# articles

feed_id: https://krebsonsecurity.com/?p=60770
title: Sounding the Alarm on Emergency Alert System Flaws
uri: Sounding-the-Alarm-on-Emergency-Alert-System-Flaws
url: https://krebsonsecurity.com/2022/08/sounding-the-alarm-on-emergency-alert-system-flaws/
content:
<p>The <strong>Department of Homeland Security</strong> (DHS) is urging states and localities to beef up security around proprietary devices that connect to the <a href="https://en.wikipedia.org/wiki/Emergency_Alert_System" target="_blank" rel="noopener"><strong>Emergency Alert System</strong></a> &#8212; a national public warning system used to deliver important emergency information, such as severe weather and AMBER alerts. The DHS warning came in advance of a workshop to be held this weekend at the <a href="https://defcon.org/" target="_blank" rel="noopener">DEFCON</a> security conference in Las Vegas, where a security researcher is slated to demonstrate multiple weaknesses in the nationwide alert system.</p>
<div id="attachment_60809" style="width: 760px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-60809" class=" wp-image-60809" src="media/9deec14a.das-eas.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/08/das-eas.png" alt="" width="750" height="494" srcset="https://krebsonsecurity.com/wp-content/uploads/2022/08/das-eas.png 1007w, https://krebsonsecurity.com/wp-content/uploads/2022/08/das-eas-768x506.png 768w, https://krebsonsecurity.com/wp-content/uploads/2022/08/das-eas-782x515.png 782w" sizes="(max-width: 750px) 100vw, 750px" /><p id="caption-attachment-60809" class="wp-caption-text">A Digital Alert Systems EAS encoder/decoder that Pyle said he acquired off eBay in 2019. It had the username and password for the system printed on the machine.</p></div>
<p>The DHS <a href="https://content.govdelivery.com/accounts/USDHSFEMA/bulletins/3263326" target="_blank" rel="noopener">warning</a> was prompted by security researcher <a href="https://www.linkedin.com/in/ken-pyle-cissp-hcispp-oscp-ecsa-ceh-ence-569642a/" target="_blank" rel="noopener">Ken Pyle</a>, a partner at security firm <a href="https://www.cybir.com" target="_blank" rel="noopener">Cybir</a>. Pyle said he started acquiring old EAS equipment off of eBay in 2019, and that he quickly identified a number of serious security vulnerabilities in a device that is broadly used by states and localities to encode and decode EAS alert signals.</p>
<p>&#8220;I found all kinds of problems back then, and reported it to the DHS, FBI and the manufacturer,&#8221; Pyle said in an interview with KrebsOnSecurity. &#8220;But nothing ever happened. I decided I wasn&#8217;t going to tell anyone about it yet because I wanted to give people time to fix it.&#8221;</p>
<p>Pyle said he took up the research again in earnest after an angry mob stormed the U.S. Capitol on Jan. 6, 2021.</p>
<p>&#8220;I was sitting there thinking, &#8216;Holy shit, someone could start a civil war with this thing,&#8221;&#8217; Pyle recalled. &#8220;I went back to see if this was still a problem, and it turns out it&#8217;s still a very big problem. So I decided that unless someone actually makes this public and talks about it, clearly nothing is going to be done about it.&#8221;</p>
<p>The EAS encoder/decoder devices Pyle acquired were made by Lyndonville, NY-based <strong>Digital Alert Systems</strong> (formerly <strong>Monroe Electronics, Inc.</strong>), which <a href="https://www.digitalalertsystems.com/EAS_DAS/security-advisory.html" target="_blank" rel="noopener">issued a security advisory</a> this month saying it released patches in 2019 to fix the flaws reported by Pyle, but that some customers are still running outdated versions of the device&#8217;s firmware. That may be because the patches were included in version 4 of the firmware for the EAS devices, and many older models apparently <a href="https://www.digitalalertsystems.com/EAS_DAS/eol.html" target="_blank" rel="noopener">do not support the new software</a>.</p>
<p>&#8220;The vulnerabilities identified present a potentially serious risk, and we believe both were addressed in software updates issued beginning Oct 2019,&#8221; EAS said in a written statement. &#8220;We also provided attribution for the researcher’s responsible disclosure, allowing us to rectify the matters before making any public statements. We are aware that some users have not taken corrective actions and updated their software and should immediately take action to update the latest software version to ensure they are not at risk. Anything lower than version 4.1 should be updated immediately. On July 20, 2022, the researcher referred to other potential issues, and we trust the researcher will provide more detail. We will evaluate and work to issue any necessary mitigations as quickly as possible.&#8221;</p>
<p>But Pyle said a great many EAS stakeholders are still ignoring basic advice from the manufacturer, such as changing default passwords and placing the devices behind a firewall, not directly exposing them to the Internet, and restricting access only to trusted hosts and networks.</p>
<div id="attachment_60948" style="width: 263px" class="wp-caption alignright"><img aria-describedby="caption-attachment-60948" loading="lazy" class=" wp-image-60948" src="media/9706aca1.pyleselfie.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/08/pyleselfie.png" alt="" width="253" height="278" /><p id="caption-attachment-60948" class="wp-caption-text">Pyle, in a selfie that is heavily redacted because the EAS device behind him had its user credentials printed on the lid.</p></div>
<p>Pyle said the biggest threat to the security of the EAS is that an attacker would only need to compromise a single EAS station to send out alerts locally that can be picked up by other EAS systems and retransmitted across the nation.</p>
<p>&#8220;The process for alerts is automated in most cases, hence, obtaining access to a device will allow you to pivot around,&#8221; he said. &#8220;There&#8217;s no centralized control of the EAS because these devices are designed such that someone locally can issue an alert, but there&#8217;s no central control over whether I am the one person who can send or whatever. If you are a local operator, you can send out nationwide alerts. That&#8217;s how easy it is to do this.&#8221;</p>
<p>One of the Digital Alert Systems devices Pyle sourced from an electronics recycler earlier this year was non-functioning, but whoever discarded it neglected to wipe the hard drive embedded in the machine. Pyle soon discovered the device contained the private cryptographic keys and other credentials needed to send alerts through <strong>Comcast</strong>, the nation&#8217;s third-largest cable company.</p>
<p>&#8220;I can issue and create my own alert here, which has all the valid checks or whatever for being a real alert station,&#8221; Pyle said in an interview earlier this month. &#8220;I can create a message that will start propagating through the EAS.&#8221;</p>
<p>Comcast told KrebsOnSecurity that &#8220;a third-party device used to deliver EAS alerts was lost in transit by a trusted shipping provider between two Comcast locations and subsequently obtained by a cybersecurity researcher.</p>
<p>&#8220;We’ve conducted a thorough investigation of this matter and have determined that no customer data, and no sensitive Comcast data, were compromised,&#8221; Comcast spokesperson <strong>David McGuire</strong> said.</p>
<p>The company said it also confirmed that the information included on the device can no longer be used to send false messages to Comcast customers or used to compromise devices within Comcast’s network, including EAS devices.<span id="more-60770"></span></p>
<p>&#8220;We are taking steps to further ensure secure transfer of such devices going forward,&#8221; McGuire said. &#8220;Separately, we have conducted a thorough audit of all EAS devices on our network and confirmed that they are updated with currently available patches and are therefore not vulnerable to recently reported security issues. We’re grateful for the responsible disclosure and to the security research community for continuing to engage and share information with our teams to make our products and technologies ever more secure. Mr. Pyle informed us promptly of his research and worked with us as we took steps to validate his findings and ensure the security of our systems.&#8221;</p>
<div id="attachment_60953" style="width: 757px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-60953" loading="lazy" class=" wp-image-60953" src="media/6aadd9c9.easalerts.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/08/easalerts.png" alt="" width="747" height="457" srcset="https://krebsonsecurity.com/wp-content/uploads/2022/08/easalerts.png 955w, https://krebsonsecurity.com/wp-content/uploads/2022/08/easalerts-768x470.png 768w, https://krebsonsecurity.com/wp-content/uploads/2022/08/easalerts-782x478.png 782w" sizes="(max-width: 747px) 100vw, 747px" /><p id="caption-attachment-60953" class="wp-caption-text">The user interface for an EAS device.</p></div>
<p>Unauthorized EAS broadcast alerts have happened enough that there is <a href="https://emergencyalertsystem.fandom.com/wiki/Hacking_of_the_EAS" target="_blank" rel="noopener">a chronicle of EAS compromises</a> over at fandom.com. Thankfully, most of these incidents have involved fairly obvious hoaxes.</p>
<p>According to the EAS wiki, in February 2013, hackers broke into the EAS networks in Great Falls, Mt. and Marquette, Mich. to broadcast an alert that zombies had risen from their graves in several counties. In Feb. 2017, an EAS station in Indiana also was hacked, with the intruders playing the same &#8220;zombies and dead bodies&#8221; audio from the 2013 incidents.</p>
<p>&#8220;On February 20 and February 21, 2020, Wave Broadband&#8217;s EASyCAP equipment was hacked due to the equipment&#8217;s default password not being changed,&#8221; the Wiki states. &#8220;Four alerts were broadcasted, two of which consisted of a Radiological Hazard Warning and a Required Monthly Test playing parts of the Hip Hop song Hot by artist Young Thug.&#8221;</p>
<p>In January 2018, Hawaii sent out an alert to cell phones, televisions and radios, warning everyone in the state that a missile was headed their way. It took 38 minutes for Hawaii to let people know the alert was a misfire, and that a draft alert was inadvertently sent. The news video clip below about the 2018 event in Hawaii does a good job of walking through how the EAS works.</p>
<div align="center"><iframe loading="lazy" title="YouTube video player" src="https://www.youtube.com/embed/M-2Xw9tuP1A" width="750" height="315" frameborder="0" allowfullscreen="allowfullscreen"></iframe></div>


feed_id: https://krebsonsecurity.com/?p=60972
title: When Efforts to Contain a Data Breach Backfire
uri: When-Efforts-to-Contain-a-Data-Breach-Backfire
url: https://krebsonsecurity.com/2022/08/when-efforts-to-contain-a-data-breach-backfire/
content:
<p>Earlier this month, the administrator of the cybercrime forum <strong>Breached</strong> received a cease-and-desist letter from a cybersecurity firm. The missive alleged that an auction on the site for data stolen from 10 million customers of Mexico&#8217;s second-largest bank was fake news and harming the bank&#8217;s reputation. The administrator responded to this empty threat by purchasing the stolen banking data and leaking it on the forum for everyone to download.</p>
<p><img class="aligncenter  wp-image-60984" src="media/8e2fa609.banorte-breached-1.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/08/banorte-breached-1.png" alt="" width="764" height="400" srcset="https://krebsonsecurity.com/wp-content/uploads/2022/08/banorte-breached-1.png 1217w, https://krebsonsecurity.com/wp-content/uploads/2022/08/banorte-breached-1-768x402.png 768w, https://krebsonsecurity.com/wp-content/uploads/2022/08/banorte-breached-1-782x409.png 782w, https://krebsonsecurity.com/wp-content/uploads/2022/08/banorte-breached-1-267x140.png 267w" sizes="(max-width: 764px) 100vw, 764px" /></p>
<p>On August 3, 2022, someone using the alias &#8220;<strong>Holistic-K1ller</strong>&#8221; posted on Breached a thread selling data allegedly stolen from <strong>Grupo Financiero Banorte</strong>, Mexico&#8217;s second-biggest financial institution <a href="https://www.bloomberg.com/news/articles/2022-08-01/citi-mexico-unit-seen-selling-above-7-billion-as-slim-eyes-bank" rel="noopener" target="_blank">by total loans</a>. Holistic-K1ller said the database included the full names, addresses, phone numbers, Mexican tax IDs (RFC), email addresses and balances on more than 10 million citizens.</p>
<p>There was no reason to believe Holistic-K1ller had fabricated their breach claim. This identity has been highly active on Breached and <a href="https://krebsonsecurity.com/2022/04/raidforums-get-raided-alleged-admin-arrested/" target="_blank" rel="noopener">its predecessor RaidForums</a> for more than two years, mostly selling databases from hacked Mexican entities. Last month, they sold customer information on 36 million customers of the Mexican phone company <strong>Telcel</strong>; in March, they sold 33,000 images of Mexican IDs &#8212; with the front picture and a selfie of each citizen. That same month, they also sold data on 1.4 million customers of Mexican lending platform <strong>Yotepresto</strong>.</p>
<p>But this history was either overlooked or ignored by <strong>Group-IB</strong>, the Singapore-based cybersecurity firm apparently hired by Banorte to help respond to the data breach.</p>
<p>&#8220;The Group-IB team has discovered a resource containing a fraudulent post offering to buy Grupo Financiero Banorte&#8217;s leaked databases,&#8221; reads a letter the Breach administrator said they received from Group-IB. &#8220;We ask you to remove this post containing Banorte data. Thank you for your cooperation and prompt attention to this urgent matter.&#8221;</p>
<p>The administrator of Breached is &#8220;<strong>Pompompurin</strong>,&#8221; the same individual who alerted this author in November 2021 to a glaring security hole in a U.S. Justice Department website that was <a href="https://krebsonsecurity.com/2021/11/hoax-email-blast-abused-poor-coding-in-fbi-website/" target="_blank" rel="noopener">used to spoof security alerts from the FBI</a>. In a post to Breached on Aug. 8, Pompompurin said they bought the Banorte database from Hacker-K1ller&#8217;s sales thread because Group-IB was sending emails complaining about it.</p>
<p>&#8220;They also attempted to submit DMCA&#8217;s against the website,&#8221; Pompompurin wrote, referring to legal takedown requests under the <a href="https://en.wikipedia.org/wiki/Digital_Millennium_Copyright_Act" target="_blank" rel="noopener">Digital Millennium Copyright Act</a>. &#8220;Make sure to tell Banorte that now they need to worry about the data being leaked instead of just being sold.&#8221;</p>
<p>Banorte did not respond to requests for comment. Nor did Group-IB. But in a brief written statement <a href="https://twitter.com/hmier/status/1558459737552723969" target="_blank" rel="noopener">picked up on Twitter</a>, Banorte said there was no breach involving their infrastructure, and the data being sold is old.</p>
<p>&#8220;There has been no violation of our platforms and technological infrastructure,&#8221; Banorte said. &#8220;The set of information referred to is inaccurate and outdated, and does not put our users and customers at risk.&#8221;<span id="more-60972"></span></p>
<p>That statement may be 100 percent true. Still, it is difficult to think of a better example of how <em>not</em> to do breach response. Banorte shrugging off this incident as a nothingburger is baffling: While it is almost certainly true that the bank balance information in the Banorte leak is now out of date, the rest of the information (tax IDs, phone numbers, email addresses) is harder to change.</p>
<p>&#8220;Is there one person from our community that think sending cease and desist letter to a hackers forum operator is a good idea?,&#8221; <a href="https://twitter.com/ohad_mz/status/1558167821888245761" target="_blank" rel="noopener">asked</a> <a href="https://twitter.com/ohad_mz" target="_blank" rel="noopener">Ohad Zaidenberg</a>, founder of <strong>CTI League</strong>, a volunteer emergency response community that <a href="https://krebsonsecurity.com/2020/04/covid-19-has-united-cybersecurity-experts-but-will-that-unity-survive-the-pandemic/" target="_blank" rel="noopener">emerged in 2020 to help fight COVID-19 related scams</a>. &#8220;Who does it? Instead of helping, they pushed the organization from the hill.&#8221;</p>
<p><strong>Kurt Seifried</strong>, director of IT for the <strong>CloudSecurityAlliance</strong>, was similarly perplexed by the response to the Banorte breach.</p>
<p>&#8220;If the data wasn&#8217;t real&#8230;.did the bank think a cease and desist would result in the listing being removed?&#8221; Seifried <a href="https://twitter.com/kurtseifried/status/1558142799886708742" target="_blank" rel="noopener">wondered</a> on Twitter. &#8220;I mean, isn&#8217;t selling breach data a worse crime usually than slander or libel? What was their thought process?&#8221;</p>
<p>A more typical response when a large bank suspects a breach is to approach the seller privately through an intermediary to ascertain if the information is valid and what it might cost to take it off the market. While it may seem odd to expect cybercriminals to make good on their claims to sell stolen data to only one party, removing sold stolen items from inventory is a fairly basic function of virtually all cybercriminal markets today (apart from perhaps sites that traffic in stolen identity data). </p>
<p>At a minimum, negotiating or simply engaging with a data seller can buy the victim organization additional time and clues with which to investigate the claim and ideally notify affected parties of a breach before the stolen data winds up online.</p>
<p>It is true that a large number of hacked databases put up for sale on the cybercrime underground are sold only after a small subset of in-the-know thieves <a href="https://krebsonsecurity.com/2021/07/the-life-cycle-of-a-breached-database/" rel="noopener" target="_blank">have harvested all of the low-hanging fruit in the data</a> &#8212; e.g., access to cryptocurrency accounts or user credentials that are recycled across multiple websites. And it&#8217;s certainly not unheard of for cybercriminals to go back on their word and re-sell or leak information that they have sold previously.</p>
<p>But companies in the throes of responding to a data security incident do themselves and customers no favors when they underestimate their adversaries, or try to intimidate cybercrooks with legal threats. Such responses generally accomplish nothing, except unnecessarily upping the stakes for everyone involved while displaying a dangerous naiveté about how the cybercrime underground works.</p>


feed_id: https://krebsonsecurity.com/?p=61016
title: PayPal Phishing Scam Uses Invoices Sent Via PayPal
uri: PayPal-Phishing-Scam-Uses-Invoices-Sent-Via-PayPal
url: https://krebsonsecurity.com/2022/08/paypal-phishing-scam-uses-invoices-sent-via-paypal/
content:
<p>Scammers are using invoices sent through <strong>PayPal.com</strong> to trick recipients into calling a number to dispute a pending charge. The missives &#8212; <em>which come from Paypal.com and include a link at Paypal.com that displays an invoice for the supposed transaction</em> &#8212; state that the user&#8217;s account is about to be charged hundreds of dollars. Recipients who call the supplied toll-free number to contest the transaction are soon asked to download software that lets the scammers assume remote control over their computer.</p>
<p>KrebsOnSecurity recently heard from a reader who received an email from paypal.com that he immediately suspected was phony. The message&#8217;s subject read, &#8220;Billing Department of PayPal updated your invoice.&#8221;</p>
<div id="attachment_61023" style="width: 731px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-61023" class="size-full wp-image-61023" src="media/6602752b.paypalinvoiceupdated.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/08/paypalinvoiceupdated.png" alt="" width="721" height="646" /><p id="caption-attachment-61023" class="wp-caption-text">A copy of the phishing message included in the PayPal.com invoice.</p></div>
<p>While the phishing message attached to the invoice is somewhat awkwardly worded, there are many convincing aspects of this hybrid scam. For starters, all of the links in the email lead to paypal.com. Hovering over the &#8220;View and Pay Invoice&#8221; button shows the button indeed wants to load a link at paypal.com, and clicking that link indeed brings up an active invoice at paypal.com.</p>
<p>Also, <a href="media/c035534e.paypalemailheaders.pdf" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/08/paypalemailheaders.pdf" target="_blank" rel="noopener">the email headers in the phishing message</a> (PDF) show that it passed all email validation checks as being sent by PayPal, and that it was sent through an Internet address assigned to PayPal.</p>
<p>Both the email and the invoice state that &#8220;there is evidence that your PayPal account has been accessed unlawfully.&#8221; The message continues:</p>
<p>&#8220;$600.00 has been debited to your account for the Walmart Gift Card purchase. This transaction will appear in the automatically deducted amount on PayPal activity after 24 hours. If you suspect you did not make this transaction, immediately contact us at the toll-free number&#8230;.&#8221;</p>
<p>Here&#8217;s the invoice that popped up when the &#8220;View and Pay Invoice&#8221; button was clicked:</p>
<div id="attachment_61024" style="width: 763px" class="wp-caption aligncenter"><a href="media/d78f633d.paypalscaminvoice.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/08/paypalscaminvoice.png" target="_blank" rel="noopener"><img aria-describedby="caption-attachment-61024" loading="lazy" class="wp-image-61024" src="media/d78f633d.paypalscaminvoice.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/08/paypalscaminvoice.png" alt="" width="753" height="459" srcset="https://krebsonsecurity.com/wp-content/uploads/2022/08/paypalscaminvoice.png 1335w, https://krebsonsecurity.com/wp-content/uploads/2022/08/paypalscaminvoice-768x468.png 768w, https://krebsonsecurity.com/wp-content/uploads/2022/08/paypalscaminvoice-782x477.png 782w" sizes="(max-width: 753px) 100vw, 753px" /></a><p id="caption-attachment-61024" class="wp-caption-text">The phony PayPal invoice, which was sent and hosted by PayPal.com.</p></div>
<p>The reader who shared this phishing email said he logged into his PayPal account and could find no signs of the invoice in question. A call to the toll-free number listed in the invoice was received by a man who answered the phone as generic &#8220;customer service,&#8221; instead of trying to spoof PayPal or Walmart. Very quickly into the conversation he suggested visiting a site called globalquicksupport[.]com to download a remote administration tool. It was clear then <a href="https://krebsonsecurity.com/2022/08/scammers-sent-uber-to-take-elderly-lady-to-the-bank/" target="_blank" rel="noopener">where the rest of this call was going</a>.</p>
<p>I can see this scam tricking a great many people, especially since both the email and invoice are sent through PayPal&#8217;s systems &#8212; which practically guarantees that the message will be successfully delivered. The invoices appear to have been sent from a compromised or fraudulent <a href="https://www.paypal.com/us/webapps/mpp/invoicing-templates" target="_blank" rel="noopener">PayPal Business account</a>, which allows users to send invoices like the one shown above. Details of this scam were shared Wednesday with PayPal&#8217;s anti-abuse (phish@paypal.com) and media relations teams.</p>
<p>It&#8217;s remarkable how well today&#8217;s fraudsters have adapted to hijacking the very same tools that financial institutions have long used to make their customers feel safe transacting online. It&#8217;s no accident that one of the most prolific scams going right now &#8212; the <a href="https://krebsonsecurity.com/2021/11/the-zelle-fraud-scam-how-it-works-how-to-fight-back/" target="_blank" rel="noopener">Zelle Fraud Scam</a> &#8212; starts with a text message about an unauthorized payment that appears to come from your bank. After all, financial institutions have spent years encouraging customers to sign up for mobile alerts via SMS about suspicious transactions, and to expect the occasional inbound call about possibly fraudulent transactions.</p>
<p>Also, today&#8217;s scammers are less interested in stealing your PayPal login than they are in phishing your entire computer and online life with remote administration software, which seems to be the whole point of so many scams these days. Because why rob just one online account when you can plunder them all?</p>
<p>The best advice to sidestep phishing scams is to avoid clicking on links that arrive unbidden in emails, text messages and other mediums. Most phishing scams invoke a temporal element that warns of dire consequences should you fail to respond or act quickly. If you’re unsure whether the message is legitimate, take a deep breath and visit the site or service in question manually — ideally, using a browser bookmark to avoid <a href="https://krebsonsecurity.com/?s=typosquatting&amp;x=0&amp;y=0" target="_blank" rel="noopener">potential typosquatting sites</a>.</p>


feed_id: https://krebsonsecurity.com/?p=61064
title: How 1-Time Passcodes Became a Corporate Liability
uri: How-1-Time-Passcodes-Became-a-Corporate-Liability
url: https://krebsonsecurity.com/2022/08/how-1-time-passcodes-became-a-corporate-liability/
content:
<p>Phishers are enjoying remarkable success using text messages to steal remote access credentials and one-time passcodes from employees at some of the world&#8217;s largest technology companies and customer support firms. A recent spate of SMS phishing attacks from one cybercriminal group has spawned a flurry of breach disclosures from affected companies, which are all struggling to combat the same lingering security threat: The ability of scammers to interact directly with employees through their mobile devices.</p>
<p><img class="aligncenter wp-image-45224" src="media/57d2a628.phonescam.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/09/phonescam.png" alt="" width="751" height="473" /></p>
<p>In mid-June 2022, a flood of SMS phishing messages began targeting employees at commercial staffing firms that provide customer support and outsourcing to thousands of companies. The missives asked users to click a link and log in at a phishing page that mimicked their employer&#8217;s Okta authentication page. Those who submitted credentials were then prompted to provide the one-time password needed for multi-factor authentication.</p>
<p>The phishers behind this scheme used newly-registered domains that often included the name of the target company, and sent text messages urging employees to click on links to these domains to view information about a pending change in their work schedule.</p>
<p>The phishing sites leveraged a Telegram instant message bot to forward any submitted credentials in real-time, allowing the attackers to use the phished username, password and one-time code to log in as that employee at the real employer website. But because of the way the bot was configured, it was possible for security researchers to capture the information being sent by victims to the public Telegram server.</p>
<p>This data trove was first reported by security researchers at Singapore-based <strong>Group-IB</strong>, which dubbed the campaign &#8220;0ktapus&#8221; for the attackers targeting organizations using identity management tools from <strong>Okta.com</strong>.</p>
<p>&#8220;This case is of interest because despite using low-skill methods it was able to compromise a large number of well-known organizations,&#8221; Group-IB <a href="https://blog.group-ib.com/0ktapus" target="_blank" rel="noopener">wrote</a>. &#8220;Furthermore, once the attackers compromised an organization they were quickly able to pivot and launch subsequent supply chain attacks, indicating that the attack was planned carefully in advance.&#8221;</p>
<p>It&#8217;s not clear how many of these phishing text messages were sent out, but the Telegram bot data reviewed by KrebsOnSecurity shows they generated nearly 10,000 replies over approximately two months of sporadic SMS phishing attacks targeting more than a hundred companies.</p>
<p>A great many responses came from those who were apparently wise to the scheme, as evidenced by the hundreds of hostile replies that included profanity or insults aimed at the phishers: The very first reply recorded in the Telegram bot data came from one such employee, who responded with the username &#8220;havefuninjail.&#8221;</p>
<p>Still, thousands replied with what appear to be legitimate credentials &#8212; many of them including one-time codes needed for multi-factor authentication. On July 20, the attackers turned their sights on internet infrastructure giant <strong>Cloudflare.com</strong>, and the intercepted credentials show at least five employees fell for the scam (although only two employees also provided the crucial one-time MFA code).</p>
<div id="attachment_61077" style="width: 576px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-61077" loading="lazy" class="size-full wp-image-61077" src="media/478a137b.CF-oktaphish.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/08/CF-oktaphish.png" alt="" width="566" height="471" /><p id="caption-attachment-61077" class="wp-caption-text">Image: Cloudflare.com</p></div>
<p>In <a href="https://blog.cloudflare.com/2022-07-sms-phishing-attacks/" target="_blank" rel="noopener">a blog post</a> earlier this month, Cloudflare said it detected the account takeovers and that no Cloudflare systems were compromised. But Cloudflare said it wanted to call attention to the phishing attacks because they would probably work against most other companies.</p>
<p>&#8220;This was a sophisticated attack targeting employees and systems in such a way that we believe most organizations would be likely to be breached,&#8221; Cloudflare CEO <strong>Matthew Prince</strong> wrote. &#8220;On July 20, 2022, the Cloudflare Security team received reports of employees receiving legitimate-looking text messages pointing to what appeared to be a Cloudflare Okta login page. The messages began at 2022-07-20 22:50 UTC. Over the course of less than 1 minute, at least 76 employees received text messages on their personal and work phones. Some messages were also sent to the employees family members.&#8221;</p>
<p>On three separate occasions, the phishers targeted employees at <strong>Twilio.com</strong>, a San Francisco based company that provides services for making and receiving text messages and phone calls. It&#8217;s unclear how many Twilio employees received the SMS phishes, but the data suggest at least four Twilio employees responded to a spate of SMS phishing attempts on July 27, Aug. 2, and Aug. 7.</p>
<p><img loading="lazy" class="aligncenter size-full wp-image-61078" src="media/70fc6af9.twiliophish.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/08/twiliophish.png" alt="" width="644" height="471" /></p>
<p>On that last date, Twilio <a href="https://www.twilio.com/blog/august-2022-social-engineering-attack" target="_blank" rel="noopener">disclosed</a> that on Aug. 4 it became aware of unauthorized access to information related to a limited number of Twilio customer accounts through a sophisticated social engineering attack designed to steal employee credentials.</p>
<p>&#8220;This broad based attack against our employee base succeeded in fooling some employees into providing their credentials,&#8221; Twilio said. &#8220;The attackers then used the stolen credentials to gain access to some of our internal systems, where they were able to access certain customer data.&#8221;</p>
<p>That &#8220;certain customer data&#8221; included information on roughly 1,900 users of the secure messaging app <strong>Signal</strong>, which relied on Twilio to provide phone number verification services. In its disclosure on the incident, Signal said that with their access to Twilio&#8217;s internal tools the attackers were able to re-register those users&#8217; phone numbers to another device.</p>
<p>On Aug. 25, food delivery service <strong>DoorDash</strong> <a href="https://doordash.news/get-the-facts/how-were-responding-to-a-third-party-vendor-phishing-incident/" target="_blank" rel="noopener">disclosed</a> that a &#8220;sophisticated phishing attack&#8221; on a third-party vendor allowed attackers to gain access to some of DoorDash&#8217;s internal company tools. DoorDash said intruders stole information on a &#8220;small percentage&#8221; of users that have since been notified. TechCrunch <a href="https://techcrunch.com/2022/08/25/doordash-customer-data-breach-twilio/" target="_blank" rel="noopener">reported last week</a> that the incident was linked to the same phishing campaign that targeted Twilio.</p>
<p>This phishing gang apparently had great success targeting employees of all the major mobile wireless providers, but most especially <strong>T-Mobile</strong>. Between July 10 and July 16, dozens of T-Mobile employees fell for the phishing messages and provided their remote access credentials.</p>
<p>&#8220;Credential theft continues to be an ongoing issue in our industry as wireless providers are constantly battling bad actors that are focused on finding new ways to pursue illegal activities like this,&#8221; T-Mobile said in a statement. &#8220;Our tools and teams worked as designed to quickly identify and respond to this large-scale smishing attack earlier this year that targeted many companies. We continue to work to prevent these types of attacks and will continue to evolve and improve our approach.&#8221;</p>
<p>This same group saw hundreds of responses from employees at some of the largest customer support and staffing firms, including <strong>Teleperformanceusa.com</strong>, <strong>Sitel.com </strong>and <strong>Sykes.com</strong>. Teleperformance did not respond to requests for comment. KrebsOnSecurity did hear from <a href="https://www.linkedin.com/in/ceknauer/" target="_blank" rel="noopener">Christopher Knauer</a>, global chief security officer at <strong>Sitel Group</strong>, the customer support giant that recently acquired Sykes. Knauer said the attacks leveraged newly-registered domains and asked employees to approve upcoming changes to their work schedules.</p>
<div id="attachment_61082" style="width: 762px" class="wp-caption aligncenter"><a href="media/966c429c.0kta-gib.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/08/0kta-gib.png" target="_blank" rel="noopener"><img aria-describedby="caption-attachment-61082" loading="lazy" class="wp-image-61082" src="media/966c429c.0kta-gib.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/08/0kta-gib.png" alt="" width="752" height="412" srcset="https://krebsonsecurity.com/wp-content/uploads/2022/08/0kta-gib.png 940w, https://krebsonsecurity.com/wp-content/uploads/2022/08/0kta-gib-768x421.png 768w, https://krebsonsecurity.com/wp-content/uploads/2022/08/0kta-gib-782x428.png 782w" sizes="(max-width: 752px) 100vw, 752px" /></a><p id="caption-attachment-61082" class="wp-caption-text">Image: Group-IB.</p></div>
<p>Knauer said the attackers set up the phishing domains just minutes in advance of spamming links to those domains in phony SMS alerts to targeted employees. He said such tactics largely sidestep automated alerts generated by companies that monitor brand names for signs of new phishing domains being registered.</p>
<p>&#8220;They were using the domains as soon as they became available,&#8221; Knauer said. &#8220;The alerting services don&#8217;t often let you know until 24 hours after a domain has been registered.&#8221;<span id="more-61064"></span></p>
<p>On July 28 and again on Aug. 7, several employees at email delivery firm <strong>Mailchimp</strong> provided their remote access credentials to this phishing group. According to <a href="https://mailchimp.com/august-2022-security-incident/?ref=newsroom" target="_blank" rel="noopener">an Aug. 12 blog post</a>, the attackers used their access to Mailchimp employee accounts to steal data from 214 customers involved in cryptocurrency and finance.</p>
<p>On Aug. 15, the hosting company <strong>DigitalOcean</strong> published <a href="https://www.digitalocean.com/blog/digitalocean-response-to-mailchimp-security-incident" target="_blank" rel="noopener">a blog post</a> saying it had severed ties with MailChimp after its Mailchimp account was compromised. DigitalOcean said the MailChimp incident resulted in a &#8220;very small number&#8221; of DigitalOcean customers experiencing attempted compromises of their accounts through password resets.</p>
<p>According to interviews with multiple companies hit by the group, the attackers are mostly interested in stealing access to cryptocurrency, and to companies that manage communications with people interested in cryptocurrency investing. In <a href="https://www.klaviyo.com/blog/august-2022-security-incident" target="_blank" rel="noopener">an Aug. 3 blog post</a> from email and SMS marketing firm <strong>Klaviyo.com</strong>, the company&#8217;s CEO recounted how the phishers gained access to the company&#8217;s internal tools, and used that to download information on 38 crypto-related accounts.</p>
<p>The ubiquity of mobile phones became a lifeline for many companies trying to manage their remote employees throughout the Coronavirus pandemic. But these same mobile devices are fast becoming a liability for organizations that use them for phishable forms of multi-factor authentication, such as one-time codes generated by a mobile app or delivered via SMS.</p>
<p>Because as we can see from the success of this phishing group, this type of data extraction is now being massively automated, and employee authentication compromises can quickly lead to security and privacy risks for the employer&#8217;s partners or for anyone in their supply chain.</p>
<p>Unfortunately, a great many companies still rely on SMS for employee multi-factor authentication. According to a report this year from Okta, 47 percent of workforce customers deploy SMS and voice factors for multi-factor authentication. That&#8217;s down from 53 percent that did so in 2018, Okta found.</p>
<p>Some companies (like Knauer&#8217;s Sitel) have taken to requiring that all remote access to internal networks be managed through work-issued laptops and/or mobile devices, which are loaded with custom profiles that can&#8217;t be accessed through other devices.</p>
<p>Others are moving away from SMS and one-time code apps and toward requiring employees to use physical FIDO multi-factor authentication devices such as <a href="https://krebsonsecurity.com/tag/security-keys/" target="_blank" rel="noopener">security keys</a>, which can neutralize phishing attacks because any stolen credentials can&#8217;t be used unless the phishers also have physical access to the user&#8217;s security key or mobile device.</p>
<p>This came in handy for <strong>Twitter</strong>, which announced last year that it was moving all of its employees to using security keys, and/or biometric authentication via their mobile device. The phishers&#8217; Telegram bot reported that on June 16, 2022, five employees at Twitter gave away their work credentials. In response to questions from KrebsOnSecurity, Twitter confirmed several employees were relieved of their employee usernames and passwords, but that its security key requirement prevented the phishers from abusing that information.</p>
<p>Twitter accelerated its plans to improve employee authentication following the <a href="https://krebsonsecurity.com/2020/07/whos-behind-wednesdays-epic-twitter-hack/" target="_blank" rel="noopener">July 2020 security incident</a>, wherein several employees were phished and relieved of credentials for Twitter&#8217;s internal tools. In that intrusion, the attackers used Twitter&#8217;s tools to hijack accounts for some of the world’s most recognizable public figures, executives and celebrities &#8212; forcing those accounts to tweet out links to bitcoin scams.</p>
<p>&#8220;Security keys can differentiate legitimate sites from malicious ones and block phishing attempts that SMS 2FA or one-time password (OTP) verification codes would not,&#8221; Twitter said in an Oct. 2021 post about the change. &#8220;To deploy security keys internally at Twitter, we migrated from a variety of phishable 2FA methods to using security keys as our only supported 2FA method on internal systems.&#8221;</p>


feed_id: https://krebsonsecurity.com/?p=61106
title: Final Thoughts on Ubiquiti
uri: Final-Thoughts-on-Ubiquiti
url: https://krebsonsecurity.com/2022/08/final-thoughts-on-ubiquiti/
content:
<p>Last year, I posted a series of articles about a purported &#8220;breach&#8221; at Ubiquiti. My sole source for that reporting was the person who has since been indicted by federal prosecutors for his alleged wrongdoing – which includes providing false information to the press.</p>
<p>As a result of the new information that has been provided to me, I no longer have faith in the veracity of my source or the information he provided to me. I always endeavor to ensure that my articles are properly sourced and factual.</p>
<p>This time, I missed the mark and, as a result, I would like to extend my sincerest apologies to Ubiquiti, and I have decided to remove those articles from my website.</p>


feed_id: https://krebsonsecurity.com/?p=61122
title: Violence-as-a-Service: Brickings, Firebombings & Shootings for Hire
uri: Violence-as-a-Service-Brickings-Firebombings-Shootings-for-Hire
url:
https://krebsonsecurity.com/2022/09/violence-as-a-service-brickings-firebombings-shootings-for-hire/

content:
<p>A 21-year-old New Jersey man has been arrested and charged with stalking in connection with a federal investigation into groups of cybercriminals who are settling scores by hiring people to carry out physical attacks on their rivals. Prosecutors say the defendant recently participated in several of these schemes &#8212; including firing a handgun into a Pennsylvania home and torching a residence in another part of the state with a Molotov Cocktail. </p>
<p><strong>Patrick McGovern-Allen</strong> of Egg Harbor Township, N.J. was arrested on Aug. 12 on a warrant from the <strong>U.S. Federal Bureau of Investigation</strong>. An FBI complaint alleges McGovern-Allen was part of a group of co-conspirators who are at the forefront of a dangerous escalation in coercion and intimidation tactics increasingly used by competing cybercriminal groups.</p>
<p>Prosecutors say that around 2 a.m. on Jan 2, 2022, McGovern-Allen and an unidentified co-conspirator fired multiple handgun rounds into a residence in West Chester, Pa. Fortunately, none of the residents inside the home at the time were injured. But prosecutors say the assailants actually recorded video of the attack as &#8220;proof&#8221; that the shooting had been carried out. </p>
<p>A copy of that video was obtained by KrebsOnSecurity. According to investigators, McGovern-Allen was one of the shooters, who yelled &#8220;Justin Active was here&#8221; as they haphazardly fired at least eight rounds into the lower story of the West Chester residence. </p>
<div align="center"><iframe width="660" height="315" src="https://www.youtube.com/embed/7OE2FnK7dVg" title="YouTube video player" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture" allowfullscreen></iframe></div>
<p>On Dec. 18, 2021, police in Abington Township, Pa., responded to reports of a house fire from homeowners who said it sounded like something was thrown at their residence just prior to the fire.  </p>
<p>Weeks later, on the day of the shooting in West Chester, a detective with the Westtown East Goshen Police Department contacted the Abington police and shared another video that was circulating on several online message boards that appeared to show two individuals setting fire to the Abington Township residence. The criminal complaint said the two police officers agreed the same suspect was present in both videos.</p>
<p>A copy of that video was obtained by KrebsOnSecurity, and it shows at least two individuals smashing a window, then lighting a rag-soaked Mad Dog 20/20 grape wine bottle and hurling it at the side of the home. </p>
<div align="center"><iframe loading="lazy" width="660" height="315" src="https://www.youtube.com/embed/zfKuc6OgBbY" title="YouTube video player" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture" allowfullscreen></iframe></div>
<p>&#8220;The Molotov cocktail caused the immediate surrounding area to ignite, including the siding of the house, grass, and the wooded chair,&#8221; the government&#8217;s complaint against McGovern-Allen states. &#8220;The two suspects then fled on foot toward the street and begin yelling something when the video stops.&#8221;</p>
<p>The government mentions the victims only by their initials &#8212; &#8220;K.M.&#8221; in the shooting and &#8220;M.K&#8221; in the firebombing &#8212; but said both had been the target of previous harassment by rival cybercriminal groups that included <a href="https://krebsonsecurity.com/?s=swatting" rel="noopener" target="_blank">swatting attacks</a>, wherein the perpetrators spoof a distress call to the police about a hostage situation, suicide or bomb threat with the goal of sending a heavily-armed police response to a targeted address.</p>
<p>A number of previous swatting incidents <a href="https://krebsonsecurity.com/?s=swatting+death" rel="noopener" target="_blank">have turned deadly</a>. But these more &#8220;hands-on&#8221; and first person attacks are becoming increasingly common within certain cybercriminal communities, particularly those engaged in <a href="https://krebsonsecurity.com/category/sim-swapping/" rel="noopener" target="_blank">SIM swapping</a>, a crime in which identity thieves hijack a target’s mobile phone number and use that to wrest control over the victim’s various online accounts and identities. </p>
<p>The complaint mentions a handle and user ID allegedly used by McGovern-Allen&#8217;s online persona &#8220;Tongue&#8221; on the Discord chat service, (user: &#8220;Tongue#001&#8221;). </p>
<p>&#8220;In the chats, [Tongue] tells other Discord users that he was the person who shot K.M.&#8217;s house and that he was willing to commit firebombings using Molotov Cocktails,&#8221; the complaint alleges. &#8220;For example, in one Discord chat from March 2022, [the defendant] states &#8216;if you need anything done for $ lmk [&#8220;let me know&#8221;]/I did a shooting/Molotov/but I can also do things for ur entertainment.&#8221;<span id="more-61122"></span></p>
<p>KrebsOnsecurity reviewed hundreds of chat records tied to this Tongue alias, and it appears both attacks were motivated by a desire to get back at a rival cybercriminal by attacking the female friends of that rival. </p>
<p>Recall that the shooters in the West Chester, Pa. incident shouted &#8220;Justin Active was here.&#8221; Justin Active is the nickname of an individual who is just as active in the same cybercriminal channels, but who has vehemently denied knowledge of or participation in the shooting. Justin Active said on Telegram that the person targeted in the shooting was his ex-girlfriend, and that the firebombing targeted another friend of his. </p>
<p>Justin Active has claimed for months that McGovern-Allen was responsible for both attacks, saying they were intended as an intimidation tactic against him. &#8220;DO THE PATRICK MCGOVERN ALLEN RAID DANCE!,&#8221; Justin Active&#8217;s alias &#8220;Nutcase68&#8221; shouted on Telegram on Aug. 12, the same day McGovern-Allen was arrested by authorities. </p>
<p>Justin Active&#8217;s version of events seems to be supported by a reference in the criminal complaint to an April 2, 2022 chat in which Tongue explained the reason for the shooting.</p>
<p>&#8220;The video/is [K]&#8217;s house/getting shit/shot/justin active/ was her current bf/ the reason it happened,&#8221; Tongue explained. &#8220;So that&#8217;s why Justin active was there.&#8221; </p>
<p>The Telegram chat channels that Justin Active and Tongue both frequented have hundreds to thousands of members each, and some of the more interesting solicitations on these communities are job offers for in-person assignments and tasks that can be found if one searches for posts titled, &#8220;If you live near,&#8221; or &#8220;IRL job&#8221; &#8212; short for &#8220;in real life&#8221; job.</p>
<p><img loading="lazy" src="media/5c0377d8.simrealm-e.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/09/simrealm-e.png" alt="" width="580" height="387" class="aligncenter size-full wp-image-61133" /></p>
<p>A number of these classified ads are in service of performing &#8220;brickings,&#8221; where someone is hired to visit a specific address and toss a brick through the target&#8217;s window. </p>
<p>&#8220;If you live near Edmonton Canada dm me need someone bricked,&#8221; reads on Telegram message on May 31, 2022. </p>
<p>&#8220;If you live near [address redacted] Lakewood, CA, dm [redacted] Paying 3k to slash the tires,&#8221; reads another help wanted ad in the same channel on Feb. 24, 2022. &#8220;If you live near here and can brick them, dm [address omitted] Richland, WA,&#8221; reads another from that same day.</p>
<p><img loading="lazy" src="media/adb4c256.callers.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/09/callers.png" alt="" width="580" height="141" class="aligncenter size-full wp-image-61131" /></p>
<p>McGovern-Allen was in the news not long ago. According to <a href="https://pressofatlanticcity.com/news/crime/egg-harbor-township-man-injured-after-driving-into-pleasantville-building/article_aebb289d-940c-573e-ada3-7c4ec9768d0d.html" rel="noopener" target="_blank">a Sept. 2020 story</a> from <em>The Press of Atlantic City</em>, a then 19-year-old Patrick McGovern Allen was injured after driving into a building and forcing residents from their home.</p>
<p>&#8220;Police found a 2007 Lexus, driven by Patrick McGovern-Allen, 19, that had lost control and left the road, crashing into the eastern end of the 1600 building,&#8221; the story recounted. &#8220;The car was driven through the steps that provide access to the second-floor apartments, destroying them, and also caused damage to the outer wall.&#8221;</p>
<p><img loading="lazy" src="media/7fc5897a.ma-housecrash.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/09/ma-housecrash.png" alt="" width="686" height="633" class="aligncenter size-full wp-image-61157" /></p>
<p>A search on the Inmate Locator of the U.S. Bureau of Prisons website shows that McGovern-Allen remains in federal custody at a detention facility in Philadelphia. He&#8217;s currently represented by a public defender who has not responded to requests for comment.</p>
<p>A copy of the criminal complaint against McGovern-Allen is available <a href="media/568266dc.gov.uscourts.paed.599644.1.0.pdf" data-original-source="https://storage.courtlistener.com/recap/gov.uscourts.paed.599644/gov.uscourts.paed.599644.1.0.pdf" rel="noopener" target="_blank">here</a> (PDF).</p>
<h2>ANALYSIS</h2>
<p>Many of the individuals involved in paying others to commit these physical attacks are also frequent participants in several Telegram channels focused singularly on SIM swapping activity. As a result, the vast majority of the people being targeted for brickings and other real-life physical assaults tend to be other cybercriminals involved in SIM swapping crimes (or individuals on the periphery of that scene).</p>
<p>There are dozens of SIM swappers who are now teenage or 20-something millionaires, by virtue of having stolen vast sums of cryptocurrencies from SIM swapping victims. And now many of these same individuals are finding that communities like Telegram can be leveraged to hire physical harassment and intimidation of their rivals and competitors.</p>
<p>The primary barrier to hiring someone to brick a home or slash some tires seems to be the costs involved: A number of solicitations for these services advertised payment of $3,000 or more upon proof of successful completion, which usually involves recording the attack and hiring a getaway driver in the town where the crime is to take place (calling a cab or hailing an Uber from the scene of a bricking isn&#8217;t the brightest idea).</p>
<p>My fear is these violence-as-a-service offerings will at some point migrate outside of the SIM swapping communities. This is precisely what happened with swatting, which for years was a crime perpetrated almost exclusively against online gamers and people streaming their games online. These days, swatting attacks are commonly used by SIM swapping groups as a way <a href="https://krebsonsecurity.com/2021/07/plugwalkjoe-does-the-perp-walk/" rel="noopener" target="_blank">to harass and extort regular Internet users into giving up prized social media account names that can be resold for thousands of dollars</a>.</p>


