# articles

feed_id: https://krebsonsecurity.com/?p=42552
title: New EU Privacy Law May Weaken Security
uri: New-EU-Privacy-Law-May-Weaken-Security
url: https://krebsonsecurity.com/2018/02/new-eu-privacy-law-may-weaken-security/
content:
<p>Companies around the globe are scrambling to comply with new European privacy regulations that take effect a little more than three months from now. But many security experts are worried that the changes being ushered in by the rush to adhere to the law may make it more difficult to track down cybercriminals and less likely that organizations will be willing to share data about new online threats.</p>
<p>On May 25, 2018, the <a href="https://gdpr-info.eu/" target="_blank" rel="noopener">General Data Protection Regulation</a> (GDPR) takes effect. The law, enacted by the European Parliament, requires technology companies to get affirmative consent for any information they collect on people within the European Union. Organizations that violate the GDPR could face fines of <em>up to four percent of global annual revenues</em>.</p>
<p><img class="aligncenter wp-image-42559" src="media/03721200.whois.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/02/whois.png" alt="" width="598" height="118" /></p>
<p>In response, the <a href="https://www.icann.org/" target="_blank" rel="noopener">Internet Corporation for Assigned Names and Numbers</a> (ICAAN) &#8212; the nonprofit entity that manages the global domain name system &#8212; is poised to propose changes to the rules governing how much personal information Web site name registrars can collect and who should have access to the data.</p>
<p>Specifically, ICANN has been seeking feedback on a range of proposals to redact information provided in WHOIS, the system for querying databases that store the registered users of domain names and blocks of Internet address ranges (IP addresses).</p>
<p>Under current ICANN rules, domain name registrars should collect and display a variety of data points when someone performs a WHOIS lookup on a given domain, such as the registrant&#8217;s name, address, email address and phone number. (Most registrars offer a privacy protection service that shields this information from public WHOIS lookups; some registrars charge a nominal fee for this service, while others offer it for free).</p>
<p>In a bid to help domain registrars comply with the GDPR regulations, ICANN has floated several proposals, all of which would redact some of the registrant data from WHOIS records. Its mildest proposal would remove the registrant&#8217;s name, email, and phone number, while allowing self-certified 3rd parties to request access to said data at the approval of a higher authority &#8212; such as the registrar used to register the domain name.</p>
<p>The most restrictive proposal would remove all registrant data from public WHOIS records, and would require legal due process (such as a subpoena or court order) to reveal any information supplied by the domain registrant.</p>
<div id="attachment_42554" style="width: 609px" class="wp-caption aligncenter"><a class="lightbox" href="media/c1f2370a.icannGDPRcompliancemodels.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/02/icannGDPRcompliancemodels.png"><img class="wp-image-42554" src="media/c1f2370a.icannGDPRcompliancemodels.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/02/icannGDPRcompliancemodels.png" alt="" width="599" height="390" /></a><p class="wp-caption-text">ICANN&#8217;s various proposed models for redacting information in WHOIS domain name records.</p></div>
<p>The full text of ICANN&#8217;s latest proposed models (from which the screenshot above was taken) can be found <a href="media/e9fc8b7a.interim-models-gdpr-compliance-12jan18-en.pdf" data-original-source="https://www.icann.org/en/system/files/files/interim-models-gdpr-compliance-12jan18-en.pdf" target="_blank" rel="noopener">here</a> (PDF). A diverse ICANN working group made up of privacy activists, technologists, lawyers, trademark holders and security experts has been arguing about these details since 2016. For the curious and/or intrepid, the entire archive of those debates up to the current day is available at <a href="http://mm.icann.org/pipermail/gnso-rds-pdp-wg/" target="_blank" rel="noopener">this link</a>.</p>
<h4>WHAT IS THE WHOIS DEBATE?</h4>
<p>To drastically simplify the discussions into two sides, those in the privacy camp say WHOIS records are being routinely plundered and abused by all manner of ne&#8217;er-do-wells, including spammers, scammers, phishers and stalkers. In short, their view seems to be that the availability of registrant data in the WHOIS records causes more problems than it is designed to solve.</p>
<p>Meanwhile, security experts are arguing that the data in WHOIS records has been indispensable in tracking down and bringing to justice those who seek to perpetrate said scams, spams, phishes and&#8230;.er&#8230;.stalks.<span id="more-42552"></span></p>
<p>Many privacy advocates seem to take a dim view of any ICANN system by which third parties (and not just law enforcement officials) might be vetted or accredited to look at a domain registrant&#8217;s name, address, phone number, email address, etc. This sentiment is captured in public comments made by the <a href="https://www.eff.org" target="_blank" rel="noopener">Electronic Frontier Foundation</a>&#8216;s <strong>Jeremy Malcolm</strong>, who argued that &#8212; even if such information were only limited to anti-abuse professionals &#8212; this also wouldn&#8217;t work.</p>
<p>&#8220;There would be nothing to stop malicious actors from identifying as anti-abuse professionals &#8211; neither would want to have a system to &#8216;vet&#8217; anti-abuse professionals, because that would be even more problematic,&#8221; Malcolm <a href="http://mm.icann.org/pipermail/gnso-rds-pdp-wg/2017-October/004480.html" target="_blank" rel="noopener">wrote in October 2017</a>. &#8220;There is no added value in collecting personal information &#8211; after all, criminals are not going to provide correct information anyway, and if a domain has been compromised then the personal information of the original registrant isn&#8217;t going to help much, and its availability in the wild could cause significant harm to the registrant.&#8221;</p>
<p>Anti-abuse and security experts <a href="http://mm.icann.org/pipermail/gnso-rds-pdp-wg/2017-October/004489.html" target="_blank" rel="noopener">counter</a> that there are endless examples of people involved in spam, phishing, malware attacks and other forms of cybercrime who include details in WHOIS records that are extremely useful for tracking down the perpetrators, disrupting their operations, or building reputation-based systems (such as anti-spam and anti-malware services) that seek to filter or block such activity.</p>
<p>Moreover, they <a href="http://mm.icann.org/pipermail/gnso-rds-pdp-wg/2017-October/004486.html" target="_blank" rel="noopener">point out</a> that the overwhelming majority of phishing is performed with the help of compromised domains, and that the primary method for cleaning up those compromises is using WHOIS data to contact the victim and/or their hosting provider.</p>
<p>Many commentators observed that, in the end, ICANN is likely to proceed in a way that covers its own backside, and that of its primary constituency &#8212; domain registrars. Registrars pay a fee to ICANN for each domain a customer registers, although <a href="http://www.domainpulse.com/2017/12/21/icann-facing-budget-cuts-as-expected-income-doesnt-materialise/" target="_blank" rel="noopener">revenue from those fees has been falling of late</a>, forcing ICANN to make <a href="https://www.icann.org/news/blog/president-s-corner-finances-planning-for-the-next-two-years" target="_blank" rel="noopener">significant budget cuts</a>.</p>
<p>Some critics of the WHOIS privacy effort have voiced the opinion that the registrars generally view public WHOIS data as a nuisance issue for their domain registrant customers and an unwelcome cost-center (from being short-staffed to field a constant stream of abuse complaints from security experts, researchers and others in the anti-abuse community).</p>
<p><span class="pullquote pqleft">&#8220;Much of the registrar market is a race to the bottom, and the ability of ICANN to police the contractual relationships in that market effectively has not been well-demonstrated over time,&#8221; commenter <a href="https://icannwiki.org/Andrew_Sullivan">Andrew Sullivan</a> <a href="http://mm.icann.org/pipermail/gnso-rds-pdp-wg/2017-October/004487.html" target="_blank" rel="noopener">observed</a>.</span></p>
<p>In any case, sources close to the debate tell KrebsOnSecurity that ICANN is poised to recommend a WHOIS model loosely based on Model 1 in the chart above.</p>
<p>Specifically, the system that ICANN is planning to recommend, according to sources, would ask registrars and registries to display just the domain name, city, state/province and country of the registrant in each record; the public email addresses would be replaced by a form or message relay link that allows users to contact the registrant. The source also said ICANN plans to leave it up to the registries/registrars to apply these changes globally or only to natural persons living in the <a href="https://www.gov.uk/eu-eea" target="_blank" rel="noopener">European Economic Area</a> (EEA).</p>
<p>In addition, sources say non-public WHOIS data would be accessible via a credentialing system to identify law enforcement agencies and intellectual property rights holders. However, it&#8217;s unlikely that such a system would be built and approved before the May 25, 2018 effectiveness date for the GDPR, so the rumor is that ICANN intends to propose a self-certification model in the meantime.</p>
<p>ICANN spokesman <strong>Brad White</strong> declined to confirm or deny any of the above, referring me instead to <a href="https://www.icann.org/news/blog/data-protection-privacy-update-latest-developments" target="_blank" rel="noopener">a blog post</a> published Tuesday evening by ICANN <strong>CEO Göran Marby</strong>. That post does not, however, clarify which way ICANN may be leaning on the matter.</p>
<p style="font-weight: 400;">&#8220;Our conversations and work are on-going and not yet final,&#8221; White wrote in a statement shared with KrebsOnSecurity. &#8220;We are converging on a final interim model as we continue to engage, review and assess the input we receive from our stakeholders and Data Protection Authorities (PDAs).&#8221;</p>
<p>But with the GDPR compliance deadline looming, some registrars are moving forward with their own plans on WHOIS privacy. <strong>GoDaddy</strong>, one of the world&#8217;s largest domain registrars, recently began redacting most registrant data from WHOIS records for domains that are queried via third-party tools. And it seems likely that other registrars will follow GoDaddy&#8217;s lead.</p>
<h4>ANALYSIS</h4>
<p>For my part, I can say without hesitation that few resources are as critical to what I do here at KrebsOnSecurity than the data available in the public WHOIS records. WHOIS records are incredibly useful signposts for tracking cybercrime, and they frequently allow KrebsOnSecurity to break important stories about the connections between and identities behind various cybercriminal operations and the individuals/networks actively supporting or enabling those activities. I also very often rely on WHOIS records to locate contact information for potential sources or cybercrime victims who may not yet be aware of their victimization.</p>
<p>In a great many cases, I have found that clues about the identities of those who perpetrate cybercrime can be found by following a trail of information in WHOIS records that predates their cybercriminal careers. Also, even in cases where online abusers provide intentionally misleading or false information in WHOIS records, that information is still extremely useful in mapping the extent of their malware, phishing and scamming operations.</p>
<p>Anyone looking for copious examples of both need only to <a href="https://krebsonsecurity.com/?s=whois&amp;x=0&amp;y=0" target="_blank" rel="noopener">search this Web site for the term &#8220;WHOIS,&#8221;</a> which yields dozens of stories and investigations that simply would not have been possible without the data currently available in the global WHOIS records.</p>
<p>Many privacy activists involved in to the WHOIS debate have argued that other data related to domain and Internet address registrations &#8212; such as name servers, Internet (IP) addresses and registration dates &#8212; should also be considered private information. My chief concern if this belief becomes more widely held is that security companies might stop sharing such information for fear of violating the GDPR, thus hampering the important work of anti-abuse and security professionals.</p>
<p>This is hardly a theoretical concern. Last month I heard from a security firm based in the European Union regarding a new Internet of Things (IoT) botnet they&#8217;d discovered that was unusually complex and advanced. Their outreach piqued my curiosity because I had already been working with a researcher here in the United States who was investigating a similar-sounding IoT botnet, and I wanted to know if my source and the security company were looking at the same thing.</p>
<p>But when I asked the security firm to share a list of Internet addresses related to their discovery, they told me they could not do so because IP addresses could be considered private data &#8212; even after I assured them I did not intend to publish the data.</p>
<p>&#8220;According to many forums, IPs should be considered personal data as it enters the scope of &#8216;online identifiers&#8217;,&#8221; the researcher wrote in an email to KrebsOnSecurity, declining to answer questions about whether their concern was related to provisions in the GDPR specifically.  &#8220;Either way, it&#8217;s IP addresses belonging to people with vulnerable/infected devices and sharing them may be perceived as bad practice on our end. We consider the list of IPs with infected victims to be private information at this point.&#8221;</p>
<p>Certainly as the Internet matures and big companies develop ever more intrusive ways to hoover up data on consumers, we also need to rein in the most egregious practices while giving Internet users more robust tools to protect and preserve their privacy. In the context of Internet security and the privacy principles envisioned in the GDPR, however, I&#8217;m worried that cybercriminals may end up being the biggest beneficiaries of this new law.</p>


feed_id: https://krebsonsecurity.com/?p=42589
title: IRS Scam Leverages Hacked Tax Preparers, Client Bank Accounts
uri: IRS-Scam-Leverages-Hacked-Tax-Preparers-Client-Bank-Accounts
url: https://krebsonsecurity.com/2018/02/irs-scam-leverages-hacked-tax-preparers-client-bank-accounts/
content:
<p>Identity thieves who specialize in tax refund fraud have been busy of late hacking online accounts at multiple tax preparation firms, using them to file phony refund requests. Once the <strong>Internal Revenue Service</strong> processes the return and deposits money into bank accounts of the hacked firms&#8217; clients, the crooks contact those clients posing as a collection agency and demand that the money be &#8220;returned.&#8221;</p>
<p>In one version of the scam, criminals are pretending to be debt collection agency officials acting on behalf of the IRS. They&#8217;ll call taxpayers who&#8217;ve had fraudulent tax refunds deposited into their bank accounts, claim the refund was deposited in error, and threaten recipients with criminal charges if they fail to forward the money to the collection agency.</p>
<p>This is exactly what happened to a number of customers at a half dozen banks in Oklahoma earlier this month. <strong>Elaine Dodd</strong>, executive vice president of the fraud division at the <a href="https://www.oba.com" target="_blank" rel="noopener">Oklahoma Bankers Association</a>, said many financial institutions in the Oklahoma City area had &#8220;a good number of customers&#8221; who had large sums deposited into their bank accounts at the same time.</p>
<p>Dodd said the bank customers received hefty deposits into their accounts from the <strong>U.S. Treasury</strong>, and shortly thereafter were contacted by phone by someone claiming to be a collections agent for a firm calling itself <strong>DebtCredit</strong> and using the Web site name <strong>debtcredit[dot]us</strong>.</p>
<p>&#8220;We&#8217;re having customers getting refunds they have not applied for,&#8221; Dodd said, noting that the transfers were traced back to a local tax preparer who&#8217;d apparently gotten phished or hacked. Those banks are now working with affected customers to close the accounts and open new ones, Dodd said. &#8220;If the crooks have breached a tax preparer and can send money to the client, they can sure enough pull money out of those accounts, too.&#8221;</p>
<div id="attachment_42606" style="width: 609px" class="wp-caption aligncenter"><a class="lightbox" href="media/d3a758c2.dandcirs.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/02/dandcirs.png"><img class="wp-image-42606" src="media/d3a758c2.dandcirs.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/02/dandcirs.png" alt="" width="599" height="592" /></a><p class="wp-caption-text">Several of the Oklahoma bank&#8217;s clients received customized notices from a phony company claiming to be a collections agency hired by the IRS.</p></div>
<p>The domain debtcredit[dot]us hasn&#8217;t been active for some time, but an exact copy of the site to which the bank&#8217;s clients were referred by the phony collection agency can be found at <strong>jcdebt[dot]com </strong>&#8212; a domain that was registered less than a month ago. The site purports to be associated with a company in New Jersey called <strong>Debt &amp; Credit Consulting Services</strong>, but according to <a href="media/d367ab1c.BE_StatusReport_0600244350_80471341339.pdf" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/02/BE_StatusReport_0600244350_80471341339.pdf" target="_blank" rel="noopener">a record</a> (PDF) retrieved from the New Jersey Secretary of State&#8217;s office, that company&#8217;s business license was revoked in 2010.</p>
<p>&#8220;You may be puzzled by an erroneous payment from the Internal Revenue Service but in fact it is quite an ordinary situation,&#8221; reads the HTML page shared with people who received the fraudulent IRS refunds. It includes a video explaining the matter, and references a case number, the amount and date of the transaction, and provides a list of personal &#8220;data reported by the IRS,&#8221; including the recipient&#8217;s name, Social Security Number (SSN), address, bank name, bank routing number and account number.</p>
<p>All of these details no doubt are included to make the scheme look official; most recipients will never suspect that they received the bank transfer because their accounting firm got hacked.</p>
<p>The scammers even supposedly assign the recipients an individual &#8220;appointed debt collector,&#8221; complete with a picture of the employee, her name, telephone number and email address. However, the emails to the domain used in the email address from the screenshot above (debtcredit[dot]com) bounced, and no one answers at the provided telephone number.</p>
<p>Along with the Web page listing the recipient&#8217;s personal and bank account information, each recipient is given a &#8220;transaction error correction letter&#8221; with IRS letterhead (see image below) that includes many of the same personal and financial details on the HTML page. It also gives the recipient instructions on the account number, ACH routing and wire number to which the wayward funds are to be wired.</p>
<div id="attachment_42594" style="width: 599px" class="wp-caption aligncenter"><img class="size-full wp-image-42594" src="media/cd9a89f0.fakeirsletter.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/02/fakeirsletter.png" alt="" width="589" height="702" /><p class="wp-caption-text">A phony letter from the IRS instructing recipients on how and where to wire the money that was deposited into their bank account as a result of a fraudulent tax refund request filed in their name.</p></div>
<p><span id="more-42589"></span>Tax refund fraud affects hundreds of thousands, if not millions, of U.S. citizens annually. Victims usually first learn of the crime after having their returns rejected because scammers beat them to it. Even those who are not required to file a return can be victims of refund fraud, as can those who are not actually due a refund from the IRS.</p>
<p>On Feb. 2, 2018, the IRS <a href="https://www.irs.gov/newsroom/tax-pros-urged-to-step-up-security-as-filing-scheme-emerges-reminded-to-report-data-thefts" target="_blank" rel="noopener">issued a warning</a> to tax preparers, urging them to step up their security in light of increased attacks. On Feb. 13, the IRS <a href="https://www.irs.gov/newsroom/scam-alert-irs-urges-taxpayers-to-watch-out-for-erroneous-refunds-beware-of-fake-calls-to-return-money-to-a-collection-agency" target="_blank" rel="noopener">warned</a> that phony refunds through hacked tax preparation accounts are a &#8220;quickly growing scam.&#8221;</p>
<p>&#8220;Thieves know it is more difficult to identify and halt fraudulent tax returns when they are using real client data such as income, dependents, credits and deductions,&#8221; the agency noted in the Feb. 2 alert. &#8220;Generally, criminals find alternative ways to get the fraudulent refunds delivered to themselves rather than the real taxpayers.&#8221;</p>
<p>The IRS says taxpayer who receive fraudulent transfers from the IRS should contact their financial institution, as the account may need to be closed (because the account details are clearly in the hands of cybercriminals). Taxpayers receiving erroneous refunds also should consider contacting their tax preparers immediately.</p>
<p>If you go to file your taxes electronically this year and the return is rejected, it may mean fraudsters have beat you to it. The IRS advises taxpayers in this situation to follow the steps outlined in the <a title="Taxpayer Guide to Identity Theft" href="https://www.irs.gov/newsroom/taxpayer-guide-to-identity-theft" data-entity-substitution="canonical" data-entity-type="node" data-entity-uuid="18414626-226d-4da0-999e-6418a0264534">Taxpayer Guide to Identity Theft</a>. Those unable to file electronically should mail a paper tax return along with <a href="media/d356facd.f14039.pdf" data-original-source="https://www.irs.gov/pub/irs-pdf/f14039.pdf" target="_blank" rel="noopener">Form 14039</a> (PDF) &#8212; the Identity Theft Affidavit &#8212; stating they were victims of a tax preparer data breach.</p>


feed_id: https://krebsonsecurity.com/?p=42584
title: Money Laundering Via Author Impersonation on Amazon?
uri: Money-Laundering-Via-Author-Impersonation-on-Amazon
url: https://krebsonsecurity.com/2018/02/money-laundering-via-author-impersonation-on-amazon/
content:
<p><strong>Patrick Reames</strong> had no idea why <strong>Amazon.com</strong> sent him a <a href="https://en.wikipedia.org/wiki/Form_1099" target="_blank" rel="noopener">1099 form</a> saying he&#8217;d made almost $24,000 selling books via <strong>Createspace</strong>, the company&#8217;s on-demand publishing arm. That is, until he searched the site for his name and discovered someone has been using it to peddle a $555 book that&#8217;s full of nothing but gibberish.</p>
<div id="attachment_42604" style="width: 582px" class="wp-caption aligncenter"><img class=" wp-image-42604" src="media/1f8c712f.lowerdaysahead.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/02/lowerdaysahead.png" alt="" width="572" height="752" /><p class="wp-caption-text">The phony $555 book sold more than 60 times on Amazon using Patrick Reames&#8217; name and Social Security number.</p></div>
<p>Reames is a credited author on Amazon by way of several commodity industry books, although none of them made anywhere near the amount Amazon is reporting to the Internal Revenue Service. Nor does he have a personal account with Createspace.</p>
<p>But that didn&#8217;t stop someone from publishing a &#8220;novel&#8221; under his name. That word is in quotations because the publication appears to be little more than computer-generated text, almost like the gibberish one might find in a spam email.</p>
<p>&#8220;Based on what I could see from the &#8216;sneak peak&#8217; function, the book was nothing more than a computer generated &#8216;story&#8217; with no structure, chapters or paragraphs &#8212; only lines of text with a carriage return after each sentence,&#8221; Reames said in an interview with KrebsOnSecurity.</p>
<p>The impersonator priced the book at $555 and it was posted to multiple Amazon sites in different countries. The book &#8212; which as been removed from most Amazon country pages as of a few days ago &#8212; is titled &#8220;Lower Days Ahead,&#8221; and was published on Oct 7, 2017.</p>
<p>Reames said he suspects someone has been buying the book using stolen credit and/or debit cards, and pocketing the 60 percent that Amazon gives to authors. At $555 a pop, it would only take approximately 70 sales over three months to rack up the earnings that Amazon said he made.</p>
<p>&#8220;This book is very unlikely to ever sell on its own, much less sell enough copies in 12 weeks to generate that level of revenue,&#8221; Reames said. &#8220;As such, I assume it was used for money laundering, in addition to tax fraud/evasion by using my Social Security number. Amazon refuses to issue a corrected 1099 or provide me with any information I can use to determine where or how they were remitting the royalties.&#8221;</p>
<p>Reames said the books he has sold on Amazon under his name were done through his publisher, not directly via a personal account (the royalties for those books accrue to his former employer) so he&#8217;d never given Amazon his Social Security number. But the fraudster evidently had, and that was apparently enough to convince Amazon that the imposter was him.</p>
<p>Reames said after learning of the impersonation, he got curious enough to start looking for other examples of author oddities on Amazon&#8217;s Createspace platform.</p>
<p>&#8220;I have reviewed numerous Createspace titles and its clear to me that there may be hundreds if not thousands of similar fraudulent books on their site,&#8221; Reames said. &#8220;These books contain no real content, only dozens of pages of gibberish or computer generated text.&#8221;<span id="more-42584"></span></p>
<p>For example, searching Amazon for the name <strong>Vyacheslav Grzhibovskiy</strong> turns up dozens of Kindle &#8220;books&#8221; that appear to be similar gibberish works &#8212; most of which have the words &#8220;quadrillion,&#8221; &#8220;trillion&#8221; or a similar word in their titles. Some retail for just one or two dollars, while others are inexplicably priced between $220 and $320.</p>
<div id="attachment_42603" style="width: 591px" class="wp-caption aligncenter"><img class=" wp-image-42603" src="media/a9da6095.quadrillion.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/02/quadrillion.png" alt="" width="581" height="702" /><p class="wp-caption-text">Some of the &#8220;books&#8221; for sale on Amazon attributed to a Vyacheslav Grzhibovskiy.</p></div>
<p>&#8220;Its not hard to imagine how these books could be used to launder money using stolen credit cards or facilitating transactions for illicit materials or funding of illegal activities,&#8221; Reames said. &#8220;I can not believe Amazon is unaware of this and is unwilling to intercede to stop it. I also believe they are not properly vetting their new accounts to limit tax fraud via stolen identities.&#8221;</p>
<p>Reames said Amazon refuses to send him a corrected 1099, or to discuss anything about the identity thief.</p>
<p>&#8220;They say all they can do at this point is send me a letter acknowledging than I&#8217;m disputing ever having received the funds, because they said they couldn&#8217;t prove I didn&#8217;t receive the funds. So I told them, &#8216;If you&#8217;re saying you can&#8217;t say whether I did receive the funds, tell me where they went?&#8217; And they said, &#8220;Oh, no, we can&#8217;t do that.&#8217; So I can&#8217;t clear myself and they won&#8217;t clear me.&#8221;</p>
<p>Amazon said in a statement that the security of customer accounts is one of its highest priorities.</p>
<p>“We have policies and security measures in place to help protect them. Whenever we become aware of actions like the ones you describe, we take steps to stop them. If you’re concerned about your account, please contact Amazon customer service immediately using the help section on our website.”</p>
<p>Beware, however, if you plan to contact Amazon customer support via phone. Performing a simple online search for Amazon customer support phone numbers can turn up some dubious and outright fraudulent results.</p>
<p>Earlier this month, KrebsOnSecurity heard from a fraud investigator for a mid-sized bank who&#8217;d recently had several customers who got suckered into scams after searching for the customer support line for Amazon. She said most of these customers were seeking to cancel an <strong>Amazon Prime</strong> membership after the trial period ended and they were charged a $99 fee.</p>
<p>The fraud investigator said her customers ended up calling fake Amazon support numbers, which were answered by people with a foreign accent who proceeded to request all manner of personal data, including bank account and credit card information. In short order, the customers&#8217; accounts were used to set up new Amazon accounts as well as accounts at <strong>Coinbase.com</strong>, a service that facilitates the purchase of virtual currencies like Bitcoin.</p>
<p><a href="http://www.thedailyscam.com/not-amazon-customer-support/" target="_blank" rel="noopener">This Web site</a> does a good job documenting the dozens of phony Amazon customer support numbers that are hoodwinking unsuspecting customers. Amazingly, many of these numbers seem to be heavily promoted using Amazon&#8217;s own online customer support discussion forums, in addition to third-party sites like Facebook.com.</p>
<p>Interestingly, clicking on the <a href="https://www.amazon.com/gp/help" target="_blank" rel="noopener">Customer Help Forum link</a> link from the <a href="https://www.amazon.com/gp/help/customer/display.html/?nodeId=201331410&amp;sr=1-1&amp;ref=sxts_snpl_6_6_3256888202&amp;qid=1519126304&amp;pf_rd_m=ATVPDKIKX0DER&amp;pf_rd_p=3256888202&amp;pf_rd_r=KET8NPQ15GC9SQDMY6A7&amp;pd_rd_wg=QSQSu&amp;pf_rd_s=desktop-signpost&amp;pf_rd_t=301&amp;pd_rd_w=ITxid&amp;pf_rd_i=help&amp;pd_rd_r=4c16d88e-f1d0-4c7d-8daf-e8a2a68c6fbb" target="_blank" rel="noopener">Amazon Support Options and Contact Us page</a> currently sends visitors to the page pictured below, which displays a &#8220;Sorry, We Couldn&#8217;t Find That Page&#8221; error. Perhaps the company is simply cleaning things up after being notified last week by KrebsOnSecurity about the bogus phone numbers being promoted on the forum.</p>
<p><img class="aligncenter wp-image-42638" src="media/3a37af29.amazonhelpsorry.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/02/amazonhelpsorry.png" alt="" width="574" height="454" /></p>
<p>In any case, it appears some of these fake Amazon support numbers are being pimped by <a href="https://www.amazon.com/s/ref=nb_sb_noss?url=search-alias%3Daps&amp;field-keywords=customer+support" target="_blank" rel="noopener">a number dubious-looking e-books for sale on Amazon</a> that are all about &#8212; you guessed it &#8212; how to contact Amazon customer support.</p>
<p>If you wish to contact Amazon by phone, the only numbers you should use are 888-280-3321 and 888-280-4331. Amazon&#8217;s main customer help page is <a href="https://www.amazon.com/gp/help/customer/display.html/ref=footer_gw_m_b_he?ie=UTF8&amp;nodeId=508510" target="_blank" rel="noopener">here</a>.</p>
<p><strong>Update, 11:44 a.m. ET:</strong> Not sure when it happened exactly, but <a href="https://www.amazon.com/gp/help/customer/display.html?nodeId=14279661" rel="noopener" target="_blank">this notice</a> says Amazon has closed its discussion boards. </p>


feed_id: https://krebsonsecurity.com/?p=42659
title: Chase ‘Glitch’ Exposed Customer Accounts
uri: Chase-Glitch-Exposed-Customer-Accounts
url: https://krebsonsecurity.com/2018/02/chase-glitch-exposed-customer-accounts/
content:
<p class="p1"><span class="s1">Multiple <strong>Chase.com</strong> customers have reported logging in to their bank accounts, only to be presented with another customer&#8217;s bank account details. Chase has acknowledged the incident, saying it was caused by an internal &#8220;glitch&#8221; Wednesday evening that did not involve any kind of hacking attempt or cyber attack.</span></p>
<p><img class="aligncenter size-full wp-image-32822" src="media/b0ca8da0.jpmchase.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2015/11/jpmchase.png" alt="" width="582" height="291" srcset="https://krebsonsecurity.com/wp-content/uploads/2015/11/jpmchase.png 582w, https://krebsonsecurity.com/wp-content/uploads/2015/11/jpmchase-580x290.png 580w" sizes="(max-width: 582px) 100vw, 582px" /></p>
<p class="p1"><span class="s1"><strong>Trish Weller</strong>, director of communications for the retail side of <strong>JP Morgan Chase</strong>, said the incident happened Wednesday evening, for &#8220;a pretty limited number of customers&#8221; between 6:30 pm  and 9 pm ET who &#8220;sporadically during that time while logged in to chase.com could see someone else’s account details.&#8221;</span></p>
<p class="p1"><span class="s1">&#8220;We know for sure the glitch was on our end, not from a malicious actor,&#8221; Weller said, noting that Chase is still trying to determine how many customers may have been affected. &#8220;We&#8217;re going through Tweets from customers and making sure that if anyone is calling us with issues we&#8217;re working one on one with customers. If you see suspicious activity you should give us a call.&#8221;</span></p>
<p class="p1"><span class="s1">Weller urged customers to &#8220;practice good security hygiene&#8221; by regularly reviewing their account statements, and promptly reporting any discrepancies. She said Chase is still working to determine the precise cause of the mix-up, and that there have been no reports of JPMC commercial customers seeing the account information of other customers.</span></p>
<p class="p1"><span class="s1">&#8220;This was all on our side,&#8221; Well said. &#8220;I don&#8217;t know what did happen yet but I know what didn&#8217;t happen. What happened last night was 100 percent not the result of anything malicious.&#8221;</span></p>
<p class="p1"><span class="s1">The account mix-up was documented on Wednesday by <a href="http://flyanddine.boardingarea.com/chase-glitch-random-access/" target="_blank" rel="noopener">Fly &amp; Dine</a>, an online publication that chronicles the airline food industry. Fly &amp; Dine included screenshots of one of their writer&#8217;s spouses logged into the account of a fellow Chase customer with an Amazon and Chase card and a balance of more than $16,000.</span><span id="more-42659"></span></p>
<p class="p1"><span class="s1"><a href="https://www.twitter.com/kennwhite" target="_blank" rel="noopener">Kenneth White</a>, a security researcher and director of the <a href="https://opencryptoaudit.org/people" target="_blank" rel="noopener">Open Crypto Audit Project</a>, said the reports he’s seen on Twitter and elsewhere suggested the screwup was somehow related to the bank’s mobile apps. He also said the Chase retail banking app offered an update first thing Thursday morning. </span></p>
<p class="p1"><span class="s1">Chase says the oddity occurred for both chase.com and users of the Chase mobile app. </span></p>
<p class="p1">&#8220;We don&#8217;t have any evidence it was related to any update,&#8221; Weller said.</p>
<p class="p1"><span class="s1">“There’s only so many kind of logic errors where Ken logs in and sees Brian’s account,” White said.<span class="Apple-converted-space">  </span>“It can be a devil to track down because every single time someone logs in it’s a roll of the dice — maybe they get something in the warmed up cache or they get a new hit. It’s tricky to debug, but this is like as bad as it gets in terms of screwup of the app.”</span></p>
<p>White said the incident is reminiscent of a <a href="http://store.steampowered.com/news/19852/" target="_blank" rel="noopener">similar glitch at online game giant Steam</a>, which caused many customers to see account information for other Steam users for a few hours. He said he suspects the problem was a configuration error someplace within Chase.com &#8220;caching servers,&#8221; which are designed to ease the load on a Web application by periodically storing some common graphical elements on the page &#8212; such as images, videos and GIFs.</p>
<p class="p1"><span class="s1">&#8220;The images, the site banner, all that&#8217;s fine to be cached, but you never want to cache active content or raw data coming back,&#8221; White said. &#8220;If you&#8217;re CNN, you&#8217;re probably caching all the content on the homepage. But for a banking app that has access to live data, you never want that be cached.&#8221;</span></p>
<p class="p1"><span class="s1">&#8220;It’s fairly easy to fix once you identify the problem,&#8221; he added. &#8220;I can imagine just getting the basics of the core issue [for Chase] would be kind of tricky and might mean a lot of non techies calling your Tier 1 support people.&#8221;</span></p>
<p><strong>Update, 8:10 p.m. ET:</strong> Added comment from Chase about the incident affecting both mobile device and Web browser users.</p>


feed_id: https://krebsonsecurity.com/?p=42450
title: USPS Finally Starts Notifying You by Mail If Someone is Scanning Your Snail Mail Online
uri: USPS-Finally-Starts-Notifying-You-by-Mail-If-Someone-is-Scanning-Your
url:
https://krebsonsecurity.com/2018/02/usps-finally-starts-notifying-you-by-mail-if-someone-is-scanning-your-snail-mail-online/

content:
<p>In October 2017, KrebsOnSecurity <a href="https://krebsonsecurity.com/2017/10/usps-informed-delivery-is-stalkers-dream/" target="_blank" rel="noopener">warned</a> that ne&#8217;er-do-wells could take advantage of a relatively new service offered by the <strong>U.S. Postal Service</strong> that provides scanned images of all incoming mail before it is slated to arrive at its destination address. We advised that stalkers or scammers could abuse this service by signing up as anyone in the household, because the USPS wasn&#8217;t at that point set up to use its own unique communication system &#8212; the U.S. mail &#8212; to alert residents when someone had signed up to receive these scanned images.</p>
<div id="attachment_40983" style="width: 610px" class="wp-caption aligncenter"><img class=" wp-image-40983" src="media/57122d51.informeddelivery.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2017/10/informeddelivery.png" alt="" width="600" height="259" srcset="https://krebsonsecurity.com/wp-content/uploads/2017/10/informeddelivery.png 818w, https://krebsonsecurity.com/wp-content/uploads/2017/10/informeddelivery-580x250.png 580w, https://krebsonsecurity.com/wp-content/uploads/2017/10/informeddelivery-768x331.png 768w" sizes="(max-width: 600px) 100vw, 600px" /><p class="wp-caption-text">Image: USPS</p></div>
<p>The USPS recently told this publication that beginning Feb. 16 it started alerting all households by mail whenever anyone signs up to receive these scanned notifications of mail delivered to that address. The notification program, dubbed &#8220;<strong>Informed Delivery</strong>,&#8221; includes a scan of the front and back of each envelope or package destined for a specific address each day.</p>
<p>The Postal Service says consumer feedback on its Informed Delivery service has been overwhelmingly positive, particularly among residents who travel regularly and wish to keep close tabs on any bills or other mail being delivered while they’re on the road. It has been available to select addresses in several states since 2014 under a targeted USPS pilot program, but it has since expanded to include many ZIP codes nationwide. U.S. residents can find out if their address is eligible by visiting <a href="https://informeddelivery.usps.com/" target="_blank" rel="noopener">informeddelivery.usps.com</a>.</p>
<p>According to the USPS, some 8.1 million accounts have been created via the service so far (Oct. 7, 2017, <a href="https://krebsonsecurity.com/2017/10/usps-informed-delivery-is-stalkers-dream/" target="_blank" rel="noopener">the last time I wrote about Informed Delivery</a>, there were 6.3 million subscribers, so the program has grown more than 28 percent in five months).</p>
<p><strong>Roy Betts</strong>, a spokesperson for the USPS&#8217;s communications team, says post offices handled 50,000 Informed Delivery notifications the week of Feb. 16, and are delivering an additional 100,000 letters to existing Informed Delivery addresses this coming week.</p>
<p>Currently, the USPS allows address changes via the USPS Web site or in-person at any one of more than 35,000 USPS retail locations nationwide. When a request is processed, the USPS sends a confirmation letter to both the old address and the new address.</p>
<p>If someone already signed up for Informed Delivery later posts a change of address request, the USPS does not automatically transfer the Informed Delivery service to the new address: Rather, it sends a mailer with a special code tied to the new address and to the username that requested the change. To resume Informed Delivery at the new address, that code needs to be entered online using the account that requested the address change.</p>
<p>A review of the methods used by the USPS to validate new account signups last fall suggested the service was wide open to abuse by a range of parties, mainly because of weak authentication and because it is not easy to opt out of the service.</p>
<p>Signing up requires an eligible resident <a href="https://reg.usps.com/entreg/RegistrationPortalAction_input" target="_blank" rel="noopener">to create a free user account</a> at USPS.com, which asks for the resident’s name, address and an email address. The final step in validating residents involves answering four so-called “knowledge-based authentication” or KBA questions.</p>
<p>The USPS told me it uses two ID proofing vendors: <a href="https://krebsonsecurity.com/2014/03/who-built-the-id-theft-service-ssndob-ru/" target="_blank" rel="noopener">Lexis Nexis</a><strong>; </strong>and, naturally, recently breached big three credit bureau <a href="https://krebsonsecurity.com/?s=Equifax&amp;x=0&amp;y=0" target="_blank" rel="noopener">Equifax</a> — to ask the magic KBA questions, rotating between them randomly.</p>
<p>KrebsOnSecurity has <a href="https://krebsonsecurity.com/?s=kba&amp;x=0&amp;y=0" target="_blank" rel="noopener">assailed KBA</a> as an unreliable authentication method because so many answers to the multiple-guess questions are available on sites like <strong>Spokeo</strong> and <strong>Zillow</strong>, or via social networking profiles.</p>
<p>It&#8217;s also nice when Equifax gives away a metric truckload of information about where you&#8217;ve worked, how much you made at each job, and what addresses you frequented when. See: <a href="https://krebsonsecurity.com/2017/11/how-to-opt-out-of-equifax-revealing-your-salary-history/" target="_blank" rel="noopener">How to Opt Out of Equifax Revealing Your Salary History</a> for how much leaks from this lucrative division of Equifax.<span id="more-42450"></span></p>
<p>All of the data points in an employee history profile from Equifax will come in handy for answering the KBA questions, or at least whittling away those that don&#8217;t match salary ranges or dates and locations of the target identity&#8217;s previous addresses.</p>
<p>Once signed up, a resident can view scanned images of the front of each piece of incoming mail in advance of its arrival. Unfortunately, anyone able to defeat those automated KBA questions from Equifax and Lexis Nexis &#8212; be they stalkers, jilted ex-partners or private investigators &#8212; can see who you’re communicating with via the Postal mail.</p>
<p>Maybe this is much ado about nothing: Maybe it&#8217;s just a reminder that people in the United States shouldn&#8217;t expect more than a post card&#8217;s privacy guarantee (which in can leak the &#8220;who&#8221; and &#8220;when&#8221; of any correspondence, and sometimes the &#8220;what&#8221; and &#8220;why&#8221; of the communication). We&#8217;d certainly all be better off if more people kept that guarantee in mind for email in addition to snail mail. At least now the USPS will deliver your address a piece of paper letting you know when someone signs up to look at those W&#8217;s in your snail mail online.</p>


