its sellers: &#8220;Starting May 15th, PayIvy will be banning all netflix accounts. If you are still selling these accounts, we advice you to stop as your paypal account will be limited as part of PayPal AUP. You have 9 days to delete your Netflix products before we do a search and remove them ourselves.&#8221;</p>


feed_id: http://krebsonsecurity.com/?p=30872
title: Deconstructing the 2014 Sally Beauty Breach
uri: Deconstructing-the-2014-Sally-Beauty-Breach
url: http://krebsonsecurity.com/2015/05/deconstructing-the-2014-sally-beauty-breach/
content:
<p>This week, nationwide beauty products chain Sally Beauty disclosed that, for the second time in a year, it was investigating reports that hackers had broken into its networks and stolen customer credit card data. That investigation is ongoing, but I recently had an opportunity to interview a former Sally Beauty IT technician who provided a first-hand look at how the first breach in 2014 went down.</p>
<p><a href="media/98574501.sallyb.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/05/sallyb.png"><img class="alignright size-full wp-image-30895" src="media/98574501.sallyb.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/05/sallyb.png" alt="sallyb" width="309" height="190" /></a>On March 14, 2014, KrebsOnSecurity broke the news that some 260,000 credit cards stolen from Sally Beauty stores had gone up for sale on <strong>Rescator[dot]cc</strong>, the same shop that first debuted cards stolen in the Home Depot and Target breaches. The company said thieves made off with just 25,000 customer cards. But the shop selling the cards listed each by the ZIP code of the Sally Beauty store from which the card data had been stolen, exactly like this same shop did with <a href="http://krebsonsecurity.com/2014/09/data-nearly-all-u-s-home-depot-stores-hit/" target="_blank">Home Depot</a> and <a href="http://krebsonsecurity.com/2013/12/cards-stolen-in-target-breach-flood-underground-markets/" target="_blank">Target</a>. <a href="http://krebsonsecurity.com/2014/03/zip-codes-show-extent-of-sally-beauty-breach/" target="_blank">An exhaustive analysis</a> of the ZIP codes represented in the cards for sale on the fraud shop indicated that the hackers had hit virtually all 2,600 Sally Beauty locations nationwide.</p>
<p>The company never disclosed additional details about the breach itself or how it happened. But earlier this week I spoke with <strong>Blake Curlovic</strong>, until recently <a href="https://www.linkedin.com/in/bcurlovic" target="_blank">an application support analyst</a> at Sally Beauty who was among the first to respond when virtual alarm bells starting going off last year about a possible intrusion. Curlovic said that at the time, Sally Beauty was running exactly one enterprise solution for security &#8212; <a href="http;//www.tripwire.com" target="_blank">Tripwire</a> (full disclosure: Tripwire is an advertiser on this blog). Tripwire&#8217;s core product monitors key operating system and application files for any changes, which then triggers alerts.</p>
<p>Tripwire fired a warning when the intruders planted a new file on point-of-sale systems within Sally Beauty&#8217;s vast network of cash registers. The file was a program designed to steal card numbers as they were being swiped through the registers, and the attackers had named their malware after a legitimate program running on all Sally Beauty registers. They also used a utility called <a href="http://www.forensicswiki.org/wiki/Timestomp" target="_blank">Timestomp</a> to change the date and time stamp on their malware to match the legitimate file, but that apparently didn&#8217;t fool Tripwire.</p>
<p><span class="pullquote pqleft">According to Curlovic, the intruders gained access through a <a href="https://www.citrix.com/solutions/remote-access/overview.html" target="_blank">Citrix remote access portal</a> set up for use by employees who needed access to company systems while on the road.</span></p>
<p>&#8220;The attackers somehow had login credentials of a district manager,&#8221; Curlovic said. &#8220;This guy was not exactly security savvy. When we got his laptop back in, we saw that it had his username and password taped to the front of it.&#8221;</p>
<p>Once inside the Sally Beauty corporate network, the attackers scanned and mapped out the entire thing, located all shared drives and scoured those for Visual Basic (VB) scripts. Network administrators in charge of managing thousands or tens of thousands of systems often will write VB scripts to automate certain tasks across all of those systems, and very often those scripts will contain usernames and passwords that can be quite useful to attackers.</p>
<p>Curlovic said the intruders located a VB script on Sally Beauty&#8217;s network that contained the username and password of a network administrator at the company.</p>
<p>&#8220;That allowed them to basically copy files to the cash registers,&#8221; he said. &#8220;They used a simple batch file loop, put in all the [cash] register Internet addresses they found while scanning the network, looped through there and copied [the malware] to all of the point-of-sale devices &#8212; roughly 6,000 of them. They were in the network for like a week prior to that planning the attack.&#8221;</p>
<p><span id="more-30872"></span></p>
<p><span style="text-decoration: underline;">HIDING IN PLAIN SIGHT</span></p>