feed_id: https://krebsonsecurity.com/?p=60802
title: Transacting in Person with Strangers from the Internet
uri: Transacting-in-Person-with-Strangers-from-the-Internet
url: https://krebsonsecurity.com/2022/09/transacting-in-person-with-strangers-from-the-internet/
content:
<p>Communities like <strong>Craigslist</strong>, <strong>OfferUp</strong>, <strong>Facebook Marketplace</strong> and others are great for finding low- or no-cost stuff that one can pick up directly from a nearby seller, and for getting rid of useful things that don&#8217;t deserve to end up in a landfill. But when dealing with strangers from the Internet, there is always a risk that the person you&#8217;ve agreed to meet has other intentions.</p>
<p>Nearly all U.S. states now have designated safe trading stations &#8212; mostly at local police departments &#8212; which ensure that all transactions are handled in plain view of both the authorities and security cameras.</p>
<p><img class="aligncenter size-full wp-image-61191" src="media/59201fc1.internetxchangesafe.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/09/internetxchangesafe.png" alt="" width="476" height="595" /></p>
<p>These safe trading places exist is because sometimes in-person transactions from the Internet don&#8217;t end well for one or more parties involved. The website <a href="http://craigslistkillings.blogspot.com/" target="_blank" rel="noopener">Craigslistkillers</a> has catalogued news links for at least 132 murders linked to Craigslist transactions since 2015. Many of these killings involved high-priced items like automobiles and consumer electronics, where the prospective buyer apparently intended all along to kill the owner and steal the item offered for sale. Others were motivated simply by a desire to hurt people.</p>
<p>This is not to say that using Craigslist is uniquely risky or dangerous; I&#8217;m sure the vast majority of transactions generated by the site end amicably and without physical violence. And that probably holds true for all of Craigslist&#8217;s competitors.</p>
<p>Still, the risk of a deal going badly when one meets total strangers from the Internet is not zero, and so it&#8217;s only sensible to take a few simple precautions. For example, choosing to transact at a designated safe place such as a police station dramatically reduces the likelihood that anyone wishing you harm would even show up.</p>
<p>I recently stumbled upon one of these designated exchange places by accident, hence my interest in learning more about them. The one I encountered was at a Virginia county sheriff&#8217;s office, and it has two parking spots reserved with a sign that reads, &#8220;Internet Purchase &amp; Exchange Location: This Area is Under 24 Hour Video Surveillance&#8221; [image above].</p>
<p>According to the list maintained at <a href="http://www.safetradestations.com/safetrade-station-list.html" target="_blank" rel="noopener">Safetradestations.com</a>, there are four other such designated locations in Northern Virginia. And it appears most states now have them in at least some major cities. <strong>Safeexchangepoint.com</strong> also has <a href="https://safeexchangepoint.com/safe-exchange-point-directory/" target="_blank" rel="noopener">a searchable index</a> of safe trading locations in the United States and Canada.</p>
<p>Granted, not everyone is going to live close to one of these designated trading stations. Or maybe what you want to buy, sell or trade you&#8217;d rather not have recorded in front of police cameras. Either way, here are a few tips on staying safe while transacting in real life with strangers from the Internet (compliments of the aforementioned safe trading websites).<span id="more-60802"></span></p>
<p>The safest exchange points are easily accessible and in a well-lit, public place where transactions are visible to others nearby. Try to arrange a meeting time that is during daylight hours, and consider bringing a friend along &#8212; especially when dealing with high-value items like laptops and smart phones.</p>
<p>Safeexchangepoint.com also advises that police or merchants that host their own exchange locations generally won&#8217;t get involved in the details of your transaction unless specified otherwise, and that many police departments (but not all) are willing to check the serial number of an item for sale to make sure it&#8217;s not known to be stolen property.</p>
<p>Of course, it&#8217;s not always practical or possible to haul that old sofa to the local police department, or a used car that isn&#8217;t working. In those situations, safetradestations.com has some decent suggestions:</p>
<ul>
<li>Meet at a police station where you can exchange and photocopy each others’ identification papers, such as a driver’s license. Do NOT carry cash to this location.</li>
<li>Photocopy the license or identification paper, or use your phone to photograph it.</li>
<li>Email the ID information to a friend, or to someone trusted (not to yourself).</li>
<li>If you’re selling at home, or going to someone’s home, never be outnumbered. If you’re at home, make sure you have two or three people there &#8212; and tell the person who is coming that you will have others with you.</li>
<li>At home or an apartment, NEVER let someone go anywhere unaccompanied. Always make sure they are escorted.</li>
<li>Never let more than one group come to your home at one time to buy or sell.</li>
<li>Beware of common scams, like checks for an amount higher than the amount of the deal; “cashier’s checks” that are forged and presented when the bank is closed.</li>
<li>If you are given a cashier’s check, money order or other equivalent, call the bank &#8212; at the number listed online, not a number the buyer gives you &#8212; to verify the validity of the check.</li>
</ul>


feed_id: https://krebsonsecurity.com/?p=61216
title: Wormable Flaw, 0days Lead Sept. 2022 Patch Tuesday
uri: Wormable-Flaw-0days-Lead-Sept-2022-Patch-Tuesday
url: https://krebsonsecurity.com/2022/09/wormable-flaw-0days-lead-sept-2022-patch-tuesday/
content:
<p>This month&#8217;s Patch Tuesday offers a little something for everyone, including security updates for a zero-day flaw in <strong>Microsoft Windows</strong> that is under active attack, and another Windows weakness experts say could be used to power a fast-spreading computer worm. Also, <strong>Apple</strong> has also quashed a pair of zero-day bugs affecting certain macOS and iOS users, and released <strong>iOS 16</strong>, which offers a new privacy and security feature called &#8220;<strong>Lockdown Mode</strong>.&#8221; And <strong>Adobe</strong> axed 63 vulnerabilities in a range of products.</p>
<p><img class="aligncenter  wp-image-61231" src="media/08ca778d.computerguys.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/09/computerguys.png" alt="" width="757" height="504" /></p>
<p>Microsoft today released software patches to plug at least 64 security holes in Windows and related products. Worst in terms of outright scariness is <a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-37969" target="_blank" rel="noopener">CVE-2022-37969</a>, which is a &#8220;privilege escalation&#8221; weakness in the <strong>Windows Common Log File System Driver</strong> that allows attackers to gain SYSTEM-level privileges on a vulnerable host. Microsoft says this flaw is already being exploited in the wild.</p>
<p><strong>Kevin Breen</strong>, director of cyber threat research at <strong>Immersive Labs</strong>, said any vulnerability that is actively targeted by attackers in the wild must be put to the top of any patching list.</p>
<p>&#8220;Not to be fooled by its relatively low CVSS score of 7.8, privilege escalation vulnerabilities are often highly sought after by cyber attackers,&#8221; Breen said. &#8220;Once an attacker has managed to gain a foothold on a victim’s system, one of their first actions will be to gain a higher level of permissions, allowing the attacker to disable security applications and any device monitoring. There is no known workaround to date, so patching is the only effective mitigation.&#8221;</p>
<p><strong>Satnam Narang</strong> at <strong>Tenable</strong> said <a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24521" target="_blank" rel="noopener">CVE-2022-24521</a> &#8212; a similar vulnerability in the same Windows log file component &#8212; was patched earlier this year as part of <a href="https://krebsonsecurity.com/2022/04/microsoft-patch-tuesday-april-2022-edition/" target="_blank" rel="noopener">Microsoft’s April Patch Tuesday release</a> and was also exploited in the wild.</p>
<p>&#8220;CVE-2022-37969 was disclosed by several groups, though it’s unclear if CVE-2022-37969 is a patch-bypass for CVE-2022-24521 at this point,&#8221; Narang said.</p>
<p>Another vulnerability Microsoft patched this month &#8212; <a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-35803" target="_blank" rel="noopener">CVE-2022-35803</a> &#8212; also seems to be related to the same Windows log file component. While there are no indications CVE-2022-35803 is being actively exploited, Microsoft suggests that exploitation of this flaw is more likely than not.</p>
<p>Trend Micro&#8217;s <strong>Dustin Childs</strong> called attention to <a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-34718" target="_blank" rel="noopener">CVE-2022-34718</a>, a remote code execution flaw in the <strong>Windows TCP/IP</strong> service that could allow an unauthenticated attacker to execute code with elevated privileges on affected systems without user interaction.</p>
<p>&#8220;That officially puts it into the &#8216;wormable&#8217; category and earns it a CVSS rating of 9.8,&#8221; Childs said. &#8220;However, only systems with IPv6 enabled and IPSec configured are vulnerable. While good news for some, if you’re using IPv6 (as many are), you’re probably running IPSec as well. Definitely test and deploy this update quickly.&#8221;</p>
<p><strong>Cisco Talos</strong> warns about four critical vulnerabilities fixed this month &#8212; <a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-34721" target="_blank" rel="noopener noreferrer" data-ss1663101811="1">CVE-2022-34721</a> and <a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-34722" target="_blank" rel="noopener noreferrer" data-ss1663101811="1">CVE-2022-34722</a> &#8212; which have severity scores of 9.8, though they are “less likely” to be exploited, according to Microsoft.</p>
<p>&#8220;These are remote code execution vulnerabilities in the <strong>Windows Internet Key Exchange</strong> protocol that could be triggered if an attacker sends a specially crafted IP packet,&#8221; <a href="https://blog.talosintelligence.com/2022/09/microsoft-patch-tuesday-for-september.html" target="_blank" rel="noopener">wrote</a> <strong>Jon Munshaw</strong> and <strong>Asheer Malhotra</strong>. &#8220;Two other critical vulnerabilities, <a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-35805" target="_blank" rel="noopener noreferrer" data-ss1663101811="1">CVE-2022-35805</a> and <a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-34700" target="_blank" rel="noopener noreferrer" data-ss1663101811="1">CVE-2022-34700</a> exist in on-premises instances of <strong>Microsoft Dynamics 365</strong>. An authenticated attacker could exploit these vulnerabilities to run a specially crafted trusted solution package and execute arbitrary SQL commands. The attacker could escalate their privileges further and execute commands as the database owner.&#8221;<span id="more-61216"></span></p>
<p><img loading="lazy" class="alignright size-full wp-image-61232" src="media/d8734e25.lockdownmode.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/09/lockdownmode.png" alt="" width="314" height="629" />Not to be outdone, Apple fixed at least two zero-day vulnerabilities when it released updates for iOS, iPadOS, macOS and Safari. CVE-2022-32984 is a problem in the deepest recesses of the operating system (the kernel). Apple pushed <a href="https://nakedsecurity.sophos.com/2022/08/18/apple-patches-double-zero-day-in-browser-and-kernel-update-now/" target="_blank" rel="noopener">an emergency update</a> for a related zero-day last month in CVE-2022-32983, which could be used to foist malware on iPhones, iPads and Macs that visited a booby-trapped website.</p>
<p>Also listed under active attack is <strong>CVE-2022-32817</strong>, which has been fixed on macOS 12.6 (Monterey), macOS 11.7 (Big Sur), iOS 15.7 and iPadOS 15.7, and iOS 16. The same vulnerability <a href="https://support.apple.com/en-us/HT213340" target="_blank" rel="noopener">was fixed in Apple Watch in July 2022</a>, and credits <strong>Xinru Chi</strong> of Japanese cybersecurity firm <strong>Pangu Lab</strong>.</p>
<p>&#8220;Interestingly, this CVE is also listed in the advisory for iOS 16, but it is not called out as being under active exploit for that flavor of the OS,&#8221; Trend Micro&#8217;s Childs noted. &#8220;Apple does state in its iOS 16 advisory that &#8216;Additional CVE entries to be added soon.&#8217; It’s possible other bugs could also impact this version of the OS. Either way, it’s time to update your Apple devices.&#8221;</p>
<p>Apple&#8217;s iOS 16 includes two new security and privacy features &#8212; <a href="https://www.apple.com/newsroom/2022/07/apple-expands-commitment-to-protect-users-from-mercenary-spyware/" target="_blank" rel="noopener">Lockdown Mode</a> and <a href="https://support.apple.com/guide/personal-safety/how-safety-check-works-ips2aad835e1/web" target="_blank" rel="noopener">Safety Check</a>. <strong>Wired.com</strong> describes Safety Check as a feature for users who are at risk for, or currently experiencing, domestic abuse.</p>
<p>&#8220;The tool centralizes a number of controls in one place to make it easier for users to manage and revoke access to their location data and reset privacy-related permissions,&#8221; <a href="https://www.wired.com/story/apple-ios-16-safety-check-lockdown-mode/" target="_blank" rel="noopener">wrote</a> <strong>Lily Hay Newman</strong>.</p>
<p>&#8220;Lockdown Mode, on the other hand, is meant for users who potentially face targeted spyware attacks and aggressive state-backed hacking. The feature comprehensively restricts any nonessential iOS features so there are as few potential points of entry to a device as possible. As more governments and repressive entities around the world have begun purchasing powerful commodity spyware to target individuals of particular importance or interest, iOS&#8217;s general security defenses haven&#8217;t been able to keep pace with these specialized threats.&#8221;</p>
<p>To turn on Lockdown Mode in iOS 16, go to <strong>Settings</strong>, then <strong>Privacy and Security</strong>, then <strong>Lockdown Mode</strong>. Safety Check is located in the same area.</p>
<p>Finally, Adobe released <a href="https://helpx.adobe.com/security.html" target="_blank" rel="noopener">seven patches</a> addressing 63 security holes in <strong>Adobe Experience Manager</strong>, <strong>Bridge</strong>, <strong>InDesign</strong>, <strong>Photoshop</strong>, <strong>InCopy</strong>, <strong>Animate</strong>, and <strong>Illustrator</strong>. More on those updates is <a href="https://helpx.adobe.com/security.html" target="_blank" rel="noopener">here</a>.</p>
<p>Don&#8217;t forget to back up your data and/or system before applying any security updates. If you experience glitches or problems installing any of these patches this month, please consider leaving a comment about it below; there’s a decent chance other readers have experienced the same and may chime in here with useful tips.</p>


feed_id: https://krebsonsecurity.com/?p=61241
title: Say Hello to Crazy Thin ‘Deep Insert’ ATM Skimmers
uri: Say-Hello-to-Crazy-Thin-Deep-Insert-ATM-Skimmers
url: https://krebsonsecurity.com/2022/09/say-hello-to-crazy-thin-deep-insert-atm-skimmers/
content:
<p>A number of financial institutions in and around New York City are dealing with a rash of super-thin &#8220;deep insert&#8221; skimming devices designed to fit inside the mouth of an ATM&#8217;s card acceptance slot. The card skimmers are paired with tiny pinhole cameras that are cleverly disguised as part of the cash machine. Here&#8217;s a look at some of the more sophisticated deep insert skimmer technology that fraud investigators have recently found in the wild.</p>
<div id="attachment_61243" style="width: 842px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-61243" class="size-full wp-image-61243" src="media/9f2120e6.nyinsertskimmer.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/09/nyinsertskimmer.png" alt="" width="832" height="351" srcset="https://krebsonsecurity.com/wp-content/uploads/2022/09/nyinsertskimmer.png 832w, https://krebsonsecurity.com/wp-content/uploads/2022/09/nyinsertskimmer-768x324.png 768w, https://krebsonsecurity.com/wp-content/uploads/2022/09/nyinsertskimmer-782x330.png 782w" sizes="(max-width: 832px) 100vw, 832px" /><p id="caption-attachment-61243" class="wp-caption-text">This ultra thin and flexible &#8220;deep insert&#8221; skimmer recently recovered from an NCR cash machine in New York is about half the height of a U.S. dime. The large yellow rectangle is a battery. Image: KrebsOnSecurity.com.</p></div>
<p>The insert skimmer pictured above is approximately .68 millimeters tall. This leaves more than enough space to accommodate most payment cards (~.54 mm) without interrupting the machine&#8217;s ability to grab and return the customer&#8217;s card. For comparison, this flexible skimmer is about half the height of a U.S. dime (1.35 mm).</p>
<p>These skimmers do not attempt to siphon chip-card data or transactions, but rather are after the cardholder data still stored in plain text on the magnetic stripe on the back of most payment cards issued to Americans.</p>
<p>Here&#8217;s what the other side of that insert skimmer looks like:</p>
<div id="attachment_61247" style="width: 761px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-61247" loading="lazy" class=" wp-image-61247" src="media/ebbe9f11.nyinsertskimmer-rev.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/09/nyinsertskimmer-rev.png" alt="" width="751" height="360" /><p id="caption-attachment-61247" class="wp-caption-text">The other side of the deep insert skimmer. Image: KrebsOnSecurity.com.</p></div>
<p>The thieves who designed this skimmer were after the magnetic stripe data and the customer&#8217;s 4-digit personal identification number (PIN). With those two pieces of data, the crooks can then clone payment cards and use them to siphon money from victim accounts at other ATMs.</p>
<p>To steal PINs, the fraudsters in this case embedded pinhole cameras in a false panel made to fit snugly over the cash machine enclosure on one side of the PIN pad.</p>
<div id="attachment_61245" style="width: 710px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-61245" loading="lazy" class=" wp-image-61245" src="media/8b4d2967.nyatmsidepanels.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/09/nyatmsidepanels.png" alt="" width="700" height="957" /><p id="caption-attachment-61245" class="wp-caption-text">Pinhole cameras were hidden in these false side panels glued to one side of the ATM, and angled toward the PIN pad. Image: KrebsOnSecurity.com.</p></div>
<p><span id="more-61241"></span></p>
<p>The skimming devices pictured above were pulled from a brand of ATMs made by NCR called the <strong>NCR SelfServ 84 Walk-Up</strong>. In January 2022, NCR produced a report on motorized deep insert skimmers, which offers a closer look at other insert skimmers found targeting this same line of ATMs.</p>
<div id="attachment_61250" style="width: 760px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-61250" loading="lazy" class=" wp-image-61250" src="media/5b1577a7.deepinsert1-ncr.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/09/deepinsert1-ncr.png" alt="" width="750" height="552" /><p id="caption-attachment-61250" class="wp-caption-text">Image: NCR</p></div>
<p>Here are some variations on deep insert skimmers NCR found in recent investigations:</p>
<div id="attachment_61253" style="width: 769px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-61253" loading="lazy" class=" wp-image-61253" src="media/a10ec1db.deepinsertvariation.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/09/deepinsertvariation.png" alt="" width="759" height="389" srcset="https://krebsonsecurity.com/wp-content/uploads/2022/09/deepinsertvariation.png 1067w, https://krebsonsecurity.com/wp-content/uploads/2022/09/deepinsertvariation-768x394.png 768w, https://krebsonsecurity.com/wp-content/uploads/2022/09/deepinsertvariation-782x401.png 782w" sizes="(max-width: 759px) 100vw, 759px" /><p id="caption-attachment-61253" class="wp-caption-text">Variations on deep insert skimmers recently found inside compromised ATMs.</p></div>
<p>The image on the left below shows another deep insert skimmer and its constituent components. The picture on the right shows a battery-operated pinhole camera hidden in a false fascia directly to the right of the ATM&#8217;s PIN pad.</p>
<div id="attachment_61266" style="width: 760px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-61266" loading="lazy" class=" wp-image-61266" src="media/5527325b.skimmercomp.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/09/skimmercomp.png" alt="" width="750" height="424" srcset="https://krebsonsecurity.com/wp-content/uploads/2022/09/skimmercomp.png 904w, https://krebsonsecurity.com/wp-content/uploads/2022/09/skimmercomp-768x434.png 768w, https://krebsonsecurity.com/wp-content/uploads/2022/09/skimmercomp-782x442.png 782w" sizes="(max-width: 750px) 100vw, 750px" /><p id="caption-attachment-61266" class="wp-caption-text">Images: NCR.</p></div>
<p>The NCR report included additional photos that show how fake ATM side panels with the hidden cameras are carefully crafted to slip over top of the real ATM side panels.</p>
<div id="attachment_61254" style="width: 762px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-61254" loading="lazy" class=" wp-image-61254" src="media/97a1d76f.ncrtripanelside.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/09/ncrtripanelside.png" alt="" width="752" height="318" srcset="https://krebsonsecurity.com/wp-content/uploads/2022/09/ncrtripanelside.png 1151w, https://krebsonsecurity.com/wp-content/uploads/2022/09/ncrtripanelside-768x325.png 768w, https://krebsonsecurity.com/wp-content/uploads/2022/09/ncrtripanelside-782x331.png 782w" sizes="(max-width: 752px) 100vw, 752px" /><p id="caption-attachment-61254" class="wp-caption-text">Image: NCR.</p></div>
<p>Sometimes the skimmer thieves embed their pinhole spy cameras in fake panels directly above the PIN pad, as in these recent attacks targeting a similar NCR model:</p>
<div id="attachment_61255" style="width: 767px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-61255" loading="lazy" class=" wp-image-61255" src="media/4c8f71a6.topfasciapanel-ncr.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/09/topfasciapanel-ncr.png" alt="" width="757" height="396" srcset="https://krebsonsecurity.com/wp-content/uploads/2022/09/topfasciapanel-ncr.png 937w, https://krebsonsecurity.com/wp-content/uploads/2022/09/topfasciapanel-ncr-768x402.png 768w, https://krebsonsecurity.com/wp-content/uploads/2022/09/topfasciapanel-ncr-782x409.png 782w, https://krebsonsecurity.com/wp-content/uploads/2022/09/topfasciapanel-ncr-267x140.png 267w" sizes="(max-width: 757px) 100vw, 757px" /><p id="caption-attachment-61255" class="wp-caption-text">Image: NCR</p></div>
<p>In the image below, the thieves hid their pinhole camera in a &#8220;consumer awareness mirror&#8221; placed directly above an ATM retrofitted with an insert skimmer:</p>
<div id="attachment_61256" style="width: 761px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-61256" loading="lazy" class=" wp-image-61256" src="media/421fa769.skimmerpanelmirror.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/09/skimmerpanelmirror.png" alt="" width="751" height="420" srcset="https://krebsonsecurity.com/wp-content/uploads/2022/09/skimmerpanelmirror.png 937w, https://krebsonsecurity.com/wp-content/uploads/2022/09/skimmerpanelmirror-768x429.png 768w, https://krebsonsecurity.com/wp-content/uploads/2022/09/skimmerpanelmirror-782x437.png 782w" sizes="(max-width: 751px) 100vw, 751px" /><p id="caption-attachment-61256" class="wp-caption-text">Image: NCR</p></div>
<p>The financial institution that shared the images above said it has seen success in stopping most of these insert skimmer attacks by incorporating a solution that NCR sells called an &#8220;insert kit,&#8221; which stops current skimmer designs from locating and locking into the card reader. NCR also is conducting field trials on a &#8220;smart detect kit&#8221; that adds a standard USB camera to view the internal card reader area, and uses image recognition software to identify any fraudulent device inside the reader.</p>
<p>Skimming devices will continue to mature in miniaturization and stealth as long as payment cards continue to hold cardholder data in plain text on a magnetic stripe. It may seem silly that we&#8217;ve spent years rolling out more tamper- and clone-proof chip-based payment cards, only to undermine this advance in the name of backwards compatibility. However, there are a great many smaller businesses in the United States that still rely on being able to swipe the customer&#8217;s card.</p>
<p>Many newer ATM models, including the <strong>NCR SelfServ </strong>referenced throughout this post, now include contactless capability, meaning customers no longer need to insert their ATM card anywhere: They can instead just tap their smart card against the wireless indicator to the left of the card acceptance slot (and right below the &#8220;Use Mobile Device Here&#8221; sign on the ATM).</p>
<p>For simple ease-of-use reasons, this contactless feature is now increasingly prevalent at drive-thru ATMs. If your payment card supports contactless technology, you will notice a wireless signal icon printed somewhere on the card &#8212; most likely on the back. ATMs with contactless capabilities also feature this same wireless icon.</p>
<p>Once you become aware of ATM skimmers, it&#8217;s difficult to use a cash machine without also tugging on parts of it to make sure nothing comes off. But the truth is you probably have a better chance of getting physically mugged after withdrawing cash than you do encountering a skimmer in real life.</p>
<p>So keep your wits about you when you’re at the ATM, and avoid dodgy-looking and standalone cash machines in low-lit areas, if possible. When possible, stick to ATMs that are physically installed at a bank. And be especially vigilant when withdrawing cash on the weekends; thieves tend to install skimming devices on Saturdays after business hours — when they know the bank won’t be open again for more than 24 hours.</p>
<p>Lastly but <em>most importantly</em>, <em>covering the PIN pad with your hand</em> defeats one key component of most skimmer scams: The spy camera that thieves typically hide somewhere on or near the compromised ATM to capture customers entering their PINs.</p>
<p>Shockingly, few people bother to take this simple, effective step. Or at least, that&#8217;s what KrebsOnSecurity found in <a href="http://krebsonsecurity.com/2012/09/a-handy-way-to-foil-atm-skimmer-scams/" target="_blank" rel="noopener">this skimmer tale from 2012</a>, wherein we obtained hours worth of video seized from two ATM skimming operations and saw customer after customer walk up, insert their cards and punch in their digits — all in the clear.</p>
<p>If you enjoyed this story, check out these related posts:</p>
<p><a href="https://krebsonsecurity.com/2016/05/crooks-go-deep-with-deep-insert-skimmers/" target="_blank" rel="noopener">Crooks Go Deep With Deep Insert Skimmers</a></p>
<p><a href="https://krebsonsecurity.com/2017/08/dumping-data-from-deep-insert-skimmers/" target="_blank" rel="noopener">Dumping Data from Deep Insert Skimmers</a></p>
<p><a href="https://krebsonsecurity.com/2021/06/how-cyber-sleuths-cracked-an-atm-shimmer-gang/" target="_blank" rel="noopener">How Cyber Sleuths Cracked an ATM Shimmer Gang</a></p>


feed_id: https://krebsonsecurity.com/?p=61281
title: Botched Crypto Mugging Lands Three U.K. Men in Jail
uri: Botched-Crypto-Mugging-Lands-Three-U-K-Men-in-Jail
url: https://krebsonsecurity.com/2022/09/botched-crypto-mugging-lands-three-u-k-men-in-jail/
content:
<p>Three men in the United Kingdom were arrested this month after police responding to an attempted break-in at a residence stopped their car as they fled the scene. The authorities found weapons and a police uniform in the trunk, and say the trio intended to assault a local man and force him to hand over virtual currencies.</p>
<p><img class="aligncenter  wp-image-61303" src="media/f17c5e55.btcbehindbars.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/09/btcbehindbars.png" alt="" width="751" height="420" srcset="https://krebsonsecurity.com/wp-content/uploads/2022/09/btcbehindbars.png 846w, https://krebsonsecurity.com/wp-content/uploads/2022/09/btcbehindbars-768x429.png 768w, https://krebsonsecurity.com/wp-content/uploads/2022/09/btcbehindbars-782x437.png 782w" sizes="(max-width: 751px) 100vw, 751px" /></p>
<p>Shortly after 11 p.m. on September 6, a resident in the Spalding Common area in the district of Lincolnshire, U.K. phoned police to say three men were acting suspiciously, and had jumped a nearby fence.</p>
<p>&#8220;The three men made off in a VW Golf and were shortly stopped nearby,&#8221; reads <a href="https://www.lincs.police.uk/news/lincolnshire/news/2022/sep-2022/three-charged-after-incident-in-spalding/" target="_blank" rel="noopener">a statement</a> by the <strong>Lincolnshire Police</strong>. &#8220;The car was searched by officers who found an imitation firearm, taser, a baseball bat and police uniform in the boot.&#8221;</p>
<p><strong>Thomas Green</strong>, 23, <strong>Rayhan Miah</strong>, 23, and <strong>Leonardo Sapiano</strong>, 24 were all charged with possession of the weapons, and &#8220;<em>with intent to cause loss to another to make an unwarranted demand of Crypto Currency from a person</em>.&#8221;</p>
<p>KrebsOnSecurity has learned that the defendants were in Spalding Common to pay a surprise visit to a 19-year-old hacker known by the handles &#8220;Discoli,&#8221; &#8220;Disco Dog,&#8221; and &#8220;Chinese.&#8221; In December 2020, Discoli took credit for <a href="https://krebsonsecurity.com/2020/12/account-hijacking-site-ogusers-hacked-again/" target="_blank" rel="noopener">hacking and leaking the user database</a> for OGUsers, a forum overrun with people looking to buy, sell and trade access to compromised social media accounts.</p>
<p>Reached via Telegram, Discoli confirmed that police believe the trio was trying to force their way into his home in Spalding Common, and that one of them was wearing a police uniform when they approached his residence.</p>
<p>&#8220;They were obvious about being fake police, so much so that one of our neighbours called,&#8221; Discoli said in an instant message chat. &#8220;That call led to the arrests. Their intent was for robbery/blackmail of crypto, I just happened to not be home at the time.&#8221;</p>
<p>The Lincolnshire Police declined to comment for this story, citing an ongoing investigation.</p>
<p>Discoli said he didn&#8217;t know any of the men charged, but believes they were hired by one of his enemies. And he said his would-be assailants didn&#8217;t just target him specifically.</p>
<p>&#8220;They had a list of people they wanted to hit consecutively as far as I know,&#8221; he said.</p>
<p>The foiled robbery is the latest example of how members of certain hacking communities are targeting one another with physical violence, by making a standing offer to pay thousands of dollars to anyone in the target&#8217;s region who agrees to carry out the assaults.</p>
<p>Last month, a 21-year-old New Jersey man was arrested and charged with stalking in connection with a federal investigation into groups of cybercriminals who are <a href="https://krebsonsecurity.com/2022/09/violence-as-a-service-brickings-firebombings-shootings-for-hire/" target="_blank" rel="noopener">settling scores by hiring people to carry out physical attacks on their rivals</a>.</p>
<p>Prosecutors say <strong>Patrick McGovern-Allen</strong> recently participated in several of these schemes — including firing a handgun into a Pennsylvania home and torching a residence in another part of the state with a Molotov Cocktail.<span id="more-61281"></span></p>
<p>McGovern-Allen and the three U.K. defendants are part of an online community that is at the forefront of a dangerous escalation in coercion and intimidation tactics increasingly used by competing cybercriminal groups to steal cryptocurrency from one another and to keep their rivals in check.</p>
<p>The Telegram chat channels where these young men transact have hundreds to thousands of members each, and some of the more interesting solicitations on these communities are job offers for in-person assignments and tasks that can be found if one searches for posts titled, “If you live near,” or “IRL job” — short for “in real life” job.</p>
<p>A number of these classified ads are in service of performing &#8220;brickings,&#8221; where someone is hired to visit a specific address and toss a brick through the target’s window. Indeed, prior to McGovern-Allen&#8217;s arrest, his alleged Telegram persona bragged that he&#8217;d carried out several brickings for hire.</p>
<p>Many of the individuals involved in paying others to commit these physical attacks are also frequent participants in Telegram chat channels focused singularly on <a href="https://krebsonsecurity.com/?s=sim+swapping" target="_blank" rel="noopener">SIM swapping</a>, a crime in which identity thieves hijack a target’s mobile phone number and use that to wrest control over the victim’s various online accounts and identities.</p>
<p>Unsurprisingly, the vast majority of people currently being targeted for brickings and other real-life physical assaults via Telegram tend to be other cybercriminals involved in SIM swapping crimes (or individuals on the periphery of that scene).</p>
<p>The United Kingdom is home to a number of young men accused of stealing millions of dollars worth of cryptocurrencies via SIM swapping. <strong>Joseph James O’Connor</strong>, a.k.a. &#8220;Plugwalk Joe&#8221;, <a href="https://krebsonsecurity.com/2021/07/plugwalkjoe-does-the-perp-walk/" target="_blank" rel="noopener">was arrested in Spain in July 2021</a> under an FBI warrant on 10 counts of offenses related to unauthorized computer access and cyber bullying. U.S. investigators say O&#8217;Connor also played a central role in <a href="https://krebsonsecurity.com/2020/07/whos-behind-wednesdays-epic-twitter-hack/" target="_blank" rel="noopener">the 2020 intrusion at Twitter</a>, wherein Twitter accounts for top celebrities and public figures were forced to tweet out links to cryptocurrency scams. O&#8217;Connor is currently fighting extradition to the United States.</p>
<p><strong>Robert Lewis Barr</strong>, a 25-year-old Scottish man who allegedly stole more than $8 million worth of crypto, was arrested on an FBI warrant last year and is also fighting his extradition. U.S. investigators say Barr SIM swapped a U.S. bitcoin broker in 2017 while living with his mom, and that he <a href="https://www.scottishdailyexpress.co.uk/news/scottish-news/scot-accused-7m-crypto-fraud-27297624" target="_blank" rel="noopener">spent much of the stolen funds throwing lavish parties at rented luxury apartments in central Glasgow</a>.</p>
<p>In many ways, these violence-as-a-service incidents are a natural extension of &#8220;<a href="https://krebsonsecurity.com/?s=swatting" target="_blank" rel="noopener">swatting</a>,&#8221; wherein fake bomb threats, hostage situations and other violent scenarios were phoned in to police as part of a scheme to trick them into visiting potentially deadly force on a target’s address. According to prosecutors, both Barr and O&#8217;Connor have a history of swatting their enemies and their SIM swapping victims.</p>


feed_id: https://krebsonsecurity.com/?p=61327
title: SIM Swapper Abducted, Beaten, Held for $200k Ransom
uri: SIM-Swapper-Abducted-Beaten-Held-for-200k-Ransom
url: https://krebsonsecurity.com/2022/09/sim-swapper-abducted-beaten-held-for-200k-ransom/
content:
<p>A Florida teenager who served as a lackey for a cybercriminal group that specializes in cryptocurrency thefts was beaten and kidnapped last week by a rival cybercrime gang. The teen&#8217;s captives held guns to his head while forcing him to record a video message pleading with his crew to fork over a $200,000 ransom in exchange for his life. The youth is now reportedly cooperating with U.S. federal investigators, who are responding to an alarming number of reports of physical violence tied to certain online crime communities.</p>
<div id="attachment_61331" style="width: 329px" class="wp-caption alignright"><img aria-describedby="caption-attachment-61331" class="size-full wp-image-61331" src="media/90a2685d.foreshadowplea.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/09/foreshadowplea.png" alt="" width="319" height="585" /><p id="caption-attachment-61331" class="wp-caption-text">The SIM-swapper known as &#8220;Foreshadow&#8221; pleading for his life.</p></div>
<p>The grisly kidnapping video has been circulating on a number of Telegram chat channels dedicated to <a href="https://krebsonsecurity.com/category/sim-swapping/" rel="noopener" target="_blank">SIM-swapping</a> &#8212; the practice of tricking or bribing mobile phone store employees into diverting a target&#8217;s phone number, text messages and calls to a device the attackers control.</p>
<p>The teen, known to the SIM-swapping community by the handle &#8220;<strong>Foreshadow</strong>,&#8221; appears to have served as a &#8220;holder&#8221; &#8212; a term used to describe a low-level member of any SIM-swapping group who agrees to carry out the riskiest and least rewarding role of the crime: Physically keeping and managing the various mobile devices and SIM cards that are used in SIM-swapping scams.</p>
<p>&#8220;Yo, Dan, please bro send the 200k,&#8221; Foreshadow said in the video, which was shot on Sept. 15 in the backseat of a moving car. Bleeding from a swollen mouth with two handguns pointed at his head, Foreshadow pleaded for his life.</p>
<p>&#8220;They&#8217;re going to kill me if you don&#8217;t,&#8221; Foreshadow continued, offering to get a job as a complicit mobile store employee or &#8220;plug&#8221; to help with future SIM-swaps. &#8220;I&#8217;ll pay you back. Just let me know what you need. I got you, for real. Any work for free. Whatever. However long you need me, too. I&#8217;ll apply to any store you need me to apply to. I can be a plug. I don&#8217;t care if I get caught by the cops or anything. I&#8217;ll get that money back for you. I used to do that work.&#8221;</p>
<p>It&#8217;s not clear where in the world the hostage video was recorded. But at one point in the video, the vehicle&#8217;s radio can be heard in the background mentioning <strong>WMIB</strong>, which is a hip-hop station in South Florida that serves both Ft. Lauderdale and Miami.</p>
<p>As Foreshadow&#8217;s hostage video began making the rounds on SIM-swapping Telegram channels, a rumor surfaced that Foreshadow had died after being shot in the leg. It soon emerged that Foreshadow had not died, and that he was cooperating with the <strong>Federal Bureau of Investigation</strong> (FBI). Members of the SIM-swapping community were then warned to delete any messages to or from Foreshadow. One of those messages read:</p>
<blockquote><p>JUST IN: FORESHADOW IS NOT DEAD!!!!</p>
<p>HES CURRENTLY CO-OPERATING WITH THE FBI DUE TO HIM BEING KIDNAPPED AND AN ATTEMPT TO EXTORT HIM FOR 200K</p>
<p>IF YOU HAVE CHATS WITH HIM CLEAR THEM </p></blockquote>
<p>Foreshadow appears to be a teenager from Florida whose first name is Justin. Foreshadow&#8217;s main Telegram account was converted from a user profile into a channel on Sept. 15 &#8212; the same day he was assaulted and kidnapped &#8212; and it is not currently responding to messages. </p>
<p>Foreshadow&#8217;s erstwhile boss Jarik told KrebsOnSecurity that the youth was indeed shot by his captors, and blamed the kidnapping on a rival SIM-swapper from Australia who was angry over getting shortchanged of the profits from a previous SIM-swapping escapade.</p>
<p>The FBI did not immediately respond to requests for comment.</p>
<p>Foreshadow&#8217;s experience is the latest example of a rapidly escalating cycle of physical violence that is taking hold of criminal SIM-swapping communities online. Earlier this month, KrebsOnSecurity detailed how multiple SIM-swapping Telegram channels are now replete with <a href="https://krebsonsecurity.com/2022/09/violence-as-a-service-brickings-firebombings-shootings-for-hire/" rel="noopener" target="_blank">&#8220;violence-as-a-service&#8221; offerings</a>, wherein denizens of the underground hire themselves out to perform various forms of physical violence &#8212; from slashing tires and throwing a brick through someone&#8217;s window, to conducting drive-by shootings, firebombings and home invasions. </p>
<p>On Aug. 12, 2022, 21-year-old <strong>Patrick McGovern-Allen</strong> of Egg Harbor Township, N.J. was arrested by the FBI and charged with stalking in connection with several of these violence-as-a-service jobs. Prosecutors say the defendant fired a handgun into a Pennsylvania home, and helped to torch another residence in the state with a Molotov Cocktail &#8212; all allegedly in service of a beef over stolen cryptocurrency.</p>
<p>Earlier this month, three men in the United Kingdom were arrested for <a href="https://krebsonsecurity.com/2022/09/botched-crypto-mugging-lands-three-u-k-men-in-jail/" rel="noopener" target="_blank">attempting to assault a local man and steal his virtual currencies</a>. The local man&#8217;s neighbor called the cops and said the three men were acting suspiciously and that one of them was wearing a police uniform. U.K. police stopped the three men allegedly fleeing the scene, and found a police uniform and weapons in the trunk of the car. All three defendants in that case were charged with &#8220;intent to cause loss to another to make an unwarranted demand of Crypto Currency from a person.&#8221;</p>
<p><strong>Dina Temple-Raston</strong> and <strong>Sean Powers</strong> over at <em>The Record</em> <a href="https://therecord.media/mobile-phone-hackers-wield-violence-as-a-service-for-money-revenge/" rel="noopener" target="_blank">recently interviewed</a> several members of the SIM-swapping community about this escalation in violence. That story is also available on the Click Here podcast &#8212; <a href="https://podcasts.apple.com/us/podcast/33-throwing-bricks-for-$$$-violence-as-a-service-comes-of-age/id1225077306?i=1000580057197" rel="noopener" target="_blank">Throwing Bricks for $$$: Violence-as-a-Service Comes of Age</a>.</p>


feed_id: https://krebsonsecurity.com/?p=61359
title: Accused Russian RSOCKS Botmaster Arrested, Requests Extradition to U.S.
uri: Accused-Russian-RSOCKS-Botmaster-Arrested-Requests-Extradition-to-U-S
url:
https://krebsonsecurity.com/2022/09/accused-russian-rsocks-botmaster-arrested-requests-extradition-to-u-s/