feed_id: https://krebsonsecurity.com/?p=42714
title: Bot Roundup: Avalanche, Kronos, NanoCore
uri: Bot-Roundup-Avalanche-Kronos-NanoCore
url: https://krebsonsecurity.com/2018/02/bot-roundup-avalanche-kronos-nanocore/
content:
<p>It&#8217;s been a busy few weeks in cybercrime news, justifying updates to a couple of cases we&#8217;ve been following closely at KrebsOnSecurity. In Ukraine, the alleged ringleader of the <a href="https://krebsonsecurity.com/2016/12/avalanche-global-fraud-ring-dismantled/" target="_blank" rel="noopener"><strong>Avalanche</strong> malware spam botnet</a> was arrested after eluding authorities in the wake of a global cybercrime crackdown there in 2016. Separately, a case that was hailed as a test of whether programmers can be held accountable for how customers use their product turned out poorly for 27-year-old programmer <strong>Taylor Huddleston</strong>, who was sentenced to almost three years in prison for making and marketing a complex spyware program.</p>
<p>First, the Ukrainian case. On Nov. 30, 2016, authorities across Europe <a href="https://krebsonsecurity.com/2016/12/avalanche-global-fraud-ring-dismantled/" target="_blank" rel="noopener">coordinated the arrest of five individuals</a> thought to be tied to the Avalanche crime gang, in an operation that the FBI and its partners abroad described as an unprecedented global law enforcement response to cybercrime. Hundreds of malicious web servers and hundreds of thousands of domains were blocked in the coordinated action.</p>
<div id="attachment_37133" style="width: 609px" class="wp-caption aligncenter"><a class="lightbox" href="media/a83785ad.avalanchemap.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2016/12/avalanchemap.png"><img class="wp-image-37133" src="media/a83785ad.avalanchemap.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2016/12/avalanchemap.png" alt="" width="599" height="365" srcset="https://krebsonsecurity.com/wp-content/uploads/2016/12/avalanchemap.png 1335w, https://krebsonsecurity.com/wp-content/uploads/2016/12/avalanchemap-580x354.png 580w, https://krebsonsecurity.com/wp-content/uploads/2016/12/avalanchemap-768x468.png 768w, https://krebsonsecurity.com/wp-content/uploads/2016/12/avalanchemap-940x573.png 940w" sizes="(max-width: 599px) 100vw, 599px" /></a><p class="wp-caption-text">The global distribution of servers used in the Avalanche crime machine. Source: Shadowserver.org</p></div>
<p>The alleged leader of the Avalanche gang — 33-year-old Russian <strong>Gennady Kapkanov</strong> — did not go quietly at the time. Kapkanov allegedly shot at officers with a Kalashnikov assault rifle through the front door as they prepared to raid his home, and then attempted to escape off of his 4th floor apartment balcony. He was <a href="https://krebsonsecurity.com/2016/12/avalanche-crime-ring-leader-eludes-justice/" target="_blank" rel="noopener">later released, after police allegedly failed to file proper arrest records for him</a>.</p>
<p>But on Monday <em>Agence France-Presse</em> (AFP) <a href="https://ph.news.yahoo.com/ukraine-arrests-avalanche-cybercrime-organiser-police-102908616.html" target="_blank" rel="noopener">reported</a> that Ukrainian authorities had once again collared Kapkanov, who was allegedly living under a phony passport in Poltav, a city in central Ukraine. No word yet on whether Kapkanov has been charged, which was supposed to happen Monday.</p>
<div id="attachment_37223" style="width: 606px" class="wp-caption aligncenter"><img class="size-full wp-image-37223" src="media/cf2c7a3d.kapkanovlicense.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2016/12/kapkanovlicense.png" alt="" width="596" height="388" srcset="https://krebsonsecurity.com/wp-content/uploads/2016/12/kapkanovlicense.png 596w, https://krebsonsecurity.com/wp-content/uploads/2016/12/kapkanovlicense-580x378.png 580w" sizes="(max-width: 596px) 100vw, 596px" /><p class="wp-caption-text">Kapkanov&#8217;s drivers license. Source: npu.gov.ua.</p></div>
<h4>HOW WELL DO YOU REALLY WANT TO KNOW YOUR CUSTOMERS?</h4>
<p>Lawyers for Taylor Huddleston, a 27-year-old programmer from Hot Springs, Ark., originally asked a federal court to believe that the software he sold on the sprawling hacker marketplace <strong>Hackforums</strong> &#8212; a &#8220;remote administration tool&#8221; or &#8220;RAT&#8221; designed to let someone remotely administer one or many computers remotely &#8212; was just a benign tool.</p>
<p>The bad things done with Mr. Huddleston&#8217;s tools, the defendant argued, were not Mr. Huddleston&#8217;s doing. Furthermore, no one had accused Mr. Huddleston of even using his own software.</p>
<p><em>The Daily Beast</em> <a href="https://www.thedailybeast.com/fbi-arrests-hacker-who-hacked-no-one" target="_blank" rel="noopener">first wrote about Huddleston&#8217;s case in 2017</a>, and at the time suggested <a href="https://www.courtlistener.com/docket/6294319/united-states-v-huddleston/" target="_blank" rel="noopener">his prosecution</a> raised questions of whether a programmer could be held criminally responsible for the actions of his users. My response to that piece was &#8220;<a href="https://krebsonsecurity.com/2017/04/dual-use-software-criminal-case-not-so-novel/" target="_blank" rel="noopener">Dual-Use Software Criminal Case Not So Novel.</a>&#8221;</p>
<div id="attachment_38879" style="width: 260px" class="wp-caption alignright"><img class=" wp-image-38879" src="media/2fb528a5.huddlestoncuff.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2017/04/huddlestoncuff.png" alt="" width="250" height="253" /><p class="wp-caption-text">Photo illustration by Lyne Lucien/The Daily Beast</p></div>
<p>The court was swayed by evidence that <em>yes</em>, Mr. Huddleston <em>could</em> be held criminally responsible for those actions. It sentenced him to 33 months in prison after the defendant acknowledged that he knew his RAT &#8212; a Remote Access Trojan dubbed &#8220;<strong>NanoCore RAT</strong>&#8221; &#8212; was being used to spy on webcams and steal passwords from systems running the software.</p>
<p>Of course Huddleston knew: He didn&#8217;t market his wares on some Craigslist software marketplace ad, or via video promos on his local cable channel: He marketed the NanoCore RAT and another software licensing program called <strong>Net Seal</strong> exclusively on <strong>Hackforums[dot]net. </strong></p>
<p>This sprawling, English language forum has <a href="https://krebsonsecurity.com/?s=hackforums&amp;x=0&amp;y=0" target="_blank" rel="noopener">a deep bench of technical forum discussions</a> about using RATs and other tools to surreptitiously record passwords and videos of &#8220;slaves,&#8221; the derisive term for systems secretly infected with these RATs.</p>
<p>Huddleston knew what many of his customers were doing because many NanoCore users also used Huddleston&#8217;s Net Seal program to keep their own RATs and other custom hacking tools from being disassembled or &#8220;cracked&#8221; and posted online for free. In short: He knew what programs his customers were using Net Seal on, and he knew what those customers had done or intended to do with tools like NanoCore.</p>
<p>The sentencing suggests that where you choose to sell something online says a lot about what you think of your own product and who&#8217;s likely buying it.</p>
<p>Daily Beast author <strong>Kevin Poulsen</strong> noted in <a href="https://www.thedailybeast.com/nanocore-coder-pleads-guilty-to-aiding-and-abetting-hackers" target="_blank" rel="noopener">a July 2017 story</a> that Huddleston changed his tune and pleaded guilty. The story pointed to an <a class="LinkWrapper LinkWrapper--external" href="media/288b56de.vaed-1.17-cr-00034-28.pdf" data-original-source="http://www.kingpin.cc/wp-content/uploads/2017/07/vaed-1.17-cr-00034-28.pdf" rel="noreferrer" data-ss1519740165="1">accompanying</a> plea in which Huddleston stipulated that he “knowingly and intentionally aided and abetted thousands of unlawful computer intrusions” in selling the program to hackers and that he “acted with the purpose of furthering these unauthorized computer intrusions and causing them to occur.”<span id="more-42714"></span></p>
<h4>NEVER HAD NO CUSTOMERS TO KNOW?</h4>
<p>Bleeping Computer&#8217;s <strong>Catalin Cimpanu</strong> <a href="https://www.bleepingcomputer.com/news/security/nanocore-rat-author-gets-33-months-in-prison/" target="_blank" rel="noopener">observes</a> that Huddleston&#8217;s case is similar to another being pursued by U.S. prosecutors against <strong>Marcus &#8220;MalwareTech&#8221; Hutchins</strong>, the security researcher who helped stop the spread of the global WannaCry ransomware outbreak in May 2017. Prosecutors allege Hutchins was the author and proprietor of &#8220;Kronos,&#8221; a strain of malware designed to steal online banking credentials.</p>
<div id="attachment_40551" style="width: 606px" class="wp-caption aligncenter"><img class=" wp-image-40551" src="media/83b44897.hutchins.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2017/09/hutchins.png" alt="" width="596" height="297" srcset="https://krebsonsecurity.com/wp-content/uploads/2017/09/hutchins.png 622w, https://krebsonsecurity.com/wp-content/uploads/2017/09/hutchins-580x289.png 580w" sizes="(max-width: 596px) 100vw, 596px" /><p class="wp-caption-text">Marcus Hutchins, just after he was revealed as the security expert who stopped the WannaCry worm. Image: twitter.com/malwaretechblog</p></div>
<p>On Sept. 5, 2017, KrebsOnSecurity published &#8220;<a href="https://krebsonsecurity.com/2017/09/who-is-marcus-hutchins/" target="_blank" rel="noopener">Who is Marcus Hutchins?</a>&#8220;, a breadcrumbs research piece on <a href="media/fea14a2e.gh0stele.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2017/09/gh0stele.png" target="_blank" rel="noopener">the public user profiles</a> known to have been wielded by Hutchins. The data did not implicate him in the Kronos trojan, but it chronicles the evolution of a young man who appears to have sold and published online quite a few unique and powerful malware samples &#8212; including several RATs and custom exploit packs (as well as access to hacked PCs).</p>
<p>MalwareTech declined to be interviewed by this publication in light of his ongoing prosecution. But Hutchins has claimed he never had any customers because he didn&#8217;t write the Kronos trojan.</p>
<p>Hutchins has pleaded not guilty to all four counts against him, including conspiracy to distribute malicious software with the intent to cause damage to 10 or more affected computers without authorization, and conspiracy to distribute malware designed to intercept protected electronic communications.</p>
<p>Hutchins said through his <a href="https://twitter.com/MalwareTechBlog/status/968245609466552320" target="_blank" rel="noopener">@MalwareTechBlog account</a> on Twitter Feb. 26 that he wanted to publicly dispute my Sept. 2017 story. But he didn&#8217;t specify why other than saying he was &#8220;not allowed to.&#8221;</p>
<p>MWT wrote: &#8220;mrw [my reaction when] I&#8217;m not allowed to debunk the Krebs article so still have to listen to morons telling me why I&#8217;m guilty based on information that isn&#8217;t even remotely correct.&#8221;</p>
<div id="attachment_42725" style="width: 607px" class="wp-caption aligncenter"><img class=" wp-image-42725" src="media/99952dc0.mrw-krebs.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/02/mrw-krebs.png" alt="" width="597" height="827" /><p class="wp-caption-text">Hutchins&#8217; tweet on Feb. 26, 2018.</p></div>
<p>According to <a href="https://www.bankinfosecurity.com/blogs/case-against-marcus-malwaretech-hutchins-gets-complex-p-2537" target="_blank" rel="noopener">a story</a> at <em>BankInfoSecurity</em>, the evidence submitted by prosecutors for the government includes:</p>
<ul>
<li>Statements made by Hutchins after he was arrested.</li>
<li>A CD containing two audio recordings from a county jail in Nevada where he was detained by the FBI.</li>
<li>150 pages of Jabber chats between the defendant and an individual.</li>
<li>Business records from Apple, Google and Yahoo.</li>
<li>Statements (350 pages) by the defendant from another internet forum, which were seized by the government in another district.</li>
<li>Three to four samples of malware.</li>
<li>A search warrant executed on a third party, which may contain some privileged information.</li>
</ul>
<p>The case against Hutchins continues apace in Wisconsin. A <a href="media/d980c208.759e31a9-a78b-44f0-b3e6-4c0387cd0a8d.pdf" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/02/759e31a9-a78b-44f0-b3e6-4c0387cd0a8d.pdf" target="_blank" rel="noopener">scheduling order for pretrial motions</a> filed Feb. 22 suggests the court wishes to have a speedy trial that concludes before the end of April 2018.</p>


feed_id: https://krebsonsecurity.com/?p=42655
title: How to Fight Mobile Number Port-out Scams
uri: How-to-Fight-Mobile-Number-Port-out-Scams
url: https://krebsonsecurity.com/2018/02/how-to-fight-mobile-number-port-out-scams/
content:
<p><strong>T-Mobile</strong>, <strong>AT&amp;T</strong> and other mobile carriers are reminding customers to take advantage of free services that can block identity thieves from easily &#8220;porting&#8221; your mobile number out to another provider, which allows crooks to intercept your calls and messages while your phone goes dark. Tips for minimizing the risk of number porting fraud are available below for customers of all four major mobile providers, including <strong>Sprint</strong> and <strong>Verizon</strong>.</p>
<p><img class="aligncenter size-full wp-image-42753" src="media/0c2a3a0c.mobileportoutscams.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/02/mobileportoutscams.png" alt="" width="564" height="275" /></p>
<p>Unauthorized mobile phone number porting is not a new problem, but T-Mobile said it <a href="https://www.t-mobile.com/customers/secure" target="_blank" rel="noopener">began alerting customers about it</a> earlier this month because the company has seen a recent uptick in fraudulent requests to have customer phone numbers ported over to another mobile provider&#8217;s network.</p>
<p style="font-weight: 400;">&#8220;We have been alerting customers via SMS that our industry is experiencing a phone number port out scam that could impact them,&#8221; T-Mobile said in a written statement. &#8220;We have been encouraging them to add a port validation feature, if they’ve not already done so.&#8221;</p>
<p>Crooks typically use phony number porting requests when they have already stolen the password for a customer account (either for the mobile provider&#8217;s network or for another site), and wish to intercept the one-time password that many companies send to the mobile device to perform two-factor authentication.</p>
<p>Porting a number to a new provider shuts off the phone of the original user, and forwards all calls to the new device. Once in control of the mobile number, thieves can request any second factor that is sent to the newly activated device, such as a one-time code sent via text message or or an automated call that reads the one-time code aloud.</p>
<p>In these cases, the fraudsters can call a customer service specialist at a mobile provider and pose as the target, providing the mark&#8217;s static identifiers like name, date of birth, social security number and other information. Often this is enough to have a target&#8217;s calls temporarily forwarded to another number, or ported to a different provider&#8217;s network.</p>
<p>&#8220;<span class="pullquote pqright">Port out fraud has been an industry problem for a long time, but recently we’ve seen an uptick in this illegal activity,&#8221; T-Mobile said. </span> &#8220;We’re not providing specific metrics, but it’s been enough that we felt it was important to encourage customers to add extra security features to their accounts.&#8221;</p>
<p>In <a href="http://about.att.com/sites/cybersecurity/ni/blog/porting" target="_blank" rel="noopener">a blog post published Tuesday</a>, AT&amp;T said bad guys sometimes use illegal porting to steal your phone number, transfer the number to a device they control and intercept text authentication messages from your bank, credit card issuer or other companies.</p>
<p>&#8220;You may not know this has happened until you notice your mobile device has lost service,&#8221; reads a post by <strong>Brian Rexroad</strong>, VP of security relations at AT&amp;T. &#8220;Then, you may notice loss of access to important accounts as the attacker changes passwords, steals your money, and gains access to other pieces of your personal information.&#8221;</p>
<p>Rexroad says in some cases the thieves just walk into an AT&amp;T store and present a fake ID and your personal information, requesting to switch carriers. Porting allows customers to take their phone number with them when they change phone carriers.</p>
<p>The law requires carriers to provide this number porting feature, but there are ways to reduce the risk of this happening to you.<span id="more-42655"></span></p>
<p><img class="aligncenter wp-image-40415" src="media/618d5447.phonefraudsmaller.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2017/08/phonefraudsmaller.png" alt="" width="588" height="297" srcset="https://krebsonsecurity.com/wp-content/uploads/2017/08/phonefraudsmaller.png 609w, https://krebsonsecurity.com/wp-content/uploads/2017/08/phonefraudsmaller-580x292.png 580w" sizes="(max-width: 588px) 100vw, 588px" /></p>
<p>T-Mobile suggests adding its port validation feature to all accounts. To do this, call 611 from your T-Mobile phone or dial <a href="tel:1-800-937-8997">1-800-937-8997</a> from any phone. The T-Mobile customer care representative will ask you to create a 6-to-15-digit passcode that will be added to your account.</p>
<p>&#8220;We’ve included alerts in the T-Mobile customer app and on MyT-Mobile.com, but we don’t want customers to wait to get an alert to take action,&#8221; the company said in its statement. &#8220;Any customer can call 611 at any time from their mobile phone and have port validation added to their accounts.&#8221;</p>
<p><strong>Verizon</strong> requires a match on a password or a PIN associated with the account for a port to go through. Subscribers can set their PIN via their Verizon Wireless website account or by visiting a local shop.</p>
<p><strong>Sprint</strong> told me that in order for a customer to port their number to a different carrier, they must provide the correct <span class="il">Sprint</span> account number and PIN number for the port to be approved. Sprint requires all customers to create a PIN during their initial account setup.</p>
<p>AT&amp;T calls its two-factor authentication &#8220;extra security,&#8221; which involves creating a unique passcode on your AT&amp;T account that requires you to provide that code before any changes can be made &#8212; including ports initiated through another carrier. Follow <a href="https://www.att.com/esupport/article.html#!/wireless/KM1051397" target="_blank" rel="noopener">this link</a> for more information. And don&#8217;t use something easily guessable like your SSN (the last four of your SSN is the default PIN, so make sure you change it quickly to something you can remember but that&#8217;s non-obvious).</p>
<p>Bigger picture, <span class="pullquote pqleft">these porting attacks are a good reminder to use something other than a text message or a one-time code that gets read to you in an automated phone call.</span> Whenever you have the option, choose the app-based alternative: Many companies now support third-party authentication apps like <a href="https://support.google.com/accounts/answer/1066447?hl=en" target="_blank" rel="noopener">Google Authenticator</a> and <a href="https://authy.com/" target="_blank" rel="noopener">Authy</a>, which can act as powerful two-factor authentication alternatives that are not nearly as easy for thieves to intercept.</p>
<p>Several of the mobile companies referred me to the work of a <a href="http://www.verizon.com/about/news/att-sprint-t-mobile-and-verizon-team-develop-mobile-authentication-solution" target="_blank" rel="noopener">Mobile Authentication task force</a> created by the carriers last fall. They say the issue of unauthorized ports to commit fraud is being addressed by this initiative.</p>
<p>For more on tightening your mobile security stance, see last year&#8217;s story, &#8220;<a href="https://krebsonsecurity.com/2017/08/is-your-mobile-carrier-your-weakest-link/" target="_blank" rel="noopener">Is Your Mobile Carrier Your Weakest Link?</a>&#8220;</p>


feed_id: https://krebsonsecurity.com/?p=42766
title: Financial Cyber Threat Sharing Group Phished
uri: Financial-Cyber-Threat-Sharing-Group-Phished
url: https://krebsonsecurity.com/2018/03/financial-cyber-threat-sharing-group-phished/
content:
<p>The <strong>Financial Services Information Sharing and Analysis Center</strong> (FS-ISAC), an industry forum for sharing data about critical cybersecurity threats facing the banking and finance industries, said today that a successful phishing attack on one of its employees was used to launch additional phishing attacks against FS-ISAC members.</p>
<p>The fallout from the back-to-back phishing attacks appears to have been limited and contained, as many FS-ISAC members who received the phishing attack quickly detected and reported it as suspicious. But the incident is a good reminder to be on your guard, remember that anyone can get phished, and that most phishing attacks succeed by abusing the sense of trust already established between the sender and recipient.</p>
<div id="attachment_42771" style="width: 457px" class="wp-caption aligncenter"><img class="size-full wp-image-42771" src="media/77f0d70e.fs-isacphish.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/03/fs-isacphish.png" alt="" width="447" height="502" /><p class="wp-caption-text">The confidential alert FS-ISAC sent to members about a successful phishing attack that spawned phishing emails coming from the FS-ISAC.</p></div>
<p>Notice of the phishing incident came in an alert FS-ISAC shared with its members today and obtained by KrebsOnSecurity. It describes an incident on Feb. 28 in which an FS-ISAC employee &#8220;clicked on a phishing email, compromising that employee&#8217;s login credentials. Using the credentials, a threat actor created an email with a PDF that had a link to a credential harvesting site and was then sent from the employee&#8217;s email account to select members, affiliates and employees.&#8221;</p>
<p>The alert said while FS-ISAC was already planning and implementing a multi-factor authentication (MFA) solution across all of its email platforms, &#8220;unfortunately, this incident happened to an employee that was not yet set up for MFA. We are accelerating our MFA solution across all FS-ISAC assets.&#8221;</p>
<p>The FS-ISAC also said it upgraded its Office 365 email version to provide &#8220;additional visibility and security.&#8221;</p>
<p>In an interview with KrebsOnSecurity, FS-ISAC President and CEO <a href="https://www.linkedin.com/in/bill-nelson-6b4b174/" target="_blank" rel="noopener">Bill Nelson</a> said his organization has grown significantly in new staff over the past few years to more than 75 people now, including <a href="https://www.linkedin.com/in/gregtemm/" target="_blank" rel="noopener">Greg Temm</a>, the FS-ISAC&#8217;s chief information risk officer.</p>
<p>&#8220;To say I&#8217;m disappointed this got through is an understatement,&#8221; Nelson said. &#8220;We need to accelerate MFA extremely quickly for all of our assets.&#8221;<span id="more-42766"></span></p>
<p>Nelson observed that &#8220;The positive messaging out of this I guess is anyone can become victimized by this.&#8221; But according to both Nelson and Temm, the phishing attack that tricked the FS-ISAC employee into giving away email credentials does not appear to have been targeted &#8212; nor was it particularly sophisticated.</p>
<p>&#8220;I would classify this as a typical, routine, non-targeted account harvesting and phishing,&#8221; Temm said. &#8220;It did not affect our member portal, or where our data is. That&#8217;s 100 percent multifactor. In this case it happened to be an asset that did not have multifactor.&#8221;</p>
<p>In this incident, it didn&#8217;t take a sophisticated actor to gain privileged access to an FS-ISAC employee&#8217;s inbox. But attacks like these raise the question: How successful might such a phishing attack be if it were only slightly more professional and/or organized?</p>
<p>Nelson said his staff members all participate in regular security awareness training and testing, but that there is always room to fill security gaps and move the needle on how many people click when they shouldn&#8217;t with email.</p>
<p>&#8220;The data our members share with us is fully protected,&#8221; he said. &#8220;We have a plan working with our board of directors to make sure we have added security going forward,&#8221; Nelson said. &#8220;But clearly, recognizing where some of these softer targets are is something every company needs to take a look at.&#8221;</p>


feed_id: https://krebsonsecurity.com/?p=42782
title: Powerful New DDoS Method Adds Extortion
uri: Powerful-New-DDoS-Method-Adds-Extortion
url: https://krebsonsecurity.com/2018/03/powerful-new-ddos-method-adds-extortion/
content:
<p>Attackers have seized on a relatively new method for executing <strong>distributed denial-of-service (DDoS) attacks</strong> of unprecedented disruptive power, using it to launch record-breaking DDoS assaults over the past week. Now evidence suggests this novel attack method is fueling digital shakedowns in which victims are asked to pay a ransom to call off crippling cyberattacks.</p>
<p><img class="aligncenter wp-image-36825" src="media/799359f6.ddosbomb.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2016/10/ddosbomb.png" alt="" width="592" height="364" srcset="https://krebsonsecurity.com/wp-content/uploads/2016/10/ddosbomb.png 699w, https://krebsonsecurity.com/wp-content/uploads/2016/10/ddosbomb-580x357.png 580w" sizes="(max-width: 592px) 100vw, 592px" /></p>
<p>On March 1, DDoS mitigation firm <strong>Akamai</strong> <a href="https://blogs.akamai.com/2018/03/memcached-fueled-13-tbps-attacks.html" target="_blank" rel="noopener">revealed</a> that one of its clients was hit with a DDoS attack that clocked in at 1.3 Tbps, which would make it the largest publicly recorded DDoS attack ever.</p>
<p>The type of DDoS method used in this record-breaking attack abuses a legitimate and relatively common service called &#8220;memcached&#8221; (pronounced &#8220;mem-cash-dee&#8221;) to massively amp up the power of their DDoS attacks.</p>
<p>Installed by default on many <strong>Linux</strong> operating system versions, memcached is designed to cache data and ease the strain on heavier data stores, like disk or databases. It is typically found in cloud server environments and it is meant to be used on systems that are not directly exposed to the Internet.</p>
<p>Memcached communicates using the User Datagram Protocol or UDP, which allows communications without any authentication &#8212; pretty much anyone or anything can talk to it and request data from it.</p>
<p>Because memcached doesn&#8217;t support authentication, an attacker can &#8220;spoof&#8221; or fake the Internet address of the machine making that request so that the memcached servers responding to the request all respond to the spoofed address &#8212; the intended target of the DDoS attack.</p>
<p>Worse yet, memcached has a unique ability to take a small amount of attack traffic and amplify it into a much bigger threat. Most popular DDoS tactics that abuse UDP connections can amplify the attack traffic 10 or 20 times &#8212; allowing, for example a 1 mb file request to generate a response that includes between 10mb and 20mb of traffic.</p>
<p>But with memcached, an attacker can force the response to be thousands of times the size of the request. All of the responses get sent to the target specified in the spoofed request, and it requires only a small number of open memcached servers to create huge attacks using very few resources.</p>
<p>Akamai believes there are currently more than 50,000 known memcached systems exposed to the Internet that can be leveraged at a moment&#8217;s notice to aid in massive DDoS attacks.</p>
<p>Both <a href="https://blogs.akamai.com/2018/02/memcached-udp-reflection-attacks.html" target="_blank" rel="noopener">Akamai</a> and <a href="https://medium.com/@qratorlabs/the-memcached-amplification-attack-reaching-500-gbps-b439a7b83c98" target="_blank" rel="noopener">Qrator</a> &#8212; a Russian DDoS mitigation company &#8212; published blog posts on Feb. 28 warning of the increased threat from memcached attacks.</p>
<p>&#8220;This attack was the largest attack seen to date by Akamai, more than twice the size of the <a href="https://krebsonsecurity.com/2016/11/akamai-on-the-record-krebsonsecurity-attack/" target="_blank" rel="noopener">September, 2016 attacks that announced the Mirai botnet </a>and possibly the largest DDoS attack publicly disclosed,&#8221; Akamai said [link added]. &#8220;Because of memcached reflection capabilities, it is highly likely that this record attack will not be the biggest for long.&#8221;</p>
<p>According to Qrator, this specific possibility of enabling high-value DDoS attacks was <a class="markup--anchor markup--p-anchor" href="https://drive.google.com/file/u/1/d/1zkep0_EJvRAsTA5mMn0HKi8L5lTYTJsN/view?usp=drive_web" target="_blank" rel="noreferrer noopener" data-href="https://drive.google.com/file/u/1/d/1zkep0_EJvRAsTA5mMn0HKi8L5lTYTJsN/view?usp=drive_web" data-ss1520013592="1">disclosed in 2017</a> by a Chinese group of researchers from the cybersecurity <a class="markup--anchor markup--p-anchor" href="https://0kee.360.cn/" target="_blank" rel="noreferrer noopener" data-href="https://0kee.360.cn" data-ss1520013592="1">0Kee Team</a>. The larger concept was first introduced in a 2014 <strong>Black Hat</strong> U.S. security conference talk titled “<a class="markup--anchor markup--p-anchor" href="media/b6a4b14f.ikov-The-New-Page-Of-Injections-Book-Memcached-Injections-WP.pdf" data-original-source="https://www.blackhat.com/docs/us-14/materials/us-14-Novikov-The-New-Page-Of-Injections-Book-Memcached-Injections-WP.pdf" target="_blank" rel="noreferrer noopener" data-href="media/b6a4b14f.ikov-The-New-Page-Of-Injections-Book-Memcached-Injections-WP.pdf" data-original-source="https://www.blackhat.com/docs/us-14/materials/us-14-Novikov-The-New-Page-Of-Injections-Book-Memcached-Injections-WP.pdf" data-ss1520013592="1">Memcached injections.&#8221;</a></p>
<h4>DDOS VIA RANSOM DEMAND</h4>
<p>On Thursday, KrebsOnSecurity heard from several experts from <strong>Cybereason</strong>, a Boston-based security company that&#8217;s been closely tracking these memcached attacks. Cybereason said its analysis reveals the attackers are embedding a short ransom note and payment address into the junk traffic they&#8217;re sending to memcached services.</p>
<p>Cybereason said it has seen memcached attack payloads that consist of little more than a simple ransom note requesting payment of 50 XMR (<a href="https://en.wikipedia.org/wiki/Monero_(cryptocurrency)" target="_blank" rel="noopener">Monero virtual currency</a>) to be sent to a specific Monero account. In these attacks, Cybereason found, the payment request gets repeated until the file reaches approximately one megabyte in size.</p>
<div id="attachment_42786" style="width: 608px" class="wp-caption aligncenter"><a class="lightbox" href="media/d400fd53.ddosdemand.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/03/ddosdemand.png"><img class="wp-image-42786 " src="media/d400fd53.ddosdemand.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/03/ddosdemand.png" alt="" width="598" height="242" /></a><p class="wp-caption-text">The ransom demand (50 Monero) found in the memcached attacks by Cybereason on Thursday.</p></div>
<p>Memcached can accept files and host files in temporary memory for download by others. So the attackers will place the 1 mb file full of ransom requests onto a server with memcached, and request that file thousands of times &#8212; all the while telling the service that the replies should all go to the same Internet address &#8212; the address of the attack&#8217;s target.</p>
<p>&#8220;The payload is the ransom demand itself, over and over again for about a megabyte of data,&#8221; said <strong>Matt Ploessel</strong>, principal security intelligence researcher at Cybereason. &#8220;We then request the memcached ransom payload over and over, and from multiple memcached servers to produce an extremely high volume DDoS with a simple script and any normal home office Internet connection. We&#8217;re observing people putting up those ransom payloads and DDoSsing people with them.&#8221;<span id="more-42782"></span></p>
<p>Because it only takes a handful of memcached servers to launch a large DDoS, security researchers working to lessen these DDoS attacks have been focusing their efforts on getting Internet service providers (ISPs) and Web hosting providers to block traffic destined for the UDP port used by memcached (port 11211).</p>
<p><a href="https://www.linkedin.com/in/ofer-gayer-17784a66/" target="_blank" rel="noopener">Ofer Gayer</a>, senior product manager at security firm <strong>Imperva</strong>, said many hosting providers have decided to filter port 11211 traffic to help blunt these memcached attacks.</p>
<p>&#8220;The big packets here are very easy to mitigate because this is junk traffic and anything coming from that port (11211) can be easily mitigated,&#8221; Gayer said.</p>
<p>Several different organizations are mapping the geographical distribution of memcached servers that can be abused in these attacks. Here&#8217;s the world at-a-glance, from our friends at <a href="https://memcachedscan.shadowserver.org/" target="_blank" rel="noopener">Shadowserver.org:</a></p>
<div id="attachment_42790" style="width: 609px" class="wp-caption aligncenter"><a class="lightbox" href="media/d5345d43.memcachehosts.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/03/memcachehosts.png"><img class="wp-image-42790" src="media/d5345d43.memcachehosts.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/03/memcachehosts.png" alt="" width="599" height="315" /></a><p class="wp-caption-text">The geographic distribution of memcached servers exposed to the Internet. Image: Shadowserver.org</p></div>
<p>Here are the Top 20 networks that are hosting the most number of publicly accessible memcached servers at this moment, according to data collected by Cybereason:</p>
<div id="attachment_42788" style="width: 607px" class="wp-caption aligncenter"><img class=" wp-image-42788" src="media/a32ad357.top20asns.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/03/top20asns.png" alt="" width="597" height="910" /><p class="wp-caption-text">The global ISPs with the most number of publicly available memcached servers.</p></div>
<p>DDoS monitoring site ddosmon.net publishes <a href="https://ddosmon.net/memcached_amplification_attack" target="_blank" rel="noopener">a live, running list of the latest targets</a> getting pelted with traffic in these memcached attacks.</p>
<p>What do the stats at ddosmon.net tell us? According to <a href="https://netlab.360.com/" target="_blank" rel="noopener">netlab@360</a>, memcached attacks were not super popular as an attack method until very recently.</p>
<p>&#8220;But things have greatly changed since February 24th, 2018,&#8221; netlab wrote in <a href="https://blog.netlab.360.com/memcache-ddos-a-little-bit-more-en/" target="_blank" rel="noopener">a Mar. 1 blog post</a>, noting that in just a few days memcached-based DDoS went from less than 50 events per day, up to 300-400 per day. &#8220;Today&#8217;s number has already reached 1484, with an hour to go.&#8221;</p>
<p>Hopefully, the global ISP and hosting community can come together to block these memcached DDoS attacks. I am encouraged by what I have heard and seen so far, and hope that can continue in earnest before these attacks start becoming more widespread and destructive.</p>
<p>Here&#8217;s the Cybereason video from which that image above with the XMR ransom demand was taken:</p>
<div style="text-align: center;"><iframe src="https://www.youtube.com/embed/DqK4u7mLbok" width="560" height="315" frameborder="0" allowfullscreen="allowfullscreen"></iframe></div>


feed_id: https://krebsonsecurity.com/?p=42687
title: What Is Your Bank’s Security Banking On?
uri: What-Is-Your-Bank-s-Security-Banking-On
url: https://krebsonsecurity.com/2018/03/what-is-your-banks-security-banking-on/
content:
<p>A large number of banks, credit unions and other financial institutions just pushed customers onto new e-banking platforms that asked them to reset their account passwords by entering a username plus some other static identifier &#8212; such as the first six digits of their Social Security number (SSN), or a mix of partial SSN, date of birth and surname. Here&#8217;s a closer look at what may be going on (spoiler: small, regional banks and credit unions have grown far too reliant on the whims of just a few major online banking platform providers).</p>
<p><img class="aligncenter wp-image-42839" src="media/8e6d09c1.moneywave.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/03/moneywave.png" alt="" width="594" height="341" /></p>
<p>You might think it odd that any self-respecting financial institution would seek to authenticate customers via static data like partial SSN for passwords, and you&#8217;d be completely justified for thinking that, too. Nobody has any business using these static identifiers for authentication because they are for sale on most Americans quite easily and cheaply in the cybercrime underground. The <a href="https://krebsonsecurity.com/?s=equifax+breach&amp;x=0&amp;y=0" target="_blank" rel="noopener">Equifax breach</a> might have &#8220;refreshed&#8221; some of those data stores for identity thieves, but most U.S. adults have had their static details (DOB/SSN/MMN, address, previous address, etc) on sale for years now.</p>
<p>On Feb. 16, KrebsOnSecurity reader <strong>Brent Hoeft</strong> shared a copy of an email he&#8217;d just received from his financial institution <strong>Associated Bank</strong>, which at $30+ billion in assets happens to be Wisconsin&#8217;s largest by asset size.</p>
<p>The notice advised:</p>
<blockquote><p>&#8220;Please read and save this information (including the password below) to prepare for your online and mobile <span class="il">banking</span> upgrade.</p>
<p>Our refreshed online and mobile <span class="il">banking</span> experience is officially launching on Monday, February 26, 2018.</p>
<p>We’re excited to share it with you, and want you to be aware of some important details about the transition.</p>
<p>TEMPORARY PASSWORD</p>
<p>Use this temporary password the first time you sign in after the upgrade. Your temporary password is the first four letters of your last name plus the last four digits of your Social Security Number.</p>
<p>XXXX#### [redacted by me but included in the email]</p>
<p>Note: your password is all lowercase without spaces.</p>
<p>Once the upgrade is complete, you will need your temporary password to begin the re-enrollment process.<br />
• Beginning Monday, February 26, you will need to sign in using your existing user ID and the temporary password included above in this email. Please note that you are only required to reenroll in online or mobile <span class="il">banking</span> but can access both using the same user ID and password.<br />
• Once you sign in, you will be prompted to create a new password and establish other security features. Your user ID will remain the same.&#8221;</p></blockquote>
<p>Hoeft said Associated Bank seems to treat the customer username as a secret, something to be protected along with the password.</p>
<p>&#8220;I contacted Associated&#8217;s customer service via email and received a far less satisfying explanation that the user name is required for re-activation and, that since [the username] was not provided in the email, the process they are using is in fact secure,&#8221; Hoeft said.</p>
<p>After speaking with Hoeft, I <a href="https://twitter.com/briankrebs/status/964538799962361856" target="_blank" rel="noopener">tweeted about</a> whether to name and shame the bank before it was too late, or perhaps to try and talk some sense into them privately. Most readers advised that calling attention to the problem before the transition could cause more harm than good, and that at least until after Feb. 26 contacting some of the banks privately was the best idea (which is what I did).</p>
<p>Associated Bank wouldn&#8217;t say who their new consumer online banking platform provider was, but they did say it was one of the big ones. I took that to mean either <strong><a href="https://www.fisglobal.com/" target="_blank" rel="noopener">FIS</a></strong>, <strong><a href="https://www.fiserv.com/index.aspx" target="_blank" rel="noopener">Fiserv</a></strong> or <strong><a href="https://www.jackhenry.com/pages/default.aspx" target="_blank" rel="noopener">Jack Henry</a></strong>, which collectively control approximately 70 percent of the market for bank core processors (according to <a href="media/4840a380.bank_core_market_share_2017.png" data-original-source="https://www.fedfis.com/uploads/8/4/8/8/84888518/bank_core_market_share_2017.png" target="_blank" rel="noopener">FedFIS.com</a>, Fiserv is by far the largest).</p>
<div id="attachment_42823" style="width: 594px" class="wp-caption aligncenter"><img class=" wp-image-42823" src="media/f14b9478.coreprocessor.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/03/coreprocessor.png" alt="" width="584" height="396" /><p class="wp-caption-text">Image: Fedfis.com</p></div>
<p>The bank&#8217;s chief information security officer <strong>Joe Smits</strong> said Associated&#8217;s new consumer online banking platform provider required that new and existing customers log in with a username and a temporary password &#8212; which was described as choice among secondary, static data elements about customers &#8212; such as the first six digits of the customer&#8217;s SSN or date of birth.</p>
<p>Smits added that the bank originally started emailing customers the instructions for figuring out their temporary passwords, but then decided US mail would be a safer option and sent the rest out that way. He said only about 15 percent of Associated Bank customers (~50,000) received instructions about their temporary passwords through email.</p>
<p>I followed up with Hoeft to find out how his online banking upgrade went at Associated Bank. He told me that upon visiting the site, it asked for his username and the temporary password (the first four letters of his last name and the last four digits of his SSN).</p>
<p>&#8220;After entering that I was told to re-enter my temporary password and then create a new password,&#8221; Hoeft said. &#8220;I then was asked to select 5 security questions and provide answers. Next I was asked for a verification phone number. Upon entering that I received a text message with a 4 digit verification code. After entering the code it asked me to finish my profile information including name, email and daytime phone. After that it took me right into my online banking account.&#8221;</p>
<p>Hoeft said it seems like the &#8220;verification&#8221; step that was supposed to create an extra security check didn&#8217;t really add any security at all.</p>
<p>&#8220;If someone were able to get in with the temporary password, they would be able to create a new password, fill out all the security code information, and then provide their phone number to receive the verification code,&#8221; Hoeft said. &#8220;Armed with the verification code they then would be able to get right into my online banking account.&#8221;<span id="more-42687"></span></p>
<h4>OTHER BANKS</h4>
<p>A simple search online revealed Associated Bank wasn&#8217;t alone: Multiple institutions were moving to a new online banking platform all on the same day: Feb. 26, 2018.</p>
<p><a href="https://www.mycutx.com/" target="_blank" rel="noopener">My Credit Union</a> also moved to a new online banking service in February, posting a notice stating that all customers will need to log in with their current username and the last four of their SSN as a temporary password.</p>
<p><strong>Customers Bank</strong>, a $10 billion bank with nearly two dozen branches between Boston and Philadelphia, also told customers that starting Feb. 26 they would need to use a temporary password &#8212; the last six digits of their Social Security number &#8212; to re-enroll in online banking. Here&#8217;s part of their advice, which was<a href="media/e4555122.FIS-Upgrade-Booklet.pdf" data-original-source="https://www.customersbank.com/pdf/FIS-Upgrade-Booklet.pdf" target="_blank" rel="noopener"> published in a PDF</a> on the bank&#8217;s site:</p>
<p>• You may notice a new co-branded logo for Customers Bank and BankMobile (Division Customers Bank).<br />
• Your existing user name for Online Banking will remain the same within the new system; however, it must be entered as all lowercase letters.<br />
• The first time you log into the new Online Banking system, your temporary password is the last 6-digits of your social security number. Your temporary<br />
password will expire on Friday, April 20, 2018. Please be sure to log in prior to that date.<br />
• Online Banking includes multi-factor authentication which will need to be reestablished as part of the initial sign in to the system.<br />
• Your username and password credentials for Online Banking will be the same for Mobile Banking. Note: Before accessing the new Mobile Banking services,<br />
you must first login to our enhanced Online Banking system to change your password.<br />
• You will also need to enroll your mobile device, either through Online Banking by visiting the Mobile Banking Center option, or directly on the device through the<br />
app. Both options will require additional authentication.</p>
<p><strong>Columbia Bank</strong>, which has 140 branches in Washington, Oregon and Idaho, also switched gears on Feb. 26, but used a more sensible approach: Sending customers a new user ID, organization ID and temporary password in two separate mailings.</p>
<h4>ANALYSIS</h4>
<p>My tweet about whether to name Associated Bank attracted the attention of at least two banking industry security regulators, each of whom spoke with KrebsOnSecurity on condition of not being identified by name or regulatory agency.</p>
<p>Both said their agencies would be using the above examples in briefings with member institutions as instructional on how not to do online banking securely. Both also said small to mid-sized banks are massively beholden to their platform providers, and many banks simply accept the defaults instead of pushing for stronger alternatives.</p>
<p>&#8220;I have a lot of communications directly with the chief information security officers, chief security officers, and chief information officers in many institutions,&#8221; one regulator said. &#8220;<span class="pullquote pqright">Many of them have massively dumbed down their password requirements. A lot of smaller institutions often don’t understand the risk involved in online banking, which is why they try to outsource the whole thing to someone else. But they can’t outsource accountability.&#8221;</span></p>
<p>One of the regulators I spoke with suggested that all of the banks they&#8217;d seen transitioning to a new online banking platform on Feb. 26 were customers of Fiserv &#8212; the nation&#8217;s largest online banking platform provider.</p>
<p>Fiserv did not respond to specific questions for this story, saying only in a written statement that: &#8220;Fiserv regularly partners with financial institutions to provide capabilities that help mitigate and manage risk, enhance the customer experience, and allow banks to remain competitive. A variety of methodologies are used by institutions to enroll and authenticate new users onto online banking platforms, and password authentication is one of multiple layers of security used to protect customers.&#8221;</p>
<p>Both banking industry regulators I spoke with said a basic problem is that many smaller institutions unfortunately still treat usernames as secret codes. I have railed against this practice for years, but far too many banks treat customer usernames as part of their security, even though most customers pick something very close to the first part of their email address (before the &#8220;@&#8221; sign). I&#8217;ve even skewered some of the airline industry giants for doing the same (United does this with <a href="https://krebsonsecurity.com/2017/08/why-its-still-a-bad-idea-to-post-or-trash-your-airline-boarding-pass/" target="_blank" rel="noopener">its super-secret frequent flyer account number</a>).</p>
<p>&#8220;I think this will be an opportunity for us to coach them on that,&#8221; one banking regulator said. &#8220;This process has to involve random password generation and that needs to be standard operating procedure. If you can shortcut security just by supplying static data like SSN, it&#8217;s all screwed. Some of these organizations have had such poor control structure for so long they don&#8217;t even understand how bad it is.&#8221;</p>
<p>The other regulator said another challenge is how long banks should wait before disabling accounts if consumers don&#8217;t log in to the new online banking system.</p>
<p>&#8220;What they’re going to do is set up all these users on this brand new system and give them default passwords,&#8221; the regulator said. &#8220;Some individuals will log into their bank account every day, others once a month and sometimes quite randomly. So, how are they going to control that window of opportunity? At some point, maybe after a couple of weeks, they need to just disable those other accounts and have people start from scratch.&#8221;</p>
<p>The first regulator said it appears many banks (and their platform providers) are singularly focused on making these transitions as seamless and painless as possible for the financial institution and its customers.</p>
<p>&#8220;I think they’re looking at making it easier for their customers and lessening the fallout as they get fewer angry and frustrated calls,&#8221; the regulator said. &#8220;That&#8217;s their incentive more than anything else.&#8221;</p>
<h4>WHAT CAN YOU DO?</h4>
<p>While it may appear that banks are more afraid of calls from their customers than of fallout from identity thieves and hackers, remember that you the consumer can shop with your wallet, and should move your funds to another bank if you&#8217;re unhappy with the security practices of your current institution.</p>
<p>Also, don&#8217;t re-use passwords. In fact, wherever possible don&#8217;t use passwords at all. Instead, choose passphrases over passwords (remember, length is key). Unfortunately, passphrases may not be possible because some banks have chosen to truncate passwords after a certain number of characters, and to disallow special symbols.</p>
<p>If you&#8217;re the kind of person who likes to use the same password across multiple sites, then <a href="https://lifehacker.com/5529133/five-best-password-managers" target="_blank" rel="noopener">a password manager is definitely for you</a>. That&#8217;s because password managers pick strong, long and secure passwords for you and the only thing you have to remember is a single master password.</p>
<p>Please consider any two-step or two-factor authentication options your financial institution may offer, and be sure to take full advantage of that when it&#8217;s available. Also, ask your bank <a href="https://krebsonsecurity.com/2017/11/simple-banking-security-tip-verbal-passwords/" target="_blank" rel="noopener">to require a unique verbal password</a> before discussing any of your account details over the phone; this prevents someone from calling in to your bank and convincing a customer service rep that he&#8217;s you just because he can regurgitate your static personal details.</p>
<p>Finally, take steps to prevent your security from being backdoored by your mobile provider: Check out <a href="https://krebsonsecurity.com/2018/02/how-to-fight-mobile-number-port-out-scams/" target="_blank" rel="noopener">last week&#8217;s tips on blocking mobile number port-out scams</a>, which thieves sometimes use in cashing out hacked bank accounts.</p>