<p>Curlovic said <a href="https://www.virustotal.com/en/file/b51310638405845490ceff14d64939b119c93a24692228777358c03c5e4f4ffc/analysis/1430852251/#additional-info" target="_blank">the malware planted on Sally Beauty&#8217;s network</a> was identified (by some security vendors) as a variant of <strong>FrameworkPOS</strong>, a card-stealing program that exfiltrates data from the target&#8217;s network by transmitting it as domain name system (DNS) traffic.</p>
<p>DNS is the fundamental Internet technology that translates human-friendly domain names like example.com to numeric Internet addresses that are easier for computers to understand. All networks rely on DNS to help direct users as they surf online, but few organizations actually keep detailed logs or records of the DNS traffic traversing their networks &#8212; making it an ideal way to siphon data from a hacked network.</p>
<p>According to <a href="https://blog.gdatasoftware.com/blog/article/new-frameworkpos-variant-exfiltrates-data-via-dns-requests.html" target="_blank">a writeup of FrameworkPOS</a> by <strong>G Data,</strong> a security firm based in Germany, the card-stealing malware allows the attackers to dynamically configure the domain name to which the DNS traffic carrying the stolen card data will reach out. On top of that, the malware obfuscates the card data with <a href="http://en.wikipedia.org/wiki/XOR_cipher" target="_blank">a simple cipher</a> so that it won&#8217;t be immediately obvious as card data to anyone who happens to be examining the DNS traffic.</p>
<p>But Curlovic said despite its clever data-stealing methods, other parts of the malware were clumsily written. In fact, he said, one component of the malware actually broke the <a href="https://technet.microsoft.com/en-us/library/cc962284.aspx" target="_blank">Net Logon service</a> on infected point-of-sale systems, limiting the ability of the Sally Beauty cash registers to communicate with the rest of the company&#8217;s internal network. Net Logon is a Microsoft Windows component that verifies network log on requests.</p>
<p>&#8220;I don&#8217;t know technically what went wrong with their software, but Net Logon wouldn&#8217;t start anymore after it was installed,&#8221; Curlovic said. &#8220;We couldn&#8217;t log in remotely with domain credentials and registers couldn&#8217;t communicate out through DNS effectively after that. It was pretty huge indicator that something was seriously wrong at that point.&#8221;</p>
<p>As for Sally Beauty&#8217;s standing claim that only 25,000 customer cards were taken, Curlovic said he&#8217;d be surprised if it was limited to the 260,000 originally reported by this blog.</p>
<p>&#8220;From what I saw in the information that the Secret Service had, 260,000 was probably on the low end,&#8221; he said. &#8220;For the period of time the software was out on the registers and running, it should have been closer to around a million, based on the number of credit transactions Sally Beauty had daily. But since the malware really wasn&#8217;t working very well, it was only capturing a portion of the cards that went through because of the formatting issue that broke the Net Logon service.</p>
<p><span style="text-decoration: underline;">ANTI-AMERICAN MESSAGES</span></p>
<p>Curlovic said the malware used in the 2014 Sally Beauty breach communicated the stolen card data to several domains that were hosted in Ukraine, and that those domains mostly carried names that seemed to be crafted as verbal jabs at the United States.</p>
<div id="attachment_27761" style="width: 295px" class="wp-caption alignright"><a href="media/11091026.us-uk-sy-eg-ly.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/09/us-uk-sy-eg-ly.png"><img class="size-medium wp-image-27761" src="media/2224fe37.us-uk-sy-eg-ly-285x204.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/09/us-uk-sy-eg-ly-285x204.png" alt="One of the images linked to in the guts of malware used in the Home Depot breach." width="285" height="204" /></a><p class="wp-caption-text">One of the images linked to in the guts of malware used in the Home Depot breach.</p></div>
<p>Curlovic said he can&#8217;t recall exactly what the domains were, since he no longer has access to his notes at work, but that one of the domains was something close to &#8220;vx.anti-usa-proxy-war[dot]com.&#8221; Curlovic said he no longer has access to his notes because he was terminated from Sally Beauty about three weeks ago for reasons his former employer declined to share. He said he found out through a person at the local Denton, Texas unemployment office that someone in the company had accused him of accessing another employee&#8217;s computer without authorization. &#8220;That&#8217;s a pretty strange accusation to make, since the network administrator guys there all have access to everyone&#8217;s system on the network.&#8221;</p>
<p>In any case, the anti-US domains referenced by the card-stealing malware reinforce a suspicion long held by this author and other researchers: That the Sally Beauty breach was carried out by the same Russian and Ukrainian organized crime gang that stole more than 100 million credit and debit cards from both Home Depot and Target.</p>
<p>As I noted in <a href="http://krebsonsecurity.com/2014/09/home-depot-hit-by-same-malware-as-target/" target="_blank">a Sept. 7, 2014 story</a>, the malware used in the Home Depot breach included several interesting text strings that chastised the United States for its role in foreign conflicts, particularly in Libya and Ukraine.</p>