content:
<p>A 36-year-old Russian man recently identified by KrebsOnSecurity as the likely proprietor of the massive <strong>RSOCKS botnet</strong> has been arrested in Bulgaria at the request of U.S. authorities. At a court hearing in Bulgaria this month, the accused hacker requested and was granted extradition to the United States, reportedly telling the judge, &#8220;America is looking for me because I have enormous information and they need it.&#8221;</p>
<div id="attachment_60166" style="width: 304px" class="wp-caption alignright"><img aria-describedby="caption-attachment-60166" class=" wp-image-60166" src="media/95f9be6f.klosterpp.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/06/klosterpp.png" alt="" width="294" height="301" /><p id="caption-attachment-60166" class="wp-caption-text">A copy of the passport for Denis Kloster, as posted to his Vkontakte page in 2019.</p></div>
<p>On June 22, KrebsOnSecurity published <a href="https://krebsonsecurity.com/2022/06/meet-the-administrators-of-the-rsocks-proxy-botnet/" target="_blank" rel="noopener">Meet the Administrators of the RSOCKS Proxy Botnet</a>, which identified <strong>Denis Kloster</strong>, a.k.a. <strong>Denis Emelyantsev</strong>, as the apparent owner of RSOCKS, a collection of millions of hacked devices that were sold as &#8220;proxies&#8221; to cybercriminals looking for ways to route their malicious traffic through someone else’s computer.</p>
<p>A native of Omsk, Russia, Kloster came into focus after KrebsOnSecurity followed clues from the RSOCKS botnet master&#8217;s identity on the cybercrime forums to <a href="https://web-archive-org.translate.goog/web/20220114060032/http://deniskloster.com/%D0%BD%D0%B0%D0%BC-%D1%82%D1%80%D0%B8-%D0%B3%D0%BE%D0%B4%D0%B0-2/?_x_tr_sl=ru&amp;_x_tr_tl=en&amp;_x_tr_hl=en&amp;_x_tr_pto=wapp" target="_blank" rel="noopener">Kloster&#8217;s personal blog</a>, which featured musings on the challenges of running a company that sells &#8220;security and anonymity services to customers around the world.&#8221; Kloster&#8217;s blog even included a group photo of RSOCKS employees.</p>
<p>&#8220;Thanks to you, we are now developing in the field of information security and anonymity!,” Kloster&#8217;s blog enthused. “We make products that are used by thousands of people around the world, and this is very cool! And this is just the beginning!!! We don’t just work together and we’re not just friends, we’re Family.”</p>
<p>The Bulgarian news outlet <a href="https://www.struma.com/krimi/ruskiyat-haker-arestuvan-v-bansko-poiska-da-go-ekstradirat-v_197964/" target="_blank" rel="noopener">24Chasa.bg reports</a> that Kloster was <a href="https://bta.bg/en/news/bulgaria/rss/281218-desi-russian-man-wanted-in-us-for-computer-crimes-is-arrested-in-bulgaria" target="_blank" rel="noopener">arrested in June</a> at a co-working space in the southwestern ski resort town of Bansko, and that the accused asked to be handed over to the American authorities.</p>
<p>&#8220;I have hired a lawyer there and I want you to send me as quickly as possible to clear these baseless charges,&#8221; Kloster reportedly told the Bulgarian court this week. &#8220;I am not a criminal and I will prove it in an American court.&#8221;</p>
<p>Launched in 2013, RSOCKS was shut down in June 2022 as part of an international investigation into the cybercrime service. The Justice Department&#8217;s <a href="https://www.justice.gov/usao-sdca/pr/russian-botnet-disrupted-international-cyber-operation" target="_blank" rel="noopener">June 2022 statement</a> about that takedown cited a search warrant from the <strong>U.S. Attorney&#8217;s Office for the Southern District of California</strong>, which also was named by Bulgarian <a href="https://bulgaria.postsen.com/local/61585/Bulgaria-extradits-a-34-year-old-Russian-hacker-to-the-US.html" target="_blank" rel="noopener">news outlets</a> this month as the source of Kloster&#8217;s arrest warrant.</p>
<p>When asked about the existence of an arrest warrant or criminal charges against Kloster, a spokesperson for the Southern District said, &#8220;no comment.&#8221;</p>
<div id="attachment_60163" style="width: 769px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-60163" loading="lazy" class=" wp-image-60163" src="media/3d2966f9.klosterphoto.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/06/klosterphoto.png" alt="" width="759" height="423" /><p id="caption-attachment-60163" class="wp-caption-text">The employees who kept things running for RSOCKS, circa 2016. Notice that nobody seems to be wearing shoes.</p></div>
<p>24Chasa said the defendant&#8217;s surname is Emelyantsev and that he only recently adopted the last name Kloster, which is his mother&#8217;s maiden name.</p>
<p>As KrebsOnSecurity reported in June, Kloster also appears to be a major player in the Russian email spam industry. In several private exchanges cybercrime forums, the RSOCKS administrator claimed ownership of the <strong>RUSdot</strong> spam forum. RUSdot is the successor forum to <strong>Spamdot</strong>, a far more secretive and restricted forum where most of the world’s top spammers, virus writers and cybercriminals collaborated for years before <a href="https://krebsonsecurity.com/2010/09/spam-affialite-program-spamit-com-to-close/" target="_blank" rel="noopener">the community’s implosion in 2010</a>.<span id="more-61359"></span></p>
<p>Email spam &#8212; and in particular malicious email sent via compromised computers &#8212; is still one of the biggest sources of malware infections that lead to data breaches and ransomware attacks. So it stands to reason that as administrator of Russia&#8217;s most well-known forum for spammers, the defendant in this case probably knows quite a bit about other top players in the botnet spam and malware community.</p>
<div id="attachment_60181" style="width: 763px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-60181" loading="lazy" class=" wp-image-60181" src="media/78b8e106.rusdot.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/06/rusdot.png" alt="" width="753" height="448" srcset="https://krebsonsecurity.com/wp-content/uploads/2022/06/rusdot.png 1267w, https://krebsonsecurity.com/wp-content/uploads/2022/06/rusdot-768x457.png 768w, https://krebsonsecurity.com/wp-content/uploads/2022/06/rusdot-782x465.png 782w" sizes="(max-width: 753px) 100vw, 753px" /><p id="caption-attachment-60181" class="wp-caption-text">A Google-translated version of the Rusdot spam forum.</p></div>
<p>Despite maintaining his innocence, Kloster reportedly told the Bulgarian judge that he could be useful to American investigators.</p>
<p>&#8220;America is looking for me because I have enormous information and they need it,&#8221; Kloster told the court, according to 24Chasa. &#8220;That&#8217;s why they want me.&#8221;</p>
<p>The Bulgarian court agreed, and granted his extradition. Kloster&#8217;s fiancee also attended the extradition hearing, and reportedly wept in the hall outside the entire time.</p>
<p>Kloster turned 36 while awaiting his extradition hearing, and may soon be facing charges that carry punishments of up to 20 years in prison.</p>


feed_id: https://krebsonsecurity.com/?p=61394
title: Fake CISO Profiles on LinkedIn Target Fortune 500s
uri: Fake-CISO-Profiles-on-LinkedIn-Target-Fortune-500s
url: https://krebsonsecurity.com/2022/09/fake-ciso-profiles-on-linkedin-target-fortune-500s/
content:
<p>Someone has recently created a large number of fake <strong>LinkedIn</strong> profiles for <strong>Chief Information Security Officer</strong> (CISO) roles at some of the world&#8217;s largest corporations. It&#8217;s not clear who&#8217;s behind this network of fake CISOs or what their intentions may be. But the fabricated LinkedIn identities are confusing search engine results for CISO roles at major companies, and they are being indexed as gospel by various downstream data-scraping sources.</p>
<p>If one searches LinkedIn for the CISO of the energy giant <strong>Chevron</strong>, one might find the profile for a <a href="https://www.linkedin.com/in/victor-sites-40139b20a/" target="_blank" rel="noopener">Victor Sites</a>, who says he&#8217;s from Westerville, Ohio and is a graduate of Texas A&amp;M University.</p>
<div id="attachment_61395" style="width: 762px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-61395" class=" wp-image-61395" src="media/bb6f4652.victorsites.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/09/victorsites.png" alt="" width="752" height="631" srcset="https://krebsonsecurity.com/wp-content/uploads/2022/09/victorsites.png 1020w, https://krebsonsecurity.com/wp-content/uploads/2022/09/victorsites-768x645.png 768w, https://krebsonsecurity.com/wp-content/uploads/2022/09/victorsites-782x656.png 782w" sizes="(max-width: 752px) 100vw, 752px" /><p id="caption-attachment-61395" class="wp-caption-text">The LinkedIn profile for Victor Sites, who is most certainly NOT the CISO of Chevron.</p></div>
<p>Of course, Sites is not the real CISO of Chevron. That role is currently occupied by <a href="https://www.linkedin.com/in/christopher-lukas/" target="_blank" rel="noopener">Christopher Lukas</a> of Danville, Calif. If you were confused at this point, you might ask Google who it thinks is the current Chief Information Security Officer of Chevron. When KrebsOnSecurity did that earlier this morning, the fake CISO profile was the very first search result returned (followed by the LinkedIn profile for the real Chevron CISO).</p>
<p><img loading="lazy" class="aligncenter wp-image-61396" src="media/5867b2a7.fakecisosearch.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/09/fakecisosearch.png" alt="" width="749" height="401" srcset="https://krebsonsecurity.com/wp-content/uploads/2022/09/fakecisosearch.png 1020w, https://krebsonsecurity.com/wp-content/uploads/2022/09/fakecisosearch-768x411.png 768w, https://krebsonsecurity.com/wp-content/uploads/2022/09/fakecisosearch-782x419.png 782w" sizes="(max-width: 749px) 100vw, 749px" /></p>
<p>Helpfully, LinkedIn seems to be able to detect something in common about all these fake CISO profiles, because it suggested I view a number of them in the &#8220;People Also Viewed&#8221; column seen in the image above. There are two fake CISO profiles suggested there, including one for a <a href="https://www.linkedin.com/in/maryann-robles-2924b620a/" target="_blank" rel="noopener">Maryann Robles</a>, who claims to be the CISO of another energy giant &#8212; <strong>ExxonMobil</strong>.</p>
<p><img loading="lazy" class="aligncenter wp-image-61397" src="media/267d27b1.maryannrobles.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/09/maryannrobles.png" alt="" width="751" height="630" srcset="https://krebsonsecurity.com/wp-content/uploads/2022/09/maryannrobles.png 1020w, https://krebsonsecurity.com/wp-content/uploads/2022/09/maryannrobles-768x645.png 768w, https://krebsonsecurity.com/wp-content/uploads/2022/09/maryannrobles-782x656.png 782w" sizes="(max-width: 751px) 100vw, 751px" /></p>
<p>Maryann&#8217;s profile says she&#8217;s from Tupelo, Miss., and includes a quaint description of how she became a self-described &#8220;old-school geek.&#8221;</p>
<p>&#8220;Since playing Tradewars on my Tandy 1000 with a 300 baud modem in the early &#8217;90s, I&#8217;ve had a lifelong passion for technology, which I&#8217;ve carried with me as Deputy CISO of the world&#8217;s largest health plan,&#8221; her profile reads.</p>
<p>However, this description appears to have been lifted from <a href="https://www.linkedin.com/in/frank-domizio-9485131b/" target="_blank" rel="noopener">the profile</a> for the real CISO at the Centers for Medicare &amp; Medicaid Services in Baltimore, Md.<span id="more-61394"></span></p>
<p>Interestingly, Maryann&#8217;s LinkedIn profile was accepted as truth by Cybercrime Magazine&#8217;s CISO 500 listing, which claims to maintain a list of the current CISOs at America&#8217;s largest companies:</p>
<div id="attachment_61398" style="width: 761px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-61398" loading="lazy" class=" wp-image-61398" src="media/e9e07916.ciso500.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/09/ciso500.png" alt="" width="751" height="443" srcset="https://krebsonsecurity.com/wp-content/uploads/2022/09/ciso500.png 1316w, https://krebsonsecurity.com/wp-content/uploads/2022/09/ciso500-768x453.png 768w, https://krebsonsecurity.com/wp-content/uploads/2022/09/ciso500-782x462.png 782w" sizes="(max-width: 751px) 100vw, 751px" /><p id="caption-attachment-61398" class="wp-caption-text">The fake CISO for ExxOnMobil was indexed in Cybercrime Magazine&#8217;s CISO 500.</p></div>
<p><strong>Rich Mason</strong>, the former CISO at Fortune 500 firm Honeywell, began warning his colleagues on LinkedIn about the phony profiles earlier this week.</p>
<p>&#8220;It&#8217;s interesting the downstream sources that repeat LinkedIn bogus content as truth,&#8221; Mason said. &#8220;This is dangerous, Apollo.io, Signalhire, and Cybersecurity Ventures.&#8221;</p>
<p>Google wasn&#8217;t fooled by the phony LinkedIn profile for <a href="https://www.linkedin.com/in/jennie-biller-9b631120a/" target="_blank" rel="noopener">Jennie Biller</a>, who claims to be CISO at biotechnology giant <strong>Biogen</strong> (the real Biogen CISO is <a href="https://www.linkedin.com/in/russell-koste-8090834/" target="_blank" rel="noopener">Russell Koste</a>). But Biller&#8217;s profile is worth mentioning because it shows how some of these phony profiles appear to be quite hastily assembled. Case in point: Biller&#8217;s name and profile photo suggest she is female, however the &#8220;About&#8221; description of her accomplishments uses male pronouns. Also, it might help that Jennie only has 18 connections on LinkedIn.</p>
<p><img loading="lazy" class="aligncenter wp-image-61405" src="media/dd77e4d0.jenniebiller.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/09/jenniebiller.png" alt="" width="750" height="629" srcset="https://krebsonsecurity.com/wp-content/uploads/2022/09/jenniebiller.png 1020w, https://krebsonsecurity.com/wp-content/uploads/2022/09/jenniebiller-768x645.png 768w, https://krebsonsecurity.com/wp-content/uploads/2022/09/jenniebiller-782x656.png 782w" sizes="(max-width: 750px) 100vw, 750px" /></p>
<p>Again, we don&#8217;t know much about who or what is behind these profiles, but in August the security firm <strong>Mandiant</strong> (recently acquired by Google) <a href="https://www.yahoo.com/video/north-korean-fraudsters-suspected-copying-153907880.html" target="_blank" rel="noopener">told Bloomberg</a> that hackers working for the North Korean government have been copying resumes and profiles from leading job listing platforms LinkedIn and Indeed, as part of an elaborate scheme to land jobs at cryptocurrency firms.</p>
<p>None of the profiles listed here responded to requests for comment (or to become a connection).</p>
<p>In a statement provided to KrebsOnSecurity, LinkedIn said its teams were actively working to take these fake accounts down.</p>
<p>&#8220;We do have strong human and automated systems in place, and we’re continually improving, as fake account activity becomes more sophisticated,&#8221; the statement reads. &#8220;In our <a href="https://about.linkedin.com/transparency/community-report" target="_blank" rel="noopener">transparency report</a> we share how our teams plus automated systems are stopping the vast majority of fraudulent activity we detect in our community &#8211; around 96% of fake accounts and around 99.1% of spam and scam.&#8221;</p>
<p>LinkedIn could take one simple step that would make it far easier for people to make informed decisions about whether to trust a given profile: Add a &#8220;created on&#8221; date for every profile. Twitter does this, and it&#8217;s enormously helpful for filtering out a great deal of noise and unwanted communications.</p>
<p>The former CISO Mason said LinkedIn also could experiment with offering something akin to Twitter&#8217;s verified mark to users who chose to validate that they can respond to email at the domain associated with their stated current employer.</p>
<p>&#8220;If I saw that a LinkedIn profile had been domain-validated, then my confidence in that profile would go way up,&#8221; Mason said, noting that many of the fake profiles had hundreds of followers, including dozens of real CISOs. Maryann&#8217;s profile grew by a hundred connections in just the past few days, he said.</p>
<p>&#8220;If we have CISOs that are falling for this, what hopes do the masses have?&#8221; Mason said.</p>
<p>Mason said LinkedIn also needs a more streamlined process for allowing employers to remove phony employee accounts. He recently tried to get a phony profile removed from LinkedIn for someone who falsely claimed to have worked for his company.</p>
<p>&#8220;I shot a note to LinkedIn and said please remove this, and they said, well, we have to contact that person and arbitrate this,&#8221; he said. &#8220;They gave the guy two weeks and he didn&#8217;t respond, so they took it down. But that doesn&#8217;t scale, and there needs to be a mechanism where an employer can contact LinkedIn and have these fake profiles taken down in less than two weeks.&#8221;</p>


feed_id: https://krebsonsecurity.com/?p=61414
title: Microsoft: Two New 0-Day Flaws in Exchange Server
uri: Microsoft-Two-New-0-Day-Flaws-in-Exchange-Server
url: https://krebsonsecurity.com/2022/09/microsoft-two-new-0-day-flaws-in-exchange-server/
content:
<p><strong>Microsoft Corp.</strong> is investigating reports that attackers are exploiting two previously unknown vulnerabilities in <strong>Exchange Server</strong>, a technology many organizations rely on to send and receive email. Microsoft says it is expediting work on software patches to plug the security holes. In the meantime, it is urging a subset of Exchange customers to enable a setting that could help mitigate ongoing attacks.</p>
<p><img src="media/5315fb8a.exchange.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/03/exchange.png" alt="" width="1072" height="362" class="aligncenter size-full wp-image-54572" srcset="https://krebsonsecurity.com/wp-content/uploads/2021/03/exchange.png 1072w, https://krebsonsecurity.com/wp-content/uploads/2021/03/exchange-768x259.png 768w" sizes="(max-width: 1072px) 100vw, 1072px" /></p>
<p>In <a href="https://msrc-blog.microsoft.com/2022/09/29/customer-guidance-for-reported-zero-day-vulnerabilities-in-microsoft-exchange-server/" rel="noopener" target="_blank">customer guidance</a> released Thursday, Microsoft said it is investigating two reported zero-day flaws affecting Microsoft Exchange Server 2013, 2016, and 2019. <a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=2022-41040" rel="noopener" target="_blank">CVE-2022-41040</a>, is a Server-Side Request Forgery (SSRF) vulnerability that can enable an authenticated attacker to remotely trigger the second zero-day vulnerability &#8212; <a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-41082" rel="noopener" target="_blank">CVE-2022-41082</a> &#8212; which allows remote code execution (RCE) when <strong>PowerShell</strong> is accessible to the attacker.</p>
<p>Microsoft said <strong>Exchange Online</strong> has detections and mitigation in place to protect customers. Customers using <em>on-premises</em> Microsoft Exchange servers are urged to review the mitigations suggested in the security advisory, which Microsoft says should block the known attack patterns.</p>
<p>Vietnamese security firm <strong>GTSC</strong> on Thursday <a href="https://gteltsc.vn/blog/warning-new-attack-campaign-utilized-a-new-0day-rce-vulnerability-on-microsoft-exchange-server-12715.html" rel="noopener" target="_blank">published a writeup on the two Exchange zero-day flaws</a>, saying it first observed the attacks in early August being used to drop &#8220;webshells.&#8221; These web-based backdoors offer attackers an easy-to-use, password-protected hacking tool that can be accessed over the Internet from any browser.</p>
<p>&#8220;We detected webshells, mostly obfuscated, being dropped to Exchange servers,&#8221; GTSC wrote. &#8220;Using the user-agent, we detected that the attacker uses Antsword, an active Chinese-based opensource cross-platform website administration tool that supports webshell management. We suspect that these come from a Chinese attack group because the webshell codepage is 936, which is a Microsoft character encoding for simplified Chinese.&#8221;</p>
<p>GTSC&#8217;s advisory includes details about post-compromise activity and related malware, as well as steps it took to help customers respond to active compromises of their Exchange Server environment. But the company said it would withhold more technical details of the vulnerabilities for now.</p>
<p>In March 2021, hundreds of thousands of organizations worldwide had their email stolen and multiple backdoor webshells installed, all thanks to <a href="https://krebsonsecurity.com/2021/03/at-least-30000-u-s-organizations-newly-hacked-via-holes-in-microsofts-email-software/" rel="noopener" target="_blank">four zero-day vulnerabilities in Exchange Server</a>. </p>
<p>Granted, the zero-day flaws that powered that debacle were far more critical than the two detailed this week, and there are no signs yet that exploit code has been publicly released (that will likely change soon). But part of what made last year&#8217;s Exchange Server mass hack so pervasive was that vulnerable organizations had little or no advance notice on what to look for before their Exchange Server environments were completely owned by multiple attackers. </p>
<p>Microsoft is quick to point out that these zero-day flaws require an attacker to have a valid username and password for an Exchange user, but this may not be such a tall order for the hackers behind these latest exploits against Exchange Server. </p>
<p><strong>Steven Adair</strong> is president of <a href="https://www.volexity.com" rel="noopener" target="_blank">Volexity</a>, the Virginia-based cybersecurity firm that was among the first to sound the alarm about the Exchange zero-days targeted in the 2021 mass hack. Adair said GTSC&#8217;s writeup includes an Internet address used by the attackers that Volexity has tied with high confidence to a China-based hacking group that has recently been observed phishing Exchange users for their credentials. </p>
<p>In February 2022, Volexity <a href="https://www.volexity.com/blog/2022/02/03/operation-emailthief-active-exploitation-of-zero-day-xss-vulnerability-in-zimbra/" rel="noopener" target="_blank">warned</a> that this same Chinese hacking group was behind the mass exploitation of a zero-day vulnerability in the <strong>Zimbra Collaboration Suite</strong>, which is a competitor to Microsoft Exchange that many enterprises use to manage email and other forms of messaging. </p>
<p>If your organization runs Exchange Server, please consider reviewing <a href="https://msrc-blog.microsoft.com/2022/09/29/customer-guidance-for-reported-zero-day-vulnerabilities-in-microsoft-exchange-server/" rel="noopener" target="_blank">the Microsoft mitigations</a> and <a href="https://gteltsc.vn/blog/warning-new-attack-campaign-utilized-a-new-0day-rce-vulnerability-on-microsoft-exchange-server-12715.html" rel="noopener" target="_blank">the GTSC post-mortem</a> on their investigations.  </p>


feed_id: https://krebsonsecurity.com/?p=61434
title: Glut of Fake LinkedIn Profiles Pits HR Against the Bots
uri: Glut-of-Fake-LinkedIn-Profiles-Pits-HR-Against-the-Bots
url: https://krebsonsecurity.com/2022/10/glut-of-fake-linkedin-profiles-pits-hr-against-the-bots/
content:
<p>A recent proliferation of phony executive profiles on <strong>LinkedIn</strong> is creating something of an identity crisis for the business networking site, and for companies that rely on it to hire and screen prospective employees. The fabricated LinkedIn identities &#8212; which pair AI-generated profile photos with text lifted from legitimate accounts &#8212; are creating major headaches for corporate HR departments and for those managing invite-only LinkedIn groups.</p>
<div id="attachment_61445" style="width: 759px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-61445" class=" wp-image-61445" src="media/c648c307.botsgroup.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/10/botsgroup.png" alt="" width="749" height="415" srcset="https://krebsonsecurity.com/wp-content/uploads/2022/10/botsgroup.png 1797w, https://krebsonsecurity.com/wp-content/uploads/2022/10/botsgroup-768x425.png 768w, https://krebsonsecurity.com/wp-content/uploads/2022/10/botsgroup-1536x850.png 1536w, https://krebsonsecurity.com/wp-content/uploads/2022/10/botsgroup-782x433.png 782w" sizes="(max-width: 749px) 100vw, 749px" /><p id="caption-attachment-61445" class="wp-caption-text">Some of the fake profiles flagged by the co-administrator of a popular sustainability group on LinkedIn.</p></div>
<p>Last week, KrebsOnSecurity examined <a href="https://krebsonsecurity.com/2022/09/fake-ciso-profiles-on-linkedin-target-fortune-500s/" rel="noopener" target="_blank">a flood of inauthentic LinkedIn profiles</a> all claiming Chief Information Security Officer (CISO) roles at various Fortune 500 companies, including <strong>Biogen</strong>, <strong>Chevron</strong>, <strong>ExxonMobil</strong>, and <strong>Hewlett Packard</strong>.</p>
<p>Since then, the response from LinkedIn users and readers has made clear that these phony profiles are showing up en masse for virtually all executive roles &#8212; but particularly for jobs and industries that are adjacent to recent global events and news trends.</p>
<p><a href="https://www.linkedin.com/in/hamishtaylor/" target="_blank" rel="noopener">Hamish Taylor</a> runs the <strong>Sustainability Professionals</strong> group on LinkedIn, which has more than 300,000 members. Together with the group&#8217;s co-owner, Taylor said they&#8217;ve blocked <em>more than 12,700 suspected fake profiles so far this year</em>, including dozens of recent accounts that Taylor describes as &#8220;cynical attempts to exploit Humanitarian Relief and Crisis Relief experts.&#8221;</p>
<p>&#8220;We receive over 500 fake profile requests to join on a weekly basis,&#8221; Taylor said. &#8220;It&#8217;s hit like hell since about January of this year. Prior to that we did not get the swarms of fakes that we now experience.&#8221;</p>
<div id="attachment_61447" style="width: 761px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-61447" loading="lazy" class=" wp-image-61447" src="media/e012f124.linkedinhelp.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/10/linkedinhelp.png" alt="" width="751" height="421" srcset="https://krebsonsecurity.com/wp-content/uploads/2022/10/linkedinhelp.png 1890w, https://krebsonsecurity.com/wp-content/uploads/2022/10/linkedinhelp-768x430.png 768w, https://krebsonsecurity.com/wp-content/uploads/2022/10/linkedinhelp-1536x861.png 1536w, https://krebsonsecurity.com/wp-content/uploads/2022/10/linkedinhelp-782x438.png 782w" sizes="(max-width: 751px) 100vw, 751px" /><p id="caption-attachment-61447" class="wp-caption-text">The opening slide for a plea by Taylor&#8217;s group to LinkedIn.</p></div>
<p>Taylor recently posted an entry on LinkedIn titled, &#8220;<strong>The Fake ID Crisis on LinkedIn</strong>,&#8221; which lampooned the &#8220;60 Least Wanted &#8216;Crisis Relief Experts&#8217; &#8212; fake profiles that claimed to be experts in disaster recovery efforts in the wake of recent hurricanes. The images above and below show just one such swarm of profiles the group flagged as inauthentic. Virtually all of these profiles were removed from LinkedIn after KrebsOnSecurity tweeted about them last week.</p>
<div id="attachment_61460" style="width: 761px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-61460" loading="lazy" class=" wp-image-61460" src="media/b8de95d8.botgroup2.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/10/botgroup2.png" alt="" width="751" height="416" srcset="https://krebsonsecurity.com/wp-content/uploads/2022/10/botgroup2.png 1797w, https://krebsonsecurity.com/wp-content/uploads/2022/10/botgroup2-768x425.png 768w, https://krebsonsecurity.com/wp-content/uploads/2022/10/botgroup2-1536x850.png 1536w, https://krebsonsecurity.com/wp-content/uploads/2022/10/botgroup2-782x433.png 782w" sizes="(max-width: 751px) 100vw, 751px" /><p id="caption-attachment-61460" class="wp-caption-text">Another &#8220;swarm&#8221; of LinkedIn bot accounts flagged by Taylor&#8217;s group.</p></div>
<p><a href="https://www.linkedin.com/in/seniorstoryteller/" target="_blank" rel="noopener">Mark Miller</a> is the owner of the <a href="https://www.linkedin.com/company/devopsgroup/" target="_blank" rel="noopener">DevOps group</a> on LinkedIn, and says he deals with fake profiles on a daily basis &#8212; often hundreds per day. What Taylor called &#8220;swarms&#8221; of fake accounts Miller described instead as &#8220;waves&#8221; of incoming requests from phony accounts.</p>
<p>&#8220;When a bot tries to infiltrate the group, it does so in waves,&#8221; Miller said. &#8220;We&#8217;ll see 20-30 requests come in with the same type of information in the profiles.&#8221;</p>
<p>After screenshotting the waves of suspected fake profile requests, Miller started sending the images to LinkedIn&#8217;s abuse teams, which told him they would review his request but that he may never be notified of any action taken.</p>
<div id="attachment_61448" style="width: 758px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-61448" loading="lazy" class=" wp-image-61448" src="media/d5f2185c.devopsbots.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/10/devopsbots.png" alt="" width="748" height="789" /><p id="caption-attachment-61448" class="wp-caption-text">Some of the bot profiles identified by Mark Miller that were seeking access to his DevOps LinkedIn group. Miller said these profiles are all listed in the order they appeared.</p></div>
<p>Miller said that after months of complaining and sharing fake profile information with LinkedIn, the social media network appeared to do something which caused the volume of group membership requests from phony accounts to drop precipitously.</p>
<p>&#8220;I wrote our LinkedIn rep and said we were considering closing the group down the bots were so bad,&#8221; Miller said. &#8220;I said, &#8216;You guys should be doing something on the backend to block this.&#8221;</p>
<p><a href="https://www.linkedin.com/in/jdlathrop/" rel="noopener" target="_blank">Jason Lathrop</a> is vice president of technology and operations at <strong>ISOutsource</strong>, a Seattle-based consulting firm with roughly 100 employees. Like Miller, Lathrop&#8217;s experience in fighting bot profiles on LinkedIn suggests the social networking giant will eventually respond to complaints about inauthentic accounts. That is, if affected users complain loudly enough (posting about it publicly on LinkedIn seems to help).</p>
<p>Lathrop said that about two months ago his employer noticed waves of new followers, and identified more than 3,000 followers that all shared various elements, such as profile photos or text descriptions.</p>
<p>&#8220;Then I noticed that they all claim to work for us at some random title within the organization,&#8221; Lathrop said in an interview with KrebsOnSecurity. &#8220;When we complained to LinkedIn, they&#8217;d tell us these profiles didn&#8217;t violate their community guidelines. But like heck they don&#8217;t! These people don&#8217;t exist, and they&#8217;re claiming they work for us!&#8221;</p>
<p>Lathrop said that after his company&#8217;s third complaint, a LinkedIn representative responded by asking ISOutsource to send a spreadsheet listing every legitimate employee in the company, and their corresponding profile links. </p>
<p>Not long after that, the phony profiles that were not on the company&#8217;s list were deleted from LinkedIn. Lathrop said he&#8217;s still not sure how they&#8217;re going to handle getting new employees allowed into their company on LinkedIn going forward.<span id="more-61434"></span></p>
<p>It remains unclear why LinkedIn has been <a href="https://blog.linkedin.com/2022/june/16/working-together-to-keep-linkedin-safe" rel="noopener" target="_blank">flooded with so many fake profiles lately</a>, or how the phony profile photos are sourced. Random testing of the profile photos shows they resemble but do not match other photos posted online. Several readers pointed out one likely source &#8212; the website thispersondoesnotexist.com, which makes using artificial intelligence to create unique headshots a point-and-click exercise.</p>
<p>Cybersecurity firm <strong>Mandiant</strong> (recently acquired by <strong>Google</strong>) <a href="https://www.yahoo.com/video/north-korean-fraudsters-suspected-copying-153907880.html" target="_blank" rel="noopener">told Bloomberg</a> that hackers working for the North Korean government have been copying resumes and profiles from leading job listing platforms LinkedIn and Indeed, as part of an elaborate scheme to land jobs at cryptocurrency firms.</p>
<p>Fake profiles also may be tied to so-called <a href="https://krebsonsecurity.com/2022/07/massive-losses-define-epidemic-of-pig-butchering/" target="_blank" rel="noopener">&#8220;pig butchering&#8221; scams</a>, wherein people are lured by flirtatious strangers online into investing in cryptocurrency trading platforms that eventually seize any funds when victims try to cash out.</p>
<p>In addition, identity thieves have been known <a href="https://krebsonsecurity.com/2021/05/how-to-tell-a-job-offer-from-an-id-theft-trap/" rel="noopener" target="_blank">to masquerade on LinkedIn as job recruiters</a>, collecting personal and financial information from people who fall for employment scams.</p>
<p>But the Sustainability Group administrator Taylor said the bots he&#8217;s tracked strangely don&#8217;t respond to messages, nor do they appear to try to post content.</p>
<p>&#8220;Clearly they are not monitored,&#8221; Taylor assessed. &#8220;Or they&#8217;re just created and then left to fester.&#8221;</p>
<p>This experience was shared by the DevOp group admin Miller, who said he&#8217;s also tried baiting the phony profiles with messages referencing their fakeness. Miller says he&#8217;s worried someone is creating a massive social network of bots for some future attack in which the automated accounts may be used to amplify false information online, or at least muddle the truth.</p>
<p><span class="pullquote pqright">&#8220;It&#8217;s almost like someone is setting up a huge bot network so that when there&#8217;s a big message that needs to go out they can just mass post with all these fake profiles,&#8221; Miller said.</span></p>
<p>In last week&#8217;s story on this topic, I suggested LinkedIn could take one simple step that would make it far easier for people to make informed decisions about whether to trust a given profile: Add a “created on” date for every profile. Twitter does this, and it’s enormously helpful for filtering out a great deal of noise and unwanted communications.</p>
<p>Many of our readers on Twitter said LinkedIn needs to give employers more tools &#8212; perhaps some kind of application programming interface (API) &#8212; that would allow them to quickly remove profiles that falsely claim to be employed at their organizations.</p>
<p>Another reader suggested LinkedIn also could experiment with offering something akin to Twitter’s verified mark to users who chose to validate that they can respond to email at the domain associated with their stated current employer. </p>
<p>In response to questions from KrebsOnSecurity, LinkedIn said it was considering the domain verification idea.</p>
<p>&#8220;This is an ongoing challenge and we&#8217;re constantly improving our systems to stop fakes before they come online,&#8221; LinkedIn said in a written statement. &#8220;We do stop the vast majority of fraudulent activity we detect in our community &#8211; around 96% of fake accounts and around 99.1% of spam and scams. We&#8217;re also exploring new ways to protect our members such as expanding email domain verification. Our community is all about authentic people having meaningful conversations and to always increase the legitimacy and quality of our community.&#8221;</p>
<p>In <a href="https://www.bloomberg.com/opinion/articles/2022-10-04/fake-linkedin-profiles-threaten-the-professional-social-media-platform" target="_blank" rel="noopener">a story published Wednesday</a>, Bloomberg noted that LinkedIn has largely so far avoided the scandals about bots that have plagued networks like Facebook and Twitter. But that shine is starting to come off, as more users are forced to waste more of their time fighting off inauthentic accounts.</p>
<p>&#8220;What&#8217;s clear is that LinkedIn&#8217;s cachet as being the social network for serious professionals makes it the perfect platform for lulling members into a false sense of security,&#8221; Bloomberg&#8217;s <strong>Tim Cuplan</strong> wrote. &#8220;Exacerbating the security risk is the vast amount of data that LinkedIn collates and publishes, and which underpins its whole business model but which lacks any robust verification mechanisms.&#8221;</p>


feed_id: https://krebsonsecurity.com/?p=61479
title: Report: Big U.S. Banks Are Stiffing Account Takeover Victims
uri: Report-Big-U-S-Banks-Are-Stiffing-Account-Takeover-Victims
url: https://krebsonsecurity.com/2022/10/report-big-u-s-banks-are-stiffing-account-takeover-victims/
content:
<p><img class="aligncenter size-full wp-image-61495" src="media/a121f46f.zelle.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/10/zelle.png" alt="" width="718" height="478" /></p>
<p>When U.S. consumers have their online bank accounts hijacked and plundered by hackers, U.S. financial institutions are legally obligated to reverse any unauthorized transactions as long as the victim reports the fraud in a timely manner. But new data released this week suggests that for some of the nation&#8217;s largest banks, reimbursing account takeover victims has become more the exception than the rule.</p>
<p>The findings came in a report released by <strong>Sen. Elizabeth Warren</strong> (D-Mass.), who in April 2022 opened an investigation into fraud tied to <strong>Zelle</strong>, the &#8220;peer-to-peer&#8221; digital payment service used by many financial institutions that allows customers to quickly send cash to friends and family.</p>
<p>Zelle is run by <strong>Early Warning Services LLC</strong> (EWS), a private financial services company which is jointly owned by <strong>Bank of America</strong>, <strong>Capital One</strong>, <strong>JPMorgan Chase</strong>, <strong>PNC Bank</strong>, <strong>Truist</strong>, <strong>U.S. Bank</strong>, and <strong>Wells Fargo</strong>. Zelle is enabled by default for customers at <a href="https://www.zellepay.com/get-started" target="_blank" rel="noopener">over 1,000 different financial institutions</a>, even if a great many customers still don&#8217;t know it&#8217;s there.</p>
<p>Sen. Warren said several of the EWS owner banks &#8212; including Capital One, JPMorgan and Wells Fargo &#8212; failed to provide all of the requested data. But Warren did get the requested information from PNC, Truist and U.S. Bank.</p>
<p>&#8220;Overall, the three banks that provided complete data sets reported 35,848 cases of scams, involving over $25.9 million of payments in 2021 and the first half of 2022,&#8221; the report summarized. &#8220;In the vast majority of these cases, the banks did not repay the customers that reported being scammed. Overall these three banks reported repaying customers in only 3,473 cases (representing nearly 10% of scam claims) and repaid only $2.9 million.&#8221;</p>
<p>Importantly, the report distinguishes between cases that involve straight up bank account takeovers and unauthorized transfers (fraud), and those losses that stem from &#8220;fraudulently induced payments,&#8221; where the victim is tricked into authorizing the transfer of funds to scammers (scams).</p>
<p>A common example of the latter is the <a href="https://krebsonsecurity.com/2021/11/the-zelle-fraud-scam-how-it-works-how-to-fight-back/" target="_blank" rel="noopener">Zelle Fraud Scam</a>, which uses an ever-shifting set of come-ons to trick people into transferring money to fraudsters. The Zelle Fraud Scam often employs text messages and phone calls spoofed to look like they came from your bank, and the scam usually relates to fooling the customer into thinking they&#8217;re sending money to themselves when they&#8217;re really sending it to the crooks.</p>
<p>Here&#8217;s the rub: When a customer issues a payment order to their bank, the bank is obligated to honor that order so long as it passes a two-stage test. The first question asks, Did the request actually come from an authorized owner or signer on the account? In the case of Zelle scams, the answer is yes.</p>
<p><strong>Trace Fooshee</strong>, a strategic advisor in the anti money laundering practice at <strong>Aite-Novarica</strong>, said the second stage requires banks to give the customer&#8217;s transfer order a kind of &#8220;sniff test&#8221; using &#8220;commercially reasonable&#8221; fraud controls that generally are not designed to detect patterns involving social engineering.</p>
<p>Fooshee said the legal phrase &#8220;commercially reasonable&#8221; is the primary reason why no bank has much &#8212; if anything &#8212; in the way of controlling for scam detection.</p>
<p>&#8220;In order for them to deploy something that would detect a good chunk of fraud on something so hard to detect they would generate egregiously high rates of false positives which would also make consumers (and, then, regulators) very unhappy,&#8221; Fooshee said. &#8220;This would tank the business case for the service as a whole rendering it something that the bank can claim to NOT be commercially reasonable.&#8221;</p>
<p>Sen. Warren&#8217;s report makes clear that banks generally <em>do not</em> pay consumers back if they are fraudulently induced into making Zelle payments.</p>
<p>&#8220;In simple terms, Zelle indicated that it would provide redress for users in cases of unauthorized transfers in which a user’s account is accessed by a bad actor and used to transfer a payment,&#8221; the report continued. &#8220;However, EWS’ response also indicated that neither Zelle nor its parent bank owners would reimburse users fraudulently induced by a bad actor into making a payment on the platform.&#8221;</p>
<p>Still, the data suggest banks did repay at least some of the funds stolen from scam victims about 10 percent of the time. Fooshee said he&#8217;s surprised that number is so high.</p>
<p>&#8220;That banks are paying victims of authorized payment fraud scams anything at all is noteworthy,&#8221; he said. &#8220;That’s money that they’re paying for out of pocket almost entirely for goodwill. You could argue that repaying all victims is a sound strategy especially in the climate we’re in but to say that it should be what all banks do remains an opinion until Congress changes the law.&#8221;</p>
<p><H2>UNAUTHORIZED FRAUD</H2></p>
<p>However, when it comes to reimbursing victims of fraud and account takeovers, the report suggests banks are stiffing their customers whenever they can get away with it. &#8220;Overall, the four banks that provided complete data sets indicated that they reimbursed only 47% of the dollar amount of fraud claims they received,&#8221; the report notes.</p>
<p>How did the banks behave individually? From the report:</p>
<blockquote><p>-In 2021 and the first six months of 2022, <strong>PNC Bank</strong> indicated that its customers reported 10,683 cases of unauthorized payments totaling over $10.6 million, of which only 1,495 cases totaling $1.46 were refunded to consumers. PNC Bank left 86% of its customers that reported cases of fraud without recourse for fraudulent activity that occurred on Zelle.</p>
<p>-Over this same time period, <strong>U.S. Bank</strong> customers reported a total of 28,642 cases of unauthorized transactions totaling over $16.2 million, while only refunding 8,242 cases totaling less than $4.7 million.</p>
<p>-In the period between January 2021 and September 2022, <strong>Bank of America</strong> customers reported 81,797 cases of unauthorized transactions, totaling $125 million. Bank of America refunded only $56.1 million in fraud claims – less than 45% of the overall dollar value of claims made in that time.</p>
<p>&#8211;<strong>Truist</strong> indicated that the bank had a much better record of reimbursing defrauded customers over this same time period. During 2021 and the first half of 2022, Truist customers filed 24,752 unauthorized transaction claims amounting to $24.4 million. Truist reimbursed 20,349 of those claims, totaling $20.8 million – 82% of Truist claims were reimbursed over this period. Overall, however, the four banks that provided complete data sets indicated that they reimbursed only 47% of the dollar amount of fraud claims they received.</p></blockquote>
<p>Fooshee said there has long been a great deal of inconsistency in how banks reimburse unauthorized fraud claims &#8212; even after the <strong>Consumer Financial Protection Bureau</strong> (CPFB) came out with <a href="https://www.consumerfinance.gov/compliance/compliance-resources/deposit-accounts-resources/electronic-fund-transfers/electronic-fund-transfers-faqs/" target="_blank" rel="noopener">guidance</a> on what qualifies as an unauthorized fraud claim.</p>
<p>&#8220;Many banks reported that they were still not living up to those standards,&#8221; he said. &#8220;As a result, I imagine that the CFPB will come down hard on those with fines and we&#8217;ll see a correction.&#8221;<span id="more-61479"></span></p>
<p>Fooshee said many banks have recently adjusted their reimbursement policies to bring them more into line with the CFPB&#8217;s guidance from last year.</p>
<p>&#8220;So this is heading in the right direction but not with sufficient vigor and speed to satisfy critics,&#8221; he said.</p>
<p><strong>Seth Ruden</strong> is a payments fraud expert who serves as director of global advisory for digital identity company <strong>BioCatch</strong>. Ruden said Zelle has recently made &#8220;significant changes to its fraud program oversight because of consumer influence.&#8221;</p>
<p>&#8220;It is clear to me that despite sensational headlines, progress has been made to improve outcomes,&#8221; Ruden said. &#8220;Presently, losses in the network on a volume-adjusted basis are lower than those typical of credit cards.&#8221;</p>
<p>But he said any failure to reimburse victims of fraud and account takeovers only adds to pressure on Congress to do more to help victims of those scammed into authorizing Zelle payments.</p>
<p>&#8220;The bottom line is that regulations have not kept up with the speed of payment technology in the United States, and we’re not alone,&#8221; Ruden said. &#8220;For the first time in the UK, authorized payment scam losses have outpaced credit card losses and a regulatory response is now on the table. Banks have the choice right now to take action and increase controls or await regulators to impose a new regulatory environment.&#8221;</p>
<p>Sen. Warren&#8217;s report is available <a href="https://www.warren.senate.gov/imo/media/doc/ZELLE%20REPORT%20OCTOBER%202022.pdf?utm_source=substack&amp;utm_medium=email" target="_blank" rel="noopener">here</a> (PDF).</p>
<p><img loading="lazy" src="media/7dbc5007.zelletext.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/11/zelletext.png" alt="" width="1244" height="677" class="aligncenter size-full wp-image-57519" srcset="https://krebsonsecurity.com/wp-content/uploads/2021/11/zelletext.png 1244w, https://krebsonsecurity.com/wp-content/uploads/2021/11/zelletext-768x418.png 768w, https://krebsonsecurity.com/wp-content/uploads/2021/11/zelletext-782x426.png 782w, https://krebsonsecurity.com/wp-content/uploads/2021/11/zelletext-370x200.png 370w" sizes="(max-width: 1244px) 100vw, 1244px" /></p>
<p>There are, of course, some versions of the Zelle fraud scam that may be confusing financial institutions as to what constitutes &#8220;authorized&#8221; payment instructions. For example, the <a href="https://krebsonsecurity.com/2021/11/the-zelle-fraud-scam-how-it-works-how-to-fight-back/" rel="noopener" target="_blank">variant I wrote about earlier</a> this year began with a text message that spoofed the target&#8217;s bank and warned of a pending suspicious transfer.</p>
<p>Those who responded at all received a call from a number spoofed to make it look like the victim&#8217;s bank calling, and were asked to validate their identities by reading back a one-time password sent via SMS. In reality, the thieves had simply asked the bank&#8217;s website to reset the victim&#8217;s password, and that one-time code sent via text by the bank&#8217;s site was the only thing the crooks needed to reset the target&#8217;s password and drain the account using Zelle. </p>
<p>None of the above discussion involves <a href="https://krebsonsecurity.com/category/smallbizvictims/" rel="noopener" target="_blank">the risks affecting businesses that bank online</a>. Businesses in the United States do not enjoy the same fraud liability protection afforded to consumers, and if a banking trojan or clever phishing site results in a business account getting drained, most banks will not reimburse that loss. </p>
<p>This is why I have always and will continue to urge small business owners to conduct their online banking affairs only from a dedicated, access restricted and security-hardened device &#8212; and preferably a non-Windows machine.</p>
<p>For consumers, the same old advice remains the best: Watch your bank statements like a hawk, and immediately report and contest any charges that appear fraudulent or unauthorized.</p>