feed_id: https://krebsonsecurity.com/?p=42636
title: Look-Alike Domains and Visual Confusion
uri: Look-Alike-Domains-and-Visual-Confusion
url: https://krebsonsecurity.com/2018/03/look-alike-domains-and-visual-confusion/
content:
<p>How good are you at telling the difference between domain names you know and trust and impostor or look-alike domains? The answer may depend on how familiar you are with the nuances of <strong>internationalized domain names</strong> (IDNs), as well as which browser or Web application you&#8217;re using.</p>
<p>For example, how does your browser interpret the following domain? I&#8217;ll give you a hint: Despite appearances, it is most certainly <strong><em>not</em></strong> the actual domain for software firm <strong>CA Technologies</strong> (formerly <strong>Computer Associates Intl Inc.</strong>), which owns the original ca.com domain name:</p>
<p><a href="https://www.са.com/" target="_blank" rel="noopener">https://www.са.com/</a></p>
<p>Go ahead and click on the link above or cut-and-paste it into a browser address bar. If you&#8217;re using <strong>Google Chrome</strong>, <strong>Apple&#8217;s Safari</strong>, or some recent version of <strong>Microsoft</strong>&#8216;s <strong>Internet Explorer</strong> or <strong>Edge browsers</strong>, you should notice that the address converts to &#8220;<strong>xn--80a7a.com</strong>.&#8221; This is called &#8220;punycode,&#8221; and it allows browsers to render domains with non-Latin alphabets like Cyrillic and Ukrainian.</p>
<p>Below is what it looks like in Edge on <strong>Windows 10</strong>;<strong> </strong>Google Chrome renders it much the same way. Notice what&#8217;s in the address bar (ignore the &#8220;fake site&#8221; and &#8220;Welcome to&#8230;&#8221; text, which was added as a courtesy by the person who registered this domain):</p>
<div id="attachment_42894" style="width: 608px" class="wp-caption aligncenter"><a class="lightbox" href="media/4559a4d6.edgewin10-arrow.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/03/edgewin10-arrow.png"><img class="wp-image-42894" src="media/4559a4d6.edgewin10-arrow.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/03/edgewin10-arrow.png" alt="" width="598" height="64" /></a><p class="wp-caption-text">The domain https://www.са.com/ as rendered by Microsoft Edge on Windows 10. The rest of the text in the image (beginning with “Welcome to a site…”) was added by the person who registered this test domain, not the browser.</p></div>
<p>IE, Edge, Chrome and Safari all will convert https://www.са.com/ into its punycode output (xn--80a7a.com), in part to warn visitors about any confusion over look-alike domains registered in other languages. But if you load that domain in <strong>Mozilla Firefox </strong>and look at the address bar, you&#8217;ll notice there&#8217;s no warning of possible danger ahead. It just looks like it&#8217;s loading the real ca.com:</p>
<div id="attachment_42856" style="width: 605px" class="wp-caption aligncenter"><a class="lightbox" href="media/2dcc85f2.fakeCAmozilla.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/03/fakeCAmozilla.png"><img class="wp-image-42856" src="media/2dcc85f2.fakeCAmozilla.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/03/fakeCAmozilla.png" alt="" width="595" height="142" /></a><p class="wp-caption-text">What the fake ca.com domain looks like when loaded in Mozilla Firefox. A browser certificate ordered from Comodo allows it to include the green lock (https://) in the address bar, adding legitimacy to the look-alike domain. The rest of the text in the image (beginning with &#8220;Welcome to a site&#8230;&#8221;) was added by the person who registered this test domain, not the browser. Click to enlarge.</p></div>
<p>The domain &#8220;xn--80a7a.com&#8221; pictured in the first screenshot above is the Ukranian punycode for the Ukrainian letters for &#8220;s&#8221; (which is represented by the character &#8220;c&#8221; in Russian and Ukrainian), as well as an identical Ukrainian &#8220;a&#8221;.</p>
<p>It was registered by <strong>Alex Holden, </strong>founder of Milwaukee, Wis.-based <strong>Hold Security Inc.</strong> Holden&#8217;s been experimenting with how the different browsers handle punycodes in the browser and via email. Holden grew up in what was then the Soviet Union and speaks both Russian and Ukrainian, and he&#8217;s been playing with Cyrillic letters to spell English words in domain names.</p>
<p>Letters like A and O look exactly the same and the only difference is their <a href="https://en.wikipedia.org/wiki/List_of_Unicode_characters" target="_blank" rel="noopener">Unicode value</a>. There are more than <a href="https://unicode-table.com/en/" target="_blank" rel="noopener">136,000 Unicode characters</a> used to represent letters and symbols in 139 modern and historic scripts, so there&#8217;s a ton of room for look-alike or malicious/fake domains.</p>
<p>For example, &#8220;a&#8221; in Latin is the Unicode value &#8220;0061&#8221; and in Cyrillic is &#8220;0430.&#8221;  To a human, the graphical representation for both looks the same, but for a computer there is a huge difference. Internationalized domain names (IDNs) allow domain names to be registered in non-Latin letters (<a href="https://www.ietf.org/rfc/rfc3492.txt" target="_blank" rel="noopener">RFC 3492</a>), provided the domain is all in the same language; trying to mix two different IDNs in the same name causes the domain registries to reject the registration attempt.</p>
<p>So, in the Cyrillic alphabet (Russian/Ukrainian), we can spell АТТ, УАНОО, ХВОХ, and so on. As you can imagine, the potential opportunity for impersonation and abuse are great with IDNs. Here&#8217;s a snippet from a larger chart Holden put together showing some of the more common ways that IDNs can be made to look like established, recognizable domains:</p>
<div id="attachment_42863" style="width: 609px" class="wp-caption aligncenter"><a class="lightbox" href="media/da67ab26.punywhat.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/03/punywhat.png"><img class="wp-image-42863" src="media/da67ab26.punywhat.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/03/punywhat.png" alt="" width="599" height="280" /></a><p class="wp-caption-text">Image: Hold Security.</p></div>
<p>Holden also was able to register a valid SSL encryption certificate for https://www.са.com from <a href="https://www.comodo.com/" target="_blank" rel="noopener">Comodo.com</a>, which would only add legitimacy to the domain were it to be used in phishing attacks against CA customers by bad guys, for example.<span id="more-42636"></span></p>
<h4>A SOLUTION TO VISUAL CONFUSION</h4>
<p><em>To be clear, the potential threat highlighted by Holden&#8217;s experiment is not new.</em> Security researchers have long warned about the use of look-alike domains that abuse special IDN/Unicode characters. Most of the major browser makers have responded in some way by making their browsers warn users about potential punycode look-alikes.</p>
<p>With the exception of Mozilla, which by most accounts is the third most-popular Web browser. And I wanted to know why. I&#8217;d read the <a href="https://wiki.mozilla.org/index.php?title=Gerv%27s_IDN_Display_Algorithm_FAQ&amp;type=revision&amp;diff=1169268&amp;oldid=1168926" target="_blank" rel="noopener">Mozilla Wiki&#8217;s IDN Display Algorithm FAQ</a>,&#8221; so I had an idea of what Mozilla was driving at in their decision not to warn Firefox users about punycode domains: Nobody wanted it to look like Mozilla was somehow treating the non-Western world as second-class citizens.</p>
<p>I wondered why Mozilla doesn&#8217;t just have Firefox alert users about punycode domains unless the user has already specified that he or she wants a non-English language keyboard installed. So I asked that in some questions I sent to their media team. They sent the following short statement in reply:</p>
<blockquote><p>&#8220;Visual confusion attacks are not new and are difficult to address while still ensuring that we render everyone’s domain name correctly. We have solved almost all IDN spoofing problems by implementing script mixing restrictions, and we also make use of Safe Browsing technology to protect against phishing attacks. While we continue to investigate better ways to protect our users, we ultimately believe domain name registries are in the best position to address this problem because they have all the necessary information to identify these potential spoofing attacks.&#8221;</p></blockquote>
<p>If you&#8217;re a Firefox user and would like Firefox to always render IDNs as their punycode equivalent when displayed in the browser address bar, type &#8220;about:config&#8221; without the quotes into a Firefox address bar. Then in the &#8220;search:&#8221; box type &#8220;punycode,&#8221; and you should see one or two options there. The one you want is called &#8220;network.IDN_show_punycode.&#8221; By default, it is set to &#8220;false&#8221;; double-clicking that entry should change that setting to &#8220;true.&#8221;</p>
<p><a class="lightbox" href="media/bb2c0dfe.aboutpunycode.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/03/aboutpunycode.png"><img class="aligncenter wp-image-42886" src="media/bb2c0dfe.aboutpunycode.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/03/aboutpunycode.png" alt="" width="598" height="144" /></a></p>
<p>Incidentally, anyone using the <a href="https://www.torproject.org/projects/torbrowser.html.en" target="_blank" rel="noopener">Tor Browser</a> to anonymize their surfing online is exposed to IDN spoofing because Tor by default uses Mozilla as well. I could definitely see spoofed IDNs being used in targeting phishing attacks aimed at Tor users, many of whom have significant assets tied up in virtual currencies. Fortunately, the same &#8220;about:config&#8221; instructions work just as well on Tor to display punycode in lieu of IDNs.</p>
<p>Holden said he&#8217;s still in the process of testing how various email clients and Web services handle look-alike IDNs. For example, it&#8217;s clear that <strong>Twitter</strong> sees nothing wrong with sending the look-alike CA.com domain in messages to other users without any context or notice.<strong> Skype</strong>, on the other hand, seems to truncate the IDN link, sending clickers to a non-existent page.</p>
<p>&#8220;I&#8217;d say that most email services and clients are either vulnerable or not fully protected,&#8221; Holden said.</p>
<p>For a look at how phishers or other scammers might use IDNs to abuse your domain name, check out <a href="https://holdintegrity.com/checker" target="_blank" rel="noopener">this domain checker</a> that Hold Security developed. Here&#8217;s the first page of results for krebsonsecurity.com, which indicate that someone at one point registered <strong>krebsoṇsecurity[dot]com</strong> (that domain includes a lowercase &#8220;n&#8221; with a tiny dot below it, a character used by several dozen scripts). The results in yellow are just possible (unregistered) domains based on common look-alike IDN characters.</p>
<div id="attachment_42865" style="width: 607px" class="wp-caption aligncenter"><img class=" wp-image-42865" src="media/36c9d6e2.idn-kos.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/03/idn-kos.png" alt="" width="597" height="600" /><p class="wp-caption-text">The first page of warnings for Krebsonsecurity.com from Hold Security&#8217;s IDN scanner tool.</p></div>
<p>I wrote this post mainly because I wanted to learn more about the potential phishing and malware threat from look-alike domains, and I hope the information here has been interesting if not also useful. I don&#8217;t think this kind of phishing is a terribly pressing threat (especially given how far less complex phishing attacks seem to succeed just fine for now). But it sure can&#8217;t hurt Firefox users to change the default &#8220;visual confusion&#8221; behavior of the browser so that it always displays punycode in the address bar (see the solution mentioned above).</p>
<p>[Author’s note: I am listed as an adviser to Hold Security on the company’s Web site. However this is not a role for which I have been compensated in any way now or in the past.]</p>


feed_id: https://krebsonsecurity.com/?p=42689
title: Checked Your Credit Since the Equifax Hack?
uri: Checked-Your-Credit-Since-the-Equifax-Hack
url: https://krebsonsecurity.com/2018/03/checked-your-credit-since-the-equifax-hack/
content:
<p>A recent consumer <a href="https://www.creditcards.com/credit-card-news/equifax-data-breach-cellphone-survey.php" target="_blank" rel="noopener">survey</a> suggests that half of all Americans still haven&#8217;t checked their credit report since <a href="https://krebsonsecurity.com/?s=equifax+breach&amp;x=0&amp;y=0" target="_blank" rel="noopener">the Equifax breach</a> last year exposed the Social Security numbers, dates of birth, addresses and other personal information on nearly 150 million people. If you&#8217;re in that fifty percent, please make an effort to remedy that soon.</p>
<p><img class="aligncenter wp-image-42918" src="media/78c9ca8e.creditreport.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/03/creditreport.png" alt="" width="595" height="195" /></p>
<p>Credit reports from the three major bureaus &#8212; <strong>Equifax</strong>, <strong>Experian</strong> and <strong>TransUnion</strong> &#8212; can be obtained online for free at <a href="https://www.annualcreditreport.com" target="_blank" rel="noopener">annualcreditreport.com</a> &#8212; the only Web site mandated by Congress to serve each American a free credit report every year.</p>
<p>Annualcreditreport.com is run by <a href="http://search.sunbiz.org/Inquiry/CorporationSearch/SearchResultDetail?inquirytype=EntityName&amp;directionType=Initial&amp;searchNameOrder=CENTRALSOURCE%20M040000050480&amp;aggregateId=forl-m04000005048-aa2368e0-cd2b-495e-bc73-cc150edebacf&amp;searchTerm=central%20source%20llc&amp;listNameOrder=CENTRALSOURCE%20M040000050480" target="_blank" rel="noopener">a Florida-based company</a>, but its data is supplied by the major credit bureaus, which struggled mightily to meet consumer demand for free credit reports in the immediate aftermath of the Equifax breach. Personally, I was unable to order a credit report for either me or my wife even two weeks after the Equifax breach went public: The site just kept returning errors and telling us to request the reports in writing via the U.S. Mail.</p>
<p>Based on thousands of comments left here in the days following the Equifax breach disclosure, I suspect many readers experienced the same but forgot to come back and try again. If this describes you, please take a moment this week to order your report(s) (and perhaps your spouse&#8217;s) and see if anything looks amiss. If you spot an error or something suspicious, contact the bureau that produced the report to correct the record immediately.</p>
<p>Of course, keeping on top of your credit report requires discipline, and if you&#8217;re not taking advantage of all three free reports each year you need to get a plan. My strategy is to put a reminder on our calendar to order a new report every four months or so, each time from a different credit bureau.<span id="more-42689"></span></p>
<p>Whenever stories about credit reports come up, so do the questions from readers about the efficacy and value of credit monitoring services. KrebsOnSecurity has <a href="https://krebsonsecurity.com/2014/03/are-credit-monitoring-services-worth-it/" target="_blank" rel="noopener">not been particularly kind</a> to the credit monitoring industry; many stories here have highlighted the reality that they are ineffective at preventing identity theft or existing account fraud, and that the most you can hope for from them is that they alert you when an ID thief tries to get new lines of credit in your name.</p>
<p>But there is one area where I think credit monitoring services can be useful: Helping you sort things out with the credit bureaus in the event that there are discrepancies or fraudulent entries on your credit report. I&#8217;ve personally worked with three different credit monitoring services, two of which were quite helpful in resolving fraudulent accounts opened in our names.</p>
<p>At $10-$15 a month, are credit monitoring services worth the cost? Probably not on an annual basis, but perhaps during periods when you actively need help. However, if you&#8217;re not already signed up for one of these monitoring services, don&#8217;t be too quick to whip out that credit card: There&#8217;s a good chance you have at least a year&#8217;s worth available to you at no cost.</p>
<p>If you&#8217;re willing to spend the time, check out a few of the state Web sites which publish lists of companies that have had a recent data breach. In most cases, those publications come with a sample consumer alert letter providing information about how to sign up for free credit monitoring. California publishes probably the most comprehensive such lists <a href="https://oag.ca.gov/privacy/databreach/list" target="_blank" rel="noopener">at this link</a>. Washington state published their list <a href="http://www.atg.wa.gov/data-breach-notifications" target="_blank" rel="noopener">here</a>; and here&#8217;s <a href="http://www.marylandattorneygeneral.gov/Pages/IdentityTheft/breachnotices.aspx#InplviewHashac628f51-0774-4b71-a77e-77d6b9909f7e=SortField%3DDate_x0020_Received-SortDir%3DAsc-WebPartID%3D%7BAC628F51--0774--4B71--A77E--77D6B9909F7E%7D" target="_blank" rel="noopener">Maryland&#8217;s list</a>. There are more.</p>
<p>It&#8217;s important for everyone to remember that as bad as the Equifax breach was (and it was <a href="https://krebsonsecurity.com/2017/09/equifax-breach-response-turns-dumpster-fire/" target="_blank" rel="noopener">a dumpster fire all around</a>), most of the consumer data exposed in the breach has been for sale in the cybercrime underground for many years on a majority of Americans. If anything, the Equifax breach may have simply refreshed some of those criminal data stores.</p>
<p>That&#8217;s why I&#8217;ve persisted over the years in urging my fellow Americans to consider freezing their credit files. A security freeze essentially blocks any potential creditors from being able to view or “pull” your credit file, unless you affirmatively unfreeze or thaw your file beforehand.</p>
<p>With a freeze in place on your credit file, ID thieves can apply for credit in your name all they want, but they will not succeed in getting new lines of credit in your name because few if any creditors will extend that credit without first being able to gauge how risky it is to loan to you (i.e., view your credit file).</p>
<p>Bear in mind that if you haven&#8217;t yet frozen your credit file and you&#8217;re interested in signing up for credit monitoring services, you&#8217;ll need to sign up first before freezing your file. That&#8217;s because credit monitoring services typically need to access your credit file to enroll you, and if you freeze it they can&#8217;t do that.</p>
<p>The previous two tips came from <a href="https://krebsonsecurity.com/2017/09/the-equifax-breach-what-you-should-know/" target="_blank" rel="noopener">a primer I wrote a few days after the Equifax breach</a>, which is an in-depth Q&amp;A about some of the more confusing aspects of policing your credit, including freezes, credit monitoring, fraud alerts, credit locks and second-tier credit bureaus.</p>


feed_id: https://krebsonsecurity.com/?p=42926
title: Flash, Windows Users: It’s Time to Patch
uri: Flash-Windows-Users-It-s-Time-to-Patch
url: https://krebsonsecurity.com/2018/03/flash-windows-users-its-time-to-patch/
content:
<p><strong>Adobe</strong> and <strong>Microsoft</strong> each pushed critical security updates to their products today. Adobe&#8217;s got a new version of <strong>Flash Player</strong> available, and Microsoft released 14 updates covering more than 75 vulnerabilities, two of which were publicly disclosed prior to today&#8217;s patch release.</p>
<p><img class="alignright wp-image-26837" src="media/863df0f6.brokenwindows.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2014/07/brokenwindows.png" alt="" width="207" height="217" />The Microsoft updates affect all supported <strong>Windows</strong> operating systems, as well as all supported versions of <strong>Internet Explorer/Edge</strong>, <strong>Office</strong>, <strong>Sharepoint</strong> and <strong>Exchange Server</strong>.</p>
<p>All of the critical vulnerabilities from Microsoft are in browsers and browser-related technologies, according to <a href="https://blog.qualys.com/laws-of-vulnerabilities/2018/03/13/march-patch-tuesday-75-microsoft-vulnerabilities-2-for-adobe" target="_blank" rel="noopener">a post</a> from security firm <strong>Qualys</strong>.</p>
<p>&#8220;It is recommended that these be prioritized for workstation-type devices,&#8221; wrote <strong>Jimmy Graham</strong>, director of product management at Qualys. &#8220;Any system that accesses the Internet via a browser should be patched.&#8221;</p>
<p>The Microsoft vulnerabilities that were publicly disclosed prior to today involve Microsoft Exchange Server 2010 through 2016 editions (<a href="https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0924" target="_blank" rel="noopener">CVE-2018-0940</a>) and <strong>ASP.NET Core 2.0</strong> (<a href="https://nvd.nist.gov/vuln/detail/CVE-2018-0784" target="_blank" rel="noopener">CVE-2018-0808</a>), said <strong>Chris Goettl</strong> at <a href="https://www.ivanti.com/blog/category/patch-tuesday/" target="_blank" rel="noopener">Ivanti</a>. Microsoft says it has no evidence that attackers have yet to exploit either flaw in active attacks online.</p>
<p>But Goettl says public disclosure means enough information was released publicly for an attacker to get a jump start or potentially to have access to proof-of-concept code making an exploit more likely. &#8220;Both of the disclosed vulnerabilities are rated as Important, so not as severe, but the risk of exploit is higher due to the disclosure,&#8221; Goettl said.<span id="more-42926"></span></p>
<p><img class="alignleft size-full wp-image-18875" src="media/18bb50f1.brokenflash-a.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2013/02/brokenflash-a.png" alt="" width="211" height="180" />Microsoft says by default, Windows 10 receives updates automatically, &#8220;and for customers running previous versions, we recommend they <a href="https://support.microsoft.com/en-us/help/306525/how-to-configure-and-use-automatic-updates-in-windows" data-ss1520968935="1">turn on automatic updates</a> as a best practice.&#8221; Microsoft doesn&#8217;t make it easy for Windows 10 users to change this setting, but <a href="https://www.howtogeek.com/224471/how-to-prevent-windows-10-from-automatically-downloading-updates/" target="_blank" rel="noopener">it is possible</a>. For all other Windows OS users, if you&#8217;d rather be alerted to new updates when they&#8217;re available so you can choose when to install them, there&#8217;s a setting for that in <strong>Windows Update</strong>.</p>
<p>Adobe&#8217;s <a href="https://helpx.adobe.com/security/products/flash-player/apsb18-05.html" target="_blank" rel="noopener">Flash Player update</a> fixes at least two critical bugs in the program. Adobe said it is not aware of any active exploits in the wild against either flaw, but if you&#8217;re not using Flash routinely for many sites, you probably want to disable or remove this awfully buggy program.</p>
<p>Just last month Adobe issued a Flash update to fix two vulnerabilities that were being used in active attacks in which merely tricking a victim into viewing a booby-trapped Web site or file could give attackers complete control over the vulnerable machine. It would be one thing if these zero-day flaws in Flash were rare, but <a href="https://krebsonsecurity.com/?s=flash+player+zero+day&amp;x=0&amp;y=0" target="_blank" rel="noopener">this is hardly an isolated occurrence.</a></p>
<p>Adobe is <a href="https://krebsonsecurity.com/2017/08/flash-player-is-dead-long-live-flash-player/" target="_blank" rel="noopener">phasing out Flash entirely by 2020</a>, but most of the major browsers already take steps to hobble Flash. And with good reason: It’s a major security liability. Chrome also bundles Flash, but blocks it from running on all but a handful of popular sites, and then only after user approval.</p>
<p>For Windows users with Mozilla Firefox installed, the browser prompts users to enable Flash on a per-site basis. Through the end of 2017 and into 2018, Microsoft Edge will continue to ask users for permission to run Flash on most sites the first time the site is visited, and will remember the user’s preference on subsequent visits.</p>
<p>The latest <a href="https://helpx.adobe.com/security/products/flash-player/apsb18-03.html" target="_blank" rel="noopener">standalone version</a> of Flash that addresses these bugs is 29.0.0.113  for Windows, <strong>Mac</strong>, <strong>Linux</strong> and <strong>Chrome OS</strong>. But most users probably would be better off manually hobbling or removing Flash altogether, since so few sites actually require it still. Disabling Flash in Chrome is simple enough. Paste “<a href="chrome://settings/content" target="_blank" rel="noopener">chrome://settings/content</a>” into a Chrome browser bar and then select “Flash” from the list of items. By default it should be set to “Ask first” before running Flash, although users also can disable Flash entirely here or whitelist and blacklist specific sites.</p>


feed_id: https://krebsonsecurity.com/?p=42946
title: Who Is Afraid of More Spams and Scams?
uri: Who-Is-Afraid-of-More-Spams-and-Scams
url: https://krebsonsecurity.com/2018/03/who-is-afraid-of-more-spams-and-scams/
content:
<p>Security researchers who rely on data included in Web site domain name records to combat spammers and scammers will likely lose access to that information for at least six months starting at the end of May 2018, under a new proposal that seeks to bring the system in line with new European privacy laws. The result, some experts warn, will likely mean more spams and scams landing in your inbox.</p>
<p><img class="aligncenter wp-image-42559" src="media/03721200.whois.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/02/whois.png" alt="" width="598" height="118" /></p>
<p>On May 25, the <a href="https://gdpr-info.eu/" target="_blank" rel="noopener">General Data Protection Regulation</a> (GDPR) takes effect. The law, enacted by the European Parliament, requires companies to get affirmative consent for any personal information they collect on people within the European Union. Organizations that violate the GDPR could face fines of <em>up to four percent of global annual revenues</em>.</p>
<p>In response, the <a href="https://www.icann.org/" target="_blank" rel="noopener">Internet Corporation for Assigned Names and Numbers</a> (ICANN) — the nonprofit entity that manages the global domain name system — has proposed redacting key bits of personal data from WHOIS, the system for querying databases that store the registered users of domain names and blocks of Internet address ranges (IP addresses).</p>
<p>Under current ICANN rules, domain name registrars should collect and display a variety of data points when someone performs a WHOIS lookup on a given domain, such as the registrant’s name, address, email address and phone number. Most registrars offer a privacy protection service that shields this information from public WHOIS lookups; some registrars charge a nominal fee for this service, while others offer it for free.</p>
<p>But in a bid to help registrars comply with the GDPR, ICANN is moving forward on a plan to remove critical data elements from all public WHOIS records. Under the new system, registrars would collect all the same data points about their customers, yet limit how much of that information is made available via public WHOIS lookups.</p>
<p>The data to be redacted includes the name of the person who registered the domain, as well as their phone number, physical address and email address. The new rules would apply to all domain name registrars globally.</p>
<p>ICANN has proposed creating an &#8220;accreditation system&#8221; that would vet access to personal data in WHOIS records for several groups, including journalists, security researchers, and law enforcement officials, as well as intellectual property rights holders who routinely use WHOIS records to combat piracy and trademark abuse.</p>
<p>But at <a href="https://61.schedule.icann.org/meetings/647709" target="_blank" rel="noopener">an ICANN meeting in San Juan, Puerto Rico</a> on Thursday, ICANN representatives conceded that a proposal for how such a vetting system might work probably would not be ready until December 2018. Assuming ICANN meets that deadline, it could be many months after that before the hundreds of domain registrars around the world take steps to adopt the new measures.</p>
<p class="pv-top-card-section__headline Sans-19px-black-85%"><strong>Gregory Mounier</strong>, head of outreach at <a href="https://en.wikipedia.org/wiki/Europol" target="_blank" rel="noopener">EUROPOL</a>&#8216;s <a href="https://www.europol.europa.eu/about-europol/european-cybercrime-centre-ec3" target="_blank" rel="noopener">European Cybercrime Center</a> and member of ICANN&#8217;s <strong>Public Safety Working Group</strong>, said the new WHOIS plan could leave security researchers in the lurch &#8212; at least in the short run.</p>
<p>&#8220;If you don&#8217;t have an accreditation system by 25 May then there&#8217;s no means for cybersecurity folks to get access to this information,&#8221; Mounier told KrebsOnSecurity. &#8220;Let&#8217;s say you&#8217;re monitoring a botnet and have 10.000 domains connected to that and you want to find information about them in the WHOIS records, you won&#8217;t be able to do that anymore. It probably won&#8217;t be implemented before December 2018 or January 2019, and that may mean security gaps for many months.&#8221;</p>
<p><strong>Rod Rasmussen</strong>, chair of ICANN&#8217;s Security and Stability Advisory Committee, said ICANN does not have a history of getting things done before or on set deadlines, meaning it may be well more than six months before researchers and others can get vetted to access personal information in WHOIS data.</p>
<p>Asked for his take on the chances that ICANN and the registrar community might still be designing the vetting system this time next year, Rasmussen said &#8220;100 percent.&#8221;</p>
<p><span class="pullquote pqright">&#8220;A lot of people who are using this data won&#8217;t be able to get access to it, and it&#8217;s not going to be pretty,&#8221; Rasmussen said.</span> &#8220;Once things start going dark it will have a cascading effect. Email deliverability is going to be one issue, and the amount of spam that shows up in peoples&#8217; inboxes will be climbing rapidly because a lot of anti-spam technologies rely on WHOIS for their algorithms.&#8221;</p>
<p>As I noted in <a href="https://krebsonsecurity.com/2018/02/new-eu-privacy-law-may-weaken-security/" target="_blank" rel="noopener">last month&#8217;s story on this topic</a>, WHOIS is probably the single most useful tool we have right now for tracking down cybercrooks and/or for disrupting their operations. On any given day I probably perform 20-30 different WHOIS queries; on days I&#8217;ve set aside for deep-dive research, I may run hundreds of WHOIS searches.<span id="more-42946"></span></p>
<p>WHOIS records are a key way that researchers reach out to Web site owners when their sites are hacked to host phishing pages or to foist malware on visitors. These records also are indispensable for tracking down cybercrime victims, sources and the cybercrooks themselves. I remain extremely concerned about the potential impact of WHOIS records going dark across the board.</p>
<p>There is one last possible &#8220;out&#8221; that could help registrars temporarily sidestep the new privacy regulations: ICANN board members told attendees at Thursday&#8217;s gathering in Puerto Rico that they had asked European regulators for a &#8220;forbearance&#8221; &#8212; basically, permission to be temporarily exempted from the new privacy regulations during the time it takes to draw up and implement a WHOIS accreditation system.</p>
<p>But so far there has been no reply, and several attendees at ICANN&#8217;s meeting Thursday observed that European regulators rarely grant such requests.</p>
<p>Some registrars are already moving forward with their own plans on WHOIS privacy. <strong>GoDaddy</strong>, one of the world’s largest domain registrars, recently began redacting most registrant data from WHOIS records for domains that are queried via third-party tools. And experts say it seems likely that other registrars will follow GoDaddy’s lead before the May 25 GDPR implementation date, if they haven&#8217;t already.</p>


feed_id: https://krebsonsecurity.com/?p=42978
title: Adrian Lamo, ‘Homeless Hacker’ Who Turned in Chelsea Manning, Dead at 37
uri: Adrian-Lamo-Homeless-Hacker-Who-Turned-in-Chelsea-Manning-Dead
url:
https://krebsonsecurity.com/2018/03/adrian-lamo-homeless-hacker-who-turned-in-chelsea-manning-dead-at-37/

content:
<p><strong>Adrian Lamo</strong>, the hacker probably best known for breaking into <strong>The New York Times</strong>&#8216;s network and for reporting <strong>Chelsea Manning</strong>&#8216;s theft of classified documents to the FBI, was found dead in a Kansas apartment on Wednesday. Lamo was widely reviled and criticized for turning in Manning, but that chapter of his life eclipsed the profile of a complex individual who taught me quite a bit about security over the years.</p>
<div id="attachment_42984" style="width: 298px" class="wp-caption alignright"><img class=" wp-image-42984" src="media/8b17500d.lamo-wiki.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/03/lamo-wiki.png" alt="" width="288" height="194" /><p class="wp-caption-text">Adrian Lamo, in 2006. Source: Wikipedia.</p></div>
<p>I first met Lamo in 2001 when I was a correspondent for <strong>Newsbytes.com</strong>, a now-defunct tech publication that was owned by <strong>The Washington Post</strong> at the time. A mutual friend introduced us over AOL Instant Messenger, explaining that Lamo had worked out a simple method allowing him to waltz into the networks of some of the world&#8217;s largest media companies using nothing more than a Web browser.</p>
<p>The panoply of alternate nicknames he used on instant messenger in those days shed light on a personality not easily grasped: Protagonist, Bitter Geek, AmINotMerciful, Unperceived, Mythos, Arcane, truefaith, FugitiveGame.</p>
<p>In this, as in so many other ways, Lamo was a study in contradictions: Unlike most other hackers who break into online networks without permission, he didn&#8217;t try to hide behind the anonymity of screen names or Internet relay chat networks.</p>
<p>By the time I met him, Adrian had already earned the nickname &#8220;the homeless hacker&#8221; because he had no fixed address, and found shelter most evenings in abandoned buildings or on friend&#8217;s couches. He launched the bulk of his missions from Internet cafes or through the nearest available dial-up connections, using an old Toshiba laptop that was missing seven keys. His method was the same in every case: find security holes; offer to fix them; refuse payment in exchange for help; wait until hole is patched; alert the media.</p>
<p>Lamo had previously hacked into the likes of <strong>AOL Time Warner,</strong> <strong>Comcast</strong>, <strong>MCI Worldcom, Microsoft, SBC Communications </strong>and <strong>Yahoo</strong> after discovering that these companies had enabled remote access to their internal networks via Web proxies, a kind of security by obscurity that allowed anyone who knew the proxy&#8217;s Internet address and port number to browse internal shares and other network resources of the affected companies.</p>
<p>By 2002, Lamo had taken to calling me on the phone frequently to relate his various exploits, often spoofing his phone number to make it look like the call had come from someplace ominous or important, such as The White House or the FBI. At the time, I wasn&#8217;t actively taking any measures to encrypt my online communications, or to suggest that my various sources do likewise. After a few weeks of almost daily phone conversations with Lamo, however, it became abundantly clear that this had been a major oversight.</p>
<p>In February 2002, Lamo told me that he&#8217;d found an open proxy on the network of The New York Times that allowed him to browse the newsroom&#8217;s corporate intranet. A few days after that conversation, Lamo turned up at Washingtonpost.com&#8217;s newsroom (then in Arlington, Va.). Just around the corner was a Kinkos, and Adrian insisted that I follow him to the location so he could get online and show me his discovery firsthand.</p>
<p>While inside the Times&#8217; intranet, he downloaded a copy of the Times&#8217; source list, which included phone numbers and contact information for such household names as Yogi Berra, Warren Beatty, and Robert Redford, as well as high-profile political figures &#8211; including Palestinian leader Yassir Arafat and Secretary of State Colin Powell. Lamo also added his own contact information to the file. My <a href="https://web.archive.org/web/20020306005915/http://www.newsbytes.com/news/02/174792.html" target="_blank" rel="noopener">exclusive story in Newsbytes</a> about the Times hack was soon picked up by other news outlets.</p>
<p>In August 2003, federal prosecutors issued an arrest warrant for Lamo in connection with the New York Times hack, among other intrusions. The next month, The Washington Post&#8217;s attorneys <a href="https://www.rcfp.org/browse-media-law-resources/news/reporters-ordered-fbi-retain-notes-conversations-hacker" target="_blank" rel="noopener">received a letter from the FBI</a> urging them not to destroy any correspondence I might have had with Lamo, and warning that my notes may be subpoenaed.</p>
<p>In response, the Post opted to take my desktop computer at work and place it in storage. We also received a letter from the FBI requesting an interview (that request was summarily denied). In October 2003, the Associated Press ran a story saying the FBI didn&#8217;t follow proper procedures when it notified reporters that their notes concerning Lamo might be subpoenaed (the DOJ&#8217;s policy was to seek materials from reporters only after all other investigative steps had been exhausted, and then only as a last resort).</p>
<p>In 2004, Lamo pleaded guilty to one felony count of computer crimes against the Times, as well as LexisNexis and Microsoft. He was sentenced to six month&#8217;s detention and two years probation, an ordered to pay $65,000 in restitution.</p>
<p>Several months later while attending a formal <strong>National Press Foundation</strong> dinner at the Washington Hilton, my bulky <a href="https://en.wikipedia.org/wiki/Palm_Treo" target="_blank" rel="noopener">Palm Treo</a> buzzed in my suit coat pocket, signaling a new incoming email message. The missive was blank save for an unusually large attachment. Normally, I would have ignored such messages as spam, but this one came from a vaguely familiar address: adrian.lamo@us.army.mil. Years before, Lamo had told me he&#8217;d devised a method for minting his own .mil email addresses.</p>
<p>The attachment turned out to be the Times&#8217; newsroom source list. The idea of possessing such information was at once overwhelming and terrifying, and for the rest of the evening I felt certain that someone was going to find me out (it didn&#8217;t help that I was seated adjacent to a table full of NYT reporters and editors). It was difficult not to stare at the source list and wonder at the possibilities. But ultimately, I decided the right thing to do was to simply delete the email and destroy the file.<span id="more-42978"></span></p>
<h4>EARLY LIFE</h4>
<p>Lamo was born in 1981 outside of Boston, Mass. into an educated, bilingual family. Lamo&#8217;s parents say from an early age he exhibited an affinity for computers and complex problem solving. In grade school, Lamo cut his teeth on a <a href="https://en.wikipedia.org/wiki/Commodore_64" target="_blank" rel="noopener">Commodore64</a>, but his parents soon bought him a more powerful IBM PC when they grasped the extent of his talents.</p>
<p>&#8220;Ever since he was very young he has shown a tendency to be a lateral thinker, and any problem you put in front of him with a computer he could solve almost immediately,&#8221; Lamo&#8217;s mother Mary said in an interview in 2003. &#8220;He has a gifted analytical mind and a natural curiosity.&#8221;</p>
<p>By the time he got to high school, Lamo had graduated to a laptop computer. During a computer class his junior year, Lamo upstaged his teacher by solving a computer problem the instructor insisted was insurmountable. After an altercation with the teacher, he was expelled. Not long after that incident, Lamo earned his high school equivalency degree and left home for a life on his own.</p>
<p>For many years after that he lived a vagabond&#8217;s existence, traveling almost exclusively on foot or by Greyhound bus, favoring the affordable bus line for being the &#8220;only remaining form of mass transit that offers some kind of anonymity.&#8221; When he wasn&#8217;t staying with friends, he passed the night in abandoned buildings or under the stars.</p>
<p>In 1995, Lamo landed contract work at a promising technology upstart called America Online, working on &#8220;<a href="https://en.wikipedia.org/wiki/PlanetOut_Inc." target="_blank" rel="noopener">PlanetOut.com</a>,&#8221; an online forum that catered to the gay and lesbian community. At the time, advertisers paid AOL based on the amount of time visitors spent on the site, and Lamo&#8217;s job was to keep people glued to the page, chatting them up for hours at a time.</p>
<p><strong>Ira Wing</strong>, a security expert at one of the nation&#8217;s largest Internet service providers, met Lamo that year at PlanetOut and the two became fast friends. It wasn&#8217;t long before he joined in one of Lamo&#8217;s favorite distractions, one that would turn out to be an eerie offshoot of the young hacker&#8217;s online proclivities: exploring the labyrinth of California&#8217;s underground sewage networks and abandoned mines.</p>
<p>Since then, Lamo kept in touch intermittently, popping in and out of Wing&#8217;s life at odd intervals. But Wing proved a trustworthy and loyal friend, and Lamo soon granted him power of attorney over his affairs should he run into legal trouble.</p>
<p>In 2002, Wing registered the domain &#8220;freeadrian.com,&#8221; as a joke. He&#8217;d later remark on how prescient a decision that had been.</p>
<p>&#8220;Adrian is like a fast moving object that has a heavy affect on anyone&#8217;s life he encounters,&#8221; Wing told this reporter in 2003. &#8220;And then he moves on.&#8221;</p>
<h4>THE MANNING AFFAIR</h4>
<p>In 2010, Lamo was contacted via instant message by <strong>Chelsea Manning</strong>, a transgender Army private who was then known as <strong>Bradley Manning</strong>. The Army private confided that she&#8217;d leaked a classified video of a helicopter attack in Baghdad that killed 12 people (including two Reuters employees) to <strong>Wikileaks</strong>. Manning also admitted to handing Wikileaks some 260,000 classified diplomatic cables.</p>
<p>Lamo reported the theft to the FBI. In explaining his decision, Lamo told news publications that he was worried the classified data leak could endanger lives.</p>
<p>“He was just grabbing information from where he could get it and trying to leak it,” Mr. Lamo <a href="https://www.nytimes.com/2010/06/08/world/08leaks.html" data-ss1521399232="1">told The </a><a href="https://www.nytimes.com/2010/06/08/world/08leaks.html" data-ss1521399232="1">Times in 2010</a>.</p>
<p>Manning was later convicted of leaking more than 700,000 government records, and received a 35 year prison sentence. In January 2017, President Barack Obama commuted Manning&#8217;s sentence after she&#8217;d served seven years of it. In January 2018, Manning <a href="https://www.nytimes.com/2018/01/13/us/politics/chelsea-manning-files-for-senate-run-in-maryland.html?rref=collection%2Ftimestopic%2FManning%2C%20Bradley%20E.&amp;action=click&amp;contentCollection=timestopics&amp;region=stream&amp;module=stream_unit&amp;version=latest&amp;contentPlacement=3&amp;pgtype=collection" target="_blank" rel="noopener">filed to run for a Senate seat in Maryland</a>.</p>
<h4>HOMELESS IN WICHITA</h4>
<p>The same month he reported Manning to the feds, Lamo <a href="https://www.wired.com/2010/05/lamo/" target="_blank" rel="noopener">told Wired.com</a> that he&#8217;d been diagnosed with <a href="https://en.wikipedia.org/wiki/Asperger_syndrome" target="_blank" rel="noopener">Asperger Syndrome</a> after being briefly hospitalized in a psychiatric ward. Lamo told Wired that he suspected someone had stolen his backpack, and that paramedics were called when the police responding to reports of the alleged theft observed him acting erratically and perhaps slurring his speech.</p>
<p>Wired later updated the story to note that Lamo&#8217;s father had reported him to the Sacramento Sherriff&#8217;s office, saying he was worried that his son was over-medicating himself with prescription drugs.</p>
<p>In 2011, Lamo <a href="https://www.aljazeera.com/video/americas/2011/03/2011313202019296426.html" target="_blank" rel="noopener">told news outlet Al Jazeera</a> that he was in hiding because he was getting death threats for betraying Manning&#8217;s confidence and turning him in to the authorities. In 2013, he <a href="https://www.theguardian.com/world/2013/jan/03/adrian-lamo-bradley-manning-q-and-a" target="_blank" rel="noopener">told The Guardian</a> that he&#8217;d struggled with substance abuse &#8220;for a while.&#8221;</p>
<p>It&#8217;s not yet certain what led to Lamo&#8217;s demise. He was found dead in a Wichita apartment on March 14. According to <a href="http://www.kansas.com/news/local/article205629184.html" target="_blank" rel="noopener">The Wichita Eagle</a>, Lamo had lived in the area for more than a year. The paper quoted local resident <strong>Lorraine Murphy</strong>, who described herself as a colleague and friend of Lamo&#8217;s. When Murphy sent him a message in December 2016 asking him what he was up to, he reportedly replied “homeless in Wichita.&#8221;</p>
<p>“Adrian was always homeless or on the verge of it,” Murphy is quoted as saying. “He bounced around a great deal, for no particular reason. He was a believer in the Geographic Cure. Whatever goes wrong in your life, moving will make it better. And he knew people all over the country.”</p>
<p>The Eagle reports that Wichita police found no signs of foul play or anything suspicious about Lamo&#8217;s death. A toxicology test was ordered but the results won&#8217;t be available for several weeks.</p>


feed_id: https://krebsonsecurity.com/?p=43000
title: 15-Year-old Finds Flaw in Ledger Crypto Wallet
uri: 15-Year-old-Finds-Flaw-in-Ledger-Crypto-Wallet
url: https://krebsonsecurity.com/2018/03/15-year-old-finds-flaw-in-ledger-crypto-wallet/
content:
<p>A 15-year-old security researcher has discovered a serious flaw in cryptocurrency hardware wallets made by <strong>Ledger</strong>, a French company whose popular products are designed to physically safeguard public and private keys used to receive or spend the user’s cryptocurrencies.</p>
<div id="attachment_43004" style="max-width: 503px" class="wp-caption aligncenter"><img class="size-full wp-image-43004" src="media/7c3017f7.ledger.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/03/ledger.png" alt="" width="493" height="276" /><p class="wp-caption-text">Ledger&#8217;s Nano-S cryptocurrency hardware wallet. Source: Amazon.</p></div>
<p>Hardware wallets like those sold by Ledger are designed to protect the user&#8217;s private keys from malicious software that might try to harvest those credentials from the user&#8217;s computer.  The devices enable transactions via a connection to a USB port on the user&#8217;s computer, but they don&#8217;t reveal the private key to the PC.</p>
<p>Yet <a href="http://www.twitter.com/spudowiar" target="_blank" rel="noopener"><strong>Saleem Rashid</strong></a>, a 15-year-old security researcher from the United Kingdom, discovered a way to acquire the private keys from Ledger devices. Rashid&#8217;s method requires an attacker to have physical access to the device, and normally such hacks would be unremarkable because they fall under the #1 rule of security &#8212; namely, if an attacker has physical access to your device, then it is not your device anymore.</p>
<p>The trouble is that consumer demand for Ledger&#8217;s products has frequently outpaced the company&#8217;s ability to produce them (it has sold over a million of its most popular <strong>Nano S</strong> models to date). This has prompted the company&#8217;s chief technology officer <a href="https://twitter.com/BTChip/status/949679898012078082" target="_blank" rel="noopener">to state publicly</a> that Ledger&#8217;s built-in security model is so robust that it is safe to purchase their products from a wide range of third-party sellers, including <strong>Amazon</strong> and <strong>eBay</strong>.</p>
<div id="attachment_43012" style="max-width: 243px" class="wp-caption alignright"><img class="size-full wp-image-43012" src="media/79786b9b.ledgerantitempter.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/03/ledgerantitempter.png" alt="" width="233" height="386" /><p class="wp-caption-text">Ledger&#8217;s message to users regarding the lack of anti-tampering mechanisms on its cryptocurrency hardware wallets.</p></div>
<p>But Rashid discovered that a reseller of Ledger&#8217;s products could update the devices with malicious code that would lie in wait for a potential buyer to use it, and then siphon the private key and drain the user&#8217;s cryptocurrency account(s) when the user goes to use it.</p>
<p>The crux of the problem is that Ledger&#8217;s devices contain a secure processor chip and a non-secure microcontroller chip. The latter is used for a variety of non-security related purposes, from handling the USB connections to displaying text on the Ledger&#8217;s digital display, but the two chips still pass information between each other. Rashid found that an attacker could compromise the insecure processor (the microcontroller) on Ledger devices to run malicious code without being detected.</p>
<p>Ledger&#8217;s products do contain a mechanism for checking to ensure the code powering the devices has not been modified, but Rashid&#8217;s proof-of-concept code &#8212; being released today in tandem with <a href="https://www.ledger.fr/2018/03/20/firmware-1-4-deep-dive-security-fixes/" target="_blank" rel="noopener">an announcement from Ledger</a> about a new firmware update designed to fix the bug &#8212; allows an attacker to force the device to sidestep those security checks.</p>
<p>&#8220;You&#8217;re essentially trusting a non-secure chip not to change what&#8217;s displayed on the screen or change what the buttons are saying,&#8221; Rasheed said in an interview with KrebsOnSecurity. &#8220;You can install whatever you want on that non-secure chip, because the code running on there can lie to you.&#8221;</p>
<p><strong>Kenneth White</strong>, director of the <a href="https://opencryptoaudit.org/" target="_blank" rel="noopener">Open Crypto Audit Project</a>, had an opportunity to review Rashid&#8217;s findings prior to their publication today. White said he was impressed with the elegance of the proof-of-concept attack code, which Rashid sent to Ledger approximately four months ago. A copy of Rashid&#8217;s research paper on the vulnerability <a href="media/2fe9eb15.ledgerattack.pdf" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/03/ledgerattack.pdf" target="_blank" rel="noopener">is available here</a> (PDF). A video of Rashid demonstrating his attack is below.</p>
<div style="text-align: center;"><iframe src="https://www.youtube.com/embed/3poUPY-VpSI" width="560" height="315" frameborder="0" allowfullscreen="allowfullscreen"></iframe></div>
<p>White said Rashid&#8217;s code subverts the security of the Ledger&#8217;s process for generating a backup code for a user&#8217;s private key, which relies on a random number generator that can be made to produce non-random results.</p>
<p>&#8220;In this case [the attacker] can set it to whatever he wants,&#8221; White said. &#8220;The victim generates keys and backup codes, but in fact those codes have been predicted by the attacker in advance because he controls the Ledger&#8217;s random number generator.&#8221;</p>
<p>Rashid said Ledger initially dismissed his findings as implausible. But in <a href="https://www.ledger.fr/2018/03/20/firmware-1-4-deep-dive-security-fixes/" target="_blank" rel="noopener">a blog post</a> published today, Ledger says it has since fixed the flaw Rasheed found &#8212; as well as others discovered and reported by different security researchers &#8212; in a firmware update that brings Ledger Nano S devices from firmware <em>version 1.3.1</em> to <em>version 1.4.1</em> (the company actually released the firmware update on March 6, potentially giving attackers time to reverse engineer Rashid&#8217;s method).</p>
<p>The company is still working on an update for its pricier <a href="https://www.ledgerwallet.com/products/ledger-blue" target="_blank" rel="noopener">Ledger Blue</a> devices, which company chief security officer<strong> Charles Guillemet</strong> said should be ready soon. Guillemet said Nano-S devices should alert users that a firmware update is available when the customer first plugs the device into a computer.</p>
<p>&#8220;The vulnerability he found was based on the fact that the secure element tries to authenticate the microcontroller, and that authentication is not strong enough,&#8221; Guillemet told KrebsOnSecurity. &#8220;This update does authentication more tightly so that it&#8217;s not possible to fool the user.&#8221;<span id="more-43000"></span></p>
<p>Rasheed said unlike its competitors in the hardware wallet industry, Ledger includes no tamper protection seal or any other device that might warn customers that a Nano S has been physically opened or modified prior to its first use by the customer.</p>
<p>&#8220;They make it so easy to open the device that you can take your fingernail and open it up,&#8221; he said.</p>
<p>Asked whether Ledger intends to add tamper protection to its products, Guillemet said such mechanisms do not add any security.</p>
<p>&#8220;For us, a tamper proof seal is nothing that adds security to the device because it&#8217;s very easy to counterfeit,&#8221; Guillemet said. &#8220;You can buy some security seals on the web. For us, it&#8217;s a lie to our customers to use this kind of seal to prove the genuineness of our product.&#8221;</p>
<p>Guillemet said despite Rashid&#8217;s findings, he sees no reason to change his recommendation that interested customers should feel free to purchase the company&#8217;s products through third party vendors.</p>
<p>&#8220;As we have upgraded our solution to prove the genuineness of our product using cryptographic checks, I don&#8217;t see why we should change this statement,&#8221; he said.</p>
<p>Nevertheless, given that many cryptocurrency owners turn to hardware wallets like Ledger to safeguard some or all of their virtual currency, it&#8217;s probably a good idea if you are going to rely on one of these devices to purchase it directly from the source, and to apply any available firmware updates before using it.</p>