<blockquote><p>&#8220;Three of the links point to news, editorial articles and cartoons that accuse the United States of fomenting war and unrest in the name of Democracy in Ukraine, Syria, Egypt and Libya. One of the images shows four Molotov cocktails with the flags of those four nations on the bottles, next to a box of matches festooned with the American flag and match ready to strike. Another link leads to an image of the current armed conflict in Ukraine between Ukrainian forces and pro-Russian separatists.&#8221;</p>
<p>&#8220;This is interesting given what we know about Rescator, the individual principally responsible for running the store that is selling all of these stolen credit and debit cards. In the wake of the Target breach, I traced a long list of clues from Rescator’s various online identities <a title="http://krebsonsecurity.com/2013/12/whos-selling-credit-cards-from-target/" href="http://krebsonsecurity.com/2013/12/whos-selling-credit-cards-from-target/" target="_blank">back to a young programmer in Odessa, Ukraine</a>. In his many personas, Rescator identified himself as a member of <a title="http://krypt3ia.wordpress.com/2014/01/24/assessment-the-lampeduza-republic-organizational-structure/" href="http://krypt3ia.wordpress.com/2014/01/24/assessment-the-lampeduza-republic-organizational-structure/" target="_blank" rel="noreferrer">the Lampeduza cybercrime forum</a>, and indeed this site is where he <a title="http://krebsonsecurity.com/wp-content/uploads/2014/09/resc-as.png" href="media/9275885d.resc-as.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/09/resc-as.png" target="_blank">alerts customers about new batches of stolen cards</a>.&#8221;</p>
<p>&#8220;As I discovered in my profile of Rescator, he and his crew seemed somewhat taken with the late despotic Libyan leader <strong>Muammar Gaddafi, </strong>although they prefer the phonetic spelling of his name. The <a title="http://krebsonsecurity.com/wp-content/uploads/2014/09/kaddafi-login.png" href="media/3c906246.kaddafi-login.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/09/kaddafi-login.png" target="_blank">Web site kaddafi[dot]hk</a> was among four main carding shops run by Rescator’s crew (it has since been retired and merged with Rescator[dot]cc). The domain kaddafi[dot]me was set up to serve as an instant message Jabber server for cybercrooks, advertising its lack of logging and record keeping as a reason crooks should trust kaddafi[dot]me to handle their private online communications.&#8221;</p>
<p>&#8220;When I reached out to Rescator last December to obtain comment about my findings on his apparent role in the Target break-in, I received an instant message reply from the Jabber address “kaddafi@kaddafi[dot]me” (in that conversation, the person chatting with me from that address offered to pay me $10,000 if I did not run that story; I declined). But I also discovered that the kaddafi[dot]me domain was a blog of sorts that hosted some harsh and frankly chilling anti-American propaganda.&#8221;</p></blockquote>
<p>Curlovic said the incident response team cleaning up the 2014 breach at Sally Beauty found another curious clue in the malware that attackers planted on the point-of-sale devices. They discovered that the intruders had created two versions of the card-stealing malware &#8212; one designed for use on 32-bit Windows systems and another created for use on 64-bit versions of Windows. The authors of the malware had taken the time to add an icon to the 32-bit version of the program that could be seen if anyone opened the directory where the malware was placed: The icon was little more than a black background with &#8220;Res&#8221; written in white lettering.</p>
<p>This kind of signing also was seen in the malware used in the Target intrusion, which contained the following text string: &#8220;“z:\Projects\<strong>Rescator</strong>\uploader\Debug\scheck.pdb”.</p>


feed_id: http://krebsonsecurity.com/?p=30752
title: Who’s Scanning Your Network? (A: Everyone)
uri: Who-s-Scanning-Your-Network-(A-Everyone)
url: http://krebsonsecurity.com/2015/05/whos-scanning-your-network-a-everyone/
content:
<p>Not long ago I heard from a reader who wanted advice on how to stop someone from scanning his home network, or at least recommendations about to whom he should report the person doing the scanning. I couldn&#8217;t believe that people actually still cared about scanning, and I told him as much: These days there are countless entities &#8212; some benign and research-oriented, and some less benign &#8212; that are continuously mapping and cataloging virtually every device that&#8217;s put online.</p>
<p><a href="media/b826f250.GF5.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/05/GF5.png"><img class="alignright  wp-image-30923" src="media/b826f250.GF5.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/05/GF5.png" alt="GF5" width="238" height="190" /></a>One of the more benign is <a href="https://scans.io/" target="_blank">scans.io</a>, a data repository of research findings collected through continuous scans of the public Internet. The project, hosted by the <a href="https://zmap.io/" target="_blank">ZMap Team</a> at the <strong>University of Michigan</strong>, includes huge, regularly updated results grouped around scanning for Internet hosts running some of the most commonly used &#8220;ports&#8221; or network entryways, such as Port 443 (think Web sites protected by the lock icon denoting SSL/TLS Web site encryption); Port 21, or file transfer protocol (FTP); and Port 25, or simple mail transfer protocol (SMTP), used by many businesses to send email.</p>