feed_id: https://krebsonsecurity.com/?p=61528
title: Microsoft Patch Tuesday, October 2022 Edition
uri: Microsoft-Patch-Tuesday-October-2022-Edition
url: https://krebsonsecurity.com/2022/10/microsoft-patch-tuesday-october-2022-edition/
content:
<p><strong>Microsoft</strong> today released updates to fix at least 85 security holes in its <strong>Windows</strong> operating systems and related software, including a new zero-day vulnerability in all supported versions of Windows that is being actively exploited. However, noticeably absent from this month&#8217;s Patch Tuesday are any updates to address a pair of zero-day flaws being exploited this past month in <strong>Microsoft Exchange Server</strong>.</p>
<p><img class="aligncenter wp-image-52647" src="media/2471c2d6.windowsec.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/08/windowsec.png" alt="" width="750" height="550" /></p>
<p>The new zero-day flaw&#8211; <a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-41033" target="_blank" rel="noopener">CVE-2022-41033</a> &#8212; is an &#8220;elevation of privilege&#8221; bug in the Windows COM+ event service, which provides system notifications when users logon or logoff. Microsoft says the flaw is being actively exploited, and that it was reported by an anonymous individual.</p>
<p>&#8220;Despite its relatively low score in comparison to other vulnerabilities patched today, this one should be at the top of everyone&#8217;s list to quickly patch,&#8221; said <strong>Kevin Breen</strong>, director of cyber threat research at <strong>Immersive Labs</strong>. &#8220;This specific vulnerability is a local privilege escalation, which means that an attacker would already need to have code execution on a host to use this exploit. Privilege escalation vulnerabilities are a common occurrence in almost every security compromise. Attackers will seek to gain SYSTEM or domain-level access in order to disable security tools, grab credentials with tools like Mimkatz and move laterally across the network.</p>
<p>Indeed, <strong>Satnam Narang</strong>, senior staff research engineer at <strong>Tenable</strong>, notes that almost half of the security flaws Microsoft patched this week are elevation of privilege bugs.<span id="more-61528"></span></p>
<p>Some privilege escalation bugs can be particularly scary. One example is <a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-37968" target="_blank" rel="noopener">CVE-2022-37968</a>, which affects organizations running <strong>Kubernetes</strong> clusters on <strong>Azure</strong> and earned a CVSS score of 10.0 &#8212; the most severe score possible.</p>
<p>Microsoft says that to exploit this vulnerability an attacker would need to know the randomly generated DNS endpoint for an Azure Arc-enabled Kubernetes cluster. But that may not be such a tall order, says Breen, who notes that a number of free and commercial DNS discovery services now make it easy to find this information on potential targets.</p>
<p>Late last month, Microsoft acknowledged that attackers were <a href="https://krebsonsecurity.com/2022/09/microsoft-two-new-0-day-flaws-in-exchange-server/" target="_blank" rel="noopener">exploiting two previously unknown vulnerabilities in Exchange Server</a>. Paired together, the two flaws are known as &#8220;ProxyNotShell&#8221; and they can be chained to allow remote code execution on Exchange Server systems.</p>
<p>Microsoft said it was expediting work on official patches for the Exchange bugs, and it urged affected customers to enable certain settings to mitigate the threat from the attacks. However, those mitigation steps were soon shown to be ineffective, and Microsoft has been <a href="https://msrc-blog.microsoft.com/2022/09/29/customer-guidance-for-reported-zero-day-vulnerabilities-in-microsoft-exchange-server/" target="_blank" rel="noopener">adjusting them on a daily basis nearly each since then</a>.</p>
<p>The lack of Exchange patches leaves a lot of Microsoft customers exposed. Security firm <strong>Rapid7</strong> said that as of early September 2022 the company observed more than 190,000 potentially vulnerable instances of Exchange Server exposed to the Internet.</p>
<p>&#8220;While Microsoft confirmed the zero-days and issued guidance faster than they have in the past, there are still no patches nearly two weeks out from initial disclosure,&#8221; said <strong>Caitlin Condon</strong>, senior manager of vulnerability research at Rapid7. &#8220;Despite high hopes that today&#8217;s Patch Tuesday release would contain fixes for the vulnerabilities, Exchange Server is conspicuously missing from the initial list of October 2022 security updates. Microsoft’s recommended rule for blocking known attack patterns has been bypassed multiple times, emphasizing the necessity of a true fix.&#8221;</p>
<p>Adobe also released <a href="https://helpx.adobe.com/security.html" target="_blank" rel="noopener">security updates to fix 29 vulnerabilities</a> across a variety of products, including <strong>Acrobat</strong> and <strong>Reader</strong>, <strong>ColdFusion</strong>, <strong>Commerce</strong> and <strong>Magento</strong>. Adobe said it is not aware of active attacks against any of these flaws.</p>
<p>For a closer look at the patches released by Microsoft today and indexed by severity and other metrics, check out the <a href="https://isc.sans.edu/forums/diary/October%202022%20Microsoft%20Patch%20Tuesday/29138/" target="_blank" rel="noopener">always-useful Patch Tuesday roundup</a> from the <strong>SANS Internet Storm Center</strong>. And it’s not a bad idea to hold off updating for a few days until Microsoft works out any kinks in the updates: <a href="https://www.askwoody.com/" target="_blank" rel="noopener">AskWoody.com</a> usually has the lowdown on any patches that may be causing problems for Windows users.</p>
<p>As always, please consider backing up your system or at least your important documents and data before applying system updates. And if you run into any problems with these updates, please drop a note about it here in the comments.</p>


feed_id: https://krebsonsecurity.com/?p=61582
title: Anti-Money Laundering Service AMLBot Cleans House
uri: Anti-Money-Laundering-Service-AMLBot-Cleans-House
url: https://krebsonsecurity.com/2022/10/anti-money-laundering-service-amlbot-cleans-house/
content:
<p><strong>AMLBot</strong>, a service that helps businesses avoid transacting with cryptocurrency wallets that have been sanctioned for cybercrime activity, said an investigation published by KrebsOnSecurity last year helped it shut down three dark web services that secretly resold its technology to help cybercrooks avoid detection by anti-money laundering systems.</p>
<div id="attachment_56584" style="width: 981px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-56584" class="size-full wp-image-56584" src="media/2a7d66af.ant-result.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/08/ant-result.png" alt="" width="971" height="795" srcset="https://krebsonsecurity.com/wp-content/uploads/2021/08/ant-result.png 971w, https://krebsonsecurity.com/wp-content/uploads/2021/08/ant-result-768x629.png 768w, https://krebsonsecurity.com/wp-content/uploads/2021/08/ant-result-782x640.png 782w" sizes="(max-width: 971px) 100vw, 971px" /><p id="caption-attachment-56584" class="wp-caption-text">Antinalysis, as it existed in 2021.</p></div>
<p>In August 2021, KrebsOnSecurity published &#8220;<a href="https://krebsonsecurity.com/2021/08/new-anti-anti-money-laundering-services-for-crooks/" target="_blank" rel="noopener">New Anti Anti-Money Laundering Services for Crooks</a>,&#8221; which examined <a href="https://web.archive.org/web/20220305155737/https://antinalysis.org/" target="_blank" rel="noopener"><strong>Antinalysis</strong></a>, a service marketed on cybercrime forums that purported to offer a glimpse of how one&#8217;s payment activity might be flagged by law enforcement agencies and private companies that track and trace cryptocurrency transactions.</p>
<p>&#8220;Worried about dirty funds in your BTC address? Come check out Antinalysis, the new address risk analyzer,&#8221; read the service’s opening announcement. &#8220;This service is dedicated to individuals that have the need to possess complete privacy on the blockchain, offering a perspective from the opponent’s point of view in order for the user to comprehend the possibility of his/her funds getting flagged down under autocratic illegal charges.&#8221;</p>
<p>Antinalysis allows free lookups, but anyone wishing to conduct bulk look-ups has to pay at least USD $3, with a minimum $30 purchase. Other plans go for as high as $6,000 for 5,000 requests. <strong>Nick Bax</strong>, a security researcher who specializes in tracing cryptocurrency transactions, told KrebsOnSecurity at the time that Antinalysis was likely a clone of AMLBot because the two services generated near-identical results.</p>
<p>AMLBot shut down Antinalysis&#8217;s access just hours after last year&#8217;s story went live. However, Antinalysis[.]org remains online and accepting requests, as does the service&#8217;s Tor-based domain, and it is unclear how those services are sourcing their information.</p>
<p>AMLBot spokesperson <strong>Polina Smoliar</strong> said the company undertook a thorough review after that discovery, and in the process found two other services similar to Antinalysis that were reselling their application programming interface (API) access to cybercrooks.</p>
<p>Smoliar said that following the revelations about Antinalysis, AMLBot audited its entire client base, and implemented the ability to provide APIs only after a contract is signed and the client has been fully audited. AMLBot said it also instituted 24/7 monitoring of all client transactions.</p>
<p>&#8220;As a result of these actions, two more services with the name AML (the same as AMLBot has) were found to be involved in fraudulent schemes,&#8221; Smoliar said. &#8220;Information about the fraudsters was also sent to key market participants, and their transaction data was added to the tracking database to better combat money laundering.&#8221;</p>
<div id="attachment_61612" style="width: 764px" class="wp-caption aligncenter"><a href="media/32a4350d.pharoah-e.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/10/pharoah-e.png" target="_blank" rel="noopener"><img aria-describedby="caption-attachment-61612" loading="lazy" class="wp-image-61612" src="media/32a4350d.pharoah-e.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/10/pharoah-e.png" alt="" width="754" height="331" srcset="https://krebsonsecurity.com/wp-content/uploads/2022/10/pharoah-e.png 1872w, https://krebsonsecurity.com/wp-content/uploads/2022/10/pharoah-e-768x337.png 768w, https://krebsonsecurity.com/wp-content/uploads/2022/10/pharoah-e-1536x674.png 1536w, https://krebsonsecurity.com/wp-content/uploads/2022/10/pharoah-e-782x343.png 782w" sizes="(max-width: 754px) 100vw, 754px" /></a><p id="caption-attachment-61612" class="wp-caption-text">Experts say the founder of Antinalysis also runs a darknet market for narcotics.</p></div>
<p>The Antinalysis homepage and chatter on the cybercrime forums indicates the service was created by a group of coders known as the <strong>Incognito Team</strong>. <strong>Tom Robinson</strong>, co-founder of the blockchain intelligence firm <a href="https://www.elliptic.com" target="_blank" rel="noopener">Elliptic</a>, said the creator of Antinalysis is also one of the developers of Incognito Market, a darknet marketplace specializing in the sale of narcotics.</p>
<p>&#8220;Incognito was launched in late 2020, and accepts payments in both Bitcoin and Monero, a cryptoasset offering heightened anonymity,&#8221; Robinson said. &#8220;The launch of Antinalysis likely reflects the difficulties faced by the market and its vendors in cashing out their Bitcoin proceeds.&#8221;</p>


feed_id: https://krebsonsecurity.com/?p=61587
title: How Card Skimming Disproportionally Affects Those Most In Need
uri: How-Card-Skimming-Disproportionally-Affects-Those-Most-In-Need
url: https://krebsonsecurity.com/2022/10/how-card-skimming-disproportionally-affects-those-most-in-need/
content:
<p>When people banking in the United States lose money because their payment card got <a href="https://krebsonsecurity.com/?s=atm+skimmer" target="_blank" rel="noopener">skimmed at an ATM</a>, <a href="https://krebsonsecurity.com/?s=pump+skimmers" target="_blank" rel="noopener">gas pump</a> or <a href="https://krebsonsecurity.com/?s=checkout+skimmer+overlay" target="_blank" rel="noopener">grocery store checkout terminal</a>, they may face hassles or delays in recovering any lost funds, but they are almost always made whole by their financial institution. Yet, one class of Americans &#8212; those receiving food assistance benefits via state-issued prepaid debit cards &#8212; are particularly exposed to losses from skimming scams, and usually have little recourse to do anything about it.</p>
<div id="attachment_61644" style="width: 682px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-61644" class=" wp-image-61644" src="media/1c4fb03a.califebt.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/10/califebt.png" alt="" width="672" height="425" srcset="https://krebsonsecurity.com/wp-content/uploads/2022/10/califebt.png 912w, https://krebsonsecurity.com/wp-content/uploads/2022/10/califebt-768x485.png 768w, https://krebsonsecurity.com/wp-content/uploads/2022/10/califebt-782x494.png 782w" sizes="(max-width: 672px) 100vw, 672px" /><p id="caption-attachment-61644" class="wp-caption-text">California&#8217;s EBT card does not currently include a chip. That silver square is a hologram.</p></div>
<p>Over the past several months, authorities in multiple U.S. states have reported rapid increases in skimming losses tied to people who receive assistance via Electronic Benefits Transfer (EBT), which allows a <a href="https://www.fns.usda.gov/snap/supplemental-nutrition-assistance-program" target="_blank" rel="noopener">Supplemental Nutrition Assistance Program</a> (SNAP) participant to pay for food using SNAP benefits.</p>
<p>When a participant uses a SNAP payment card at an authorized retail store, their SNAP EBT account is debited to reimburse the store for food that was purchased. EBT is used in all 50 states, the District of Columbia, Puerto Rico, the Virgin Islands, and Guam.</p>
<p>EBT cards work just like regular debit cards, in that they can be used along with a personal identification number (PIN) to pay for goods at participating stores, and to withdraw cash from an ATM.</p>
<p>However, EBT cards differ from debit cards issued to most Americans in two important ways. First, <a href="https://krebsonsecurity.com/2022/10/glut-of-fake-linkedin-profiles-pits-hr-against-the-bots/" target="_blank" rel="noopener">most states</a> do not equip EBT cards with smart chip technology, which can make payment cards much more difficult and expensive for skimming thieves to clone.</p>
<p>Alas, it is no accident that all of the states reporting recent spikes in fraud tied to EBT accounts &#8212; including <a href="https://abc30.com/atm-skimmers-ebt-money-stolen-credit-card-theft-bank-of-america/11814857/" target="_blank" rel="noopener">California</a>, <a href="https://www.nbcconnecticut.com/news/local/state-warns-residents-who-receive-snap-ebt-benefits-after-learning-about-skimming-phishing-incidents/2849775/" target="_blank" rel="noopener">Connecticut</a>, <a href="https://www.thebaltimorebanner.com/community/criminal-justice/one-womans-quest-for-justice-after-almost-3000-of-benefits-were-stolen-LHIKMQZSNJBULC7LXCEIE264OA/" target="_blank" rel="noopener">Maryland</a>, <a href="https://www.fox43.com/article/news/crime/york-county-ebt-card-cloning-thefts/521-64b60fbd-b4be-4fd9-8928-5c6ed8d45faa" target="_blank" rel="noopener">Pennsylvania</a>, <a href="https://www.newschannel5.com/news/nashville-family-scammed-in-ebt-card-skimmer-scheme" target="_blank" rel="noopener">Tennessee</a>, and <a href="http://wtkr.com/news/chesapeake-mom-warns-others-of-ebt-scam-after-losing-benefits" target="_blank" rel="noopener">Virginia</a> appear to currently issue chip-less cards to their EBT recipients.</p>
<div id="attachment_61661" style="width: 622px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-61661" loading="lazy" class=" wp-image-61661" src="media/aab247ad.mass-dta.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/10/mass-dta.png" alt="" width="612" height="377" /><p id="caption-attachment-61661" class="wp-caption-text">The Massachusetts SNAP benefits card looks more like a library card than a payment card.  Oddly enough, both are reliant on the same fundamentally insecure technology: The magnetic stripe, which stores cardholder data in plain text that can be easily copied.</p></div>
<p>In September, authorities in California arrested three men thought to be part of a skimming crew that specifically targeted EBT cards and balances. The men allegedly installed <a href="https://krebsonsecurity.com/2022/09/say-hello-to-crazy-thin-deep-insert-atm-skimmers/" target="_blank" rel="noopener">deep insert skimmers</a>, and stole PINs using tiny hidden cameras.</p>
<p>&#8220;The arrests were the result of a joint investigation by the Sheriff’s Office and Bank of America corporate security,&#8221; reads <a href="https://www.sacbee.com/news/local/crime/article265394781.html" target="_blank" rel="noopener">a September 2022 story</a> from <em>The Sacramento Bee</em>. &#8220;The investigation focused on illegal skimming, particularly the high-volume cash-out sequence at ATMs near the start of each month when Electronic Benefits Transfer accounts are funded by California.&#8221;</p>
<p>Armed with a victim&#8217;s PIN along with stolen card data, thieves can clone the card onto anything with a magnetic stripe and use it at ATMs to withdraw cash, or as a payment instrument at any establishment that accepts EBT cards.</p>
<div id="attachment_61645" style="width: 760px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-61645" loading="lazy" class=" wp-image-61645" src="media/30747102.sacskims.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/10/sacskims.png" alt="" width="750" height="473" /><p id="caption-attachment-61645" class="wp-caption-text">Skimming gear seized from three suspects arrested by Sacramento authorities in September. Image: Sacramento County Sheriff&#8217;s Office.</p></div>
<p>Although it may be shocking that California &#8212; one of America&#8217;s wealthiest states &#8212; still treats EBT recipients as second-class citizens by issuing them chip-less debit cards, California <a href="https://foodstampsebt.com/category/ebt-card/ebt-card-balance/" target="_blank" rel="noopener">behaves like most other states in this regard</a>.</p>
<p>More critical, however, is the second way SNAP cards differ from regular debit cards: Recipients of SNAP benefits have little to no hope of recovering their funds when their EBT cards are copied by card-skimming devices and used for fraud.</p>
<p>That&#8217;s because in the SNAP program, federal law bars the states from replacing SNAP benefits using federal funds. And while some of these EBT cards have Visa or MasterCard logos on them, it is not up to those companies to replace funds in the event of fraud.</p>
<p>Victims are encouraged to report the theft to both their state agency and the local police, but many victims say they rarely receive updates on their cases from police, and, if they hear from the state, it&#8217;s usually the agency telling them it found no evidence of fraud.<span id="more-61587"></span></p>
<div id="attachment_61647" style="width: 616px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-61647" loading="lazy" class=" wp-image-61647" src="media/6ecada8f.md-ebt.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/10/md-ebt.png" alt="" width="606" height="373" /><p id="caption-attachment-61647" class="wp-caption-text">Maryland&#8217;s EBT card.</p></div>
<p>That&#8217;s according to <strong>Brenna Smith</strong>, a reporter at <em>The Baltimore Banner</em> who <a href="https://www.thebaltimorebanner.com/community/criminal-justice/one-womans-quest-for-justice-after-almost-3000-of-benefits-were-stolen-LHIKMQZSNJBULC7LXCEIE264OA/" target="_blank" rel="noopener">recently wrote about</a> the case of a Maryland mother of three who lost nearly $3,000 in SNAP benefits thanks to a skimmer installed at a local 7-Eleven. Maryland [Department of Human Services] spokesperson Katherine Morris told the Banner there was evidence of &#8220;a nationwide EBT card cloning scheme.&#8221;</p>
<p>The woman profiled in Smith&#8217;s story contacted all of the retailers where her EBT card was used to buy thousands of dollars worth of baby formula. Two of those retailers agreed to share video surveillance footage of the people making the purchases at the exact timestamps specified in her EBT account history: The videos clearly showed it was the same fraudster making both purchases with a cloned copy of her EBT card.</p>
<p>Even after the police officer assigned to the victim&#8217;s case confirmed they found a skimmer installed at the 7-Eleven store she frequented, her claim &#8212; which was denied &#8212; is still languishing in appeals months later.</p>
<div id="attachment_61640" style="width: 759px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-61640" loading="lazy" class=" wp-image-61640" src="media/25e92d74.ebt-skimscammer.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/10/ebt-skimscammer.png" alt="" width="749" height="496" srcset="https://krebsonsecurity.com/wp-content/uploads/2022/10/ebt-skimscammer.png 907w, https://krebsonsecurity.com/wp-content/uploads/2022/10/ebt-skimscammer-768x509.png 768w, https://krebsonsecurity.com/wp-content/uploads/2022/10/ebt-skimscammer-782x518.png 782w" sizes="(max-width: 749px) 100vw, 749px" /><p id="caption-attachment-61640" class="wp-caption-text">(Left) A video still showing a couple purchasing almost $1,200 in baby formula using SNAP benefits. (Right) A video still of a woman leaving from the CVS in Seat Pleasant. Image: The Baltimore Banner.</p></div>
<p><strong>The Center for Law and Social Policy</strong> (CLASP) recently published <a href="https://www.clasp.org/blog/five-ways-state-agencies-can-support-ebt-users-at-risk-of-skimming/" target="_blank" rel="noopener">Five Ways State Agencies Can Support EBT Users at Risk of Skimming</a>. CLASP says while it is true states can&#8217;t use federal funds to replace benefits unless the loss was due to a &#8220;system error,&#8221; states could use their own funds.</p>
<p>&#8220;Doing so will ensure families don’t have to go without food, gas money, or their rent for the month,&#8221; CLASP wrote.</p>
<p>That would help address the symptoms of card skimming, but not a root cause. Hardly anyone is suggesting the obvious, which is to equip EBT cards with the same security technology afforded to practically everyone else participating in the U.S. banking system.</p>
<p>There are several reasons most state-issued EBT cards do not include chips. For starters, nobody says they have to. Also, it&#8217;s a fair bit more expensive to produce chip cards versus plain old magnetic stripe cards, and many state assistance programs are chronically under-funded. Finally, there is no vocal (or at least well-heeled) constituency advocating for change.</p>


feed_id: https://krebsonsecurity.com/?p=61544
title: Battle with Bots Prompts Mass Purge of Amazon, Apple Employee Accounts on LinkedIn
uri: Battle-with-Bots-Prompts-Mass-Purge-of-Amazon-Apple-Employee-Accounts
url:
https://krebsonsecurity.com/2022/10/battle-with-bots-prompts-mass-purge-of-amazon-apple-employee-accounts-on-linkedin/

content:
<p>On October 10, 2022, there were 576,562 <strong>LinkedIn</strong> accounts that listed their current employer as <strong>Apple Inc.</strong> The next day, half of those profiles no longer existed. A similarly dramatic drop in the number of LinkedIn profiles claiming employment at <strong>Amazon</strong> comes as LinkedIn is struggling to combat a significant uptick in the creation of fake employee accounts that pair AI-generated profile photos with text lifted from legitimate users.</p>
<p><a href="https://www.linkedin.com/in/jaypinho/" target="_blank" rel="noopener">Jay Pinho</a> is a developer who is working on a product that tracks company data, including hiring. Pinho has been using LinkedIn to monitor daily employee headcounts at several dozen large organizations, and last week he noticed that two of them had far fewer people claiming to work for them than they did just 24 hours previously.</p>
<p>Pinho&#8217;s screenshot below shows the daily count of employees as displayed on <a href="https://www.linkedin.com/company/amazon/" rel="noopener" target="_blank">Amazon&#8217;s LinkedIn homepage</a>. Pinho said his scraper shows that the number of LinkedIn profiles claiming current roles at Amazon fell from roughly 1.25 million to 838,601 in just one day, a 33 percent drop:</p>
<div id="attachment_61548" style="width: 765px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-61548" class=" wp-image-61548" src="media/18b2a5cf.LI-Amazon.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/10/LI-Amazon.png" alt="" width="755" height="501" srcset="https://krebsonsecurity.com/wp-content/uploads/2022/10/LI-Amazon.png 1253w, https://krebsonsecurity.com/wp-content/uploads/2022/10/LI-Amazon-768x510.png 768w, https://krebsonsecurity.com/wp-content/uploads/2022/10/LI-Amazon-782x519.png 782w" sizes="(max-width: 755px) 100vw, 755px" /><p id="caption-attachment-61548" class="wp-caption-text">The number of LinkedIn profiles claiming current positions at Amazon fell 33 percent overnight. Image: twitter.com/jaypinho</p></div>
<p>As stated above, the number of LinkedIn profiles that claimed to work at Apple fell by approximately 50 percent on Oct. 10, according to Pinho&#8217;s analysis:</p>
<div id="attachment_61549" style="width: 766px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-61549" loading="lazy" class=" wp-image-61549" src="media/211c75dd.LI-Apple.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/10/LI-Apple.png" alt="" width="756" height="502" srcset="https://krebsonsecurity.com/wp-content/uploads/2022/10/LI-Apple.png 1253w, https://krebsonsecurity.com/wp-content/uploads/2022/10/LI-Apple-768x510.png 768w, https://krebsonsecurity.com/wp-content/uploads/2022/10/LI-Apple-782x519.png 782w" sizes="(max-width: 756px) 100vw, 756px" /><p id="caption-attachment-61549" class="wp-caption-text">Image: twitter.com/jaypinho</p></div>
<p>Neither Amazon or Apple responded to requests for comment. LinkedIn declined to answer questions about the account purges, saying only that the company is constantly working to keep the platform free of fake accounts. In June, LinkedIn <a href="https://blog.linkedin.com/2022/june/16/working-together-to-keep-linkedin-safe" rel="noopener" target="_blank">acknowledged it was seeing a rise in fraudulent activity</a> happening on the platform.</p>
<p>KrebsOnSecurity hired Menlo Park, Calif.-based <strong>SignalHire</strong> to check Pinho&#8217;s numbers. SignalHire keeps track of active and former profiles on LinkedIn, and during the Oct 9-11 timeframe SignalHire said it saw somewhat smaller but still unprecedented drops in active profiles tied to Amazon and Apple. </p>
<p>&#8220;The drop in the percentage of 7-10 percent [of all profiles], as it happened [during] this time, is not something that happened before,&#8221; SignalHire&#8217;s <strong>Anastacia Brown</strong> told KrebsOnSecurity. </p>
<p>Brown said the normal daily variation in profile numbers for these companies is plus or minus one percent.</p>
<p>&#8220;That&#8217;s definitely the first huge drop that happened throughout the time we&#8217;ve collected the profiles,&#8221; she said.</p>
<p>In late September 2022, KrebsOnSecurity warned about <a href="https://krebsonsecurity.com/2022/09/fake-ciso-profiles-on-linkedin-target-fortune-500s/" target="_blank" rel="noopener">the proliferation of fake LinkedIn profiles for Chief Information Security Officer (CISO) roles</a> at some of the world&#8217;s largest corporations. A <a href="https://krebsonsecurity.com/2022/10/glut-of-fake-linkedin-profiles-pits-hr-against-the-bots/" target="_blank" rel="noopener">follow-up story on Oct. 5</a> showed how the phony profile problem has affected virtually all executive roles at corporations, and how these fake profiles are creating an identity crisis for the businesses networking site and the companies that rely on it to hire and screen prospective employees.<span id="more-61544"></span></p>
<p>A day after that second story ran, KrebsOnSecurity <a href="https://twitter.com/briankrebs/status/1578134158752227328" target="_blank" rel="noopener">heard from a recruiter</a> who noticed the number of LinkedIn profiles that claimed virtually any role in network security had dropped seven percent overnight. LinkedIn declined to comment about that earlier account purge, saying only that, &#8220;We’re constantly working at taking down fake accounts.&#8221; </p>
<div id="attachment_61460" style="width: 763px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-61460" loading="lazy" class=" wp-image-61460" src="media/b8de95d8.botgroup2.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/10/botgroup2.png" alt="" width="753" height="417" srcset="https://krebsonsecurity.com/wp-content/uploads/2022/10/botgroup2.png 1797w, https://krebsonsecurity.com/wp-content/uploads/2022/10/botgroup2-768x425.png 768w, https://krebsonsecurity.com/wp-content/uploads/2022/10/botgroup2-1536x850.png 1536w, https://krebsonsecurity.com/wp-content/uploads/2022/10/botgroup2-782x433.png 782w" sizes="(max-width: 753px) 100vw, 753px" /><p id="caption-attachment-61460" class="wp-caption-text">A &#8220;swarm&#8221; of LinkedIn AI-generated bot accounts flagged by a LinkedIn group administrator recently.</p></div>
<p>It&#8217;s unclear whether LinkedIn is responsible for this latest account purge, or if individually affected companies are starting to take action on their own. The timing, however, argues for the former, as the account purges for Apple and Amazon employees tracked by Pinho appeared to happen within the same 24 hour period.<!--more--></p>
<p>It&#8217;s also unclear who or what is behind the recent proliferation of fake executive profiles on LinkedIn. Cybersecurity firm <strong>Mandiant</strong> (recently acquired by <strong>Google</strong>) <a href="https://www.yahoo.com/video/north-korean-fraudsters-suspected-copying-153907880.html" target="_blank" rel="noopener">told Bloomberg</a> that hackers working for the North Korean government have been copying resumes and profiles from leading job listing platforms LinkedIn and <strong>Indeed</strong>, as part of an elaborate scheme to land jobs at cryptocurrency firms.</p>
<p>On this point, Pinho said he noticed an account purge in early September that targeted fake profiles tied to jobs at cryptocurrency exchange <strong>Binance</strong>. Up until Sept. 3, there were 7,846 profiles claiming current executive roles at Binance. The next day, that number stood at 6,102, a 23 percent drop (by <a href="https://twitter.com/cz_binance/status/1558894008893669378" target="_blank" rel="noopener">some accounts</a> that 6,102 head count is still wildly inflated).</p>
<p><img loading="lazy" class="aligncenter wp-image-61550" src="media/3c325035.LI-Binance.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/10/LI-Binance.png" alt="" width="756" height="440" srcset="https://krebsonsecurity.com/wp-content/uploads/2022/10/LI-Binance.png 1227w, https://krebsonsecurity.com/wp-content/uploads/2022/10/LI-Binance-768x447.png 768w, https://krebsonsecurity.com/wp-content/uploads/2022/10/LI-Binance-782x455.png 782w" sizes="(max-width: 756px) 100vw, 756px" /></p>
<p>Fake profiles also may be tied to so-called <a href="https://krebsonsecurity.com/2022/07/massive-losses-define-epidemic-of-pig-butchering/" target="_blank" rel="noopener">“pig butchering” scams</a>, wherein people are lured by flirtatious strangers online into investing in cryptocurrency trading platforms that eventually seize any funds when victims try to cash out.</p>
<p>In addition, identity thieves have been known <a href="https://krebsonsecurity.com/2021/05/how-to-tell-a-job-offer-from-an-id-theft-trap/" target="_blank" rel="noopener">to masquerade on LinkedIn as job recruiters</a>, collecting personal and financial information from people who fall for employment scams.</p>
<p><strong>Nicholas Weaver</strong>, a researcher for the <a href="https://www.icsi.berkeley.edu/icsi/" target="_blank" rel="noopener">International Computer Science Institute</a> at <strong>University of California, Berkeley</strong>, suggested another explanation for the recent glut of phony LinkedIn profiles: Someone may be setting up a mass network of accounts in order to more fully scrape profile information from the entire platform.</p>
<p>&#8220;Even with just a standard LinkedIn account, there&#8217;s a pretty good amount of profile information just in the default two-hop networks,&#8221; Weaver said. &#8220;We don&#8217;t know the purpose of these bots, but we know creating bots isn&#8217;t free and creating hundreds of thousands of bots would require a lot of resources.&#8221;</p>
<p>In response to last week&#8217;s story about the explosion of phony accounts on LinkedIn, the company said it was exploring new ways to protect members, such as expanding email domain verification. Under such a scheme, LinkedIn users would be able to publicly attest that their profile is accurate by verifying that they can respond to email at the domain associated with their current employer.</p>
<p>LinkedIn claims that its security systems detect and block approximately 96 percent of fake accounts. And despite the recent purges, LinkedIn may be telling the truth, Weaver said.</p>
<p>&#8220;There&#8217;s no way you can test for that,&#8221; he said. &#8220;Because technically, it may be that there were actually 100 million bots trying to sign up at LinkedIn as employees at Amazon.&#8221;</p>
<p>Weaver said the apparent mass account purge at LinkedIn underscores the size of the bot problem, and could present a &#8220;real and material change&#8221; for LinkedIn.</p>
<p>&#8220;It may mean the statistics they&#8217;ve been reporting about usage and active accounts are off by quite a bit,&#8221; Weaver said.</p>


feed_id: https://krebsonsecurity.com/?p=61714
title: Accused ‘Raccoon’ Malware Developer Fled Ukraine After Russian Invasion
uri: Accused-Raccoon-Malware-Developer-Fled-Ukraine-After-Russian-Inv
url:
https://krebsonsecurity.com/2022/10/accused-raccoon-malware-developer-fled-ukraine-after-russian-invasion/

content:
<p>A 26-year-old Ukrainian man is awaiting extradition from The Netherlands to the United States on charges that he acted as a core developer for <strong>Raccoon</strong>, a popular &#8220;malware-as-a-service&#8221; offering that helped paying customers steal passwords and financial data from millions of cybercrime victims. KrebsOnSecurity has learned that the defendant was busted in March 2022, after fleeing mandatory military service in Ukraine in the weeks following the Russian invasion.</p>
<div id="attachment_61715" style="width: 760px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-61715" class=" wp-image-61715" src="media/5840fd2e.sokolovskyborder.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/10/sokolovskyborder.png" alt="" width="750" height="423" srcset="https://krebsonsecurity.com/wp-content/uploads/2022/10/sokolovskyborder.png 1130w, https://krebsonsecurity.com/wp-content/uploads/2022/10/sokolovskyborder-768x433.png 768w, https://krebsonsecurity.com/wp-content/uploads/2022/10/sokolovskyborder-782x441.png 782w" sizes="(max-width: 750px) 100vw, 750px" /><p id="caption-attachment-61715" class="wp-caption-text">Ukrainian national Mark Sokolovsky, seen here in a Porsche Cayenne on Mar. 18 fleeing mandatory military service in Ukraine. This image was taken by Polish border authorities as Sokolovsky&#8217;s vehicle entered Germany. Image: KrebsOnSecurity.com.</p></div>
<p>The <strong>U.S. Attorney for the Western District of Texas</strong> unsealed an indictment last week that named <strong>Mark Sokolvsky</strong> as the core developer for the Raccoon Infostealer business, which was marketed on several Russian-language cybercrime forums beginning in 2019.</p>
<p>Raccoon was essentially a Web-based control panel, where &#8212; for $200 a month &#8212; customers could get the latest version of the Raccoon Infostealer malware, and interact with infected systems in real time. Security experts say the passwords and other data stolen by Raccoon malware were often resold to groups engaged in deploying ransomware.</p>
<p>Working with investigators in Italy and The Netherlands, U.S. authorities seized a copy of the server used by Raccoon to help customers manage their botnets. According to the <strong>U.S. Justice Department</strong>, FBI agents have identified more than 50 million unique credentials and forms of identification (email addresses, bank accounts, cryptocurrency addresses, credit card numbers, etc.) stolen with the help of Raccoon.</p>
<div id="attachment_61733" style="width: 760px" class="wp-caption aligncenter"><a href="media/71105af9.raccoonpanel.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/10/raccoonpanel.png" target="_blank" rel="noopener"><img aria-describedby="caption-attachment-61733" loading="lazy" class="wp-image-61733" src="media/71105af9.raccoonpanel.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/10/raccoonpanel.png" alt="" width="750" height="470" srcset="https://krebsonsecurity.com/wp-content/uploads/2022/10/raccoonpanel.png 945w, https://krebsonsecurity.com/wp-content/uploads/2022/10/raccoonpanel-768x481.png 768w, https://krebsonsecurity.com/wp-content/uploads/2022/10/raccoonpanel-782x490.png 782w" sizes="(max-width: 750px) 100vw, 750px" /></a><p id="caption-attachment-61733" class="wp-caption-text">The Raccoon v. 1 web panel, where customers could search by infected IP, and stolen cookies, wallets, domains and passwords.</p></div>
<p>The unsealed <a href="media/299e7423.SokolovskyIndictment.pdf" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/10/SokolovskyIndictment.pdf" target="_blank" rel="noopener">indictment</a> (PDF) doesn&#8217;t delve much into how investigators tied Sokolovsky to Raccoon, but two sources close to the investigation shared more information about that process on condition of anonymity because they were not authorized to discuss the case publicly.</p>
<p>According to those sources, U.S. authorities zeroed in on an operational security mistake that the Raccoon developer made early on in his posts to the crime forums, connecting a Gmail account for a cybercrime forum identity used by the Raccoon developer (&#8220;Photix&#8221;) to an Apple iCloud account belonging to Sokolovsky. For example, the indictment includes a photo that investigators subpoenaed from Sokolovsky&#8217;s iCloud account that shows him posing with several stacks of bundled cash.</p>
<div id="attachment_61717" style="width: 559px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-61717" loading="lazy" class="size-full wp-image-61717" src="media/91b382f0.marks-stacks.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/10/marks-stacks.png" alt="" width="549" height="776" /><p id="caption-attachment-61717" class="wp-caption-text">A selfie pulled from Mark Sokolovsky&#8217;s iCloud account. Image: USDOJ.</p></div>
<p>When Russia invaded Ukraine in late February 2022, Sokolovsky was living in Kharkiv, a city in northeast Ukraine that would soon come under heavy artillery bombardment from Russian forces. Authorities monitoring Sokolovsky&#8217;s iCloud account had spent weeks watching him shuttle between Kharkiv and the Ukrainian capital Kyiv, but on Mar. 18, 2022, his phone suddenly showed up in Poland.</p>
<p>Investigators learned from Polish border guards that Sokolovsky had fled Ukraine in a Porsche Cayenne along with a young blond woman, leaving his mother and other family behind. The image at the top of this post was shared with U.S. investigators by Polish border security officials, and it shows Sokolovsky leaving Poland for Germany on Mar. 18.</p>
<p>At the time, all able-bodied men of military age were required to report for service to help repel the Russian invasion, and it would have been illegal for Sokolovsky to leave Ukraine without permission. But both sources said investigators believe Sokolovsky bribed border guards to let them pass.</p>
<p>Authorities soon tracked Sokolvsky&#8217;s phone through Germany and eventually to The Netherlands, with his female companion helpfully documenting every step of the trip on her Instagram account. Here is a picture she posted of the two embracing upon their arrival in Amsterdam&#8217;s Dam Square:</p>
<p><img loading="lazy" class="aligncenter wp-image-61718" src="media/52a2ddec.marks-damsquare.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/10/marks-damsquare.png" alt="" width="739" height="681" srcset="https://krebsonsecurity.com/wp-content/uploads/2022/10/marks-damsquare.png 777w, https://krebsonsecurity.com/wp-content/uploads/2022/10/marks-damsquare-768x708.png 768w" sizes="(max-width: 739px) 100vw, 739px" /></p>
<p>Authorities in The Netherlands arrested Sokolovsky on Mar. 20, and quickly seized control over the Raccoon Infostealer infrastructure. Meanwhile, on March 25 the accounts that had previously advertised the Raccoon Stealer malware on cybercrime forums announced the service was closing down. The parting message to customers said nothing of an arrest, and instead insinuated that the core members in charge of the malware-as-a-service project had perished in the Russian invasion.<span id="more-61714"></span></p>
<p>&#8220;Unfortunately, due to the &#8216;special operation,&#8217; we will have to close our Raccoon Stealer project,&#8221; the team announced Mar. 25. &#8220;Our team members who were responsible for critical components of the product are no longer with us. Thank you for this experience and time, for every day, unfortunately everything, sooner or later, the end of the WORLD comes to everyone.&#8221;</p>
<p>Sokolovsky&#8217;s extradition to the United States has been granted, but he is appealing that decision. He faces one count of conspiracy to commit computer fraud; one count of conspiracy to commit wire fraud; one count of conspiracy to commit money laundering, and one count of aggravated identity theft.</p>
<p>Sources tell KrebsOnSecurity that Sokolovsky has been consulting with Houston, Tx.-based attorney <strong>F. Andino Reynal</strong>, the same lawyer who represented <strong>Alex Jones</strong> in the recent defamation lawsuit against Jones and his conspiracy theory website <strong>Infowars</strong>. Reynal was responsible for what Jones himself referred to as <a href="https://www.reuters.com/legal/government/alex-jones-lawyer-terrible-horrible-no-good-very-bad-week-2022-08-08/" target="_blank" rel="noopener">the &#8220;Perry Mason&#8221; moment of the trial</a>, wherein the plaintiff&#8217;s lawyer revealed that Reynal had inadvertently given them an entire digital copy of Jones&#8217;s cell phone. Mr. Reynal did not respond to requests for comment.</p>
<p>If convicted, Sokolovsky faces a maximum penalty of 20 years in prison for the wire fraud and money laundering offenses, five years for the conspiracy to commit computer fraud charge, and a mandatory consecutive two-year term for the aggravated identity theft offense.</p>
<p>The Justice Department has set up a website &#8212; <a href="https://raccoon.ic3.gov/home" target="_blank" rel="noopener">raccoon.ic3.gov</a> &#8212; that allows visitors to check whether their email address shows up in the data collected by the Raccoon Stealer service.</p>
<p><img loading="lazy" class="aligncenter wp-image-61723" src="media/8abe7c00.raccoon-ic3.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/10/raccoon-ic3.png" alt="" width="751" height="491" srcset="https://krebsonsecurity.com/wp-content/uploads/2022/10/raccoon-ic3.png 1117w, https://krebsonsecurity.com/wp-content/uploads/2022/10/raccoon-ic3-768x502.png 768w, https://krebsonsecurity.com/wp-content/uploads/2022/10/raccoon-ic3-782x511.png 782w" sizes="(max-width: 751px) 100vw, 751px" /></p>