feed_id: https://krebsonsecurity.com/?p=43025
title: Survey: Americans Spent $1.4B on Credit Freeze Fees in Wake of Equifax Breach
uri: Survey-Americans-Spent-1-4B-on-Credit-Freeze-Fees-in-Wake-of-Equifax
url:
https://krebsonsecurity.com/2018/03/survey-americans-spent-1-4b-on-credit-freeze-fees-in-wake-of-equifax-breach/

content:
<p>Almost 20 percent of Americans froze their credit file with one or more of the big three credit bureaus in the wake of last year&#8217;s <a href="https://krebsonsecurity.com/?s=equifax+breach&amp;x=0&amp;y=0" target="_blank" rel="noopener">data breach</a> at <strong>Equifax</strong>, costing consumers an estimated $1.4 billion, according to a new study. The findings come as lawmakers in Congress are debating legislation that would make credit freezes free in every state.</p>
<p>The figures, commissioned by small business loan provider <a href="https://www.fundera.com" target="_blank" rel="noopener">Fundera</a> and conducted by <a href="http://www.wakefieldresearch.com" target="_blank" rel="noopener">Wakefield Research</a>, surveyed some 1,000 adults in the U.S. Respondents were asked to self-report how much they spent on the freezes; 32 percent said the freezes cost them $10 or less, but 38 percent said the total cost was $30 or more. The average cost to consumers who froze their credit after the Equifax breach was $23.</p>
<p>A credit freeze blocks potential creditors from being able to view or &#8220;pull&#8221; your credit file, making it far more difficult for identity thieves to apply for new lines of credit in your name.</p>
<p>Depending on your state of residence, the cost of placing a freeze on your credit file can run between $3 and $10 per credit bureau, and in many states the bureaus also can charge fees for temporarily &#8220;thawing&#8221; and removing a freeze (according a list published by <a href="http://consumersunion.org/research/consumers-unions-guide-to-security-freeze-protection-2/" target="_blank" rel="noopener">Consumers Union</a>, residents of four states &#8212; Indiana, Maine, North Carolina, South Carolina &#8212; do not need to pay to place, thaw or lift a freeze).</p>
<div id="attachment_43035" style="max-width: 605px" class="wp-caption aligncenter"><img class=" wp-image-43035" src="media/bc68e5fb.freezesurveymethod.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/03/freezesurveymethod.png" alt="" width="595" height="592" /><p class="wp-caption-text">Image: Wakefield Research.</p></div>
<p>In a <a href="https://www.fundera.com/resources/credit-freeze-after-equifax-breach?nocache" target="_blank" rel="noopener">blog post</a> published today, Fundera said the percentage of people who froze their credit in response to the Equifax breach incrementally decreases as people get older.</p>
<p>&#8220;Thirty-two percent of millennials, 16 percent of Generation Xers and 12 percent of baby boomers froze their credit,&#8221; Fundera explained. &#8220;This data is surprising considering that older generations have been working on building their credit for a longer period of time, and thus they have a more established record to protect.&#8221;</p>
<p>However, freeze fees could soon be a thing of the past. A provision included in a bill passed by the <strong>U.S. Senate</strong> on March 14 would require credit-reporting firms to let consumers place a freeze without paying (the measure is awaiting action in the House of Representatives).</p>
<p>But there may be a catch: According to <a href="https://www.cnbc.com/2018/03/08/senate-banking-bill-would-make-credit-freezes-free.html" target="_blank" rel="noopener">CNBC</a>, the congressional effort to require free freezes is part of a larger measure, <a class="inline_asset" title="https://www.congress.gov/bill/115th-congress/senate-bill/2155?q=%7B%22search%22%3A%5B%22S2155%22%5D%7D&amp;r=1" href="https://www.congress.gov/bill/115th-congress/senate-bill/2155?q=%7B%22search%22%3A%5B%22S2155%22%5D%7D&amp;r=1" target="_blank" rel="noopener noreferrer" data-ss1521677845="1">S. 2155</a>, which rolls back some banking regulations put in place after the financial crisis that rocked the U.S. economy a decade ago.<span id="more-43025"></span></p>
<p>Consumer advocacy groups like Consumers Union and the <a href="https://uspirg.org/" target="_blank" rel="noopener">U.S. Public Interest Research Group</a> (USPIRG) have long advocated for free credit freezes. But they&#8217;re not too wild about S. 2155, arguing that it would undermine banking regulations passed in the wake of the 2007-2008 financial crisis.</p>
<p>In <a href="media/3cd3e7bc.CU-Letter-Opposing-S.-2155.pdf" data-original-source="http://consumersunion.org/wp-content/uploads/2018/03/CU-Letter-Opposing-S.-2155.pdf" target="_blank" rel="noopener">a March 8 letter</a> (PDF) opposing the bill, Consumers Union said the security freeze section fails to include a number of important consumer protections, such as a provision for the consumer to temporarily “lift” the freeze in order to open credit.</p>
<p>&#8220;Moreover, it could preclude the states from making important improvements to expand protections against identity theft,&#8221; Consumers Union wrote.</p>
<p>While it may seem like credit bureaus realized a huge financial windfall as a result of the Equifax breach, it&#8217;s important to keep in mind that credit bureaus also make money by selling your credit report to potential lenders &#8212; something they can&#8217;t do if there&#8217;s a freeze on your credit file.</p>
<p>Curious about what a freeze involves, how to file one, and other options aside from the credit freeze? Check out <a href="https://krebsonsecurity.com/2017/09/the-equifax-breach-what-you-should-know/" target="_blank" rel="noopener">this in-depth Q&amp;A</a> that KrebsOnSecurity published not long after the Equifax breach.</p>
<p>Also, if you haven&#8217;t done so lately, take a moment to visit <a href="https://www.annualcreditreport.com" target="_blank" rel="noopener">annualcreditreport.com</a> to get a free copy of your credit file. A consumer survey published earlier this month <a href="https://krebsonsecurity.com/2018/03/checked-your-credit-since-the-equifax-hack/" target="_blank" rel="noopener">found that roughly half of all Americans</a> haven&#8217;t bothered to do this since the Equifax breach.</p>


feed_id: https://krebsonsecurity.com/?p=43072
title: San Diego Sues Experian Over ID Theft Service
uri: San-Diego-Sues-Experian-Over-ID-Theft-Service
url: https://krebsonsecurity.com/2018/03/san-diego-sues-experian-over-id-theft-service/
content:
<p>The City of San Diego, Calif. is suing consumer credit bureau <strong>Experian</strong>, alleging that a data breach first reported by KrebsOnSecurity in 2013 affected more than a quarter-million people in San Diego but that Experian never alerted affected consumers as required under California law.</p>
<p><img class="aligncenter size-full wp-image-31685" src="media/89b3723c.experian.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2015/07/experian.png" alt="" width="580" height="384" /></p>
<p>The lawsuit, filed by San Diego city attorney <strong>Mara Elliott</strong>, concerns a data breach at an Experian subsidiary that lasted for nine months ending in 2013. As <a href="https://krebsonsecurity.com/2013/10/experian-sold-consumer-data-to-id-theft-service/" target="_blank" rel="noopener">first reported here in October 2013,</a> a Vietnamese man named <strong>Hieu Minh Ngo</strong> ran an identity theft service online and gained access to sensitive consumer information by posing as a licensed private investigator in the United States.</p>
<p>In reality, the fraudster was running his identity theft service from Vietnam, and paying Experian thousands of dollars in cash each month for access to <a href="https://krebsonsecurity.com/2014/03/experian-lapse-allowed-id-theft-service-to-access-200-million-consumer-records/" target="_blank" rel="noopener">200 million consumer records</a>. Ngo then resold that access to more than 1,300 customers of his ID theft service. KrebsOnSecurity first wrote about Ngo&#8217;s ID theft service &#8212; alternately called <strong>Superget[dot]info</strong> and <strong>Findget[dot]me</strong> &#8212; <a href="http://krebsonsecurity.com/2011/11/how-much-is-your-identity-worth/" target="_blank" rel="noopener">in 2011</a>.</p>
<p>Ngo was arrested after being lured out of Vietnam by the <strong>U.S. Secret Service</strong>. He later pleaded guilty to identity fraud charges and was <a href="https://krebsonsecurity.com/2015/07/id-theft-service-proprietor-gets-13-years/" target="_blank" rel="noopener">sentenced in July 2015 to 13 years in prison</a>.</p>
<p>News of the lawsuit comes from <a href="http://www.sandiegouniontribune.com/news/watchdog/sd-me-data-breach-20180321-story.html" target="_blank" rel="noopener">The San Diego Union-Tribune</a>, which says the city attorney alleges that some 30 million consumers could have had their information stolen in the breach, including an estimated 250,000 people in San Diego.</p>
<p>&#8220;Elliott’s office cited the Internal Revenue Service in saying hackers filed more than 13,000 false returns using the hacked information, obtaining $65 million in fraudulent tax refunds,&#8221; writes Union-Tribune reporter <strong>Greg Moran</strong>.</p>
<p>Experian did not respond to requests for comment.</p>
<div id="attachment_12183" style="max-width: 609px" class="wp-caption aligncenter"><img class=" wp-image-12183" src="media/199086ca.supergethome.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2011/11/supergethome.png" alt="" width="599" height="350" srcset="https://krebsonsecurity.com/wp-content/uploads/2011/11/supergethome.png 1001w, https://krebsonsecurity.com/wp-content/uploads/2011/11/supergethome-300x175.png 300w" sizes="(max-width: 599px) 100vw, 599px" /><p class="wp-caption-text">Ngo&#8217;s Identity theft service, superget.info, which relied on access to consumer databases maintained by a company that Experian purchased in 2012.</p></div>
<p>In December 2013, an executive from <strong>Experian</strong> <a title="http://krebsonsecurity.com/2014/03/experian-lapse-allowed-id-theft-service-to-access-200-million-consumer-records/" href="http://krebsonsecurity.com/2014/03/experian-lapse-allowed-id-theft-service-to-access-200-million-consumer-records/" target="_blank" rel="noopener">told Congress</a> that the company was not aware of any consumers who had been harmed by the incident. However, soon after Ngo was extradited to the United States, the Secret Service began identifying and rounding up dozens of customers of Ngo&#8217;s identity theft service. And most of Ngo&#8217;s customers were indeed involved in <a href="https://krebsonsecurity.com/2018/01/file-your-taxes-before-scammers-do-it-for-you/" target="_blank" rel="noopener">tax refund fraud</a> with the states and the IRS.<span id="more-43072"></span></p>
<p>Tax refund fraud affects hundreds of thousands of U.S. citizens annually. Victims usually first learn of the crime after having their returns rejected because scammers beat them to it. Even those who are not required to file a return can be victims of refund fraud, as can those who are not actually due a refund from the IRS.</p>
<p>In May 2014, KrebsOnSecurity reported that Ngo&#8217;s identity theft service was <a href="https://krebsonsecurity.com/2014/05/experian-breach-tied-to-ny-nj-id-theft-ring/" target="_blank" rel="noopener">connected to an identity theft ring</a> that operated out of New Jersey and New York and specialized in tax refund and credit card fraud.</p>
<p>In October 2014, a Florida man was <a href="https://krebsonsecurity.com/2014/10/id-theft-service-customer-gets-27-months/" target="_blank" rel="noopener">sentenced to 27 months</a> for using Ngo&#8217;s service to purchase Social Security numbers and bank account records on more than 100 Americans with the intent to open credit card accounts and file fraudulent tax refund requests in the victims&#8217; names. Another <a href="https://krebsonsecurity.com/tag/lance-ealy/" target="_blank" rel="noopener">customer of Ngo&#8217;s ID theft service</a> led U.S. Marshals on a <a href="https://krebsonsecurity.com/2015/03/convicted-tax-fraudster-fugitive-caught/" target="_blank" rel="noopener">multi-state fugitive chase</a> after being convicted of fraud and sentenced to 124 months in jail.</p>
<p>According to the Union-Tribune, the lawsuit seeks civil monetary penalties under the state’s Unfair Competition Law, as well as a court order compelling the Costa Mesa-based company to formally notify consumers whose personal information was stolen and to pay costs for identity protection services for those people. If the city prevails in its lawsuit, Experian also could be facing some hefty fines: Companies that fail to notify California residents when their personal information is exposed in a breach could face penalties of up to $2,500 for each violation.</p>


feed_id: https://krebsonsecurity.com/?p=42909
title: Who and What Is Coinhive?
uri: Who-and-What-Is-Coinhive
url: https://krebsonsecurity.com/2018/03/who-and-what-is-coinhive/
content:
<p>Multiple security firms recently identified cryptocurrency mining service <strong>Coinhive</strong> as the top malicious threat to Web users, thanks to the tendency for Coinhive&#8217;s computer code to be used on hacked Web sites to steal the processing power of its visitors&#8217; devices. This post looks at how Coinhive vaulted to the top of the threat list less than a year after its debut, and explores clues about the possible identities of the individuals behind the service.</p>
<p>Coinhive is a cryptocurrency mining service that relies on a small chunk of computer code designed to be installed on Web sites. The code uses some or all of the computing power of any browser that visits the site in question, enlisting the machine in a bid to mine bits of the <a href="https://en.wikipedia.org/wiki/Monero_(cryptocurrency)" target="_blank" rel="noopener">Monero cryptocurrency</a>.</p>
<p><img class="aligncenter wp-image-43055" src="media/c3787382.coinhive.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/03/coinhive.png" alt="" width="596" height="200" /></p>
<p>Monero differs from Bitcoin in that its transactions are virtually untraceble, and there is no way for an outsider to track Monero transactions between two parties. Naturally, this quality makes Monero an especially appealing choice for cybercriminals.</p>
<p>Coinhive released its mining code last summer, pitching it as a way for Web site owners to earn an income without running intrusive or annoying advertisements. But since then, Coinhive&#8217;s code has emerged as the top malware threat tracked by multiple security firms. That&#8217;s because much of the time the code is installed on hacked Web sites &#8212; without the owner&#8217;s knowledge or permission.</p>
<p>Much like a malware infection by a malicious bot or Trojan, Coinhive&#8217;s code frequently locks up a user&#8217;s browser and drains the device&#8217;s battery as it continues to mine Monero for as long a visitor is browsing the site.</p>
<p>According to <a href="https://publicwww.com/websites/%22coinhive.min.js%22/" target="_blank" rel="noopener">publicwww.com</a>, a service that indexes the source code of Web sites, there are nearly 32,000 Web sites currently running Coinhive&#8217;s JavaScript miner code. It&#8217;s impossible to say how many of those sites have installed the code intentionally, but in recent months hackers have secretly stitched it into some extremely high-profile Web sites, including sites for such companies as <a href="https://www.hackread.com/la-times-website-hacked-mine-monero-cryptocurrency/" target="_blank" rel="noopener">The Los Angeles Times</a>, mobile device maker <a href="https://twitter.com/briankrebs/status/948419247671267328?lang=en" target="_blank" rel="noopener">Blackberry</a>, <a href="https://www.pcmag.com/news/356783/political-fact-checking-site-hacked-to-mine-cryptocurrency" target="_blank" rel="noopener">Politifact</a>, and <a href="https://www.theregister.co.uk/2017/09/25/showtime_hit_with_coinmining_script/" target="_blank" rel="noopener">Showtime</a>.</p>
<p>And it&#8217;s turning up in some unexpected places: In December, Coinhive code was found embedded in <a href="https://www.bleepingcomputer.com/news/security/cryptojackers-found-on-starbucks-wifi-network-github-pirate-streaming-sites/" target="_blank" rel="noopener">all Web pages served by a WiFi hotspot at a Starbucks in Buenos Aires</a>. For roughly a week in January, Coinhive was found hidden inside of <a href="https://blog.trendmicro.com/trendlabs-security-intelligence/malvertising-campaign-abuses-googles-doubleclick-to-deliver-cryptocurrency-miners/" target="_blank" rel="noopener"> YouTube advertisements</a> (via Google&#8217;s DoubleClick platform) in select countries, including Japan, France, Taiwan, Italy and Spain. In February, Coinhive <a href="https://techcrunch.com/2018/02/12/browsealoud-coinhive-monero-mining-hack/" target="_blank" rel="noopener">was found on &#8220;Browsealoud,&#8221;</a> a service provided by Texthelp that reads web pages out loud for the visually impaired. The service is widely used on many UK government websites, in addition to a few US and Canadian government sites.</p>
<p>What does Coinhive get out of all this? Coinhive keeps 30 percent of whatever amount of Monero cryptocurrency that is mined using its code, whether or not a Web site has given consent to run it. The code is tied to a special cryptographic key that identifies which user account is to receive the other 70 percent.</p>
<p>Coinhive does accept abuse complaints, but it generally refuses to respond to any complaints that do not come from a hacked Web site&#8217;s owner (it mostly ignores abuse complaints lodged by third parties). What&#8217;s more, when Coinhive does respond to abuse complaints, it does so by invalidating the key tied to the abuse.</p>
<p>But according to <a href="https://twitter.com/bad_packets?lang=en" target="_blank" rel="noopener">Troy Mursch</a>, a security expert who spends much of his time tracking Coinhive and other instances of &#8220;cryptojacking,&#8221; killing the key doesn&#8217;t do anything to stop Coinhive&#8217;s code from continuing to mine Monero on a hacked site. Once a key is invalidated, Mursch said, <em>Coinhive keeps 100 percent of the cryptocurrency mined by sites tied to that account from then on</em>.</p>
<p>Mursch said<b> </b>Coinhive appears to have zero incentive to police the widespread abuse that is leveraging its platform.</p>
<p>&#8220;When they &#8216;terminate&#8217; a key, it just terminates the user on that platform, it doesn&#8217;t stop the malicious JavaScript from running, and it just means that particular Coinhive user doesn&#8217;t get paid anymore,&#8221; Mursch said. &#8220;The code keeps running, and Coinhive gets all of it. Maybe they can&#8217;t do anything about it, or maybe they don&#8217;t want to. But as long as the code is still on the hacked site, it&#8217;s still making them money.&#8221;</p>
<p>Reached for comment about this apparent conflict of interest, Coinhive replied with a highly technical response, claiming the organization is working on a fix to correct that conflict.</p>
<p>&#8220;We have developed Coinhive under the assumption that site keys are immutable,&#8221; Coinhive wrote in an email to KrebsOnSecurity. &#8220;This is evident by the fact that a site key can not be deleted by a user. This assumption greatly simplified our initial development. We can cache site keys on our WebSocket servers instead of reloading them from the database for every new client. We&#8217;re working on a mechanism [to] propagate the invalidation of a key to our WebSocket servers.&#8221;</p>
<h4>AUTHEDMINE</h4>
<p>Coinhive has responded to such criticism by releasing a version of their code called &#8220;AuthedMine,&#8221; which is designed to seek a Web site visitor&#8217;s consent before running the Monero mining scripts. Coinhive maintains that approximately 35 percent of the Monero cryptocurrency mining activity that uses its platform comes from sites using AuthedMine.</p>
<p>But according to <a href="https://blog.malwarebytes.com/cybercrime/2018/02/state-malicious-cryptomining/" target="_blank" rel="noopener">a report</a> published in February by security firm <strong>Malwarebytes</strong>, the AuthedMine code is &#8220;barely used&#8221; compared to the use of Coinhive&#8217;s mining code that does not seek permission from Web site visitors. Malwarebytes&#8217; telemetry data (drawn from antivirus alerts when users browse to a site running Coinhive&#8217;s code) determined that AuthedMine is used in a little more than one percent of all cases that involve Coinhive&#8217;s mining code.</p>
<div id="attachment_43045" style="max-width: 605px" class="wp-caption aligncenter"><a class="lightbox" href="media/6a2f1cfb.mb-coinhive.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/03/mb-coinhive.png"><img class="wp-image-43045" src="media/6a2f1cfb.mb-coinhive.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/03/mb-coinhive.png" alt="" width="595" height="354" /></a><p class="wp-caption-text">Image: Malwarebytes. The statistic above refer to the number of times per day between Jan. 10 and Feb. 7 that Malwarebytes blocked connections to AuthedMine and Coinhive, respectively.</p></div>
<p>Asked to comment on the Malwarebytes findings, Coinhive replied that if relatively few people are using AuthedMine it might be because anti-malware companies like Malwarebytes have made it unprofitable for people to do so.</p>
<p>&#8220;They identify our opt-in version as a threat and block it,&#8221; Coinhive said. &#8220;Why would anyone use AuthedMine if it&#8217;s blocked just as our original implementation? We don&#8217;t think there&#8217;s any way that we could have launched <span class="il">Coinhive</span> and not get it blacklisted by Antiviruses. If antiviruses say &#8216;mining is bad,&#8217; then mining is bad.&#8221;</p>
<p>Similarly, data from the aforementioned source code tracking site publicwww.com shows that some <a href="https://publicwww.com/websites/%22coinhive.min.js%22/" target="_blank" rel="noopener">32,000 sites</a> are running the original Coinhive mining script, while the site lists <a href="https://publicwww.com/websites/%22authedmin e.min.js%22/" target="_blank" rel="noopener">just under 1,200 sites running AuthedMine</a>.</p>
<h4>WHO IS COINHIVE?</h4>
<p>[<strong>Author&#8217;s&#8217; note:</strong> Ordinarily, I prefer to link to sources of information cited in stories, such as those on Coinhive&#8217;s own site and other entities mentioned throughout the rest of this piece. However, because many of these links either go to sites that actively mine with Coinhive or that include decidedly not-safe-for-work content, I have included screenshots instead of links in these cases. For these reasons, I would strongly advise against visiting pr0gramm&#8217;s Web site.]</p>
<p>According to a since-deleted statement on the original version of Coinhive&#8217;s Web site &#8212; coin-hive[dot]com &#8212; Coinhive was born out of an experiment on the German-language image hosting and discussion forum <strong>pr0gramm[dot]com</strong>.</p>
<p><div id="attachment_43047" style="max-width: 607px" class="wp-caption aligncenter"><a class="lightbox" href="media/7a302cc7.ch-aboutus.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/03/ch-aboutus.png"><img class="wp-image-43047" src="media/7a302cc7.ch-aboutus.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/03/ch-aboutus.png" alt="" width="597" height="102" /></a><p class="wp-caption-text">A now-deleted &#8220;About us&#8221; statement on the original coin-hive[dot]com Web site. This snapshop was taken on Sept. 15, 2017. Image courtesy archive.org.</p></div>Indeed, multiple discussion threads on pr0gramm[dot]com show that Coinhive&#8217;s code first surfaced there in the third week of July 2017. At the time, the experiment was dubbed &#8220;<strong>pr0miner</strong>,&#8221; and those threads indicate that the core programmer responsible for pr0miner used the nickname &#8220;<strong>int13h</strong>&#8221; on pr0gramm. In a message to this author, Coinhive confirmed that &#8220;most of the work back then was done by int13h, who is still on our team.&#8221;</p>
<p>I asked Coinhive for clarity on the disappearance of the above statement from its site concerning its affiliation with pr0gramm. Coinhive replied that it had been a convenient fiction:</p>
<p>&#8220;The owners of pr0gramm are good friends and we&#8217;ve helped them with their infrastructure and various projects in the past. They let us use pr0gramm as a testbed for the miner and also allowed us to use their name to get some more credibility. Launching a new platform is difficult if you don&#8217;t have a track record. As we later gained some publicity, this statement was no longer needed.&#8221;</p>
<p>Asked for clarification about the &#8220;platform&#8221; referred to in its statement (&#8220;We are self-funded and have been running this platform for the past 11 years&#8221;) Coinhive replied, &#8220;Sorry for not making it clearer: &#8216;this platform&#8217; is indeed pr0gramm.&#8221;</p>
<p>After receiving this response, it occurred to me that someone might be able to find out who&#8217;s running Coinhive by determining the identities of the pr0gramm forum administrators. I reasoned that if they were not one and the same, the pr0gramm admins almost certainly would know the identities of the folks behind Coinhive.<span id="more-42909"></span></p>
<h4>WHO IS PR0GRAMM?</h4>
<p>So I set about trying to figure out who&#8217;s running pr0gramm. It wasn&#8217;t easy, but in the end <em>all of the information needed to determine that was freely available online</em>.</p>
<p>Let me be crystal clear on this point: <em>All</em> of the data I gathered (and presented in the detailed &#8216;mind map&#8217; below) was derived from either public <a href="https://krebsonsecurity.com/2018/03/who-is-afraid-of-more-spams-and-scams/" target="_blank" rel="noopener">Web site WHOIS domain name registration records</a> or from information posted to various social media networks by the pr0gramm administrators themselves. In other words, <em>there is nothing in this research that was not put online by the pr0gramm administrators themselves</em>.</p>
<p>I began with the pr0gramm domain itself which, like many other domains tied to this research, was originally registered to an individual named <strong>Dr. Matthias Moench</strong>. Mr. Moench is only tangentially connected to this research, so I will dispense with a discussion of him for now except to say that he is a convicted spammer and murderer, and that the last subsection of this story explains who Moench is and why he may be connected to so many of these domains. His is a fascinating and terrifying story.</p>
<p>Through many weeks of research, I learned that pr0gramm was originally tied to a network of adult Web sites linked to two companies that were both incorporated more than a decade ago in Las Vegas, Nevada: <strong>Eroxell Limited</strong>, and <strong>Dustweb Inc</strong>. Both of these companies stated they were involved in online advertising of some form or another.</p>
<p>Both Eroxell and Dustweb, as well as several related pr0gramm Web sites (e.g., <strong>pr0mining[dot]com</strong>, <strong>pr0mart[dot]de</strong>, <strong>pr0shop[dot]com</strong>) are connected to a German man named <strong>Reinhard Fuerstberger</strong>, whose domain registration records include the email address &#8220;admin@pr0gramm[dot]com&#8221;. Eroxell/Dustweb also each are connected to a company incorporated in Spain called <strong>Suntainment SL, </strong>of which Fuerstberger is the apparent owner.</p>
<p>As stated on pr0gramm&#8217;s own site, the forum began in 2007 as a German language message board that originated from an automated bot that would index and display images posted to certain online chat channels associated with the wildly popular video first-person shooter game <strong>Quake</strong>.</p>
<p>As the forum&#8217;s user base grew, so did the diversity of the site&#8217;s cache of images, and pr0gramm began offering paid so-called &#8220;pr0mium&#8221; accounts that allowed users to view all of the forum&#8217;s not-safe-for-work images and to comment on the discussion board. When pr0gramm last July first launched <strong>pr0miner</strong> (the precursor to what is now Coinhive), it invited pr0gramm members to try the code on their own sites, offering any who did so to claim their reward in the form of pr0mium points.</p>
<div id="attachment_43110" style="max-width: 602px" class="wp-caption aligncenter"><img class=" wp-image-43110" src="media/b1ef559f.prominer.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/03/prominer.png" alt="" width="592" height="582" /><p class="wp-caption-text">A post on pr0gramm post concerning pr0miner, the precursor to what would later become known as Coinhive.</p></div>
<h4>DEIMOS AND PHOBOS</h4>
<p>Pr0gramm was launched in late 2007 by a Quake enthusiast from Germany named <strong>Dominic Szablewski, </strong> a computer expert better known to most on pr0gramm by his screen name &#8220;<strong>cha0s</strong>.&#8221;</p>
<p>At the time of pr0gramm&#8217;s inception, Szbalewski ran a Quake discussion board called <strong>chaosquake[dot]de</strong>, and a personal blog &#8212; <strong>phoboslab[dot]org</strong>. I was able to determine this by tracing a variety of connections, but most importantly because phoboslab and pr0gramm both once shared the same <strong>Google Analytics</strong> tracking code (<strong>UA-571256</strong>).</p>
<p>Reached via email, Szablewski said he did not wish to comment for this story beyond stating that he sold pr0gramm a few years ago to another, unnamed individual.</p>
<p>Multiple longtime pr0gramm members have remarked that since cha0s departed as administrator, the forum has become overrun by individuals with populist far-right political leanings. Mr. Fuerstberger describes himself on various social media sites as a &#8220;politically incorrect, <a href="https://en.wikipedia.org/wiki/Bavarian_nationalism" target="_blank" rel="noopener">Bavarian separatist</a>&#8221; [Wiki link added]. What&#8217;s more, there are countless posts on pr0gramm that are particularly hateful and denigrating to specific ethnic or religious groups.</p>
<p>Responding to questions via email, Fuerstberger said he had no idea pr0gramm was used to launch Coinhive.</p>
<p>&#8220;I can assure you that I heard about Coinhive for the first time in my life earlier this week,&#8221; he said. &#8220;I can assure you that the company Suntainment has nothing to do with it. I do not even have anything to do with Pr0gram. That&#8217;s what my partner does. When I found out now what was abusing my company, I was shocked.&#8221;</p>
<p>Below is a &#8220;mind map&#8221; I assembled to keep track of the connections between and among the various names, emails and Web sites mentioned in this research.</p>
<div id="attachment_43058" style="max-width: 606px" class="wp-caption aligncenter"><a class="lightbox" href="media/b01248c0.pr0gram-mmdraft-1.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/03/pr0gram-mmdraft-1.png"><img class="wp-image-43058" src="media/b01248c0.pr0gram-mmdraft-1.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/03/pr0gram-mmdraft-1.png" alt="" width="596" height="294" /></a><p class="wp-caption-text">A &#8220;mind map&#8221; I put together to keep track of and organize my research on pr0gramm and Coinhive. This map was created with Mindnode Pro for Mac. Click to enlarge.</p></div>
<h4>GAMB</h4>
<p>I was able to learn the identity of Fuerstberger&#8217;s partner &#8212; the current pr0gramm administrator, who goes by the nickname &#8220;<strong>Gamb</strong>&#8221; &#8212; by following the WHOIS data from sites registered to the U.S.-based company tied to pr0gramm (Eroxell Ltd).</p>
<p>Among the many domains registered to Eroxell was <strong>deimoslab[dot]com</strong>, which at one point was a site that sold electronics. As can be seen below in a copy of the site from 2010 (thanks to archive.org), the proprietor of deimoslab used the same Gamb nickname.</p>
<p>Deimos and Phobos are the names of the two moons of the planet Mars. They also refer to the names of the fourth and fifth level in the computer game &#8220;Doom.&#8221; In addition, they are the names of two spaceships that feature prominently in the game <a href="http://quake.wikia.com/wiki/Phobos_(Q2)" target="_blank" rel="noopener">Quake II</a>.</p>
<div id="attachment_43063" style="max-width: 606px" class="wp-caption aligncenter"><a class="lightbox" href="media/fa5c0eab.archive-deimos.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/03/archive-deimos.png"><img class="wp-image-43063" src="media/fa5c0eab.archive-deimos.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/03/archive-deimos.png" alt="" width="596" height="302" /></a><p class="wp-caption-text">A screenshot of Deimoslab.com from 2010 (courtesy of archive.org) shows the user &#8220;Gamb&#8221; was responsible for the site.</p></div>
<p>A <a href="http://techgenix.com/what-passive-dns/" target="_blank" rel="noopener">passive DNS</a> lookup on an Internet address long used by pr0gramm[dot]com shows that deimoslab[dot]com once shared the server with several other domains, including <strong>phpeditor[dot]de</strong>. According to a historic WHOIS lookup on phpeditor[dot]de, the domain was originally registered by an <strong>Andre Krumb</strong> from Gross-Gerau, Germany.</p>
<p>When I discovered this connection, I still couldn&#8217;t see anything tying Krumb to &#8220;Gamb,&#8221; the nickname of the current administrator of pr0gramm. That is, until I began searching the Web for online forum accounts leveraging usernames that included the nickname &#8220;Gamb.&#8221;</p>
<p>One such site is <strong>ameisenforum[dot]de</strong>, a discussion forum for people interested in creating and raising ant farms. I didn&#8217;t know what to make of this initially and so at first disregarded it. That is, until I discovered that the email address used to register phpeditor[dot]de also was used to register a rather unusual domain: <strong>antsonline[dot]de</strong>.</p>
<p>In a series of email exchanges with KrebsOnSecurity, Krumb acknowledged that he was the administrator of pr0gramm (as well as chief technology officer at the aforementioned Suntainment SL), but insisted that neither he nor pr0gramm was involved in Coinhive.</p>
<p>Krumb repeatedly told me something I still have trouble believing: That Coinhive was the work of just one individual &#8212; <strong>int13h</strong>, the pr0gramm user credited by Coinhive with creating its mining code.</p>
<p>&#8220;Coinhive is not affiliated with Suntainment or Suntainment&#8217;s permanent employees in any way,&#8221; Krumb said in an email, declining to share any information about int13h. &#8220;Also it’s not a group of people you are looking for, it’s just one guy who sometimes worked for Suntainment as a freelancer.&#8221;</p>
<h4>COINHIVE CHANGES ITS STORY, WEB SITE</h4>
<p>Very soon after I began receiving email replies from Mr. Fuerstberger and Mr. Krumb, I started getting emails from Coinhive again.</p>
<p>&#8220;Some people involved with pr0gramm have contacted us, saying they&#8217;re being extorted by you,&#8221; Coinhive wrote. &#8220;They want to run pr0gramm anonymously because admins and moderators had a history of being harassed by some trolls. I&#8217;m sure you can relate to that. You have them on edge, which of course is exactly where you want them. While we must applaud your efficiency for finding information, your tactics for doing so are questionable in our opinion.&#8221;</p>
<p>Coinhive was rather dramatically referring to my communications with Krumb, in which I stated that I was seeking more information about int13h and anyone else affiliated with Coinhive.</p>
<p>&#8220;We want to make it very clear again that Coinhive in its current form has nothing to do with pr0gramm or its owners,&#8221; Coinhive said. &#8220;We tested a &#8216;toy implementation&#8217; of the miner on pr0gramm, because they had a community open for these kind of things. That&#8217;s it.&#8221;</p>
<p>When asked about their earlier statement to this author &#8212; that the people behind Coinhive claimed pr0gramm as &#8220;their platform of 11 years&#8221; (which, incidentally, is exactly how long pr0gramm has been online) &#8212; Coinhive reiterated its revised statement: That this had been a convenient fabrication, and that the two were completely separate organizations.</p>
<p>On March 22, the Coinhive folks sent me a follow-up email, saying that in response to my inquiries they consulted their legal team and decided to add some contact information to their Web site.</p>
<div id="attachment_43103" style="max-width: 605px" class="wp-caption aligncenter"><img class=" wp-image-43103" src="media/b247ca60.coinhive-legal.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/03/coinhive-legal.png" alt="" width="595" height="517" /><p class="wp-caption-text">&#8220;Legal information&#8221; that Coinhive added to its Web site on March 22 in response to inquiries from this reporter.</p></div>
<p>That addition, which can be viewed at coinhive[dot]com/legal, lists a company in Kaiserlautern, Germany called <strong>Badges2Go UG</strong>. Business records show Badges2Go is a limited liability company established in April 2017 and headed by a <strong>Sylvia Klein</strong> from Frankfurt. Klein&#8217;s <a href="https://www.linkedin.com/in/sylviaklein/" target="_blank" rel="noopener">Linkedin profile</a> states that she is the CEO of several organizations in Germany, including one called <strong>Blockchain Future</strong>.</p>
<p>&#8220;I founded Badges2Go as an incubator for promising web and mobile applications,&#8221; Klein said in a instant message chat with KrebsOnSecurity. &#8220;Coinhive is one of them. Right now we check the potential and fix the next steps to professionalize the service.&#8221;</p>
<h4>THE BIZARRE SIDE STORY OF DR. MATTHIAS MOENCH</h4>
<p>I have one final and disturbing anecdote to share about some of the Web site registration data in the mind map above. As mentioned earlier, readers can see that many of the domain names tied to the pr0gramm forum administrators were originally registered to an individual named &#8220;<strong>Dr. Matthias Moench</strong>.&#8221;</p>
<p>When I first began this research back in January 2018, I guessed that Mr. Moench was almost certainly a pseudonym used to throw off researchers. But the truth is Dr. Moench is indeed a real person &#8212; and a very scary individual at that.</p>
<p>According to <a href="https://www.welt.de/wirtschaft/article135077209/Viagra-ist-fuer-Gangster-heute-lukrativer-als-Kokain.html" target="_blank" rel="noopener">a chilling 2014 article</a> in the German daily newspaper <em>Die Welt</em>, Moench was the son of a wealthy entrepreneurial family in Germany who was convicted at age 19 of hiring a Turkish man to murder his parents a year earlier in 1988. <em>Die Welt</em> says the man Moench hired used a machete to hack to death Moench&#8217;s parents and the family poodle. Moench reportedly later explained his actions by saying he was upset that his parents bought him a used car for his 18th birthday instead of the Ferrari that he&#8217;d always wanted.</p>
<div id="attachment_43061" style="max-width: 607px" class="wp-caption aligncenter"><img class=" wp-image-43061" src="media/db955950.moench.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/03/moench.png" alt="" width="597" height="307" /><p class="wp-caption-text">Matthias Moench in 1989. Image: Welt.de.</p></div>
<p>Moench was ultimately convicted and sentenced to nine years in a juvenile detention facility, but he would only serve five years of that sentence. Upon his release, Moench claimed he had found religion and wished to become a priest.</p>
<p>Somewhere along the way, however, Moench ditched the priest idea and decided to become a spammer instead. For years, he worked assiduously to pump out spam emails pimping erectile dysfunction medications, reportedly earning at least 21.5 million Euros from his various spamming activities.</p>
<p>Once again, Mr. Moench was arrested and put on trial. In 2015, he and several other co-defendants <a href="https://www.svz.de/regionales/brandenburg/panorama_bb/kopf-der-pillen-bande-verurteilt-id9749396.html" target="_blank" rel="noopener">were convicted of fraud and drug-related offenses</a>. Moench was sentenced to six years in prison. According to <strong>Lars-Marten Nagel</strong>, the author of the original <em>Die Welt</em> story on Moench&#8217;s murderous childhood, German prosecutors say Moench is expected to be released from prison later this year.</p>
<p>It may be tempting to connect the pr0gramm administrators with Mr. Moench, but it seems likely that there is little to no connection here. An <a href="https://translate.google.com/translate?hl=en&amp;sl=de&amp;u=http://devjack.de/wer-ist-dr-matthias-moench/&amp;prev=search" target="_blank" rel="noopener">incredibly detailed blog post from 2006</a> which sought to determine the identity of the Matthias Moench named as the original registrant of so many domains (they number in the tens of thousands) found that Moench himself stated on several Internet forums that his name and mailing addresses in Germany and the Czech Republic could be freely used or abused by any like-minded spammer or scammer who wished to hide his identity. Apparently, many people took him up on that offer.</p>