<p>When I was first getting my feet wet on the security beat roughly 15 years ago, the practice of scanning networks you didn&#8217;t own looking for the virtual equivalent of open doors and windows was still fairly frowned upon &#8212; if not grounds to get one into legal trouble. These days, complaining about being scanned is about as useful as griping that the top of your home is viewable via <strong>Google Earth</strong>. Trying to put devices on the Internet and then hoping that someone or something won&#8217;t find them is one of the most futile exercises in security-by-obscurity.</p>
<p>To get a gut check on this, I spoke at length last week with University of Michigan researcher <strong>Zakir Durumeric </strong>(ZD) and <strong>Michael D. Bailey </strong>at the <strong>University of Illinois at Urbana-Champaign</strong> (MB) about their ongoing and very public project to scan all the Internet-facing things. I was curious to get their perspective on how public perception of widespread Internet scanning has changed over the years, and how targeted scanning can actually lead to beneficial results for Internet users as a whole.</p>
<p><strong>MB:</strong> Because of the historic bias against scanning and this debate between disclosure and security-by-obscurity, we&#8217;ve approached this very carefully. We certainly think that the benefits of publishing this information are huge, and that we&#8217;re just scratching the surface of what we can learn from it.</p>
<p><strong>ZD:</strong> Yes, there are close to two dozen papers published now based on broad, Internet-wide scanning. People who are more focused on comprehensive scans tend to be the more serious publications that are trying to do statistical or large-scale analyses that are complete, versus just finding devices on the Internet. It&#8217;s really been in the last year that we&#8217;ve started ramping up and adding scans [to the scans.io site] more frequently.</p>
<p><strong>BK: What are your short- and long-term goals with this project?</strong></p>
<p><strong>ZD:</strong> I think long-term we do want to add coverage of additional protocols. A lot of what we’re focused on is different aspects of a protocol. For example, if you&#8217;re looking at hosts running the &#8220;https://&#8221; protocol, there are many different ways you can ask questions depending on what perspective you come from. You see different attributes and behavior. So a lot of what we&#8217;ve done has revolved around https, which is of course hot right now within the research community.</p>
<p><strong>MB:</strong> I’m excited to add other protocols. There are a handful of protocols that are critical to operations of the Internet, and I&#8217;m very interested in understanding the deployment of DNS, BGP, and TLS&#8217;s interception with SMTP. Right now, there’s a pretty long tail to all of these protocols, and so that&#8217;s where it starts to get interesting. We&#8217;d like to start looking at things like programmable logic controllers (PLCs) and things that are responding from industrial control systems.</p>
<p><strong>ZD:</strong> One of the things we’re trying to pay more attention to is the world of embedded devices, or this &#8216;Internet of Things&#8217; phenomenon. As Michael said, there are also industrial protocols, and there are different protocols that these embedded devices are supporting, and I think we’ll continue to add protocols around that class of devices as well because from a security perspective it&#8217;s incredibly interesting which devices are popping up on the Internet.</p>
<p><strong>BK: What are some of the things you&#8217;ve found in your aggregate scanning results that surprised you?</strong></p>
<p><strong>ZD: </strong>I think one thing in the &#8220;https://&#8221; world that really popped out was we have this very large certificate authority ecosystem, and a lot of the attention is focused on a small number of authorities, but actually there is this very long tail &#8212; there are hundreds of certificate authorities that we don&#8217;t really think about on a daily basis, but that still have permission to sign for any Web site. That&#8217;s something we didn&#8217;t necessary expect. We knew there were a lot, but we didn&#8217;t really know what would come up until we looked at those.</p>
<p>There also was work we did a couple of years ago on cryptographic keys and how those are shared between devices. In one example, primes were being shared between RSA keys, and because of this we were able to factor a large number of keys, but we really wouldn&#8217;t have seen that unless we started to dig into that aspect [their research paper on this is available <a href="media/acec21c3.https-imc13.pdf" data-original-source="https://jhalderm.com/pub/papers/https-imc13.pdf" target="_blank">here</a>].</p>
<p><strong>MB:</strong> One of things we’ve been surprised about is when we measure these things at scale in a way that hasn&#8217;t been done before, often times these kinds of emergent behaviors become clear.</p>
<p><strong>BK: Talk about what you hope to do with all this data.</strong></p>