feed_id: https://krebsonsecurity.com/?p=61711
title: Hacker Charged With Extorting Online Psychotherapy Service
uri: Hacker-Charged-With-Extorting-Online-Psychotherapy-Service
url: https://krebsonsecurity.com/2022/11/hacker-charged-with-extorting-online-psychotherapy-service/
content:
<p><img class="aligncenter wp-image-61773" src="media/0074dfea.kikmaki-wanted.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/11/kikmaki-wanted.png" alt="" width="751" height="357" srcset="https://krebsonsecurity.com/wp-content/uploads/2022/11/kikmaki-wanted.png 2936w, https://krebsonsecurity.com/wp-content/uploads/2022/11/kikmaki-wanted-768x366.png 768w, https://krebsonsecurity.com/wp-content/uploads/2022/11/kikmaki-wanted-1536x731.png 1536w, https://krebsonsecurity.com/wp-content/uploads/2022/11/kikmaki-wanted-2048x975.png 2048w, https://krebsonsecurity.com/wp-content/uploads/2022/11/kikmaki-wanted-782x372.png 782w" sizes="(max-width: 751px) 100vw, 751px" /></p>
<p>A 25-year-old Finnish man has been charged with extorting a once popular and now-bankrupt online psychotherapy company and its patients. Finnish authorities rarely name suspects in an investigation, but they were willing to make an exception for <strong>Julius &#8220;Zeekill&#8221; Kivimaki</strong>, a notorious hacker who &#8212; at the tender age of 17 &#8212; had been <a href="https://krebsonsecurity.com/2015/07/finnish-decision-is-win-for-internet-trolls/" target="_blank" rel="noopener">convicted of more than 50,000 cybercrimes</a>, including data breaches, payment fraud, operating botnets, and calling in bomb threats.</p>
<p>In late October 2022, Kivimaki was charged (and arrested in absentia, according to the Finns) with attempting to extort money from the<strong> Vastaamo Psychotherapy Center</strong>.  On October 21, 2020, Vastaamo became the target of blackmail when a tormentor identified as &#8220;<strong>ransom_man</strong>&#8221; demanded payment of 40 bitcoins (~450,000 euros at the time) in return for a promise not to publish highly sensitive therapy session notes Vastaamo had exposed online.</p>
<p>In a series of posts over the ensuing days on a Finnish-language dark net discussion board, ransom_man said Vastaamo appeared unwilling to negotiate a payment, and that he would start publishing 100 patient profiles every 24 hours &#8220;to provide further incentive for the company to continue communicating with us.&#8221;</p>
<p>&#8220;We&#8217;re not asking for much, approximately 450,000 euros which is less than 10 euros per patient and only a small fraction of the around 20 million yearly revenues of this company,&#8221; ransom_man wrote.</p>
<p>When Vastaamo declined to pay, ransom_man shifted to extorting individual patients. According to <a href="https://poliisi.fi/-/yksi-vangittu-poissaolevana-liittyen-vastaamon-tietomurtoon?languageId=en_US" target="_blank" rel="noopener">Finnish police</a>, some 22,000 victims reported extortion attempts targeting them personally, targeted emails that threatened to publish their therapy notes online unless paid a 500 euro ransom.</p>
<div id="attachment_61775" style="width: 761px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-61775" loading="lazy" class=" wp-image-61775" src="media/71f690ac.vastaamo-extortion.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/11/vastaamo-extortion.png" alt="" width="751" height="518" srcset="https://krebsonsecurity.com/wp-content/uploads/2022/11/vastaamo-extortion.png 2178w, https://krebsonsecurity.com/wp-content/uploads/2022/11/vastaamo-extortion-768x530.png 768w, https://krebsonsecurity.com/wp-content/uploads/2022/11/vastaamo-extortion-1536x1059.png 1536w, https://krebsonsecurity.com/wp-content/uploads/2022/11/vastaamo-extortion-2048x1412.png 2048w, https://krebsonsecurity.com/wp-content/uploads/2022/11/vastaamo-extortion-782x539.png 782w, https://krebsonsecurity.com/wp-content/uploads/2022/11/vastaamo-extortion-100x70.png 100w" sizes="(max-width: 751px) 100vw, 751px" /><p id="caption-attachment-61775" class="wp-caption-text">The extortion message targeted Vastaamo patients.</p></div>
<p>On Oct. 23, 2020, ransom_man uploaded to the dark web a large compressed file that included all of the stolen Vastaamo patient records. But investigators found the file also contained an entire copy of ransom_man&#8217;s home folder, a likely mistake that exposed a number of clues that they say point to Kivimaki.</p>
<p>Ransom_man quickly deleted the large file (accompanied by a &#8220;whoops&#8221; notation), but not before it had been downloaded a number of times. The entire archive has since been made into a searchable website on the Dark Web.</p>
<p>Among those who grabbed a copy of the database was <strong>Antti Kurittu</strong>, a former criminal investigator at the Helsinki Police Department. In 2013, Kurritu worked on investigation involving Kivimaki&#8217;s use of the Zbot botnet, among other activities Kivimaki engaged in as a member of the hacker group <a href="https://krebsonsecurity.com/2015/02/webnic-registrar-blamed-for-hijack-of-lenovo-google-domains/" target="_blank" rel="noopener">Hack the Planet</a>.</p>
<p>&#8220;It was a huge opsec [operational security] fail, because they had a lot of stuff in there &#8212; including the user&#8217;s private SSH folder, and a lot of known hosts that we could take a very good look at,&#8221; Kurittu told KrebsOnSecurity, declining to discuss specifics of the evidence investigators seized. &#8220;There were also other projects and databases.&#8221;</p>
<p>Kurittu said he and others who worked on the investigation into Kivimaki&#8217;s previous cybercrimes couldn&#8217;t shake the suspicion that the infamous cybercriminal was also behind the Vastaamo extortion.</p>
<p>&#8220;I couldn&#8217;t find anything that would link that data directly to one individual, but there were enough indicators in there that put the name in my head and I couldn&#8217;t shake it,&#8221; Kurittu said. &#8220;I told the police this back in 2020, and when they named him as the prime suspect I was not surprised.&#8221;<span id="more-61711"></span></p>
<p>A handful of individually extorted victims paid a ransom, but when news broke that the entire Vastaamo database had been leaked online, the extortion threats no longer held their sting. However, someone would soon set up a site on the dark web where anyone could search this sensitive data.</p>
<p>Kivimaki stopped using his middle name Julius in favor of his given first name <strong>Aleksanteri</strong> when he moved abroad several years ago. A Twitter account by that name was verified by Kivimaki&#8217;s attorney as his, and through that account he denied being involved in the Vastaamo extortion.</p>
<p>&#8220;I believe [the Finnish authorities] brought this to the public in order to influence the decision-making of my old case from my teenage years, which was just processed in the Court of Appeal, both cases are investigated by the same persons,&#8221; Kivimaki <a href="https://mobile.twitter.com/AlexKivimaeki/status/1586083493641351168" target="_blank" rel="noopener">tweeted on Oct. 28</a>.</p>
<p>Kivimaki is appealing a 2020 district court decision sentencing him to &#8220;one year of conditional imprisonment for two counts of fraud committed as a young person, and one of gross fraud, interference with telecommunications as a young person, aggravated data breach as a young person and incitement to fraud as a young person,&#8221; according to the Finnish tabloid<em> Ilta-Sanomat.</em></p>
<p class="article-body mb-24 px-16">&#8220;Now in the Court of Appeal, the prosecutor is demanding a harsher punishment for the man, i.e. unconditional imprisonment,&#8221; reads the <a href="https://www.is.fi/digitoday/art-2000009041118.html" target="_blank" rel="noopener"><em>Ilta-Sanomat story</em></a>. &#8220;The prosecutor notes in his complaint that the young man has been committing cybercrimes from Espoo since he was 15 years old, and the actions have had to be painstakingly investigated through international legal aid.&#8221;</p>
<p>As described in <a href="https://www.wired.com/story/vastaamo-psychotherapy-patients-hack-data-breach/" target="_blank" rel="noopener">this Wired story last year</a>, Vastaamo filled an urgent demand for psychological counseling, and it won accolades from Finnish health authorities and others for its services.</p>
<p>&#8220;Vastaamo was a private company, but it seemed to operate in the same spirit of tech-enabled ease and accessibility: You booked a therapist with a few clicks, wait times were tolerable, and Finland’s Social Insurance Institution reimbursed a big chunk of the session fee (provided you had a diagnosed mental disorder),&#8221; <strong>William Ralston</strong> wrote for <em>Wired</em>. &#8220;The company was run by <strong>Ville Tapio</strong>, a 39-year-old coder and entrepreneur with sharp eyebrows, slicked-back brown hair, and a heavy jawline. He’d cofounded the company with his parents. They pitched ­Vastaamo as a humble family-run enterprise committed to improving the mental health of all Finns.&#8221;</p>
<p>But for all the good it brought, the healthcare records management system that Vastaamo used relied on little more than a MySQL database that was left dangerously exposed to the web for 16 months, guarded by nothing more than an administrator account with a blank password.</p>
<p>The Finnish daily <a href="https://www.iltalehti.fi/kotimaa/a/7477b65a-9fc8-46fa-a1a0-63674b8a064a" target="_blank" rel="noopener">Iltalehti</a> said Tapio was relieved of his duties as CEO of Vastaamo in October 2020, and that in September, prosecutors brought charges against Tapio for a data protection offense in connection with Vastaamo&#8217;s information leak.</p>
<p class="paragraph">&#8220;According to Vastaamo, the data breach in Vastaamo&#8217;s customer databases took place in November 2018,&#8221; Iltalehti reported last month. &#8220;According to Vastaamo, Tapio concealed information about the data breach for more than a year and a half.&#8221;</p>


feed_id: https://krebsonsecurity.com/?p=61785
title: LinkedIn Adds Verified Emails, Profile Creation Dates
uri: LinkedIn-Adds-Verified-Emails-Profile-Creation-Dates
url: https://krebsonsecurity.com/2022/11/linkedin-adds-verified-emails-profile-creation-dates/
content:
<p>Responding to a recent surge in AI-generated bot accounts, <strong>LinkedIn</strong> is rolling out new features that it hopes will help users make more informed decisions about with whom they choose to connect. Many LinkedIn profiles now display a creation date, and the company is expanding its domain validation offering, which allows users to publicly confirm that they can reply to emails at the domain of their stated current employer.</p>
<p><img class="aligncenter wp-image-61789" src="media/fe64a742.bkli.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/11/bkli.png" alt="" width="751" height="588" srcset="https://krebsonsecurity.com/wp-content/uploads/2022/11/bkli.png 1192w, https://krebsonsecurity.com/wp-content/uploads/2022/11/bkli-768x602.png 768w, https://krebsonsecurity.com/wp-content/uploads/2022/11/bkli-782x613.png 782w" sizes="(max-width: 751px) 100vw, 751px" /></p>
<p>LinkedIn&#8217;s new &#8220;About This Profile&#8221; section &#8212; which is visible by clicking the &#8220;More&#8221; button at the top of a profile &#8212; includes the year the account was created, the last time the profile information was updated, and an indication of how and whether an account has been verified.</p>
<p>LinkedIn also said it is adding a warning to some LinkedIn messages that include high-risk content, or that try to entice the user into taking the conversation to another platform (like WeChat).</p>
<p>&#8220;We may warn you about messages that ask you to take the conversation to another platform because that can be a sign of a scam,&#8221; the company said in a blog post. &#8220;These warnings will also give you the choice to report the content without letting the sender know.&#8221;</p>
<p>In late September 2022, KrebsOnSecurity warned about <a href="https://krebsonsecurity.com/2022/09/fake-ciso-profiles-on-linkedin-target-fortune-500s/" target="_blank" rel="noopener">the proliferation of fake LinkedIn profiles for Chief Information Security Officer (CISO) roles</a> at some of the world’s largest corporations. A <a href="https://krebsonsecurity.com/2022/10/glut-of-fake-linkedin-profiles-pits-hr-against-the-bots/" target="_blank" rel="noopener">follow-up story on Oct. 5</a> showed how the phony profile problem has affected virtually all executive roles at corporations, and how these fake profiles are creating an identity crisis for the businesses networking site and the companies that rely on it to hire and screen prospective employees.<span id="more-61544"></span></p>
<p>Reporting here last month also tracked a <a href="https://krebsonsecurity.com/2022/10/battle-with-bots-prompts-mass-purge-of-amazon-apple-employee-accounts-on-linkedin/" target="_blank" rel="noopener">massive drop in profiles claiming to work at several major technology companies</a>, as LinkedIn apparently took action against hundreds of thousands of inauthentic accounts that falsely claimed roles at these companies.</p>
<p>For example, on October 10, 2022, there were 576,562 <strong>LinkedIn</strong> accounts that listed their current employer as <strong>Apple Inc.</strong> The next day, half of those profiles no longer existed. At around the same time, the number of LinkedIn profiles claiming current roles at <strong>Amazon</strong> fell from roughly 1.25 million to 838,601 in just one day, a 33 percent drop.<span id="more-61785"></span></p>
<p>For whatever reason, the majority of the phony LinkedIn profiles reviewed by this author were young women with profile photos that appear to have been generated by artificial intelligence (AI) tools.</p>
<p>&#8220;We’re seeing rapid advances in AI-based synthetic image generation technology and we’ve created a deep learning model to better catch profiles made with this technology,&#8221; LinkedIn&#8217;s <strong>Oscar Rodriguez</strong> <a href="https://blog.linkedin.com/2022/october/25/new-linkedin-profile-features-help-verify-identity--detect-and-r" target="_blank" rel="noopener">wrote</a>. &#8220;AI-based image generators can create an unlimited number of unique, high-quality profile photos that do not correspond to real people.&#8221;</p>
<p>It remains unclear who or what is behind the recent proliferation of fake executive profiles on LinkedIn, but likely they are from a combination of scams. Cybersecurity firm <strong>Mandiant</strong> (recently acquired by <strong>Google</strong>) <a href="https://www.yahoo.com/video/north-korean-fraudsters-suspected-copying-153907880.html" target="_blank" rel="noopener">told Bloomberg</a> that hackers working for the North Korean government have been copying resumes and profiles from leading job listing platforms LinkedIn and <strong>Indeed</strong>, as part of an elaborate scheme to land jobs at cryptocurrency firms.</p>
<p>Identity thieves have been known <a href="https://krebsonsecurity.com/2021/05/how-to-tell-a-job-offer-from-an-id-theft-trap/" target="_blank" rel="noopener">to masquerade on LinkedIn as job recruiters</a>, collecting personal and financial information from people who fall for employment scams.</p>
<p>Also, fake profiles also may be tied to so-called <a href="https://krebsonsecurity.com/2022/07/massive-losses-define-epidemic-of-pig-butchering/" target="_blank" rel="noopener">“pig butchering” scams</a>, wherein people are lured by flirtatious strangers online into investing in cryptocurrency trading platforms that eventually seize any funds when victims try to cash out.</p>


feed_id: https://krebsonsecurity.com/?p=61753
title: Patch Tuesday, November 2022 Election Edition
uri: Patch-Tuesday-November-2022-Election-Edition
url: https://krebsonsecurity.com/2022/11/patch-tuesday-november-2022-election-edition/
content:
<p>Let&#8217;s face it: Having “2022 election” in the headline above is probably the only reason anyone might read this story today. Still, while most of us here in the United States are anxiously awaiting the results of how well we&#8217;ve patched our Democracy, it seems fitting that <strong>Microsoft Corp.</strong> today released gobs of security patches for its ubiquitous <strong>Windows</strong> operating systems. November&#8217;s patch batch includes fixes for <em>a whopping six zero-day security vulnerabilities</em> that miscreants and malware are already exploiting in the wild.</p>
<p><img class="aligncenter  wp-image-60331" src="media/f9a52a5f.winupdatedate.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/07/winupdatedate.png" alt="" width="751" height="497" srcset="https://krebsonsecurity.com/wp-content/uploads/2022/07/winupdatedate.png 923w, https://krebsonsecurity.com/wp-content/uploads/2022/07/winupdatedate-768x508.png 768w, https://krebsonsecurity.com/wp-content/uploads/2022/07/winupdatedate-782x518.png 782w" sizes="(max-width: 751px) 100vw, 751px" /></p>
<p>Probably the scariest of the zero-day flaws is <a href="https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2022-41128" target="_blank" rel="noopener">CVE-2022-41128</a>, a &#8220;critical&#8221; weakness in the Windows scripting languages that could be used to foist malicious software on vulnerable users who do nothing more than browse to a hacked or malicious site that exploits the weakness. Microsoft credits <strong>Google</strong> with reporting the vulnerability, which earned a CVSS score of 8.8.</p>
<p><a href="https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2022-41073" target="_blank" rel="noopener">CVE-2022-41073</a> is a zero-day flaw in the <strong>Windows Print Spooler</strong>, a Windows component that Microsoft has patched mightily over the past year. <strong>Kevin Breen</strong>, director of cyber threat research at <strong>Immersive Labs</strong>, noted that the print spooler has been a popular target for vulnerabilities in the last 12 months, with this marking the 9th patch.</p>
<p>The third zero-day Microsoft patched this month is <a href="https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2022-41125" target="_blank" rel="noopener">CVE-2022-41125</a>, which is an &#8220;elevation of privilege&#8221; vulnerability in the Windows Cryptography API: Next Generation (CNG) Key Isolation Service, a service for isolating private keys. <strong>Satnam Narang</strong>, senior staff research engineer at <strong>Tenable</strong>, said exploitation of this vulnerability could grant an attacker SYSTEM privileges.</p>
<p>The fourth zero-day, <a href="https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2022-41091" target="_blank" rel="noopener">CVE-2022-41091</a>, was previously disclosed and widely reported on in October. It is a Security Feature Bypass of “Windows Mark of the Web” – a mechanism meant to flag files that have come from an untrusted source.<span id="more-61753"></span></p>
<p>The other two zero-day bugs Microsoft patched this month were for vulnerabilities being exploited in <strong>Exchange Server</strong>. News that these two Exchange flaws were being exploited in the wild <a href="https://krebsonsecurity.com/2022/09/microsoft-two-new-0-day-flaws-in-exchange-server/" target="_blank" rel="noopener">surfaced in late September 2022</a>, and many were surprised when Microsoft let October&#8217;s Patch Tuesday sail by without issuing official patches for them (the company instead issued mitigation instructions that it was forced to revise multiple times). Today&#8217;s patch batch addresses both issues.</p>
<p><strong>Greg Wiseman</strong>, product manager at <strong>Rapid7</strong>, said the Exchange flaw <a href="https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2022-41040" target="_blank" rel="noopener">CVE-2022-41040</a> is a “critical” elevation of privilege vulnerability, and <a href="https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2022-41082" target="_blank" rel="noopener">CVE-2022-41082</a> is considered Important, allowing Remote Code Execution (RCE) when PowerShell is accessible to the attacker.</p>
<p>&#8220;Both vulnerabilities have been exploited in the wild,&#8221; Wiseman said. &#8220;Four other CVEs affecting Exchange Server have also been addressed this month. Three are rated as Important, and <a href="https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2022-41080" target="_blank" rel="noopener">CVE-2022-41080</a> is another privilege escalation vulnerability considered Critical. Customers are advised to update their Exchange Server systems immediately, regardless of whether any previously recommended mitigation steps have been applied. The mitigation rules are no longer recommended once systems have been patched.&#8221;</p>
<p><strong>Adobe</strong> usually issues security updates for its products on Patch Tuesday, but it did not this month. For a closer look at the patches released by Microsoft today and indexed by severity and other metrics, check out the <a href="https://isc.sans.edu/forums/diary/Microsoft+November+2022+Patch+Tuesday/29230/" target="_blank" rel="noopener">always-useful Patch Tuesday roundup</a> from the <strong>SANS Internet Storm Center</strong>. And it’s not a bad idea to hold off updating for a few days until Microsoft works out any kinks in the updates: <a href="https://www.askwoody.com/" target="_blank" rel="noopener">AskWoody.com</a> usually has the lowdown on any patches that may be causing problems for Windows users.</p>
<p>As always, please consider backing up your system or at least your important documents and data before applying system updates. And if you run into any problems with these updates, please drop a note about it here in the comments.</p>


feed_id: https://krebsonsecurity.com/?p=61848
title: Lawsuit Seeks Food Benefits Stolen By Skimmers
uri: Lawsuit-Seeks-Food-Benefits-Stolen-By-Skimmers
url: https://krebsonsecurity.com/2022/11/lawsuit-seeks-food-benefits-stolen-by-skimmers/
content:
<p>A nonprofit organization is suing the state of Massachusetts on behalf of thousands of low-income families who were collectively robbed of more than a $1 million in food assistance benefits by card skimming devices secretly installed at cash machines and grocery store checkout lanes across the state. Federal law bars states from replacing these benefits using federal funds, and a recent rash of skimming incidents nationwide has disproportionately affected those receiving food assistance via state-issued prepaid debit cards.</p>
<div id="attachment_61661" style="width: 619px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-61661" class=" wp-image-61661" src="media/aab247ad.mass-dta.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/10/mass-dta.png" alt="" width="609" height="375" /><p id="caption-attachment-61661" class="wp-caption-text">The Massachusetts SNAP benefits card looks more like a library card than a payment card.</p></div>
<p>On Nov. 4, <strong>The Massachusetts Law Reform Institute</strong> (MLRI) filed a class action lawsuit on behalf of low-income families whose <a href="https://www.fns.usda.gov/snap/supplemental-nutrition-assistance-program" target="_blank" rel="noopener">Supplemental Nutrition and Assistance Program</a> (SNAP) benefits were stolen from their accounts. The SNAP program serves over a million people in Massachusetts, and 41 million people nationally.</p>
<p>&#8220;Over the past few months, thieves have stolen over a million SNAP dollars from thousands of Massachusetts families – putting their nutrition and economic stability at risk,&#8221; the MLRI said in a statement on the lawsuit. &#8220;The criminals attach a skimming device on a POS (point of sale) terminal to capture the household’s account information and PIN. The criminals then use that information to make a fake card and steal the SNAP benefits.&#8221;</p>
<p>In announcing the lawsuit, the MRLI linked to a story KrebsOnSecurity published last month that examined how <a href="https://krebsonsecurity.com/2022/10/how-card-skimming-disproportionally-affects-those-most-in-need/" target="_blank" rel="noopener">skimming thieves increasingly are targeting SNAP payment card holders</a> nationwide. The story looked at how the vast majority of SNAP benefit cards issued by the states do not include the latest chip technology that makes it more difficult and expensive for thieves to clone them.</p>
<p>The story also highlighted how SNAP cardholders usually have little recourse to recover any stolen funds &#8212; even in <a href="https://www.thebaltimorebanner.com/community/criminal-justice/one-womans-quest-for-justice-after-almost-3000-of-benefits-were-stolen-LHIKMQZSNJBULC7LXCEIE264OA/" target="_blank" rel="noopener">unlikely cases where the victim has gathered mountains of proof to show state and federal officials that the fraudulent withdrawals were not theirs</a>.</p>
<p><strong>Deborah Harris</strong> is a staff attorney at the MLRI. Harris said the goal of the lawsuit is to force Massachusetts to reimburse SNAP skimming victims using state funds, and to convince <strong>The U.S. Department of Agriculture</strong> (USDA) &#8212; which funds the program that states draw from &#8212; to change its policies and allow states to replace stolen benefits with federal funds.</p>
<p>&#8220;Ultimately we think it&#8217;s the USDA that needs to step up and tell states they have a duty to restore the stolen benefits, and that USDA will cover the cost at least until there is better security in place, such as chip cards,&#8221; Harris told KrebsOnSecurity.</p>
<p>&#8220;The losses we&#8217;re talking about are relatively small in the scheme of total SNAP expenditures which are billions,&#8221; she said. &#8220;But if you are a family that can&#8217;t pay for food because you suddenly don&#8217;t have money in your account, it&#8217;s devastating for the family.&#8221;<span id="more-61848"></span></p>
<p>The USDA has not said it will help states restore the stolen funds. But on Oct. 31, 2022, the agency <a href="media/898bf72e.USDA-EBT-Card-Skimming-Prevention-10-31-22.pdf" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/11/USDA-EBT-Card-Skimming-Prevention-10-31-22.pdf" target="_blank" rel="noopener">released guidance</a> (PDF) whose primary instructions were included in an appendix titled, Card Security Options Available to Households. Notably, the USDA did not mention the idea of shifting to chip-based SNAP benefits cards.</p>
<div id="attachment_61855" style="width: 608px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-61855" loading="lazy" class="size-full wp-image-61855" src="media/537536b6.usda-snapskim.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/11/usda-snapskim.png" alt="" width="598" height="612" /><p id="caption-attachment-61855" class="wp-caption-text">The recently issued USDA guidance.</p></div>
<p>&#8220;The guidance generally continues to make households responsible for preventing the theft of their benefits as well as for suffering the loss when benefits are stolen through no fault of the household,&#8221; Harris said. &#8220;Many of the recommendations are not practical for households who don&#8217;t have a smartphone to receive text messages and aren&#8217;t able to change their PIN after each transaction and keep track of the new PIN.&#8221;</p>
<p>Harris said three of the four recommendations are not currently available in Massachusetts, and they are very likely not currently available in other states. For example, she said, Massachusetts households do not have the option of freezing or locking their cards between transactions. Nor do they receive alerts about transactions. And they most certainly don&#8217;t have any way to block out-of-state transactions.</p>
<p>&#8220;Perhaps these are options that [card] processors and states could provide, but they are not available now as far as we know,&#8221; Harris said. &#8220;Most likely they would take time to implement.&#8221;</p>
<div class="entry-content">
<p><strong>The Center for Law and Social Policy</strong> (CLASP) recently published <a href="https://www.clasp.org/blog/five-ways-state-agencies-can-support-ebt-users-at-risk-of-skimming/" target="_blank" rel="noopener">Five Ways State Agencies Can Support EBT Users at Risk of Skimming</a>. CLASP says while it is true states can’t use federal funds to replace benefits unless the loss was due to a “system error,” states could use their own funds.</p>
<p>“Doing so will ensure families don’t have to go without food, gas money, or their rent for the month,” CLASP wrote.</p>
<p>That would help address the symptoms of card skimming, but not a root cause. Hardly anyone is suggesting the obvious, which is to equip SNAP benefit cards with the same security technology afforded to practically everyone else participating in the U.S. banking system.</p>
<p>There are several reasons most state-issued SNAP benefit cards do not include chips. For starters, nobody says they have to. Also, it’s a fair bit more expensive to produce chip cards versus plain old magnetic stripe cards, and many state assistance programs are chronically under-funded. Finally, there is no vocal (or at least well-heeled) constituency advocating for change.</p>
<p>A copy of the class action complaint filed by the MLRI is available <a href="https://drive.google.com/file/d/1R11j74KZsBRLJAyHlBYiRBQTxJQSfdkc/view" target="_blank" rel="noopener">here</a>.</p>
</div>


feed_id: https://krebsonsecurity.com/?p=61797
title: Top Zeus Botnet Suspect “Tank” Arrested in Geneva
uri: Top-Zeus-Botnet-Suspect-Tank-Arrested-in-Geneva
url: https://krebsonsecurity.com/2022/11/top-zeus-botnet-suspect-tank-arrested-in-geneva/
content:
<p><strong>Vyacheslav &#8220;Tank&#8221; Penchukov</strong>, the accused 40-year-old Ukrainian leader of a prolific cybercriminal group that stole tens of millions of dollars from small to mid-sized businesses in the United States and Europe, has been arrested in Switzerland, according to multiple sources.</p>
<div id="attachment_61805" style="width: 777px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-61805" class="size-full wp-image-61805" src="media/e9cf3802.penchukov-fbiwanted.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/11/penchukov-fbiwanted.png" alt="" width="767" height="575" /><p id="caption-attachment-61805" class="wp-caption-text">Wanted Ukrainian cybercrime suspect Vyacheslav &#8220;Tank&#8221; Penchukov (right) was arrested in Geneva, Switzerland. Tank was the day-to-day manager of a cybercriminal group that stole tens of millions of dollars from small to mid-sized businesses.</p></div>
<p>Penchukov was named in a 2014 indictment by the <strong>U.S. Department of Justice</strong> as a top figure in the <strong>JabberZeus Crew</strong>, a small but potent cybercriminal collective from Ukraine and Russia that attacked victim companies with a powerful, custom-made version of the <strong>Zeus</strong> banking trojan.</p>
<p>The <strong>U.S. Federal Bureau of Investigation</strong> (FBI) declined to comment for this story. But according to multiple sources, Penchukov was arrested in Geneva, Switzerland roughly three weeks ago as he was traveling to meet up with his wife there.</p>
<p>Penchukov is from Donetsk, a traditionally Russia-leaning region in Eastern Ukraine that was recently annexed by Russia. In his hometown, Penchukov was a well-known deejay (&#8220;<a href="https://en.geo.pro/reportage/143573-red-line-dj-jam-dj-slava-rich/" target="_blank" rel="noopener">DJ Slava Rich</a>&#8220;) who enjoyed being seen riding around in his high-end BMWs and Porsches. More recently, Penchukov has been <a href="https://jetsetter.ua/event/promo-otkrytie-butika-garde/" target="_blank" rel="noopener">investing quite a bit in local businesses</a>.</p>
<p>The JabberZeus crew&#8217;s name is derived from the malware they used, which was configured to send them a Jabber instant message each time a new victim entered a one-time password code into a phishing page mimicking their bank. The JabberZeus gang <a href="http://krebsonsecurity.com/category/smallbizvictims/" target="_blank" rel="noopener">targeted mostly small to mid-sized businesses</a>, and they were an early pioneer of so-called &#8220;man-in-the-browser&#8221; attacks, malware that can silently siphon any data that victims submit via a web-based form.</p>
<p>Once inside a victim company&#8217;s bank accounts, the crooks would modify the firm&#8217;s payroll to add dozens of &#8220;<strong>money mules</strong>,&#8221; <a href="https://krebsonsecurity.com/2010/09/u-s-charges-37-alleged-money-mules/" target="_blank" rel="noopener">people recruited through work-at-home schemes to handle bank transfers</a>. The mules in turn would forward any stolen payroll deposits &#8212; minus their commissions &#8212; via wire transfer overseas.</p>
<div id="attachment_61804" style="width: 660px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-61804" loading="lazy" class=" wp-image-61804" src="media/ea1b4c16.tank-dj.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/11/tank-dj.png" alt="" width="650" height="514" /><p id="caption-attachment-61804" class="wp-caption-text">Tank, a.k.a. &#8220;DJ Slava Rich,&#8221; seen here performing as a DJ in Ukraine in an undated photo from social media.</p></div>
<p>The JabberZeus malware was custom-made for the crime group by the alleged author of the Zeus trojan &#8212; <strong>Evgeniy Mikhailovich Bogachev</strong>, a top Russian cybercriminal with <a href="https://krebsonsecurity.com/2015/02/fbi-3m-bounty-for-zeus-trojan-author/" target="_blank" rel="noopener">a $3 million bounty on his head from the FBI</a>. Bogachev is accused of running the <a href="https://krebsonsecurity.com/2014/06/operation-tovar-targets-gameover-zeus-botnet-cryptolocker-scourge/" target="_blank" rel="noopener">Gameover Zeus botnet</a>, a massive crime machine of 500,000 to 1 million infected PCs that was used for large DDoS attacks and for spreading Cryptolocker &#8212; a peer-to-peer ransomware threat that was years ahead of its time.</p>
<p>Investigators knew Bogachev and JabberZeus were linked because for many years they were reading the private Jabber chats between and among members of the JabberZeus crew, and Bogachev&#8217;s monitored aliases were in semi-regular contact with the group about updates to the malware.</p>
<p><strong>Gary Warner</strong>, director of research in computer forensics at the University of Alabama at Birmingham, noted in his blog from 2014 that Tank told co-conspirators in a JabberZeus chat on July 22, 2009 that his daughter, <strong>Miloslava</strong>, had been born and gave her birth weight.</p>
<p>&#8220;A search of Ukrainian birth records only showed one girl named Miloslava with that birth weight born on that day,&#8221; Warner wrote. This was enough to positively identify Tank as Penchukov, Warner said.</p>
<p>Ultimately, Penchukov&#8217;s political connections helped him evade prosecution by Ukrainian cybercrime investigators for many years. The late son of former Ukrainian President <strong><a href="https://en.wikipedia.org/wiki/Viktor_Yanukovych" target="_blank" rel="noopener">Victor Yanukovych</a></strong> (<a href="https://en.wikipedia.org/wiki/Viktor_Viktorovych_Yanukovych" target="_blank" rel="noopener">Victor Yanukovych Jr.</a>) would serve as godfather to Tank&#8217;s daughter Miloslava. Through his connections to the Yanukovych family, Tank was able to establish contact with key insiders in top tiers of the Ukrainian government, including law enforcement.</p>
<p>Sources briefed on the investigation into Penchukov said that in 2010 &#8212; at a time when the Security Service of Ukraine (SBU) <a href="https://krebsonsecurity.com/2010/10/ukraine-detains-5-individuals-tied-to-70-million-in-ebanking-heists/" target="_blank" rel="noopener">was preparing to serve search warrants on Tank and his crew</a> &#8212; Tank received a tip that the SBU was coming to raid his home. That warning gave Tank ample time to destroy important evidence against the group, and to avoid being home when the raids happened. Those sources also said Tank used his contacts to have the investigation into his crew moved to a different unit that was headed by his corrupt SBU contact.</p>
<p>Writing for <em>Technology Review</em>, <strong>Patrick Howell O&#8217;Neil</strong> <a href="https://www.technologyreview.com/2021/07/08/1027999/fbi-russia-ukraine-cybercrime-investigation-ransomware/" rel="noopener" target="_blank">recounted</a> how SBU agents in 2010 were trailing Tank around the city, watching closely as he moved between nightclubs and his apartment. </p>
<p>&#8220;In early October, the Ukrainian surveillance team said they’d lost him,&#8221; he wrote. &#8220;The Americans were unhappy, and a little surprised. But they were also resigned to what they saw as the realities of working in Ukraine. The country had a notorious corruption problem. The running joke was that it was easy to find the SBU’s anticorruption unit—just look for the parking lot full of BMWs.&#8221;<span id="more-61797"></span></p>
<h2>AUTHOR&#8217;S NOTE/BACKGROUND</h2>
<p>I first encountered Tank and the JabberZeus crew roughly 14 years ago as a reporter for <em>The Washington Post</em>, after a trusted source confided that he&#8217;d secretly gained access to the group&#8217;s private Jabber conversations.</p>
<p>From reading those discussions each day, it became clear Tank was nominally in charge of the Ukrainian crew, and that he spent much of his time overseeing the activities of the money mule recruiters &#8212; which were an integral part of their victim cashout scheme.</p>
<p>It was soon discovered that the phony corporate websites the money mule recruiters used to manage new hires had a security weakness that allowed anyone who signed up at the portal to view messages for every other user. A scraping tool was built to harvest these money mule recruitment messages, and at the height of the JabberZeus gang&#8217;s activity in 2010 that scraper was monitoring messages on close to a dozen different money mule recruitment sites, each managing hundreds of &#8220;employees.&#8221;</p>
<p>Each mule <a href="media/bdc11733.busywork.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/12/busywork.png" target="_blank" rel="noopener">was given busy work or menial tasks</a> for a few days or weeks prior to being asked to handle money transfers. I believe this was an effort to weed out unreliable money mules. After all, those who showed up late for work tended to cost the crooks a lot of money, as the victim’s bank would usually try to reverse any transfers that hadn’t already been withdrawn by the mules.</p>
<p>When it came time to transfer stolen funds, the recruiters would send a message through the fake company website saying something like: &#8220;Good morning [mule name here]. Our client — XYZ Corp. — is sending you some money today. Please visit your bank now and withdraw this payment in cash, and then wire the funds in equal payments — minus your commission — to these three individuals in Eastern Europe.&#8221;</p>
<p>Only, in every case the company mentioned as the &#8220;client&#8221; was in fact a small business whose payroll accounts they’d already hacked into.</p>
<p>So, each day for several years my morning routine went as follows: Make a pot of coffee; shuffle over to the computer and view the messages Tank and his co-conspirators had sent to their money mules over the previous 12-24 hours; look up the victim company names in Google; pick up the phone to warn each that they were in the process of being robbed by the Russian Cyber Mob.</p>
<p>My spiel on all of these calls was more or less the same: &#8220;You probably have no idea who I am, but here’s all my contact info and what I do. Your payroll accounts have been hacked, and you’re about to lose a great deal of money. You should contact your bank immediately and have them put a hold on any pending transfers before it’s too late. Feel free to call me back afterwards if you want more information about how I know all this, but for now please just call or visit your bank.&#8221;</p>
<p>In many instances, my call would come in just minutes or hours before an unauthorized payroll batch was processed by the victim company’s bank, and some of those notifications prevented what otherwise would have been enormous losses — often several times the amount of the organization’s normal weekly payroll. At some point I stopped counting how many tens of thousands of dollars those calls saved victims, but over several years it was probably in the millions.</p>
<p>Just as often, the victim company would suspect that I was somehow involved in the robbery, and soon after alerting them I would receive a call from an FBI agent or from a police officer in the victim’s hometown. Those were always interesting conversations.</p>
<p>Collectively, these notifications to victims led to <a href="https://krebsonsecurity.com/category/smallbizvictims/" target="_blank" rel="noopener">dozens of stories over several years</a> about small businesses battling their financial institutions to recover their losses. I never wrote about a single victim that wasn&#8217;t okay with my calling attention to their plight and to the sophistication of the threat facing other companies.</p>
<p>This incessant meddling on my part very much aggravated Tank, who on more than one occasion expressed mystification as to how I knew so much about their operations and victims. Here&#8217;s a snippet from one of their Jabber chats in 2009, after I&#8217;d written a story for The Washington Post about their efforts <a href="http://voices.washingtonpost.com/securityfix/2009/07/an_odyssey_of_fraud_part_ii.html" target="_blank" rel="noopener">to steal $415,000 from the coffers of Bullitt County, Kentucky</a>. In the chat below, &#8220;lucky12345&#8221; is the Zeus author Bogachev:</p>
<blockquote><p>tank: Are you there?<br />
tank: This is what they damn wrote about me.<br />
tank: http://voices.washingtonpost.com/securityfix/2009/07/an_odyssey_of_fraud_part_ii.html#more<br />
tank: I’ll take a quick look at history<br />
tank: Originator: BULLITT COUNTY FISCAL Company: Bullitt County Fiscal Court<br />
tank: Well, you got [it] from that cash-in.<br />
lucky12345: From 200K?<br />
tank: Well, they are not the right amounts and the cash out from that account was shitty.<br />
tank: Levak was written there.<br />
tank: Because now the entire USA knows about Zeus.<br />
tank: <img src="media/a50267f3.1f600.png" data-original-source="https://s.w.org/images/core/emoji/14.0.0/72x72/1f600.png" alt="😀" class="wp-smiley" style="height: 1em; max-height: 1em;" /><br />
lucky12345: It’s fucked.</p></blockquote>
<p>On Dec. 13, 2009, one of Tank&#8217;s top money mule recruiters — a crook who used the pseudonym “Jim Rogers” — told his boss something I hadn’t shared beyond a few trusted confidants at that point: That The Washington Post had eliminated my job in the process of merging the newspaper’s Web site (where I worked at the time) with the dead tree edition.</p>
<blockquote><p>jim_rogers: There is a rumor that our favorite (Brian) didn’t get his contract extension at Washington Post. We are giddily awaiting confirmation <img src="media/3fc8b120.1f642.png" data-original-source="https://s.w.org/images/core/emoji/14.0.0/72x72/1f642.png" alt="🙂" class="wp-smiley" style="height: 1em; max-height: 1em;" /> Good news expected exactly by the New Year! Besides us no one reads his column <img src="media/3fc8b120.1f642.png" data-original-source="https://s.w.org/images/core/emoji/14.0.0/72x72/1f642.png" alt="🙂" class="wp-smiley" style="height: 1em; max-height: 1em;" /></p>
<p>tank: Mr. Fucking Brian Fucking Kerbs!</p></blockquote>
<p>Another member of the JabberZeus crew &#8212; Ukrainian-born <strong>Maksim &#8220;Aqua&#8221; Yakubets</strong> &#8212; also is currently wanted by the FBI, which is offering a $5 million reward for information leading to his arrest and conviction.</p>
<div id="attachment_49935" style="width: 816px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-49935" loading="lazy" class="size-full wp-image-49935" src="media/0a225466.yukabets.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/12/yukabets.png" alt="" width="806" height="657" /><p id="caption-attachment-49935" class="wp-caption-text">Alleged &#8220;Evil Corp&#8221; bigwig Maksim &#8220;Aqua&#8221; Yakubets. Image: FBI</p></div>


feed_id: https://krebsonsecurity.com/?p=61870
title: Disneyland Malware Team: It’s a Puny World After All
uri: Disneyland-Malware-Team-It-s-a-Puny-World-After-All
url: https://krebsonsecurity.com/2022/11/disneyland-malware-team-its-a-puny-world-after-all/
content:
<p>A financial cybercrime group calling itself the <strong>Disneyland Team</strong> has been making liberal use of visually confusing phishing domains that spoof popular bank brands using <a href="https://en.wikipedia.org/wiki/Punycode" target="_blank" rel="noopener">Punycode</a>, an Internet standard that allows web browsers to render domain names with non-Latin alphabets like Cyrillic.</p>
<div id="attachment_61889" style="width: 763px" class="wp-caption aligncenter"><a href="media/3277399b.disneylandteampanel.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/11/disneylandteampanel.png" target="_blank" rel="noopener"><img aria-describedby="caption-attachment-61889" class="wp-image-61889" src="media/3277399b.disneylandteampanel.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/11/disneylandteampanel.png" alt="" width="753" height="380" srcset="https://krebsonsecurity.com/wp-content/uploads/2022/11/disneylandteampanel.png 1649w, https://krebsonsecurity.com/wp-content/uploads/2022/11/disneylandteampanel-768x387.png 768w, https://krebsonsecurity.com/wp-content/uploads/2022/11/disneylandteampanel-1536x775.png 1536w, https://krebsonsecurity.com/wp-content/uploads/2022/11/disneylandteampanel-782x395.png 782w" sizes="(max-width: 753px) 100vw, 753px" /></a><p id="caption-attachment-61889" class="wp-caption-text">The Disneyland Team&#8217;s Web interface, which allows them to interact with malware victims in real time to phish their login credentials using phony bank websites.</p></div>
<p>The Disneyland Team uses common misspellings for top bank brands in its domains. For example, one domain the gang has used since March 2022 is <strong>ushank[.]com</strong> &#8212; which was created to phish U.S. Bank customers.</p>
<p>But this group also usually makes use of Punycode to make their phony bank domains look more legit. The U.S. financial services firm <strong>Ameriprise</strong> uses the domain ameriprise.com; the Disneyland Team&#8217;s domain for Ameriprise customers is https://www.xn--meripris-mx0doj[.]com [brackets added to defang the domain], which displays in the browser URL bar as ạmeriprisẹ[.]com.</p>
<p>Look carefully, and you&#8217;ll notice small dots <a href="https://en.wiktionary.org/wiki/%E1%BA%A1" target="_blank" rel="noopener">beneath the &#8220;a&#8221;</a> and <a href="https://en.wiktionary.org/wiki/%E1%BA%B9" target="_blank" rel="noopener">the second &#8220;e&#8221;</a>. You could be forgiven if you mistook one or both of those dots for a spec of dust on your computer screen or mobile device.</p>
<p>This candid view inside the Disneyland Team comes from <strong>Alex Holden</strong>, founder of the Milwaukee-based cybersecurity consulting firm <a href="https://www.holdsecurity.com" target="_blank" rel="noopener">Hold Security</a>. Holden&#8217;s analysts gained access to a Web-based control panel the crime group has been using to keep track of victim credentials (see screenshot above). The panel reveals the gang has been operating dozens of Punycode-based phishing domains for the better part of 2022.</p>
<p>Have a look at the Punycode in this Disneyland Team phishing domain: https://login2.xn--mirtesnbd-276drj[.]com, which shows up in the browser URL bar as login2.ẹmirạtesnbd[.]com, a domain targeting users of <strong>Emirates NBD Bank</strong> in Dubai.</p>
<p>Here&#8217;s another domain registered this year by the Disneyland Team: https://xn--clientchwb-zxd5678f[.]com, which spoofs the login page of financial advisor <strong>Charles Schwab</strong> with the landing page of cliẹntșchwab[.]com. Again, notice the dots under the letters &#8220;e&#8221; and &#8220;s&#8221;.  Another Punycode domain of theirs sends would-be victims to cliẹrtschwạb[.]com, which combines a brand misspelling with Punycode.</p>
<p>We see the same dynamic with the Disneyland Team Punycode domain https://singlepoint.xn--bamk-pxb5435b[.]com, which translates to singlepoint.ụșbamk[.]com &#8212; again phishing U.S. Bank customers.</p>
<p>What&#8217;s going on here? Holden says the Disneyland Team is Russian-speaking &#8212; if not also based in Russia &#8212;  but it is not a phishing gang per se. Rather, this group uses the phony bank domains in conjunction with malicious software that is already secretly installed on a victim&#8217;s computer.</p>
<p>Holden said the Disneyland Team domains were made to help the group steal money from victims infected with a powerful strain of Microsoft Windows-based banking malware known as <a href="https://krebsonsecurity.com/?s=gozi" target="_blank" rel="noopener">Gozi 2.0/Ursnif</a>. Gozi specializes in collecting credentials, and is mainly used for attacks on client-side online banking to facilitate fraudulent bank transfers. Gozi also allows the attackers to connect to a bank&#8217;s website using the victim&#8217;s computer.</p>
<p>In years past, crooks like these would use custom-made &#8220;<strong>web injects</strong>&#8221; to manipulate what Gozi victims see in their Web browser when they visit their bank&#8217;s site. These web injects allowed malware to rewrite the bank&#8217;s HTML code on the fly, and copy and/or intercept any data users would enter into a web-based form, such as a username and password.</p>
<p>Most Web browser makers, however, have spent years adding security protections to block such nefarious activity. As a result, the Disneyland Team simply tries to make their domains look as much like the real thing as possible, and then funnel victims toward interacting with those imposter sites.</p>
<p>&#8220;The reason that it is infeasible for them to use in-browser injects include browser and OS protection measures, and difficulties manipulating dynamic pages for banks that require multi-factor authentication,&#8221; Holden said.</p>
<p>In reality, the fake bank website overlaid by the Disneyland Team&#8217;s malware relays the victim&#8217;s browser activity through to the real bank website, while allowing the attackers to forward any secondary login requests from the bank, such as secret questions or multi-factor authentication challenges.<span id="more-61870"></span></p>
<p>The Disneyland Team included instructions for its users, noting that when the victim enters their login credentials, he sees a 10-second spinning wheel, and then the message, &#8220;Awaiting back office approval for your request. Please don&#8217;t close this window.&#8221;</p>
<div id="attachment_61891" style="width: 760px" class="wp-caption aligncenter"><a href="media/e61cd51f.pncoverlay.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/11/pncoverlay.png" target="_blank" rel="noopener"><img aria-describedby="caption-attachment-61891" loading="lazy" class="wp-image-61891" src="media/e61cd51f.pncoverlay.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/11/pncoverlay.png" alt="" width="750" height="449" srcset="https://krebsonsecurity.com/wp-content/uploads/2022/11/pncoverlay.png 1213w, https://krebsonsecurity.com/wp-content/uploads/2022/11/pncoverlay-768x460.png 768w, https://krebsonsecurity.com/wp-content/uploads/2022/11/pncoverlay-782x468.png 782w" sizes="(max-width: 750px) 100vw, 750px" /></a><p id="caption-attachment-61891" class="wp-caption-text">A fake PNC website overlay or &#8220;web inject&#8221; displaying a message intended to temporarily prevent the user from accessing their account.</p></div>
<p>The &#8220;SKIP&#8221; button in the screenshot above sends the user to the real bank login page, &#8220;in case the account is not interesting to us,&#8221; the manual explains. &#8220;Also, this redirect works if none of our operators are working at the time.&#8221;</p>
<p>The &#8220;TAKE&#8221; button in the Disneyland Team control panel allows users or affiliates to claim ownership over a specific infected machine or bot, which then excludes other users from interacting with that victim.</p>
<p>In the event that it somehow takes a long time to get the victim (bot) connected to the Disneyland Team control panel, or if it is necessary to delay a transaction, users can push a button that prompts the following message to appear on the victim&#8217;s screen:</p>
<blockquote><p>&#8220;Your case ID number is 875472. An online banking support representative will get in touch shortly. Please provide your case ID number, and DO NOT close this page.&#8221;</p></blockquote>
<p>The Disneyland user manual explains that the panel can be used to force the victim to log in again if they transmit invalid credentials. It also has other options for stalling victims whilst their accounts are drained. Another fake prompt the panel can produce shows the victim a message saying, &#8220;We are currently working on updating our security system. You should be able to log in once the countdown timer expires.&#8221;</p>
<p>The user manual says this option blocks the user from accessing their account for two hours. &#8220;It is possible to block for an hour with this button, in this case they get less frustrated, within the hours ddos will kill their network.&#8221;</p>
<p>Cybercrime groups will sometimes launch distributed denial-of-service (DDoS) attacks on the servers of the companies they&#8217;re trying to rob &#8212; which is usually <a href="https://krebsonsecurity.com/2011/11/ddos-attacks-spell-gameover-for-banks-victims-in-cyber-heists/" target="_blank" rel="noopener">intended to distract victims from their fleecing</a>, although Holden said it&#8217;s unclear if the Disneyland Team employs this tactic as well.</p>
<p>For many years, KrebsOnSecurity tracked the day-to-day activities of a similar malware crew that used web injects and bots to <a href="http://krebsonsecurity.com/category/smallbizvictims/" target="_blank" rel="noopener">steal tens of millions of dollars from small- to mid-sized businesses across the United States</a>.</p>
<p>At the end of each story, I would close with a recommendation that anyone concerned about malware snarfing their banking information should strongly consider doing their online banking from a dedicated, security-hardened system which is only used for that purpose. Of course, the dedicated system approach works only if you <a href="https://krebsonsecurity.com/2010/06/using-windows-for-a-day-cost-mac-user-100000/" target="_blank" rel="noopener">always use that dedicated system for managing your account online</a>.</p>
<p>Those stories also observed that since the vast majority of the malicious software used in cyberheists is designed to run only on Microsoft Windows computers, it made sense to pick a non-Windows computer for that dedicated banking system, such as a Mac or even a version of Linux. I still stand by this advice.</p>
<p>In case anyone is interested, <a href="media/5dfc4eac.punydomains.pdf" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/11/punydomains.pdf" target="_blank" rel="noopener">here</a> (PDF) is a list of all phishing domains currently and previously used by the Disneyland Team.</p>