feed_id: https://krebsonsecurity.com/?p=43116
title: Omitting the “o” in .com Could Be Costly
uri: Omitting-the-o-in-com-Could-Be-Costly
url: https://krebsonsecurity.com/2018/03/omitting-the-o-in-com-could-be-costly/
content:
<p>Take care when typing a domain name into a browser address bar, because it&#8217;s far too easy to fat-finger a key and wind up somewhere you don&#8217;t want to go. For example, if you try to visit some of the most popular destinations on the Web but omit the &#8220;o&#8221; in .com (and type .cm instead), there&#8217;s a good chance your browser will be bombarded with malware alerts and other misleading messages &#8212; potentially even causing your computer to lock up completely. As it happens, many of these domains appear tied to a marketing company whose CEO is a convicted felon and once self-proclaimed &#8220;Spam King.&#8221;</p>
<p><img class="aligncenter wp-image-43168" src="media/226db26d.typos.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/03/typos.png" alt="" width="588" height="305" /></p>
<p><strong>Matthew Chambers</strong> is a senior security adviser at <a href="https://www.secureworks.com" target="_blank" rel="noopener">SecureWorks</a>, an Atlanta-based firm that helps companies defend against and respond to cyberattacks. Earlier this month Chambers <a href="https://blog.infostruction.com/2018/03/21/wrong-spelling-brand-name-hijack/" target="_blank" rel="noopener">penned a post on his personal blog</a> detailing what he found after several users he looks after accidentally mistyped different domains &#8212; such as <strong>espn[dot]cm.</strong></p>
<p>Chambers said the user who visited that domain told him that after typing in espn.com he quickly had his computer screen filled with alerts about malware and countless other pop-ups. Security logs for that user&#8217;s system revealed the user had actually typed espn[dot]cm, but when Chambers reviewed the source code at that Web page he found an innocuous placeholder content page instead.</p>
<p>&#8220;One thing we notice is that any links generated off these domains tend to only work one time, if you try to revisit it’s a 404,&#8221; Chambers wrote, referring to the standard 404 message displayed in the browser when a Web page is not found. &#8220;The file is deleted to prevent researchers from trying to grab it, or automatic scanners from downloading it. Also, some of the exploit code on these sites will randomly vaporize, and they will have no code on them, but were just being weaponized in campaigns. It could be the user agent, or some other factor, but they definitely go dormant for periods of time.&#8221;</p>
<p>Espn[dot]cm is one of more than a thousand so-called &#8220;<a href="https://en.wikipedia.org/wiki/Typosquatting" target="_blank" rel="noopener">typosquatting</a>&#8221; domains hosted on the same Internet address (<a href="https://www.virustotal.com/#/ip-address/85.25.199.30" target="_blank" rel="noopener noreferrer" data-ss1522275371="1">85.25.199.30</a>), including <strong>aetna[dot]cm</strong>, <strong>aol[dot]cm</strong>, <strong>box[dot]cm</strong>, <strong>chase[dot]cm</strong>, <strong>citicards[dot]cm</strong>, <strong>costco[dot]cm</strong>, <strong>facebook[dot]cm</strong>, <strong>geico[dot]cm</strong>, <strong>hulu[dot]cm</strong>, <strong>itunes[dot]cm</strong>, <strong>pnc[dot]cm</strong>, <strong>slate[dot]cm</strong>, <strong>suntrust[dot]cm</strong>, <strong>turbotax[dot]cm</strong>, and <strong>walmart[dot]cm</strong>. I&#8217;ve compiled a partial list of the most popular typosquatting domains that are part of this network <a href="media/c6d2fa74.dot-cm.pdf" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/03/dot-cm.pdf" target="_blank" rel="noopener">here</a> (PDF).</p>
<p>KrebsOnSecurity sought to dig a bit deeper into Chambers&#8217; findings, researching some of the domain registration records tied to the list of dot-cm typosquatting domains. Helpfully, all of the domains currently redirect visitors to just one of two landing pages &#8212; either <strong>antistrophebail[dot]com </strong>or <strong>chillcardiac[dot]com.</strong></p>
<p>For the moment, if one visits either of these domains directly via a desktop Web browser (I&#8217;d advise against this) chances are the site will display a message saying, &#8220;Sorry, we currently have no promotions available right now.&#8221; Browsing some of them with a mobile device sometimes leads to a page urging the visitor to complete a &#8220;short survey&#8221; in exchange for &#8220;a chance to get an gift [sic] cards, coupons and other amazing deals!&#8221;</p>
<p><img class="alignright wp-image-43120" src="media/41b146e8.mediabreakaway.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/03/mediabreakaway.png" alt="" width="244" height="357" /></p>
<p>Those antistrophebail and chillcardiac domains &#8212; as well as 1,500+ others &#8212; were registered to the email address: <strong>ryanteraksxe1@yahoo.com</strong>. A Web search on that address doesn&#8217;t tell us much, but entering it at <strong>Yahoo</strong>&#8216;s &#8220;forgot password&#8221; page lists a partially obfuscated address to which Yahoo can send an account key that may be used to reset the password for the account. That address is k*****ng@mediabreakaway[dot]com.</p>
<p>The full email address is <strong>kmanning@mediabreakaway[dot]com.</strong> According to the &#8220;leadership&#8221; page at mediabreakaway[dot]com, the email address ryanteraksxe1@yahoo.com almost certainly belongs to one <strong>Kacy Manning</strong>, who is listed as the &#8220;Manager of Special Projects&#8221; at Colorado based marketing firm <strong>Media Breakaway LLC</strong>.</p>
<p>Media Breakaway is headed by <strong>Scott Richter</strong>, a convicted felon who&#8217;s been successfully sued for spamming by some of the biggest media companies over the years.<span id="more-43116"></span></p>
<p>In 2003, New York&#8217;s attorney general <a href="https://www.wired.com/2003/12/lawsuits-target-alleged-spammers/" target="_blank" rel="noopener">sued Richter and his former company OptInRealBig[dot]com</a> after an investigation by Microsoft found his company was the source of hundreds of millions of spam emails daily touting dubious products and services. OptInRealBig later declared bankruptcy in the face of a $500 million judgment against the company. At the time, anti-spam group <strong>Spamhaus</strong> listed Richter as the world&#8217;s third most prolific spammer worldwide. For more on how Richter views his business, check out <a href="http://www.cc.com/video-clips/tbb136/the-daily-show-with-jon-stewart-email-trouble" target="_blank" rel="noopener">this hilarious interview</a> that Richter gave to the <strong>The Daily Show </strong>in 2004.</p>
<p>In 2006, <a href="http://www.nbcnews.com/id/8879528/ns/technology_and_science-security/t/microsoft-settles-suit-against-former-spammer/" target="_blank" rel="noopener">Richter paid $7 million to Microsoft</a> in a settlement arising out of a lawsuit alleging illegal spamming.</p>
<p>In 2007, Richter and Media Breakaway were sued by social networking site <strong>MySpace</strong>; a year later, an arbitration firm <a href="https://mashable.com/2008/06/16/myspace-versus-scott-richter/" target="_blank" rel="noopener">awarded MySpace $6 million</a> in damages and attorneys fees.</p>
<p>In 2013, the <strong>Internet Corporation for Assigned Names and Numbers</strong> (ICANN), the nonprofit firm which oversees the domain name registration industry, <a href="https://krebsonsecurity.com/2013/11/spam-friendly-registrar-dynamic-dolphin-shuttered/" target="_blank" rel="noopener">terminated the registrar agreement for Dynamic Dolphin</a>, a domain name registrar of which Richter was the CEO.</p>
<p>According to the contracts that ICANN requires all registrars to sign, registrars may not have anyone as an officer of the company who has been convicted of a criminal offense involving financial activities. While Richter’s spam offenses all involve civil matters, KrebsOnSecurity discovered several years ago that Richter had actually pleaded guilty in 2003 to a felony grand larceny charge.</p>
<div id="attachment_23573" style="max-width: 208px" class="wp-caption alignleft"><img class="size-full wp-image-23573" src="media/5dbbbd66.richter.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2013/11/richter.png" alt="" width="198" height="201" /><p class="wp-caption-text">Scott Richter. Image: 4law.co.il</p></div>
<p>Richter, then 32, was busted for conspiring to deal in stolen goods, including a Bobcat, a generator, laptop computers, cigarettes and tools. He later <a href="media/292a4a6a.Scott-Allen-Richter-Court-Record-Theft.pdf" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2013/11/Scott-Allen-Richter-Court-Record-Theft.pdf" target="_blank" rel="noopener">pleaded guilty</a> to one felony count of grand larceny, and was ordered to pay nearly $38,000 in restitution to cover costs linked to the case.</p>
<p>Neither Richter nor Media Breakaway responded to requests for comment on this story.</p>
<p>Chambers said it appears Media Breakaway is selling advertising space to unscrupulous actors who are pushing potentially unwanted programs (PUPs) or adware over the network.</p>
<p>&#8220;You end up coming out of the funnel into an advertiser&#8217;s payload site, and Media Breakaway is the publisher that routes those ‘parked/typosquatting’ sites as a gateway,&#8221; Chambers said. &#8220;Research on the <a href="https://www.virustotal.com/#/ip-address/85.25.199.30" target="_blank" rel="noopener" data-saferedirecturl="https://www.google.com/url?hl=en&amp;q=https://www.virustotal.com/%23/ip-address/85.25.199.30&amp;source=gmail&amp;ust=1522373627113000&amp;usg=AFQjCNHv_9kh_r4Stz_6Ov02lnDM3m7WBg">IP</a> under VirusTotal Communicating Files shows files like <a href="https://www.virustotal.com/#/file/a8efbc8c2d19874bcc90acd9d5b0c035447942bb83cfea4483e431917f5ba635/detection" target="_blank" rel="noopener" data-saferedirecturl="https://www.google.com/url?hl=en&amp;q=https://www.virustotal.com/%23/file/a8efbc8c2d19874bcc90acd9d5b0c035447942bb83cfea4483e431917f5ba635/detection&amp;source=gmail&amp;ust=1522373627113000&amp;usg=AFQjCNH4RienGwms88mbFPHoBIEzVxGkzA">this one</a> (42/66 engines) reporting to the IP address that hosts all these sites, and it goes back <a href="http://blog.talosintelligence.com/2015/03/threat-spotlight-imperiosus-curse-tool.html" target="_blank" rel="noopener">to at least March 2015</a>. That file SETUPINST.EXE has detection primarily as LiveSoftAction, GetNow, ElDorado, and Multitoolbar. I think it’s just pushing out [content] for sketchy advertisers.&#8221;</p>
<p>It&#8217;s remarkable that so many huge corporate brand names aren&#8217;t doing more to police their trademarks and to prevent would-be visitors from falling victim to such blatant typosquatting traps.</p>
<p>Under the <a title="Uniform Domain-Name Dispute-Resolution Policy" href="https://en.wikipedia.org/wiki/Uniform_Domain-Name_Dispute-Resolution_Policy" data-ss1522274601="1">Uniform Domain-Name Dispute-Resolution Policy</a> (UDRP), trademark holders can lodge typosquatting complaints with the <a title="World Intellectual Property Organization" href="https://en.wikipedia.org/wiki/World_Intellectual_Property_Organization" data-ss1522274601="1">World Intellectual Property Organization</a> (WIPO). The complainant can wrest control over a disputed domain name, but first needs to show that the registered domain name is identical or &#8220;confusingly similar&#8221; to their trademark, that the registrant has no legitimate interest in the domain name, and that the domain name is being used in <a title="Bad faith" href="https://en.wikipedia.org/wiki/Bad_faith" data-ss1522274601="1">bad faith.</a></p>
<p>Everyone makes typ0s from time to time, which is why it&#8217;s a good idea to avoid directly navigating to Web sites you frequent. Instead, bookmark the sites you visit most, particularly those that store your personal and financial information, or that require a login for access.</p>
<p>Oh, and if your security or antivirus software allows you to block all Web sites in a given top-level domain, it might not be a bad idea to block anything coming out of <a href="https://en.wikipedia.org/wiki/.cm" target="_blank" rel="noopener">dot-cm</a> (the country code top-level domain for Cameroon): A report published in December 2009 by <strong>McAfee </strong>found that .cm was the riskiest domain in the world, with 36.7% of the sites posing a security risk to PCs.</p>


feed_id: https://krebsonsecurity.com/?p=43179
title: Coinhive Exposé Prompts Cancer Research Fundraiser
uri: Coinhive-Exposé-Prompts-Cancer-Research-Fundraiser
url: https://krebsonsecurity.com/2018/03/coinhive-expose-prompts-cancer-research-fundraiser/
content:
<p>A story published here this week revealed the real-life identity behind the original creator of <strong>Coinhive</strong> &#8212; a controversial cryptocurrency mining service that several security firms have recently labeled the most ubiquitous malware threat on the Internet today. In an unusual form of protest against that story, members of a popular German language image-posting board founded by the Coinhive creator have vented their dismay by donating tens of thousands of euros to local charities that support cancer research.</p>
<p>On Monday KrebsOnSecurity published <a href="https://krebsonsecurity.com/2018/03/who-and-what-is-coinhive/" target="_blank" rel="noopener">Who and What is Coinhive</a>, an in-depth story which proved that the founder of Coinhive was indeed the founder of the German image hosting and discussion forum <strong>pr0gramm[dot]com</strong> (not safe for work). I undertook the research because Coinhive&#8217;s code primarily is found on tens of thousands of hacked Web sites, and because the until-recently anonymous Coinhive operator(s) have been reluctant to take steps that might curb the widespread abuse of their platform.</p>
<div id="attachment_43184" style="max-width: 606px" class="wp-caption aligncenter"><a class="lightbox" href="media/47b4accb.krebsiscancer.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/03/krebsiscancer.png"><img class="wp-image-43184" src="media/47b4accb.krebsiscancer.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/03/krebsiscancer.png" alt="" width="596" height="520" /></a><p class="wp-caption-text">One of countless pages of images posted about this author by pr0gramm users in response to the story about Coinhive.</p></div>
<p>In an early version of its Web site, Coinhive said its service was first tested on pr0gramm, and that the founder(s) of Coinhive considered pr0gramm &#8220;their platform&#8221; of 11 years (exactly the length of time pr0gramm has been online). Coinhive declined to say who was running their service, and tried to tell me their earlier statement about Coinhive&#8217;s longtime affiliation with pr0gramm was a convenient lie that was used to helped jump-start the service by enlisting the help of pr0gramm&#8217;s thousands of members.</p>
<p>Undeterred, I proceeded with my research based on the assumption that one or more of the founders of pr0gramm were involved in Coinhive. When I learned the real-life identities of the pr0gramm founders and approached them directly, each deflected questions about their apparent roles in founding and launching Coinhive.</p>
<p>However, shortly after the Coinhive story went live, the original founder of pr0gramm (<strong>Dominic Szablewski</strong>, a.k.a. &#8220;cha0s&#8221;) published a blog post acknowledging that he was in fact the creator of Coinhive. What&#8217;s more, Coinhive has since added legal contact information to its Web site, and has said it is now taking steps to ensure that it <a href="https://twitter.com/bad_packets/status/979361375616151558" target="_blank" rel="noopener">no longer profits</a> from cryptocurrency mining activity after hacked Web sites owners report finding Coinhive&#8217;s code on their sites.</p>
<p>Normally, when KrebsOnSecurity publishes a piece that sheds light on a corner of the Internet that would rather remain in the shadows, the response is as predictable as it is swift: Distributed denial-of-service (DDoS) attacks on this site combined with threats of physical violence and harm from anonymous users on Twitter and other social networks.</p>
<p>While this site did receive several small DDoS attacks this week &#8212; and more than a few anonymous threats of physical violence and even death related to the Coinhive story &#8212; the response from pr0gramm members has been remarkably positive overall.</p>
<p><span class="pullquote pqright">The pr0gramm community quickly seized on the fact that my last name &#8212; Krebs &#8212; means &#8220;crab&#8221; and &#8220;cancer&#8221; in German.</span> Apparently urged by one of the pr0gramm founders named in the story to express their anger in &#8220;objective and polite&#8221; ways, several pr0gramm members took to donating money to the <a href="https://www.krebshilfe.de/informieren/ueber-uns/deutsche-krebshilfe/about-us-deutsche-krebshilfegerman-cancer-aid/" target="_blank" rel="noopener">Deutsche Krebshilfe</a> (German Cancer Aid/DKMS) Web site as a way to display their unity and numbers.</p>
<p>The protest (pr0test?) soon caught on in the Twitter hashtag &#8220;#KrebsIsCancer,&#8221; promoted and re-tweeted heavily by pr0gramm members as a means to &#8220;Fight Krebs&#8221; or fight cancer. According to <a href="http://www.t-online.de/digital/internet/id_83466874/tausende-pr0gramm-nutzer-spenden-aus-aerger-ueber-brian-krebs-gegen-krebs.html" target="_blank" rel="noopener">a story</a> on Wednesday about the effort in Germany&#8217;s biggest news portal <strong>T-Online.de</strong>, German Cancer Aid had at that point received some 4,100 small donations totaling more than 103,000 Euros (~ USD $126,000). The publication said another organization, the <strong>German Cancer Research Center</strong>, reported 74 small donations likely connected to the effort.</p>
<p>In <a href="https://twitter.com/DKMS_de/status/979280639299084288" target="_blank" rel="noopener">a statement via Twitter</a>, DKMS Germany said it could not say for sure the total amount the #KrebsIsCancer movement raised, but that it did achieve &#8220;above average levels&#8221; of donations several days this week. &#8220;Last Tuesday alone, a total of over € 50,000 was received. &#8220;The amounts can not be assigned directly to the action, but are largely the result&#8221; of the #KrebsIsCancer campaign, DKMS said.</p>


feed_id: https://krebsonsecurity.com/?p=43216
title: Panerabread.com Leaks Millions of Customer Records
uri: Panerabread-com-Leaks-Millions-of-Customer-Records
url: https://krebsonsecurity.com/2018/04/panerabread-com-leaks-millions-of-customer-records/
content:
<p><strong>Panerabread.com</strong>, the Web site for the American chain of bakery-cafe fast casual restaurants by the same name, leaked millions of customer records &#8212; including names, email and physical addresses, birthdays and the last four digits of the customer&#8217;s credit card number &#8212; for at least eight months before it was yanked offline earlier today, KrebsOnSecurity has learned.</p>
<p>The data available in plain text from Panera&#8217;s site appeared to include records for any customer who has signed up for an account to order food online via panerabread.com. The St. Louis-based company, which has more than 2,100 retail locations in the United States and Canada, allows customers to order food online for pickup in stores or for delivery.</p>
<div id="attachment_43225" style="max-width: 605px" class="wp-caption aligncenter"><a class="lightbox" href="media/3a9b6f8e.panerabread-red.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/04/panerabread-red.png"><img class="wp-image-43225" src="media/3a9b6f8e.panerabread-red.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/04/panerabread-red.png" alt="" width="595" height="283" /></a><p class="wp-caption-text">Redacted records from Panera&#8217;s site, which let anyone search by a variety of customer attributes, including phone number, email address, physical address or loyalty account number. In this example, the phone number was a main line at an office building where many different employees apparently registered to order food online.</p></div>
<p>KrebsOnSecurity learned about the breach earlier today after being contacted by security researcher <strong>Dylan Houlihan</strong>, who said he initially notified Panera about customer data leaking from its Web site back on August 2, 2017.</p>
<p>A long message thread that Houlihan shared between himself and Panera indicates that <strong>Mike Gustavison</strong>, Panera&#8217;s director of information security, initially dismissed Houlihan&#8217;s report as a likely scam. A week later, however, those messages suggest that the company had validated Houlihan&#8217;s findings and was working on a fix.</p>
<p>&#8220;Thank you for the information we are working on a resolution,&#8221; Gustavison wrote.</p>
<div id="attachment_43228" style="max-width: 440px" class="wp-caption aligncenter"><a class="lightbox" href="media/cbb2fb39.paneranote.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/04/paneranote.png"><img class="wp-image-43228 size-full" src="media/cbb2fb39.paneranote.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/04/paneranote.png" alt="" width="430" height="362" /></a><p class="wp-caption-text">Panera was alerted about the data leakage in early August 2017, and said it was fixing the problem then.</p></div>
<p>Fast forward to early this afternoon &#8212; exactly eight months to the day after Houlihan first reported the problem &#8212; and data shared by Houlihan indicated the site was still leaking customer records in plain text. Worse still, the records could be indexed and crawled by automated tools with very little effort.<span id="more-43216"></span></p>
<p>For example, some of the customer records include unique identifiers that increment by one for each new record, making it potentially simple for someone to scrape all available customer accounts. The format of the database also lets anyone search for customers via a variety of data points, including by phone number.</p>
<p>&#8220;Panera Bread uses sequential integers for account IDs, which means that if your goal is to gather as much information as you can instead about someone, you can simply increment through the accounts and collect as much as you&#8217;d like, up to and including the entire database,&#8221; Houlihan said.</p>
<p>Asked whether he saw any indication that Panera ever addressed the issue he reported in August 2017 until today, Houlihan said no.</p>
<p>&#8220;No, the flaw never disappeared,&#8221; he said. &#8220;I checked on it every month or so because I was pissed.&#8221;</p>
<p>Shortly after KrebsOnSecurity spoke briefly with Panera&#8217;s chief information officer <strong>John Meister</strong> by phone today, the company briefly took the Web site offline. As of this publication, the site is back online but the data referenced above no longer appears to be reachable.</p>
<div id="attachment_43226" style="max-width: 608px" class="wp-caption aligncenter"><img class=" wp-image-43226" src="media/070ae944.paneradown.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/04/paneradown.png" alt="" width="598" height="243" /><p class="wp-caption-text">Panera took its site down today after being notified by KrebsOnSecurity.</p></div>
<p>Another data point exposed in these records included the customer&#8217;s Panera loyalty card number, which could potentially be abused by scammers to spend prepaid accounts or to otherwise siphon value from <a href="https://www.panerabread.com/en-us/company/meet-mypanera.html" target="_blank" rel="noopener">Panera customer loyalty accounts</a>.</p>
<p>It is not clear yet exactly how many Panera customer records may have been exposed by the company&#8217;s leaky Web site, but incremental customer numbers indexed by the site suggest that number may be higher than seven million. It&#8217;s also unclear whether any Panera customer account passwords may have been impacted.</p>
<p>In a written statement, Panera said it had fixed the problem within less than two hours of being notified by KrebsOnSecurity. But Panera did not explain why it appears to have taken the company eight months to fix the issue after initially acknowledging it privately with Houlihan.</p>
<p>&#8220;Panera takes data security very seriously and this issue is resolved,&#8221; the statement reads. &#8220;Following reports today of a potential problem on our website, we suspended the functionality to repair the issue.  Our investigation is continuing, but there is no evidence of payment card information nor a large number of records being accessed or retrieved.&#8221;</p>


feed_id: https://krebsonsecurity.com/?p=43200
title: Dot-cm Typosquatting Sites Visited 12M Times So Far in 2018
uri: Dot-cm-Typosquatting-Sites-Visited-12M-Times-So-Far-in-2018
url: https://krebsonsecurity.com/2018/04/dot-cm-typosquatting-sites-visited-12m-times-so-far-in-2018/
content:
<p>A <a href="https://krebsonsecurity.com/2018/03/omitting-the-o-in-com-could-be-costly/" target="_blank" rel="noopener">story published here last week</a> warned readers about a vast network of potentially malicious Web sites ending in &#8220;.cm&#8221; that mimic some of the world&#8217;s most popular Internet destinations (e.g. <strong>espn[dot]cm</strong>, <strong>aol[dot]cm</strong> and <strong>itunes[dot].cm</strong>) in a bid to bombard visitors with fake security alerts that can lock up one&#8217;s computer. If that piece lacked one key detail it was insight into just how many people were mistyping .com and ending up at one of these so-called &#8220;<a href="https://en.wikipedia.org/wiki/Typosquatting" target="_blank" rel="noopener">typosquatting</a>&#8221; domains.</p>
<p>On March 30, an eagle-eyed reader <a href="https://krebsonsecurity.com/2018/03/omitting-the-o-in-com-could-be-costly/comment-page-2/#comment-464712" target="_blank" rel="noopener">noted</a> that four years of access logs for the entire network of more than 1,000 dot-cm typosquatting domains were available for download directly from the typosquatting network&#8217;s own hosting provider. The logs &#8212; which include detailed records of how many people visited the sites over the past three years and from where &#8212; were deleted shortly after that comment was posted here, but not before KrebsOnSecurity managed to grab a copy of the entire archive for analysis.</p>
<div id="attachment_43215" style="width: 606px" class="wp-caption aligncenter"><a class="lightbox" href="media/3339035b.typomap.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/04/typomap.png"><img class="wp-image-43215" src="media/3339035b.typomap.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/04/typomap.png" alt="" width="596" height="278" /></a><p class="wp-caption-text">The geographic distribution of 25,000 randomly selected Internet addresses (IP addresses) in the logs seen accessing the dot-cm typosquatting domains in February 2018. Batchgeo, the service used to produce this graphic, limits free lookups to 25,000, but the above image is likely still representative of the overall geographic distribution. Perhaps unsurprisingly, the largest share of traffic is coming from the United States.</p></div>
<p><strong>Matthew Chambers</strong>, a security expert with whom this author worked on the original dot-cm typosquatting story published last week, analyzed the access logs from just the past three months and found the sites were visited approximately 12 million times during the first quarter of 2018.</p>
<p>Chambers said he combed through the logs and weeded out hits from Internet addresses that appeared to be bots or search engine scrapers. Here&#8217;s Chambers&#8217; analysis of the 2018 access log data:</p>
<p>January 2018: <strong>2,200,160 unique IPs</strong><br />
February 2018: <strong>3,352,032 unique IPs</strong><br />
Mar 2018: <strong>3,197,119 unique IPs</strong></p>
<p>Those figures suggest that the total number of visits to these typosquatting sites in the first quarter of 2018 was approximately 12 million, or <em>almost 50 million hits per year</em>. Certainly, not everyone visiting these sites will have the experience that Chambers&#8217; users reported (being bombarded with misleading malware alerts and redirected to scammy and spammy Web sites), but it seems clear this network could make its operators a pretty penny regardless of the content that ends up getting served through it.<span id="more-43200"></span></p>
<div id="attachment_43247" style="width: 608px" class="wp-caption aligncenter"><a class="lightbox" href="media/9d7afe1d.dotcmlogs.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/04/dotcmlogs.png"><img class="wp-image-43247" src="media/9d7afe1d.dotcmlogs.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/04/dotcmlogs.png" alt="" width="598" height="427" /></a><p class="wp-caption-text">Until very recently, the site access logs for this network of more than 1,000 dot-cm typosquatting sites were available on the same server hosting the network.</p></div>
<p>Chambers also performed &#8220;<a href="https://en.wikipedia.org/wiki/Reverse_DNS_lookup" target="_blank" rel="noopener">reverse DNS</a>&#8221; lookups on the IP addresses listed in the various dot-cm access logs for the month of February 2018. It&#8217;s worth noting here that many of <a href="media/c6d2fa74.dot-cm.pdf" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/03/dot-cm.pdf" target="_blank" rel="noopener">the dot-cm (.cm) typosquatting domains in this network</a> (PDF) are trying to divert traffic away from extremely popular porn sites (e.g. pornhub[dot]cm).</p>
<p>&#8220;I’ve been diving thru the data thus far, and came up with some interesting visitors,&#8221; Chambers said. &#8220;I pulled those when it was easy to observe that a particular agency owned a large range of IPs.&#8221;</p>
<p>Chambers queried the logs from 2018 for any hits coming from .gov or .mil sites. Here&#8217;s what he found:</p>
<p><strong>-National Aeronautics and Space Administration (JSC, GSFC, JPL, NDC):</strong> Accessed one of the .cm typosquatting sites 104 times in February, including 16 porn sites.<br />
&#8211;<strong>Department of Justice</strong> (80 times) [7 porn sites]<br />
&#8211;<strong>United States House of Representatives</strong> (47 times) [17 porn sites]<br />
&#8211;<strong>Central Intelligence Agency</strong> (6 times)<br />
&#8211;<strong>United State Army</strong> (29 times)<br />
&#8211;<strong>United States Navy</strong> (25 times)<br />
&#8211;<strong>Environmental Protection Agency</strong> (15 times)<br />
&#8211;<strong>New York State Court System</strong> (4 times)</p>
<p>Other federal agencies with typosquatting victims visiting these domains include:</p>
<p><strong>Defense Information Systems Agency (DISA)</strong><br />
<strong> Sandia National Laboratories</strong><br />
<strong> National Oceanic and Atmospheric Administration (NOAA)</strong><br />
<strong> United States Department of Agriculture</strong><br />
<strong> Berkeley Lab</strong><br />
<strong> Pacific Northwest Lab</strong></p>
<p>Last week&#8217;s story noted this entire network appears to be rented out by a Colorado-based online marketing firm called <a href="https://krebsonsecurity.com/?s=Media+Breakaway&amp;x=0&amp;y=0" target="_blank" rel="noopener">Media Breakaway</a>. That company is headed by <a href="https://en.wikipedia.org/wiki/Scott_Richter" target="_blank" rel="noopener">Scott Richter</a>, a convicted felon and once self-avowed &#8220;spam king&#8221; who&#8217;s been successfully sued for spamming by <strong>Microsoft</strong>, <strong>MySpace</strong> and the New York attorney general. Neither Richter nor anyone else at Media Breakaway has responded to requests for comment.</p>
<p>If you&#8217;re in the habit of directly navigating to Web sites (i.e. typing the name of the site into a Web browser address bar), consider weaning yourself of this risky practice. As these ubiquitous typosquatting sites show, it’s a good idea to avoid directly navigating to Web sites you frequent. Instead, bookmark the sites you visit most, particularly those that store your personal and financial information, or that require a login for access.</p>


feed_id: https://krebsonsecurity.com/?p=43270
title: Secret Service Warns of Chip Card Scheme
uri: Secret-Service-Warns-of-Chip-Card-Scheme
url: https://krebsonsecurity.com/2018/04/secret-service-warns-of-chip-card-scheme/
content:
<p>The <strong>U.S. Secret Service</strong> is warning financial institutions about a new scam involving the temporary theft of chip-based debit cards issued to large corporations. In this scheme, the fraudsters intercept new debit cards in the mail and replace the chips on the cards with chips from old cards. When the unsuspecting business receives and activates the modified card, thieves can start draining funds from the account.</p>
<div id="attachment_43274" style="width: 606px" class="wp-caption aligncenter"><a class="lightbox" href="media/04a47683.chiptamper.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/04/chiptamper.png"><img class="wp-image-43274" src="media/04a47683.chiptamper.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/04/chiptamper.png" alt="" width="596" height="223" /></a><p class="wp-caption-text">Signs of a card with an old or invalid chip include heat damage around the chip or on the card, or a small hole in the plastic used to pry the chip off the card. Image: U.S. Secret Service.</p></div>
<p>According to an alert sent to banks late last month, the entire scheme goes as follows:</p>
<p>1. Criminals intercept mail sent from a financial institution to large corporations that contain payment cards, targeting debit payment cards with access to large amount of funds.</p>
<p>2. The crooks remove the chip from the debit payment card using a heat source that warms the glue.</p>
<p>3. Criminals replace the chip with an old or invalid chip and repackage the payment card for delivery.</p>
<p>4. Criminals place the stolen chip into an old payment card.</p>
<p>5. The corporation receives the debit payment card without realizing the chip has been replaced.</p>
<p>6. The corporate office activates the debit payment card; however, their payment card is inoperable thanks to the old chip.</p>
<p>7. Criminals use the payment card with the stolen chip for their personal gain once the corporate office activates the card.<span id="more-43270"></span></p>
<p>The reason the crooks don&#8217;t just use the debit cards when intercepting them via the mail is that they need the cards to be activated first, and presumably they lack the privileged information needed to do that. So, they change out the chip and send the card on to the legitimate account holder and then wait for it to be activated.</p>
<p>The Secret Service memo doesn&#8217;t specify at what point in the mail process the crooks are intercepting the cards. It could well involve <strong>U.S. Postal Service</strong> employees (or another delivery service), or perhaps the thieves are somehow gaining access to company mailboxes directly. Either way, this alert shows the extent to which some thieves will go to target high-value customers.</p>
<p>One final note: It seems almost every time I write about the Secret Service in relation to credit card fraud, some readers are mystified why an agency entrusted with protecting the President of the United States is involved at all in these types of investigations. The truth is that safeguarding the nation&#8217;s currency supply from <a href="https://krebsonsecurity.com/2014/09/fun-with-funny-money/" target="_blank" rel="noopener">counterfeiters</a> was the <a href="https://www.secretservice.gov/about/history/events/" target="_blank" rel="noopener">Secret Service&#8217;s original mission</a> when it was first created in 1865. Only after the assassination of <a href="https://en.wikipedia.org/wiki/William_McKinley" target="_blank" rel="noopener">President William McKinley</a> &#8212; the third sitting president to be assassinated &#8212; did that mandate come to include protecting the president and foreign dignitaries.</p>
<p>Incidentally, if you enjoy reading historical non-fiction, I&#8217;d highly recommend <strong>Candice Millard</strong>&#8216;s magnificently researched and written book, <a href="https://www.amazon.com/Destiny-Republic-Madness-Medicine-President-ebook/dp/B004J4X33O" target="_blank" rel="noopener">Destiny of the Republic</a>, about the life and slow, painful death of <strong>President James A. Garfield</strong> after he was shot in the back by his lunatic assailant.</p>


feed_id: https://krebsonsecurity.com/?p=43302
title: Don’t Give Away Historic Details About Yourself
uri: Don-t-Give-Away-Historic-Details-About-Yourself
url: https://krebsonsecurity.com/2018/04/dont-give-away-historic-details-about-yourself/
content:
<p>Social media sites are littered with seemingly innocuous little quizzes, games and surveys urging people to reminisce about specific topics, such as &#8220;What was your first job,&#8221; or &#8220;What was your first car?&#8221; The problem with participating in these informal surveys is that in doing so you may be inadvertently giving away the answers to &#8220;secret questions&#8221; that can be used to unlock access to a host of your online identities and accounts.</p>
<p>I&#8217;m willing to bet that a good percentage of regular readers here would never respond &#8212; honestly or otherwise &#8212; to such questionnaires (except perhaps to chide others for responding). But I thought it was worth mentioning because certain social networks &#8212; particularly <strong>Facebook</strong> &#8212; seem positively overrun with these data-harvesting schemes. What&#8217;s more, I&#8217;m constantly asking friends and family members to stop participating in these quizzes and to stop urging their contacts to do the same.</p>
<p>On the surface, these simple questions may be little more than an attempt at online engagement by otherwise well-meaning companies and individuals. Nevertheless, your answers to these questions may live in perpetuity online, giving identity thieves and scammers ample ammunition to start gaining backdoor access to your various online accounts.</p>
<p>Consider, for example, the following quiz posted to Facebook by <strong>San Benito Tire Pros</strong>, a tire and auto repair shop in California. It asks Facebook users, &#8220;What car did you learn to drive stick shift on?&#8221;</p>
<p>I hope this is painfully obvious, but for many people the answer will be the same as to the question, &#8220;What was the make and model of your first car?&#8221;, which is one of several &#8220;secret questions&#8221; most commonly used by banks and other companies to let customers reset their passwords or gain access to the account without knowing the password.</p>
<div id="attachment_43303" style="width: 580px" class="wp-caption aligncenter"><img class=" wp-image-43303" src="media/f29f45e2.stickshift.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/04/stickshift.png" alt="" width="570" height="869" /><p class="wp-caption-text">This simple one-question quiz has been shared more than 250 times on Facebook since it was posted a week ago. Thousands of Facebook users responded in earnest, and in so doing linked their profile to the answer.</p></div>
<p>Probably the most well-known and common secret question, &#8220;what was the name of your first pet,&#8221; comes up in a number of Facebook quizzes that, incredibly, thousands of people answer willingly and (apparently) truthfully. When I saw this one I was reminded of <a href="http://www.cc.com/video-clips/o69akp/the-daily-show-with-jon-stewart-bill-gates-pt--1" target="_blank" rel="noopener">this hilarious 2007 Daily Show interview</a> wherein <strong>Jon Stewart</strong> has Microsoft co-founder <strong>Bill Gates</strong> on and tries to slyly ask him the name of his first pet.</p>
<div id="attachment_43309" style="width: 495px" class="wp-caption aligncenter"><img class="size-full wp-image-43309" src="media/f06a0abd.whatwasyourfirstpet.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/04/whatwasyourfirstpet.png" alt="" width="485" height="872" /><p class="wp-caption-text">Almost 5,000 Facebook users answered this common password reset secret question.</p></div>
<p><span id="more-43302"></span>Womenworking.com asked a variation on this same question of their huge Facebook following and received an impressive number of responses:</p>
<p><img class="aligncenter size-full wp-image-43327" src="media/e325e511.yourpetsname.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/04/yourpetsname.png" alt="" width="490" height="810" /></p>
<p>Here&#8217;s a great one from <strong>springchicken.co.uk</strong>, an e-commerce site in the United Kingdom. It asks users to publicly state the answer to yet another common secret question: &#8220;What street did you grow up on?&#8221;</p>
<div id="attachment_43304" style="width: 498px" class="wp-caption aligncenter"><img class=" wp-image-43304" src="media/acace3cf.whatstreet.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/04/whatstreet.png" alt="" width="488" height="579" /><p class="wp-caption-text">More than 500 Facebook users have shared this quiz with their network, and hundreds more shared the answer using their real names and links to their profiles.</p></div>
<p>This question, from the Facebook account of <strong>Rving.how</strong> &#8212; a site for owners of recreational vehicles &#8212; asks: &#8220;What was your first job?&#8221; How the answer to this question might possibly relate to RV camping is beyond me, but that didn&#8217;t stop people from responding.</p>
<p><img class="aligncenter wp-image-43305" src="media/2a89304a.firstjob.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/04/firstjob.png" alt="" width="492" height="673" /></p>
<p>The question, &#8220;What was your high school mascot&#8221; is another common secret question, and yet you can find this one floating around lots of Facebook profiles:</p>
<p><img class="aligncenter size-full wp-image-43325" src="media/0dd4a627.hsmascot.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/04/hsmascot.png" alt="" width="445" height="613" /></p>
<p>Among the most common secret questions is, &#8220;Where did you meet your spouse or partner?&#8221; Loads of people like to share this information online as well, it seems:</p>
<div id="attachment_43326" style="width: 504px" class="wp-caption aligncenter"><img class="size-full wp-image-43326" src="media/31781a4c.spousemeet.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/04/spousemeet.png" alt="" width="494" height="646" /><p class="wp-caption-text">This common secret question has been shared on Facebook almost 10,000 times and has garnered more than 2,300 responses.</p></div>
<p>Here&#8217;s another gem from the Womenworking Facebook page. Who hasn&#8217;t had to use the next secret question at some point? Answering this truthfully &#8212; in a Facebook quiz or on your profile somewhere &#8212; is a bad idea.</p>
<div id="attachment_43329" style="width: 598px" class="wp-caption aligncenter"><img class=" wp-image-43329" src="media/db7eba3b.favoritemovie.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/04/favoritemovie.png" alt="" width="588" height="404" /><p class="wp-caption-text">Incredibly, 6,800 Facebook users answered this question.</p></div>
<p>Do you remember your first grade teacher&#8217;s name? Don&#8217;t worry, if you forget it after answering this question, Facebook will remember it for you:</p>
<p><img class="aligncenter size-full wp-image-43328" src="media/ada9d12e.firstgradeteacher.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/04/firstgradeteacher.png" alt="" width="489" height="587" /></p>
<p>I&#8217;ve never seen a &#8220;what was the first concert you ever saw&#8221; secret question, but it is unique as secret questions go and I wouldn&#8217;t be surprised if some companies use this one. &#8220;What is your favorite band?&#8221; is definitely a common secret question, however:</p>
<p><img class="aligncenter wp-image-43306" src="media/8cb00d85.firstconcert.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/04/firstconcert.png" alt="" width="596" height="414" /></p>
<p>Giving away information about yourself, your likes and preferences, etc., can lead to all kinds of unexpected consequences. This practice may even help turn the tide of elections. Just take <a href="https://www.nytimes.com/2018/03/20/technology/facebook-cambridge-behavior-model.html" target="_blank" rel="noopener">the ongoing scandal involving Cambridge Analytica</a>, which reportedly collected data on more than 50 million Facebook users without their consent and then used this information to build behavioral models to target potential voters in various political campaigns.</p>
<p>I hope readers don&#8217;t interpret this story as KrebsOnSecurity endorsing secret questions as a valid form of authentication. In fact, I have <a href="https://krebsonsecurity.com/?s=secret+question&amp;x=0&amp;y=0" target="_blank" rel="noopener">railed against this practice for years</a>, precisely because the answers often are so easily found using online services and social media profiles.</p>
<p>But if you must patronize a company or service that forces you to select secret questions, I think it&#8217;s a really good idea not to answer them truthfully. Just make sure you have a method for remembering your phony answer, in case you forget the lie somewhere down the road.</p>
<p>Many thanks to RonM for assistance with this post.</p>


feed_id: https://krebsonsecurity.com/?p=43288
title: Adobe, Microsoft Push Critical Security Fixes
uri: 2018-04-11-Adobe-Microsoft-Push-Critical-Security-Fixes
url: https://krebsonsecurity.com/2018/04/adobe-microsoft-push-critical-security-fixes-12/
content:
<p><strong>Adobe</strong> and <strong>Microsoft</strong> each released critical fixes for their products today, a.k.a &#8220;Patch Tuesday,&#8221; the second Tuesday of every month. Adobe updated its <strong>Flash Player</strong> program to resolve a half dozen critical security holes. Microsoft issued updates to correct at least 65 security vulnerabilities in <strong>Windows</strong> and associated software.</p>
<p><img class="alignright size-full wp-image-26837" src="media/863df0f6.brokenwindows.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2014/07/brokenwindows.png" alt="" width="229" height="240" />The Microsoft updates impact many core Windows components, including the built-in browsers <strong>Internet Explorer</strong> and <strong>Edge</strong>, as well as <strong>Office</strong>, the <strong>Microsoft Malware Protection Engine</strong>, <strong>Microsoft Visual Studio</strong> and <strong>Microsoft Azure</strong>.</p>
<p>The Malware Protection Engine flaw is one that was publicly disclosed earlier this month, and one for which Redmond issued an out-of-band (outside of Patch Tuesday) update one week ago.</p>
<p>That flaw, discovered and reported by <strong>Google&#8217;</strong>s <strong>Project Zero</strong> program, is <a href="https://www.helpnetsecurity.com/2018/04/05/microsoft-malware-protection-engine-flaw/" target="_blank" rel="noopener">reportedly</a> quite easy to exploit and impacts the malware scanning capabilities for a variety of Microsoft anti-malware products, including <strong>Windows Defender</strong>, <strong>Microsoft Endpoint Protection</strong> and <strong>Microsoft Security Essentials</strong>.</p>
<p>Microsoft really wants users to install these updates as qucikly as possible, but it might not be the worst idea to wait a few days before doing so: Quite often, problems with patches that may cause systems to end up in an endless reboot loop are reported and resolved with subsequent updates within a few days after their release. However, depending on which version of Windows you&#8217;re using it may be difficult to put off installing these patches.</p>
<p>Microsoft says by default, Windows 10 receives updates automatically, “and for customers running previous versions, we recommend they <a href="https://support.microsoft.com/en-us/help/306525/how-to-configure-and-use-automatic-updates-in-windows" data-ss1520968935="1">turn on automatic updates</a> as a best practice.” Microsoft doesn’t make it easy for Windows 10 users to change this setting, but <a href="https://www.howtogeek.com/224471/how-to-prevent-windows-10-from-automatically-downloading-updates/" target="_blank" rel="noopener">it is possible</a>. For all other Windows OS users, if you’d rather be alerted to new updates when they’re available so you can choose when to install them, there’s a setting for that in <strong>Windows Update</strong>. In any case, don&#8217;t put off installing these updates too long.<span id="more-43288"></span></p>
<p><img class="alignleft size-full wp-image-18875" src="media/18bb50f1.brokenflash-a.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2013/02/brokenflash-a.png" alt="" width="211" height="180" />Adobe’s <a href="https://helpx.adobe.com/security/products/flash-player/apsb18-05.html" target="_blank" rel="noopener">Flash Player update</a> fixes at least two critical bugs in the program. Adobe said it is not aware of any active exploits in the wild against either flaw, but if you’re not using Flash routinely for many sites, you probably want to disable or remove this buggy program.</p>
<p>Adobe is <a href="https://krebsonsecurity.com/2017/08/flash-player-is-dead-long-live-flash-player/" target="_blank" rel="noopener">phasing out Flash entirely by 2020</a>, but most of the major browsers already take steps to hobble Flash. And with good reason: It’s a major security liability. <strong>Google Chrome</strong> also bundles Flash, but blocks it from running on all but a handful of popular sites, and then only after user approval.</p>
<p>For Windows users with <strong>Mozilla Firefox</strong> installed, the browser prompts users to enable Flash on a per-site basis. Through the end of 2017 and into 2018, Microsoft Edge will continue to ask users for permission to run Flash on most sites the first time the site is visited, and will remember the user’s preference on subsequent visits.</p>
<p>The latest <a href="https://helpx.adobe.com/security/products/flash-player/apsb18-08.html" target="_blank" rel="noopener">standalone version</a> of Flash that addresses these bugs is <em>29.0.0.140</em>  for Windows, <strong>Mac</strong>, <strong>Linux</strong> and <strong>Chrome OS</strong>. But most users probably would be better off manually hobbling or removing Flash altogether, since so few sites actually require it still. Disabling Flash in Chrome is simple enough. Paste “<a href="chrome://settings/content" target="_blank" rel="noopener">chrome://settings/content</a>” into a Chrome browser bar and then select “Flash” from the list of items. By default it should be set to “Ask first” before running Flash, although users also can disable Flash entirely here or whitelist and blacklist specific sites.</p>
<p>More information on today&#8217;s updates is available from security vendors <a href="https://www.ivanti.com/blog/april-patch-tuesday-2018/" target="_blank" rel="noopener">Ivanti</a> and <a href="https://blog.qualys.com/laws-of-vulnerabilities/2018/04/10/april-patch-tuesday-63-microsoft-vulnerabilities-19-for-adobe" target="_blank" rel="noopener">Qualys</a>.</p>
<p>As always, if you experience problems installing any of these updates, feel free to note your issues in the comments below. Chances are, another reader here has experienced something similar and can assist in troubleshooting the issue.</p>