<p><strong>ZD:</strong> We were involved a lot in the analysis of the Heartbleed vulnerability. And one of the surprising developments there wasn&#8217;t that there were lots of people vulnerable, but it was interesting to see who patched, how and how quickly. What we were able to find was by taking the data from these scans and actually doing vulnerability notifications to everybody, we were able to increase patching for the Heartbleed bug by 50 percent. So there was an interesting kind of surprise there, not what you learn from looking at the data, but in terms of what actions do you take from that analysis? And that&#8217;s something we&#8217;re incredibly interested in: Which is how can we spur progress within the community to improve security, whether that be through vulnerability notification, or helping with configurations.</p>
<p><strong>BK: How do you know your notifications helped speed up patching?</strong></p>
<p><strong>MB:</strong> With the Heartbleed vulnerability, we took the known vulnerable population from scans, and ran an <a href="http://en.wikipedia.org/wiki/A/B_testing" target="_blank">A/B test.</a> We split the population that was vulnerable in half and notified one half of the population, while not notifying the other half, and then measured the difference in patching rates between the two populations. We did end up after a week notifying the second population&#8230;the other half.<span id="more-30752"></span></p>
<p><strong>BK: How many people did you notify after going through the data from the Heartbleed vulnerability scanning? </strong></p>
<p><strong>ZD: </strong>We took everyone on the IPv4 address space, found those that were vulnerable, and then contacted the registered abuse contact for each block of IP space. We used data from 200,000 hosts, which corresponded to 4,600 abuse contacts, and then we split those into an A/B test.<strong> </strong>[Their research on this testing was published <a href="media/e3fa9c69.heartbleed-imc14.pdf" data-original-source="https://jhalderm.com/pub/papers/heartbleed-imc14.pdf" target="_blank">here</a>].</p>
<p>So, that&#8217;s the other thing that&#8217;s really exciting about this data. Notification is one thing, but the other is we&#8217;ve been building models that are predictive of organizational behavior. So, if you can watch, for example, how an organization runs their Web server, how they respond to certificate revocation, or how fast they patch &#8212; that actually tells you something about the security posture of the organization, and you can start to build models of risk profiles of those organizations. It moves away from this sort of patch-and-break or patch-and-pray game we&#8217;ve been playing. So, that&#8217;s the other thing we&#8217;ve been starting to see, which is the potential for being more proactive about security.</p>
<p><strong>BK: How exactly do you go about the notification process? That&#8217;s a hard thing to do effectively and smoothly even if you already have a good relationship with the organization you&#8217;re notifying&#8230;.</strong></p>
<p><strong>MB:</strong> I think one of the reasons why the Heartbleed notification experiment was so successful is we did notifications on the heels of a broad vulnerability disclosure. The press and the general atmosphere and culture provided the impetus for people to be excited about patching. The overwhelming response we received from notifications associated with that were very positive. A lot of people we reached out to say, &#8216;Hey, this is a great, please scan me again, and let me know if I&#8217;m patched.&#8221; Pretty much everyone was excited to have the help.</p>
<p>Another interesting challenge was that we did some filtering as well in cases where the IP address had no known patches. So, for example, where we got information from a national CERT [Computer Emergency Response Team] that this was an embedded device for which there was no patch available, we withheld that notification because we felt it would do more harm than good since there was no path forward for them. We did some aggregation as well, because it was clear there were a lot of DSL and dial-up pools affected, and we did some notifications to ISPs directly.</p>
<p><strong>BK: You must get some pushback from people about being included in these scans. Do you think that idea that scanning is inherently bad or should somehow prompt some kind of reaction in and of itself, do you think that ship has sailed?</strong></p>
<p><strong>ZD:</strong> There is some small subset that does have issues. What we try to do with this is be as transparent as possible. All of our hosts we use for scanning, if look at them on WHOIS records or just visit them with a browser it will tell you right away that this machine is part of this research study, here&#8217;s the information we&#8217;re collecting and here&#8217;s how you can be excluded. A very small percentage of people who visit that page will read it and then contact us and ask to be excluded. If you send us an email [and request removal], we&#8217;ll remove you from all future scans. A lot of this comes down to education, a lot of people to whom we explain our process and motives are okay with it.</p>
<p><strong>BK: Are those that object and ask to be removed more likely to be companies and governments, or individuals?</strong></p>