feed_id: https://krebsonsecurity.com/?p=61783
title: Researchers Quietly Cracked Zeppelin Ransomware Keys
uri: Researchers-Quietly-Cracked-Zeppelin-Ransomware-Keys
url: https://krebsonsecurity.com/2022/11/researchers-quietly-cracked-zeppelin-ransomware-keys/
content:
<p><img loading="lazy" src="media/882d5015.zeppransom.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/11/zeppransom.png" alt="" width="873" height="288" class="aligncenter size-full wp-image-61934" srcset="https://krebsonsecurity.com/wp-content/uploads/2022/11/zeppransom.png 873w, https://krebsonsecurity.com/wp-content/uploads/2022/11/zeppransom-768x253.png 768w, https://krebsonsecurity.com/wp-content/uploads/2022/11/zeppransom-782x258.png 782w" sizes="(max-width: 873px) 100vw, 873px" /></p>
<p>Peter is an IT manager for a technology manufacturer that got hit with a Russian ransomware strain called &#8220;<strong>Zeppelin</strong>&#8221; in May 2020. He&#8217;d been on the job less than six months, and because of the way his predecessor architected things, the company&#8217;s data backups also were encrypted by Zeppelin. After two weeks of stalling their extortionists, Peter&#8217;s bosses were ready to capitulate and pay the ransom demand. Then came the unlikely call from an FBI agent. &#8220;Don&#8217;t pay,&#8221; the agent said. &#8220;We&#8217;ve found someone who can crack the encryption.&#8221;</p>
<p>Peter, who spoke candidly about the attack on condition of anonymity, said the FBI told him to contact a cybersecurity consulting firm in New Jersey called <a href="https://www.unit221b.com" rel="noopener" target="_blank">Unit 221B</a>, and specifically its founder &#8212; <strong>Lance James</strong>. Zeppelin <a href="https://blogs.blackberry.com/en/2019/12/zeppelin-russian-ransomware-targets-high-profile-users-in-the-us-and-europe" rel="noopener" target="_blank">sprang onto the crimeware scene in December 2019</a>, but it wasn&#8217;t long before James discovered multiple vulnerabilities in the malware&#8217;s encryption routines that allowed him to brute-force the decryption keys in a matter of hours, using nearly 100 cloud computer servers.</p>
<p>In an interview with KrebsOnSecurity, James said Unit 221B was wary of advertising its ability to crack Zeppelin ransomware keys because it didn&#8217;t want to tip its hand to Zeppelin&#8217;s creators, who were likely to modify their file encryption approach if they detected it was somehow being bypassed.</p>
<p>This is not an idle concern. There are multiple examples of ransomware groups doing just that after security researchers crowed about finding vulnerabilities in their ransomware code.</p>
<p>&#8220;The minute you announce you&#8217;ve got a decryptor for some ransomware, they change up the code,&#8221; James said.</p>
<p>But he said the Zeppelin group appears to have stopped spreading their ransomware code gradually over the past year, possibly because Unit 221B&#8217;s referrals from the FBI let them quietly help nearly two dozen victim organizations recover without paying their extortionists.</p>
<p>In a blog post published today to coincide with a Black Hat Dubai talk on their discoveries, James and co-author <strong>Joel Lathrop</strong> said they were motivated to crack Zeppelin after the ransomware gang started attacking nonprofit and charity organizations.</p>
<p>&#8220;What motivated us the most during the leadup to our action was the targeting of homeless shelters, nonprofits and charity organizations,&#8221; the two wrote. &#8220;These senseless acts of targeting those who are unable to respond are the motivation for this research, analysis, tools, and blog post. A general Unit 221B rule of thumb around our offices is: Don’t [REDACTED] with the homeless or sick! It will simply trigger our ADHD and we will get into that hyper-focus mode that is good if you’re a good guy, but not so great if you are an ***hole.&#8221;</p>
<p>The researchers said their break came when they understood that while Zeppelin used three different types of encryption keys to encrypt files, they could undo the whole scheme by factoring or computing just one of them: An ephemeral RSA-512 public key that is randomly generated on each machine it infects.</p>
<p>“If we can recover the RSA-512 Public Key from the registry, we can crack it and get the 256-bit AES Key that encrypts the files!&#8221; they wrote. &#8220;The challenge was that they delete the [public key] once the files are fully encrypted. Memory analysis gave us about a 5-minute window after files were encrypted to retrieve this public key.&#8221;</p>
<p>Unit 221B ultimately built a &#8220;Live CD&#8221; version of Linux that victims could run on infected systems to extract that RSA-512 key. From there, they would load the keys into a cluster of 800 CPUs donated by hosting giant <strong>Digital Ocean</strong> that would then start cracking them. The company also used that same donated infrastructure to help victims decrypt their data using the recovered keys.</p>
<div id="attachment_61925" style="width: 700px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-61925" loading="lazy" src="media/44f0236d.zeppelin-note.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/11/zeppelin-note.png" alt="" width="690" height="370" class="size-full wp-image-61925" /><p id="caption-attachment-61925" class="wp-caption-text">A typical Zeppelin ransomware note.</p></div>
<p>Jon is another grateful Zeppelin ransomware victim who was aided by Unit 221B&#8217;s decryption efforts. Like Peter, Jon asked that his last name and that of his employer be omitted from the story, but he&#8217;s in charge of IT for a mid-sized managed service provider that got hit with Zeppelin in July 2020.</p>
<p>The attackers that savaged Jon&#8217;s company managed to phish credentials and a multi-factor authentication token for some tools the company used to support customers, and in short order they&#8217;d seized control over the servers and backups for a healthcare provider customer.</p>
<p>Jon said his company was reluctant to pay a ransom in part because it wasn&#8217;t clear from the hackers&#8217; demands whether the ransom amount they demanded would provide a key to unlock all systems, and that it would do so safely.</p>
<p>&#8220;They want you to unlock your data with their software, but you can&#8217;t trust that,&#8221; Jon said. &#8220;You want to use your own software or someone else who&#8217;s trusted to do it.&#8221;</p>
<p>In August 2022, the FBI and the Cybersecurity &#038; Infrastructure Security Agency (CISA) <a href="https://www.cisa.gov/uscert/ncas/alerts/aa22-223a" rel="noopener" target="_blank">issued a joint warning on Zeppelin</a>, saying the FBI had &#8220;observed instances where Zeppelin actors executed their malware multiple times within a victim’s network, resulting in the creation of different IDs or file extensions, for each instance of an attack; this results in the victim needing several unique decryption keys.&#8221;<span id="more-61783"></span></p>
<p>The advisory says Zeppelin has attacked &#8220;a range of businesses and critical infrastructure organizations, including defense contractors, educational institutions, manufacturers, technology companies, and especially organizations in the healthcare and medical industries. Zeppelin actors have been known to request ransom payments in Bitcoin, with initial amounts ranging from several thousand dollars to over a million dollars.&#8221;</p>
<p>The FBI and CISA say the Zeppelin actors gain access to victim networks by exploiting weak Remote Desktop Protocol (RDP) credentials, exploiting SonicWall firewall vulnerabilities, and phishing campaigns. Prior to deploying Zeppelin ransomware, actors spend one to two weeks mapping or enumerating the victim network to identify data enclaves, including cloud storage and network backups, the alert notes.</p>
<p>Jon said he felt so lucky after connecting with James and hearing about their decryption work, that he toyed with the idea of buying a lottery ticket that day.</p>
<p>&#8220;This just doesn&#8217;t usually happen,&#8221; Jon said. &#8220;It&#8217;s 100 percent like winning the lottery.&#8221;</p>
<p>By the time Jon&#8217;s company got around to decrypting their data, they were forced by regulators to prove that no patient data had been exfiltrated from their systems. All told, it took his employer two months to fully recover from the attack.</p>
<p>&#8220;I definitely feel like I was ill-prepared for this attack,&#8221; Jon said. &#8220;One of the things I&#8217;ve learned from this is the importance of forming your core team and having those people who know what their roles and responsibilities are ahead of time. Also, trying to vet new vendors you&#8217;ve never met before and build trust relationships with them is very difficult to do when you have customers down hard now and they&#8217;re waiting on you to help them get back up.&#8221;</p>
<p>A more technical writeup on Unit 221B&#8217;s discoveries (cheekily titled &#8220;0XDEAD ZEPPELIN&#8221;) is available <a href="https://blog.unit221b.com/dont-read-this-blog/0xdead-zeppelin" rel="noopener" target="_blank">here</a>.</p>


feed_id: https://krebsonsecurity.com/?p=61915
title: U.S. Govt. Apps Bundled Russian Code With Ties to Mobile Malware Developer
uri: U-S-Govt-Apps-Bundled-Russian-Code-With-Ties-to-Mobile-Malware-Devel
url:
https://krebsonsecurity.com/2022/11/u-s-govt-apps-bundled-russian-code-with-ties-to-mobile-malware-developer/

content:
<p>A recent scoop by <strong>Reuters</strong> revealed that mobile apps for the <strong>U.S. Army</strong> and the <strong>Centers for Disease Control and Prevention</strong> (CDC) were integrating software that sends visitor data to a Russian company called <strong>Pushwoosh</strong>, which claims to be based in the United States. But that story omitted an important historical detail about Pushwoosh: In 2013, one of its developers admitted to authoring the <strong>Pincer Trojan</strong>, malware designed to surreptitiously intercept and forward text messages from <strong>Android</strong> mobile devices.</p>
<p><img class="aligncenter wp-image-61955" src="media/0a880479.pushwoosh-li.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/11/pushwoosh-li.png" alt="" width="751" height="602" srcset="https://krebsonsecurity.com/wp-content/uploads/2022/11/pushwoosh-li.png 831w, https://krebsonsecurity.com/wp-content/uploads/2022/11/pushwoosh-li-768x616.png 768w, https://krebsonsecurity.com/wp-content/uploads/2022/11/pushwoosh-li-782x627.png 782w" sizes="(max-width: 751px) 100vw, 751px" /></p>
<p>Pushwoosh says it is a U.S. based company that provides code for software developers to profile smartphone app users based on their online activity, allowing them to send tailor-made notifications. But a <a href="https://www.reuters.com/technology/exclusive-russian-software-disguised-american-finds-its-way-into-us-army-cdc-2022-11-14/" target="_blank" rel="noopener">recent investigation by Reuters</a> raised questions about the company&#8217;s real location and truthfulness.</p>
<p>The Army told Reuters it removed an app containing Pushwoosh in March, citing &#8220;security concerns.&#8221; The Army app was used by soldiers at one of the nation&#8217;s main combat training bases.</p>
<p>Reuters said the CDC likewise recently removed Pushwoosh code from its app over security concerns, after reporters informed the agency Pushwoosh was not based in the Washington D.C. area &#8212; as the company had represented &#8212; but was instead operated from Novosibirsk, Russia.</p>
<p>Pushwoosh&#8217;s software also was found in apps for &#8220;a wide array of international companies, influential nonprofits and government agencies from global consumer goods company <strong>Unilever</strong> and the <strong>Union of European Football Associations</strong> (UEFA) to the politically powerful U.S. gun lobby, the <strong>National Rifle Association</strong> (NRA), and Britain&#8217;s <strong>Labour Party</strong>.&#8221;</p>
<p>The company&#8217;s founder <strong>Max Konev</strong> told Reuters Pushwoosh &#8220;has no connection with the Russian government of any kind&#8221; and that it stores its data in the United States and Germany.</p>
<p>But Reuters found that while Pushwoosh&#8217;s social media and U.S. regulatory filings present it as a U.S. company based variously in California, Maryland and Washington, D.C., the company&#8217;s employees are located in Novosibirsk, Russia.</p>
<p>Reuters also learned that the company&#8217;s address in California does not exist, and that two LinkedIn accounts for Pushwoosh employees in Washington, D.C. were fake.</p>
<p>&#8220;Pushwoosh never mentioned it was Russian-based in eight annual filings in the U.S. state of Delaware, where it is registered, an omission which could violate state law,&#8221; Reuters reported.</p>
<p>Pushwoosh admitted the LinkedIn profiles were fake, but said they were created by a marketing firm to drum up business for the company &#8212; not misrepresent its location.</p>
<p>Pushwoosh told Reuters it used addresses in the Washington, D.C. area to &#8220;receive business correspondence&#8221; during the coronavirus pandemic. A review of the Pushwoosh founder&#8217;s online presence via <a href="https://www.constellaintelligence.com" target="_blank" rel="noopener">Constella Intelligence</a> shows his Pushwoosh email address was tied to a phone number in Washington, D.C. that was also connected to email addresses and account profiles for over a dozen other Pushwoosh employees.</p>
<div id="attachment_61978" style="width: 758px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-61978" loading="lazy" class=" wp-image-61978" src="media/a84da8c9.pushwoosh-ru.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/11/pushwoosh-ru.png" alt="" width="748" height="596" srcset="https://krebsonsecurity.com/wp-content/uploads/2022/11/pushwoosh-ru.png 964w, https://krebsonsecurity.com/wp-content/uploads/2022/11/pushwoosh-ru-768x612.png 768w, https://krebsonsecurity.com/wp-content/uploads/2022/11/pushwoosh-ru-782x623.png 782w" sizes="(max-width: 748px) 100vw, 748px" /><p id="caption-attachment-61978" class="wp-caption-text">Pushwoosh was incorporated in Novosibirsk, Russia in 2016.</p></div>
<h2>THE PINCER TROJAN CONNECTION</h2>
<p>The dust-up over Pushwoosh came in part from data gathered by <strong>Zach Edwards</strong>, a security researcher who until recently worked for the <a href="https://internetsafetylabs.org/" target="_blank" rel="noopener">Internet Safety Labs</a>, a nonprofit organization that funds research into online threats.</p>
<p>Edwards said Pushwoosh began as <strong>Arello-Mobile</strong>, and for several years the two co-branded &#8212; appearing side by side at various technology expos. Around 2016, he said, the two companies both started using the Pushwoosh name.</p>
<p>A search on <a href="https://search.maven.org/artifact/com.pushwoosh/pushwoosh-firebase/6.2.5/aar" target="_blank" rel="noopener">Pushwoosh&#8217;s code base</a> shows that one of the company&#8217;s longtime developers is a 41-year-old from Novosibirsk named <strong>Yuri Shmakov</strong>. In 2013, KrebsOnSecurity interviewed Shmakov for the story, &#8220;<a href="https://krebsonsecurity.com/2013/08/who-wrote-the-pincer-android-trojan/" target="_blank" rel="noopener">Who Wrote the Pincer Android Trojan?</a>&#8221; wherein Shmakov acknowledged writing the malware as a freelance project.</p>
<blockquote><p>Shmakov told me that, based on the client’s specifications, he suspected it might ultimately be put to nefarious uses. Even so, he completed the job and signed his work by including his nickname in the app’s code.</p>
<p>“I was working on this app for some months, and I was hoping that it would be really helpful,” Shmakov wrote. “[The] idea of this app is that you can set it up as a spam filter…block some calls and SMS remotely, from a Web service. I hoped that this will be [some kind of] blacklist, with logging about blocked [messages/calls]. But of course, I understood that client [did] not really want this.”</p></blockquote>
<p>Shmakov did not respond to requests for comment. His LinkedIn profile says he stopped working for Arello Mobile in 2016, and that he currently is employed full-time as the Android team leader at an online betting company.</p>
<p>In a blog post responding to the <em>Reuters</em> story, Pushwoosh said it is a privately held company incorporated under the state laws of Delaware, USA, and that Pushwoosh Inc. was <a href="media/a84da8c9.pushwoosh-ru.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/11/pushwoosh-ru.png" target="_blank" rel="noopener">never owned by any company registered in the Russian Federation</a>.</p>
<p>&#8220;Pushwoosh Inc. used to outsource development parts of the product to the Russian company in Novosibirsk, mentioned in the article,&#8221; the company said. &#8220;However, in February 2022, Pushwoosh Inc. terminated the contract.&#8221;</p>
<p>However, Edwards noted that <a href="https://securitytrails.com/domain/go.nmassalitin.dev-cluster.pushwoosh.com/dns" target="_blank" rel="noopener">dozens of developer subdomains on Pushwoosh&#8217;s main domain still point to JSC Avantel</a>, an Internet provider based in Novosibirsk, Russia.</p>
<h2>WAR GAMES</h2>
<div id="attachment_61967" style="width: 762px" class="wp-caption aligncenter"><a href="media/d9305073.pushwooshteam.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/11/pushwooshteam.png" target="_blank" rel="noopener"><img aria-describedby="caption-attachment-61967" loading="lazy" class="wp-image-61967" src="media/d9305073.pushwooshteam.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/11/pushwooshteam.png" alt="" width="752" height="317" srcset="https://krebsonsecurity.com/wp-content/uploads/2022/11/pushwooshteam.png 1396w, https://krebsonsecurity.com/wp-content/uploads/2022/11/pushwooshteam-768x324.png 768w, https://krebsonsecurity.com/wp-content/uploads/2022/11/pushwooshteam-782x330.png 782w" sizes="(max-width: 752px) 100vw, 752px" /></a><p id="caption-attachment-61967" class="wp-caption-text">Pushwoosh employees posing at a company laser tag event.</p></div>
<p>Edwards said the U.S. Army&#8217;s app had a custom Pushwoosh configuration that did not appear on any other customer implementation.</p>
<p>&#8220;It had an extremely custom setup that existed nowhere else,&#8221; Edwards said. &#8220;Originally, it was an in-app Web browser, where it integrated a Pushwoosh javascript so that any time a user clicked on links, data went out to Pushwoosh and they could push back whatever they wanted through the in-app browser.&#8221;</p>
<p>An <em>Army Times</em> <a href="https://www.armytimes.com/news/your-army/2022/11/15/official-army-app-had-russian-code-might-have-harvested-user-data/" target="_blank" rel="noopener">article</a> published the day after the Reuters story ran said at least 1,000 people downloaded the app, which &#8220;delivered updates for troops at the National Training Center on Fort Irwin, Calif., a critical waypoint for deploying units to test their battlefield prowess before heading overseas.&#8221;</p>
<p>In April 2022, roughly 4,500 Army personnel converged on the National Training Center for <a href="https://apnews.com/article/russia-ukraine-war-us-army-training-54e76eba46f9bf79542dd3f872456e67" target="_blank" rel="noopener">a war games exercise</a> on how to use lessons learned from Russia&#8217;s war against Ukraine to prepare for future fights against a major adversary such as Russia or China.</p>
<p>Edwards said despite Pushwoosh&#8217;s many prevarications, the company&#8217;s software doesn&#8217;t appear to have done anything untoward to its customers or users.</p>
<p>&#8220;Nothing they did has been seen to be malicious,&#8221; he said. &#8220;Other than completely lying about where they are, where their data is being hosted, and where they have infrastructure.&#8221;<span id="more-61915"></span></p>
<h2>GOV 311</h2>
<p>Edwards also found Pushwoosh&#8217;s technology embedded in nearly two dozen mobile apps that were sold to cities and towns across Illinois as a way to help citizens access general information about their local communities and officials.</p>
<p><img loading="lazy" class="aligncenter size-full wp-image-61965" src="media/ebf8b782.gov311.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/11/gov311.png" alt="" width="589" height="765" />The Illinois apps that bundled Pushwoosh&#8217;s technology were produced by a company called <a href="https://government311.com/contact-us/" target="_blank" rel="noopener">Government 311</a>, which is owned by <a href="https://www.linkedin.com/in/bill-mccarty-168b746/" target="_blank" rel="noopener">Bill McCarty</a>, the current director of the Springfield Office of Budget and Management. A <a href="https://www.sj-r.com/story/news/politics/county/2014/10/06/sherman-launching-app-to-report/36239154007/" target="_blank" rel="noopener">2014 story</a> in <em>The State Journal-Register</em> said Gov 311&#8217;s pricing was based on population, and that the app would cost around $2,500 per year for a city with approximately 25,000 people.</p>
<p>McCarty told KrebsOnSecurity that his company stopped using Pushwoosh &#8220;years ago,&#8221; and that it now relies on its own technology to provide push notifications through its 311 apps.</p>
<p>But Edwards found some of the 311 apps still try to phone home to Pushwoosh, such as the 311 app for Riverton, Ill.</p>
<p>&#8220;Riverton ceased being a client several years ago, which [is] probably why their app was never updated to change out Pushwoosh,&#8221; McCarty explained. &#8220;We are in the process of updating all client apps and a website refresh. As part of that, old unused apps like Riverton 311 will be deleted.&#8221;</p>
<h2>FOREIGN ADTECH THREAT?</h2>
<p>Edwards said it&#8217;s far from clear how many other state and local government apps and Web sites rely on technology that sends user data to U.S. adversaries overseas. In July, Congress introduced an amended version of the Intelligence Authorization Act for 2023, which included a new section focusing on data drawn from online ad auctions that could be used to geolocate individuals or gain other information about them.</p>
<p><em>Business Insider</em> <a href="https://www.businessinsider.com/odni-investigate-adtech-national-security-risk-2022-8" target="_blank" rel="noopener">reports</a> that if this section makes it into the final version &#8212; which the Senate also has to pass &#8212; the Office for the Director of National Intelligence (ODNI) will have 60 days after the Act becomes law to produce a risk assessment. The assessment will look into &#8220;the counterintelligence risks of, and the exposure of intelligence community personnel to, tracking by foreign adversaries through advertising technology data,&#8221; the Act states.</p>
<p>Edwards says he&#8217;s hoping those changes pass, because what he found with Pushwoosh is likely just a drop in a bucket.</p>
<p>&#8220;I&#8217;m hoping that Congress acts on that,&#8221; he said. &#8220;If they were to put a requirement that there&#8217;s an annual audit of risks from foreign ad tech, that would at least force people to identify and document those connections.&#8221;</p>


feed_id: https://krebsonsecurity.com/?p=61999
title: ConnectWise Quietly Patches Flaw That Helps Phishers
uri: ConnectWise-Quietly-Patches-Flaw-That-Helps-Phishers
url: https://krebsonsecurity.com/2022/12/connectwise-quietly-patches-flaw-that-helps-phishers/
content:
<p><strong>ConnectWise</strong>, a self-hosted, remote desktop software application that is widely used by Managed Service Providers (MSPs), is warning about an unusually sophisticated phishing attack that can let attackers take remote control over user systems when recipients click the included link. The warning comes just weeks after the company quietly patched a vulnerability that makes it easier for phishers to launch these attacks.</p>
<div id="attachment_62001" style="width: 764px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-62001" class=" wp-image-62001" src="media/ddc88954.connectwisephish.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/12/connectwisephish.png" alt="" width="754" height="463" /><p id="caption-attachment-62001" class="wp-caption-text">A phishing attack targeting MSP customers using ConnectWise.</p></div>
<p>ConnectWise&#8217;s service is extremely popular among MSPs that manage, protect and service large numbers of computers remotely for client organizations. Their product provides a dynamic software client and hosted server that connects two or more computers together, and provides temporary or persistent remote access to those client systems.</p>
<p>When a support technician wants to use ConnectWise to remotely administer a computer, the ConnectWise website generates an executable file that is digitally signed by ConnectWise and downloadable by the client via a hyperlink.</p>
<p>When the remote user in need of assistance clicks the link, their computer is then directly connected to the computer of the remote administrator, who can then control the client&#8217;s computer as if they were seated in front of it.</p>
<p>While modern Microsoft Windows operating systems by default will ask users whether they want to run a downloaded executable file, many systems set up for remote administration by MSPs disable that user account control feature for this particular application.</p>
<p>In October, security researcher <strong>Ken Pyle</strong> alerted ConnectWise that their client executable file <em>gets generated based on client-controlled parameters</em>. Meaning, an attacker could craft a ConnectWise client download link that would bounce or proxy the remote connection from the MSP&#8217;s servers to a server that the attacker controls.</p>
<p>This is dangerous because many organizations that rely on MSPs to manage their computers often set up their networks so that only remote assistance connections coming from their MSP&#8217;s networks are allowed.</p>
<p>Using a free ConnectWise trial account, Pyle showed the company how easy it was to create a client executable that is cryptographically signed by ConnectWise and can bypass those network restrictions by bouncing the connection through an attacker&#8217;s ConnectWise control server.</p>
<p>&#8220;You as the attacker have full control over the link&#8217;s parameters, and that link gets injected into an executable file that is downloaded by the client through an unauthenticated Web interface,&#8221; said Pyle, a partner and exploit developer at the security firm <a href="http://cybir.com" target="_blank" rel="noopener">Cybir</a>. &#8220;I can send this link to a victim, they will click this link, and their workstation will connect back to my instance via a link on your site.&#8221;</p>
<div id="attachment_62003" style="width: 760px" class="wp-caption aligncenter"><a href="media/985370dd.pyleofpain.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/12/pyleofpain.png" target="_blank" rel="noopener"><img aria-describedby="caption-attachment-62003" loading="lazy" class="wp-image-62003" src="media/985370dd.pyleofpain.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/12/pyleofpain.png" alt="" width="750" height="630" srcset="https://krebsonsecurity.com/wp-content/uploads/2022/12/pyleofpain.png 1020w, https://krebsonsecurity.com/wp-content/uploads/2022/12/pyleofpain-768x645.png 768w, https://krebsonsecurity.com/wp-content/uploads/2022/12/pyleofpain-782x657.png 782w" sizes="(max-width: 750px) 100vw, 750px" /></a><p id="caption-attachment-62003" class="wp-caption-text">A composite of screenshots researcher Ken Pyle put together to illustrate the ScreenConnect vulnerability.</p></div>
<p>On Nov. 29, roughly the same time Pyle <a href="https://cybir.com/2022/cve/hijacking-connectwise-control-and-ddos/" target="_blank" rel="noopener">published a blog post about his findings</a>, ConnectWise issued <a href="https://www.connectwise.com/company/trust/advisories" target="_blank" rel="noopener">an advisory</a> warning users to be on guard against a new round email phishing attempts that mimic legitimate email alerts the company sends when it detects unusual activity on a customer account.</p>
<p>&#8220;We are aware of a phishing campaign that mimics ConnectWise Control New Login Alert emails and has the potential to lead to unauthorized access to legitimate Control instances,&#8221; the company said.</p>
<p>ConnectWise said it released software updates last month that included new protections against the misdirection vulnerability that Pyle reported.  But the company said there is no reason to believe the phishers they warned about are exploiting any of the issues reported by Pyle.<span id="more-61999"></span></p>
<p>&#8220;Our team quickly triaged the report and determined the risk to partners to be minimal,&#8221; ConnectWise spokesperson <strong>Tarran Street</strong> said. &#8220;Nevertheless, the mitigation was simple and presented no risk to partner experience, so we put it into the then-stable <em>22.8 build</em> and the then-canary <em>22.9 build</em>, which were released as part of our normal release processes. Due to the low severity of the issue, we didn&#8217;t (and don&#8217;t plan to) issue a security advisory or alert, since we reserve those notifications for serious security issues.&#8221;</p>
<p>Pyle said he doubts the issue he reported is unrelated to the phishing attacks ConnectWise is warning about.</p>
<p>&#8220;They don&#8217;t want to talk about my work (no advisory), and they recommend applying the patch they issued in response to my work,&#8221; Pyle wrote when asked to comment on ConnectWise&#8217;s response.</p>
<p>The ConnectWise advisory warned users that before clicking any link that appears to come from their service, users should validate the content includes &#8220;domains owned by trusted sources,&#8221; and &#8220;links to go to places you recognize.&#8221;</p>
<p>But Pyle said this advice is not terribly useful for customers, because in his attack scenario the phishers can send emails directly from ConnectWise, and the short link that gets presented to the user is a wildcard domain that ends in ConnectWise&#8217;s own domain name &#8212; screenconnect.com. What&#8217;s more, examining the exceedingly long link generated by ConnectWise&#8217;s systems offers few insights to the average user.</p>
<p>&#8220;It&#8217;s signed by ConnectWise and comes from them, and if you sign up for a free trial instance, you can email people invites directly from them,&#8221; Pyle said.</p>
<p>ConnectWise&#8217;s warnings come amid breach reports from another major provider of cloud-based remote support technologies: <strong>GoTo</strong> <a href="https://www.goto.com/blog/our-response-to-a-recent-security-incident#" target="_blank" rel="noopener">disclosed</a> on Nov. 30 that it is investigating a security incident involving &#8220;unusual activity within our development environment and third-party cloud storage services. The third-party cloud storage service is currently shared by both GoTo and its affiliate, the password manager service <strong>LastPass</strong>.</p>
<p>In <a href="https://blog.lastpass.com/2022/11/notice-of-recent-security-incident/" target="_blank" rel="noopener">its own advisory on the incident</a>, LastPass said they believe the intruders leveraged information stolen during a previous intrusion in August 2022 to gain access to &#8220;certain elements of our customers&#8217; information.&#8221;  However, LastPass maintains that its &#8220;customer passwords remain safely encrypted due to LastPass&#8217;s Zero Knowledge architecture.&#8221;</p>
<p>In short, that architecture means if you lose or forget your all-important master LastPass password &#8212; the one needed to unlock access to all of your other passwords stored with them &#8212; LastPass can&#8217;t help you with that, because they don&#8217;t store it. But that same architecture theoretically means that hackers who might break into LastPass&#8217;s networks can&#8217;t access that information either.</p>


feed_id: https://krebsonsecurity.com/?p=61945
title: Judge Orders U.S. Lawyer in Russian Botnet Case to Pay Google
uri: Judge-Orders-U-S-Lawyer-in-Russian-Botnet-Case-to-Pay-Google
url: https://krebsonsecurity.com/2022/12/judge-orders-u-s-lawyer-in-russian-botnet-case-to-pay-google/
content:
<p>In December 2021, <strong>Google</strong> filed a civil lawsuit against two Russian men thought to be responsible for operating <strong>Glupteba</strong>, one of the Internet&#8217;s largest and oldest botnets. The defendants, who initially pursued a strategy of counter suing Google for tortious interference in their sprawling cybercrime business, later brazenly offered to dismantle the botnet in exchange for payment from Google. The judge in the case was not amused, found for the plaintiff, and ordered the defendants <em>and their U.S. attorney</em> to pay Google&#8217;s legal fees.</p>
<div id="attachment_62037" style="width: 765px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-62037" class=" wp-image-62037" src="media/0b685146.gluptebamodules.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/12/gluptebamodules.png" alt="" width="755" height="389" srcset="https://krebsonsecurity.com/wp-content/uploads/2022/12/gluptebamodules.png 1294w, https://krebsonsecurity.com/wp-content/uploads/2022/12/gluptebamodules-768x396.png 768w, https://krebsonsecurity.com/wp-content/uploads/2022/12/gluptebamodules-782x403.png 782w" sizes="(max-width: 755px) 100vw, 755px" /><p id="caption-attachment-62037" class="wp-caption-text">A slide from a talk given in Sept. 2022 by Google researcher Luca Nagy. https://www.youtube.com/watch?v=5Gz6_I-wl0E&amp;t=6s</p></div>
<p>Glupteba is a rootkit that steals passwords and other access credentials, disables security software, and tries to compromise other devices on the victim network &#8212; such as Internet routers and media storage servers &#8212; for use in relaying spam or other malicious traffic.</p>
<p>Collectively, the tens of thousands of systems infected with Glupteba on any given day feed into a number of major cybercriminal businesses: The botnet&#8217;s proprietors sell the credential data they steal, use the botnet to place disruptive ads on the infected computers, and mine cryptocurrencies. Glupteba also rents out infected systems as &#8220;proxies,&#8221; directing third-party traffic through the infected devices to disguise the origin of the traffic.</p>
<p>In June 2022, KrebsOnSecurity showed how the malware proxy services <a href="https://krebsonsecurity.com/2022/06/the-link-between-awm-proxy-the-glupteba-botnet/" target="_blank" rel="noopener">RSOCKS and AWMProxy were entirely dependent on the Glupteba botnet</a> for fresh proxies, and that the founder of AWMProxy was <strong>Dmitry Starovikov</strong> &#8212; one of the Russian men named in Google&#8217;s lawsuit.</p>
<p>Google sued Starovikov and 15 other &#8220;John Doe&#8221; defendants, alleging violations of the Racketeer Influenced and Corrupt Organizations Act (RICO), the Computer Fraud and Abuse Act, trademark and unfair competition law, and unjust enrichment.</p>
<p>In June, Google and the named defendants agreed that the case would proceed as a nonjury action because Google had withdrawn its claim for damages &#8212; seeking only injunctive relief to halt the operations of the botnet.</p>
<p>The defendants, who worked for a Russian firm called &#8220;<strong>Valtron</strong>&#8221; that was also named in the lawsuit, told Google that they were interested in settling. The defendants said they could potentially help Google by taking the botnet offline.</p>
<div id="attachment_62038" style="width: 763px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-62038" loading="lazy" class=" wp-image-62038" src="media/292d6be4.glupteba-eco.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/12/glupteba-eco.png" alt="" width="753" height="481" srcset="https://krebsonsecurity.com/wp-content/uploads/2022/12/glupteba-eco.png 1024w, https://krebsonsecurity.com/wp-content/uploads/2022/12/glupteba-eco-768x491.png 768w, https://krebsonsecurity.com/wp-content/uploads/2022/12/glupteba-eco-782x499.png 782w" sizes="(max-width: 753px) 100vw, 753px" /><p id="caption-attachment-62038" class="wp-caption-text">Another slide from Google researcher Luca Nagy&#8217;s September 2022 talk on Glupteba.</p></div>
<p>But the court expressed frustration that the defendants were unwilling to consent to a permanent injunction, and at the same time were unable to articulate why an injunction forbidding them from engaging in unlawful activities would pose a problem.</p>
<p>&#8220;The Defendants insisted that they were not engaged in criminal activity, and that any alleged activity in which they were engaged was legitimate,&#8221; U.S. District Court Judge Denise Cote wrote. &#8220;Nevertheless, the Defendants resisted entry of a permanent injunction, asserting that Google’s use of the preliminary injunction had disrupted their normal business operations.&#8221;</p>
<p>While the defendants represented that they had the ability to dismantle the Glupteba botnet, when it came time for discovery &#8212; the stage in a lawsuit where both parties can compel the production of documents and other information pertinent to their case &#8212; the attorney for the defendants told the court his clients had been fired by Valtron in late 2021, and thus no longer had access to their work laptops or the botnet.</p>
<p>The lawyer for the defendants &#8212; New York-based cybercrime defense attorney <strong>Igor Litv</strong><strong>ak</strong> &#8212; told the court he first learned about his clients&#8217; termination from Valtron on May 20, a fact Judge Cote said she found &#8220;troubling&#8221; given statements he made to the court after that date representing that his clients still had access to the botnet.</p>
<p>The court ultimately suspended the discovery process against Google, saying there was reason to believe the defendants sought discovery only &#8220;to learn whether they could circumvent the steps Google has taken to block the malware.&#8221;<span id="more-61945"></span></p>
<p>On September 6, Litvak emailed Google that his clients were willing to discuss settlement.</p>
<p>&#8220;The parties held a call on September 8, at which Litvak explained that the Defendants would be willing to provide Google with the private keys for Bitcoin addresses associated with the Glupteba botnet, and that they would promise not to engage in their alleged criminal activity in the future (without any admission of wrongdoing),&#8221; the judge wrote.</p>
<p>&#8220;In exchange, the Defendants would receive Google’s agreement not to report them to law enforcement, and a payment of $1 million per defendant, plus $110,000 in attorney’s fees,&#8221; Judge Cote continued. &#8220;The Defendants stated that, although they do not currently have access to the private keys, Valtron would be willing to provide them with the private keys if the case were settled. The Defendants also stated that they believe these keys would help Google shut down the Glupteba botnet.&#8221;</p>
<p>Google rejected the defendants’ offer as extortionate, and reported it to law enforcement. Judge Cote also found Litvak was complicit in the defendants&#8217; efforts to mislead the court, and ordered him to join his clients in paying Google&#8217;s legal fees.</p>
<p>&#8220;It is now clear that the Defendants appeared in this Court not to proceed in good faith to defend against Google’s claims but with the intent to abuse the court system and discovery rules to reap a profit from Google,&#8221; Judge Cote wrote.</p>
<p>Litvak has filed <a href="media/b948a882.133-1.pdf" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/12/133-1.pdf" target="_blank" rel="noopener">a motion to reconsider</a> (PDF), asking the court to vacate the sanctions against him. He said his goal is to get the case back into court.</p>
<p>&#8220;The judge was completely wrong to issue sanctions,&#8221; Litvak said in an interview with KrebsOnSecurity. &#8220;From the beginning of the case, she acted as if she needed to protect Google from something. If the court does not decide to vacate the sanctions, we will have to go to the Second Circuit (<a href="https://en.wikipedia.org/wiki/United_States_Court_of_Appeals_for_the_Second_Circuit" target="_blank" rel="noopener">Court of Appeals</a>) and get justice there.&#8221;</p>
<p>In <a href="https://blog.google/outreach-initiatives/public-policy/a-ruling-in-our-legal-case-against-the-glupteba-botnet/" target="_blank" rel="noopener">a statement on the court&#8217;s decision</a>, Google said it will have significant ramifications for online crime, and that since its technical and legal attacks on the botnet last year, Google has observed a 78 percent reduction in the number of hosts infected by Glupteba.</p>
<p>&#8220;While Glupteba operators have resumed activity on some non-Google platforms and IoT devices, shining a legal spotlight on the group makes it less appealing for other criminal operations to work with them,&#8221; reads a blog post from Google&#8217;s General Counsel <strong>Halimah DeLaine Prado</strong> and vice president of engineering <strong>Royal Hansen</strong>. &#8220;And the steps [Google] took last year to disrupt their operations have already had significant impact.&#8221;</p>
<div id="attachment_60212" style="width: 760px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-60212" loading="lazy" class=" wp-image-60212" src="media/218d8565.certpolska-glupteba.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/06/certpolska-glupteba.png" alt="" width="750" height="457" srcset="https://krebsonsecurity.com/wp-content/uploads/2022/06/certpolska-glupteba.png 988w, https://krebsonsecurity.com/wp-content/uploads/2022/06/certpolska-glupteba-768x468.png 768w, https://krebsonsecurity.com/wp-content/uploads/2022/06/certpolska-glupteba-782x476.png 782w" sizes="(max-width: 750px) 100vw, 750px" /><p id="caption-attachment-60212" class="wp-caption-text">A report from the Polish computer emergency response team (CERT Orange Polksa) found Glupteba was the biggest malware threat in 2021.</p></div>


feed_id: https://krebsonsecurity.com/?p=62052
title: New Ransom Payment Schemes Target Executives, Telemedicine
uri: New-Ransom-Payment-Schemes-Target-Executives-Telemedicine
url: https://krebsonsecurity.com/2022/12/new-ransom-payment-schemes-target-executives-telemedicine/
content:
<p>Ransomware groups are constantly devising new methods for infecting victims and convincing them to pay up, but a couple of strategies tested recently seem especially devious. The first centers on targeting healthcare organizations that offer consultations over the Internet and sending them booby-trapped medical records for the &#8220;patient.&#8221; The other involves carefully editing email inboxes of public company executives to make it appear that some were involved in insider trading.</p>
<p><img class="aligncenter  wp-image-62073" src="media/43ded43a.insidertrading.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/12/insidertrading.png" alt="" width="690" height="460" /></p>
<p><strong>Alex Holden</strong> is founder of <a href="https://www.holdsecurity.com" target="_blank" rel="noopener">Hold Security</a>, a Milwaukee-based cybersecurity firm. Holden&#8217;s team gained visibility into discussions among members of two different ransom groups: <strong>CLOP</strong> (a.k.a. &#8220;<strong>Cl0p</strong>&#8221; a.k.a. &#8220;<a href="https://malpedia.caad.fkie.fraunhofer.de/details/win.clop" target="_blank" rel="noopener">TA505</a>&#8220;), and a newer ransom group known as <strong>Venus</strong>.</p>
<p>Last month, the <strong>U.S. Department of Health and Human Services</strong> (HHS) <a href="media/b688a29e.venus-ransomware-analyst-note.pdf" data-original-source="https://www.hhs.gov/sites/default/files/venus-ransomware-analyst-note.pdf" target="_blank" rel="noopener">warned</a> that Venus ransomware attacks were targeting a number of U.S. healthcare organizations. First spotted <a href="https://www.bleepingcomputer.com/news/security/venus-ransomware-targets-publicly-exposed-remote-desktop-services/" target="_blank" rel="noopener">in mid-August 2022</a>, Venus is known for hacking into victims&#8217; publicly-exposed Remote Desktop services to encrypt Windows devices.</p>
<p>Holden said the internal discussions among the Venus group members indicate this gang has no problem gaining access to victim organizations.</p>
<p>&#8220;The Venus group has problems getting paid,&#8221; Holden said. &#8220;They are targeting a lot of U.S. companies, but nobody wants to pay them.&#8221;</p>
<p>Which might explain why their latest scheme centers on trying to frame executives at public companies for insider trading charges. Venus indicated it recently had success with a method that involves carefully editing one or more email inbox files at a victim firm &#8212; to insert messages discussing plans to trade large volumes of the company&#8217;s stock based on non-public information.</p>
<p>&#8220;We imitate correspondence of the [CEO] with a certain insider who shares financial reports of his companies through which your victim allegedly trades in the stock market, which naturally is a criminal offense and &#8212; according to US federal laws [includes the possibility of up to] 20 years in prison,&#8221; one Venus member wrote to an underling.</p>
<p>&#8220;You need to create this file and inject into the machine(s) like this so that metadata would say that they were created on his computer,&#8221; they continued. &#8220;One of my clients did it, I don&#8217;t know how. In addition to pst, you need to decompose several files into different places, so that metadata says the files are native from a certain date and time rather than created yesterday on an unknown machine.&#8221;</p>
<p>Holden said it&#8217;s not easy to plant emails into an inbox, but it can be done with <a href="https://support.microsoft.com/en-us/office/create-an-outlook-data-file-pst-to-save-your-information-17a13ca2-df52-48e8-b933-4c84c2aabe7c" target="_blank" rel="noopener">Microsoft Outlook .pst files</a>, which the attackers may also have access to if they&#8217;d already compromised a victim network.</p>
<p>&#8220;It&#8217;s not going to be forensically solid, but that&#8217;s not what they care about,&#8221; he said. &#8220;It still has the potential to be a huge scandal &#8212; at least for a while &#8212; when a victim is being threatened with the publication or release of these records.&#8221;</p>
<p><div id="attachment_62059" style="width: 761px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-62059" loading="lazy" class=" wp-image-62059" src="media/12912a1e.venusransom.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/12/venusransom.png" alt="" width="751" height="361" /><p id="caption-attachment-62059" class="wp-caption-text">The Venus ransom group&#8217;s extortion note. Image: Tripwire.com</p></div><span id="more-62052"></span></p>
<p>Holden said the CLOP ransomware gang has a different problem of late: Not enough victims. The intercepted CLOP communication seen by KrebsOnSecurity shows the group bragged about twice having success infiltrating new victims in the healthcare industry by sending them infected files disguised as ultrasound images or other medical documents for a patient seeking a remote consultation.</p>
<p>The CLOP members said one tried-and-true method of infecting healthcare providers involved gathering healthcare insurance and payment data to use in submitting requests for a remote consultation on a patient who has cirrhosis of the liver.</p>
<p>&#8220;Basically, they&#8217;re counting on doctors or nurses reviewing the patient&#8217;s chart and scans just before the appointment,&#8221; Holden said. &#8220;They initially discussed going in with cardiovascular issues, but decided cirrhosis or fibrosis of the liver would be more likely to be diagnosable remotely from existing test results and scans.&#8221;</p>
<p>While CLOP as a money making collective is a fairly young organization, security experts say CLOP members hail from a group of Threat Actors (TA) known as &#8220;TA505,&#8221; which <a href="https://attack.mitre.org/groups/G0092/" target="_blank" rel="noopener">MITRE&#8217;s ATT&amp;CK database says</a> is a financially motivated cybercrime group that has been active since at least 2014. &#8220;This group is known for frequently changing malware and driving global trends in criminal malware distribution,&#8221; MITRE assessed.</p>
<p>In April, 2021, KrebsOnSecurity detailed how CLOP helped pioneer another innovation aimed at pushing more victims into paying an extortion demand: <a href="https://krebsonsecurity.com/2021/04/ransom-gangs-emailing-victim-customers-for-leverage/" target="_blank" rel="noopener">Emailing the ransomware victim&#8217;s customers and partners directly</a> and warning that their data would be leaked to the dark web unless they can convince the victim firm to pay up.</p>
<p>Security firm <strong>Tripwire</strong> <a href="https://www.tripwire.com/state-of-security/healthcare-sector-warned-venus-ransomware-attacks" target="_blank" rel="noopener">points out</a> that the HHS advisory on Venus says multiple threat actor groups are likely distributing the Venus ransomware. Tripwire&#8217;s tips for all organizations on avoiding ransomware attacks include:</p>
<ul>
<li>Making secure offsite backups.</li>
<li>Running up-to-date security solutions and ensuring that your computers are protected with the latest security patches against vulnerabilities.</li>
<li>Using hard-to-crack unique passwords to protect sensitive data and accounts, as well as enabling multi-factor authentication.</li>
<li>Encrypting sensitive data wherever possible.</li>
<li>Continuously educating and informing staff about the risks and methods used by cybercriminals to launch attacks and steal data.</li>
</ul>
<p>While the above tips are important and useful, one critical area of ransomware preparedness overlooked by too many organizations is the need to develop &#8212; and then periodically rehearse &#8212; a plan for how everyone in the organization should respond in the event of a ransomware or data ransom incident. Drilling this breach response plan is key because it helps expose weaknesses in those plans that could be exploited by the intruders.</p>
<p>As noted in last year&#8217;s story <a href="https://krebsonsecurity.com/2021/07/dont-wanna-pay-ransom-gangs-test-your-backups/" target="_blank" rel="noopener">Don&#8217;t Wanna Pay Ransom Gangs? Test Your Backups</a>, experts say the biggest reason ransomware targets and/or their insurance providers still pay when they already have reliable backups of their systems and data is that nobody at the victim organization bothered to test in advance how long this data restoration process might take.</p>
<p>&#8220;Suddenly the victim notices they have a couple of petabytes of data to restore over the Internet, and they realize that even with their fast connections it’s going to take three months to download all these backup files,&#8221; said <strong>Fabian Wosar</strong>, chief technology officer at <a href="https://www.emsisoft.com" target="_blank" rel="noopener">Emsisoft</a>. &#8220;A lot of IT teams never actually make even a back-of-the-napkin calculation of how long it would take them to restore from a data rate perspective.&#8221;</p>