feed_id: https://krebsonsecurity.com/?p=43290
title: When Identity Thieves Hack Your Accountant
uri: When-Identity-Thieves-Hack-Your-Accountant
url: https://krebsonsecurity.com/2018/04/when-identity-thieves-hack-your-accountant/
content:
<p>The <strong>Internal Revenue Service</strong> has been <a href="https://www.irs.gov/newsroom/summit-partners-warn-tax-pros-to-be-on-alert-step-up-security-measures" target="_blank" rel="noopener">urging tax preparation firms</a> to step up their cybersecurity efforts this year, warning that identity thieves and hackers increasingly are targeting certified public accountants (CPAs) in a bid to siphon oodles of sensitive personal and financial data on taxpayers. This is the story of a CPA in New Jersey whose compromise by malware led to identity theft and phony tax refund requests filed on behalf of his clients.</p>
<p>Last month, KrebsOnSecurity was alerted by security expert <strong>Alex Holden</strong> of <a href="https://www.holdsecurity.com" target="_blank" rel="noopener">Hold Security</a> about a malware gang that appears to have focused on CPAs. The crooks in this case were using a Web-based keylogger that recorded every keystroke typed on the target&#8217;s machine, and periodically uploaded screenshots of whatever was being displayed on the victim&#8217;s computer screen at the time.</p>
<p>If you&#8217;ve never seen one of these keyloggers in action, viewing their output can be a bit unnerving. This particular malware is not terribly sophisticated, but nevertheless is quite effective. It not only grabs any data the victim submits into Web-based forms, but also captures any typing &#8212; including backspaces and typos as we can see in the screenshot below.</p>
<div id="attachment_43358" style="width: 606px" class="wp-caption aligncenter"><a class="lightbox" href="media/112cbc57.typotype.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/04/typotype.png"><img class="wp-image-43358" src="media/112cbc57.typotype.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/04/typotype.png" alt="" width="596" height="172" /></a><p class="wp-caption-text">The malware records everything its victims type (including backspaces and typos), and frequently takes snapshots of the victim&#8217;s computer screen.</p></div>
<p>Whoever was running this scheme had all victim information uploaded to a site that was protected from data scraping by search engines, but the site itself did not require any form of authentication to view data harvested from victim PCs. Rather, the stolen information was indexed by victim and ordered by day, meaning anyone who knew the right URL could view each day&#8217;s keylogging record as one long image file.</p>
<p>Those records suggest that this particular CPA &#8212; &#8220;John,&#8221; a New Jersey professional whose real name will be left out of this story &#8212; likely had his computer compromised sometime in mid-March 2018 (at least, this is as far back as the keylogging records go for John).</p>
<p>It&#8217;s also not clear exactly which method the thieves used to get malware on John&#8217;s machine. Screenshots for John&#8217;s account suggest he routinely ignored <a href="https://krebsonsecurity.com/2018/04/adobe-microsoft-push-critical-security-fixes-12/" target="_blank" rel="noopener">messages from <strong>Microsoft</strong></a> and other third party Windows programs about the need to apply critical security updates.</p>
<div id="attachment_43346" style="width: 606px" class="wp-caption aligncenter"><a class="lightbox" href="media/a1249aae.criticalupdatesneeded.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/04/criticalupdatesneeded.png"><img class="wp-image-43346" src="media/a1249aae.criticalupdatesneeded.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/04/criticalupdatesneeded.png" alt="" width="596" height="409" /></a><p class="wp-caption-text">Messages like this one &#8212; about critical security updates available for QuickBooks &#8212; went largely ignored, according to multiple screenshots from John&#8217;s computer.</p></div>
<p>More likely, however, John&#8217;s computer was compromised by someone who sent him a booby-trapped email attachment or link. When one considers just how frequently CPAs must need to open <strong>Microsoft Office</strong> and other files submitted by clients and potential clients via email, it&#8217;s not hard to imagine how simple it might be for hackers to target and successfully compromise your average CPA.</p>
<p>The keylogging malware itself appears to have been sold (or perhaps directly deployed) by a cybercriminal who uses the nickname <strong>ja_far</strong>. This individual markets a $50 keylogger product alongside a <a href="https://krebsonsecurity.com/2014/05/antivirus-is-dead-long-live-antivirus/" target="_blank" rel="noopener">malware &#8220;crypting&#8221; service</a> that guarantees his malware will be undetected by most antivirus products for a given number of days after it is used against a victim.</p>
<div id="attachment_43348" style="width: 609px" class="wp-caption aligncenter"><a class="lightbox" href="media/be4908e8.ja_far.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/04/ja_far.png"><img class="wp-image-43348" src="media/be4908e8.ja_far.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/04/ja_far.png" alt="" width="599" height="280" /></a><p class="wp-caption-text">Ja_far&#8217;s sales threads for the keylogger used to steal tax and financial data from hundreds of John&#8217;s clients.</p></div>
<p>It seems likely that ja_far&#8217;s keylogger was the source of this data because at one point &#8212; early in the morning John&#8217;s time &#8212; the attacker appears to have accidentally pasted ja_far&#8217;s jabber instant messenger address into the victim&#8217;s screen instead of his own. In all likelihood, John&#8217;s assailant was seeking additional crypting services to ensure the keylogger remained undetected on John&#8217;s PC. A couple of minutes later, the intruder downloaded a file to John&#8217;s PC from file-sharing site <strong>sendspace.com</strong>.</p>
<div id="attachment_43349" style="width: 606px" class="wp-caption aligncenter"><a class="lightbox" href="media/04411175.xkey.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/04/xkey.png"><img class="wp-image-43349" src="media/04411175.xkey.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/04/xkey.png" alt="" width="596" height="374" /></a><p class="wp-caption-text">The attacker apparently messing around on John&#8217;s computer while John was not sitting in front of the keyboard.</p></div>
<p>What I found remarkable about John&#8217;s situation was despite receiving notice after notice that the IRS had rejected many of his clients&#8217; tax returns because those returns had already been filed by fraudsters, for at least two weeks John does not appear to have suspected that his compromised computer was likely the source of said fraud inflicted on his clients (or if he did, he didn&#8217;t share this notion with any of his friends or family via email).</p>
<p>Instead, John composed and distributed to his clients a form letter about their rejected returns, and another letter that clients could use to alert the IRS and New Jersey tax authorities of suspected identity fraud.<span id="more-43290"></span></p>
<p>Then again, perhaps John ultimately <em>did</em> suspect that someone had commandeered his machine, because on March 30 he downloaded and installed <strong>Spyhunter 4</strong>, a security product by <strong>Enigma Software</strong> designed to detect spyware, keyloggers and rootkits, among other malicious software.</p>
<div id="attachment_43352" style="width: 600px" class="wp-caption aligncenter"><a class="lightbox" href="media/8a512b77.spyhunter.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/04/spyhunter.png"><img class="wp-image-43352" src="media/8a512b77.spyhunter.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/04/spyhunter.png" alt="" width="590" height="306" /></a><p class="wp-caption-text">Evidently suspecting someone or something was messing with his computer, John downloaded the trial version of Spyhunter 4 to scan his PC for malware.</p></div>
<p>Spyhunter appears to have found ja_far&#8217;s keylogger, because shortly after the malware alert pictured above popped up on John&#8217;s screen, the Web-based keylogging service stopped recording logs from his machine. John did not respond to requests for comment (via phone).</p>
<p>It&#8217;s unlikely John&#8217;s various clients who experience(d) identity fraud, tax refund fraud or account takeovers as a result of his PC infection will ever learn the real reason for the fraud. I opted to keep his name out of this story because I thought the experience documented and explained here would be eye opening enough and I have no particular interest in ruining his business.</p>
<p>But a new type of identity theft that the IRS first warned about this year involving CPAs would be very difficult for a victim CPA to conceal. Identity thieves who specialize in tax refund fraud have been busy of late <a href="https://krebsonsecurity.com/2018/02/irs-scam-leverages-hacked-tax-preparers-client-bank-accounts/" target="_blank" rel="noopener">hacking online accounts at multiple tax preparation firms and using them to file phony refund requests</a>. Once the IRS processes the return and deposits money into bank accounts of the hacked firms’ clients, the crooks contact those clients posing as a collection agency and demand that the money be “returned.”</p>
<p>If you go to file your taxes electronically this year and the return is rejected, it may mean fraudsters have beat you to it. The IRS advises taxpayers in this situation to follow the steps outlined in the Taxpayer Guide to Identity Theft. Those unable to file electronically should mail a paper tax return along with <a href="media/d356facd.f14039.pdf" data-original-source="https://www.irs.gov/pub/irs-pdf/f14039.pdf" target="_blank" rel="noopener">Form 14039</a> (PDF) — the Identity Theft Affidavit — stating they were victims of a tax preparer data breach.</p>
<p>Tax professionals might consider using something other than <strong>Microsoft Windows</strong> to manage their client&#8217;s data. I&#8217;ve <a href="https://krebsonsecurity.com/?s=live+cd&amp;x=0&amp;y=0" target="_blank" rel="noopener">long dispensed this advice</a> for people in charge of handling payroll accounts for small- to mid-sized businesses. I continue to stand by this advice not because there isn&#8217;t malware that can infect <strong>Mac</strong> or <strong>Linux</strong>-based systems, but because the vast majority of malicious software out there today still targets Windows computers, and you don&#8217;t have to outrun the bear &#8212; only the next guy.</p>
<p>Many readers involved in handling corporate payroll accounts have countered that this advice is impractical for people who rely on multiple Windows-based programs to do their jobs. These days, however, most systems and services needed to perform accounting (and CPA) tasks can be used across multiple operating systems &#8212; mainly because they are now Web-based and rely instead on credentials entered at some cloud service (e.g., <strong>UltraTax</strong>, <strong>QuickBooks</strong>, or even <strong>Microsoft&#8217;s Office 365)</strong>.</p>
<p>Naturally, users still must be on guard against phishing scams that try to trick people into divulging credentials to these services, but when your entire business of managing other people&#8217;s money and identities can be undone by a simple keylogger, it&#8217;s a good idea to do whatever you can to keep from becoming the next malware victim.</p>
<p>According to the IRS, fraudsters are using spear phishing attacks to compromise computers of tax pros. In this scheme, the &#8220;criminal singles out one or more tax preparers in a firm and sends an email posing as a trusted source such as the IRS, a tax software provider or a cloud storage provider. Thieves also may pose as clients or new prospects. The objective is to trick the tax professional into disclosing sensitive usernames and passwords or to open a link or attachment that secretly downloads malware enabling the thieves to track every keystroke.&#8221;</p>
<p>The IRS warns that some tax professionals may be unaware they are victims of data theft, even long after all of their clients&#8217; data has been stolen by digital intruders. Here are some signs there might be a problem:</p>
<ul>
<li>Client e-filed returns begin to be rejected because returns with their Social Security numbers were already filed;</li>
<li>The number of returns filed with tax practitioner’s Electronic Filing Identification Number (EFIN) exceeds number of clients;</li>
<li>Clients who haven’t filed tax returns begin to receive authentication letters from the IRS;</li>
<li>Network computers running slower than normal;</li>
<li>Computer cursors moving or changing numbers without touching the keyboard;</li>
<li>Network computers locking out tax practitioners.</li>
</ul>


feed_id: https://krebsonsecurity.com/?p=43391
title: Deleted Facebook Cybercrime Groups Had 300,000 Members
uri: Deleted-Facebook-Cybercrime-Groups-Had-300-000-Members
url: https://krebsonsecurity.com/2018/04/deleted-facebook-cybercrime-groups-had-300000-members/
content:
<p>Hours after being alerted by KrebsOnSecurity, <strong>Facebook</strong> last week deleted almost 120 private discussion groups totaling more than 300,000 members who flagrantly promoted a host of illicit activities on the social media network&#8217;s platform. The scam groups facilitated a broad spectrum of shady activities, including spamming, wire fraud, account takeovers, <a href="https://krebsonsecurity.com/?s=tax+refund+fraud&amp;x=0&amp;y=0" target="_blank" rel="noopener">phony tax refunds</a>, <a href="https://krebsonsecurity.com/?s=419+scam&amp;x=0&amp;y=0" target="_blank" rel="noopener">419 scams</a>, <a href="https://krebsonsecurity.com/?s=booters&amp;x=0&amp;y=0" target="_blank" rel="noopener">denial-of-service attack-for-hire services</a> and <a href="https://en.wikipedia.org/wiki/Botnet" target="_blank" rel="noopener">botnet</a> creation tools. The average age of these groups on Facebook&#8217;s platform was two years.</p>
<p>On Thursday, April 12, KrebsOnSecurity spent roughly two hours combing Facebook for groups whose sole purpose appeared to be flouting the company&#8217;s terms of service agreement about what types of content it will or will not tolerate on its platform.</p>
<div id="attachment_43416" style="width: 609px" class="wp-caption aligncenter"><a class="lightbox" href="media/fb509ff5.buybest.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/04/buybest.png"><img class="wp-image-43416" src="media/fb509ff5.buybest.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/04/buybest.png" alt="" width="599" height="284" /></a><p class="wp-caption-text">One of nearly 120 different closed cybercrime groups operating on Facebook that were deleted late last week. In total, there were more than 300,000 members of these groups. The average age of these groups was two years, but some had existed for up to nine years on Facebook</p></div>
<p>My research centered on groups whose singular focus was promoting all manner of cyber fraud, but most especially those engaged in identity theft, spamming, account takeovers and credit card fraud. Virtually all of these groups advertised their intent by stating well-known terms of fraud in their group names, such as &#8220;botnet helpdesk,&#8221; &#8220;spamming,&#8221; &#8220;carding&#8221; (referring to credit card fraud), &#8220;DDoS&#8221; (distributed denial-of-service attacks), &#8220;tax refund fraud,&#8221; and account takeovers.</p>
<p>Each of these closed groups solicited new members to engage in a variety of shady activities. Some had existed on Facebook for up to nine years; <em>approximately ten percent of them had plied their trade on the social network for more than four years</em>.</p>
<p>Here is <a href="media/36c8494b.FBcarding-Sheet1.pdf" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/04/FBcarding-Sheet1.pdf" target="_blank" rel="noopener">a spreadsheet</a> (PDF) listing all of the offending groups reported, including: Their stated group names; the length of time they were present on Facebook; the number of members; whether the group was promoting a third-party site on the dark or clear Web; and a link to the offending group. A copy of the same spreadsheet in .csv format is available <a href="https://krebsonsecurity.com/wp-content/uploads/2018/04/FBcarding-Sheet1.csv" target="_blank" rel="noopener">here</a>.</p>
<p>The biggest collection of groups banned last week were those promoting the sale and use of stolen credit and debit card accounts. The next largest collection of groups included those facilitating account takeovers &#8212; methods for mass-hacking emails and passwords for countless online accounts such <strong>Amazon</strong>, <strong>Google</strong>, <strong>Netflix</strong>, <strong>PayPal, </strong>as well as a host of online banking services.</p>
<div id="attachment_43419" style="width: 591px" class="wp-caption aligncenter"><a class="lightbox" href="media/d7231f9a.buyselling.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/04/buyselling.png"><img class="wp-image-43419" src="media/d7231f9a.buyselling.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/04/buyselling.png" alt="" width="581" height="362" /></a><p class="wp-caption-text">This rather active Facebook group, which specialized in identity theft and selling stolen bank account logins, was active for roughly three years and had approximately 2,500 members.</p></div>
<p>In a statement to KrebsOnSecurity, Facebook pledged to be more proactive about policing its network for these types of groups.</p>
<p>&#8220;We thank Mr. Krebs for bringing these groups to our attention, we removed them as soon as we investigated,&#8221; said <strong>Pete Voss</strong>, Facebook&#8217;s communications director. &#8220;We investigated these groups as soon as we were aware of the report, and once we confirmed that they violated our Community Standards, we disabled them and removed the group admins. We encourage our community to report anything they see that they don’t think should be in Facebook, so we can take swift action.&#8221;<span id="more-43391"></span></p>
<p>KrebsOnSecurity&#8217;s research was far from exhaustive: For the most part, I only looked at groups that promoted fraudulent activities in the English language. Also, I ignored groups that had fewer than 25 members. As such, there may well be hundreds or thousands of other groups who openly promote fraud as their purpose of membership but which achieve greater stealth by masking their intent with variations on or mispellings of different cyber fraud slang terms.</p>
<p>Facebook said its <a href="http://facebook.com/communitystandards" target="_blank" rel="noopener">community standards policy</a> does not allow the promotion or sale of illegal goods or services including credit card numbers or CVV numbers (stolen card details marketed for use in online fraud), and that once a violation is reported, its teams review a report and remove the offending post or group if it violates those policies.</p>
<p>The company added that Facebook users can report suspected violations by loading a group&#8217;s page, clicking &#8220;…&#8221; in the top right and selecting &#8220;Report Group”. Users who wish to learn more about reporting abusive groups can visit <a href="https://www.facebook.com/help/reportlinks" target="_blank" rel="noopener">facebook.com/report</a>.</p>
<p>&#8220;As technology improves, we will continue to look carefully at other ways to use automation,&#8221; Facebook&#8217;s statement concludes, responding to questions from KrebsOnSecurity about what steps it might take to more proactively scour its networks for abusive groups. &#8220;Of course, a lot of the work we do is very contextual, such as determining whether a particular comment is hateful or bullying. That&#8217;s why we have real people looking at those reports and making the decisions.&#8221;</p>
<p>Facebook&#8217;s stated newfound interest in cleaning up its platform comes as the social networking giant finds itself reeling from a scandal in which <strong>Cambridge Analytica</strong>, a political data firm, was found to have <a href="https://www.nytimes.com/2018/03/19/technology/facebook-cambridge-analytica-explained.html" target="_blank" rel="noopener">acquired access to private data on more than 50 million Facebook profiles</a> &#8212; most of them scraped without user permission.</p>


feed_id: https://krebsonsecurity.com/?p=43376
title: A Sobering Look at Fake Online Reviews
uri: A-Sobering-Look-at-Fake-Online-Reviews
url: https://krebsonsecurity.com/2018/04/a-sobering-look-at-fake-online-reviews/
content:
<p>In 2016, KrebsOnSecurity exposed a network of phony Web sites and fake online reviews that funneled those seeking help for drug and alcohol addiction toward <a href="https://krebsonsecurity.com/2016/06/scientology-seeks-captive-converts-via-google-maps-drug-rehab-centers/" target="_blank" rel="noopener">rehab centers that were secretly affiliated with the Church of Scientology</a>. Not long after the story ran, that network of bogus reviews disappeared from the Web. Over the past few months, however, the same prolific purveyor of these phantom sites and reviews appears to be back at it again, enlisting the help of Internet users and paying people $25-$35 for each fake listing.</p>
<p>Sometime in March 2018, ads began <a href="https://indianapolis.craigslist.org/web/d/social-media-posting-work-at/6541363463.html" target="_blank" rel="noopener">appearing on Craigslist</a> promoting part-time &#8220;social media assistant&#8221; jobs, in which interested applicants are directed to sign up for positions at <strong>seorehabs[dot]com</strong>. This site promotes itself as &#8220;leaders in addiction recovery consulting,&#8221; explaining that assistants can earn a minimum of $25 just for creating individual <strong>Google for Business</strong> listings tied to a few dozen generic-sounding addiction recovery center names, such as &#8220;<strong>Integra Addiction Center</strong>,&#8221; and &#8220;<strong>First Exit Recovery</strong>.&#8221;</p>
<div id="attachment_43409" style="width: 602px" class="wp-caption aligncenter"><a class="lightbox" href="media/6d474303.seorehabs-craigslist.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/04/seorehabs-craigslist.png"><img class="wp-image-43409" src="media/6d474303.seorehabs-craigslist.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/04/seorehabs-craigslist.png" alt="" width="592" height="308" /></a><p class="wp-caption-text">The listing on Craigslist.com advertising jobs for creating fake online businesses tied to addiction rehabilitation centers.</p></div>
<p>Applicants who sign up are given detailed instructions on how to step through Google&#8217;s anti-abuse process for creating listings, which include receiving a postcard via snail mail from Google that contains a PIN which needs to be entered at Google&#8217;s site before a listing can be created.</p>
<p>Assistants are cautioned not to create more than two listings per street address, but otherwise to use <em>any</em> U.S.-based street address and to leave blank the phone number and Web site for the new business listing.</p>
<div id="attachment_43411" style="width: 587px" class="wp-caption aligncenter"><img class=" wp-image-43411" src="media/a75ae41a.recoverysites.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/04/recoverysites.png" alt="" width="577" height="832" /><p class="wp-caption-text">A screen shot from Seorehabs&#8217; instructions for those hired to create rehab center listings.</p></div>
<p>In my story <a href="https://krebsonsecurity.com/2016/06/scientology-seeks-captive-converts-via-google-maps-drug-rehab-centers/" target="_blank" rel="noopener">Scientology Seeks Captive Converts Via Google Maps, Drug Rehab Centers</a>, I showed how a labyrinthine network of fake online reviews that steered Internet searches toward rehab centers funded by Scientology adherents was set up by <strong>TopSeek Inc.</strong>, which bills itself as a collection of &#8220;local marketing experts.&#8221; According to <a href="https://www.linkedin.com/in/john-harvey-15a20223/" target="_blank" rel="noopener">LinkedIn</a>, TopSeek is owned by <strong>John Harvey</strong>, an individual (or alias) who lists his address variously as Sacramento, Calif. and Hawaii.</p>
<p>Although the current Web site registration records from registrar giant <strong>Godaddy</strong> obscure the information for the current owner of seorehabs[dot]com, <a href="https://krebsonsecurity.com/wp-content/uploads/2018/04/seorehabs-domaintools-original-whois.txt" target="_blank" rel="noopener">a historic WHOIS search</a> via <a href="https://www.domaintools.com" target="_blank" rel="noopener">Domaintools</a> shows the site was also registered by John Harvey and TopSeek in 2015. Mr. Harvey did not respond to requests for comment. [Full disclosure: Domaintools previously was an advertiser on KrebsOnSecurity].</p>
<p>TopSeek&#8217;s Web site says it works with several clients, but most especially <strong><a href="https://en.wikipedia.org/wiki/Narconon" target="_blank" rel="noopener">Narconon International</a></strong> — an organization that promotes the rather unorthodox theories of <a title="Scientology" href="https://en.wikipedia.org/wiki/Scientology" data-ss1467034033="1">Scientology</a> founder <a title="L. Ron Hubbard" href="https://en.wikipedia.org/wiki/L._Ron_Hubbard" data-ss1467034033="1">L. Ron Hubbard</a> regarding substance abuse treatment and addiction.</p>
<p>As described in <a href="https://en.wikipedia.org/wiki/Narconon" target="_blank" rel="noopener">Narconon’s Wikipedia entry</a>, Narconon facilities are known not only for attempting to win over new converts to Scientology, but also for treating all substance abuse addictions with a rather bizarre cocktail consisting mainly of vitamins and long hours in extremely hot saunas. Their Wiki entry documents multiple cases of accidental deaths at Narconon facilities, where some addicts reportedly died from overdoses of vitamins or neglect.<span id="more-43376"></span></p>
<h4>A LUCRATIVE RACKET</h4>
<p><strong>Bryan Seely</strong>, a security expert who has written extensively about the use of fake search listings to conduct online bait-and-switch scams, said the purpose of sites like those that Seorehabs pays people to create is to funnel calls to a handful of switchboards that then sell the leads to rehab centers that have agreed to pay for them. Many rehab facilities will pay hundreds of dollars for leads that may ultimately lead to a new patient. After all, Seely said, some facilities can then turn around and bill insurance providers for thousands of dollars per patient.</p>
<p>Perhaps best known for a stunt in which he used fake Google Maps listings to <a href="https://www.youtube.com/watch?v=5c6AADI7Pb4" target="_blank" rel="noopener">intercept calls destined for the FBI and U.S. Secret Service</a>, Seely has learned a thing or two about this industry: Until 2011, he worked for an SEO firm that helped to develop and spread some of the same fake online reviews that he is now helping to clean up.</p>
<p>&#8220;Mr. Harvey and TopSeek are crowdsourcing the data input for these fake rehab centers,&#8221; Seely said. &#8220;The phone numbers all go to just a few dedicated call centers, and it&#8217;s not hard to see why. The money is good in this game. He sells a call for $50-$100 at a minimum, and the call center then tries to sell that lead to a treatment facility that has agreed to buy leads. Each lead can be worth $5,000 to $10,000 for a patient who has good health insurance and signs up.&#8221;</p>
<div id="attachment_35338" style="width: 602px" class="wp-caption aligncenter"><a class="lightbox" href="media/360fbfce.whatshappening.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2016/06/whatshappening.png"><img class="wp-image-35338" src="media/360fbfce.whatshappening.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2016/06/whatshappening.png" alt="" width="592" height="322" srcset="https://krebsonsecurity.com/wp-content/uploads/2016/06/whatshappening.png 1177w, https://krebsonsecurity.com/wp-content/uploads/2016/06/whatshappening-580x315.png 580w, https://krebsonsecurity.com/wp-content/uploads/2016/06/whatshappening-768x418.png 768w, https://krebsonsecurity.com/wp-content/uploads/2016/06/whatshappening-940x511.png 940w" sizes="(max-width: 592px) 100vw, 592px" /></a><p class="wp-caption-text">This graph illustrates what happens when someone calls one of these Seorehabs listings. Source: Bryan Seely.</p></div>
<p>Many of the listings created by Seorehab assistants are tied to fake <strong>Google Maps</strong> entries that include phony reviews for bogus treatment centers. In the event those listings get suspended by Google, Seorehab offers detailed instructions on how assistants can delete and re-submit listings.</p>
<p><img class="aligncenter wp-image-43434" src="media/08ed5bb1.listingsuspended.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/04/listingsuspended.png" alt="" width="573" height="636" /></p>
<p>Assistants also can earn extra money writing fake, glowing reviews of the treatment centers:</p>
<p><img class="aligncenter size-full wp-image-43435" src="media/8da4ee3e.seorehabs-postingreviews.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/04/seorehabs-postingreviews.png" alt="" width="497" height="472" /></p>
<p>Below are some of the plainly bogus reviews and listings created in the last month that pimp the various treatment center names and Web sites provided by Seorehabs. It is not difficult to find dozens of other examples of people who claim to have been at multiple Seorehab-promoted centers scattered across the country. For example, &#8220;Gloria Gonzalez&#8221; supposedly has been treated at no fewer than seven Seorehab-marketed detox locations in five states, penning each review just in the last month:</p>
<p><a class="lightbox" href="media/f45738cb.GloriaGonzalez.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/04/GloriaGonzalez.png"><img class="aligncenter wp-image-43436" src="media/f45738cb.GloriaGonzalez.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/04/GloriaGonzalez.png" alt="" width="597" height="424" /></a></p>
<p>A reviewer using the name &#8220;Tedi Spicer&#8221; also promoted at least seven separate rehab centers across the United States in the past month. Getting treated at so many far-flung facilities in just the few months that the domains for these supposed rehab centers have been online would be an impressive feat:</p>
<p><a class="lightbox" href="media/466935fd.tedispicer-1.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/04/tedispicer-1.png"><img class="aligncenter wp-image-43442" src="media/466935fd.tedispicer-1.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/04/tedispicer-1.png" alt="" width="596" height="355" /></a></p>
<p>Bring up any of the Web sites for these supposed rehab listings and you&#8217;ll notice they all include the same boilerplate text and graphic design. Aside from combing listings created by the reviewers paid to promote the sites, we can find other Seorehab listings just by searching the Web for chunks of text on the sites. Doing so reveals <a href="https://krebsonsecurity.com/wp-content/uploads/2018/04/seorehabs-domainlist.txt" target="_blank" rel="noopener">a long list</a> (this is likely far from comprehensive) of domain names registered in the past few months that were all created with hidden registration details and registered via <strong>Godaddy</strong>.</p>
<p>Seely said he spent a few hours this week calling dozens of phone numbers tied to these rehab centers promoted by TopSeek, and created a spreadsheet documenting his work and results <a href="https://docs.google.com/spreadsheets/d/1zDs_YU9x3zHn9ucp-huZuvetwTIByWKtcalzFjBLuFs/edit?usp=sharing" target="_blank" rel="noopener">here</a> (Google Sheets).</p>
<p>Seely said while he would never advocate such activity, TopSeek&#8217;s fake listings could end up costing Mr. Harvey plenty of money if someone figured out a way to either mass-report the listings as fraudulent or automate calls to the handful of hotlines tied to the listings.</p>
<p>&#8220;It would kill his business until he changes all the phone numbers tied to these fake listings, but if he had to do that he&#8217;d have to pay people to rebuild all the directories that link to these sites,&#8221; he said.</p>
<h4>WHAT YOU CAN DO ABOUT FAKE ONLINE REVIEWS</h4>
<p>Before doing business with a company you found online, don’t just pick the company that comes up at the top of search results on Google or any other search engine. Unfortunately, that generally guarantees little more than the company is good at marketing.</p>
<p>Take the time to research the companies you wish to hire <em>before</em> booking them for jobs or services &#8212; especially when it comes to big, expensive, and potentially risky services like drug rehab or <a href="http://krebsonsecurity.com/2015/07/dont-be-fooled-by-phony-online-reviews/" target="_blank" rel="noopener">moving companies</a>. By the way, if you’re looking for a legitimate rehab facility, you could do worse than to start at <strong>rehabs.com</strong>, a legitimate rehab search engine.</p>
<p>It’s a good idea to get in the habit of verifying that the organization’s physical address, phone number and Web address shown in the search result match that of the landing page. If the phone numbers are different, use the contact number listed on the linked site.</p>
<p>Take the time to learn about the organization’s reputation online and in social media; if it has none (other than a Google Maps listing with all glowing, 5-star reviews), it’s probably fake. Search the Web for any public records tied to the business’ listed physical address, including articles of incorporation from the local secretary of state office online.</p>
<p>A search of the company’s <a href="https://whois.domaintools.com/" target="_blank" rel="noopener">domain name registration records</a> can give you an idea of how long its Web site has been in business, as well as additional details about the the organization (although the ability to do this <a href="https://krebsonsecurity.com/2018/03/who-is-afraid-of-more-spams-and-scams/" target="_blank" rel="noopener">may soon be a thing of the past</a>).</p>
<p>Seely said one surefire way to avoid these marketing shell games is to ask a simple question of the person who answers the phone in the online listing.</p>
<p>“Ask anyone on the phone what company they’re with,” Seely said. “Have them tell you, take their information and then call them back. If they aren’t forthcoming about who they are, they’re most likely a scam.”</p>
<p>In 2016, Seely published <a href="https://www.amazon.com/gp/product/1533156778/ref=as_li_tl?ie=UTF8&amp;camp=1789&amp;creative=9325&amp;creativeASIN=1533156778&amp;linkCode=as2&amp;tag=seelysecurity-20&amp;linkId=bdd3831a679a515a5a3c2bb2129ff643" target="_blank" rel="noopener">a book on Amazon</a> about the thriving and insanely lucrative underground business of fake online reviews. He&#8217;s agreed to let KrebsOnSecurity republish the entire e-book, which is available for free <a href="media/6ce8c9be.Cyber-Fraud-Book-KrebsEditionBWR.pdf" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/04/Cyber-Fraud-Book-KrebsEditionBWR.pdf" target="_blank" rel="noopener">at this link</a> (PDF).</p>
<p>&#8220;This is literally the worst book ever written about Google Maps fraud,&#8221; Seely said. &#8220;It&#8217;s also the best. Is it still a niche if I&#8217;m the only one here? The more people who read it, the better.&#8221;</p>


feed_id: https://krebsonsecurity.com/?p=43469
title: Is Facebook’s Anti-Abuse System Broken?
uri: Is-Facebook-s-Anti-Abuse-System-Broken
url: https://krebsonsecurity.com/2018/04/is-facebooks-anti-abuse-system-broken/
content:
<p><strong>Facebook</strong> has built some of the most advanced algorithms for tracking users, but when it comes to acting on user abuse reports about Facebook groups and content that clearly violate the company&#8217;s &#8220;community standards,&#8221; the social media giant&#8217;s technology appears to be woefully inadequate.</p>
<p><img class="alignright wp-image-43481" src="media/f6f7d408.fbtd.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/04/fbtd.png" alt="" width="266" height="227" />Last week, Facebook <a href="https://krebsonsecurity.com/2018/04/deleted-facebook-cybercrime-groups-had-300000-members/" target="_blank" rel="noopener">deleted almost 120 groups</a> totaling more than 300,000 members. The groups were mostly closed &#8212; requiring approval from group administrators before outsiders could view the day-to-day postings of group members.</p>
<p>However, the titles, images and postings available on each group&#8217;s front page left little doubt about their true purpose: Selling everything from stolen credit cards, identities and hacked accounts to services that help automate things like spamming, phishing and denial-of-service attacks for hire.</p>
<p>To its credit, Facebook deleted the groups within just a few hours of KrebsOnSecurity sharing via email a spreadsheet detailing each group, which concluded that the average length of time the groups had been active on Facebook was two years. But I suspect that the company took this extraordinary step mainly because I informed them that I intended to write about the proliferation of cybercrime-based groups on Facebook.</p>
<p>That story, <a href="https://krebsonsecurity.com/2018/04/deleted-facebook-cybercrime-groups-had-300000-members/" target="_blank" rel="noopener">Deleted Facebook Cybercrime Groups had 300,000 Members</a>, ended with a statement from Facebook promising to crack down on such activity and instructing users on how to report groups that violate it its community standards.</p>
<p>In short order, some of the groups I reported that were removed re-established themselves within hours of Facebook&#8217;s action. I decided instead of contacting Facebook&#8217;s public relations arm directly that I would report those resurrected groups and others using <a href="https://www.facebook.com/help/reportlinks" target="_blank" rel="noopener">Facebook&#8217;s stated process</a>. Roughly two days later I received a series replies saying that Facebook had reviewed my reports but that none of the groups were found to have violated its standards. Here&#8217;s a snippet from those replies:</p>
<p><img class="aligncenter size-full wp-image-43472" src="media/dd9d7668.fb-sorry.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/04/fb-sorry.png" alt="" width="408" height="927" /></p>
<p>Perhaps I should give Facebook the benefit of the doubt: Maybe my multiple reports one after the other triggered some kind of anti-abuse feature that is designed to throttle those who would seek to abuse it to get otherwise legitimate groups taken offline &#8212; much in the way that pools of automated bot accounts have been known to abuse Twitter&#8217;s reporting system to successfully sideline accounts of specific targets.</p>
<p>Or it could be that I simply didn&#8217;t click the proper sequence of buttons when reporting these groups. The closest match I could find in Facebook&#8217;s abuse reporting system were, &#8220;Doesn&#8217;t belong on Facebook,&#8221; and &#8220;Purchase or sale of drugs, guns or regulated products.&#8221; There was/is no option for &#8220;selling hacked accounts, credit cards and identities,&#8221; or anything of that sort.</p>
<p>In any case, one thing seems clear: Naming and shaming these shady Facebook groups via <strong>Twitter</strong> seems to work better right now for getting them removed from Facebook than using Facebook&#8217;s own formal abuse reporting process. So that&#8217;s what I did on Thursday. Here&#8217;s an example:<span id="more-43469"></span></p>
<p><img class="aligncenter wp-image-43473" src="media/8cc6127c.carderx.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/04/carderx.png" alt="" width="574" height="693" /></p>
<p>Within minutes of my <a href="https://twitter.com/briankrebs/status/986986606149144576" target="_blank" rel="noopener">tweeting about this</a>, the group was gone. I also <a href="https://twitter.com/briankrebs/status/986986887716966403" target="_blank" rel="noopener">tweeted about &#8220;Best of the Best,&#8221;</a> which was selling accounts from many different e-commerce vendors, including Amazon and eBay:</p>
<p><img class="aligncenter wp-image-43474" src="media/cdf79935.accountsforsale.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/04/accountsforsale.png" alt="" width="594" height="623" /></p>
<p>That group, too, was nixed shortly after my tweet. And so it went for other groups I mentioned in my tweetstorm today. But in response to that flurry of tweets about abusive groups on Facebook, I heard from dozens of other Twitter users who said they&#8217;d received the same &#8220;does not violate our community standards&#8221; reply from Facebook after reporting other groups that clearly flouted the company&#8217;s standards.</p>
<p><strong>Pete Voss</strong>, Facebook&#8217;s communications manager, apologized for the oversight.</p>
<p>“We&#8217;re sorry about this mistake,&#8221; Voss said. &#8220;Not removing this material was an error and we removed it as soon as we investigated. Our team processes millions of reports each week, and sometimes we get things wrong. We are reviewing this case specifically, including the user’s reporting options, and we are taking steps to improve the experience, which could include broadening the scope of categories to choose from.”</p>
<p>Facebook CEO and founder <strong>Mark Zuckerberg</strong> testified before Congress last week in response to allegations that the company wasn&#8217;t doing enough to halt the abuse of its platform for things like fake news, hate speech and terrorist content. <a href="https://www.technologyreview.com/s/610860/three-problems-with-facebooks-plan-to-kill-hate-speech-using-ai/" target="_blank" rel="noopener">It emerged</a> that Facebook already employs 15,000 human moderators to screen and remove offensive content, and that it plans to hire another 5,000 by the end of this year.</p>
<p>&#8220;But right now, those moderators can only react to posts Facebook users have flagged,&#8221; writes <strong>Will Knight</strong>, for Technologyreview.com.</p>
<p>Zuckerberg told lawmakers that Facebook hopes expected advances in artificial intelligence or &#8220;AI&#8221; technology will soon help the social network do a better job self-policing against abusive content. But for the time being, as long as Facebook mainly acts on abuse reports only when it is publicly pressured to do so by lawmakers or people with hundreds of thousands of followers, the company will continue to be dogged by a perception that doing otherwise is simply bad for its business model.</p>


feed_id: https://krebsonsecurity.com/?p=43489
title: Transcription Service Leaked Medical Records
uri: Transcription-Service-Leaked-Medical-Records
url: https://krebsonsecurity.com/2018/04/transcription-service-leaked-medical-records/
content:
<p><strong>MEDantex</strong>, a Kansas-based company that provides medical transcription services for hospitals, clinics and private physicians, took down its customer Web portal last week after being notified by KrebsOnSecurity that it was leaking sensitive patient medical records &#8212; apparently for thousands of physicians.</p>
<p>On Friday, KrebsOnSecurity learned that the portion of MEDantex&#8217;s site which was supposed to be a password-protected portal physicians could use to upload audio-recorded notes about their patients was instead completely open to the Internet.</p>
<p>What&#8217;s more, numerous online tools intended for use by MEDantex employees were exposed to anyone with a Web browser, including pages that allowed visitors to add or delete users, and to search for patient records by physician or patient name. No authentication was required to access any of these pages.</p>
<div id="attachment_43497" style="width: 595px" class="wp-caption aligncenter"><a class="lightbox" href="media/26071f25.adminsearch.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/04/adminsearch.png"><img class="wp-image-43497" src="media/26071f25.adminsearch.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/04/adminsearch.png" alt="" width="585" height="387" /></a><p class="wp-caption-text">This exposed administrative page from MEDantex&#8217;s site granted anyone complete access to physician files, as well as the ability to add and delete authorized users.</p></div>
<p>Several MEDantex portal pages left exposed to the Web suggest that the company recently was the victim of <strong>WhiteRose</strong>, a strain of ransomware that encrypts a victim&#8217;s files unless and until a ransom demand is paid &#8212; usually in the form of some virtual currency such as bitcoin.</p>
<p><img class="aligncenter wp-image-43502" src="media/eb8b002c.whiterose-highlighted.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/04/whiterose-highlighted.png" alt="" width="596" height="197" /></p>
<p>Contacted by KrebsOnSecurity, MEDantex founder and chief executive <a href="https://www.linkedin.com/in/sreeram-pydah/" target="_blank" rel="noopener"><strong>Sreeram Pydah</strong></a> confirmed that the Wichita, Kansas based transcription firm recently rebuilt its online servers after suffering a ransomware infestation. Pydah said the MEDantex portal was taken down for nearly two weeks, and that it appears the glitch exposing patient records to the Web was somehow incorporated into that rebuild.</p>
<p>&#8220;There was some ransomware injection [into the site], and we rebuilt it,&#8221; Pydah said, just minutes before disabling the portal (which remains down as of this publication). &#8220;I don&#8217;t know how they left the documents in the open like that. We&#8217;re going to take the site down and try to figure out how this happened.&#8221;</p>
<p>It&#8217;s unclear exactly how many patient records were left exposed on MEDantex&#8217;s site. But one of the main exposed directories was named &#8220;/documents/userdoc,&#8221; and it included <a href="https://docs.google.com/spreadsheets/d/1P4DLPjCO9Y64dCf6YWYAuhQ8Wr4vUaoV2cCYZxY8RpI/edit?usp=sharing" target="_blank" rel="noopener">more than 2,300 physicians</a> listed alphabetically by first initial and last name. Drilling down into each of these directories revealed a varying number of patient records &#8212; displayed and downloadable as Microsoft Word documents and/or raw audio files.</p>
<p><img class="aligncenter wp-image-43495 size-full" src="media/7b75b5bc.medantex.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/04/medantex.png" alt="" width="453" height="962" /></p>
<p>Although many of the exposed documents appear to be quite recent, some of the records dated as far back as 2007. It&#8217;s also unclear how long the data was accessible, but <a href="http://webcache.googleusercontent.com/search?q=cache:wJyJ6QYOKZoJ:medantex2.com/+&amp;cd=1&amp;hl=en&amp;ct=clnk&amp;gl=us&amp;client=firefox-b-ab" target="_blank" rel="noopener">this Google cache</a> of the MEDantex physician portal seems to indicate it was wide open on April 10, 2018.</p>
<p>Among the <a href="http://medantex.com/About-Us/Clients.html" target="_blank" rel="noopener">clients listed</a> on MEDantex&#8217;s site include <strong>New York University Medical Center</strong>; <strong>San Francisco Multi-Specialty Medical Group</strong>; <strong>Jackson Hospital</strong> in Montgomery Ala.; <strong>Allen County Hospital</strong> in Iola, Kan; <strong>Green Clinic Surgical Hospital</strong> in Ruston, La.; <strong>Trillium Specialty Hospital</strong> in Mesa and Sun City, Ariz.; <strong>Cooper University Hospital</strong> in Camden, N.J.; <strong>Sunrise Medical Group</strong> in Miami; the <strong>Wichita Clinic</strong> in Wichita, Kan.; the <strong>Kansas Spine Center</strong>; the <strong>Kansas Orthopedic Center</strong>; and <strong>Foundation Surgical Hospitals</strong> nationwide. MEDantex&#8217;s site states these are just some of the healthcare organizations partnering with the company for transcription services.<span id="more-43489"></span></p>
<p>Unfortunately, the incident at MEDantex is far from an anomaly. A <a href="https://www.verizonenterprise.com/verizon-insights-lab/dbir/" target="_blank" rel="noopener">study of data breaches released this month</a> by <strong>Verizon Enterprise</strong> found that nearly a quarter of all breaches documented by the company in 2017 involved healthcare organizations.</p>
<p>Verizon says ransomware attacks account for 85 percent of all malware in healthcare breaches last year, and that healthcare is the only industry in which the threat from the inside is greater than that from outside.</p>
<p>&#8220;Human error is a major contributor to those stats,&#8221; the report concluded.</p>
<div id="attachment_43499" style="width: 604px" class="wp-caption aligncenter"><img class=" wp-image-43499" src="media/682b5066.dbir-hc-2018.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/04/dbir-hc-2018.png" alt="" width="594" height="402" /><p class="wp-caption-text">Source: Verizon Business 2018 Data Breach Investigations Report.</p></div>
<p>According to <a href="https://www.bleepingcomputer.com/news/security/the-whiterose-ransomware-is-decryptable-and-tells-a-strange-story/" target="_blank" rel="noopener">a story</a> at <strong>BleepingComputer</strong>, a security news and help forum that specializes in covering ransomware outbreaks, WhiteRose was first spotted about a month ago. BleepingComputer founder <strong>Lawrence Abrams</strong> says it&#8217;s not clear how this ransomware is being distributed, but that reports indicate it is being manually installed by <a href="https://krebsonsecurity.com/?s=rdp&amp;x=0&amp;y=0" target="_blank" rel="noopener">hacking into Remote Desktop services</a>.</p>
<p>Fortunately for WhiteRose victims, this particular strain of ransomware is decryptable without the need to pay the ransom.</p>
<p>&#8220;The good news is this ransomware appears to be decryptable by <a href="https://twitter.com/demonslay335" target="_blank" rel="noopener">Michael Gillespie</a>,&#8221; Abrams wrote. &#8220;So if you become infected with WhiteRose, do not pay the ransom, and instead post a request for help in our <a href="https://www.bleepingcomputer.com/forums/t/674697/whiterose-ransomware-support-topic-how-to-recovery-filestxt/" target="_blank" rel="noopener">WhiteRose Support &amp; Help topic</a><a href="https://twitter.com/demonslay335" target="_blank" rel="noopener">.&#8221;</a></p>
<p>Ransomware victims may also be able to find assistance in unlocking data without paying from <a href="https://www.nomoreransom.org" target="_blank" rel="noopener">nomoreransom.org</a>.</p>
<p>KrebsOnSecurity would like to thank India-based cybersecurity startup <a href="https://banbreach.com/" target="_blank" rel="noopener">Banbreach</a> for the heads up about this incident.</p>


feed_id: https://krebsonsecurity.com/?p=43525
title: DDoS-for-Hire Service Webstresser Dismantled
uri: DDoS-for-Hire-Service-Webstresser-Dismantled
url: https://krebsonsecurity.com/2018/04/ddos-for-hire-service-webstresser-dismantled/
content:
<p>Authorities in the U.S., U.K. and the Netherlands on Tuesday took down popular online attack-for-hire service <strong>WebStresser.org</strong> and arrested its alleged administrators. Investigators say that prior to the takedown, the service had more than 136,000 registered users and was responsible for launching somewhere between four and six million attacks over the past three years.</p>
<p>The action, dubbed &#8220;<strong>Operation Power Off</strong>,&#8221; targeted WebStresser.org (previously Webstresser.co), one of the most active services for launching point-and-click distributed denial-of-service (DDoS) attacks. WebStresser was one of many so-called <a href="https://krebsonsecurity.com/?s=booter+service&amp;x=0&amp;y=0" target="_blank" rel="noopener">&#8220;booter&#8221;</a> services &#8212; virtual hired muscle that anyone can rent to knock nearly any website or Internet user offline.</p>
<div id="attachment_43527" style="width: 600px" class="wp-caption aligncenter"><img class=" wp-image-43527" src="media/e5959a2d.webstresser.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/04/webstresser.png" alt="" width="590" height="309" /><p class="wp-caption-text">Webstresser.org (formerly Webstresser.co), as it appeared in 2017.</p></div>
<p>&#8220;The damage of these attacks is substantial,&#8221; reads a statement from the <strong>Dutch National Police</strong> in <a href="https://www.reddit.com/r/IAmA/comments/8esjr6/we_are_the_dutch_national_police_and_the_public/" target="_blank" rel="noopener">a Reddit thread about the takedown</a>.&#8221;Victims are out of business for a period of time, and spend money on mitigation and on (other) security measures.&#8221;</p>
<p>In <a href="https://www.europol.europa.eu/newsroom/news/world%E2%80%99s-biggest-marketplace-selling-internet-paralysing-ddos-attacks-taken-down" target="_blank" rel="noopener">a separate statement</a> released this morning, <strong>Europol</strong> &#8212; the law enforcement agency of the European Union &#8212; said &#8220;further measures were taken against the top users of this marketplace in the Netherlands, Italy, Spain, Croatia, the United Kingdom, Australia, Canada and Hong Kong.&#8221; The servers powering WebStresser were located in Germany, the Netherlands and the United States, according to Europol.</p>
<p>The U.K.&#8217;s <strong>National Crime Agency</strong> <a href="http://www.nationalcrimeagency.gov.uk/news/1336-international-operation-shuts-down-notorious-cyber-crime-website" target="_blank" rel="noopener">said</a> WebStresser could be rented for as little as $14.99, and that the service allowed people with little or no technical knowledge to launch crippling DDoS attacks around the world.</p>
<p>Neither the Dutch nor U.K. authorities would say who was arrested in connection with this takedown. But according to information obtained by KrebsOnSecurity, the administrator of WebStresser allegedly was a young man in Serbia named <strong>Jovan Mirkovic</strong>.</p>
<p>Mirkovic, who went by the hacker nickname &#8220;<strong>m1rk</strong>,&#8221; also used the alias &#8220;<a href="https://www.facebook.com/Igot2muchSwag69?fref=ts" target="_blank" rel="noopener">Mirkovik Babs</a>&#8221; on Facebook where for years he openly discussed his role in programming and ultimately running WebStresser. The last post on Mirkovic&#8217;s Facebook page, dated April 3 (the day before the takedown), shows the young hacker sipping what appears to be liquor while bathing. Below that image are dozens of comments left in the past few hours, most of them simply, &#8220;RIP.&#8221;</p>
<p><img class="aligncenter wp-image-43526" src="media/eb8c9d5f.mirkovik-rip.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/04/mirkovik-rip.png" alt="" width="597" height="776" /></p>
<p><span id="more-43525"></span>Tuesday&#8217;s action against WebStresser is the latest such takedown to target both owners and customers of booter services. Many booter service operators apparently believe (or at least hide behind) a wordy “terms of service” agreement that all customers must acknowledge, under the assumption that somehow this <a href="https://krebsonsecurity.com/2013/05/ragebooter-legit-ddos-service-or-fed-backdoor/" target="_blank" rel="noopener">absolves them of any sort of liability</a> for how their customers use the service — regardless of how much hand-holding and technical support booter service administrators offer customers.</p>
<p>In October the FBI released <a href="https://www.ic3.gov/media/2017/171017-2.aspx" target="_blank" rel="noopener">an advisory</a> warning that the use of booter services — also called “stressers” — is punishable under the <a href="https://en.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act" target="_blank" rel="noopener">Computer Fraud and Abuse Act</a>, and may result in arrest and criminal prosecution.</p>
<p>In 2016, authorities in Israel <a href="https://krebsonsecurity.com/2016/09/alleged-vdos-proprietors-arrested-in-israel/" target="_blank" rel="noopener">arrested two 18-year-old men</a> accused of running <a href="https://krebsonsecurity.com/?s=vdos&amp;x=0&amp;y=0" target="_blank" rel="noopener">vDOS</a>, until then the most popular and powerful booter service on the market. Their arrests came within hours of <a href="http://krebsonsecurity.com/2016/09/israeli-online-attack-service-vdos-earned-600000-in-two-years/" target="_blank" rel="noopener">a story at KrebsOnSecurity</a> that named the men and detailed how their service had been hacked.</p>
<p>Many in the hacker community have criticized authorities for targeting booter service administrators and users and for not pursuing what they perceive as more serious cybercriminals, noting that the vast majority of both groups are young men under the age of 21. In its Reddit thread, the Dutch Police addressed this criticism head-on, saying Dutch authorities are working on a new legal intervention called &#8220;Hack_Right,&#8221; a diversion program intended for first-time cyber offenders.</p>
<p>&#8220;Prevention of re-offending by offering a combination of restorative justice, training, coaching and positive alternatives is the main aim of this project,&#8221; the Dutch Police wrote. &#8220;See page 24 of the <a href="https://overons.kpn/en/news/2018/kpn-publishes-fifth-european-cyber-security-perspectives" rel="noreferrer" data-ss1524667376="1">5<sup>th</sup> European Cyber Security Perspectives</a> and stay tuned on our <a href="https://twitter.com/politiethtc" rel="noreferrer" data-ss1524667376="1">THTC twitter account</a> #HackRight! AND we are working on a media campaign to prevent youngsters from starting to commit cyber crimes in the first place. Expect a launch soon.&#8221;</p>
<p>In the meantime, it&#8217;s likely we&#8217;ll sooner see the launch of yet another booter service. According to reviews and sales threads at <strong>stresserforums[dot]net</strong> &#8212; a marketplace for booter buyers and sellers &#8212; there are dozens of other booter services in operations, with new ones coming online almost every month.</p>