<p><strong>ZD:</strong> It&#8217;s a mix of all of them. I do remember offhand there were a fair number of academic institutions and government organizations, but there were a surprising number of home users. Actually, when we <a href="media/61569848.scanning-sec14.pdf" data-original-source="https://jhalderm.com/pub/papers/scanning-sec14.pdf" target="_blank">broke down the numbers last year</a> (PDF), the largest category was small to mid-sized businesses. This time last year, we had excluded only 157 organizations that had asked for it.</p>
<p><strong>BK: Was there any pattern to those that asked to be excluded?</strong></p>
<p><strong>ZD:</strong> I think that actually is somewhat interesting: The exclusion requests aren&#8217;t generally coming from large corporations, which likely notice our scanning but don&#8217;t have an issue with it. A lot of emails we get are from these small businesses and organizations that really don&#8217;t know how to interpret their logs, and often times just choose the most conservative route.</p>
<p>So we&#8217;ve been scanning for a several years now, and I think when we originally started scanning, we expected to have all the people who were watching for this to contact us all at once, and say &#8221;Please exclude us.&#8217; And then we sort of expected that the number of people who&#8217;d ask to be excluded would plateau, and we wouldn&#8217;t have problems again. But what we&#8217;ve seen is, almost the exact opposite. We still get [exclusion request] emails each day, but what we&#8217;re really finding is people aren&#8217;t discovering these scans proactively. Instead, they&#8217;re going through their logs while trying to troubleshoot some other issue, and they see a scan coming from us there and they don&#8217;t know who we are or why we&#8217;re contacting their servers. And so it&#8217;s not these organizations that are watching, it&#8217;s the ones who really aren&#8217;t watching who are contacting us.</p>
<p><strong>BK: Do you guys go back and delete historic records associated with network owners that have asked to be excluded from scans going forward? </strong></p>
<p><strong>ZD:</strong> At this point we haven&#8217;t gone back and removed data. One reason is there are published research results that are based on those data sets, results, and so it&#8217;s very hard to change that information after the fact because if another researcher went back and tried to confirm an experiment or perform something similar, there would be no easy way of doing that.</p>
<p><strong>BK: Is this what you&#8217;re thinking about for the future of your project? How to do more notification and build on the data you have for those purposes? Or are you going in a different or additional direction?</strong></p>
<p><strong>MB:</strong> When I think about the ethics of this kind of activity, I have very utilitarian view: I&#8217;m interested in doing as much good as we possibly can with the data we have. I think that lies in notifications, being proactive, helping organizations that run networks to better understand what their external posture looks like, and in building better safe defaults. But I&#8217;m most interested in a handful of core protocols that are under-serviced and not well understood. And so I think we should spend a majority of effort focusing on a small handful of those, including BGP, TLS, and DNS.</p>
<p><strong>ZD:</strong> In many ways, we’re just kind of at the tip of this iceberg. We&#8217;re just starting to see what types of security questions we can answer from these large-scale analyses. I think in terms of notifications, it&#8217;s very exciting that there are things beyond the analysis that we can use to actually trigger actions, but that&#8217;s something that clearly needs a lot more analysis. The challenge is learning how to do this correctly. Every time we look at another protocol, we start seeing these weird trends and behavior we never noticed before. With every protocol we look at there are these endless questions that seem to need to be answered. And at this point there are far more questions than we have hours in the day to answer.</p>


feed_id: http://krebsonsecurity.com/?p=30943
title: Adobe, Microsoft Push Critical Security Fixes
uri: 2015-05-13-Adobe-Microsoft-Push-Critical-Security-Fixes
url: http://krebsonsecurity.com/2015/05/adobe-microsoft-push-critical-security-fixes-7/
content:
<p><strong>Microsoft</strong> today issued 13 patch bundles to fix roughly four dozen security vulnerabilities in <strong>Windows</strong> and associated software. Separately, <strong>Adobe</strong> pushed updates to fix a slew of critical flaws in its <strong>Flash Player</strong> and <strong>Adobe Air</strong> software, as well as patches to fix holes in <strong>Adobe Reader</strong> and <strong>Acrobat</strong>.</p>
<p><a href="media/d85cffb4.brokenwindows.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/07/brokenwindows.png"><img class="alignright  wp-image-26837" src="media/d85cffb4.brokenwindows.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/07/brokenwindows.png" alt="brokenwindows" width="187" height="196" /></a>Three of the Microsoft patches earned the company&#8217;s most dire &#8220;critical&#8221; rating, meaning they fix flaws that can be exploited to break into vulnerable systems with little or no interaction on the part of the user. The critical patches plug at least 30 separate flaws. The majority of those are included in <a href="https://technet.microsoft.com/library/security/ms15-043" target="_blank">a cumulative update</a> for Internet Explorer. Other critical fixes address problems with the Windows OS, <strong>.NET</strong>, <strong>Microsoft Office</strong>, and <strong>Silverlight</strong>, among other components.</p>