feed_id: https://krebsonsecurity.com/?p=62084
title: FBI’s Vetted Info Sharing Network ‘InfraGard’ Hacked
uri: FBI-s-Vetted-Info-Sharing-Network-InfraGard-Hacked
url: https://krebsonsecurity.com/2022/12/fbis-vetted-info-sharing-network-infragard-hacked/
content:
<p><strong>InfraGard</strong>, a program run by the <strong>U.S. Federal Bureau of Investigation</strong> (FBI) to build cyber and physical threat information sharing partnerships with the private sector, this week saw its database of contact information on more than 80,000 members go up for sale on an English-language cybercrime forum. Meanwhile, the hackers responsible are communicating directly with members through the InfraGard portal online &#8212; using a new account under the assumed identity of a financial industry CEO that was vetted by the FBI itself.</p>
<p><img class="aligncenter wp-image-62092" src="media/a52556c2.igard.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/12/igard.png" alt="" width="749" height="383" srcset="https://krebsonsecurity.com/wp-content/uploads/2022/12/igard.png 1345w, https://krebsonsecurity.com/wp-content/uploads/2022/12/igard-768x393.png 768w, https://krebsonsecurity.com/wp-content/uploads/2022/12/igard-782x401.png 782w" sizes="(max-width: 749px) 100vw, 749px" /></p>
<p>On Dec. 10, 2022, the relatively new cybercrime forum <strong>Breached</strong> featured a bombshell new sales thread: The user database for InfraGard, including names and contact information for tens of thousands of InfraGard members.</p>
<p>The FBI&#8217;s InfraGard program is supposed to be a vetted Who&#8217;s Who of key people in private sector roles involving both cyber and physical security at companies that manage most of the nation&#8217;s critical infrastructures &#8212; including drinking water and power utilities, communications and financial services firms, transportation and manufacturing companies, healthcare providers, and nuclear energy firms.</p>
<p>&#8220;InfraGard connects critical infrastructure owners, operators, and stakeholders with the FBI to provide education, networking, and information-sharing on security threats and risks,&#8221; the FBI&#8217;s InfraGard fact sheet reads.</p>
<p>In response to information shared by KrebsOnSecurity, the FBI said it is aware of a potential false account associated with the InfraGard Portal and that it is actively looking into the matter.</p>
<p>&#8220;This is an ongoing situation, and we are not able to provide any additional information at this time,&#8221; the FBI said in a written statement.</p>
<p>KrebsOnSecurity contacted the seller of the InfraGard database, a Breached forum member who uses the handle &#8220;<strong>USDoD</strong>&#8221; and whose avatar is the seal of the <strong>U.S. Department of Defense</strong>.</p>
<div id="attachment_62128" style="width: 761px" class="wp-caption aligncenter"><a href="media/56b3b33e.breachedige.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/12/breachedige.png" target="_blank" rel="noopener"><img aria-describedby="caption-attachment-62128" loading="lazy" class="wp-image-62128" src="media/56b3b33e.breachedige.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/12/breachedige.png" alt="" width="751" height="284" srcset="https://krebsonsecurity.com/wp-content/uploads/2022/12/breachedige.png 1301w, https://krebsonsecurity.com/wp-content/uploads/2022/12/breachedige-768x290.png 768w, https://krebsonsecurity.com/wp-content/uploads/2022/12/breachedige-782x296.png 782w" sizes="(max-width: 751px) 100vw, 751px" /></a><p id="caption-attachment-62128" class="wp-caption-text">USDoD&#8217;s InfraGard sales thread on Breached.</p></div>
<p>USDoD said they gained access to the FBI&#8217;s InfraGard system by applying for a new account using the name, Social Security Number, date of birth  and other personal details of a chief executive officer at a company that was highly likely to be granted InfraGard membership.</p>
<p>The CEO in question &#8212; currently the head of a major U.S. financial corporation that has a direct impact on the creditworthiness of most Americans &#8212; told KrebsOnSecurity they were never contacted by the FBI seeking to vet an InfraGard application.</p>
<p>USDoD told KrebsOnSecurity their phony application was submitted in November in the CEO&#8217;s name, and that the application included a contact email address that they controlled &#8212; but also the CEO&#8217;s real mobile phone number.</p>
<p>&#8220;When you register they said that to be approved can take at least three months,&#8221; USDoD said. &#8220;I wasn&#8217;t expected to be approve[d].&#8221;</p>
<p><img loading="lazy" class="alignright size-full wp-image-62095" src="media/f6ef21eb.infrareply.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/12/infrareply.png" alt="" width="229" height="694" />But USDoD said that in early December, their email address in the name of the CEO received a reply saying the application had been approved (see redacted screenshot to the right). While the FBI&#8217;s InfraGard system requires multi-factor authentication by default, users can choose between receiving a one-time code via SMS or email.</p>
<p>&#8220;If it was only the phone I will be in [a] bad situation,&#8221; USDoD said. &#8220;Because I used the person[&#8216;s] phone that I&#8217;m impersonating.&#8221;</p>
<p>USDoD said the InfraGard user data was made easily available via an Application Programming Interface (API) that is built into several key components of the website that help InfraGard members connect and communicate with each other.</p>
<p>USDoD said after their InfraGard membership was approved, they asked a friend to code a script in Python to query that API and retrieve all available InfraGard user data.</p>
<p>&#8220;InfraGard is a social media intelligence hub for high profile persons,&#8221; USDoD said. &#8220;They even got [a] forum to discuss things.&#8221;</p>
<p>To prove they still had access to InfraGard as of publication time Tuesday evening, USDoD sent a direct note through InfraGard&#8217;s messaging system to an InfraGard member whose personal details were initially published as a teaser on the database sales thread.</p>
<p>That InfraGard member, who is head of security at a major U.S. technology firm, confirmed receipt of USDoD&#8217;s message but asked to remain anonymous for this story.</p>
<p>USDoD acknowledged that their $50,000 asking price for the InfraGard database may be a tad high, given that it is a fairly basic list of people who are already very security-conscious. Also, only about half of the user accounts contain an email address, and most of the other database fields &#8212; like Social Security Number and Date of Birth &#8212; are completely empty.</p>
<p>&#8220;I don&#8217;t think someone will pay that price, but I have to [price it] a bit higher to [negotiate] the price that I want,&#8221; they explained.<span id="more-62084"></span></p>
<p>While the data exposed by the infiltration at InfraGard may be minimal, the user data might not have been the true end game for the intruders.</p>
<p>USDoD said they were hoping the imposter account would last long enough for them to finish sending direct messages as the CEO to other executives using the InfraGuard messaging portal. USDoD shared the following redacted screenshot from what they claimed was one such message, although they provided no additional context about it.</p>
<div id="attachment_62094" style="width: 760px" class="wp-caption aligncenter"><a href="media/7086a09b.infraletter.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/12/infraletter.png" target="_blank" rel="noopener"><img aria-describedby="caption-attachment-62094" loading="lazy" class="wp-image-62094" src="media/7086a09b.infraletter.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/12/infraletter.png" alt="" width="750" height="526" srcset="https://krebsonsecurity.com/wp-content/uploads/2022/12/infraletter.png 989w, https://krebsonsecurity.com/wp-content/uploads/2022/12/infraletter-768x539.png 768w, https://krebsonsecurity.com/wp-content/uploads/2022/12/infraletter-782x549.png 782w, https://krebsonsecurity.com/wp-content/uploads/2022/12/infraletter-100x70.png 100w" sizes="(max-width: 750px) 100vw, 750px" /></a><p id="caption-attachment-62094" class="wp-caption-text">A screenshot shared by USDoD showing a message thread in the FBI&#8217;s InfraGard system.</p></div>
<p>USDoD said in their sales thread that the guarantor for the transaction would be <strong>Pompompurin</strong>, the administrator of the cybercrime forum Breached. By purchasing the database through the forum administrator&#8217;s escrow service, would-be buyers can theoretically avoid getting ripped off and ensure the transaction will be consummated to the satisfaction of both parties before money exchanges hands.</p>
<p>Pompompurin has been a thorn in the side of the FBI for years. Their Breached forum is widely considered to be the second incarnation of <strong>RaidForums</strong>, a remarkably similar English-language cybercrime forum <a href="https://krebsonsecurity.com/2022/04/raidforums-get-raided-alleged-admin-arrested/" target="_blank" rel="noopener">shuttered by the U.S. Department of Justice in April.</a> Prior to its infiltration by the FBI, RaidForums sold access to more than 10 billion consumer records stolen in some of the world&#8217;s largest data breaches.</p>
<p>In November 2021, KrebsOnSecurity detailed how Pompompurin abused a vulnerability in an FBI online portal designed to share information with state and local law enforcement authorities, and how that access was used to <a href="https://krebsonsecurity.com/2021/11/hoax-email-blast-abused-poor-coding-in-fbi-website/" target="_blank" rel="noopener">blast out thousands of hoax email messages &#8212; all sent from an FBI email and Internet address</a>.</p>
<p><strong>Update, 10:58 p.m. ET:</strong> Updated the story after hearing from the financial company CEO whose identity was used to fool the FBI into approving an InfraGard membership. That CEO said they were never contacted by the FBI.</p>
<p><strong>Update, 11:15 p.m. ET: </strong> The FBI just confirmed that it is aware of a potential false account associated with the InfraGard portal. The story now includes their full statement.</p>
<p><em>This is a developing story. Updates will be noted here with timestamps. </em></p>


feed_id: https://krebsonsecurity.com/?p=62050
title: Microsoft Patch Tuesday, December 2022 Edition
uri: Microsoft-Patch-Tuesday-December-2022-Edition
url: https://krebsonsecurity.com/2022/12/microsoft-patch-tuesday-december-2022-edition/
content:
<p><strong>Microsoft</strong> has released its final monthly batch of security updates for 2022, fixing more than four dozen security holes in its various <strong>Windows</strong> operating systems and related software. The most pressing patches include a zero-day in a Windows feature that tries to flag malicious files from the Web, a critical bug in <strong>PowerShell</strong>, and a dangerous flaw in <strong>Windows 11</strong> systems that was detailed publicly prior to this week&#8217;s Patch Tuesday.</p>
<p><img class="aligncenter wp-image-56287" src="media/96fddb2c.windupate.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/07/windupate.png" alt="" width="749" height="527" srcset="https://krebsonsecurity.com/wp-content/uploads/2021/07/windupate.png 841w, https://krebsonsecurity.com/wp-content/uploads/2021/07/windupate-768x541.png 768w, https://krebsonsecurity.com/wp-content/uploads/2021/07/windupate-782x550.png 782w, https://krebsonsecurity.com/wp-content/uploads/2021/07/windupate-100x70.png 100w" sizes="(max-width: 749px) 100vw, 749px" /></p>
<p>The security updates include patches for <strong>Azure</strong>, <strong>Microsoft Edge, </strong><strong>Office</strong>, <strong>SharePoint Server</strong>, <strong>SysInternals</strong>, and the <strong>.NET framework</strong>. Six of the update bundles earned Microsoft&#8217;s most dire &#8220;critical&#8221; rating, meaning they fix vulnerabilities that malware or malcontents can use to remotely commandeer an unpatched Windows system &#8212; with little to no interaction on the part of the user.</p>
<p>The bug already seeing exploitation is <a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-44698" target="_blank" rel="noopener">CVE-2022-44698</a>, which allows attackers to bypass the Windows SmartScreen security feature. The vulnerability allows attackers to craft documents that won&#8217;t get tagged with Microsoft&#8217;s &#8220;Mark of the Web,&#8221; despite being downloaded from untrusted sites.</p>
<p>&#8220;This means no Protected View for Microsoft Office documents, making it easier to get users to do sketchy things like execute malicious macros,<br />
said <strong>Greg Wiseman</strong>, product manager at security firm <strong>Rapid7</strong>. This is the second Mark of the Web flaw Microsoft has patched in as many months; both were first publicly detailed over the past two months <a href="https://twitter.com/wdormann/status/1602727668344053767" target="_blank" rel="noopener">on Twitter by security researcher Will Dormann</a>.<span id="more-62050"></span></p>
<p>Publicly disclosed (but not actively exploited for now) is <a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-44710" target="_blank" rel="noopener">CVE-2022-44710</a>, which is an elevation of privilege flaw in the DirectX graphics component of Windows 11.</p>
<p>Another notable critical bug is <a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-41076" target="_blank" rel="noopener">CVE-2022-41076</a>, a remote code execution flaw in PowerShell &#8212; a key component of Windows that makes it easier to automate system tasks and configurations.</p>
<p><strong>Kevin Breen </strong>at <strong>Immersive Labs</strong> said while Microsoft doesn&#8217;t share much detail about CVE-2022-41076 apart from the designation &#8216;Exploitation More Likely,&#8217; they also note that successful exploitation requires an attacker to take additional actions to prepare the target environment.</p>
<p>&#8220;What actions are required is not clear; however, we do know that exploitation requires an authenticated user level of access,&#8221; Breen said. &#8220;This combination suggests that the exploit requires a social engineering element, and would likely be seen in initial infections using attacks like MalDocs or LNK files.&#8221;</p>
<p>Speaking of malicious documents, <strong>Trend Micro&#8217;s Zero Day Initiative</strong> highlights <a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-44713" target="_blank" rel="noopener">CVE-2022-44713</a>, a spoofing vulnerability in <strong>Outlook for Mac</strong>.</p>
<p>&#8220;We don’t often highlight spoofing bugs, but anytime you’re dealing with a spoofing bug in an e-mail client, you should take notice,&#8221; ZDI&#8217;s <strong>Dustin Childs</strong> wrote. &#8220;This vulnerability could allow an attacker to appear as a trusted user when they should not be. Now combine this with the SmartScreen Mark of the Web bypass and it’s not hard to come up with a scenario where you receive an e-mail that appears to be from your boss with an attachment entitled “Executive_Compensation.xlsx”. There aren’t many who wouldn’t open that file in that scenario.&#8221;</p>
<p>Microsoft also <a href="https://msrc.microsoft.com/update-guide/vulnerability/ADV220005" target="_blank" rel="noopener">released guidance</a> on reports that certain software drivers certified by Microsoft&#8217;s Windows Hardware Developer Program were being used maliciously in post-exploitation activity.</p>
<p>Three different companies reported evidence that malicious hackers were using these signed malicious driver files to lay the groundwork for ransomware deployment inside victim organizations. One of those companies, <strong>Sophos</strong>, published <a href="https://news.sophos.com/en-us/2022/12/13/signed-driver-malware-moves-up-the-software-trust-chain/" target="_blank" rel="noopener">a blog post Tuesday</a> detailing how the activity was tied to the <a href="https://www.cisa.gov/uscert/ncas/alerts/aa22-335a" target="_blank" rel="noopener">Russian ransomware group <strong>Cuba</strong></a>, which has extorted an estimated $60 million from victims since 2019.</p>
<p>Of course, not all scary and pressing security threats are Microsoft-based. Also on Tuesday, <strong>Apple</strong> released a bevy of security updates to iOS, iPadOS, macOS, tvOS and Safari, including  a patch for a <a href="https://thehackernews.com/2022/12/new-actively-exploited-zero-day.html" target="_blank" rel="noopener">newly discovered zero-day vulnerability</a> that could lead to remote code execution.</p>
<p>Anyone responsible for maintaining <strong>Fortinet</strong> or <strong>Citrix</strong> remote access products probably needs to update, as both are dealing with <a href="media/ccd118fe.CSA-APT5-CITRIXADC-V1.PDF" data-original-source="https://media.defense.gov/2022/Dec/13/2003131586/-1/-1/0/CSA-APT5-CITRIXADC-V1.PDF" target="_blank" rel="noopener">active attacks</a> on <a href="https://www.bleepingcomputer.com/news/security/fortinet-says-ssl-vpn-pre-auth-rce-bug-is-exploited-in-attacks/" target="_blank" rel="noopener">just-patched flaws</a>.</p>
<p>For a closer look at the patches released by Microsoft today (indexed by severity and other metrics) check out the <a href="https://isc.sans.edu/forums/diary/Microsoft%20December%202022%20Patch%20Tuesday/29336/" target="_blank" rel="noopener">always-useful Patch Tuesday roundup</a> from the <strong>SANS Internet Storm Center</strong>. And it’s not a bad idea to hold off updating for a few days until Microsoft works out any kinks in the updates: <a href="https://www.askwoody.com/" target="_blank" rel="noopener">AskWoody.com</a> usually has the lowdown on any patches that may be causing problems for Windows users.</p>
<p>As always, please consider backing up your system or at least your important documents and data before applying system updates. And if you run into any problems with these updates, please drop a note about it here in the comments.</p>


feed_id: https://krebsonsecurity.com/?p=62170
title: Six Charged in Mass Takedown of DDoS-for-Hire Sites
uri: Six-Charged-in-Mass-Takedown-of-DDoS-for-Hire-Sites
url: https://krebsonsecurity.com/2022/12/six-charged-in-mass-takedown-of-ddos-for-hire-sites/
content:
<p>The <strong>U.S. Department of Justice</strong> (DOJ) today seized four-dozen domains that sold &#8220;booter&#8221; or &#8220;stresser&#8221; services &#8212; businesses that make it easy and cheap for even non-technical users to launch powerful Distributed Denial of Service (DDoS) attacks designed knock targets offline. The DOJ also charged six U.S. men with computer crimes related to their alleged ownership of the popular DDoS-for-hire services.</p>
<div id="attachment_62176" style="width: 759px" class="wp-caption aligncenter"><a href="media/372fddf3.orphic.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/12/orphic.png" target="_blank" rel="noopener"><img aria-describedby="caption-attachment-62176" class="wp-image-62176" src="media/372fddf3.orphic.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/12/orphic.png" alt="" width="749" height="471" srcset="https://krebsonsecurity.com/wp-content/uploads/2022/12/orphic.png 1100w, https://krebsonsecurity.com/wp-content/uploads/2022/12/orphic-768x483.png 768w, https://krebsonsecurity.com/wp-content/uploads/2022/12/orphic-782x492.png 782w" sizes="(max-width: 749px) 100vw, 749px" /></a><p id="caption-attachment-62176" class="wp-caption-text">The booter service OrphicSecurityTeam[.]com was one of the 48 DDoS-for-hire domains seized by the Justice Department this week.</p></div>
<p>The DOJ said the 48 domains it seized helped paying customers launch millions of digital sieges capable of knocking Web sites and even entire network providers offline.</p>
<p>Booter services are advertised through a variety of methods, including Dark Web forums, chat platforms and even youtube.com. They accept payment via PayPal, Google Wallet, and/or cryptocurrencies, and subscriptions can range in price from just a few dollars to several hundred per month. The services are generally priced according to the volume of traffic to be hurled at the target, the duration of each attack, and the number of concurrent attacks allowed.</p>
<p>Prosecutors in Los Angeles say the booter sites <strong>supremesecurityteam[.]com</strong> and <strong>royalstresser[.]com</strong> were the brainchild of <strong>Jeremiah Sam Evans Miller</strong>, a.k.a. &#8220;John the Dev,&#8221; a 23-year-old from San Antonio, Texas. Miller was charged this week with conspiracy and violations of the Computer Fraud and Abuse Act (CFAA). The complaint against Miller alleges Royalstresser launched nearly 200,000 DDoS attacks between November 2021 and February 2022. </p>
<p>Defendant <strong>Angel Manuel Colon Jr.</strong>, a.k.a Anonghost720 and Anonghost1337, is a 37-year-old from Belleview, Fla. Colon is suspected of running the booter service <strong>securityteam[.]io</strong>. He was also charged with conspiracy and CFAA violations. The feds say the SecurityTeam stresser service conducted 1.3 million attacks between 2018 and 2022, and attracted some 50,000 registered users.</p>
<p>Charged with conspiracy were <strong>Corey Anthony Palmer</strong>, 22, of Lauderhill, Fla, for his alleged ownership of <strong>booter[.]sx</strong>; and <strong>Shamar Shattock</strong>, 19, of Margate, Fla., for allegedly operating the booter service <strong>astrostress[.]com</strong>, which had more than 30,000 users and blasted out some 700,000 attacks.</p>
<p>Two other alleged booter site operators were charged in Alaska. <strong>John M. Dobbs</strong>, 32, of Honolulu, HI is charged with aiding and abetting violations of the CFAA related to the operation of <strong>IPStresser[.]com</strong>, which he allegedly ran for nearly 13 years until last month. During that time, IPstresser <em>launched approximately 30 million DDoS attacks</em> and garnered more than two million registered users.</p>
<p><strong>Joshua Laing</strong>, 32, of Liverpool, NY, also was charged with CFAA infractions tied to his alleged ownership of the booter service <strong>TrueSecurityServices[.]io</strong>, which prosecutors say had 18,000 users and conducted over 1.2 million attacks between 2018 and 2022.</p>
<p>Purveyors of stressers and booters claim they are not responsible for how customers use their services, and that they aren&#8217;t breaking the law because — like most security tools — stresser services can be used for good or bad purposes. For example, all of the above-mentioned booter sites contained wordy &#8220;terms of use&#8221; agreements that required customers to agree they will only stress-test their own networks — and that they won’t use the service to attack others.</p>
<p>But the DOJ says these disclaimers usually ignore the fact that most booter services are heavily reliant on constantly scanning the Internet to commandeer misconfigured devices that are critical for maximizing the size and impact of DDoS attacks.</p>
<p>&#8220;None of these sites ever required the FBI to confirm that it owned, operated, or had any property right to the computer that the FBI attacked during its testing (as would be appropriate if the attacks were for a legitimate or authorized purpose),&#8221; reads <a href="media/986e091d.Booter-2.0-SEIZURE-WARRANT-Namecheap.pdf" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/12/Booter-2.0-SEIZURE-WARRANT-Namecheap.pdf" rel="noopener" target="_blank">an affidavit</a> (PDF) filed by <strong>Elliott Peterson</strong>, a special agent in the FBI&#8217;s Anchorage field office.<span id="more-62170"></span></p>
<p>&#8220;Additionally, analysis of data related to the FBI-initiated attacks revealed that the attacks launched by the SUBJECT DOMAINS involved the extensive misuse of third-party services,&#8221; Peterson continued. &#8220;Specifically, all of the tested services offered &#8216;amplification&#8217; attacks, where the attack traffic is amplified through unwitting third-party servers in order to increase the overall attack size, and to shift the financial burden of generating and transmitting all of that data away from the booter site administrator(s) and onto third parties.&#8221;</p>
<p>According to U.S. federal prosecutors, the use of booter and stresser services to conduct attacks is punishable under both wire fraud laws and the Computer Fraud and Abuse Act (18 U.S.C. § 1030), and may result in arrest and prosecution, the seizure of computers or other electronics, as well as prison sentences and a penalty or fine. </p>
<p>The charges unsealed today stemmed from investigations launched by the FBI&#8217;s field offices in Los Angeles and Alaska, which spent months purchasing and testing attack services offered by the booter sites. </p>
<p>A similar investigation initiating from the FBI&#8217;s Alaska field office in 2018 culminated in <a href="https://krebsonsecurity.com/2018/12/feds-charge-three-in-mass-seizure-of-attack-for-hire-services/" rel="noopener" target="_blank">a takedown and arrest operation that targeted 15 DDoS-for-hire sites</a>, as well as three booter store defendants who later pleaded guilty.</p>
<p>The Justice Department says its trying to impress upon people that even buying attacks from DDoS-for-hire services can land Internet users in legal jeopardy. </p>
<p>&#8220;Whether a criminal launches an attack independently or pays a skilled contractor to carry one out, the FBI will work with victims and use the considerable tools at our disposal to identify the person or group responsible,&#8221; said <strong>Donald Alway</strong>, the assistant director in charge of the FBI&#8217;s Los Angeles field office. </p>
<p>The United Kingdom, which has been battling its fair share of domestic booter bosses, in 2020 <a href="https://krebsonsecurity.com/2020/05/uk-ad-campaign-seeks-to-deter-cybercrime/" rel="noopener" target="_blank">started running online ads aimed at young people who search the Web for booter services</a>. </p>
<p>And in Europe, prosecutors have even <a href="https://krebsonsecurity.com/2019/02/250-webstresser-users-to-face-legal-action/" target="_blank" rel="noopener">gone after booter customers</a>.</p>
<p>Here is the full list of booter site domains seized (or in the process of being seized) by the DOJ:</p>
<p>api-sky[.]xyz<br />
astrostress[.]com<br />
blackstresser[.]net<br />
booter[.]sx<br />
booter[.]vip<br />
bootyou[.]net<br />
brrsecurity[.]org<br />
buuter[.]cc<br />
cyberstress[.]us<br />
defconpro[.]net<br />
dragonstresser[.]com<br />
dreams-stresser[.]io<br />
exotic-booter[.]com<br />
freestresser[.]so<br />
instant-stresser[.]com<br />
ipstress[.]org<br />
ipstress[.]vip<br />
ipstresser[.]com<br />
ipstresser[.]us<br />
ipstresser[.]wtf<br />
ipstresser[.]xyz<br />
kraysec[.]com<br />
mcstorm[.]io<br />
nightmarestresser[.]com<br />
orphicsecurityteam[.]com<br />
ovhstresser[.]com<br />
quantum-stresser[.]net<br />
redstresser[.]cc<br />
royalstresser[.]com<br />
securityteam[.]io<br />
shock-stresser[.]com<br />
silentstress[.]net<br />
stresser[.]app<br />
stresser[.]best<br />
stresser[.]gg<br />
stresser[.]is<br />
stresser[.]net/stresser[.]org<br />
stresser[.]one<br />
stresser[.]shop<br />
stresser[.]so<br />
stresser[.]top<br />
stresserai[.]com<br />
sunstresser[.]com<br />
supremesecurityteam[.]com<br />
truesecurityservices[.]io<br />
vdos-s[.]co<br />
zerostresser[.]com</p>


feed_id: https://krebsonsecurity.com/?p=62207
title: Hacked Ring Cams Used to Record Swatting Victims
uri: Hacked-Ring-Cams-Used-to-Record-Swatting-Victims
url: https://krebsonsecurity.com/2022/12/hacked-ring-cams-used-to-record-swatting-victims/
content:
<div id="attachment_62211" style="width: 759px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-62211" class=" wp-image-62211" src="media/953fce6f.ringdoor.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/12/ringdoor.png" alt="" width="749" height="488" srcset="https://krebsonsecurity.com/wp-content/uploads/2022/12/ringdoor.png 988w, https://krebsonsecurity.com/wp-content/uploads/2022/12/ringdoor-768x501.png 768w, https://krebsonsecurity.com/wp-content/uploads/2022/12/ringdoor-782x510.png 782w" sizes="(max-width: 749px) 100vw, 749px" /><p id="caption-attachment-62211" class="wp-caption-text">Photo: BrandonKleinPhoto / Shutterstock.com</p></div>
<p>Two U.S. men have been charged with hacking into the Ring home security cameras of a dozen random people and then &#8220;swatting&#8221; them &#8212; falsely reporting a violent incident at the target&#8217;s address to trick local police into responding with force. Prosecutors say the duo used the compromised Ring devices to stream live video footage on social media of police raiding their targets&#8217; homes, and to taunt authorities when they arrived.</p>
<p>Prosecutors in Los Angeles allege 20-year-old <strong>James Thomas Andrew McCarty</strong>, a.k.a. &#8220;Aspertaine,&#8221; of Charlotte, N.C., and <strong>Kya Christian Nelson</strong>, a.k.a. &#8220;ChumLul,&#8221; 22, of Racine, Wisc., conspired to hack into <strong>Yahoo</strong> email accounts belonging to victims in the United States. From there, the two allegedly would check how many of those Yahoo accounts were associated with Ring accounts, and then target people who used the same password for both accounts. </p>
<p>An indictment unsealed this week says that in the span of just one week in November 2020, McCarty and Nelson identified and swatted at least a dozen different victims across the country.</p>
<p>&#8220;The defendants then allegedly accessed without authorization the victims&#8217; Ring devices and transmitted the audio and video from those devices on social media during the police response,&#8221; reads <a href="https://www.justice.gov/usao-cdca/pr/grand-jury-indicts-2-swatting-scheme-took-over-ring-doorbells-across-us-livestream" rel="noopener" target="_blank">a statement</a> from <strong>Martin Estrada</strong>, the U.S. Attorney for the Central District of California. &#8220;They also allegedly verbally taunted responding police officers and victims through the Ring devices during several of the incidents.&#8221;</p>
<div id="attachment_62212" style="width: 299px" class="wp-caption alignright"><img aria-describedby="caption-attachment-62212" loading="lazy" class=" wp-image-62212" src="media/a3da20c9.JTAMcCarty-Mugshot.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/12/JTAMcCarty-Mugshot.png" alt="" width="289" height="354" /><p id="caption-attachment-62212" class="wp-caption-text">James Thomas Andrew McCarty.</p></div>
<p>The indictment charges that McCarty continued his swatting spree in 2021 from his hometown in Kayenta, Ariz., where he called in bomb threats or phony hostage situations on more than two dozen occasions.</p>
<p>The <strong>Telegram</strong> and <strong>Discord</strong> aliases allegedly used by McCarty &#8212; &#8220;Aspertaine&#8221; and &#8220;Couch,&#8221; among others &#8212; correspond to an identity that was active in certain channels dedicated to SIM-swapping, a crime that involves stealing wireless phone numbers and hijacking the online financial and social media accounts tied to those numbers.</p>
<p>Aspertaine bragged on Discord that he&#8217;d amassed more than $330,000 in virtual currency. On Telegram, the Aspertaine/Couch alias frequented several popular SIM-swapping channels, where they initially were active as a &#8220;holder&#8221; &#8212; a low-level but key SIM-swapping group member who agrees to hold stolen cryptocurrency after an account takeover is completed. Aspertaine later claimed more direct involvement in individual SIM-swapping attacks.</p>
<p>In September, KrebsOnSecurity broke the news about a wide-ranging federal investigation into &#8220;violence-as-a-service&#8221; offerings on Telegram and other social media networks, wherein people can settle scores by hiring total strangers to carry out physical attacks such as <a href="https://krebsonsecurity.com/2022/09/violence-as-a-service-brickings-firebombings-shootings-for-hire/" target="_blank" rel="noopener">brickings, shootings, and firebombings at a target&#8217;s address</a>.</p>
<p>The story observed that SIM swappers were especially enamored of these &#8220;IRL&#8221; or &#8220;In Real Life&#8221; violence services, which they frequently used to target one another in response to disagreements over how stolen money should be divided amongst themselves. And a number of Aspertaine&#8217;s peers on these SIM-swapping channels claimed they&#8217;d been ripped off after Aspertaine took more than a fair share from co-conspirators.<span id="more-62207"></span></p>
<p>On April 30, 2022, a member of a popular SIM-swapping group on Telegram who was slighted by Aspertaine put out the word that he was looking for some physical violence to be visited on McCarty&#8217;s address in North Carolina. &#8220;Anyone live near here and wants to [do] a job for me,&#8221; the job ad with McCarty&#8217;s home address read. &#8220;Jobs range from $1k-$50k. Payment in BTC [bitcoin].&#8221; It&#8217;s unclear if anyone responded to that job offer.</p>
<p>In May 2021, KrebsOnSecurity published <a href="https://krebsonsecurity.com/2021/05/the-wages-of-password-re-use-your-money-or-your-life/" target="_blank" rel="noopener">The Wages of Password ReUse: Your Money or Your Life</a>, which observed that when normal computer users fall into the nasty habit of recycling passwords, the result is most often some type of financial loss. Whereas, when cybercriminals reuse passwords, it often costs them their freedom.</p>
<p>But perhaps that story should be updated, because it&#8217;s now clear that password reuse can also put you in mortal danger. Swatting attacks are dangerous, expensive hoaxes that sometimes end in tragedy.</p>
<p>In June 2021, an 18-year-old serial swatter from Tennessee was sentenced to five years in prison for his role in a fraudulent swatting attack that <a href="https://krebsonsecurity.com/2021/07/serial-swatter-who-caused-death-gets-five-years-in-prison/" target="_blank" rel="noopener">led to the death of a 60-year-old man</a>.</p>
<p>In 2019, prosecutors handed down a 20-year sentence to <strong>Tyler Barriss</strong>, a then 26-year-old serial swatter from California who admitted making a phony emergency call to police in late 2017 that <a href="https://krebsonsecurity.com/2019/03/man-behind-fatal-swatting-gets-20-years/" target="_blank" rel="noopener">led to the shooting death of an innocent Kansas man</a>.</p>
<p>McCarty was arrested last week in Arizona, and charged with conspiracy to intentionally access computers without authorization. Prosecutors said Nelson is currently incarcerated in Kentucky in connection with unrelated investigation.</p>
<p>If convicted on the conspiracy charge, both defendants would face a statutory maximum penalty of five years in federal prison. The charge of intentionally accessing without authorization a computer carries a maximum possible sentence of five years. A conviction on the additional charge against Nelson &#8212; aggravated identity theft &#8212; carries a mandatory two-year consecutive sentence.</p>


feed_id: https://krebsonsecurity.com/?p=62235
title: The Equifax Breach Settlement Offer is Real, For Now
uri: The-Equifax-Breach-Settlement-Offer-is-Real-For-Now
url: https://krebsonsecurity.com/2022/12/the-equifax-breach-settlement-offer-is-real-for-now/
content:
<p>Millions of people likely just received an email or snail mail notice saying they&#8217;re eligible to claim a class action payment in connection with the 2017 megabreach at consumer credit bureau <strong>Equifax</strong>. Given the high volume of reader inquiries about this, it seemed worth pointing out that while this particular offer is legit (if paltry), scammers are likely to soon capitalize on public attention to the settlement money.</p>
<div id="attachment_62242" style="width: 763px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-62242" class=" wp-image-62242" src="media/50bfcf1b.equifaxbreachsettlementletter.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/12/equifaxbreachsettlementletter.png" alt="" width="753" height="606" srcset="https://krebsonsecurity.com/wp-content/uploads/2022/12/equifaxbreachsettlementletter.png 841w, https://krebsonsecurity.com/wp-content/uploads/2022/12/equifaxbreachsettlementletter-768x618.png 768w, https://krebsonsecurity.com/wp-content/uploads/2022/12/equifaxbreachsettlementletter-782x630.png 782w" sizes="(max-width: 753px) 100vw, 753px" /><p id="caption-attachment-62242" class="wp-caption-text">One reader&#8217;s copy of their Equifax Breach Settlement letter. They received a check for $6.97.</p></div>
<p>In 2017, Equifax disclosed a massive, <a href="https://krebsonsecurity.com/tag/equifax-breach/" target="_blank" rel="noopener">extended data breach</a> that led to the theft of Social Security Numbers, dates of birth, addresses and other personal information on nearly 150 million people. Following a public breach response perhaps best described as <a href="https://krebsonsecurity.com/2017/09/equifax-breach-response-turns-dumpster-fire/" target="_blank" rel="noopener">a giant dumpster fire</a>, the big-three consumer credit reporting bureau was quickly hit with nearly two dozen class-action lawsuits.</p>
<p>In exchange for resolving all outstanding class action claims against it, Equifax in 2019 <a href="https://krebsonsecurity.com/2019/07/what-you-should-know-about-the-equifax-data-breach-settlement/" target="_blank" rel="noopener">agreed to a settlement that includes up to $425 million to help people affected by the breach</a>.</p>
<p>Affected consumers were eligible to apply for at least three years of credit monitoring via all three major bureaus simultaneously, including Equifax, Experian and Trans Union. Or, if you didn&#8217;t want to take advantage of the credit monitoring offers, you could opt for a cash payment of <em>up to</em> $125.</p>
<p>The settlement also offered reimbursement for the time you may have spent remedying identity theft or misuse of your personal information caused by the breach, or purchasing credit monitoring or credit reports. This was capped at 20 total hours at $25 per hour ($500), with total cash reimbursement payments not to exceed $20,000 per consumer.</p>
<p>Those who did file a claim probably started receiving emails or other communications earlier this year from the Equifax Breach Settlement Fund, which has been messaging class participants about methods of collecting their payments.</p>
<p>How much each recipient receives appears to vary quite a bit, but probably most people will have earned a payment on the smaller end of that $125 scale &#8212; like less than $10. Those who received higher amounts likely spent more time documenting actual losses and/or explaining how the breach affected them personally.<span id="more-62235"></span></p>
<p>So far this week, KrebsOnSecurity has received at least 20 messages from readers seeking more information about these notices. Some readers shared copies of letters they got in the mail along with a paper check from the Equifax Breach Settlement Fund (see screenshot above).</p>
<p>Others said they got emails from the Equifax Breach Settlement domain that looked like an animated greeting card offering instructions on how to redeem a virtual prepaid card.</p>
<p><img loading="lazy" class="aligncenter size-full wp-image-62241" src="media/72db8a63.equifaxbreachsettlementcard.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/12/equifaxbreachsettlementcard.png" alt="" width="501" height="770" /></p>
<p>If you received one of these settlement emails and are wary about clicking the included links (good for you, by the way), copy the redemption code and paste it into the search box at <a href="https://myprepaidcenter.com/redeem" target="_blank" rel="noopener">myprepaidcenter.com/redeem</a>. Successfully completing the card application requires <a href="media/8ed365b7.1663705384677_CHA_Mastercard_Disbursements_Virtual_1000135.pdf" data-original-source="https://bes-fenton-production-yourcardhub.s3-us-west-2.amazonaws.com/Cardholder_Agreement/1663705384677_CHA_Mastercard_Disbursements_Virtual_1000135.pdf" target="_blank" rel="noopener">accepting a prepaid MasterCard agreement</a> (PDF).</p>
<p>The website for the settlement &#8212; <a href="https://eligibility.equifaxbreachsettlement.com/en/Eligibility" target="_blank" rel="noopener">equifaxbreachsettlement.com</a> &#8212; also includes a lookup tool that lets visitors check whether they were affected by the breach; it requires your last name and the last six digits of your Social Security Number.</p>
<p>In February 2020, the U.S. Justice Department <a href="https://krebsonsecurity.com/2020/02/u-s-charges-4-chinese-military-officers-in-2017-equifax-hack/" target="_blank" rel="noopener">indicted four Chinese officers of the People&#8217;s Liberation Army</a> (PLA) for perpetrating the 2017 Equifax hack. DOJ officials said the four men were responsible for carrying out the largest theft of sensitive personal information by state-sponsored hackers ever recorded.</p>
<p>Equifax <a href="https://www.nasdaq.com/articles/equifax-efx-surpasses-q3-earnings-and-revenue-estimates" target="_blank" rel="noopener">surpassed Wall Street&#8217;s expectations</a> in its most recently quarterly earnings: The company reported revenues of $1.24 billion for the quarter ending September 2022.</p>
<p>Of course, most of those earnings come from Equifax&#8217;s continued legal ability to buy and sell eye-popping amounts of financial and personal data on U.S. consumers. As one of the three major credit bureaus, Equifax collects and packages information about your credit, salary, and employment history. It tracks how many credit cards you have, how much money you owe, and how you pay your bills. Each company creates a credit report about you, and then sells this report to businesses who are deciding whether to give you credit.</p>
<p>Americans currently have no legal right to opt out of this data collection and trade. But you can and also should and <a href="https://krebsonsecurity.com/2018/09/credit-freezes-are-free-let-the-ice-age-begin/" target="_blank" rel="noopener" data-ss1671561058="1">freeze your credit</a>, which by the way can make your credit profile less profitable for companies like Equifax &#8212; because they make money every time some potential creditor wants a peek inside your financial life. Also, it&#8217;s probably a good idea to freeze the credit of your children and/or dependents as well. It&#8217;s free on both counts.</p>