feed_id: https://krebsonsecurity.com/?p=43561
title: Security Trade-Offs in the New EU Privacy Law
uri: Security-Trade-Offs-in-the-New-EU-Privacy-Law
url: https://krebsonsecurity.com/2018/04/security-trade-offs-in-the-new-eu-privacy-law/
content:
<p>On <a href="https://krebsonsecurity.com/2018/03/who-is-afraid-of-more-spams-and-scams/" target="_blank" rel="noopener">two</a> <a href="https://krebsonsecurity.com/2018/02/new-eu-privacy-law-may-weaken-security/" target="_blank" rel="noopener">occasions</a> this past year I&#8217;ve published stories here warning about the prospect that new European privacy regulations could result in more spams and scams ending up in your inbox. This post explains in a question and answer format some of the reasoning that went into that prediction, and responds to many of the criticisms leveled against it.</p>
<p>Before we get to the Q&amp;A, a bit of background is in order. On May 25, 2018 the <a href="https://gdpr-info.eu/" target="_blank" rel="noopener">General Data Protection Regulation</a> (GDPR) takes effect. The law, enacted by the European Parliament, requires companies to get affirmative consent for any personal information they collect on people within the European Union. Organizations that violate the GDPR could face fines of <em>up to four percent of global annual revenues</em>.</p>
<p><img class="aligncenter wp-image-42559" src="media/03721200.whois.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/02/whois.png" alt="" width="598" height="118" /></p>
<p>In response, the <a href="https://www.icann.org/" target="_blank" rel="noopener">Internet Corporation for Assigned Names and Numbers</a> (ICANN) — the nonprofit entity that manages the global domain name system — has proposed redacting key bits of personal data from WHOIS, the system for querying databases that store the registered users of domain names and blocks of Internet address ranges (IP addresses).</p>
<p>Under current ICANN rules, domain name registrars should collect and display a variety of data points when someone performs a WHOIS lookup on a given domain, such as the registrant’s name, address, email address and phone number. Most registrars offer a privacy protection service that shields this information from public WHOIS lookups; some registrars charge a nominal fee for this service, while others offer it for free.</p>
<p>But in a bid to help registrars comply with the GDPR, ICANN is moving forward on a plan to remove critical data elements from all public WHOIS records. Under the new system, registrars would collect all the same data points about their customers, yet limit how much of that information is made available via public WHOIS lookups.</p>
<p>The data to be redacted includes the name of the person who registered the domain, as well as their phone number, physical address and email address. The new rules would apply to all domain name registrars globally.</p>
<p>ICANN has proposed creating an “accreditation system” that would vet access to personal data in WHOIS records for several groups, including journalists, security researchers, and law enforcement officials, as well as intellectual property rights holders who routinely use WHOIS records to combat piracy and trademark abuse.</p>
<p>But at <a href="https://61.schedule.icann.org/meetings/647709" target="_blank" rel="noopener">an ICANN meeting in San Juan, Puerto Rico</a> last month, ICANN representatives conceded that a proposal for how such a vetting system might work probably would not be ready until December 2018. Assuming ICANN meets that deadline, it could be many months after that before the hundreds of domain registrars around the world take steps to adopt the new measures.</p>
<p>In a series of posts on Twitter, I <a href="https://twitter.com/briankrebs/status/981735118648889345" target="_blank" rel="noopener">predicted</a> that the WHOIS changes coming with GDPR will likely result in a noticeable increase in cybercrime &#8212; particularly in the form of phishing and other types of spam. In response to those tweets, several authors on Wednesday published an article for Georgia Tech&#8217;s <strong>Internet Governance Project</strong> titled, <a href="https://www.internetgovernance.org/2018/04/25/whois-afraid-dark-truth-illusion-lets-know-difference-comes-whois/" target="_blank" rel="noopener">&#8220;WHOIS afraid of the dark? Truth or illusion, let&#8217;s know the difference when it comes to WHOIS.&#8221;</a></p>
<p>The following Q&amp;A is intended to address many of the more misleading claims and assertions made in that article.</p>
<p><strong>Cyber criminals don&#8217;t use their real information in WHOIS registrations, so what&#8217;s the big deal if the data currently available in WHOIS records is no longer in the public domain after May 25?</strong></p>
<p>I can point to <a href="https://krebsonsecurity.com/?s=domaintools&amp;x=0&amp;y=0" target="_blank" rel="noopener">dozens of stories printed here</a> &#8212; and probably hundreds elsewhere &#8212; that clearly demonstrate otherwise. Whether or not cyber crooks do provide their real information is beside the point. ANY information they provide &#8212; and especially information that they re-use across multiple domains and cybercrime campaigns &#8212; is invaluable to both grouping cybercriminal operations and in ultimately identifying who&#8217;s responsible for these activities.</p>
<p>To understand why data reuse in WHOIS records is so common among crooks, put yourself in the shoes of your average scammer or spammer &#8212; someone who has to register dozens or even hundreds or thousands of domains a week to ply their trade. Are you going to create hundreds or thousands of email addresses and fabricate as many personal details to make your WHOIS listings that much harder for researchers to track? The answer is that those who take this extraordinary step are by far and away the exception rather than the rule. Most simply reuse the same email address and phony address/phone/contact information across many domains as long as it remains profitable for them to do so.</p>
<p>This pattern of WHOIS data reuse doesn&#8217;t just extend across a few weeks or months. Very often, if a spammer, phisher or scammer can get away with re-using the same WHOIS details over many years without any deleterious effects to their operations, they will happily do so. Why they may do this is their own business, but nevertheless it makes WHOIS an incredibly powerful tool for tracking threat actors across multiple networks, registrars and Internet epochs.</p>
<p><strong>All domain registrars offer free or a-la-carte privacy protection services that mask the personal information provided by the domain registrant. Most cybercriminals &#8212; unless they are dumb or lazy &#8212; are already taking advantage of these anyway, so it&#8217;s not clear why masking domain registration for everyone is going to change the status quo by much. </strong></p>
<p>It is true that some domain registrants do take advantage of WHOIS privacy services, but based on countless investigations I have conducted using WHOIS to uncover cybercrime businesses and operators, I&#8217;d wager that cybercrooks more often do <em>not</em> use these services. Not infrequently, when they <em>do</em> use WHOIS privacy options there are still gaps in coverage at some point in the domain&#8217;s history (such as when a registrant switches hosting providers) which are indexed by historic WHOIS records and that offer a brief window of visibility into the details behind the registration.</p>
<p>This is demonstrably true <a href="https://twitter.com/ClearskySec/status/984029180789698560" target="_blank" rel="noopener">even for organized cybercrime groups and for nation state actors</a>, and these are arguably some of the most sophisticated and savvy cybercriminals out there.</p>
<p>It&#8217;s worth adding that if so many cybercrooks seem nonchalant about adopting WHOIS privacy services it may well be because they reside in countries where the rule of law is not well-established, or their host country doesn&#8217;t particularly discourage their activities so long as they&#8217;re not violating the golden rule &#8212; namely, targeting people in their own backyard. And so they may not particularly care about covering their tracks. Or in other cases they do care, but nevertheless make mistakes or get sloppy at some point, as most cybercriminals do.</p>
<p><strong>The GDPR does not apply to businesses &#8212; only to individuals &#8212; so there is no reason researchers or anyone else should be unable to find domain registration details for organizations and companies in the WHOIS database after May 25, right?</strong></p>
<p>It is true that the European privacy regulations as they relate to WHOIS records do not apply to businesses registering domain names. However, the domain registrar industry &#8212; which operates on razor-thin profit margins and which has long sought to be free from any WHOIS requirements or accountability whatsoever &#8212; won&#8217;t exactly be tripping over themselves to add more complexity to their WHOIS efforts just to make a distinction between businesses and individuals.</p>
<p>As a result, registrars simply won&#8217;t make that distinction because there is no mandate that they must. They&#8217;ll just adopt the same WHOIS data collection and display polices across the board, regardless of whether the WHOIS details for a given domain suggest that the registrant is a business or an individual.<span id="more-43561"></span></p>
<p><strong>But the GDPR only applies to data collected about people in Europe, so why should this impact WHOIS registration details collected on people who are outside of Europe?</strong></p>
<p>Again, domain registrars are the ones collecting WHOIS data, and they are most unlikely to develop WHOIS record collection and dissemination policies that seek to differentiate between entities covered by GDPR and those that may not be. Such an attempt would be fraught with legal and monetary complications that they simply will not take on voluntarily.</p>
<p>What&#8217;s more, the domain registrar community tends to view the public display of WHOIS data as a nuisance and a cost center. They have mainly only allowed public access to WHOIS data because ICANN&#8217;s contracts state that they should. So, from registrar community&#8217;s point of view, the less information they must make available to the public, the better.</p>
<p><strong>Like it or not, the job of tracking down and bringing cybercriminals to justice falls to law enforcement agencies &#8212; not security researchers. Law enforcement agencies will still have unfettered access to full WHOIS records.</strong></p>
<p>As it relates to inter-state crimes (i.e, the bulk of all Internet abuse), law enforcement &#8212; at least in the United States &#8212; is divided into two main components: The investigative side (i.e., the FBI and Secret Service) and the prosecutorial side (the state and district attorneys who actually initiate court proceedings intended to bring an accused person to justice).</p>
<p>Much of the legwork done to provide the evidence needed to convince prosecutors that there is even a case worth prosecuting is performed by security researchers. The reasons why this is true are too numerous to delve into here, but the safe answer is that law enforcement investigators typically are more motivated to focus on crimes for which they can readily envision someone getting prosecuted &#8212; and because very often their plate is full with far more pressing, immediate and local (physical) crimes.</p>
<p>Admittedly, this is a bit of a blanket statement because in many cases local, state and federal law enforcement agencies <em>will</em> do this often tedious legwork of cybercrime investigations on their own &#8212; provided it involves or impacts someone in their jurisdiction. But due in large part to these jurisdictional issues, politics and the need to build prosecutions around a specific locality when it comes to cybercrime cases, very often law enforcement agencies tend to miss the forest for the trees.</p>
<p><strong>Who cares if security researchers will lose access to WHOIS data, anyway? To borrow an assertion from the Internet Governance article, &#8220;maybe it&#8217;s high time for security researchers and businesses that harvest personal information from WHOIS on an industrial scale to refine and remodel their research methods and business models.&#8221;</strong></p>
<p>This is an alluring argument. After all, the technology and security industries claim to be based on innovation. But consider carefully how anti-virus, anti-spam or firewall technologies currently work. The unfortunate reality is that these technologies are still mostly powered by humans, and those humans rely heavily on access to key details about domain reputation and ownership history.</p>
<p>Those metrics for reputation weigh a host of different qualities, but a huge component of that reputation score is determining whether a given domain or Internet address has been connected to any other previous scams, spams, attacks or other badness. We can argue about whether this is the best way to measure reputation, but it doesn&#8217;t change the prospect that many of these technologies will in all likelihood perform less effectively after WHOIS records start being heavily redacted.</p>
<p><strong>Don&#8217;t advances in artificial intelligence and machine learning obviate the need for researchers to have access to WHOIS data?</strong></p>
<p>This sounds like a nice idea, but again it is far removed from current practice. Ask anyone who regularly uses WHOIS data to determine reputation or to track and block malicious online threats and I&#8217;ll wager you will find the answer is that these analyses are still mostly based on manual lookups and often thankless legwork. Perhaps such trendy technological buzzwords will indeed describe the standard practice of the security industry at some point in the future, but in my experience this does not accurately depict the reality today.</p>
<p><strong>Okay, but Internet addresses are pretty useful tools for determining reputation. The sharing of IP addresses tied to cybercriminal operations isn&#8217;t going to be impacted by the GDPR, is it? </strong></p>
<p>That depends on the organization doing the sharing. I&#8217;ve encountered at least two cases in the past few months wherein European-based security firms have been reluctant to share Internet address information at all in response to the GDPR &#8212; based on a perceived (if not overly legalistic) interpretation that somehow this information also might be considered personally identifying data. This reluctance to share such information out of a concern that doing so might land the sharer in legal hot water can indeed have a chilling effect on the important sharing of threat intelligence across borders.</p>
<p><strong>According to the Internet Governance article, &#8220;If you need to get in touch with a website’s administrator, you will be able to do so in what is a less intrusive manner of achieving this purpose: by using an anonymized email address, or webform, to reach them (The exact implementation will depend on the registry). If this change is inadequate for your &#8216;private detective&#8217; activities and you require full WHOIS records, including the personal information, then you will need to declare to a domain name registry your specific need for and use of this personal information. <a href="https://en.wikipedia.org/wiki/Nominet_UK" target="_blank" rel="noopener">Nominet</a>, for instance<a href="https://www.nominet.uk/response-proposed-changes-uk-policy-arising-gdpr/" rel="noreferrer" data-ss1524770856="1">, has said that interested parties may</a> request the full WHOIS record (including historical data) for a specific domain and get a response within one business day for no charge.”</strong></p>
<p>I&#8217;m sure this will go over tremendously with both the hacked sites used to host phishing and/or malware download pages, as well as those phished by or served with malware in the added time it will take to relay and approve said requests.</p>
<p>According to <a href="media/41e6ea98.Webroot_Quarterly_Threat_Trends_September_2017.pdf" data-original-source="https://www-cdn.webroot.com/8415/0585/3084/Webroot_Quarterly_Threat_Trends_September_2017.pdf" target="_blank" rel="noopener">a Q3 2017 study</a> (PDF) by security firm <strong>Webroot</strong>, the average lifespan of a phishing site is between four and eight hours. How is waiting 24 hours before being able to determine who owns the offending domain going to be helpful to either the hacked site or its victims? It also doesn&#8217;t seem likely that many other registrars will volunteer for this 24-hour turnaround duty &#8212; and indeed no others have publicly demonstrated any willingness to take on this added cost and hassle.</p>
<p><strong>I&#8217;ve heard that ICANN is pushing for a delay in the GDPR as it relates to WHOIS records, to give the registrar community time to come up with an accreditation system that would grant vetted researchers access to WHOIS records. Why isn&#8217;t that a good middle ground?</strong></p>
<p>It might be if ICANN hadn&#8217;t dragged its heels in taking GDPR seriously until perhaps the past few months. As it stands, the experts I&#8217;ve interviewed see little prospect for such a system being ironed out or in gaining necessary traction among the registrar community to accomplish this anytime soon. And most experts I&#8217;ve interviewed predict it is likely that the Internet community will still be debating about how to create such an accreditation system a year from now.</p>
<p>Hence, it&#8217;s not likely that WHOIS records will continue to be anywhere near as useful to researchers in a month or so than they were previously. And this reality will continue for many months to come &#8212; if indeed some kind of vetted WHOIS access system is ever envisioned and put into place.</p>
<p><strong>After I registered a domain name using my real email address, I noticed that address started receiving more spam emails. Won&#8217;t hiding email addresses in WHOIS records reduce the overall amount of spam I can expect when registering a domain under my real email address?</strong></p>
<p>That depends on whether you believe any of the responses to the bolded questions above. Will that address be spammed by people who try to lure you into paying them to register variations on that domain, or to entice you into purchasing low-cost Web hosting services from some random or shady company? Probably. That&#8217;s exactly what happens to almost anyone who registers a domain name that is publicly indexed in WHOIS records.</p>
<p>The real question is whether redacting all email addresses from WHOIS will result in overall more bad stuff entering your inbox and littering the Web, thanks to reputation-based anti-spam and anti-abuse systems failing to work as well as they did before GDPR kicks in.</p>
<p>It&#8217;s worth noting that ICANN created a working group <a href="https://whois.icann.org/en/link/whois-service-source-email-addresses-spammers-sac-023" target="_blank" rel="noopener">to study this exact issue</a>, which noted that &#8220;the appearance of email addresses in response to WHOIS queries is indeed a contributor to the receipt of spam, albeit just one of many.&#8221; However, the report concluded that &#8220;the Committee members involved in the WHOIS study do not believe that the WHOIS service is the dominant source of spam.&#8221;</p>
<p><strong>Do you have something against people not getting spammed, or against better privacy in general? </strong></p>
<p>To the contrary, I have worked the majority of my professional career <a href="https://www.amazon.com/Spam-Nation-Organized-Cybercrime-Epidemic-ebook/dp/B00L5QGBL0/ref=dp_kinw_strp_1" target="_blank" rel="noopener">to expose those who are doing the spamming and scamming</a>. And I can say without hesitation that an overwhelming percentage of that research has been possible thanks to data included in public WHOIS registration records.</p>
<p>Is the current WHOIS system outdated, antiquated and in need of an update? Perhaps. But scrapping the current system without establishing anything in between while laboring under the largely untested belief that in doing so we will achieve some kind of privacy utopia seems myopic.</p>
<p>If opponents of the current WHOIS system are being intellectually honest, they will make the following argument and stick to it: By restricting access to information currently available in the WHOIS system, whatever losses or negative consequences on security we may suffer as a result will be worth the cost in terms of added privacy. That&#8217;s an argument I can respect, if not agree with.</p>
<p>But for the most part that&#8217;s not the refrain I&#8217;m hearing. Instead, what this camp seems to be saying is if you&#8217;re not on board with the WHOIS changes that will be brought about by the GDPR, then there must be something wrong with you, and in any case here a bunch of thinly-sourced reasons why the coming changes might not be that bad.</p>


feed_id: https://krebsonsecurity.com/?p=43590
title: When Your Employees Post Passwords Online
uri: When-Your-Employees-Post-Passwords-Online
url: https://krebsonsecurity.com/2018/05/when-your-employees-post-passwords-online/
content:
<p>Storing passwords in plaintext online is never a good idea, but it&#8217;s remarkable how many companies have employees who are doing just that using online collaboration tools like <strong>Trello.com</strong>. Last week, KrebsOnSecurity notified a host of companies that employees were using Trello to share passwords for sensitive internal resources. Among those put at risk by such activity included an insurance firm, a state government agency and ride-hailing service <strong>Uber</strong>.</p>
<p>By default, Trello boards for both enterprise and personal use are set to either private (requires a password to view the content) or team-visible only (approved members of the collaboration team can view).</p>
<p>But that doesn&#8217;t stop individual Trello users from manually sharing personal boards that include proprietary employer data, information that may be indexed by search engines and available to anyone with a Web browser. And unfortunately for organizations, far too many employees are posting sensitive internal passwords and other resources on their own personal Trello boards that are left open and exposed online.</p>
<div id="attachment_43594" style="width: 609px" class="wp-caption aligncenter"><a class="lightbox" href="media/65c18a76.uber-red.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/04/uber-red.png"><img class="wp-image-43594" src="media/65c18a76.uber-red.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/04/uber-red.png" alt="" width="599" height="318" /></a><p class="wp-caption-text">A personal Trello board created by an Uber employee included passwords that might have exposed sensitive internal company operations.</p></div>
<p>KrebsOnSecurity spent the past week using Google to discover unprotected personal Trello boards that listed employer passwords and other sensitive data. Pictured above was a personal board set up by some Uber developers in the company&#8217;s Asia-Pacific region, which included passwords needed to view a host of internal Google Documents and images.</p>
<p>Uber spokesperson <strong>Melanie Ensign</strong> said the Trello board in question was made private shortly after being notified by this publication, among others. Ensign said Uber found the unauthorized Trello board exposed information related to two users in South America who have since been notified. </p>
<p>&#8220;We had a handful of members in random parts of the world who didn&#8217;t realize they were openly sharing this information,&#8221; Ensign said. &#8220;We&#8217;ve reached out to these teams to remind people that these things need to happen behind internal resources. Employee awareness is an ongoing challenge, We may have dodged a bullet here, and it definitely could have been worse.&#8221;</p>
<p>Ensign said the initial report about the exposed board came through <a href="https://hackerone.com/uber" target="_blank" rel="noopener">the company&#8217;s bug bounty program</a>, and that the person who reported it would receive at least the minimum bounty amount &#8212; $500 &#8212; for reporting the incident (Uber hasn&#8217;t yet decided whether the award should be higher for this incident).</p>
<p>The Uber employees who created the board &#8220;used their work email to open a public board that they weren&#8217;t supposed to,&#8221; Ensign said. &#8220;They didn&#8217;t go through our enterprise account to create that. We first found out about it through our bug bounty program, and while it&#8217;s not technically a vulnerability in our products, it&#8217;s certainly something that we would pay for anyway. In this case, we got multiple reports about the same thing, but we always pay the first report we get.&#8221;</p>
<p>Of course, not every company has a bug bounty program to incentivize the discovery and private reporting of internal resources that may be inadvertently exposed online.</p>
<p>Screenshots that KrebsOnSecurity took of many far more shocking examples of employees posting dozens of passwords for sensitive internal resources are not pictured here because the affected parties still have not responded to alerts provided by this author.<br />
<span id="more-43590"></span></p>
<p>Trello is one of many online collaboration tools made by <a href="https://en.wikipedia.org/wiki/Atlassian" target="_blank" rel="noopener">Atlassian Corporation PLC</a>, a technology company based in Sydney, Australia. Trello co-founder <strong>Michael Pryor</strong> said Trello boards are set to private by default and must be manually changed to public by the user.</p>
<p>&#8220;We strive to make sure public boards are being created intentionally and have built in safeguards to confirm the intention of a user before they make a board publicly visible,&#8221; Pryor said. &#8220;Additionally, visibility settings are displayed persistently on the top of every board.&#8221;</p>
<div id="attachment_43609" style="width: 603px" class="wp-caption aligncenter"><img class=" wp-image-43609" src="media/830360c7.trellovisibility.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/05/trellovisibility.png" alt="" width="593" height="660" /><p class="wp-caption-text">If a board is Team Visible it means any members of that team can view, join, and edit cards. If a board is Private, only members of that specific board can see it. If a board is Public, anyone with the link to the board can see it.</p></div>
<p>Interestingly, <a href="https://trello.com/privacy-updated" target="_blank" rel="noopener">updates made to Trello&#8217;s privacy policy</a> over the past weekend may make it easier for companies to locate personal boards created by employees and pull them behind company resources.</p>
<p>A Trello spokesperson said the privacy changes were made to bring the company&#8217;s policies in line with <a href="https://krebsonsecurity.com/2018/04/security-trade-offs-in-the-new-eu-privacy-law/" target="_blank" rel="noopener">new EU privacy laws</a> that come into enforcement later this month. But they also clarify that Trello&#8217;s enterprise features allow the enterprise admins to control the security and permissions around a work account an employee may have created before the enterprise product was purchased.</p>
<p>Uber spokesperson Ensign called the changes welcome.</p>
<p>&#8220;As a result companies will have more security control over Trello boards created by current/former employees and contractors, so we’re happy to see the change,&#8221; she said.</p>


feed_id: https://krebsonsecurity.com/?p=43628
title: Twitter to All Users: Change Your Password Now!
uri: Twitter-to-All-Users-Change-Your-Password-Now
url: https://krebsonsecurity.com/2018/05/twitter-to-all-users-change-your-password-now/
content:
<p><strong>Twitter</strong> just asked all 300+ million users to reset their passwords, citing the exposure of user passwords via a bug that stored passwords in plain text &#8212; without protecting them with any sort of encryption technology that would mask a Twitter user&#8217;s true password. The social media giant says it has fixed the bug and that so far its investigation hasn&#8217;t turned up any signs of a breach or that anyone misused the information. But if you have a Twitter account, please <a href="https://twitter.com/account/begin_password_reset" target="_blank" rel="noopener">change your account password now</a>.</p>
<p>Or if you don&#8217;t trust links in blogs like this (I get it) go to Twitter.com and change it from there. And then come back and read the rest of this. We&#8217;ll wait.</p>
<p>In a post to its company blog this afternoon, <strong>Twitter CTO Parag Agrawal</strong> wrote:</p>
<p>&#8220;When you set a password for your Twitter account, we use technology that masks it so no one at the company can see it. We recently identified a bug that stored passwords unmasked in an internal log. We have fixed the bug, and our investigation shows no indication of breach or misuse by anyone.</p>
<div id="attachment_43638" style="width: 543px" class="wp-caption aligncenter"><img class="size-full wp-image-43638" src="media/db4c196f.twittersecure.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/05/twittersecure.png" alt="" width="533" height="457" /><p class="wp-caption-text">A message posted this afternoon (and still present as a pop-up) warns all users to change their passwords.</p></div>
<p>&#8220;Out of an abundance of caution, we ask that you consider changing your password on all services where you’ve used this password. You can change your Twitter password anytime by going to the password settings page.&#8221;<span id="more-43628"></span></p>
<p>Agrawal explains that Twitter normally masks user passwords through a state-of-the-art encryption technology called &#8220;<a href="https://en.wikipedia.org/wiki/Bcrypt" target="_blank" rel="noopener">bcrypt</a>,&#8221; which replaces the user&#8217;s password with a random set of numbers and letters that are stored in Twitter&#8217;s system.</p>
<p>&#8220;This allows our systems to validate your account credentials without revealing your password,&#8221; said Agrawal, who says the technology they&#8217;re using to mask user passwords is the industry standard.</p>
<p>&#8220;Due to a bug, passwords were written to an internal log before completing the hashing process,&#8221; he continued. &#8220;We found this error ourselves, removed the passwords, and are implementing plans to prevent this bug from happening again.&#8221;</p>
<p>Agrawal wrote that while Twitter has no reason to believe password information ever left Twitter&#8217;s systems or was misused by anyone, the company is still urging all Twitter users to reset their passwords NOW.</p>
<div id="attachment_43630" style="width: 587px" class="wp-caption aligncenter"><a class="lightbox" href="media/6e2b7315.twitterpasswordmessage.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/05/twitterpasswordmessage.png"><img class="wp-image-43630" src="media/6e2b7315.twitterpasswordmessage.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/05/twitterpasswordmessage.png" alt="" width="577" height="541" /></a><p class="wp-caption-text">A letter to all Twitter users posted by <strong>Twitter CTO</strong> <strong>Parag Agrawal</strong></p></div>
<p>Twitter advises:<br />
<strong>-Change your password on Twitter and on any other service where you may have used the same password.</strong><br />
<strong> -Use a strong password that you don’t reuse on other websites.</strong><br />
<strong> &#8211;<a href="https://help.twitter.com/en/managing-your-account/two-factor-authentication" target="_blank" rel="noopener">Enable login verification</a>, also known as two factor authentication. This is the single best action you can take to increase your account security.</strong><br />
<strong> -Use a password manager to make sure you’re using strong, unique passwords everywhere.</strong></p>
<p>This may be much ado about nothing disclosed out of an abundance of caution, or further investigation may reveal different findings. It doesn&#8217;t matter for right now: If you&#8217;re a Twitter user and if you didn&#8217;t take my advice to go change your password yet, go do it now! That is, if you can.</p>
<p>Twitter.com seems responsive now, but some period of time Thursday afternoon Twitter had problems displaying many Twitter profiles, or even its homepage. Just a few moments ago, I tried to visit the Twitter CTO&#8217;s profile page and got this (ditto for Twitter.com):</p>
<div id="attachment_43629" style="width: 602px" class="wp-caption aligncenter"><a class="lightbox" href="media/24ea046a.twitterdown.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/05/twitterdown.png"><img class="wp-image-43629" src="media/24ea046a.twitterdown.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/05/twitterdown.png" alt="" width="592" height="470" /></a><p class="wp-caption-text">What KrebsOnSecurity and other Twitter users got when we tried to visit twitter.com and the Twitter CTO&#8217;s profile page late in the afternoon ET on May 3, 2018.</p></div>
<p>If for some reason you can&#8217;t reach Twitter.com, try again soon. Put it on your to-do list or calendar for an hour from now. Seriously, do it now or very soon.</p>
<p>And please don&#8217;t use a password that you have used for any other account you use online, <a href="https://krebsonsecurity.com/2018/01/canadian-police-charge-operator-of-hacked-password-service-leakedsource-com/" target="_blank" rel="noopener">either in the past</a> or in the present. A non-comprehensive list (note to self) of some password tips <a href="https://krebsonsecurity.com/password-dos-and-donts/" target="_blank" rel="noopener">are here</a>.</p>
<p>I have sent some more specific questions about this incident in to Twitter. More updates as available.</p>
<p><strong>Update, 8:04 p.m. ET:</strong> Went to reset my password at Twitter and it said my new password was strong, but when I submitted it I was led to a dead page. But after logging in again at twitter.com the new password worked (and the old didn&#8217;t anymore). Then it prompted me to enter one-time code from app (you do have <a href="https://help.twitter.com/en/managing-your-account/two-factor-authentication" target="_blank" rel="noopener">2-factor set up on Twitter</a>, right?) Password successfully changed!</p>


feed_id: https://krebsonsecurity.com/?p=43666
title: Study: Attack on KrebsOnSecurity Cost IoT Device Owners $323K
uri: Study-Attack-on-KrebsOnSecurity-Cost-IoT-Device-Owners-323K
url: https://krebsonsecurity.com/2018/05/study-attack-on-krebsonsecurity-cost-iot-device-owners-323k/
content:
<p>A <a href="https://krebsonsecurity.com/2016/09/krebsonsecurity-hit-with-record-ddos/" target="_blank" rel="noopener">monster distributed denial-of-service attack</a> (DDoS) against KrebsOnSecurity.com in 2016 <a href="https://krebsonsecurity.com/2016/09/the-democratization-of-censorship/" target="_blank" rel="noopener">knocked this site offline for nearly four days</a>. The attack was executed through a network of hacked &#8220;Internet of Things&#8221; (IoT) devices such as Internet routers, security cameras and digital video recorders. A new study that tries to measure the direct cost of that one attack for IoT device users whose machines were swept up in the assault found that it may have cost device owners a total of $323,973.75 in excess power and added bandwidth consumption.</p>
<p>My bad.</p>
<p>But really, none of it was my fault at all. It was mostly the fault of IoT makers for shipping cheap, poorly designed products (insecure by default), and the fault of customers who bought these IoT things and plugged them onto the Internet without changing the things&#8217; factory settings (passwords at least.)</p>
<p><img class="aligncenter size-full wp-image-43692" src="media/1ea7fa53.ddo.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/05/ddo.png" alt="" width="379" height="123" /></p>
<p>The botnet that hit my site in Sept. 2016 was powered by the first version of <a href="https://krebsonsecurity.com/?s=mirai&amp;x=0&amp;y=0" target="_blank" rel="noopener">Mirai</a>, a malware strain that wriggles into dozens of IoT devices left exposed to the Internet and running with factory-default settings and passwords. Systems infected with Mirai are forced to scan the Internet for other vulnerable IoT devices, but they&#8217;re just as often used to help launch punishing DDoS attacks.</p>
<p>By the time of the first Mirai attack on this site, the young masterminds behind Mirai <em>had already enslaved more than 600,000 IoT devices for their DDoS armies</em>. But according to <a href="https://krebsonsecurity.com/2017/01/who-is-anna-senpai-the-mirai-worm-author/" target="_blank" rel="noopener">an interview with one of the admitted</a> and <a href="https://krebsonsecurity.com/2017/12/mirai-iot-botnet-co-authors-plead-guilty/" target="_blank" rel="noopener">convicted co-authors</a> of Mirai, the part of their botnet that pounded my site was a mere slice of firepower they&#8217;d sold for a few hundred bucks to a willing buyer. The attack army sold to this ne&#8217;er-do-well harnessed the power of just 24,000 Mirai-infected systems (mostly security cameras and DVRs, but some routers, too).</p>
<p>These 24,000 Mirai devices clobbered my site for several days with data blasts of up to 620 Gbps. The attack was so bad that my pro-bono DDoS protection provider at the time &#8212; <strong>Akamai</strong> &#8212; had to let me go because <a href="https://krebsonsecurity.com/2016/11/akamai-on-the-record-krebsonsecurity-attack/" target="_blank" rel="noopener">the data firehose pointed at my site</a> was starting to cause real pain for their paying customers. Akamai later estimated that the cost of maintaining protection against my site in the face of that onslaught would have run into the millions of dollars.</p>
<p>We&#8217;re getting better at figuring out the financial costs of DDoS attacks to the victims (5, 6 or 7 -digit dollar losses) and to the perpetrators (zero to hundreds of dollars). According to <a href="https://www.businesswire.com/news/home/20180123005628/en" target="_blank" rel="noopener">a report</a> released this year by DDoS mitigation giant <strong>NETSCOUT Arbor</strong>, fifty-six percent of organizations last year experienced a financial impact from DDoS attacks for between $10,000 and $100,000, almost double the proportion from 2016.</p>
<p>But what if there were also a way to work out the cost of these attacks to the users of the IoT devices which get snared by DDos botnets like Mirai? That&#8217;s what researchers at <a href="https://www.berkeley.edu/" target="_blank" rel="noopener">University of California, Berkeley</a> <a href="https://www.ischool.berkeley.edu/" target="_blank" rel="noopener">School of Information</a> sought to determine in their new paper, &#8220;<a href="https://groups.ischool.berkeley.edu/riot/" target="_blank" rel="noopener">rIoT: Quantifying Consumer Costs of Insecure Internet of Things Devices.</a>&#8221;</p>
<p>If we accept the UC Berkeley team&#8217;s assumptions about costs borne by hacked IoT device users (more on that in a bit), the total cost of added bandwidth and energy consumption from the botnet that hit my site came to $323,973.95. This may sound like a lot of money, but remember that broken down among 24,000 attacking drones the per-device cost comes to just $13.50.</p>
<p>So let&#8217;s review: The attacker who wanted to clobber my site paid a few hundred dollars to rent a tiny portion of a much bigger Mirai crime machine. That attack would likely have cost millions of dollars to mitigate. The consumers in possession of the IoT devices that did the attacking probably realized a few dollars in losses each, if that. Perhaps forever unmeasured are the many Web sites and Internet users whose connection speeds are often collateral damage in DDoS attacks.</p>
<div id="attachment_43688" style="width: 609px" class="wp-caption aligncenter"><a class="lightbox" href="media/d67c657d.ddosexternalities.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/05/ddosexternalities.png"><img class="wp-image-43688" src="media/d67c657d.ddosexternalities.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/05/ddosexternalities.png" alt="" width="599" height="360" /></a><p class="wp-caption-text">Image: UC Berkeley.</p></div>
<p><span id="more-43666"></span>Anyone noticing a slight asymmetry here in either costs or incentives? IoT security is what&#8217;s known as an &#8220;<a href="https://www.economicshelp.org/micro-economic-essays/marketfailure/negative-externality/" target="_blank" rel="noopener">externality</a>,&#8221; a term used to describe &#8220;positive or negative consequences to third parties that result from an economic transaction. When one party does not bear the full costs of its actions, it has inadequate incentives to avoid actions that incur those costs.&#8221;</p>
<p>In many cases negative externalities are synonymous with problems that the free market has a hard time rewarding individuals or companies for fixing or ameliorating, much like environmental pollution. The common theme with externalities is that the pain points to fix the problem are so diffuse and the costs borne by the problem so distributed across international borders that doing something meaningful about it often takes a global effort with many stakeholders &#8212; who can hopefully settle upon concrete steps for action and metrics to measure success.</p>
<p>The paper&#8217;s authors explain the misaligned incentives on two sides of the IoT security problem:</p>
<blockquote><p>-&#8220;On the manufacturer side, many devices run lightweight Linux-based operating systems that open doors for hackers. Some consumer IoT devices implement minimal security. For example, device manufacturers may use default username and password credentials to access the device. Such design decisions simplify device setup and troubleshooting, but they also leave the device open to exploitation by hackers with access to the publicly-available or guessable credentials.&#8221;</p>
<p>-&#8220;Consumers who expect IoT devices to act like user-friendly &#8216;plug-and-play&#8217; conveniences may have sufficient intuition to use the device but insufficient technical knowledge to protect or update it. Externalities may arise out of information asymmetries caused by hidden information or misaligned incentives. Hidden information occurs when consumers cannot discern product characteristics and, thus, are unable to purchase products that reflect their preferences. When consumers are unable to observe the security qualities of software, they instead purchase products based solely on price, and the overall quality of software in the market suffers.&#8221;</p></blockquote>
<p>The UK Berkeley researchers concede that their experiments &#8212; in which they measured the power output and bandwidth consumption of various IoT devices they&#8217;d infected with a <a href="https://www.techopedia.com/definition/25266/sandboxing" target="_blank" rel="noopener">sandboxed</a> version of Mirai &#8212; suggested that the scanning and DDoSsing activity prompted by a Mirai malware infection added almost negligible amounts in power consumption for the infected devices.</p>
<p>Thus, most of the loss figures cited for the 2016 attack rely heavily on estimates of how much the excess bandwidth created by a Mirai infection might cost users directly, and as such I suspect the $13.50 per machine estimates are on the high side.</p>
<p>No doubt, some Internet users get online via an Internet service provider that includes a daily &#8220;bandwidth cap,&#8221; such that over-use of the allotted daily bandwidth amount can incur overage fees and/or relegates the customer to a slower, throttled connection for some period after the daily allotted bandwidth overage.</p>
<p>But for a majority of high-speed Internet users, the added bandwidth use from a router or other IoT device on the network being infected with Mirai probably wouldn&#8217;t show up as an added line charge on their monthly bills. I asked the researchers about the considerable wiggle factor here:</p>
<p>&#8220;Regarding bandwidth consumption, the cost may not ever show up on a consumer&#8217;s bill, especially if the consumer has no bandwidth cap,&#8221; reads an email from the UC Berkeley researchers who wrote the report, including <strong>Kim Fong</strong>, <strong>Kurt Hepler</strong>, <strong>Rohit Raghavan</strong> and <strong>Peter Rowland</strong>.</p>
<p>&#8220;We debated a lot on how to best determine and present bandwidth costs, as it does vary widely among users and ISPs,&#8221; they continued. &#8220;Costs are more defined in cases where bots cause users to exceed their monthly cap. But even if a consumer doesn&#8217;t directly pay a few extra dollars at the end of the month, the infected device is consuming actual bandwidth that must be supplied/serviced by the ISP. And it&#8217;s not unreasonable to assume that ISPs will eventually pass their increased costs onto consumers as higher monthly fees, etc. It&#8217;s difficult to quantify the consumer-side costs of unauthorized use &#8212; which is likely why there&#8217;s not much existing work &#8212; and our stats are definitely an estimate, but we feel it&#8217;s helpful in starting the discussion on how to quantify these costs.&#8221;</p>
<p><img class="aligncenter size-full wp-image-40170" src="media/a8923b63.iotc.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2017/08/iotc.png" alt="" width="569" height="395" /></p>
<p>Measuring bandwidth and energy consumption may turn out to be a useful and accepted tool to help more accurately measure the full costs of DDoS attacks. I&#8217;d love to see these tests run against a broader range of IoT devices in a much larger simulated environment.</p>
<p>If the Berkeley method is refined enough to become accepted as one of many ways to measure actual losses from a DDoS attack, the reporting of such figures could make these crimes more likely to be prosecuted.</p>
<p>Many DDoS attack investigations go nowhere because targets of these attacks fail to come forward or press charges, making it difficult for prosecutors to prove any real economic harm was done. Since many of these investigations die on the vine for a lack of financial damages reaching certain law enforcement thresholds to justify a federal prosecution (often $50,000 &#8211; $100,000), factoring in estimates of the cost to hacked machine owners involved in each attack could change that math.</p>
<p>But the biggest levers for throttling the DDoS problem are in the hands of the people running the world&#8217;s largest ISPs, hosting providers and bandwidth peering points on the Internet today. Some of those levers I detailed in the &#8220;<strong>Shaming the Spoofers</strong>&#8221; section of <a href="https://krebsonsecurity.com/2016/09/the-democratization-of-censorship/" target="_blank" rel="noopener">The Democraticization of Censorship</a>, the first post I wrote after the attack and after Google had <a href="https://krebsonsecurity.com/2017/02/how-google-took-on-mirai-krebsonsecurity/" target="_blank" rel="noopener">brought this site back online</a> under its <a href="https://projectshield.withgoogle.com/public/" target="_blank" rel="noopener">Project Shield</a> program.</p>
<p>By the way, we should probably stop referring to IoT devices as &#8220;smart&#8221; when they start misbehaving within three minutes of being plugged into an Internet connection. That&#8217;s about how long your average cheapo, factory-default security camera plugged into the Internet has before getting successfully taken over by Mirai. <span class="pullquote pqright">In short, dumb IoT devices are those that don&#8217;t make it easy for owners to use them safely without being a nuisance or harm to themselves or others.</span></p>
<p>Maybe what we need to fight this onslaught of dumb devices are more network operators turning to ideas like <a href="https://arxiv.org/abs/1712.03623v1" target="_blank" rel="noopener">IDIoT</a>, a network policy enforcement architecture for consumer IoT devices that was first proposed in December 2017.  The goal of IDIoT is to restrict the network capabilities of IoT devices to only what is essential for regular device operation. For example, it might be okay for network cameras to upload a video file somewhere, but it&#8217;s definitely not okay for that camera to then go scanning the Web for other cameras to infect and enlist in DDoS attacks.</p>
<p>So what does all this mean to you? That depends on how many IoT things you and your family and friends are plugging into the Internet and your/their level of knowledge about how to secure and maintain these devices. <a href="https://krebsonsecurity.com/2018/01/some-basic-rules-for-securing-your-iot-stuff/" target="_blank" rel="noopener">Here’s a primer</a> on minimizing the chances that your orbit of IoT things become a security liability for you or for the Internet at large.</p>