<p>According to security vendor <strong>Shavlik</strong>, the issues address in <a href="https://technet.microsoft.com/library/security/ms15-044" target="_blank">MS15-044</a> deserve special priority in patching, in part because it impacts so many different Microsoft programs but also because the vulnerabilities fixed in the patch can be exploited merely by viewing specially crafted content in a Web page or a document. More information on and links to today&#8217;s individual updates can be found <a href="http://blogs.msmvps.com/donpatterson/2015/05/12/microsoft-security-bulletins-for-may-12-2015/" target="_blank">here</a><a href="media/06f26f56.brokenflash-a.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2013/02/brokenflash-a.png">.</a></p>
<p>Adobe&#8217;s fix for Flash Player and AIR fix at least 18 security holes in the programs. Updates are available for Windows, OS X and Linux versions of the software. Mac and Windows users, the latest, patched version is <em>v. 17.0.0.188. </em><span id="more-30943"></span></p>
<p>If you’re unsure whether your browser has Flash installed or what version it may be running, browse to <a title="https://www.adobe.com/software/flash/about/" href="https://www.adobe.com/software/flash/about/" target="_blank">this link</a>. Adobe Flash Player installed with <strong>Google Chrome</strong>, as well as <strong>Internet Explorer</strong> on <strong>Windows 8.x</strong>, should automatically update to the latest version. To force the installation of an available update, click the triple bar icon to the right of the address bar, select “About Google” Chrome, click the apply update button and restart the browser.</p>
<p><img class="alignleft size-full wp-image-18875" src="media/06f26f56.brokenflash-a.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2013/02/brokenflash-a.png" alt="brokenflash-a" width="211" height="180" /></p>
<p>The most recent versions of Flash should be available from the <a title="http://get.adobe.com/flashplayer/" href="http://get.adobe.com/flashplayer/" target="_blank">Flash home page</a>, but beware potentially unwanted add-ons, like <strong>McAfee Security Scan</strong>. To avoid this, uncheck the pre-checked box before downloading, or grab your OS-specific Flash download from <a title="https://www.adobe.com/products/flashplayer/distribution3.html" href="https://www.adobe.com/products/flashplayer/distribution3.html" target="_blank">here</a>. Windows users who browse the Web with anything other than Internet Explorer may need to apply this patch twice, once with IE and again using the alternative browser (<strong>Firefox</strong>, <strong>Opera</strong>, e.g.).</p>
<p>If you run <a href="https://helpx.adobe.com/security/products/reader/apsb15-10.html" target="_blank">Adobe Reader</a>, <a href="https://helpx.adobe.com/security/products/acrobat/apsb15-10.html" target="_blank">Acrobat</a> or AIR, you&#8217;ll need to update those programs as well. Adobe said it is not aware of any active exploits or attacks against any of the vulnerabilities it patched with today&#8217;s releases.</p>


feed_id: http://krebsonsecurity.com/?p=30913
title: Mobile Spyware Maker mSpy Hacked, Customer Data Leaked
uri: Mobile-Spy-Software-Maker-mSpy-Hacked-Customer-Data-Leaked
url: http://krebsonsecurity.com/2015/05/mobile-spy-software-maker-mspy-hacked-customer-data-leaked/
content:
<p><b>mSpy</b>, the makers of a dubious software-as-a-service product that claims to help more than two million people spy on the mobile devices of their kids and partners, appears to have been massively hacked. Last week, a huge trove of data apparently stolen from the company&#8217;s servers was posted on the Deep Web, exposing countless emails, text messages, payment and location data on an undetermined number of mSpy &#8220;users.&#8221;</p>
<p>mSpy has not responded to multiple requests for comment left for the company over the past five days. KrebsOnSecurity learned of the apparent breach from an anonymous source who shared a link to a Web page that is only reachable via <a href="https://www.torproject.org/" target="_blank">Tor</a>, a technology that helps users hide their true Internet address and allows users to host Web sites that are extremely difficult to get taken down.</p>
<div id="attachment_30950" style="width: 590px" class="wp-caption aligncenter"><a href="media/558e910f.mspyreamde.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/05/mspyreamde.png"><img class="size-medium wp-image-30950" src="media/be1aff94.mspyreamde-580x152.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/05/mspyreamde-580x152.png" alt="The Tor-based Web site hosting content stolen from mobile devices running Mspy." width="580" height="152" /></a><p class="wp-caption-text">The Tor-based Web site hosting content stolen from mobile devices running mSpy.</p></div>
<p>The Tor-based site hosts several hundred gigabytes worth of data taken from mobile devices running mSpy&#8217;s products, including some four million events logged by the software. The message left by the unknown hackers who&#8217;ve claimed responsibility for this intrusion suggests that the data dump includes information on more than 400,000 users, including <strong>Apple IDs</strong> and passwords, tracking data, and payment details on some 145,000 successful transactions.</p>