feed_id: https://krebsonsecurity.com/?p=62266
title: Happy 13th Birthday, KrebsOnSecurity!
uri: Happy-13th-Birthday-KrebsOnSecurity
url: https://krebsonsecurity.com/2022/12/happy-13th-birthday-krebsonsecurity/
content:
<p>KrebsOnSecurity turns 13 years old today. That&#8217;s a crazy long time for an independent media outlet these days, but then again I&#8217;m bound to keep doing this as long as they keep letting me. Heck, I&#8217;ve been doing this so long I briefly forgot which birthday this was!</p>
<p>Thanks to your readership and support, I was able to spend more time in 2022 on some deep, meaty investigative stories &#8212; the really satisfying kind with the potential to affect positive change. Some of that work is highlighted in the 2022 Year in Review review below.</p>
<p>Until recently, I was fairly active on <strong>Twitter</strong>, regularly tweeting to more than 350,000 followers about important security news and stories here. For a variety of reasons, I will no longer be sharing these updates on Twitter. I seem to be doing most of that activity now <a href="https://infosec.exchange/@briankrebs" target="_blank" rel="noopener">on Mastodon</a>, which appears to have absorbed most of the infosec refugees from Twitter, and in any case is proving to be a far more useful, civil and constructive place to post such things. I will also continue to <a href="https://www.linkedin.com/in/bkrebs/" target="_blank" rel="noopener">post on LinkedIn</a> about new stories in 2023.</p>
<p>Here&#8217;s a look at some of the more notable cybercrime stories from the past year, as covered by KrebsOnSecurity and elsewhere. Several strong themes emerged from 2022&#8217;s crop of breaches, including the targeting or impersonating of employees to gain access to internal company tools; multiple intrusions at the same victim company; and less-than-forthcoming statements from victim firms about what actually transpired.</p>
<p><strong>JANUARY</strong></p>
<p>You just knew 2022 was going to be <em>The Year of Crypto Grift</em> when two of the world&#8217;s most popular antivirus makers &#8212; <a href="https://krebsonsecurity.com/2022/01/norton-360-now-comes-with-a-cryptominer/" target="_blank" rel="noopener">Norton</a> and <a href="https://krebsonsecurity.com/2022/01/500m-avira-antivirus-users-introduced-to-cryptomining/" target="_blank" rel="noopener">Avira</a> &#8212; kicked things off by installing cryptocurrency mining programs on customer computers. This bold about-face dumbfounded many longtime Norton users because antivirus firms had spent years broadly classifying all cryptomining programs as malware.</p>
<p><img class="aligncenter wp-image-62309" src="media/99dd76de.nortcrypto.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/12/nortcrypto.png" alt="" width="750" height="353" srcset="https://krebsonsecurity.com/wp-content/uploads/2022/12/nortcrypto.png 833w, https://krebsonsecurity.com/wp-content/uploads/2022/12/nortcrypto-768x361.png 768w, https://krebsonsecurity.com/wp-content/uploads/2022/12/nortcrypto-782x368.png 782w" sizes="(max-width: 750px) 100vw, 750px" /></p>
<p>Suddenly, hundreds of millions of users &#8212; many of them old enough to have bought antivirus from <strong>Peter Norton</strong> himself back in the day &#8212; were being encouraged to start caring about and investing in crypto. Big Yellow and Avira weren&#8217;t the only established brands cashing in on crypto hype as a way to appeal to a broader audience: The venerable electronics retailer <strong>RadioShack</strong> wasted no time in announcing plans to launch <a href="https://www.radioshack.org/" target="_blank" rel="noopener">a cryptocurrency exchange</a>.</p>
<p>By the second week of January, Russia had amassed more than 100,000 troops along its southern border with Ukraine. The Kremlin breaks with all tradition and announces that &#8212; at the request of the United States &#8212; it has <a href="https://krebsonsecurity.com/2022/01/at-request-of-u-s-russia-rounds-up-14-revil-ransomware-affiliates/" target="_blank" rel="noopener">arrested 14 people suspected of working for REvil</a>, one of the more ruthless and profitable Russian ransomware groups.</p>
<p>Security and Russia experts dismiss the low-level arrests as a kind of &#8220;<strong>ransomware diplomacy</strong>,&#8221; a signal to the United States that if it doesn&#8217;t enact severe sanctions against Russia for invading Ukraine, Russia will continue to cooperate on ransomware investigations.</p>
<p>The Jan. 19th story <a href="https://krebsonsecurity.com/2022/01/irs-will-soon-require-selfies-for-online-access/" target="_blank" rel="noopener">IRS Will Soon Require Selfies For Online Access</a> goes immediately viral for pointing out something that apparently nobody has noticed on the <strong>U.S. Internal Revenue Service</strong> website for months: Anyone seeking to create an account to view their tax records online would soon be required to provide biometric data to a private company in Virginia &#8212; <strong>ID.me</strong>.</p>
<p>Facing a backlash from lawmakers and the public, the IRS soon <a href="https://krebsonsecurity.com/2022/02/irs-selfies-now-optional-biometric-data-to-be-deleted/" target="_blank" rel="noopener">reverses course</a>, saying video selfies will be optional and that any biometric data collected will be destroyed after verification.</p>
<p><strong>FEBRUARY</strong></p>
<p>Super Bowl Sunday watchers are treated to no fewer than a half-dozen commercials for cryptocurrency investing. <strong>Matt Damon </strong>sells his soul to <strong>Crypto.com</strong>, telling viewers that &#8220;fortune favors the brave&#8221; &#8212; basically, &#8220;<a href="https://theintercept.com/2022/10/26/matt-damon-crypto-commercial/" target="_blank" rel="noopener">only cowards would fail to buy cryptocurrency at this point</a>.&#8221; Meanwhile, Crypto.com is trying to put space between it and recent headlines that a breach led to $30 million being stolen from hundreds of customer accounts. A single bitcoin is trading at around $45,000.</p>
<p><img loading="lazy" class="aligncenter wp-image-62310" src="media/492b8701.cryptoskeptic.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/12/cryptoskeptic.png" alt="" width="749" height="320" srcset="https://krebsonsecurity.com/wp-content/uploads/2022/12/cryptoskeptic.png 1105w, https://krebsonsecurity.com/wp-content/uploads/2022/12/cryptoskeptic-768x328.png 768w, https://krebsonsecurity.com/wp-content/uploads/2022/12/cryptoskeptic-782x334.png 782w" sizes="(max-width: 749px) 100vw, 749px" /></p>
<p><strong>Larry David</strong>, the comedian who brought us years of awkward hilarity with hits like <strong>Seinfeld</strong> and <strong>Curb Your Enthusiasm</strong>, plays the part of the &#8220;<a href="https://www.inverse.com/input/culture/tom-brady-matt-damon-crypto-ad-spending-down-cryptocom-super-bowl" target="_blank" rel="noopener">doofus, crypto skeptic</a>&#8221; in <a href="https://www.youtube.com/watch?v=hWMnbJJpeZc" target="_blank" rel="noopener">a lengthy Super Bowl ad</a> for <strong>FTX, </strong>a cryptocurrency exchange then valued at over $20 billion that is pitched as a &#8220;safe and easy way to get into crypto.&#8221; [Last month, FTX imploded and filed for bankruptcy; the company&#8217;s founder now faces civil and criminal charges from three different U.S. agencies].</p>
<p>On Feb. 24, Russia invades Ukraine, and fault lines quickly begin to appear in the cybercrime underground. Cybercriminal syndicates that previously straddled Russia and Ukraine with ease are forced to reevaluate many comrades who are suddenly working for The Other Side.</p>
<p>Many cybercriminals who operated with impunity from Russia and Ukraine prior to the war chose to flee those countries following the invasion, presenting international law enforcement agencies with rare opportunities to catch most-wanted cybercrooks. One of those is <strong>Mark Sokolovsky</strong>, a 26-year-old Ukrainian man who operated the popular &#8220;<strong>Raccoon</strong>&#8221; malware-as-a-service offering; Sokolovsky was <a href="https://krebsonsecurity.com/2022/10/accused-raccoon-malware-developer-fled-ukraine-after-russian-invasion/" target="_blank" rel="noopener">busted in March after fleeing Ukraine&#8217;s mandatory military service orders</a>.</p>
<p>Also nabbed on the lam is <strong>Vyacheslav &#8220;Tank&#8221; Penchukov</strong>, a senior Ukrainian member of a transnational cybercrime group that <a href="https://krebsonsecurity.com/2022/11/top-zeus-botnet-suspect-tank-arrested-in-geneva/" target="_blank" rel="noopener">stole tens of millions of dollars over nearly a decade from countless hacked businesses</a>. Penchukov was arrested after leaving Ukraine to meet up with his wife in Switzerland.</p>
<div id="attachment_61804" style="width: 476px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-61804" loading="lazy" class="size-full wp-image-61804" src="media/ea1b4c16.tank-dj.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/11/tank-dj.png" alt="" width="466" height="368" /><p id="caption-attachment-61804" class="wp-caption-text">Tank, seen here performing as a DJ in Ukraine in an undated photo from social media.</p></div>
<p>Ransomware group <strong>Conti</strong> chimes in shortly after the invasion, vowing to attack anyone who tries to stand in Mother Russia&#8217;s way. Within hours of that declaration several years worth of internal chat logs stolen from Conti <a href="https://krebsonsecurity.com/2022/03/conti-ransomware-group-diaries-part-i-evasion/" target="_blank" rel="noopener">were leaked online</a>. The candid employee conversations provide a rare glimpse into the challenges of running a sprawling criminal enterprise with <a href="https://krebsonsecurity.com/2022/03/conti-ransomware-group-diaries-part-ii-the-office/" target="_blank" rel="noopener">more than 100 salaried employees</a>. The records also reveal how Conti dealt with its own internal breaches and attacks from private security firms and foreign governments.</p>
<p>Faced with an increasing brain drain of smart people fleeing the country, Russia floats a new strategy to address a worsening shortage of qualified information technology experts: <a href="https://krebsonsecurity.com/2022/05/russia-to-rent-tech-savvy-prisoners-to-corporate-it/" target="_blank" rel="noopener">Forcing tech-savvy people within the nation’s prison population to perform low-cost IT work for domestic companies</a>.</p>
<p>Chipmaker <strong>NVIDIA</strong> says a cyberattack led to theft of information on more than 71,000 employees. Credit for that intrusion is quickly claimed by <a href="https://krebsonsecurity.com/2022/03/a-closer-look-at-the-lapsus-data-extortion-group/" target="_blank" rel="noopener"><strong>LAPSUS$</strong></a>, a group of 14-18 year-old cyber hooligans mostly from the United Kingdom who specialized in low-tech but highly successful methods of breaking into companies: <a href="https://krebsonsecurity.com/2022/04/the-original-apt-advanced-persistent-teenagers/" target="_blank" rel="noopener">Targeting employees directly over their mobile phones</a>.</p>
<p>LAPSUS$ soon employs these skills to successfully siphon source code and other data from some of the world&#8217;s biggest technology firms, including <strong>Microsoft</strong>, <strong>Okta</strong>, <strong>Samsung</strong>, <strong>T-Mobile</strong> and <strong>Uber</strong>, among many others.<span id="more-62266"></span></p>
<p><strong>MARCH</strong></p>
<p>We learn that criminal hackers are compromising email accounts and websites for police departments worldwide, so that they can <a href="https://krebsonsecurity.com/2022/03/hackers-gaining-power-of-subpoena-via-fake-emergency-data-requests/" target="_blank" rel="noopener">impersonate police and send legal requests to obtain sensitive customer data from mobile providers, ISPs and social media companies</a>. That story prompts revelations that several companies &#8212; including <strong>Apple</strong>, <strong>Discord</strong> and <strong>Meta/Facebook</strong> &#8212; have complied with the fake requests, and <a href="https://krebsonsecurity.com/2022/03/fake-emergency-search-warrants-draw-scrutiny-from-capitol-hill/" target="_blank" rel="noopener">draws the attention of Congress to the problem</a>.</p>
<p><strong>APRIL</strong></p>
<p>It emerges that email marketing giant <strong>Mailchimp</strong> got hacked. The unknown intruders gained access to internal Mailchimp tools and customer data by social engineering employees at the company, and then started <a href="https://www.bleepingcomputer.com/news/security/hackers-breach-mailchimps-internal-tools-to-target-crypto-customers/" target="_blank" rel="noopener">sending targeted phishing attacks to owners of <strong>Trezor</strong> hardware cryptocurrency wallets</a>.</p>
<p>The <strong>FBI</strong> warns about a massive surge in victims from &#8220;<strong>pig butchering</strong>&#8221; scams, in which <a href="https://krebsonsecurity.com/2022/07/massive-losses-define-epidemic-of-pig-butchering/" target="_blank" rel="noopener">flirtatious strangers online lure people into investing in cryptocurrency scams</a>. Investigative reports reveal pig butchering&#8217;s link to organized crime gangs in Asia that attract young job seekers with the promise of customer service jobs. Instead, those who show up at the appointed time and place are kidnapped, trafficked across the border into neighboring countries like Cambodia, and pressed into a life of indentured servitude scamming others online.</p>
<p><div id="attachment_60506" style="width: 759px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-60506" loading="lazy" class=" wp-image-60506" src="media/9ce2762f.xtb-prices.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/07/xtb-prices.png" alt="" width="749" height="500" srcset="https://krebsonsecurity.com/wp-content/uploads/2022/07/xtb-prices.png 1139w, https://krebsonsecurity.com/wp-content/uploads/2022/07/xtb-prices-768x512.png 768w, https://krebsonsecurity.com/wp-content/uploads/2022/07/xtb-prices-782x522.png 782w" sizes="(max-width: 749px) 100vw, 749px" /><p id="caption-attachment-60506" class="wp-caption-text">The now-defunct and always phony cryptocurrency trading platform xtb-market[.]com, which was fed by pig butchering scams.</p></div><strong>MAY</strong></p>
<p>KrebsOnSecurity reports that hackers who specialize in filing fake police requests for subscriber data gained access to a <strong>U.S. Drug Enforcement Administration</strong> (DEA) portal <a href="https://krebsonsecurity.com/2022/05/dea-investigating-breach-of-law-enforcement-data-portal/" target="_blank" rel="noopener">that taps into 16 different federal law enforcement databases</a>.</p>
<p>The government of <strong>Costa Rica</strong> is forced to <a href="https://krebsonsecurity.com/2022/05/costa-rica-may-be-pawn-in-conti-ransomware-groups-bid-to-rebrand-evade-sanctions/" target="_blank" rel="noopener">declare a state of emergency</a> after a ransomware attack by Conti cripples government systems. Conti  publishes nearly 700 GB worth of government records after the country&#8217;s leaders decline to pay a $20 million ransom demand.<!--more--></p>
<p><strong>JUNE</strong></p>
<p>KrebsOnSecurity identifies Russian national <strong>Denis Emelyantsev</strong> <a href="https://krebsonsecurity.com/2022/06/meet-the-administrators-of-the-rsocks-proxy-botnet/" target="_blank" rel="noopener">as the likely owner of the RSOCKS botnet</a>, a collection of millions of hacked devices that were sold as &#8220;proxies&#8221; to cybercriminals looking for ways to route their malicious traffic through someone else&#8217;s computer. Emelyantsev was <a href="https://krebsonsecurity.com/2022/09/accused-russian-rsocks-botmaster-arrested-requests-extradition-to-u-s/" target="_blank" rel="noopener">arrested that same month at a resort in Bulgaria</a>, where he requested and was granted extradition to the United States &#8212;  reportedly telling the judge, &#8220;America is looking for me because I have enormous information and they need it.&#8221;</p>
<div id="attachment_60163" style="width: 759px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-60163" loading="lazy" class=" wp-image-60163" src="media/3d2966f9.klosterphoto.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/06/klosterphoto.png" alt="" width="749" height="417" /><p id="caption-attachment-60163" class="wp-caption-text">The employees who kept things running for RSOCKS, circa 2016. Notice that nobody seems to be wearing shoes.</p></div>
<p><strong>JULY</strong></p>
<p>Big-three consumer credit bureau <strong>Experian</strong> comes under scrutiny after <a href="https://krebsonsecurity.com/2022/07/experian-you-have-some-explaining-to-do/" target="_blank" rel="noopener">KrebsOnSecurity reveals</a> identity thieves are reliably seizing control over consumer credit files by simply re-registering using the target&#8217;s personal information and an email address tied to the crooks. Two months later, Experian would be <a href="https://krebsonsecurity.com/2022/08/class-action-targets-experian-over-account-security/" target="_blank" rel="noopener">hit with a class-action lawsuit</a> over these security and privacy failures.</p>
<p><strong>Twitter</strong> <a href="https://www.bleepingcomputer.com/news/security/twitter-confirms-zero-day-used-to-expose-data-of-54-million-accounts/" target="_blank" rel="noopener">acknowledges</a> that it was relieved of phone numbers and email addresses for 5.4 million users. The security weakness that allowed the data to be collected was <a href="https://hackerone.com/reports/1439026" target="_blank" rel="noopener">patched in January 2022</a>.</p>
<p><strong>AUGUST</strong></p>
<p>Messaging behemoth <strong>Twilio</strong> confirms that data on 125 customers was accessed by intruders, who tricked employees into handing over their login credentials by posing as employees of the company&#8217;s IT department.</p>
<p>Among the Twilio customers targeted was encrypted messaging service <strong>Signal</strong>, which relied on Twilio to provide phone number verification services. Signal said that with their access to Twilio’s internal tools, the attackers were able to re-register those users’ phone numbers to another device.</p>
<p>Food delivery service <strong>DoorDash</strong> <a href="https://doordash.news/get-the-facts/how-were-responding-to-a-third-party-vendor-phishing-incident/" target="_blank" rel="noopener">discloses</a> that a “sophisticated phishing attack” on a third-party vendor allowed attackers to gain access to some of DoorDash’s internal company tools. Thanks to <a href="https://krebsonsecurity.com/2022/08/how-1-time-passcodes-became-a-corporate-liability/" target="_blank" rel="noopener">data left exposed online by the intruders</a>, it becomes clear that DoorDash was victimized by the same group that snookered employees at Twilio, Mailchimp, <strong>CloudFlare</strong>, and dozens of other major companies throughout 2022.</p>
<p><img loading="lazy" class="aligncenter wp-image-62311" src="media/e80c7650.mailchimp.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/12/mailchimp.png" alt="" width="747" height="290" srcset="https://krebsonsecurity.com/wp-content/uploads/2022/12/mailchimp.png 861w, https://krebsonsecurity.com/wp-content/uploads/2022/12/mailchimp-768x298.png 768w, https://krebsonsecurity.com/wp-content/uploads/2022/12/mailchimp-782x303.png 782w" sizes="(max-width: 747px) 100vw, 747px" /></p>
<p>Mailchimp discloses another intrusion involving targeted phishing attacks against employees, wherein hackers stole data on more than 200 Mailchimp customers. Web hosting giant <strong>DigitalOcean</strong> discloses it was one of the victims, and that the intruders used their access to send password reset emails to a number of DigitalOcean customers involved in cryptocurrency and blockchain technologies. DigitalOcean <a href="https://www.digitalocean.com/blog/digitalocean-response-to-mailchimp-security-incident" target="_blank" rel="noopener">severs ties with Mailchimp after that incident</a>, which briefly prevented the hosting firm from communicating with its customers or processing password reset requests.</p>
<p>Password manager service <strong>LastPass</strong> discloses that <a href="https://www.bleepingcomputer.com/news/security/lastpass-developer-systems-hacked-to-steal-source-code/" target="_blank" rel="noopener">its software development environment was breached</a>, and that intruders made off with source code and some proprietary LastPass data. LastPass emphasizes the intruders weren&#8217;t able to access any customer data or encrypted password vaults, and that &#8220;there is no evidence of any threat actor activity beyond the established timeline,&#8221; and &#8220;no evidence that this incident involved any access to customer data or encrypted password vaults.&#8221;</p>
<p><strong>SEPTEMBER</strong></p>
<p>Uber discloses another breach, forcing the company to take several of its internal communications and engineering systems offline as it investigates. The intrusion only comes to light when the hacker uses the company&#8217;s internal Slack channel to boast about their access, listing several internal databases they claimed had been compromised. The intruder told <a href="https://www.nytimes.com/2022/09/15/technology/uber-hacking-breach.html" target="_blank" rel="noopener">The New York Times</a> they got in by sending a text message to an employee while posing as an employee from Uber&#8217;s IT department. Uber blames LAPSUS$ for the intrusion.</p>
<p>Australian telecommunications giant <strong>Optus</strong> suffers <a href="https://www.bbc.com/news/world-australia-63056838" target="_blank" rel="noopener">a data breach involving nearly 10 million customers</a>, including passport or license numbers on almost three million people. The incident dominates headlines and politics in Australia for weeks, as the hacker demands a million dollars in cryptocurrency not to publish the information online. Optus&#8217;s CEO calls the intrusion a &#8220;sophisticated attack,&#8221; but interviews with the hacker reveal they simply enumerated and scraped the data from the Optus website without authentication. After briefly posting 10,000 records from the intrusion, the hacker announces they made a mistake, and deletes the auction.</p>
<p><strong>OCTOBER</strong></p>
<p>A report commissioned by <strong>Sen. Elizabeth Warren</strong> (D-Mass.) reveals that <a href="https://krebsonsecurity.com/2022/10/report-big-u-s-banks-are-stiffing-account-takeover-victims/" target="_blank" rel="noopener">most big U.S. banks are stiffing account takeover victims</a>. Even though U.S. financial institutions are legally obligated to reverse any unauthorized transactions as long as the victim reports the fraud in a timely manner, the report cited figures showing that four of the nation&#8217;s largest banks collectively reimbursed only 47 percent of the dollar amount of claims they received.</p>
<p><img loading="lazy" class="aligncenter wp-image-61495" src="media/a121f46f.zelle.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/10/zelle.png" alt="" width="750" height="499" /></p>
<p><strong>Joe Sullivan</strong>, the former chief security officer for Uber, is <a href="https://www.nytimes.com/2022/10/05/technology/uber-security-chief-joe-sullivan-verdict.html" target="_blank" rel="noopener">found guilty of two felonies</a> after a four-week trial. In 2016, while the <strong>U.S. Federal Trade Commission</strong> was already investigating a 2014 breach at Uber, another security breach affected 57 million Uber account holders and drivers. The intruders demand $100,000, but Sullivan and his team paid the ransom under the company&#8217;s bug bounty program, made the hackers sign a non-disclosure agreement, and concealed the incident from users and investors. The two hackers involved pleaded guilty in 2019; by this time, it has become a nearly everyday occurrence for victim companies to pay to keep a ransomware attack quiet.</p>
<p><strong>NOVEMBER</strong></p>
<p>A ransomware group with ties to REvil begins publishing names, birth dates, passport numbers and information on medical claims on <a href="https://www.theguardian.com/australia-news/2022/dec/01/medibank-hackers-announce-case-closed-and-dump-huge-data-file-on-dark-web" target="_blank" rel="noopener">nearly 10 million current and former customers</a> of Australian health insurer <strong>Medibank</strong>. The data is published after Medibank reportedly declines to pay a US$10 million ransom demand.</p>
<p><strong>DECEMBER</strong></p>
<p>KrebsOnSecurity breaks the news that <strong>InfraGard</strong>, a program run by the <strong>U.S. Federal Bureau of Investigation</strong> (FBI) to build cyber and physical threat information sharing partnerships with the private sector, saw its database of contact information on more than 80,000 members <a href="https://krebsonsecurity.com/2022/12/fbis-vetted-info-sharing-network-infragard-hacked/" target="_blank" rel="noopener">put up for sale on an English-language cybercrime forum</a>. Meanwhile, the hackers responsible were communicating directly with members through the InfraGard portal online — using a new account under the assumed identity of a financial industry CEO that was vetted by the FBI itself.</p>
<p>A cybercriminal <a href="https://infosec.exchange/@briankrebs/109569533436686804" target="_blank" rel="noopener">starts selling account data scraped from 400 million Twitter users</a>, including email addresses and in many cases phone numbers. The seller claims their data was scraped in late December 2021 using the same vulnerability that Twitter patched in January 2022, and that led Twitter to acknowledge the data scraping of 5.4 million user accounts earlier this year. Twitter no longer has a press office, and the company&#8217;s Chief Twit <a href="https://twitter.com/briankrebs/status/1607848771777630209" target="_blank" rel="noopener">has remained silent</a> about the 400 million claim so far, despite <a href="https://www.bbc.com/news/technology-64109777" target="_blank" rel="noopener">many indications that the data is legitimate</a>.</p>
<p>Two days before Christmas, LastPass posted an update on its investigation into the August data breach, saying the intruder was able to use data stolen in the August breach to come back and copy a backup of customer vault data from the encrypted storage container. LastPass&#8217;s lackadaisical disclosure timeline and failure to answer follow-up questions has <a href="https://palant.info/2022/12/26/whats-in-a-pr-statement-lastpass-breach-explained/" target="_blank" rel="noopener">done little to assuage the fears of many users</a>, leaving <em>Wired.com</em> <a href="https://www.wired.com/story/lastpass-breach-vaults-password-managers/?utm_medium=social&amp;utm_social-type=owned&amp;utm_brand=wired&amp;mbid=social_twitter&amp;utm_source=twitter" target="_blank" rel="noopener">to recommend</a> users abandon the platform in favor of the password managers <a href="https://www.1password.com" target="_blank" rel="noopener">1Password</a> and <a href="https://www.bitwarden.com" target="_blank" rel="noopener">Bitwarden</a>.</p>
<p>Also two days before Christmas, KrebsOnSecurity <a href="https://infosec.exchange/@briankrebs/109587022002246891" target="_blank" rel="noopener">notifies Experian</a> that anyone can bypass security questions in their application for a free credit report, meaning identity thieves can access your full credit file with just your name, address, date of birth and Social Security number. Unfortunately, this static data on most Americans has been for sale in the cybercrime underground for years. Experian has yet to say whether it has fixed the problem, but expect to see a full report about this early in the New Year.</p>


feed_id: https://krebsonsecurity.com/?p=62353
title: Identity Thieves Bypassed Experian Security to View Credit Reports
uri: Identity-Thieves-Bypassed-Experian-Security-to-View-Credit-Reports
url:
https://krebsonsecurity.com/2023/01/identity-thieves-bypassed-experian-security-to-view-credit-reports/

content:
<p>Identity thieves have been exploiting a glaring security weakness in the website of <strong>Experian</strong>, one of the big three consumer credit reporting bureaus. Normally, Experian requires that those seeking a copy of their credit report successfully answer several multiple choice questions about their financial history. But until the end of 2022, Experian&#8217;s website allowed anyone to bypass these questions and go straight to the consumer&#8217;s report. All that was needed was the person&#8217;s name, address, birthday and Social Security number.</p>
<div id="attachment_62364" style="width: 760px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-62364" class=" wp-image-62364" src="media/de5efa6a.exp-1.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/01/exp-1.png" alt="" width="750" height="465" srcset="https://krebsonsecurity.com/wp-content/uploads/2023/01/exp-1.png 1544w, https://krebsonsecurity.com/wp-content/uploads/2023/01/exp-1-768x476.png 768w, https://krebsonsecurity.com/wp-content/uploads/2023/01/exp-1-1536x952.png 1536w, https://krebsonsecurity.com/wp-content/uploads/2023/01/exp-1-782x485.png 782w" sizes="(max-width: 750px) 100vw, 750px" /><p id="caption-attachment-62364" class="wp-caption-text">The vulnerability in Experian&#8217;s website was exploitable after one applied to see their credit file via annualcreditreport.com.</p></div>
<p>In December, KrebsOnSecurity heard from <strong>Jenya Kushnir</strong>, a security researcher living in Ukraine who said he discovered the method being used by identity thieves after spending time on <strong>Telegram</strong> chat channels dedicated to the cashing out of compromised identities.</p>
<p>&#8220;I want to try and help to put a stop to it and make it more difficult for [ID thieves] to access, since [Experian is] not doing shit and regular people struggle,&#8221; Kushnir wrote in an email to KrebsOnSecurity explaining his motivations for reaching out. &#8220;If somehow I can make small change and help to improve this, inside myself I can feel that I did something that actually matters and helped others.&#8221;</p>
<p>Kushnir said the crooks learned they could trick Experian into giving them access to anyone&#8217;s credit report, just by editing the address displayed in the browser URL bar at a specific point in Experian&#8217;s identity verification process.</p>
<p>Following Kushnir&#8217;s instructions, I sought a copy of my credit report from Experian via <strong>annualcreditreport.com</strong> &#8212; a website that is required to provide all Americans with a free copy of their credit report from each of the three major reporting bureaus, once per year.</p>
<p>Annualcreditreport.com begins by asking for your name, address, SSN and birthday. After I supplied that and told Annualcreditreport.com I wanted my report from Experian, I was taken to Experian.com to complete the identity verification process.</p>
<p><img loading="lazy" class="aligncenter wp-image-62370" src="media/c5d4749a.exp-ssna.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/01/exp-ssna.png" alt="" width="750" height="465" srcset="https://krebsonsecurity.com/wp-content/uploads/2023/01/exp-ssna.png 1544w, https://krebsonsecurity.com/wp-content/uploads/2023/01/exp-ssna-768x476.png 768w, https://krebsonsecurity.com/wp-content/uploads/2023/01/exp-ssna-1536x952.png 1536w, https://krebsonsecurity.com/wp-content/uploads/2023/01/exp-ssna-782x485.png 782w" sizes="(max-width: 750px) 100vw, 750px" /></p>
<p>Normally at this point, Experian&#8217;s website would present four or five multiple-guess questions, such as &#8220;Which of the following addresses have you lived at?&#8221;</p>
<p>Kushnir told me that when the questions page loads, you simply change the last part of the URL from &#8220;/acr/oow/&#8221; to &#8220;/acr/report,&#8221; and the site would display the consumer&#8217;s full credit report.</p>
<p>But when I tried to get my report from Experian via annualcreditreport.com, Experian&#8217;s website said it didn&#8217;t have enough information to validate my identity. It wouldn&#8217;t even show me the four multiple-guess questions. Experian said I had three options for a free credit report at this point: Mail a request along with identity documents, call a phone number for Experian, or upload proof of identity via the website.</p>
<p>But that didn&#8217;t stop Experian from showing me my full credit report after I changed the Experian URL as Kushnir had instructed &#8212; modifying the error page&#8217;s trailing URL from &#8220;/acr/OcwError&#8221; to simply &#8220;/acr/report&#8221;.</p>
<p>Experian&#8217;s website then immediately displayed my entire credit file.</p>
<p><a href="media/6a9914e1.exp-4.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/01/exp-4.png" target="_blank" rel="noopener"><img loading="lazy" class="aligncenter wp-image-62367" src="media/6a9914e1.exp-4.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/01/exp-4.png" alt="" width="750" height="465" srcset="https://krebsonsecurity.com/wp-content/uploads/2023/01/exp-4.png 1544w, https://krebsonsecurity.com/wp-content/uploads/2023/01/exp-4-768x476.png 768w, https://krebsonsecurity.com/wp-content/uploads/2023/01/exp-4-1536x952.png 1536w, https://krebsonsecurity.com/wp-content/uploads/2023/01/exp-4-782x485.png 782w" sizes="(max-width: 750px) 100vw, 750px" /></a></p>
<p>Even though Experian said it couldn&#8217;t tell that I was actually me, it still coughed up my report. And thank goodness it did. The report contains so many errors that it&#8217;s probably going to take a good deal of effort on my part to straighten out.</p>
<p>Now I know why Experian has NEVER let me view my own file via their website. For example, there were four phone numbers on my Experian credit file: Only one of them was mine, and that one hasn&#8217;t been mine for ages.</p>
<p>I was so dumbfounded by Experian&#8217;s incompetence that I asked a close friend and trusted security source to try the method on her identity file at Experian. Sure enough, when she got to the part where Experian asked questions, changing the last part of the URL in her address bar to &#8220;/report&#8221; bypassed the questions and immediately displayed her full credit report. Her report also was replete with errors.</p>
<p>KrebsOnSecurity shared Kushnir&#8217;s findings with Experian on Dec. 23, 2022. On Dec. 27, 2022, Experian&#8217;s PR team acknowledged receipt of my Dec. 23 notification, but the company has so far ignored multiple requests for comment or clarification.</p>
<p>By the time Experian confirmed receipt of my report, the &#8220;exploit&#8221; Kushnir said he learned from the identity thieves on Telegram had been patched and no longer worked. But it remains unclear how long Experian&#8217;s website was making it so easy to access anyone&#8217;s credit report.</p>
<p>In response to information shared by KrebsOnSecurity, <strong>Senator Ron Wyden </strong>(D-Ore.) said he was disappointed &#8212; but not at all surprised &#8212; to hear about yet another cybersecurity lapse at Experian.</p>
<p>&#8220;The credit bureaus are poorly regulated, act as if they are above the law and have thumbed their noses at Congressional oversight,&#8221; Wyden said in a written statement. &#8220;Just last year, Experian ignored repeated briefing requests from my office after you revealed another cybersecurity lapse the company.&#8221;</p>
<p>Sen. Wyden&#8217;s quote above references a story published here in July 2022, which broke the news that identity thieves were hijacking consumer accounts at Experian.com just by signing up as them at Experian once more, <a href="https://krebsonsecurity.com/2022/07/experian-you-have-some-explaining-to-do/" target="_blank" rel="noopener">supplying the target&#8217;s static, personal information (name, DoB/SSN, address) but a different email address</a>.</p>
<p>From interviews with multiple victims who contacted KrebsOnSecurity after that story, it emerged that Experian&#8217;s own customer support representatives were actually telling consumers who got locked out of their Experian accounts to recreate their accounts using their personal information and a new email address. This was Experian&#8217;s advice even for people who&#8217;d just explained that this method was what identity thieves had used to lock them in out in the first place.<span id="more-62353"></span></p>
<p>Clearly, Experian found it simpler to respond this way, rather than acknowledging the problem and addressing the root causes (lazy authentication and abhorrent account recovery practices). It&#8217;s also worth mentioning that reports of hijacked Experian.com accounts persisted into late 2022. That screw-up has since prompted <a href="https://krebsonsecurity.com/2022/08/class-action-targets-experian-over-account-security/" target="_blank" rel="noopener">a class action lawsuit against Experian</a>.</p>
<p>Sen. Wyden said the <strong>Federal Trade Commission</strong> (FTC) and <strong>Consumer Financial Protection Bureau</strong> (CFPB) need to do much more to protect Americans from screw-ups by the credit bureaus.</p>
<p>&#8220;If they don&#8217;t believe they have the authority to do so, they should endorse legislation like my <a href="https://www.congress.gov/bill/117th-congress/senate-bill/1444" target="_blank" rel="noopener">Mind Your Own Business Act</a>, which gives the FTC power to set tough mandatory cybersecurity standards for companies like Experian,&#8221; Wyden said.</p>
<p>Sadly, none of this is terribly shocking behavior for Experian, which has shown itself a completely negligent custodian of obscene amounts of highly sensitive consumer information.</p>
<p>In April 2021, KrebsOnSecurity revealed how identity thieves were <a href="https://krebsonsecurity.com/2021/04/experians-credit-freeze-security-is-still-a-joke/" target="_blank" rel="noopener">exploiting lax authentication on Experian’s PIN retrieval page to unfreeze consumer credit files</a>. In those cases, Experian failed to send any notice via email when a freeze PIN was retrieved, <em>nor did it require the PIN to be sent to an email address already associated with the consumer’s account</em>.</p>
<p>A few days after that April 2021 story, KrebsOnSecurity broke the news that <a href="https://krebsonsecurity.com/2021/04/experian-api-exposed-credit-scores-of-most-americans/" target="_blank" rel="noopener">an Experian API was exposing the credit scores of most Americans</a>.</p>
<p>It&#8217;s bad enough that we can&#8217;t really opt out of companies like Experian making <a href="https://www.marketwatch.com/investing/stock/expn/financials/income/quarter?countrycode=uk" target="_blank" rel="noopener">$2.6 billion each quarter</a> collecting and selling gobs of our personal and financial information. But there has to be some meaningful accountability when these monopolistic companies engage in negligent and reckless behavior <em>with the very same consumer data that feeds their quarterly profits</em>. Or when security and privacy shortcuts are found to be intentional, like for cost-saving reasons.</p>
<p>And as we saw with Equifax&#8217;s <a href="https://krebsonsecurity.com/2022/12/the-equifax-breach-settlement-offer-is-real-for-now/" target="_blank" rel="noopener">consolidated class-action settlement</a> in response to letting <a href="https://krebsonsecurity.com/2020/02/u-s-charges-4-chinese-military-officers-in-2017-equifax-hack/" target="_blank" rel="noopener">state-sponsored hackers from China</a> steal data on nearly 150 million Americans <a href="https://krebsonsecurity.com/2017/09/breach-at-equifax-may-impact-143m-americans/" target="_blank" rel="noopener">back in 2017</a>, class-actions and more <a href="https://krebsonsecurity.com/2018/11/equifax-has-chosen-experian-wait-what/" target="_blank" rel="noopener">laughable &#8220;free credit monitoring&#8221; services</a> from the very same companies that created the problem aren&#8217;t going to cut it.</p>
<h2>WHAT CAN YOU DO?</h2>
<p>It is easy to adopt a defeatist attitude with the credit bureaus, who often foul things up royally even for consumers who are quite diligent about watching their consumer credit files and disputing any inaccuracies.</p>
<p>But there are some concrete steps that everyone can take which will dramatically lower the risk that identity thieves will ruin your financial future. And happily, most of these steps have the side benefit of costing the credit bureaus money, or at least causing the data they collect about you to become less valuable over time.</p>
<p>The first step is awareness. Find out what these companies are saying about you behind your back. Keep in mind that &#8212; fair or not &#8212; your credit score as collectively determined by these bureaus can affect whether you get that loan, apartment, or job. In that context, even small, unintentional errors that are unrelated to identity theft can have outsized consequences for consumers down the road.</p>
<p>Each bureau is required to provide a free copy of your credit report every year. The easiest way to get yours is through <a href="https://www.annualcreditreport.com" target="_blank" rel="noopener">annualcreditreport.com</a>.</p>
<p>Some consumers report that this site never works for them, and that each bureau will insist they don&#8217;t have enough information to provide a report. I am definitely in this camp. Thankfully, a financial institution that I already have a relationship with offers the ability to view your credit file through them. Your mileage on this front may vary, and you may end up having to send copies of your identity documents through the mail or website.</p>
<p>When you get your report, look for anything that isn&#8217;t yours, and then document and file a dispute with the corresponding credit bureau. And after you&#8217;ve reviewed your report, set a calendar reminder to recur every four months, reminding you it&#8217;s time to get another free copy of your credit file.</p>
<p>If you haven&#8217;t already done so, consider making 2023 the year that you freeze your credit files at the three major reporting bureaus, including Experian, <strong>Equifax</strong> and <strong>TransUnion</strong>. It is <a href="https://krebsonsecurity.com/2018/09/credit-freezes-are-free-let-the-ice-age-begin/" target="_blank" rel="noopener">now free to people in all 50 U.S. states to place a security freeze on their credit files</a>. It is also free to do this for your partner and/or your dependents.</p>
<p>Freezing your credit means no one who doesn&#8217;t already have a financial relationship with you can view your credit file, making it unlikely that potential creditors will grant new lines of credit in your name to identity thieves. Freezing your credit file also means Experian and its brethren can no longer sell peeks at your credit history to others.</p>
<p>Anytime you wish to apply for new credit or a new job, or open an account at a utility or communications provider, you can quickly thaw a freeze on your credit file, and set it to freeze automatically again after a specified length of time.</p>
<p>Please don&#8217;t confuse a credit freeze (a.k.a. &#8220;security freeze&#8221;) with the alternative that the bureaus will likely steer you towards when you ask for a freeze: &#8220;Credit lock&#8221; services.</p>
<p>The bureaus pitch these credit lock services as a way for consumers to easily toggle their credit file availability with push of a button on a mobile app, but they do little to prevent the bureaus from continuing to sell your information to others.</p>
<p>My advice: Ignore the lock services, and just freeze your credit files already.</p>
<p>One final note. Frequent readers here will have noticed that I&#8217;ve criticized these so-called &#8220;<a href="https://krebsonsecurity.com/?s=knowledge-based+authentication" target="_blank" rel="noopener">knowledge-based authentication</a>&#8221; or KBA questions that Experian&#8217;s website failed to ask as part of its consumer verification process.</p>
<p>KrebsOnSecurity has long assailed KBA as weak authentication because the questions and answers are drawn largely from consumer records that are public and easily accessible to organized identity theft groups.</p>
<p>That said, given that these KBA questions appear to be the ONLY thing standing between me and my Experian credit report, it seems like maybe they should at least take care to ensure that those questions actually get asked.</p>


feed_id: https://krebsonsecurity.com/?p=62425
title: Microsoft Patch Tuesday, January 2023 Edition
uri: Microsoft-Patch-Tuesday-January-2023-Edition
url: https://krebsonsecurity.com/2023/01/microsoft-patch-tuesday-january-2023-edition/
content:
<p><strong>Microsoft</strong> today released updates to fix nearly 100 security flaws in its <strong>Windows</strong> operating systems and other software. Highlights from the first <strong>Patch Tuesday</strong> of 2023 include a zero-day vulnerability in Windows, printer software flaws reported by the <strong>U.S. National Security Agency</strong>, and a critical <strong>Microsoft SharePoint Server</strong> bug that allows a remote, unauthenticated attacker to make an anonymous connection.</p>
<p><img class="aligncenter wp-image-60331" src="media/f9a52a5f.winupdatedate.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/07/winupdatedate.png" alt="" width="749" height="496" srcset="https://krebsonsecurity.com/wp-content/uploads/2022/07/winupdatedate.png 923w, https://krebsonsecurity.com/wp-content/uploads/2022/07/winupdatedate-768x508.png 768w, https://krebsonsecurity.com/wp-content/uploads/2022/07/winupdatedate-782x518.png 782w" sizes="(max-width: 749px) 100vw, 749px" /></p>
<p>At least 11 of the patches released today are rated &#8220;Critical&#8221; by Microsoft, meaning they could be exploited by malware or malcontents to seize remote control over vulnerable Windows systems with little or no help from users.</p>
<p>Of particular concern for organizations running <strong>Microsoft SharePoint Server</strong> is <a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21743" target="_blank" rel="noopener">CVE-2023-21743</a>. This is a Critical security bypass flaw that could allow a remote, unauthenticated attacker to make an anonymous connection to a vulnerable SharePoint server. Microsoft says this flaw is &#8220;more likely to be exploited&#8221; at some point.</p>
<p>But patching this bug may not be as simple as deploying Microsoft updates. <strong>Dustin Childs</strong>, head of threat awareness at <strong>Trend Micro&#8217;s Zero Day Initiative</strong>, said sysadmins need to take additional measures to be fully protected from this vulnerability.</p>
<p>&#8220;To fully resolve this bug, you must also trigger a SharePoint upgrade action that’s also included in this update,&#8221; Childs said. &#8220;Full details on how to do this are in the bulletin. Situations like this are why people who scream ‘Just patch it!’ show they have never actually had to patch an enterprise in the real world.&#8221;</p>
<p>Eighty-seven of the vulnerabilities earned Redmond&#8217;s slightly less dire &#8220;Important&#8221; severity rating. That designation describes vulnerabilities &#8220;whose exploitation could result in compromise of the confidentiality, integrity, or availability of user data, or of the integrity or availability of processing resources.&#8221;</p>
<p>Among the more Important bugs this month is <a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21674" target="_blank" rel="noopener">CVE-2023-21674</a>, which is an &#8220;elevation of privilege&#8221; weakness in most supported versions of Windows that has already been abused in active attacks.</p>
<p><strong>Satnam Narang</strong>, senior staff research engineer at <strong>Tenable</strong>, said although details about the flaw were not available at the time Microsoft published its advisory on Patch Tuesday, it appears this was likely chained together with a vulnerability in a Chromium-based browser such as Google Chrome or Microsoft Edge in order to break out of a browser’s sandbox and gain full system access.</p>
<p>&#8220;Vulnerabilities like CVE-2023-21674 are typically the work of advanced persistent threat (APT) groups as part of targeted attacks,&#8221; Narang said. &#8220;The likelihood of future widespread exploitation of an exploit chain like this is limited due to auto-update functionality used to patch browsers.&#8221;<span id="more-62425"></span></p>
<p>By the way, when was the last time you completely closed out your Web browser and restarted it? Some browsers will automatically download and install new security updates, but the protection from those updates usually only happens after you restart the browser.</p>
<p>Speaking of APT groups, the U.S. National Security Agency is credited with reporting <a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21678" target="_blank" rel="noopener">CVE-2023-21678</a>, which is another &#8220;important&#8221; vulnerability in the Windows Print Spooler software.</p>
<p>There have been so many vulnerabilities patched in Microsoft&#8217;s printing software over the past year (including the dastardly <a href="https://krebsonsecurity.com/2021/07/microsoft-issues-emergency-patch-for-windows-flaw/" target="_blank" rel="noopener">PrintNightmare attacks and borked patches</a>) that KrebsOnSecurity has joked about Patch Tuesday reports being sponsored by Print Spooler. Tenable&#8217;s Narang points out that this is the third Print Spooler flaw the NSA has reported in the last year.</p>
<p><strong>Kevin Breen</strong> at <strong>Immersive Labs</strong> called special attention to <a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21563" target="_blank" rel="noopener">CVE-2023-21563</a>, which is a security feature bypass in <strong>BitLocker</strong>, the data and disk encryption technology built into enterprise versions of Windows.</p>
<p>&#8220;For organizations that have remote users, or users that travel, this vulnerability may be of interest,&#8221; Breen said. &#8220;We rely on BitLocker and full-disk encryption tools to keep our files and data safe in the event a laptop or device is stolen. While information is light, this appears to suggest that it could be possible for an attacker to bypass this protection and gain access to the underlying operating system and its contents. If security teams are not able to apply this patch, one potential mitigation could be to ensure Remote Device Management is deployed with the ability to remotely disable and wipe assets.&#8221;</p>
<p>There are also two <strong>Microsoft Exchange</strong> vulnerabilities patched this month &#8212; <a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21762" target="_blank" rel="noopener">CVE-2023-21762</a> and <a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21745" target="_blank" rel="noopener">CVE-2023-21745</a>. Given the rapidity with which threat actors exploit new Exchange bugs to steal corporate email and infiltrate vulnerable systems, organizations using Exchange should patch immediately. Microsoft&#8217;s advisory says these Exchange flaws are indeed &#8220;more likely to be exploited.&#8221;</p>
<p><strong>Adobe</strong> released four patches addressing 29 flaws in <strong>Adobe Acrobat</strong> and <strong>Reader</strong>, <strong>InDesign</strong>, <strong>InCopy</strong>, and <strong>Adobe Dimension</strong>. The update for Reader fixes 15 bugs with eight of these being ranked Critical in severity (allowing arbitrary code execution if an affected system opened a specially crafted file).</p>
<p>For a more granular rundown on the updates released today, see <a href="https://isc.sans.edu/forums/diary/Microsoft%20January%202023%20Patch%20Tuesday/29420/" target="_blank" rel="noopener">the SANS Internet Storm Center roundup</a>. Nearly 100 updates is a lot, and there are bound to be a few patches that cause problems for organizations and end users. When that happens, <a href="https://www.askwoody.com/2023/batten-down-the-hatches-for-january-updates/" target="_blank" rel="noopener">AskWoody.com</a> usually has the lowdown.</p>
<p>Please consider backing up your data and/or imaging your system before applying any updates. And please sound off in the comments if you experience any problems as a result of these patches.</p>