feed_id: https://krebsonsecurity.com/?p=43750
title: Microsoft Patch Tuesday, May 2018 Edition
uri: Microsoft-Patch-Tuesday-May-2018-Edition
url: https://krebsonsecurity.com/2018/05/microsoft-patch-tuesday-may-2018-edition/
content:
<p><strong>Microsoft</strong> today released a bundle of security updates to fix at least 67 holes in its various <strong>Windows</strong> operating systems and related software, including one dangerous flaw that Microsoft warns is actively being exploited. Meanwhile, as it usually does on Microsoft&#8217;s Patch Tuesday &#8212; the second Tuesday of each month &#8212; <strong>Adobe</strong> has a new <strong>Flash Player</strong> update that addresses a single but critical security weakness.</p>
<p><img class="alignright size-full wp-image-18875" src="media/18bb50f1.brokenflash-a.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2013/02/brokenflash-a.png" alt="" width="211" height="180" />First, the <a href="https://helpx.adobe.com/security/products/flash-player/apsb18-16.html" target="_blank" rel="noopener">Flash Tuesday update</a>, which brings Flash Player to v. <em>29.0.0.171</em>. Some (present company included) would argue that Flash Player is itself &#8220;a single but critical security weakness.&#8221; Nevertheless, <strong>Google Chrome</strong> and <strong>Internet Explorer/Edge</strong> ship with their own versions of Flash, which get updated automatically when new versions of these browsers are made available.</p>
<p>You can check if your browser has Flash installed/enabled and what version it&#8217;s at by pointing your browser at <a href="https://helpx.adobe.com/flash-player.html" target="_blank" rel="noopener">this link</a>. Adobe is <a href="https://krebsonsecurity.com/2017/08/flash-player-is-dead-long-live-flash-player/" target="_blank" rel="noopener">phasing out Flash entirely by 2020</a>, but most of the major browsers already take steps to hobble Flash. And with good reason: It’s a major security liability.<span id="more-43750"></span></p>
<p>Google Chrome blocks Flash from running on all but a handful of popular sites, and then only after user approval. Disabling Flash in Chrome is simple enough. Paste “<a href="chrome://settings/content" target="_blank" rel="noopener">chrome://settings/content</a>” into a Chrome browser bar and then select “Flash” from the list of items. By default it should be set to “Ask first” before running Flash, although users also can disable Flash entirely here or whitelist/blacklist specific sites. If you spot an upward pointing arrow to the right of the address bar in Chrome, that means there&#8217;s an update to the browser available, and it&#8217;s time to restart Chrome.</p>
<p><img class="alignleft wp-image-26837" src="media/863df0f6.brokenwindows.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2014/07/brokenwindows.png" alt="" width="204" height="214" />For Windows users with <strong>Mozilla Firefox</strong> installed, the browser prompts users to enable Flash on a per-site basis.</p>
<p>Through the end of 2017 and into 2018, Microsoft Edge will continue to ask users for permission to run Flash on most sites the first time the site is visited, and will remember the user’s preference on subsequent visits. Microsoft users will need to install this month&#8217;s batch of patches to get the latest Flash version for IE/Edge, where most of the critical updates in this month&#8217;s patch batch reside.</p>
<p>According to security vendor <a href="https://blog.qualys.com/laws-of-vulnerabilities/2018/05/08/may-2018-patch-tuesday-medium-weight-but-one-active-exploit-needs-attention#more-24616" target="_blank" rel="noopener">Qualys</a>, one Microsoft patch in particular deserves priority over others in organizations that are testing updates before deploying them: <strong>CVE-2018-8174</strong> involves a problem with the way the Windows scripting engine handles certain objects, and Microsoft says this bug is already being exploited in active attacks.</p>
<p>Some other useful sources of information on today&#8217;s updates include the <a href="https://www.thezdi.com/blog/2018/5/8/the-may-2018-security-update-review" target="_blank" rel="noopener">Zero Day Initiative</a> and <a href="https://www.bleepingcomputer.com/news/microsoft/microsoft-may-2018-patch-tuesday-fixes-67-security-issues-including-ie-zero-day/" target="_blank" rel="noopener">Bleeping Computer</a>. And of course there is always the <a href="https://portal.msrc.microsoft.com/en-us/security-guidance" target="_blank" rel="noopener">Microsoft Security Update Guide</a>.</p>
<p>As always, please feel free to leave a comment below if you experience any issues applying any of these updates.</p>


feed_id: https://krebsonsecurity.com/?p=43713
title: Think You’ve Got Your Credit Freezes Covered? Think Again.
uri: Think-You-ve-Got-Your-Credit-Freezes-Covered-Think-Again
url: https://krebsonsecurity.com/2018/05/another-credit-freeze-target-nctue-com/
content:
<p>I spent a few days last week speaking at and attending a conference on responding to identity theft. The forum was held in Florida, one of the major epicenters for identity fraud complaints in United States. One gripe I heard from several presenters was that identity thieves increasingly are finding ways to open new lines of credit for things like mobile phones on people who have already frozen their credit files with the big-three credit bureaus. Here&#8217;s a look at what may be going on, and how you can protect yourself.</p>
<p><strong>Carrie Kerskie</strong> is director of the <a href="https://www.hodges.edu/identity/" target="_blank" rel="noopener">Identity Fraud Institute</a> at <a href="https://en.wikipedia.org/wiki/Hodges_University" target="_blank" rel="noopener">Hodges University</a> in Naples, and a big part of her job is helping local residents respond to identity theft and identity fraud complaints. Kerskie said she&#8217;s had multiple victims in her area recently complain of having cell phone accounts opened in their names even though they had already frozen their credit files at the big three credit bureaus &#8212; <strong>Equifax</strong>, <strong>Experian</strong> and <strong>Trans Union</strong> (as well as distant fourth bureau <strong>Innovis</strong>).</p>
<p>The freeze process is designed so that creditor should not be able to pull a copy of your report unless you unfreeze the account. A credit freeze blocks potential creditors from being able to view or “pull” your credit file, making it far more difficult for identity thieves to apply for new lines of credit in your name.</p>
<p>A freeze works to protect one&#8217;s credit file only if a potential creditor (or ID thief) tries to open a new line of credit at a company that uses one of the big three bureaus or Innovis. But Kerskie&#8217;s investigation revealed that the mobile phone merchants weren&#8217;t asking any of those four credit bureaus. Rather, the mobile providers that dinged the credit of Kerskie&#8217;s clients instead were making consumer credit queries with the <strong>National Consumer Telecommunications and Utilities Exchange</strong> (NCTUE), or <a href="http://www.nctue.com/" target="_blank" rel="noopener">nctue.com</a>.</p>
<div id="attachment_43721" style="width: 608px" class="wp-caption aligncenter"><img class=" wp-image-43721" src="media/7fe75b94.nctue.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/05/nctue.png" alt="" width="598" height="270" /><p class="wp-caption-text">Source: nctue.com</p></div>
<p>&#8220;We&#8217;re finding that a lot of phone carriers &#8212; even some of the larger ones &#8212; are relying on NCTUE for credit checks,&#8221; Kerskie said. &#8220;Phone carriers, utilities, power, water, cable, any of those. They&#8217;re all starting to use this more.&#8221;</p>
<p>The NCTUE is a consumer reporting agency founded by mobile provider <strong>AT&amp;T</strong> in 1997 that maintains data such as payment and account history, reported by telecommunication, pay TV and utility service providers that are members of NCTUE.</p>
<p>Who are the NCTUE&#8217;s members? If you call the 800-number that NCTUE makes available to get a free copy of your NCTUE credit report, the option for &#8220;more information&#8221; about the organization says there are four &#8220;exchanges&#8221; that feed into the NCTUE&#8217;s system: the NCTUE itself; something called &#8220;<strong>Centralized Credit Check Systems</strong>&#8220;; the <strong>New York Data Exchange</strong>; and the <strong>California Utility Exchange</strong>.</p>
<p>According to a <a href="https://www22.verizon.com/wholesale/local/billing/content/access-to-customer-credit-info-for-verizon-north-west.html" target="_blank" rel="noopener">partner solutions page at <strong>Verizon</strong>,</a> the New York Data Exchange is a not-for-profit created in 1996 that provides participating local exchange carriers with access to local telecommunications service arrears (accounts that are unpaid) and final account information on residential end user accounts. The NYDE is operated by <strong>Equifax Credit Information Services Inc. </strong>(yes, <a href="https://krebsonsecurity.com/2017/09/the-equifax-breach-what-you-should-know/" target="_blank" rel="noopener"><em>that</em> Equifax</a>). Verizon is one of many telecom providers that use the NYDE (and recall that AT&amp;T was the founder of NCTUE).</p>
<p>The California Utility Exchange collects customer payment data from dozens of local utilities in the state, and also is operated by Equifax (<strong>Equifax Information Services LLC</strong>).</p>
<p>Google has virtually no useful information available about an entity called Centralized Credit Check Systems. If anyone finds differently, please leave a note in the comments section.</p>
<p>When I did some more digging on the NCTUE, I discovered&#8230;wait for it&#8230;Equifax <em>also is the sole contractor that manages the NCTUE database.</em> The entity&#8217;s site is also hosted out of Equifax&#8217;s servers. Equifax&#8217;s current contract to provide this service expires in 2020, according to <a href="https://www.prnewswire.com/news-releases/equifax-and-nctue-expand-services-agreement-through-2020-300164903.html" target="_blank" rel="noopener">a press release</a> posted in 2015 by Equifax.</p>
<p><img class="alignright size-full wp-image-40756" src="media/1e5fd68d.equihax.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2017/09/equihax.png" alt="" width="249" height="232" /></p>
<h4>RED LIGHT. GREEN LIGHT. RED LIGHT.</h4>
<p>Fortunately, the NCTUE makes it fairly easy to obtain any records they may have on you. Simply phone them up  at 1-866-349-5185 and provide your Social Security number and the numeric portion of your registered street address.</p>
<p>Assuming it can verify you with that information, the system then orders a credit report to be sent to the address on file. You can also request to be sent a free &#8220;risk score&#8221; assigned by the NCTUE for each credit file it maintains.</p>
<p>The NCTUE also offers a free online process for freezing one&#8217;s report. Perhaps unsurprisingly, however, the process for ordering a freeze through the NCTUE appears to be completely borked at the moment, thanks no doubt to Equifax&#8217;s well documented abysmal security practices.</p>
<p>Or it could all be part of a willful and negligent strategy to continue discouraging Americans from freezing their credit files.</p>
<p>On April 29, I had an occasion to visit Equifax&#8217;s credit freeze application page, and found that the site was being served with an expired SSL encryption certificate from <strong>Symantec</strong>. This happened because I browsed the site using Google Chrome, and <a href="https://www.zdnet.com/article/google-reveals-plan-to-distrust-symantec-certificates-in-2018/" target="_blank" rel="noopener">Google announced a decision in September 2017 to no longer trust SSL certs issued by Symantec prior to June 1, 2016</a>. Google said it would do this starting with Google Chrome version 66. It did not keep this plan a secret.</p>
<p>On April 18, Google pushed out Chrome 66. Despite all of the advance warnings, the security people at Equifax apparently missed the memo and in so doing probably scared most people away from its freeze page for several weeks (Equifax fixed the problem on its site sometime after <a href="https://twitter.com/briankrebs/status/990648659707682817" target="_blank" rel="noopener">I tweeted about the borked certificate on April 29</a>). That&#8217;s because when one uses Chrome to visit a site whose encryption certificate is validated by one of these unsupported Symantec certs, Chrome puts up a dire security warning that would almost certainly discourage most casual users from continuing.</p>
<div id="attachment_43717" style="width: 609px" class="wp-caption aligncenter"><img class=" wp-image-43717" src="media/b5ebc10a.equifaxsecure-not.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/05/equifaxsecure-not.png" alt="" width="599" height="326" /><p class="wp-caption-text">The insecurity around Equifax&#8217;s own freeze site likely discouraged people from requesting a freeze on their credit files.</p></div>
<p>On May 7, when I visited the NCTUE&#8217;s page for freezing my credit file with them I was presented with the very same connection SSL security alert from Chrome, warning that any data I share with the NCTUE&#8217;s freeze page might not be encrypted in transit.</p>
<div id="attachment_43718" style="width: 609px" class="wp-caption aligncenter"><img class=" wp-image-43718" src="media/5159645a.exchangeservicecentercert.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/05/exchangeservicecentercert.png" alt="" width="599" height="394" /><p class="wp-caption-text">The security alert generated by Chrome when visiting the freeze page for the NCTUE, whose database (and apparently web site) also is run by Equifax.</p></div>
<p>When I clicked through past the warnings and proceeded to the insecure NCTUE freeze form (which is worded and stylized almost <em>exactly</em> like Equifax&#8217;s credit freeze page and is hosted on Equifax&#8217;s own servers), I filled out the required information to freeze my NCTUE file. No dice. I was unceremoniously declined the opportunity to do that. &#8220;We are currently unable to service your request,&#8221; read the resulting Web page, without suggesting alternative means of obtaining its report. &#8220;Please try again later.&#8221;</p>
<div id="attachment_43719" style="width: 605px" class="wp-caption aligncenter"><img class=" wp-image-43719" src="media/014ca98e.freezeunable.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/05/freezeunable.png" alt="" width="595" height="208" /><p class="wp-caption-text">The message I received after trying to freeze my file with the NCTUE.</p></div>
<p>This scenario will no doubt be familiar to many readers who tried (and failed in a similar fashion) to file freezes on their credit files with Equifax after the company divulged that hackers had relieved it of Social Security numbers, addresses, dates of birth and other sensitive data on nearly 150 million Americans last September. I attempted to file a freeze via the NCTUE&#8217;s site with no fewer than three different browsers, and each time the form reset itself upon submission or took me to a failure page.</p>
<p>So let&#8217;s review. Many people who have succeeded in freezing their credit files with Equifax have nonetheless had their identities stolen and new accounts opened in their names thanks to a lesser-known credit bureau that seems to rely entirely on credit checking entites operated by Equifax.</p>
<p>&#8220;This just reinforces the fact that we are no longer in control of our information,&#8221; said Kerskie, who is also a founding member of <a href="https://www.griffonforce.com" target="_blank" rel="noopener">Griffon Force</a>, a Florida-based identity theft restoration firm.</p>
<p>I find it difficult to disagree with Kerskie&#8217;s statement. What chaps me about this discovery is that countless Americans are in many cases plunking down $2-$10 per bureau to freeze their credit files, and yet a huge player in this market is able to continue to profit off of identity theft on those same Americans.</p>
<h4>EQUIFAX RESPONDS</h4>
<p>I reached out to Equifax to understand why the credit bureau operating the NCTUE&#8217;s data exchange (and those of at least two other contributing members) couldn&#8217;t detect when consumers had placed credit freezes with Equifax. As you might imagine, Equifax responded that NCTUE is separate entity from Equifax. It also said NCTUE doesn&#8217;t include Equifax credit information.</p>
<p>Here is Equifax&#8217;s full statement on the matter:</p>
<p class="m_-4813359322738933510MsoListParagraph">·        <u></u><i>The National Consumer Telecom and Utilities Exchange, Inc. (NCTUE) is a nationwide, member-owned and operated, FCRA-compliant consumer reporting agency that houses both positive and negative consumer payment data reported by its members, such as new connect requests, payment history, and historical account status and/or fraudulent accounts.  NCTUE members are providers of telecommunications and pay/satellite television services to consumers, as well as utilities providing gas, electrical and water services to consumers. <u></u><u></u></i></p>
<p class="m_-4813359322738933510MsoListParagraph"><u></u>·        <u></u><i>This information is available to NCTUE members and, on a limited basis, to certain other customers of NCTUE&#8217;s contracted exchange operator, Equifax Information Services, LLC (Equifax) – typically financial institutions and insurance providers.  NCTUE does not include Equifax credit information, and Equifax is not a member of NCTUE, nor does Equifax own any aspect of NCTUE.  NCTUE does not provide telecommunications pay/ satellite television or utility services to consumers, and consumers do not apply for those services with NCTUE.<u></u><u></u></i></p>
<p class="m_-4813359322738933510MsoListParagraph"><u></u>·        <u></u><i>As a consumer reporting agency, NCTUE places and lifts security freezes on consumer files in accordance with the state law applicable to the consumer.  NCTUE also maintains a voluntary security freeze program for consumers who live in states which currently do not have a security freeze law. <u></u><u></u></i></p>
<p class="m_-4813359322738933510MsoListParagraph"><u></u>·        <u></u><i>NCTUE is a separate consumer reporting agency from Equifax and therefore a consumer would need to independently place and lift a freeze with NCTUE.<u></u><u></u></i></p>
<p class="m_-4813359322738933510MsoListParagraph"><u></u>·        <u></u><i>While state laws vary in the manner in which consumers can place or lift a security freeze (temporarily or permanently), if a consumer has a security freeze on his or her NCTUE file and has not temporarily lifted the freeze, a creditor or other service provider, such as a mobile phone provider, generally cannot access that consumer’s NCTUE report in connection with a new account opening.  However, the creditor or provider may be able to access that consumer’s credit report from another consumer reporting agency in order to open a new account, or decide to open the account without accessing a credit report from any consumer reporting agency, such as NCTUE or Equifax. </i></p>
<p>PLACING THE FREEZE</p>
<p>I was finally able to successfully place a freeze on my NCTUE report by calling their 800-number &#8212; 1-866-349-5355. The message said the NCTUE might charge a fee for placing or lifting the freeze, in accordance with state freeze laws.</p>
<p>Depending on your state of residence, the cost of placing a freeze on your credit file at Equifax, Experian or Trans Union can run between $3 and $10 per credit bureau, and in many states the bureaus also can charge fees for temporarily “thawing” and removing a freeze (according a list published by <a href="http://consumersunion.org/research/consumers-unions-guide-to-security-freeze-protection-2/" target="_blank" rel="noopener">Consumers Union</a>, residents of four states — Indiana, Maine, North Carolina, South Carolina — do not need to pay to place, thaw or lift a freeze).</p>
<p>While my home state of Virginia allows the bureaus to charge $10 to place a freeze, for whatever reason the NCTUE did not assess that fee when I placed my freeze request with them. When and if your freeze request does get approved using the NCTUE&#8217;s automated phone system, make sure you have pen and paper or a keyboard handy to jot down the freeze PIN, which you will need in the event you ever wish to lift the freeze. When the system read my freeze PIN, it was read so quickly that I had to hit &#8220;*&#8221; on the dial pad several times to repeat the message.</p>
<p>It&#8217;s frankly laughable that consumers should ever have to pay to freeze their credit files at all, and yet a recent study indicates that almost 20 percent of Americans chose to do so at one or more of the three major credit bureaus since Equifax announced its breach last fall. The total estimated cost to consumers in freeze fees? <a href="https://krebsonsecurity.com/2018/03/survey-americans-spent-1-4b-on-credit-freeze-fees-in-wake-of-equifax-breach/" target="_blank" rel="noopener">$1.4 billion</a>. With a freeze on your files, the major credit bureaus stand to lose about one dollar for each time they might have been able to sell your credit report to a potential creditor, or potential identity thief.</p>
<p>But wishing Equifax and its ilk were finally and completely exposed for the digital dinosaurs that they are will not change the fact that if you care about your identity, you now may have another freeze to worry about. If you decide to take this step, please sound off about your experience in the comments below.</p>


feed_id: https://krebsonsecurity.com/?p=43782
title: Detecting Cloned Cards at the ATM, Register
uri: Detecting-Cloned-Cards-at-the-ATM-Register
url: https://krebsonsecurity.com/2018/05/detecting-cloned-cards-at-the-atm-register/
content:
<p>Much of the fraud involving counterfeit credit, ATM debit and retail gift cards relies on the ability of thieves to use cheap, widely available hardware to encode stolen data onto any card&#8217;s magnetic stripe. But new research suggests retailers and ATM operators could reliably detect counterfeit cards using a simple technology that flags cards which appear to have been altered by such tools.</p>
<div id="attachment_43797" style="width: 307px" class="wp-caption alignright"><img class=" wp-image-43797" src="media/26e0096f.giftcard.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/05/giftcard.png" alt="" width="297" height="212" /><p class="wp-caption-text">A gift card purchased at retail with an unmasked PIN hidden behind a paper sleeve. Such PINs can be easily copied by an adversary, who waits until the card is purchased to steal the card’s funds. Image: University of Florida.</p></div>
<p>Researchers at the <strong>University of Florida</strong> found that account data encoded on legitimate cards is invariably written using quality-controlled, automated facilities that tend to imprint the information in uniform, consistent patterns.</p>
<p>Cloned cards, however, usually are created by hand with inexpensive encoding machines, and as a result feature far more variance or &#8220;jitter&#8221; in the placement of digital bits on the card&#8217;s stripe.</p>
<p>Gift cards can be extremely profitable and brand-building for retailers, but gift card fraud creates a very negative shopping experience for consumers and a costly conundrum for retailers. The FBI estimates that while gift card fraud makes up a small percentage of overall gift card sales and use, approximately $130 billion worth of gift cards are sold each year.</p>
<p>One of the most common forms of gift card fraud involves thieves tampering with cards inside the retailer&#8217;s store &#8212; before the cards are purchased by legitimate customers. Using a handheld card reader, crooks will swipe the stripe to record the card&#8217;s serial number and other data needed to duplicate the card.</p>
<p>If there is a PIN on the gift card packaging, the thieves record that as well. In many cases, the PIN is obscured by a scratch-off decal, but gift card thieves can easily scratch those off and then replace the material with identical or similar decals that are sold very cheaply by the roll online.</p>
<p>&#8220;They can buy big rolls of that online for almost nothing,&#8221; said <strong><a href="https://www.cise.ufl.edu/~traynor/" target="_blank" rel="noopener">Patrick Traynor</a></strong>, an associate professor of computer science at the University of Florida. &#8220;Retailers we&#8217;ve worked with have told us they&#8217;ve gone to their gift card racks and found tons of this scratch-off stuff on the ground near the racks.&#8221;</p>
<p>At this point the cards are still worthless because they haven&#8217;t yet been activated. But armed with the card&#8217;s serial number in PIN, thieves can simply monitor the gift card account at the retailer&#8217;s online portal and wait until the cards are paid for and activated at the checkout register by an unwitting shopper.</p>
<p>Once a card is activated, thieves can encode that card&#8217;s data onto any card with a magnetic stripe and use that counterfeit to purchase merchandise at the retailer. The stolen goods typically are then sold online or on the street. Meanwhile, the person who bought the card (or the person who received it as a gift) finds the card is drained of funds when they eventually get around to using it at a retail store.</p>
<div id="attachment_41972" style="width: 600px" class="wp-caption aligncenter"><img class=" wp-image-41972" src="media/b40c7a50.giftcardtamper.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2017/12/giftcardtamper.png" alt="" width="590" height="583" /><p class="wp-caption-text">The top two gift cards show signs that someone previously peeled back the protective sticker covering the redemption code. Image: Flint Gatrell.</p></div>
<p>Traynor and a team of five other University of Florida researchers partnered with retail giant <strong>WalMart</strong> to test their technology, which Traynor said can be easily and quite cheaply incorporated into point-of-sale systems at retail store cash registers. They said the WalMart trial demonstrated that researchers&#8217; technology distinguished legitimate gift cards from clones with up to 99.3 percent accuracy.</p>
<p>While impressive, that rate still means the technology could still generate a &#8220;false positive&#8221; &#8212; erroneously flagging a legitimate customer as using a fraudulently obtained gift card in a non-trivial number of cases. But Traynor said the retailers they spoke with in testing their equipment all indicated they would welcome any additional tools to curb the incidence of gift card fraud.</p>
<p>&#8220;We&#8217;ve talked with quite a few retail loss prevention folks,&#8221; he said. &#8220;Most said even if they can simply flag the transaction and make a note of the person [presenting the cloned card] that this would be a win for them. Often, putting someone on notice that loss prevention is watching is enough to make them stop &#8212; at least at that store. From our discussions with a few big-box retailers, this kind of fraud is probably their newest big concern, although they don&#8217;t talk much about it publicly. If the attacker does any better than simply cloning the card to a blank white card, they&#8217;re pretty much powerless to stop the attack, and that&#8217;s a pretty consistent story behind closed doors.&#8221;<span id="more-43782"></span></p>
<h4>BEYOND GIFT CARDS</h4>
<p>Traynor said the University of Florida team&#8217;s method works even more accurately in detecting counterfeit ATM and credit cards, thanks to the dramatic difference in jitter between bank-issued cards and those cloned by thieves.</p>
<p>The magnetic material on most gift cards bears a quality that&#8217;s known in the industry as &#8220;low coercivity.&#8221; The stripe on so-called &#8220;LoCo&#8221; cards is usually brown in color, and new data can be imprinted on them quite cheaply using a machine that emits a relatively low or weak magnetic field. Hotel room keys also rely on LoCo stripes, which is why they tend to so easily lose their charge (particularly when placed next to something else with a magnetic charge).</p>
<p>In contrast, &#8220;high coercivity&#8221; (HiCo) stripes like those found on bank-issued debit and credit cards are usually black in color, hold their charge much longer, and are far more durable than LoCo cards. The downside of HiCo cards is that they are more expensive to produce, often relying on complex machinery and sophisticated manufacturing processes that encode the account data in highly uniform patterns.</p>
<div id="attachment_43800" style="width: 608px" class="wp-caption aligncenter"><a class="lightbox" href="media/b03faf23.cardbit.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/05/cardbit.png"><img class="wp-image-43800" src="media/b03faf23.cardbit.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/05/cardbit.png" alt="" width="598" height="190" /></a><p class="wp-caption-text">These graphics illustrate the difference between original and cloned cards. Source: University of Florida.</p></div>
<p>Traynor said tests indicate their technology can detect cloned bank cards with virtually zero false-positives. In fact, when the University of Florida team first began seeing positive results from their method, they originally pitched the technique as a way for banks to cut losses from ATM skimming and other forms of credit and debit card fraud.</p>
<p>Yet, Traynor said fellow academicians who reviewed their draft paper told them that banks probably wouldn&#8217;t invest in the technology because most financial institutions are counting on newer, more sophisticated chip-based (<a href="https://en.wikipedia.org/wiki/EMV" target="_blank" rel="noopener">EMV</a>) cards to eventually reduce counterfeit fraud losses.</p>
<p>&#8220;The original pitch on the paper was actually focused on credit cards, but academic reviewers were having trouble getting past EMV &#8212; as in, &#8220;EMV solves this and it&#8217;s universally deployed &#8211; so why is this necessary?'&#8221;, Traynor said. &#8220;We just kept getting reviews back from other academics saying that credit and bank card fraud is a solved problem.&#8221;</p>
<p>The trouble is that virtually all chip cards still store account data in plain text on the magnetic stripe on the back of the card — mainly so that the cards can be used in ATM and retail locations that are not yet equipped to read chip-based cards. As a result, even European countries whose ATMs all require chip-based cards remain heavily targeted by skimming gangs because the data on the chip card&#8217;s magnetic stripe can still be copied by a skimmer and used by thieves in the United States.</p>
<p>The University of Florida researchers recently were featured in <a href="https://www.forensicmag.com/news/2018/05/nypd-tests-new-tool-detects-credit-card-skimmers" target="_blank" rel="noopener">an Associated Press story</a> about an anti-skimming technology they developed and dubbed the &#8220;Skim Reaper.&#8221; The device, which can be made cheaply using a 3D printer, fits into the mouth of ATM&#8217;s card acceptance slot and can detect the presence of extra card reading devices that skimmer thieves may have fitted on top of or inside the cash machine.</p>
<p>The AP story quoted a New York Police Department financial crimes detective saying the Skim Reapers worked remarkably well in detecting the presence of ATM skimmers. But Traynor said many ATM operators and owners are simply uninterested in paying to upgrade their machines with their technology &#8212; in large part because the losses from ATM card counterfeiting are mostly assumed by consumers and financial institutions.</p>
<p>&#8220;We found this when we were talking around with the cops in New York City, that the incentive of an ATM bodega owner to upgrade an ATM is very low,&#8221; Traynor said. &#8220;Why should they go to that expense? Upgrades required to make these machines [chip-card compliant] are significant in cost, and the motivation is not necessarily there.&#8221;</p>
<p>Retailers also could choose to produce gift cards with embedded EMV chips that make the cards more expensive and difficult to counterfeit. But doing so likely would increase the cost of manufacturing by $2 to $3 per card, Traynor said.</p>
<p>&#8220;Putting a chip on the card dramatically increases the cost, so a $10 gift card might then have a $3 price added,&#8221; he said. &#8220;And you can imagine the reaction a customer might have when asked to pay $13 for a gift card that has a $10 face value.&#8221;</p>
<p>A copy of the University of Florida&#8217;s research paper is available <a href="media/969c6997.scaife-sandp18.pdf" data-original-source="https://www.cise.ufl.edu/~traynor/papers/scaife-sandp18.pdf" target="_blank" rel="noopener">here</a> (PDF).</p>
<p>The FBI has compiled a list of recommendations for reducing the likelihood of being victimized by gift card fraud. For starters, when buying in-store don’t just pick cards right off the rack. Look for ones that are sealed in packaging or stored securely behind the checkout counter. Also check the scratch-off area on the back to look for any evidence of tampering.</p>
<p>Here are some other tips from the FBI:</p>
<p>-If possible, only buy cards online directly from the store or restaurant.<br />
-If buying from a secondary gift card market website, check reviews and only buy from or sell to reputable dealers.<br />
-Check the gift card balance before and after purchasing the card to verify the correct balance on the card.<br />
-The re-seller of a gift card is responsible for ensuring the correct balance is on the gift card, not the merchant whose name is listed. If you are scammed, some merchants in some situations will replace the funds. Ask for, but don’t expect, help.<br />
-When selling a gift card through an online marketplace, do not provide the buyer with the card’s PIN until the transaction is complete.<br />
-When purchasing gift cards online, be leery of auction sites selling gift cards at a steep discount or in bulk.</p>


feed_id: https://krebsonsecurity.com/?p=43823
uri: Tracking-Firm-LocationSmart-Leaked-Location-Data-for-Customers-of-All
title:
Tracking Firm LocationSmart Leaked Location Data for Customers of All Major U.S. Mobile Carriers Without Consent in Real Time Via Its Web Site

url:
https://krebsonsecurity.com/2018/05/tracking-firm-locationsmart-leaked-location-data-for-customers-of-all-major-u-s-mobile-carriers-in-real-time-via-its-web-site/

content:
<p><strong>LocationSmart</strong>, a U.S. based company that acts as an aggregator of real-time data about the precise location of mobile phone devices, has been leaking this information to anyone via a buggy component of its Web site &#8212; <em>without the need for any password or other form of authentication or authorization</em> &#8212; KrebsOnSecurity has learned. The company took the vulnerable service offline early this afternoon after being contacted by KrebsOnSecurity, which verified that it could be used to reveal the location of any <strong>AT&amp;T</strong>, <strong>Sprint</strong>, <strong>T-Mobile</strong> or <strong>Verizon</strong> phone in the United States to an accuracy of within a few hundred yards.</p>
<p><img class="aligncenter size-full wp-image-43845" src="media/f262877a.locationtracking.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/05/locationtracking.jpg" alt="" width="500" height="324" /></p>
<p>On May 10, <em>The New York Times</em> <a href="https://www.nytimes.com/2018/05/10/technology/cellphone-tracking-law-enforcement.html" target="_blank" rel="noopener">broke the news</a> that a different cell phone location tracking company called <strong>Securus Technologies</strong> had been selling or giving away location data on customers of virtually any major mobile network provider to a sheriff&#8217;s office in Mississippi County, Mo.</p>
<p>On May 15, <em>ZDnet.com</em> <a href="https://www.zdnet.com/article/us-cell-carriers-selling-access-to-real-time-location-data/" target="_blank" rel="noopener">ran a piece</a> saying that Securus was getting its data through an intermediary &#8212; Carlsbad, CA-based LocationSmart.</p>
<p>Wednesday afternoon <em>Motherboard</em> <a href="https://motherboard.vice.com/en_us/article/gykgv9/securus-phone-tracking-company-hacked" target="_blank" rel="noopener">published another bombshell</a>: A hacker had broken into the servers of Securus and stolen 2,800 usernames, email addresses, phone numbers and hashed passwords of authorized Securus users. Most of the stolen credentials reportedly belonged to law enforcement officers across the country &#8212; stretching from 2011 up to this year.</p>
<p>Several hours before the Motherboard story went live, KrebsOnSecurity heard from <strong>Robert Xiao</strong>, a security researcher at <strong>Carnegie Mellon University</strong> who&#8217;d read the coverage of Securus and LocationSmart and had been poking around a demo tool that LocationSmart makes available on its Web site for potential customers to try out its mobile location technology.</p>
<p>LocationSmart&#8217;s demo is a free service that allows anyone to see the approximate location of their own mobile phone, just by entering their name, email address and phone number into a form on the site. LocationSmart then texts the phone number supplied by the user and requests permission to ping that device&#8217;s nearest cellular network tower.</p>
<p>Once that consent is obtained, LocationSmart texts the subscriber their approximate longitude and latitude, plotting the coordinates on a Google Street View map. [It also potentially collects and stores a great deal of technical data about your mobile device. For example, according to their <a href="https://www.locationsmart.com/privacy" target="_blank" rel="noopener">privacy policy</a> that information &#8220;may include, but is not limited to, device latitude/longitude, accuracy, heading, speed, and altitude, cell tower, Wi-Fi access point, or IP address information&#8221;].</p>
<p>But according to <strong>Xiao</strong>, a PhD candidate at <b>CMU&#8217;s</b> <a href="https://www.hcii.cmu.edu/people/robert-xiao" target="_blank" rel="noopener">Human-Computer Interaction Institute</a>, this same service failed to perform basic checks to prevent anonymous and unauthorized queries. Translation: Anyone with a modicum of knowledge about how Web sites work could abuse the LocationSmart demo site to figure out how to conduct mobile number location lookups at will, <em>all without ever having to supply a password or other credentials</em>.</p>
<p>&#8220;I stumbled upon this almost by accident, and it wasn&#8217;t terribly hard to do,&#8221; Xiao said. &#8220;This is something anyone could discover with minimal effort. And the gist of it is I can track most peoples&#8217; cell phone without their consent.&#8221;</p>
<p>Xiao said his tests showed he could reliably query LocationSmart&#8217;s service to ping the cell phone tower closest to a subscriber&#8217;s mobile device. Xiao said he checked the mobile number of a friend several times over a few minutes while that friend was moving. By pinging the friend&#8217;s mobile network multiple times over several minutes, he was then able to plug the coordinates into <a href="https://maps.google.com" target="_blank" rel="noopener">Google Maps</a> and track the friend&#8217;s directional movement.</p>
<p>&#8220;This is really creepy stuff,&#8221; Xiao said, adding that he&#8217;d also successfully tested the vulnerable service against one <strong>Telus</strong> <strong>Mobility</strong> mobile customer in Canada who volunteered to be found.</p>
<p>Before LocationSmart&#8217;s demo was taken offline today, KrebsOnSecurity pinged five different trusted sources, all of whom gave consent to have Xiao determine the whereabouts of their cell phones. Xiao was able to determine within a few seconds of querying the public LocationSmart service the near-exact location of the mobile phone belonging to all five of my sources.</p>
<div id="attachment_43840" style="width: 606px" class="wp-caption aligncenter"><img class=" wp-image-43840" src="media/8126b691.lsmartdemo.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/05/lsmartdemo.png" alt="" width="596" height="468" /><p class="wp-caption-text">LocationSmart&#8217;s demo page.</p></div>
<p>One of those sources said the longitude and latitude returned by Xiao&#8217;s queries <em>came within 100 yards of their then-current location</em>. Another source said the location found by the researcher was 1.5 miles away from his current location. The remaining three sources said the location returned for their phones was between approximately 1/5 to 1/3 of a mile at the time.</p>
<p>Reached for comment via phone, LocationSmart Founder and CEO <strong>Mario Proietti</strong> said the company was investigating.</p>
<p>&#8220;We don&#8217;t give away data,&#8221; Proietti said. &#8220;We make it available for legitimate and authorized purposes. It&#8217;s based on legitimate and authorized use of location data that only takes place on consent. We take privacy seriously and we&#8217;ll review all facts and look into them.&#8221;</p>
<p>LocationSmart&#8217;s home page features the corporate logos of all four the major wireless providers, as well as companies like <strong>Google</strong>, <strong>Neustar</strong>, <strong>ThreatMetrix</strong>, and <strong>U.S. Cellular</strong>. The company says its technologies help businesses keep track of remote employees and corporate assets, and that it helps mobile advertisers and marketers serve consumers with &#8220;geo-relevant promotions.&#8221;</p>
<div id="attachment_43843" style="width: 603px" class="wp-caption aligncenter"><img class=" wp-image-43843" src="media/c570cf47.ls-customers.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/05/ls-customers.png" alt="" width="593" height="366" /><p class="wp-caption-text">LocationSmart&#8217;s home page lists many partners.</p></div>
<p>It&#8217;s not clear exactly how long LocationSmart has offered its demo service or for how long the service has been so permissive; <a href="https://web.archive.org/web/20170106095744/https://www.locationsmart.com/resources#demos" target="_blank" rel="noopener">this link from archive.org</a> suggests it dates back to at least January 2017. <a href="https://web.archive.org/web/20110628000743/https://instantlocatedemo.loc-aid.com/" rel="noopener" target="_blank">This link from The Internet Archive</a> suggests the service may have existed under a different company name &#8212; loc-aid.com &#8212; since mid-2011, but it&#8217;s unclear if that service used the same code. Loc-aid.com is one of four other sites hosted on the same server as locationsmart.com, according to <a href="https://www.domaintools.com" rel="noopener" target="_blank">Domaintools.com</a>.<span id="more-43823"></span></p>
<p>LocationSmart&#8217;s privacy policy says the company has security measures in place&#8230;&#8221;to protect our site from the loss or misuse of information that we have collected. Our servers are protected by firewalls and are physically located in secure data facilities to further increase security. While no computer is 100% safe from outside attacks, we believe that the steps we have taken to protect your personal information drastically reduce the likelihood of security problems to a level appropriate to the type of information involved.&#8221;</p>
<p>But these assurances may ring hollow to anyone with a cell phone who&#8217;s concerned about having their physical location revealed at any time. The component of LocationSmart&#8217;s Web site that can be abused to look up mobile location data at will is an insecure &#8220;<a href="https://en.wikipedia.org/wiki/Application_programming_interface" target="_blank" rel="noopener">application programming interface</a>&#8221; or API &#8212; an interactive feature designed to display data in response to specific queries by Web site visitors. </p>
<p><span class="pullquote pqright">Although the LocationSmart&#8217;s demo page required users to consent to having their phone located by the service, LocationSmart apparently did nothing to prevent or authenticate direct interaction with the API itself.</span></p>
<p>API authentication weaknesses are not uncommon, but they can lead to the exposure of sensitive data on a great many people in a short period of time. In April 2018, KrebsOnSecurity <a href="https://krebsonsecurity.com/2018/04/panerabread-com-leaks-millions-of-customer-records/" target="_blank" rel="noopener">broke the story</a> of an API at the Web site of fast-casual bakery chain <strong>PaneraBread.com</strong> that exposed the names, email and physical addresses, birthdays and last four digits of credit cards on file for tens of millions of customers who&#8217;d signed up for an account at PaneraBread to order food online.</p>
<p>In <a href="https://www.documentcloud.org/documents/4457319-Wyden-Securus-Location-Tracking-Letter-to-AT-amp-T.html" target="_blank" rel="noopener">a May 9 letter</a> sent to the top four wireless carriers and to the <strong>U.S. Federal Communications Commission</strong> in the wake of revelations about Securus&#8217; alleged practices, <strong>Sen. Ron Wyden</strong> (D-Ore.) urged all parties to take &#8220;proactive steps to prevent the unrestricted disclosure and potential abuse of private customer data.&#8221;</p>
<p>&#8220;Securus informed my office that it purchases real-time location information on AT&amp;T&#8217;s customers &#8212; through a third party location aggregator that has a commercial relationship with the major wireless carriers &#8212; and routinely shares that information with its government clients,&#8221; Wyden wrote. &#8220;This practice skirts wireless carrier&#8217;s legal obligation to be the sole conduit by which the government may conduct surveillance of Americans&#8217; phone records, and needlessly exposes millions of Americans to potential abuse and unchecked surveillance by the government.&#8221;</p>
<p>Securus, which reportedly gets its cell phone location data from LocationSmart, told <em>The New York Times</em> that it requires customers to upload a legal document &#8212; such as a warrant or affidavit &#8212; and to certify that the activity was authorized. But in his letter, Wyden said &#8220;senior officials from Securus have confirmed to my office that it never checks the legitimacy of those uploaded documents to determine whether they are in fact court orders and has dismissed suggestions that it is obligated to do so.&#8221;</p>
<p>Securus did not respond to requests for comment.</p>
<h4>THE CARRIERS RESPOND</h4>
<p>It remains unclear what, if anything, AT&amp;T, Sprint, T-Mobile and Verizon plan to do about any of this. A third-party firm leaking customer location information not only would almost certainly violate each mobile providers own stated privacy policies, but the real-time exposure of this data poses serious privacy and security risks for virtually all U.S. mobile customers (and perhaps beyond, although all my willing subjects were inside the United States).</p>
<p>None of the major carriers would confirm or deny a formal business relationship with LocationSmart, despite LocationSmart listing them each by corporate logo on its Web site.</p>
<p>AT&amp;T spokesperson <strong>Jim Greer</strong> said AT&amp;T does not permit the sharing of location information without customer consent or a demand from law enforcement.</p>
<p>&#8220;If we learn that a vendor does not adhere to our policy we will take appropriate action,&#8221; Greer said.</p>
<p>T-Mobile referred me to <a href="https://www.t-mobile.com/company/privacy-resources/location-services.html" target="_blank" rel="noopener">their privacy policy,</a> which says T-Mobile follows the &#8220;best practices&#8221; <a href="media/d2eb3e24.CTIA_LBS_Best_Practices_Adopted_03_10.pdf" data-original-source="http://files.ctia.org/pdf/CTIA_LBS_Best_Practices_Adopted_03_10.pdf" target="_blank" rel="noopener">document</a> (PDF) for subscriber location data as laid out by the <strong>CTIA</strong>, the international association for the wireless telecommunications industry.</p>
<p>A T-Mobile spokesperson said that after receiving Sen. Wyden&#8217;s letter, the company quickly shut down any transaction of customer location data to Securus.</p>
<p>&#8220;We are continuing to investigate this matter,&#8221; a T-Mobile spokesperson wrote via email. T-Mobile has not yet responded to requests specifically about LocationSmart.</p>
<p>Verizon also referred me to <a href="http://www.verizon.com/about/privacy/full-privacy-policy#information_shared" target="_blank" rel="noopener">their privacy policy</a>.</p>
<p>Sprint officials shared the following statement:</p>
<blockquote><p>&#8220;Protecting our customers’ privacy and security is a top priority, and we are transparent about our <a href="https://www.sprint.com/en/legal/sprint-corporation-privacy-policy.html" data-saferedirecturl="https://www.google.com/url?hl=en&amp;q=https://www.sprint.com/en/legal/sprint-corporation-privacy-policy.html&amp;source=gmail&amp;ust=1526649786355000&amp;usg=AFQjCNH0_rDmNAC_NEEbwuljnv52crJZ1g">Privacy Policy</a>. To be clear, we do not share or sell consumers’ sensitive information to third parties. We share personally identifiable geo-location information only with customer consent or in response to a lawful request such as a validated court order from law enforcement.&#8221;</p>
<p style="font-weight: 400;">&#8220;We will answer the questions raised in Sen. Wyden’s letter directly through appropriate channels. However, it is important to note that Sprint’s relationship with Securus does not include data sharing, and is limited to supporting efforts to curb unlawful use of contraband cellphones in correctional facilities.&#8221;</p>
</blockquote>
<h4>WHAT NOW?</h4>
<p><strong>Stephanie Lacambra</strong>, a staff attorney with the the nonprofit <a href="https://www.eff.org" target="_blank" rel="noopener">Electronic Frontier Foundation</a>, said that wireless customers in the United States cannot opt out of location tracking by their own mobile providers. For starters, carriers constantly use this information to provide more reliable service to the customers. Also, by law wireless companies need to be able to ascertain at any time the approximate location of a customer&#8217;s phone in order to comply with emergency 911 regulations.</p>
<p>But unless and until Congress and federal regulators make it more clear how and whether customer location information can be shared with third-parties, mobile device customers may continue to have their location information potentially exposed by a host of third-party companies, Lacambra said.</p>
<p>&#8220;This is precisely why we have lobbied so hard for robust privacy protections for location information,&#8221; she said. &#8220;It really should be only that law enforcement is required to get a warrant for this stuff, and that&#8217;s the rule we&#8217;ve been trying to push for.&#8221;</p>
<p><strong>Chris Calabrese</strong> is vice president of the <a href="https://www.cdt.org" target="_blank" rel="noopener">Center for Democracy &amp; Technology</a>, a policy think tank in Washington, D.C. Calabrese said the current rules about mobile subscriber location information are governed by the <a href="https://en.wikipedia.org/wiki/Electronic_Communications_Privacy_Act" target="_blank" rel="noopener">Electronic Communications Privacy Act (ECPA)</a>, a law passed in 1986 that hasn&#8217;t been substantially updated since.</p>
<p>&#8220;The law here is really out of date,&#8221; Calabrese said. &#8220;But I think any processes that involve going to third parties who don&#8217;t verify that it&#8217;s a lawful or law enforcement request &#8212; and that don&#8217;t make sure the evidence behind that request is legitimate &#8212; are hugely problematic and they&#8217;re major privacy violations.&#8221;</p>
<p>&#8220;I would be very surprised if any mobile carrier doesn&#8217;t think location information should be treated sensitively, and I&#8217;m sure none of them want this information to be made public,&#8221; Calabrese continued. &#8220;My guess is the carriers are going to come down hard on this, because it&#8217;s sort of their worst nightmare come true. We all know that cell phones are portable tracking devices. There&#8217;s a sort of an implicit deal where we&#8217;re okay with it because we get lots of benefits from it, but we all also assume this information should be protected. But when it isn&#8217;t, that presents a major problem and I think these examples would be a spur for some sort of legislative intervention if they weren&#8217;t fixed very quickly.&#8221;</p>
<p>For his part, Xiao says we&#8217;re likely to see more leaks from location tracking companies like Securus and LocationSmart as long as the mobile carriers are providing third party companies <em>any</em> access to customer location information.</p>
<p>&#8220;We&#8217;re going to continue to see breaches like this happen until access to this data can be much more tightly controlled,&#8221; he said.</p>