<p>The exact number of mSpy users compromised could not be confirmed, but one thing is clear: There is a crazy amount of personal and sensitive data in this cache, including photos, calendar data, corporate email threads, and very private conversations. Also included in the data dump are thousands of support request emails from people around the world who paid between $8.33 to as much as $799 for a variety of subscriptions to mSpy&#8217;s surveillance software.</p>
<div id="attachment_30952" style="width: 590px" class="wp-caption aligncenter"><a href="media/a2e179c3.mspydemo.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/05/mspydemo.png"><img class="size-medium wp-image-30952" src="media/143fb17e.mspydemo-580x450.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/05/mspydemo-580x450.png" alt="Mspy users can track Android and iPhone users, snoop on apps like Snapchat and Skype, and keep a record of every key the user types." width="580" height="450" /></a><p class="wp-caption-text">mSspy users can track the exact location of Android and iPhone users, snoop on apps like Snapchat and Skype, and keep a record of every word the user types.</p></div>
<p>It&#8217;s unclear exactly where mSpy is based; the company&#8217;s Web site suggests it has offices in the United States, Germany and the United Kingdom, although the firm does not appear to list an official physical address. However, according to historic Web site registration records, the company is tied to a now-defunct firm called <strong>MTechnology LTD</strong> out of the United Kingdom.<span id="more-30913"></span></p>
<p>Documents obtained from <strong>Companies House</strong>, an official register of corporations in the U.K., indicate that the two founding members of the company are self-described programmers <strong>Aleksey Fedorchuk</strong> and <strong>Pavel Daletski</strong>. Those <a href="media/d1816241.OfficersMspy.pdf" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/05/OfficersMspy.pdf" target="_blank">records</a> (PDF) indicate that Daletski is a British citizen, and that Mr. Fedorchuk is from Russia. Neither of the men could be reached for comment.</p>
<p><a href="media/315eae69.DaletskiTrademarkcase.pdf" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2015/05/DaletskiTrademarkcase.pdf" target="_blank">Court documents</a> (PDF) obtained from the U.S. District Court in Jacksonville, Fla. regarding a trademark dispute involving mSpy and Daletski state that mSpy has a U.S.-based address of 800 West El Camino Real, in Mountain View, Calif. Those same court documents indicate that Daletski is a director at a firm based in the Seychelles called <strong>Bitex Group LTD. </strong>Interestingly, that lawsuit was brought by <strong>Retina-X Studios</strong>, an mSpy competitor based in Jacksonville, Fla. that makes a product called <strong>MobileSpy</strong>.</p>
<p>U.S. regulators and law enforcers have taken a dim view of companies that offer mobile spyware services like mSpy. In September 2014, U.S. authorities <a href="http://www.forbes.com/sites/kashmirhill/2014/09/30/stealthgenie-ugly-marketing-of-spyware/" target="_blank">arrested</a> a 31-year-old <strong>Hammad Akbar</strong>, the CEO of a Lahore-based company that makes a spyware app called StealthGenie. The FBI noted that while the company advertised StealthGenie&#8217;s use for &#8220;monitoring employees and loved ones such as children,&#8221; the primary target audience was people who thought their partners were cheating. Akbar was charged with selling and advertising wiretapping equipment.</p>
<p>&#8220;Advertising and selling spyware technology is a criminal offense, and such conduct will be aggressively pursued by this office and our law enforcement partners,&#8221; <strong>U.S. Attorney Dana Boente</strong> said in a press release tied to Akbar&#8217;s indictment.</p>
<p>Akbar <a href="http://www.justice.gov/opa/pr/man-pleads-guilty-selling-stealthgenie-spyware-app-and-ordered-pay-500000-fine" target="_blank">pleaded guilty</a> to the charges in November 2014, and according to the Justice Department he is &#8220;the first-ever person to admit criminal activity in advertising and selling spyware that invades an unwitting victim&#8217;s confidential communications.&#8221;</p>
<p>Unlike Akbar&#8217;s StealthGenie and some other mobile spyware products, mSpy advertises that its product works even on <a href="http://www.mspy.com/compatibility.html" target="_blank">non-jailbroken iPhones</a>, giving users the ability to log the device holder&#8217;s contacts, call logs, text messages, browser history, events and notes.</p>
<p>&#8220;If you have opted to purchase mSpy Without Jailbreak, and you have the mobile user’s iCloud credentials, you will not need physical access to the device,&#8221; the company&#8217;s FAQ states. &#8220;However, there may be some instances where physical access may be necessary.<span style="font-size: 13.3333330154419px; line-height: 20px;"> </span>If you purchase mSpy for a jailbroken iOS phone or tablet, you will need 5-15 minutes of physical access to the device for successful installation.&#8221;</p>
<p>A public relations pitch from mSpy to KrebsOnSecurity in March 2015 stated that approximately 40 percent of the company&#8217;s users are parents interested in keeping tabs on their kids. Assuming that is a true statement, it&#8217;s ironic that so many parents have now unwittingly exposed their kids to predators, bullies and other ne&#8217;er-do-wells thanks to this breach.</p>


